application or DLL C:\WINDOWS\system32\rusunife.dll is not a valid Windows image

Question

Hello-I am new to posting, but have been reading the forums for years. My daughter's computer acquired multiple infections. When she alerted me to the fact I found many problems and an unbelievable amount of malware on it. During the arduous process of rectifying the issues the error above began popping up aout 40 times during start up anda few more times as any program is requested. The computer seems to be working fine otherwise, and I no longer find any malware when I scan. I am guessing there is a residual bit of code somewhere, but have no idea how to hunt it down. I have considered pouring coffee on it but thought I would see if someone here could help first.

Thanks

Jean S.

Bugbatter · Answer

Instead of coffee, Clorox might be better (just kidding, of course):emotion-2:

What did you use to remove the malware and what scans did you run? I don't want to repeat anything that you've already done.

Please review the Please Read This Before Posting For Malware Removal Help announcement at the top of the forum as well. I look forward to your reply.

motherthing1 · Answer

Whoops-I had read 'the read this before...' but it was a couple of weeks ago. I scanned with Spybot, lavasoft's Ad-Aware, Windows malware removal tool, windows defender, AVG anti virus, Malwarebytes anti malware and before I had read some of your other posts and saw malware bytes and spybot(which was most useful) as suggestions, I had used PC Tools Spyware Doctor. I let all of them remove whatever they found. They found vitumunde, vundo, fake av and some others. I didn't keep track; that was a couple of weeks ago. When I first started with it the firewall was off(causing much acrimonious finger pointing among the offspring) automatic updates was not functional, neither AVG nor Ad-aware would update and the browser would come up unasked for, refuse to go to sites like microsoft and was full of dire virus warnings. All of that is now fixed, the computer is behaving relatively well, except for the repeated error. Here is the HJT log. Logfile of Trend Micro HijackThis v2.0.2Scan saved at 8:13:51 AM, on 2/2/2009Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.6000.16762)Boot mode: Normal Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\csrss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Intel\Wireless\Bin\EvtEng.exeC:\Program Files\Intel\Wireless\Bin\S24EvMon.exeC:\Program Files\Intel\Wireless\Bin\WLKeeper.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Lavasoft\Ad-Aware\aawservice.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeC:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exeC:\PROGRA~1\AVG\AVG8\avgwdsvc.exeC:\Program Files\Bonjour\mDNSResponder.exeC:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exeC:\WINDOWS\eHome\ehRecvr.exeC:\WINDOWS\eHome\ehSched.exeC:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exeC:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXEC:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exeC:\Program Files\Dell\QuickSet\NICCONFIGSVC.exeC:\PROGRA~1\AVG\AVG8\avgrsx.exeC:\WINDOWS\system32
vsvc32.exeC:\Program Files\Intel\Wireless\Bin\RegSrvc.exeC:\Program Files\Spyware Doctor\pctsAuxs.exeC:\Program Files\Spyware Doctor\pctsSvc.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\stacsv.exeC:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exeC:\WINDOWS\ehome\mcrdsvc.exeC:\WINDOWS\system32\dllhost.exeC:\WINDOWS\System32\alg.exeC:\WINDOWS\system32\wbem\wmiprvse.exeC:\WINDOWS\system32undll32.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\iPod\bin\iPodService.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\ehome\ehtray.exeC:\Program Files\Synaptics\SynTP\SynTPEnh.exeC:\WINDOWS\eHome\ehmsas.exeC:\WINDOWS\system32undll32.exeC:\Program Files\Intel\Wireless\bin\ZCfgSvc.exeC:\Program Files\Intel\Wireless\Bin\ifrmewrk.exeC:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exeC:\WINDOWS\stsystra.exeC:\Program Files\Dell\Media Experience\DMXLauncher.exeC:\Program Files\Dell\QuickSet\quickset.exeC:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exeC:\WINDOWS\system32\Rundll32.exeC:\Program Files\Creative\VoiceCenter\AndreaVC.exeC:\DOCUME~1\ADMINN~1\LOCALS~1\Temp\clclean.0001C:\Program Files\Common Files\InstallShield\UpdateService\issch.exeC:\WINDOWS\System32\DLA\DLACTRLW.EXEC:\Program Files\Google\Google Desktop Search\GoogleDesktop.exeC:\PROGRA~1\AVG\AVG8\avgtray.exeC:\Program Files\Google\Google Desktop Search\GoogleDesktop.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\Spyware Doctor\pctsTray.exeC:\Program Files\NetWaiting
etWaiting.exeC:\Program Files\Dell Support\DSAgnt.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exeC:\Program Files\Digital Line Detect\DLG.exeC:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exeC:\Program Files\Trend Micro\HijackThis\HijackThis.exeC:\WINDOWS\system32\wbem\wmiprvse.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.comR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://support.dell.com/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.comR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.comR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.htmlR0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.avg.com/ww.special-toolbar-first-run-tlbrfR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo!O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dllO2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dllO2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLLO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLLO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dllO2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dllO2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dllO2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dllO2 - BHO: (no name) - {CAEB658C-EA47-496B-892C-F209F7CE7D41} - (no file)O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dllO3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLLO3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dllO4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exeO4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exeO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [nwiz] nwiz.exe /installquietO4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,StartO4 - HKLM\..\Run: [IntelZeroConfig] 'C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe'   Thank-you Jean

