Free Malware Removal Forum

by **Nenad** » August 4th, 2009, 10:48 pm

Hello,

I think I may have caught some malware and I need help removing it. The symptoms I am experiencing are:

1. Cannot redirect from igoogle.com to gmail.com (using any of chrome, firefox, opera or IE8)
2. On shutdown, rundll32.exe reports an error and hangs until the error message is cleared
3. IE8 will open a window after a short while of usage, and will invoke a url that starts with url.urtbk.com, which then will redirect to yet another site.
4. The computer is generally very slow to unusable at times.

I am running windows XP Home, with the latest updates, and also an up-to-date norton anti-virus (apparently that didn't help with this problem too much). I also read a few topics posted earlier to this forum, and have downloaded and installed Malwarebyte's Antimalware, and Trend's HijackThis, but have not run either of the tools.

Please advise.

Thanks,
N.

HijackThis.log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:39:19 PM, on 8/4/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLSDBNT.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Norton AntiVirus\Engine\16.5.0.134\ccSvcHst.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLPWDNT.EXE
C:\WINDOWS\stsystra.exe
C:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLPSP.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Norton AntiVirus\Engine\16.5.0.134\ccSvcHst.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Documents and Settings\Nenad\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Nenad\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Java\jre6\bin\jucheck.exe
C:\Documents and Settings\Nenad\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Nenad\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Nenad\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Nenad\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\Mozilla Thunderbird\thunderbird.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton AntiVirus\Engine\16.5.0.134\IPSBHO.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [DLPSP] "c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLPSP.EXE"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Nenad\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-21-1757981266-1844823847-1801674531-1005\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'Katarina')
O4 - HKUS\S-1-5-21-1757981266-1844823847-1801674531-1005\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Katarina')
O4 - HKUS\S-1-5-21-1757981266-1844823847-1801674531-1005\..\Run: [Google Update] "C:\Documents and Settings\Katarina\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c (User 'Katarina')
O4 - HKUS\S-1-5-21-1757981266-1844823847-1801674531-1005\..\Run: [A00F17150E.exe] C:\DOCUME~1\Katarina\LOCALS~1\Temp\_A00F17150E.exe (User 'Katarina')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 3557333390
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 3550020109
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D092B8F6-D1F0-46DC-97BC-84FEDD3A1E7C}: NameServer = 65.39.192.198,65.39.196.215
O20 - AppInit_DLLs: C:\WINDOWS\System32\gcdef32.dll
O20 - Winlogon Notify: 500c3832651 - C:\WINDOWS\System32\gcdef32.dll
O20 - Winlogon Notify: __c001934D - C:\WINDOWS\system32\__c001934D.dat
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Dell Printer Status Watcher (DLPWD) - Dell Inc. - c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLPWDNT.EXE
O23 - Service: Dell Printer Status Database (DLSDB) - Dell Inc. - c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLSDBNT.EXE
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Norton AntiVirus - Symantec Corporation - C:\Program Files\Norton AntiVirus\Engine\16.5.0.134\ccSvcHst.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe

--
End of file - 8370 bytes

by **MWR 3 day Mod** » August 8th, 2009, 5:02 am

Hi,

We are sorry to see your topic is over three days old and no one has yet been able to respond and offer help.

If you still require assistance, please post a link to your topic in our Waiting for help with malware removal? forum, and our staff will make an effort to assist you as promptly as possible. Only post a LINK to this topic, DO NOT post your DDS log!

Please do not reply to this topic.

If you haven't posted within two days in the "Waiting for help with malware removal?" forum, we will assume you have been able to get assistance in other ways and this topic will be closed.

by **Shaba** » August 8th, 2009, 5:12 am

Hi Nenad

We will begin with ComboFix. Please visit this webpage for download links, and instructions for running the tool:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix, link
Remember to re-enable them afterwards.
Click Yes to allow ComboFix to continue scanning for malware.

When the tool is finished, it will produce a report for you.

Please include the following reports for further review, and so we may continue cleansing the system:

C:\ComboFix.txt
New HijackThis log.

A word of warning: Please do not run ComboFix on your own. This tool is not a toy and not for everyday use.

by **Nenad** » August 8th, 2009, 12:53 pm

Hi Shaba,

Thanks for replying to my post. I understand you guys are rather busy at the moment. I ran the tools like you asked. ComboFix reported that Norton AV was still running even after I had disabled the service and rebooted. After a while it finished and produced the log below. It had also rebooted the computer in the course of action.

The hijackThis log is following below as well.

Thanks,
N.

Combofix.log:

ComboFix 09-08-07.09 - Nenad 08/08/2009 12:11.1.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1014.634 [GMT -4:00]
Running from: c:\documents and settings\Nenad\Desktop\ComboFix.exe
AV: Norton AntiVirus *On-access scanning enabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Katarina\Application Data\02000000bf4249e0651C.manifest
c:\documents and settings\Katarina\Application Data\02000000bf4249e0651O.manifest
c:\documents and settings\Katarina\Application Data\02000000bf4249e0651P.manifest
c:\documents and settings\Katarina\Application Data\02000000bf4249e0651S.manifest
c:\documents and settings\Nenad\Application Data\02000000bf4249e0651C.manifest
c:\documents and settings\Nenad\Application Data\02000000bf4249e0651O.manifest
c:\documents and settings\Nenad\Application Data\02000000bf4249e0651P.manifest
c:\documents and settings\Nenad\Application Data\02000000bf4249e0651S.manifest
c:\program files\Common Files\Real\WeatherBug\MiniBugTransporter.dll
c:\recycler\S-1-5-21-117609710-220523388-725345543-1004
c:\recycler\S-1-5-21-2487558442-1393283963-623444354-1006
c:\recycler\S-1-5-21-2487558442-1393283963-623444354-1007
c:\recycler\S-1-5-21-2487558442-1393283963-623444354-1012
c:\recycler\S-1-5-21-2487558442-1393283963-623444354-1014
c:\windows\GnuHashes.ini
c:\windows\system32\__c001934D.dat
c:\windows\system32\__c00748C2.dat
c:\windows\system32\1.tmp
c:\windows\system32\4.tmp
c:\windows\system32\FlRniVv.vbs
c:\windows\system32\GroupPolicy000.dat
c:\windows\system32\SystemX86
c:\windows\system32\SystemX86\245.crack.zip
c:\windows\system32\SystemX86\245.crack.zip.kwd
c:\windows\system32\SystemX86\246.keygen.zip
c:\windows\system32\SystemX86\246.keygen.zip.kwd
c:\windows\system32\SystemX86\247.serial.zip
c:\windows\system32\SystemX86\247.serial.zip.kwd
c:\windows\system32\SystemX86\248.setup.zip
c:\windows\system32\SystemX86\248.setup.zip.kwd
c:\windows\system32\SystemX86\249.music.au
c:\windows\system32\SystemX86\249.music.au.kwd
c:\windows\system32\SystemX86\250.music2.au
c:\windows\system32\SystemX86\250.music2.au.kwd
c:\windows\system32\SystemX86\251.music3.au
c:\windows\system32\SystemX86\251.music3.au.kwd
c:\windows\system32\SystemX86\252.music.snd
c:\windows\system32\SystemX86\252.music.snd.kwd

.
((((((((((((((((((((((((( Files Created from 2009-07-08 to 2009-08-08 )))))))))))))))))))))))))))))))
.

2009-08-08 16:28 . 2009-08-08 16:28 -------- d-sh--w- c:\windows\system32\SystemX86
2009-08-08 16:10 . 2009-08-08 16:10 -------- d-----w- C:\32788R22FWJFW
2009-08-08 16:05 . 2009-08-08 16:05 -------- d-----w- c:\documents and settings\Nenad\Local Settings\Application Data\Symantec
2009-08-08 05:21 . 2009-07-13 08:00 87888 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090807.024\NAVENG.SYS
2009-08-08 05:21 . 2009-07-13 08:00 875728 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090807.024\NAVEX15.SYS
2009-08-08 05:21 . 2009-02-25 09:00 371248 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090807.024\EECTRL.SYS
2009-08-08 05:21 . 2009-02-25 09:00 2414128 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090807.024\CCERASER.DLL
2009-08-08 05:21 . 2009-02-25 09:00 101936 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090807.024\ERASER.SYS
2009-08-08 05:21 . 2009-02-19 09:00 177520 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090807.024\NAVENG32.DLL
2009-08-08 05:21 . 2009-02-19 09:00 1181040 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090807.024\NAVEX32A.DLL
2009-08-08 05:21 . 2008-12-05 09:52 259368 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090807.024\ECMSVR32.DLL
2009-08-04 21:26 . 2009-08-04 21:26 -------- d-----w- c:\program files\Trend Micro
2009-08-04 20:21 . 2009-08-04 20:21 -------- d-----w- c:\documents and settings\Nenad\Application Data\Malwarebytes
2009-08-04 20:21 . 2009-08-03 17:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-04 20:21 . 2009-08-04 20:21 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes
2009-08-04 20:21 . 2009-08-03 17:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-08-04 20:21 . 2009-08-05 02:38 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-08-01 20:46 . 2009-08-01 20:46 121856 ----a-w- c:\windows\system32\gcdef32.dll
2009-07-30 22:34 . 2009-07-11 19:34 276344 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090730.003\IDSXpx86.sys
2009-07-30 22:34 . 2009-07-11 19:34 293424 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090730.003\IDSvix86.sys
2009-07-30 22:34 . 2009-07-11 19:34 533880 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090730.003\Scxpx86.dll
2009-07-30 22:34 . 2009-07-11 19:34 451960 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090730.003\IDSxpx86.dll
2009-07-30 22:34 . 2009-07-11 19:34 397360 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090730.003\IDSviA64.sys
2009-07-27 22:02 . 2009-07-11 19:34 276344 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090722.001\IDSXpx86.sys
2009-07-27 22:02 . 2009-07-11 19:34 293424 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090722.001\IDSvix86.sys
2009-07-27 22:02 . 2009-07-11 19:34 533880 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090722.001\Scxpx86.dll
2009-07-27 22:02 . 2009-07-11 19:34 451960 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090722.001\IDSxpx86.dll
2009-07-27 22:02 . 2009-07-11 19:34 397360 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090722.001\IDSviA64.sys
2009-07-21 01:06 . 2009-07-21 01:06 -------- d-sh--w- c:\documents and settings\Katarina\PrivacIE
2009-07-20 01:10 . 2009-06-29 19:28 106496 ----a-w- c:\documents and settings\Nenad\Application Data\Mozilla\Plugins\npcoolirisplugin.dll
2009-07-20 01:10 . 2009-06-29 19:28 937984 ----a-w- c:\documents and settings\Nenad\Application Data\Mozilla\Firefox\Profiles\va7e7u35.default\extensions\piclens@cooliris.com\libs\PicLensHelper.exe
2009-07-20 01:10 . 2009-06-29 19:28 106496 ----a-w- c:\documents and settings\Nenad\Application Data\Mozilla\Firefox\Profiles\va7e7u35.default\extensions\piclens@cooliris.com\libs\npcoolirisplugin.dll
2009-07-20 01:10 . 2009-06-29 19:28 103424 ----a-w- c:\documents and settings\Nenad\Application Data\Mozilla\Firefox\Profiles\va7e7u35.default\extensions\piclens@cooliris.com\libs\pixomatic.dll
2009-07-20 01:10 . 2009-06-29 19:28 65536 ----a-w- c:\documents and settings\Nenad\Application Data\Mozilla\Firefox\Profiles\va7e7u35.default\extensions\piclens@cooliris.com\components\coolirisstub.dll
2009-07-20 01:10 . 2009-06-29 19:28 4734976 ----a-w- c:\documents and settings\Nenad\Application Data\Mozilla\Firefox\Profiles\va7e7u35.default\extensions\piclens@cooliris.com\libs\cooliris19.dll
2009-07-20 01:10 . 2009-06-29 19:28 344064 ----a-w- c:\documents and settings\Nenad\Application Data\Mozilla\Firefox\Profiles\va7e7u35.default\extensions\piclens@cooliris.com\libs\LaunchCooliris.exe
2009-07-19 11:27 . 2009-07-31 19:28 -------- d-----w- c:\documents and settings\Nenad\Local Settings\Application Data\Temp
2009-07-17 19:18 . 2009-08-02 14:54 -------- d-----w- c:\documents and settings\Katarina\Local Settings\Application Data\Temp
2009-07-17 04:05 . 2009-07-17 04:05 -------- d-----w- c:\program files\iPod
2009-07-17 03:51 . 2009-07-17 03:51 75040 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Apple Computer\Installer Cache\iTunes 8.2.1.6\SetupAdmin.exe
2009-07-11 19:34 . 2009-07-11 19:34 276344 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\IDSXpx86.sys
2009-07-11 19:34 . 2009-07-11 19:34 293424 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\IDSvix86.sys
2009-07-11 19:34 . 2009-07-11 19:34 533880 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\Scxpx86.dll
2009-07-11 19:34 . 2009-07-11 19:34 451960 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\IDSxpx86.dll
2009-07-11 19:34 . 2009-07-11 19:34 397360 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\IDSviA64.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-08 16:28 . 2009-08-08 16:28 0 ----a-w- c:\windows\system32\GroupPolicy000.dat
2009-08-08 16:28 . 2009-08-08 16:27 518144 --sha-w- c:\windows\system32\2.tmp
2009-08-07 22:40 . 2006-04-14 15:53 -------- d-----w- c:\program files\Mozilla Thunderbird
2009-08-01 20:50 . 2009-02-06 14:20 -------- d-----w- c:\documents and settings\Nenad\Application Data\LimeWire
2009-08-01 14:04 . 2009-02-02 03:55 -------- d-----w- c:\program files\Microsoft Silverlight
2009-07-18 12:21 . 2009-02-03 05:11 -------- d-----w- c:\documents and settings\Nenad\Application Data\uTorrent
2009-07-17 04:17 . 2009-03-12 22:45 -------- d-----w- c:\program files\Safari
2009-07-17 04:05 . 2009-06-19 02:03 -------- d-----w- c:\program files\iTunes
2009-07-03 17:09 . 2006-03-04 03:33 915456 ----a-w- c:\windows\system32\wininet.dll
2009-06-27 00:53 . 2009-06-27 00:53 -------- d-----w- c:\documents and settings\Nenad\Application Data\Canon
2009-06-19 04:24 . 2009-02-02 06:14 -------- d-----w- c:\documents and settings\Nenad\Application Data\Apple Computer
2009-06-19 02:01 . 2009-06-19 02:00 -------- d-----w- c:\program files\QuickTime
2009-06-19 01:58 . 2009-02-02 06:09 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Apple
2009-06-16 14:36 . 2004-08-04 10:00 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:36 . 2004-08-04 10:00 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-11 11:38 . 2006-11-21 02:26 -------- d-----w- c:\program files\Java
2009-06-11 11:37 . 2009-06-11 11:37 152576 ----a-w- c:\documents and settings\Nenad\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-06-05 15:42 . 2009-03-12 23:15 2060288 ----a-w- c:\windows\system32\usbaaplrc.dll
2009-06-05 15:42 . 2009-02-02 06:13 39424 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2009-06-03 19:09 . 2004-08-04 10:00 1291264 ----a-w- c:\windows\system32\quartz.dll
2009-05-29 20:31 . 2009-06-19 01:29 65536 ----a-w- c:\documents and settings\Nenad\Application Data\Mozilla\Firefox\Profiles\va7e7u35.default\extensions\piclens@cooliris.com-trash\components\coolirisstub.dll
2009-05-29 20:31 . 2009-06-19 01:29 4616192 ----a-w- c:\documents and settings\Nenad\Application Data\Mozilla\Firefox\Profiles\va7e7u35.default\extensions\piclens@cooliris.com-trash\libs\cooliris19.dll
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\opera\program\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\opera\program\plugins\ssldivx.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\Nenad\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-02-02 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-18 13574144]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-09-30 155648]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-18 86016]
"DLPSP"="c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLPSP.EXE" [2005-01-13 126976]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-10-15 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-10-15 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-10-15 114688]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-05-14 177472]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-09-18 1657376]
"SigmatelSysTrayApp"="stsystra.exe" - c:\windows\stsystra.exe [2005-03-23 339968]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\500c3832651]
2009-08-01 20:46 121856 ----a-w- c:\windows\system32\gcdef32.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]
@="FSFilter Activity Monitor"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\WINDOWS\\explorer.exe"=