Bugbatter · Answer

We need to see some additional information about what is happening in the machine.

Download DDS by sUBs from one of the following links. Save it to your desktop.
Double click on the DDS icon, allow it to run.
A small box will open, with an explanation about the tool.
Click Yes at the prompt for Optional Scan.
When done, DDS will open two (2) logs
1. DDS.txt
2. Attach.txt
Save both reports to your desktop.
Copy/paste both logs to your reply on the forum.
Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet. Information on A/V control HERE.

motherthing1 · Answer

OK-that was painful. My error message came up and had to be ok'd about 100 times to get this to run, but here they are, I hope they are right because there was no prompt for an optional scan, just a dos window with excruciatingly correct grammar assuring me of benign intentions. DDS (Ver_09-02-01.01) - NTFSx86  Run by Adminnistrator at 16:42:29.11 on Mon 02/02/2009Internet Explorer: 7.0.5730.11Microsoft Windows XP Professional  5.1.2600.3.1252.1.1033.18.1022.483 [GMT -9:00] AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)FW: Norton Internet Worm Protection *disabled* ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunchC:\WINDOWS\system32\svchost -k rpcssC:\WINDOWS\System32\svchost.exe -k netsvcsC:\WINDOWS\system32\svchost.exe -k WudfServiceGroupC:\Program Files\Intel\Wireless\Bin\EvtEng.exeC:\Program Files\Intel\Wireless\Bin\S24EvMon.exeC:\Program Files\Intel\Wireless\Bin\WLKeeper.exeC:\WINDOWS\system32\svchost.exe -k NetworkServiceC:\WINDOWS\system32\svchost.exe -k LocalServiceC:\Program Files\Lavasoft\Ad-Aware\aawservice.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeC:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exeC:\PROGRA~1\AVG\AVG8\avgwdsvc.exeC:\Program Files\Bonjour\mDNSResponder.exeC:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exeC:\WINDOWS\eHome\ehRecvr.exeC:\WINDOWS\eHome\ehSched.exeC:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exeC:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXEC:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exeC:\Program Files\Dell\QuickSet\NICCONFIGSVC.exeC:\PROGRA~1\AVG\AVG8\avgrsx.exeC:\WINDOWS\system32
vsvc32.exeC:\Program Files\Intel\Wireless\Bin\RegSrvc.exeC:\WINDOWS\system32\svchost.exe -k LocalServiceC:\WINDOWS\system32\stacsv.exeC:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exeC:\WINDOWS\ehome\mcrdsvc.exeC:\WINDOWS\system32\dllhost.exeC:\WINDOWS\System32\alg.exeC:\WINDOWS\system32\wbem\wmiprvse.exeC:\WINDOWS\system32undll32.exeC:\WINDOWS\System32\svchost.exe -k HTTPFilterC:\Program Files\iPod\bin\iPodService.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\ehome\ehtray.exeC:\Program Files\Synaptics\SynTP\SynTPEnh.exeC:\WINDOWS\system32undll32.exeC:\Program Files\Intel\Wireless\bin\ZCfgSvc.exeC:\WINDOWS\eHome\ehmsas.exeC:\Program Files\Intel\Wireless\Bin\ifrmewrk.exeC:\WINDOWS\stsystra.exeC:\Program Files\Dell\Media Experience\DMXLauncher.exeC:\Program Files\Dell\QuickSet\quickset.exeC:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exeC:\WINDOWS\system32\Rundll32.exeC:\Program Files\Creative\VoiceCenter\AndreaVC.exeC:\Program Files\Common Files\InstallShield\UpdateService\issch.exeC:\WINDOWS\System32\DLA\DLACTRLW.EXEC:\Program Files\Google\Google Desktop Search\GoogleDesktop.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\NetWaiting
etWaiting.exeC:\Program Files\Dell Support\DSAgnt.