R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NAV\1005000.086\SymEFA.sys [3/20/2009 11:13 PM 310320]
R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\NAV\1005000.086\BHDrvx86.sys [3/20/2009 11:13 PM 258608]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NAV\1005000.086\cchpx86.sys [3/20/2009 11:12 PM 482352]
R1 IDSxpx86;IDSxpx86;c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090730.003\IDSXpx86.sys [7/30/2009 6:34 PM 276344]
R2 DLSDB;Dell Printer Status Database;c:\program files\Dell Printers\Additional Color Laser Software\Status Monitor\dlsdbnt.exe [4/19/2006 11:28 PM 135168]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2/25/2009 9:51 PM 101936]
S3 Drmuhccr6-d;Drmuhccr6-d;c:\windows\system32\drivers\nwlnkipx.sys [8/4/2004 6:00 AM 88320]
S4 Norton AntiVirus;Norton AntiVirus;c:\program files\Norton AntiVirus\Engine\16.5.0.134\ccSvcHst.exe [3/20/2009 11:12 PM 115560]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-07-30 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2009-08-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1757981266-1844823847-1801674531-1004Core.job
- c:\documents and settings\Nenad\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-02-02 04:01]

2009-08-08 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1757981266-1844823847-1801674531-1004UA.job
- c:\documents and settings\Nenad\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-02-02 04:01]

2009-08-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1757981266-1844823847-1801674531-1005Core.job
- c:\documents and settings\Katarina\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-02-24 04:03]

2009-08-08 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1757981266-1844823847-1801674531-1005UA.job
- c:\documents and settings\Katarina\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-02-24 04:03]

2009-08-08 c:\windows\Tasks\User_Feed_Synchronization-{4E073B3C-B0A7-42D6-A028-6E7D40EF776B}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 08:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.ca/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
TCP: {D092B8F6-D1F0-46DC-97BC-84FEDD3A1E7C} = 65.39.192.198,65.39.196.215
FF - ProfilePath - c:\documents and settings\Nenad\Application Data\Mozilla\Firefox\Profiles\va7e7u35.default\
FF - component: c:\documents and settings\Nenad\Application Data\Mozilla\Firefox\Profiles\va7e7u35.default\extensions\piclens@cooliris.com\components\coolirisstub.dll
FF - plugin: c:\documents and settings\Nenad\Application Data\Mozilla\plugins\npcoolirisplugin.dll
FF - plugin: c:\documents and settings\Nenad\Local Settings\Application Data\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\Opera\program\plugins\npdivx32.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-08 12:27
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Norton AntiVirus]
"ImagePath"="\"c:\program files\Norton AntiVirus\Engine\16.5.0.134\ccSvcHst.exe\" /s \"Norton AntiVirus\" /m \"c:\program files\Norton AntiVirus\Engine\16.5.0.134\diMaster.dll\" /prefetch:1"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(960)
c:\windows\System32\gcdef32.dll

- - - - - - - > 'explorer.exe'(1520)
c:\windows\system32\WININET.dll
c:\windows\System32\gcdef32.dll
c:\windows\system32\2.tmp
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\program files\Bonjour\mdnsNSP.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Dell Printers\Additional Color Laser Software\Status Monitor\dlpwdnt.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2009-08-08 12:40 - machine was rebooted
ComboFix-quarantined-files.txt 2009-08-08 16:40

Pre-Run: 29,106,757,632 bytes free
Post-Run: 36,611,887,104 bytes free

239 --- E O F --- 2009-07-31 07:00

HijackThis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:44:14 PM, on 8/8/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLSDBNT.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLPWDNT.EXE
C:\WINDOWS\stsystra.exe
C:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLPSP.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton AntiVirus\Engine\16.5.0.134\IPSBHO.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [DLPSP] "c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLPSP.EXE"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Nenad\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 3557333390
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 3550020109
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D092B8F6-D1F0-46DC-97BC-84FEDD3A1E7C}: NameServer = 65.39.192.198,65.39.196.215
O20 - Winlogon Notify: 500c3832651 - C:\WINDOWS\System32\gcdef32.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Dell Printer Status Watcher (DLPWD) - Dell Inc. - c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLPWDNT.EXE
O23 - Service: Dell Printer Status Database (DLSDB) - Dell Inc. - c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLSDBNT.EXE
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 6044 bytes

by **Shaba** » August 8th, 2009, 1:09 pm

To access the Uninstall Manager you would do the following:

1. Start HijackThis
2. Click on the Config button
3. Click on the Misc Tools button
4. Click on the Open Uninstall Manager button.

You will now be presented with a screen similar to the one below:

5. Click on the Save list... button and specify where you would like to save this file. When you press Save button a notepad will open with the contents of that file. Simply copy and paste the contents of that notepad here on your next reply.

by **Nenad** » August 8th, 2009, 3:22 pm

Uninstall manager log:

Acrobat.com
Acrobat.com
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 9.1.2
Apple Mobile Device Support
Apple Software Update
Bonjour
Canon CanoScan Toolbox 5.0
CanoScan LiDE 70
Critical Update for Windows Media Player 11 (KB959772)
Dell Printer Software
DivX Codec
DivX Converter
DivX Player
DivX Plus DirectShow Filters
DivX Web Player
GIMP 2.6.4
HijackThis 2.0.2
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB952287)
Intel(R) Graphics Media Accelerator Driver
Intel(R) PRO Network Connections Drivers
iTunes
IZArc 3.81
Java DB 10.4.1.3
Java(TM) 6 Update 13
Java(TM) SE Development Kit 6 Update 12
Malwarebytes' Anti-Malware
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Standard Edition 2003
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.0
MobileMe Control Panel
Mozilla Firefox (3.0.12)
Mozilla Thunderbird (2.0.0.22)
MSXML 4.0 SP2 (KB954430)
Nero 7 Demo
Norton AntiVirus
NVIDIA Drivers
Opera 9.62
QuickTime
Safari
Security Update for CAPICOM (KB931906)
Security Update for CAPICOM (KB931906)
Security Update for Windows Internet Explorer 7 (KB938127-v2)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 8 (KB969897)
Security Update for Windows Internet Explorer 8 (KB972260)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB973346)
TextPad 5
Update for Windows Internet Explorer 8 (KB971180)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
VC80CRTRedist - 8.0.50727.762
Winamp
Windows Internet Explorer 7
Windows Internet Explorer 8
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
Windows XP Service Pack 3
WinRAR archiver

by **Shaba** » August 9th, 2009, 5:14 am

Open notepad and copy/paste the text in the codebox below into it:

Code: Select all

File::
c:\windows\system32\GroupPolicy000.dat
c:\windows\system32\2.tmp

Folder::
c:\windows\system32\SystemX86
c:\documents and settings\Nenad\Application Data\LimeWire
c:\documents and settings\Nenad\Application Data\uTorrent

Save this as "CFScript"

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.

Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
If that happened we want to know, and also what process you had to end.

by **Nenad** » August 9th, 2009, 9:13 am

Hi Shaba,

I did what you told me to. ComboFix took a long time again. Just about when I seriously started considering looking into the process manager list, it finished and produced a log. The component running at the time was Find3M.

While I was typing up this message in chrome, three background IE windows opened up and tried to invoke the following URLs:

Here now are the logs you asked for:

ComboFix log:

ComboFix 09-08-07.09 - Nenad 08/09/2009 8:38.2.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1014.670 [GMT -4:00]
Running from: c:\documents and settings\Nenad\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Nenad\Desktop\CFScript
AV: Norton AntiVirus *On-access scanning enabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}

FILE ::
"c:\windows\system32\2.tmp"
"c:\windows\system32\GroupPolicy000.dat"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Katarina\Application Data\02000000bf4249e0651C.manifest
c:\documents and settings\Katarina\Application Data\02000000bf4249e0651O.manifest
c:\documents and settings\Katarina\Application Data\02000000bf4249e0651P.manifest
c:\documents and settings\Katarina\Application Data\02000000bf4249e0651S.manifest
c:\documents and settings\Nenad\Application Data\02000000bf4249e0651C.manifest
c:\documents and settings\Nenad\Application Data\02000000bf4249e0651O.manifest
c:\documents and settings\Nenad\Application Data\02000000bf4249e0651P.manifest
c:\documents and settings\Nenad\Application Data\02000000bf4249e0651S.manifest
c:\documents and settings\Nenad\Application Data\LimeWire\.AppSpecialShare\The.Adventures.Of.Indiana.Jones[Raiders.Of.The.Lost.Ark-Temple.Of.Doom-Last.Crusade]DvDrip[Eng]-aXXo.torrent.bak
c:\documents and settings\Nenad\Application Data\LimeWire\certificate\limewire.keystore
c:\documents and settings\Nenad\Application Data\LimeWire\createtimes.cache
c:\documents and settings\Nenad\Application Data\LimeWire\downloads.dat
c:\documents and settings\Nenad\Application Data\LimeWire\fileurns.bak
c:\documents and settings\Nenad\Application Data\LimeWire\fileurns.cache
c:\documents and settings\Nenad\Application Data\LimeWire\filters.props
c:\documents and settings\Nenad\Application Data\LimeWire\gnutella.net
c:\documents and settings\Nenad\Application Data\LimeWire\installation.props
c:\documents and settings\Nenad\Application Data\LimeWire\library.dat
c:\documents and settings\Nenad\Application Data\LimeWire\limewire.props
c:\documents and settings\Nenad\Application Data\LimeWire\mojito.props
c:\documents and settings\Nenad\Application Data\LimeWire\promotion\promodb.backup
c:\documents and settings\Nenad\Application Data\LimeWire\promotion\promodb.data
c:\documents and settings\Nenad\Application Data\LimeWire\promotion\promodb.properties
c:\documents and settings\Nenad\Application Data\LimeWire\promotion\promodb.script
c:\documents and settings\Nenad\Application Data\LimeWire\questions.props
c:\documents and settings\Nenad\Application Data\LimeWire\responses.cache
c:\documents and settings\Nenad\Application Data\LimeWire\simpp.xml
c:\documents and settings\Nenad\Application Data\LimeWire\spam.dat
c:\documents and settings\Nenad\Application Data\LimeWire\tables.props
c:\documents and settings\Nenad\Application Data\LimeWire\themes\limewirePro_theme.lwtp
c:\documents and settings\Nenad\Application Data\LimeWire\themes\limewirePro_theme\01_star.gif
c:\documents and settings\Nenad\Application Data\LimeWire\themes\limewirePro_theme\02_star.gif
c:\documents and settings\Nenad\Application Data\LimeWire\themes\limewirePro_theme\03_star.gif
c:\documents and settings\Nenad\Application Data\LimeWire\themes\limewirePro_theme\04_star.gif
c:\documents and settings\Nenad\Application Data\LimeWire\themes\limewirePro_theme\05_star.gif
c:\documents and settings\Nenad\Application Data\LimeWire\themes\limewirePro_theme\chat.gif
c:\documents and settings\Nenad\Application Data\LimeWire\themes\limewirePro_theme\dir_closed.gif
c:\documents and settings\Nenad\Application Data\LimeWire\themes\limewirePro_theme\dir_open.gif
c:\documents and settings\Nenad\Application Data\LimeWire\themes\limewirePro_theme\forward_dn.gif
c:\documents and settings\Nenad\Application Data\LimeWire\themes\limewirePro_theme\forward_up.gif
c:\documents and settings\Nenad\Application Data\LimeWire\themes\limewirePro_theme\kill.gif
c:\documents and settings\Nenad\Application Data\LimeWire\themes\limewirePro_theme\kill_on.gif
c:\documents and settings\Nenad\Application Data\LimeWire\themes\limewirePro_theme\lime.gif
c:\documents and settings\Nenad\Application Data\LimeWire\themes\limewirePro_theme\lw_logo.png
c:\documents and settings\Nenad\Application Data\LimeWire\themes\limewirePro_theme\pause_dn.gif
c:\documents and settings\Nenad\Application Data\LimeWire\themes\limewirePro_theme\pause_up.gif
c:\documents and settings\Nenad\Application Data\LimeWire\themes\limewirePro_theme\play_dn.gif
c:\documents and settings\Nenad\Application Data\LimeWire\themes\limewirePro_theme\play_up.gif
c:\documents and settings\Nenad\Application Data\LimeWire\themes\limewirePro_theme\question.gif
c:\documents and settings\Nenad\Application Data\LimeWire\themes\limewirePro_theme\rewind_dn.gif
c:\documents and settings\Nenad\Application Data\LimeWire\themes\limewirePro_theme\rewind_up.gif
c:\documents and settings\Nenad\Application Data\LimeWire\themes\limewirePro_theme\stop_dn.gif
c:\documents and settings\Nenad\Application Data\LimeWire\themes\limewirePro_theme\stop_up.gif
c:\documents and settings\Nenad\Application Data\LimeWire\themes\limewirePro_theme\theme.txt
c:\documents and settings\Nenad\Application Data\LimeWire\themes\limewirePro_theme\version.txt
c:\documents and settings\Nenad\Application Data\LimeWire\themes\limewirePro_theme\warning.gif
c:\documents and settings\Nenad\Application Data\LimeWire\ttrees.cache
c:\documents and settings\Nenad\Application Data\LimeWire\ttroot.cache
c:\documents and settings\Nenad\Application Data\LimeWire\version.xml
c:\documents and settings\Nenad\Application Data\LimeWire\versions.props
c:\documents and settings\Nenad\Application Data\LimeWire\xml\data\audio.sxml2
c:\documents and settings\Nenad\Application Data\LimeWire\xml\data\video.sxml2
c:\documents and settings\Nenad\Application Data\uTorrent
c:\documents and settings\Nenad\Application Data\uTorrent\Adobe Photoshop Elements 7.torrent
c:\documents and settings\Nenad\Application Data\uTorrent\Bianca Beauchamp All Access.avi.torrent
c:\documents and settings\Nenad\Application Data\uTorrent\debian-40r6-i386-CD-1.iso.torrent
c:\documents and settings\Nenad\Application Data\uTorrent\dht.dat
c:\documents and settings\Nenad\Application Data\uTorrent\dht.dat.old
c:\documents and settings\Nenad\Application Data\uTorrent\LimeWireWin.exe.torrent
c:\documents and settings\Nenad\Application Data\uTorrent\Rescue.Me.S05E12.Disease.HDTV.XviD-FQM.torrent
c:\documents and settings\Nenad\Application Data\uTorrent\Rescue.Me.S05E13.Torch.HDTV.XviD-FQM.torrent
c:\documents and settings\Nenad\Application Data\uTorrent\resume.dat
c:\documents and settings\Nenad\Application Data\uTorrent\resume.dat.old
c:\documents and settings\Nenad\Application Data\uTorrent\rss.dat
c:\documents and settings\Nenad\Application Data\uTorrent\rss.dat.old
c:\documents and settings\Nenad\Application Data\uTorrent\settings.dat
c:\documents and settings\Nenad\Application Data\uTorrent\settings.dat.old
c:\documents and settings\Nenad\Application Data\uTorrent\Survivor - Eye of the tiger.mp3.torrent
c:\documents and settings\Nenad\Application Data\uTorrent\Terminator 2-Judgement Day(DirCut)[1991]AC-3(5.1)ENG[UKB-RG Xvid]-keltz.torrent
c:\documents and settings\Nenad\Application Data\uTorrent\Terminator 3 - Rise of the Machines(2003).DVDrip.nl.subs.NLT-Release (Xvid).torrent
c:\documents and settings\Nenad\Application Data\uTorrent\The Terminator[1984]AC-3(5.1)ENG[UKB-RG Xvid]-keltz.torrent
c:\documents and settings\Nenad\Application Data\uTorrent\utorrent.lng
c:\windows\GnuHashes.ini
c:\windows\system32\2.tmp
c:\windows\system32\3.tmp
c:\windows\system32\GroupPolicy000.dat
c:\windows\system32\SystemX86
c:\windows\system32\SystemX86\245.crack.zip
c:\windows\system32\SystemX86\245.crack.zip.kwd
c:\windows\system32\SystemX86\246.keygen.zip
c:\windows\system32\SystemX86\246.keygen.zip.kwd
c:\windows\system32\SystemX86\247.serial.zip
c:\windows\system32\SystemX86\247.serial.zip.kwd
c:\windows\system32\SystemX86\248.setup.zip
c:\windows\system32\SystemX86\248.setup.zip.kwd
c:\windows\system32\SystemX86\249.music.au
c:\windows\system32\SystemX86\249.music.au.kwd
c:\windows\system32\SystemX86\250.music2.au
c:\windows\system32\SystemX86\250.music2.au.kwd
c:\windows\system32\SystemX86\251.music3.au
c:\windows\system32\SystemX86\251.music3.au.kwd
c:\windows\system32\SystemX86\252.music.snd
c:\windows\system32\SystemX86\252.music.snd.kwd

.
((((((((((((((((((((((((( Files Created from 2009-07-09 to 2009-08-09 )))))))))))))))))))))))))))))))
.