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exeC:\Program Files\Digital Line Detect\DLG.exeC:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exeC:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exeC:\Program Files\Google\Google Desktop Search\GoogleDesktop.exeC:\DOCUME~1\ADMINN~1\LOCALS~1\Temp\clclean.0001C:\Program Files\Internet Explorer\iexplore.exeC:\PROGRA~1\AVG\AVG8\aAvgApi.exeC:\Program Files\AVG\AVG8\avgui.exeC:\Documents and Settings\Adminnistrator\Desktop\dds.comC:\WINDOWS\system32\wbem\wmiprvse.exe ============== Pseudo HJT Report =============== uStart Page = hxxp://support.dell.com/uSearch Page = hxxp://www.google.com/hws/sb/dell-usuk/en/side.html?channel=usuWindow Title = Windows Internet Explorer provided by Yahoo!uDefault_Page_URL = hxxp://www.yahoo.commDefault_Page_URL = hxxp://www.yahoo.commDefault_Search_URL = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.commSearch Page = hxxp://www.google.commStart Page = hxxp://www.msn.commSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.htmluInternet Connection Wizard,ShellNext = hxxp://www.avg.com/ww.special-toolbar-first-run-tlbrfBHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\progra~1\yahoo!\companion\installs\cpn0\yt.dllBHO: NoExplorer - No FileBHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dllBHO: Yahoo! IE Services Button: {5bab4b5b-68bc-4b02-94d6-2fc0de4a7897} - c:\program files\yahoo!\common\yiesrvc.dllBHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\DLASHX_W.DLLBHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.5.0_06\bin\ssv.dllBHO: AVG Security Toolbar: {a057a204-bacc-4d26-9990-79a187e2698e} - c:\progra~1\avg\avg8\AVGTOO~1.DLLBHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dllBHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.0.926.3450\swg.dllBHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_219B3E1547538286.dllBHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\bae\BAE.dll{caeb658c-ea47-496b-892c-f209f7ce7d41}TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn0\yt.dllTB: AVG Security Toolbar: {a057a204-bacc-4d26-9990-79a187e2698e} - c:\progra~1\avg\avg8\AVGTOO~1.DLLTB: &Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dllTB: {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No FileTB: {C4069E3A-68F1-403E-B40E-20066696354B} - No FileuRun: [ModemOnHold] c:\program files
etwaiting
etWaiting.exeuRun: [SetDefaultMIDI] MIDIDef.exeuRun: [DellSupport] 'c:\program files\dell support\DSAgnt.exe' /startupuRun: [ctfmon.exe] c:\windows\system32\ctfmon.exeuRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exeuRun: [MSMSGS] 'c:\program files\messenger\msmsgs.exe' /backgroundmRun: [ehTray] c:\windows\ehome\ehtray.exemRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exemRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartupmRun: [nwiz] nwiz.exe /installquietmRun: [NVHotkey] rundll32.exe nvHotkey.dll,StartmRun: [IntelZeroConfig] 'c:\program files\intel\wireless\bin\ZCfgSvc.exe'mRun: [IntelWireless] 'c:\program files\intel\wireless\bin\ifrmewrk.exe' /tf Intel PROSet/WirelessmRun: [SigmatelSysTrayApp] stsystra.exemRun: [DMXLauncher] c:\program files\dell\media experience\DMXLauncher.exemRun: [Dell QuickSet] c:\program files\dell\quickset\quickset.exemRun: [CTSysVol] c:\program files\creative\sbaudigy\surround mixer\CTSysVol.exe /rmRun: [MBMon] Rundll32 CTMBHA.DLL,MBMonmRun: [UpdReg] c:\windows\UpdReg.EXEmRun: [VoiceCenter] 'c:\program files\creative\voicecenter\AndreaVC.exe' /traymRun: [ISUSPM Startup] 'c:\program files\common files\installshield\updateservice\isuspm.exe' -startupmRun: [ISUSScheduler] 'c:\program files\common files\installshield\updateservice\issch.exe' -startmRun: [DLA] c:\windows\system32\dla\DLACTRLW.EXEmRun: [Google Desktop Search] 'c:\program files\google\google desktop search\GoogleDesktop.exe' /startupmRun: [Adobe Reader Speed Launcher] 'c:\program files\adobeeader 8.0eader\Reader_sl.exe'mRun: [Windows Defender] 'c:\program files\windows defender\MSASCui.exe' -hidemRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exemRun: [QuickTime Task] 'c:\program files\quicktime\qttask.exe' -atboottimemRun: [iTunesHelper] 'c:\program files\itunes\iTunesHelper.exe' Attach.txtDDS (Ver_09-02-01.01) Microsoft Windows XP ProfessionalBoot Device: \Device\HarddiskVolume2Install Date: 10/2/2006 3:50:44 PMSystem Uptime: 2/2/2009 4:26:49 AM (12 hours ago) Motherboard: Dell Inc. |  | 0KG266Processor: Intel(R) Core(TM)2 CPU         T5600  @ 1.83GHz | Microprocessor | 1828/133mhz ==== Disk Partitions ========================= C: is FIXED (NTFS) - 50 GiB total, 17.383 GiB free.D: is CDROM ()E: is Removable ==== Disabled Device Manager Items ============= ==== System Restore Points =================== No restore point in system. ==== Installed Programs ====================== Ad-AwareAdobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)Adobe Flash Player 10 ActiveXAdobe Flash Player 10 PluginAdobe Reader 8.1.2Adobe Reader 8.1.2 Security Update 1 (KB403742)Adobe Shockwave PlayerAmazon MP3 Downloader 1.0.0+6Andrea VoiceCenterAOLIconApple Mobile Device SupportApple Software UpdateAVG Free 8.0Banctec Service AgreementBeTrapped!BonjourBroadcom Management ProgramsConexant HDA D110 MDC V.92 ModemDell CinePlayerDell Digital Jukebox DriverDell Game ConsoleDell Support 3.2Dell System RestoreDietPower 4.0Digital Content PortalDigital Line DetectDocumentation & Support LauncherEarthLink setup filesEducateUELIconEpocrates EssentialsESPNMotionGames, Music, & Photos LauncherGemMaster MysticGet High Speed Internet!getPlus(R)_ocxGoogle DesktopGoogle EarthGoogle Toolbar for Internet ExplorerGoogle UpdaterHigh Definition Audio Driver Package - KB835221HijackThis 2.0.2Hotfix 2050 for SQL Server 2000 ENU (KB948110)Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)Hotfix for Windows Internet Explorer 7 (KB947864)Hotfix for Windows Media Format 11 SDK (KB929399)Hotfix for Windows Media Player 10 (KB903157)Hotfix for Windows Media Player 11 (KB939683)Hotfix for Windows XP (KB952287)Hotfix for Windows XP (KB954550-v5)ieSpellIntel(R) PROSet/Wireless SoftwareInternet Service Offers LauncheriTunesJ2SE Runtime Environment 5.0 Update 6Learn2 Player (Uninstall Only)LiveUpdate 3.0 (Symantec Corporation)LUMIX Simple ViewerMalwarebytes' Anti-MalwaremCoremDrWiFiMemeo AutoBackupmHlpDellMicrosoft .NET Framework 1.1Microsoft .NET Framework 1.1 Hotfix (KB928366)Microsoft .NET Framework 2.0 Service Pack 2Microsoft .NET Framework 3.0 Service Pack 2Microsoft .NET Framework 3.5 SP1Microsoft Age of Empires IIMicrosoft Age of Empires II: The Conquerors ExpansionMicrosoft Compression Client Pack 1.0 for Windows XPMicrosoft Internationalized Domain Names Mitigation APIsMicrosoft National Language Support Downlevel APIsMicrosoft Office Outlook 2003 with Business Contact Manager UpdateMicrosoft Office Small Business Edition 2003Microsoft Plus! Digital Media Edition InstallerMicrosoft Plus! Photo Story 2 LEMicrosoft SQL Server Desktop Engine (MICROSOFTSMLBIZ)Microsoft User-Mode Driver Framework Feature Pack 1.0Microsoft Visual C++ 2005 RedistributablemIWAmLogViewmMHouseModem HelperMozilla Firefox (3.0.5)mPfMgrmPfWizmProSafeMSNmSSOMSXML 4.0 SP2 (KB925672)MSXML 4.0 SP2 (KB927978)MSXML 4.0 SP2 (KB936181)MSXML 4.0 SP2 (KB954430)Musicmatch® JukeboxmWlsSafemWMImXMLmZConfigNetWaitingNetZeroInstallersNVIDIA DriversOttoPalm DesktopPocket Tanks v1.3QuickSetQuickTimeRealPlayer BasicRegistry Mechanic 8.0RhapsodyRhapsody Player EngineRoxio DLARoxio RecordNow AudioRoxio RecordNow CopyRoxio RecordNow DataSafariSearchAssistSecurity Update for CAPICOM (KB931906)Security Update for Windows Internet Explorer 7 (KB928090)Security Update for Windows Internet Explorer 7 (KB929969)Security Update for Windows Internet Explorer 7 (KB931768)Security Update for Windows Internet Explorer 7 (KB933566)Security Update for Windows Internet Explorer 7 (KB937143)Security Update for Windows Internet Explorer 7 (KB938127)Security Update for Windows Internet Explorer 7 (KB939653)Security Update for Windows Internet Explorer 7 (KB942615)Security Update for Windows Internet Explorer 7 (KB944533)Security Update for Windows Internet Explorer 7 (KB950759)Security Update for Windows Internet Explorer 7 (KB953838)Security Update for Windows Internet Explorer 7 (KB956390)Security Update for Windows Internet Explorer 7 (KB958215)Security Update for Windows Internet Explorer 7 (KB960714)Security Update for Windows Media Player (KB911564)Security Update for Windows Media Player (KB952069)Security Update for Windows Media Player 10 (KB917734)Security Update for Windows Media Player 10 (KB936782)Security Update for Windows Media Player 11 (KB936782)Security Update for Windows Media Player 11 (KB954154)Security Update for Windows Media Player 6.4 (KB925398)Security Update for Windows XP (KB923689)Security Update for Windows XP (KB938464)Security Update for Windows XP (KB941569)Security Update for Windows XP (KB946648)Security Update for Windows XP (KB950760)Security Update for Windows XP (KB950762)Security Update for Windows XP (KB950974)Security Update for Windows XP (KB951066)Security Update for Windows XP (KB951376-v2)Security Update for Windows XP (KB951376)Security Update for Windows XP (KB951698)Security Update for Windows XP (KB951748)Security Update for Windows XP (KB952954)Security Update for Windows XP (KB953839)Security Update for Windows XP (KB954211)Security Update for Windows XP (KB954459)Security Update for Windows XP (KB954600)Security Update for Windows XP (KB955069)Security Update for Windows XP (KB956391)Security Update for Windows XP (KB956802)Security Update for Windows XP (KB956803)Security Update for Windows XP (KB956841)Security Update for Windows XP (KB957095)Security Update for Windows XP (KB957097)Security Update for Windows XP (KB958644)Security Update for Windows XP (KB958687)skiStuntSonic Activation ModuleSonic Advanced DecoderSonic EncodersSonic Update ManagerSound Blaster ADVANCED MB DriversSound Blaster Audigy ADVANCED MBSound Blaster Audigy ADVANCED MB Product RegistrationSpybot - Search & DestroySpyware Doctor 6.0Symantec KB-DocID:2003093015493306Symantec Technical Support Web ControlsSynaptics Pointing Device DriverTradewindsUpdate for Windows Media Player 10 (KB910393)Update for Windows Media Player 10 (KB913800)Update for Windows Media Player 10 (KB926251)Update for Windows XP (KB951072-v2)Update for Windows XP (KB951978)Update for Windows XP (KB955839)Update Rollup 2 for Windows XP Media Center Edition 2005URL AssistantViewpoint Media PlayerVirtools 3D Life PlayerWD DiagnosticsWebFldrs XPWindows DefenderWindows Genuine Advantage Notifications (KB905474)Windows Genuine Advantage Validation Tool (KB892130)Windows Installer 3.1 (KB893803)Windows Internet Explorer 7Windows Media Format 11 runtimeWindows Media Player 10Windows Media Player 10 Hotfix [See EmeraldQFE2 for more information]Windows Media Player 11Windows XP Media Center Edition 2005 KB908246Windows XP Media Center Edition 2005 KB925766Windows XP Service Pack 3Yahoo! Browser ServicesYahoo! Install ManagerYahoo! Internet MailYahoo! MessengerYahoo! Photos Easy Upload Tool 1v7Yahoo! Toolbar ==== Event Viewer Messages From Past Week ======== 1/31/2009 7:05:41 AM, error: Service Control Manager [7002]  - The PARPEPPY service depends on the Parallel arbitrator group and no member of this group started.1/31/2009 7:05:41 AM, error: Service Control Manager [7000]  - The MCSTRM service failed to start due to the following error:  The system cannot find the file specified.1/31/2009 7:04:42 AM, error: Dhcp [1002]  - The IP address lease 192.168.1.2 for the Network Card with network address 0015C53E1B8C has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).1/30/2009 12:31:09 PM, error: Service Control Manager [7011]  - Timeout (30000 milliseconds) waiting for a transaction response from the  service.1/30/2009 12:30:45 PM, error: Service Control Manager [7011]  - Timeout (30000 milliseconds) waiting for a transaction response from the avg8wd service.1/30/2009 11:00:38 AM, error: NetBT [4319]  - A duplicate name has been detected on the TCP network.  The IP address of the machine that sent the message is in the data. Use nbtstat -n in a command window to see which name is in the Conflict state.1/28/2009 9:08:50 PM, error: W32Time [17]  - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751)2/2/2009 4:07:14 PM, error: Service Control Manager [7034]  - The PC Tools Security Service service terminated unexpectedly.  It has done this 1 time(s). ==== End Of File ===========================