2009-08-08 16:05 . 2009-08-08 16:05 -------- d-----w- c:\documents and settings\Nenad\Local Settings\Application Data\Symantec
2009-08-08 05:21 . 2009-07-13 08:00 87888 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090807.024\NAVENG.SYS
2009-08-08 05:21 . 2009-07-13 08:00 875728 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090807.024\NAVEX15.SYS
2009-08-08 05:21 . 2009-02-25 09:00 371248 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090807.024\EECTRL.SYS
2009-08-08 05:21 . 2009-02-25 09:00 2414128 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090807.024\CCERASER.DLL
2009-08-08 05:21 . 2009-02-25 09:00 101936 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090807.024\ERASER.SYS
2009-08-08 05:21 . 2009-02-19 09:00 177520 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090807.024\NAVENG32.DLL
2009-08-08 05:21 . 2009-02-19 09:00 1181040 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090807.024\NAVEX32A.DLL
2009-08-08 05:21 . 2008-12-05 09:52 259368 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090807.024\ECMSVR32.DLL
2009-08-04 21:26 . 2009-08-04 21:26 -------- d-----w- c:\program files\Trend Micro
2009-08-04 20:21 . 2009-08-04 20:21 -------- d-----w- c:\documents and settings\Nenad\Application Data\Malwarebytes
2009-08-04 20:21 . 2009-08-03 17:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-04 20:21 . 2009-08-04 20:21 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes
2009-08-04 20:21 . 2009-08-03 17:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-08-04 20:21 . 2009-08-05 02:38 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-08-01 20:46 . 2009-08-01 20:46 121856 ----a-w- c:\windows\system32\gcdef32.dll
2009-07-30 22:34 . 2009-07-11 19:34 276344 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090730.003\IDSXpx86.sys
2009-07-30 22:34 . 2009-07-11 19:34 293424 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090730.003\IDSvix86.sys
2009-07-30 22:34 . 2009-07-11 19:34 533880 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090730.003\Scxpx86.dll
2009-07-30 22:34 . 2009-07-11 19:34 451960 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090730.003\IDSxpx86.dll
2009-07-30 22:34 . 2009-07-11 19:34 397360 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090730.003\IDSviA64.sys
2009-07-27 22:02 . 2009-07-11 19:34 276344 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090722.001\IDSXpx86.sys
2009-07-27 22:02 . 2009-07-11 19:34 293424 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090722.001\IDSvix86.sys
2009-07-27 22:02 . 2009-07-11 19:34 533880 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090722.001\Scxpx86.dll
2009-07-27 22:02 . 2009-07-11 19:34 451960 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090722.001\IDSxpx86.dll
2009-07-27 22:02 . 2009-07-11 19:34 397360 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090722.001\IDSviA64.sys
2009-07-21 01:06 . 2009-07-21 01:06 -------- d-sh--w- c:\documents and settings\Katarina\PrivacIE
2009-07-20 01:10 . 2009-06-29 19:28 106496 ----a-w- c:\documents and settings\Nenad\Application Data\Mozilla\Plugins\npcoolirisplugin.dll
2009-07-20 01:10 . 2009-06-29 19:28 937984 ----a-w- c:\documents and settings\Nenad\Application Data\Mozilla\Firefox\Profiles\va7e7u35.default\extensions\piclens@cooliris.com\libs\PicLensHelper.exe
2009-07-20 01:10 . 2009-06-29 19:28 106496 ----a-w- c:\documents and settings\Nenad\Application Data\Mozilla\Firefox\Profiles\va7e7u35.default\extensions\piclens@cooliris.com\libs\npcoolirisplugin.dll
2009-07-20 01:10 . 2009-06-29 19:28 103424 ----a-w- c:\documents and settings\Nenad\Application Data\Mozilla\Firefox\Profiles\va7e7u35.default\extensions\piclens@cooliris.com\libs\pixomatic.dll
2009-07-20 01:10 . 2009-06-29 19:28 65536 ----a-w- c:\documents and settings\Nenad\Application Data\Mozilla\Firefox\Profiles\va7e7u35.default\extensions\piclens@cooliris.com\components\coolirisstub.dll
2009-07-20 01:10 . 2009-06-29 19:28 4734976 ----a-w- c:\documents and settings\Nenad\Application Data\Mozilla\Firefox\Profiles\va7e7u35.default\extensions\piclens@cooliris.com\libs\cooliris19.dll
2009-07-20 01:10 . 2009-06-29 19:28 344064 ----a-w- c:\documents and settings\Nenad\Application Data\Mozilla\Firefox\Profiles\va7e7u35.default\extensions\piclens@cooliris.com\libs\LaunchCooliris.exe
2009-07-19 11:27 . 2009-07-31 19:28 -------- d-----w- c:\documents and settings\Nenad\Local Settings\Application Data\Temp
2009-07-17 19:18 . 2009-08-02 14:54 -------- d-----w- c:\documents and settings\Katarina\Local Settings\Application Data\Temp
2009-07-17 04:05 . 2009-07-17 04:05 -------- d-----w- c:\program files\iPod
2009-07-17 03:51 . 2009-07-17 03:51 75040 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Apple Computer\Installer Cache\iTunes 8.2.1.6\SetupAdmin.exe
2009-07-11 19:34 . 2009-07-11 19:34 276344 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\IDSXpx86.sys
2009-07-11 19:34 . 2009-07-11 19:34 293424 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\IDSvix86.sys
2009-07-11 19:34 . 2009-07-11 19:34 533880 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\Scxpx86.dll
2009-07-11 19:34 . 2009-07-11 19:34 451960 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\IDSxpx86.dll
2009-07-11 19:34 . 2009-07-11 19:34 397360 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\IDSviA64.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-09 12:46 . 2009-02-06 14:20 -------- d-----w- c:\documents and settings\Nenad\Application Data\LimeWire
2009-08-07 22:40 . 2006-04-14 15:53 -------- d-----w- c:\program files\Mozilla Thunderbird
2009-08-01 14:04 . 2009-02-02 03:55 -------- d-----w- c:\program files\Microsoft Silverlight
2009-07-17 04:17 . 2009-03-12 22:45 -------- d-----w- c:\program files\Safari
2009-07-17 04:05 . 2009-06-19 02:03 -------- d-----w- c:\program files\iTunes
2009-07-03 17:09 . 2006-03-04 03:33 915456 ----a-w- c:\windows\system32\wininet.dll
2009-06-27 00:53 . 2009-06-27 00:53 -------- d-----w- c:\documents and settings\Nenad\Application Data\Canon
2009-06-19 04:24 . 2009-02-02 06:14 -------- d-----w- c:\documents and settings\Nenad\Application Data\Apple Computer
2009-06-19 02:01 . 2009-06-19 02:00 -------- d-----w- c:\program files\QuickTime
2009-06-19 01:58 . 2009-02-02 06:09 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Apple
2009-06-16 14:36 . 2004-08-04 10:00 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:36 . 2004-08-04 10:00 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-11 11:38 . 2006-11-21 02:26 -------- d-----w- c:\program files\Java
2009-06-11 11:37 . 2009-06-11 11:37 152576 ----a-w- c:\documents and settings\Nenad\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-06-05 15:42 . 2009-03-12 23:15 2060288 ----a-w- c:\windows\system32\usbaaplrc.dll
2009-06-05 15:42 . 2009-02-02 06:13 39424 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2009-06-03 19:09 . 2004-08-04 10:00 1291264 ----a-w- c:\windows\system32\quartz.dll
2009-05-29 20:31 . 2009-06-19 01:29 65536 ----a-w- c:\documents and settings\Nenad\Application Data\Mozilla\Firefox\Profiles\va7e7u35.default\extensions\piclens@cooliris.com-trash\components\coolirisstub.dll
2009-05-29 20:31 . 2009-06-19 01:29 4616192 ----a-w- c:\documents and settings\Nenad\Application Data\Mozilla\Firefox\Profiles\va7e7u35.default\extensions\piclens@cooliris.com-trash\libs\cooliris19.dll
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\opera\program\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\opera\program\plugins\ssldivx.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-08-08_16.28.05 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-08-09 12:32 . 2009-08-09 12:32 16384 c:\windows\Temp\Perflib_Perfdata_224.dat
- 2009-08-08 16:27 . 2009-08-08 16:27 16384 c:\windows\Temp\Perflib_Perfdata_224.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\Nenad\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-02-02 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-18 13574144]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-09-30 155648]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-18 86016]
"DLPSP"="c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLPSP.EXE" [2005-01-13 126976]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-10-15 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-10-15 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-10-15 114688]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-05-14 177472]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-09-18 1657376]
"SigmatelSysTrayApp"="stsystra.exe" - c:\windows\stsystra.exe [2005-03-23 339968]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\500c3832651]
2009-08-01 20:46 121856 ----a-w- c:\windows\system32\gcdef32.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]
@="FSFilter Activity Monitor"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NAV\1005000.086\SymEFA.sys [3/20/2009 11:13 PM 310320]
R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\NAV\1005000.086\BHDrvx86.sys [3/20/2009 11:13 PM 258608]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NAV\1005000.086\cchpx86.sys [3/20/2009 11:12 PM 482352]
R1 IDSxpx86;IDSxpx86;c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090730.003\IDSXpx86.sys [7/30/2009 6:34 PM 276344]
R2 DLSDB;Dell Printer Status Database;c:\program files\Dell Printers\Additional Color Laser Software\Status Monitor\dlsdbnt.exe [4/19/2006 11:28 PM 135168]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2/25/2009 9:51 PM 101936]
S3 Drmuhccr6-d;Drmuhccr6-d;c:\windows\system32\drivers\nwlnkipx.sys [8/4/2004 6:00 AM 88320]
S4 Norton AntiVirus;Norton AntiVirus;c:\program files\Norton AntiVirus\Engine\16.5.0.134\ccSvcHst.exe [3/20/2009 11:12 PM 115560]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-07-30 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2009-08-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1757981266-1844823847-1801674531-1004Core.job
- c:\documents and settings\Nenad\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-02-02 04:01]