Bugbatter · Answer

Please visit this webpage for download links, and instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

" * Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Please include the C:\ComboFix.txt in your next reply along with a fresh HijackThis log for further review. Your first HijackThis log was incomplete. Please make sure you copy and paste the entire log.

* Additional information on A/V control HERE

.

motherthing1 · Answer

Ok- Highjack this log after combifix scan- Logfile of Trend Micro HijackThis v2.0.2Scan saved at 10:24:08 AM, on 2/3/2009Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.6000.16762)Boot mode: Normal Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Intel\Wireless\Bin\EvtEng.exeC:\Program Files\Intel\Wireless\Bin\S24EvMon.exeC:\Program Files\Intel\Wireless\Bin\WLKeeper.exeC:\Program Files\Lavasoft\Ad-Aware\aawservice.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeC:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exeC:\PROGRA~1\AVG\AVG8\avgwdsvc.exeC:\Program Files\Bonjour\mDNSResponder.exeC:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exeC:\WINDOWS\eHome\ehRecvr.exeC:\WINDOWS\eHome\ehSched.exeC:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exeC:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXEC:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exeC:\Program Files\Dell\QuickSet\NICCONFIGSVC.exeC:\PROGRA~1\AVG\AVG8\avgrsx.exeC:\WINDOWS\system32
vsvc32.exeC:\Program Files\Intel\Wireless\Bin\RegSrvc.exeC:\WINDOWS\system32\stacsv.exeC:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exeC:\WINDOWS\system32\dllhost.exeC:\WINDOWS\ehome\ehtray.exeC:\Program Files\Synaptics\SynTP\SynTPEnh.exeC:\WINDOWS\eHome\ehmsas.exeC:\WINDOWS\system32undll32.exeC:\Program Files\Intel\Wireless\bin\ZCfgSvc.exeC:\Program Files\Intel\Wireless\Bin\ifrmewrk.exeC:\WINDOWS\stsystra.exeC:\Program Files\Dell\Media Experience\DMXLauncher.exeC:\Program Files\Dell\QuickSet\quickset.exeC:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exeC:\WINDOWS\system32\Rundll32.exeC:\Program Files\Creative\VoiceCenter\AndreaVC.exeC:\Program Files\Common Files\InstallShield\UpdateService\issch.exeC:\WINDOWS\System32\DLA\DLACTRLW.EXEC:\Program Files\Google\Google Desktop Search\GoogleDesktop.exeC:\PROGRA~1\AVG\AVG8\avgtray.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\NetWaiting
etWaiting.exeC:\Program Files\Dell Support\DSAgnt.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exeC:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exeC:\Program Files\Messenger\msmsgs.exeC:\Program Files\Digital Line Detect\DLG.exeC:\Palm\HOTSYNC.EXEC:\DOCUME~1\ADMINN~1\LOCALS~1\Temp\clclean.0001C:\Program Files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exeC:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exeC:\Program Files\iPod\bin\iPodService.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\explorer.exeC:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://en.community.dell.com/forums/t/19255839.aspxR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.htmlR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.avg.com/ww.special-toolbar-first-run-tlbrfO2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dllO2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dllO2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLLO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLLO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dllO2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dllO2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dllO2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dllO3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dllO3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLLO3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dllO4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exeO4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exeO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [nwiz] nwiz.exe /installquietO4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,StartO4 - HKLM\..\Run: [IntelZeroConfig] 'C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe'O4 - HKLM\..