2009-08-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1757981266-1844823847-1801674531-1004UA.job
- c:\documents and settings\Nenad\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-02-02 04:01]

2009-08-08 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1757981266-1844823847-1801674531-1005Core.job
- c:\documents and settings\Katarina\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-02-24 04:03]

2009-08-08 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1757981266-1844823847-1801674531-1005UA.job
- c:\documents and settings\Katarina\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-02-24 04:03]

2009-08-09 c:\windows\Tasks\User_Feed_Synchronization-{4E073B3C-B0A7-42D6-A028-6E7D40EF776B}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 08:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.ca/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
TCP: {D092B8F6-D1F0-46DC-97BC-84FEDD3A1E7C} = 65.39.192.198,65.39.196.215
FF - ProfilePath - c:\documents and settings\Nenad\Application Data\Mozilla\Firefox\Profiles\va7e7u35.default\
FF - component: c:\documents and settings\Nenad\Application Data\Mozilla\Firefox\Profiles\va7e7u35.default\extensions\piclens@cooliris.com\components\coolirisstub.dll
FF - plugin: c:\documents and settings\Nenad\Application Data\Mozilla\plugins\npcoolirisplugin.dll
FF - plugin: c:\documents and settings\Nenad\Local Settings\Application Data\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\Opera\program\plugins\npdivx32.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-09 08:47
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Norton AntiVirus]
"ImagePath"="\"c:\program files\Norton AntiVirus\Engine\16.5.0.134\ccSvcHst.exe\" /s \"Norton AntiVirus\" /m \"c:\program files\Norton AntiVirus\Engine\16.5.0.134\diMaster.dll\" /prefetch:1"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(960)
c:\windows\System32\gcdef32.dll
.
Completion time: 2009-08-09 9:00
ComboFix-quarantined-files.txt 2009-08-09 13:00
ComboFix2.txt 2009-08-08 16:40

Pre-Run: 36,652,486,656 bytes free
Post-Run: 36,609,503,232 bytes free

288 --- E O F --- 2009-07-31 07:00

hijackthis.log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:01:41 AM, on 8/9/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLSDBNT.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLPWDNT.EXE
C:\WINDOWS\stsystra.exe
C:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLPSP.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Documents and Settings\Nenad\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\imapi.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton AntiVirus\Engine\16.5.0.134\IPSBHO.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [DLPSP] "c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLPSP.EXE"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Nenad\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 3557333390
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 3550020109
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D092B8F6-D1F0-46DC-97BC-84FEDD3A1E7C}: NameServer = 65.39.192.198,65.39.196.215
O20 - Winlogon Notify: 500c3832651 - C:\WINDOWS\System32\gcdef32.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Dell Printer Status Watcher (DLPWD) - Dell Inc. - c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLPWDNT.EXE
O23 - Service: Dell Printer Status Database (DLSDB) - Dell Inc. - c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLSDBNT.EXE
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 6202 bytes

by **Shaba** » August 9th, 2009, 9:33 am

Yes another round is needed.

Open notepad and copy/paste the text in the codebox below into it:

Code: Select all

File::
C:\WINDOWS\System32\gcdef32.dll

Save this as "CFScript"

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.

Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.

by **Nenad** » August 9th, 2009, 10:26 am

Here are the two logs like you asked:

ComboFix log:

ComboFix 09-08-07.09 - Nenad 08/09/2009 9:56.3.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1014.594 [GMT -4:00]
Running from: c:\documents and settings\Nenad\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Nenad\Desktop\CFScript.txt
AV: Norton AntiVirus *On-access scanning enabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}

FILE ::
"c:\windows\system32\gcdef32.dll"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\Nenad\LOCALS~1\Temp\6.tmp
c:\documents and settings\Nenad\Application Data\02000000bf4249e0651C.manifest
c:\documents and settings\Nenad\Application Data\02000000bf4249e0651O.manifest
c:\documents and settings\Nenad\Application Data\02000000bf4249e0651P.manifest
c:\documents and settings\Nenad\Application Data\02000000bf4249e0651S.manifest
c:\documents and settings\Nenad\Local Settings\Temp\6.tmp
c:\windows\GnuHashes.ini
c:\windows\system32\3.tmp
c:\windows\system32\gcdef32.dll
c:\windows\system32\GroupPolicy000.dat
c:\windows\system32\SystemX86
c:\windows\system32\SystemX86\245.crack.zip
c:\windows\system32\SystemX86\245.crack.zip.kwd
c:\windows\system32\SystemX86\246.keygen.zip
c:\windows\system32\SystemX86\246.keygen.zip.kwd
c:\windows\system32\SystemX86\247.serial.zip
c:\windows\system32\SystemX86\247.serial.zip.kwd
c:\windows\system32\SystemX86\248.setup.zip
c:\windows\system32\SystemX86\248.setup.zip.kwd
c:\windows\system32\SystemX86\249.music.au
c:\windows\system32\SystemX86\249.music.au.kwd
c:\windows\system32\SystemX86\250.music2.au
c:\windows\system32\SystemX86\250.music2.au.kwd
c:\windows\system32\SystemX86\251.music3.au
c:\windows\system32\SystemX86\251.music3.au.kwd
c:\windows\system32\SystemX86\252.music.snd
c:\windows\system32\SystemX86\252.music.snd.kwd

.
((((((((((((((((((((((((( Files Created from 2009-07-09 to 2009-08-09 )))))))))))))))))))))))))))))))
.

2009-08-08 16:05 . 2009-08-08 16:05 -------- d-----w- c:\documents and settings\Nenad\Local Settings\Application Data\Symantec
2009-08-08 05:21 . 2009-07-13 08:00 87888 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090807.024\NAVENG.SYS
2009-08-08 05:21 . 2009-07-13 08:00 875728 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090807.024\NAVEX15.SYS
2009-08-08 05:21 . 2009-02-25 09:00 371248 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090807.024\EECTRL.SYS
2009-08-08 05:21 . 2009-02-25 09:00 2414128 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090807.024\CCERASER.DLL
2009-08-08 05:21 . 2009-02-25 09:00 101936 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090807.024\ERASER.SYS
2009-08-08 05:21 . 2009-02-19 09:00 177520 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090807.024\NAVENG32.DLL
2009-08-08 05:21 . 2009-02-19 09:00 1181040 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090807.024\NAVEX32A.DLL
2009-08-08 05:21 . 2008-12-05 09:52 259368 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090807.024\ECMSVR32.DLL
2009-08-04 21:26 . 2009-08-04 21:26 -------- d-----w- c:\program files\Trend Micro
2009-08-04 20:21 . 2009-08-04 20:21 -------- d-----w- c:\documents and settings\Nenad\Application Data\Malwarebytes
2009-08-04 20:21 . 2009-08-03 17:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-04 20:21 . 2009-08-04 20:21 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes
2009-08-04 20:21 . 2009-08-03 17:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-08-04 20:21 . 2009-08-05 02:38 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-07-30 22:34 . 2009-07-11 19:34 276344 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090730.003\IDSXpx86.sys
2009-07-30 22:34 . 2009-07-11 19:34 293424 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090730.003\IDSvix86.sys
2009-07-30 22:34 . 2009-07-11 19:34 533880 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090730.003\Scxpx86.dll
2009-07-30 22:34 . 2009-07-11 19:34 451960 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090730.003\IDSxpx86.dll
2009-07-30 22:34 . 2009-07-11 19:34 397360 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090730.003\IDSviA64.sys
2009-07-27 22:02 . 2009-07-11 19:34 276344 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090722.001\IDSXpx86.sys
2009-07-27 22:02 . 2009-07-11 19:34 293424 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090722.001\IDSvix86.sys
2009-07-27 22:02 . 2009-07-11 19:34 533880 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090722.001\Scxpx86.dll
2009-07-27 22:02 . 2009-07-11 19:34 451960 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090722.001\IDSxpx86.dll
2009-07-27 22:02 . 2009-07-11 19:34 397360 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090722.001\IDSviA64.sys
2009-07-21 01:06 . 2009-07-21 01:06 -------- d-sh--w- c:\documents and settings\Katarina\PrivacIE
2009-07-20 01:10 . 2009-06-29 19:28 106496 ----a-w- c:\documents and settings\Nenad\Application Data\Mozilla\Plugins\npcoolirisplugin.dll
2009-07-20 01:10 . 2009-06-29 19:28 937984 ----a-w- c:\documents and settings\Nenad\Application Data\Mozilla\Firefox\Profiles\va7e7u35.default\extensions\piclens@cooliris.com\libs\PicLensHelper.exe
2009-07-20 01:10 . 2009-06-29 19:28 106496 ----a-w- c:\documents and settings\Nenad\Application Data\Mozilla\Firefox\Profiles\va7e7u35.default\extensions\piclens@cooliris.com\libs\npcoolirisplugin.dll
2009-07-20 01:10 . 2009-06-29 19:28 103424 ----a-w- c:\documents and settings\Nenad\Application Data\Mozilla\Firefox\Profiles\va7e7u35.default\extensions\piclens@cooliris.com\libs\pixomatic.dll
2009-07-20 01:10 . 2009-06-29 19:28 65536 ----a-w- c:\documents and settings\Nenad\Application Data\Mozilla\Firefox\Profiles\va7e7u35.default\extensions\piclens@cooliris.com\components\coolirisstub.dll
2009-07-20 01:10 . 2009-06-29 19:28 4734976 ----a-w- c:\documents and settings\Nenad\Application Data\Mozilla\Firefox\Profiles\va7e7u35.default\extensions\piclens@cooliris.com\libs\cooliris19.dll
2009-07-20 01:10 . 2009-06-29 19:28 344064 ----a-w- c:\documents and settings\Nenad\Application Data\Mozilla\Firefox\Profiles\va7e7u35.default\extensions\piclens@cooliris.com\libs\LaunchCooliris.exe
2009-07-19 11:27 . 2009-07-31 19:28 -------- d-----w- c:\documents and settings\Nenad\Local Settings\Application Data\Temp
2009-07-17 19:18 . 2009-08-02 14:54 -------- d-----w- c:\documents and settings\Katarina\Local Settings\Application Data\Temp
2009-07-17 04:05 . 2009-07-17 04:05 -------- d-----w- c:\program files\iPod
2009-07-17 03:51 . 2009-07-17 03:51 75040 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Apple Computer\Installer Cache\iTunes 8.2.1.6\SetupAdmin.exe
2009-07-11 19:34 . 2009-07-11 19:34 276344 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\IDSXpx86.sys
2009-07-11 19:34 . 2009-07-11 19:34 293424 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\IDSvix86.sys
2009-07-11 19:34 . 2009-07-11 19:34 533880 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\Scxpx86.dll
2009-07-11 19:34 . 2009-07-11 19:34 451960 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\IDSxpx86.dll
2009-07-11 19:34 . 2009-07-11 19:34 397360 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\IDSviA64.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-09 12:46 . 2009-02-06 14:20 -------- d-----w- c:\documents and settings\Nenad\Application Data\LimeWire
2009-08-07 22:40 . 2006-04-14 15:53 -------- d-----w- c:\program files\Mozilla Thunderbird
2009-08-01 14:04 . 2009-02-02 03:55 -------- d-----w- c:\program files\Microsoft Silverlight
2009-07-17 04:17 . 2009-03-12 22:45 -------- d-----w- c:\program files\Safari
2009-07-17 04:05 . 2009-06-19 02:03 -------- d-----w- c:\program files\iTunes
2009-07-03 17:09 . 2006-03-04 03:33 915456 ----a-w- c:\windows\system32\wininet.dll
2009-06-27 00:53 . 2009-06-27 00:53 -------- d-----w- c:\documents and settings\Nenad\Application Data\Canon
2009-06-19 04:24 . 2009-02-02 06:14 -------- d-----w- c:\documents and settings\Nenad\Application Data\Apple Computer
2009-06-19 02:01 . 2009-06-19 02:00 -------- d-----w- c:\program files\QuickTime
2009-06-19 01:58 . 2009-02-02 06:09 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Apple
2009-06-16 14:36 . 2004-08-04 10:00 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:36 . 2004-08-04 10:00 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-11 11:38 . 2006-11-21 02:26 -------- d-----w- c:\program files\Java
2009-06-11 11:37 . 2009-06-11 11:37 152576 ----a-w- c:\documents and settings\Nenad\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-06-05 15:42 . 2009-03-12 23:15 2060288 ----a-w- c:\windows\system32\usbaaplrc.dll
2009-06-05 15:42 . 2009-02-02 06:13 39424 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2009-06-03 19:09 . 2004-08-04 10:00 1291264 ----a-w- c:\windows\system32\quartz.dll
2009-05-29 20:31 . 2009-06-19 01:29 65536 ----a-w- c:\documents and settings\Nenad\Application Data\Mozilla\Firefox\Profiles\va7e7u35.default\extensions\piclens@cooliris.com-trash\components\coolirisstub.dll
2009-05-29 20:31 . 2009-06-19 01:29 4616192 ----a-w- c:\documents and settings\Nenad\Application Data\Mozilla\Firefox\Profiles\va7e7u35.default\extensions\piclens@cooliris.com-trash\libs\cooliris19.dll
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\opera\program\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\opera\program\plugins\ssldivx.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-08-08_16.28.05 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-08-09 14:06 . 2009-08-09 14:06 16384 c:\windows\Temp\Perflib_Perfdata_230.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\Nenad\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-02-02 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-18 13574144]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-09-30 155648]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-18 86016]
"DLPSP"="c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLPSP.EXE" [2005-01-13 126976]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-10-15 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-10-15 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-10-15 114688]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-05-14 177472]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-09-18 1657376]
"SigmatelSysTrayApp"="stsystra.exe" - c:\windows\stsystra.exe [2005-03-23 339968]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]
@="FSFilter Activity Monitor"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NAV\1005000.086\SymEFA.sys [3/20/2009 11:13 PM 310320]
R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\NAV\1005000.086\BHDrvx86.sys [3/20/2009 11:13 PM 258608]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NAV\1005000.086\cchpx86.sys [3/20/2009 11:12 PM 482352]
R1 IDSxpx86;IDSxpx86;c:\documents and settings\All Users.WINDOWS\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090730.003\IDSXpx86.sys [7/30/2009 6:34 PM 276344]
R2 DLSDB;Dell Printer Status Database;c:\program files\Dell Printers\Additional Color Laser Software\Status Monitor\dlsdbnt.exe [4/19/2006 11:28 PM 135168]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2/25/2009 9:51 PM 101936]
S3 Drmuhccr6-d;Drmuhccr6-d;c:\windows\system32\drivers\nwlnkipx.sys [8/4/2004 6:00 AM 88320]
S4 Norton AntiVirus;Norton AntiVirus;c:\program files\Norton AntiVirus\Engine\16.5.0.134\ccSvcHst.exe [3/20/2009 11:12 PM 115560]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-07-30 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2009-08-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1757981266-1844823847-1801674531-1004Core.job
- c:\documents and settings\Nenad\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-02-02 04:01]

2009-08-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1757981266-1844823847-1801674531-1004UA.job
- c:\documents and settings\Nenad\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-02-02 04:01]

2009-08-08 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1757981266-1844823847-1801674531-1005Core.job
- c:\documents and settings\Katarina\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-02-24 04:03]

2009-08-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1757981266-1844823847-1801674531-1005UA.job
- c:\documents and settings\Katarina\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-02-24 04:03]

2009-08-09 c:\windows\Tasks\User_Feed_Synchronization-{4E073B3C-B0A7-42D6-A028-6E7D40EF776B}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 08:31]
.
- - - - ORPHANS REMOVED - - - -

Notify-500c3832651 - c:\windows\System32\gcdef32.dll

.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.ca/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
TCP: {D092B8F6-D1F0-46DC-97BC-84FEDD3A1E7C} = 65.39.192.198,65.39.196.215
FF - ProfilePath - c:\documents and settings\Nenad\Application Data\Mozilla\Firefox\Profiles\va7e7u35.default\
FF - component: c:\documents and settings\Nenad\Application Data\Mozilla\Firefox\Profiles\va7e7u35.default\extensions\piclens@cooliris.com\components\coolirisstub.dll
FF - plugin: c:\documents and settings\Nenad\Application Data\Mozilla\plugins\npcoolirisplugin.dll
FF - plugin: c:\documents and settings\Nenad\Local Settings\Application Data\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\Opera\program\plugins\npdivx32.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-09 10:06
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Norton AntiVirus]
"ImagePath"="\"c:\program files\Norton AntiVirus\Engine\16.5.0.134\ccSvcHst.exe\" /s \"Norton AntiVirus\" /m \"c:\program files\Norton AntiVirus\Engine\16.5.0.134\diMaster.dll\" /prefetch:1"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(2984)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Dell Printers\Additional Color Laser Software\Status Monitor\dlpwdnt.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2009-08-09 10:22 - machine was rebooted
ComboFix-quarantined-files.txt 2009-08-09 14:22
ComboFix2.txt 2009-08-09 13:00
ComboFix3.txt 2009-08-08 16:40

Pre-Run: 36,597,272,576 bytes free
Post-Run: 36,584,882,176 bytes free

225 --- E O F --- 2009-07-31 07:00

hijackthis.log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:23:28 AM, on 8/9/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLSDBNT.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLPWDNT.EXE
C:\WINDOWS\stsystra.exe
C:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLPSP.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Documents and Settings\Nenad\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Nenad\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton AntiVirus\Engine\16.5.0.134\IPSBHO.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [DLPSP] "c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLPSP.EXE"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Nenad\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 3557333390
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 3550020109
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D092B8F6-D1F0-46DC-97BC-84FEDD3A1E7C}: NameServer = 65.39.192.198,65.39.196.215
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Dell Printer Status Watcher (DLPWD) - Dell Inc. - c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLPWDNT.EXE
O23 - Service: Dell Printer Status Database (DLSDB) - Dell Inc. - c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLSDBNT.EXE
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 6178 bytes

by **Shaba** » August 9th, 2009, 1:50 pm

Please go to Kaspersky website and perform an online antivirus scan.

Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As....
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
Please post this log in your next reply along with a fresh HijackThis log.

by **Nenad** » August 9th, 2009, 3:00 pm

Hi Shaba,

I am having great difficulties running the Kaspersky online scanner. It starts like you described, I Accept, the download starts and then the database updates break half way through with the following message:

Update has failed. Program has failed to start. Close the Kaspersky Online Scanner 7.0 window and open it again to install the program. You must be online to update the Kaspersky Online Scanner 7.0 database. With the latest database updates, you can find new viruses and other threats. Please go online to use Kaspersky Online Scanner 7.0. [ERROR: Key is expired]

But all of this was while I was online and from a firefox window. I tried running Kaspersky with other browsers, but got the same result.

Thanks,
N.

by **Shaba** » August 9th, 2009, 3:35 pm

Check the box next to "YES, I accept the Terms of Use."
Click "Start"
Click Yes... at the run ActiveX prompt. Click Install... at the install ActiveX prompt.
Once installed, the scanner will be initialized.
Click "Start". Make sure that the options:
- Remove found threats is UNCHECKED
- Scan unwanted applications is CHECKED
Click "Scan"
Wait for the scan to finish... it may take a while... please be patient. When the scan is finished...
Use Notepad to open the log file located at C:\Program Files\EsetOnlineScanner\log.txt
Copy and paste the contents of log.txt in your next reply.

by **Nenad** » August 9th, 2009, 9:16 pm

Here are the results of the ESET anti virus scanner. I am also including a fresh hijackthis.log.

ESET AV log.txt:

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=6
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.5889
# api_version=3.0.2
# EOSSerial=d836a5aba9c742439ecb131493c4160e
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2009-08-09 11:59:24
# local_time=2009-08-09 07:59:24 (-0500, Eastern Daylight Time)
# country="United States"
# lang=9
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=3587 21 100 94 122571957500000
# compatibility_mode=5889 62 0 100 872660089375000
# scanned=305731
# found=12
# cleaned=0
# scan_time=13255
C:\Documents and Settings\Katarina\Local Settings\Application Data\Identities\{DBA3AEB9-D922-4EEE-9077-745F1A772337}\Microsoft\Outlook Express\Sent Items.dbx HTML/Iframe.B.Gen virus 00000000000000000000000000000000 I
C:\Documents and Settings\Katarina\My Documents\Mica\Mail\Flora Win32/Jep.Russ joke 00000000000000000000000000000000 I
C:\Documents and Settings\Katarina\My Documents\Mica\Old Mail\Ivan Flipped joke 00000000000000000000000000000000 I
C:\Documents and Settings\Nenad\Application Data\Thunderbird\Profiles\ej0bg8zn.default\Mail\Local Folders\Inbox probably a variant of Win32/TrojanDownloader.Agent trojan 00000000000000000000000000000000 I
C:\Documents and Settings\Nenad\Application Data\Thunderbird\Profiles\ej0bg8zn.default\Mail\Local Folders\Junk probably a variant of Win32/TrojanDownloader.Agent trojan 00000000000000000000000000000000 I
C:\downloads\Nero 9.2.5.0+Keygen[h33t]MasterUploader\Setup\Nero-9.2.5.0.exe Win32/Toolbar.AskSBar application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\FlRniVv.vbs.vir VBS/Disabler.NAB trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\SystemX86\249.music.au.vir a variant of WMA/TrojanDownloader.GetCodec.gen trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\SystemX86\250.music2.au.vir a variant of WMA/TrojanDownloader.GetCodec.gen trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\SystemX86\251.music3.au.vir a variant of WMA/TrojanDownloader.GetCodec.gen trojan 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\WINDOWS\system32\SystemX86\252.music.snd.vir a variant of WMA/TrojanDownloader.GetCodec.gen trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{A5FD8AA7-808B-49FA-9F27-478947BAB321}\RP205\A0031109.vbs VBS/Disabler.NAB trojan 00000000000000000000000000000000 I

hijackthis.log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:11:35 PM, on 8/9/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLSDBNT.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLPWDNT.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\stsystra.exe
C:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLPSP.EXE
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Documents and Settings\Nenad\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Nenad\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\TextPad 5\TextPad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton AntiVirus\Engine\16.5.0.134\IPSBHO.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [DLPSP] "c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLPSP.EXE"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Nenad\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 3557333390
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 3550020109
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D092B8F6-D1F0-46DC-97BC-84FEDD3A1E7C}: NameServer = 65.39.192.198,65.39.196.215
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Dell Printer Status Watcher (DLPWD) - Dell Inc. - c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLPWDNT.EXE
O23 - Service: Dell Printer Status Database (DLSDB) - Dell Inc. - c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLSDBNT.EXE
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 6467 bytes

by **Shaba** » August 10th, 2009, 12:00 am

Delete this:

C:\downloads\Nero 9.2.5.0+Keygen[h33t]MasterUploader

Empty this folder:

C:\Qoobox\Quarantine

Empty Recycle Bin.

Still problems?

Free Malware Removal Forum

need help removing malware (url.urtbk.com) + HijackThis log

need help removing malware (url.urtbk.com) + HijackThis log

Re: need help removing malware (url.urtbk.com) + HijackThis log

Re: need help removing malware (url.urtbk.com) + HijackThis log

Re: need help removing malware (url.urtbk.com) + HijackThis log

Re: need help removing malware (url.urtbk.com) + HijackThis log

Re: need help removing malware (url.urtbk.com) + HijackThis log

Re: need help removing malware (url.urtbk.com) + HijackThis log

Re: need help removing malware (url.urtbk.com) + HijackThis log

Re: need help removing malware (url.urtbk.com) + HijackThis log

Re: need help removing malware (url.urtbk.com) + HijackThis log

Re: need help removing malware (url.urtbk.com) + HijackThis log

Re: need help removing malware (url.urtbk.com) + HijackThis log

Re: need help removing malware (url.urtbk.com) + HijackThis log

Re: need help removing malware (url.urtbk.com) + HijackThis log

Re: need help removing malware (url.urtbk.com) + HijackThis log

Who is online