\Run: [IntelWireless] 'C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe' /tf Intel PROSet/WirelessO4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exeO4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exeO4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exeO4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /rO4 - HKLM\..\Run: [MBMon] Rundll32 CTMBHA.DLL,MBMonO4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXEO4 - HKLM\..\Run: [VoiceCenter] 'C:\Program Files\Creative\VoiceCenter\AndreaVC.exe' /trayO4 - HKLM\..\Run: [ISUSPM Startup] 'C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe' -startupO4 - HKLM\..\Run: [ISUSScheduler] 'C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe' -startO4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXEO4 - HKLM\..\Run: [Google Desktop Search] 'C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe' /startupO4 - HKLM\..\Run: [Adobe Reader Speed Launcher] 'C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe'O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exeO4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottimeO4 - HKLM\..\Run: [iTunesHelper] 'C:\Program Files\iTunes\iTunesHelper.exe'O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting
etWaiting.exeO4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exeO4 - HKCU\..\Run: [DellSupport] 'C:\Program Files\Dell Support\DSAgnt.exe' /startupO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exeO4 - HKCU\..\Run: [MSMSGS] 'C:\Program Files\Messenger\msmsgs.exe' /backgroundO4 - HKUS\S-1-5-18\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'SYSTEM')O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] 'C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe' -t (User 'SYSTEM')O4 - HKUS\.DEFAULT\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Default user')O4 - Global Startup: Digital Line Detect.lnk = ?O4 - Global Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXEO4 - Global Startup: LUMIX Simple Viewer.lnk = ?O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exeO8 - Extra context menu item: &ieSpell Options - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTMO8 - Extra context menu item: Check &Spelling - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTMO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000O8 - Extra context menu item: Lookup on Merriam Webster - file://C:\Program Files\ieSpell\Merriam Webster.HTMO8 - Extra context menu item: Lookup on Wikipedia - file://C:\Program Files\ieSpell\wikipedia.HTMO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dllO9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dllO9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dllO9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dllO9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dllO9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLLO9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dllO9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dllO16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1163118805953O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cabO16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cabO16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cabO16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/virtools.download.akamai.com/6712/player/install/installer.exeO18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dllO20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dllO23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exeO23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeO23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exeO23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exeO23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exeO23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exeO23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exeO23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exeO23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exeO23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXEO23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exeO23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exeO23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exeO23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exeO23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exeO23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\WINDOWS\system32\stacsv.exeO23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exeO23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe --End of file - 14104 bytes Combifix scan: ComboFix 09-02-02.04 - Adminnistrator 2009-02-03 10:03:08.1 - NTFSx86Microsoft Windows XP Professional  5.1.2600.3.1252.1.1033.18.1022.516 [GMT -9:00]Running from: c:\documents and settings\Adminnistrator\Desktop\ComboFix.exeAV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)FW: Norton Internet Worm Protection *disabled* * Created a new restore point. (((((((((((((((((((((((((((((((((((((((   Other Deletions   ))))))))))))))))))))))))))))))))))))))))))))))))). c:\windows\IE4 Error Log.txtc:\windows\system32\_000006_.tmp.dllc:\windows\system32\_000008_.tmp.dllc:\windows\system32\aleyahet.inic:\windows\system32\ampgnery.inic:\windows\system32\anomonov.inic:\windows\system32\egijiroh.inic:\windows\system32\idasevev.inic:\windows\system32\mdviolnp.inic:\windows\system32
kgoqxhh.inic:\windows\system32\obiyotek.inic:\windows\system32\opiwovid.inic:\windows\system32uzunife.dllc:\windows\system32\senekadujwndye.datc:\windows\system32	est.tttc:\windows\system32\uguruzan.inic:\windows\system32\utipogaf.inic:\windows\system32\win32hlp.cnf .(((((((((((((((((((((((((((((((((((((((   Drivers/Services   ))))))))))))))))))))))))))))))))))))))))))))))))). -------\Service_seneka (((((((((((((((((((((((((   Files Created from 2009-01-03 to 2009-02-03  ))))))))))))))))))))))))))))))). 2009-02-01 14:44 . 2009-02-01 14:44   d-------- c:\program files\ieSpell 2009-01-31 06:48 . 2009-01-31 06:48   d-------- c:\windows\system32\XPSViewer 2009-01-31 06:47 . 2009-01-31 06:47   d-------- c:\program files\Reference Assemblies 2009-01-31 06:47 . 2009-01-31 06:47   d-------- c:\program files\MSBuild 2009-01-31 06:47 . 2009-01-31 06:47   d-------- C:\64fda4fdd64004d80be0a99673 2009-01-31 06:47 . 2008-07-06 03:06 1,676,288 --------- c:\windows\system32\xpssvcs.dll 2009-01-31 06:47 . 2008-07-06 03:06 1,676,288 --------- c:\windows\system32\dllcache\xpssvcs.dll 2009-01-31 06:47 . 2008-07-06 01:50 597,504 --------- c:\windows\system32\dllcache\printfilterpipelinesvc.exe 2009-01-31 06:47 . 2008-07-06 03:06 575,488 --------- c:\windows\system32\xpsshhdr.dll 2009-01-31 06:47 . 2008-07-06 03:06 575,488 --------- c:\windows\system32\dllcache\xpsshhdr.dll 2009-01-31 06:47 . 2008-07-06 03:06 117,760 --------- c:\windows\system32\prntvpt.dll 2009-01-31 06:47 . 2008-07-06 03:06 89,088 --------- c:\windows\system32\dllcache\filterpipelineprintproc.dll 2009-01-31 06:46 . 2009-01-31 07:04   d-------- c:\windows\SxsCaPendDel 2009-01-30 15:21 . 2009-01-30 15:21 10,520 --a------ c:\windows\system32\avgrsstx.dll 2009-01-22 13:01 . 2009-01-22 13:01   d-------- c:\windows\2DMW5ENW6FOX6GPY 2009-01-21 07:50 . 2009-01-21 07:50   d-------- c:\program files\Trend Micro 2009-01-19 12:57 . 2009-01-21 06:16   d-------- c:\documents and settings\Adminnistrator\.housecall6.6 2009-01-19 09:47 . 2009-01-20 12:01   d-------- c:\documents and settings\Adminnistrator\Application Data\Yahoo! 2009-01-19 09:43 . 2009-02-01 12:38   d-------- c:\documents and settings\Adminnistrator\Application Data\AVGTOOLBAR 2009-01-18 17:59 . 2009-01-18 17:59   d-------- c:\documents and settings\Adminnistrator\Application Data\Malwarebytes 2009-01-18 14:41 . 2006-09-26 19:36   d-------- c:\documents and settings\Adminnistrator\Application Data\Intel 2009-01-18 14:41 . 2006-09-26 20:03   d--h----- c:\documents and settings\Adminnistrator\Application Data\Gtek 2009-01-18 14:41 . 2009-01-31 07:02   d-------- c:\documents and settings\Adminnistrator 2009-01-17 11:49 . 2009-01-17 11:49   d-------- c:\documents and settings\Sarah\Application Data\Malwarebytes 2009-01-16 18:45 . 2009-01-19 10:47   d-------- c:\program files\Spybot - Search & Destroy 2009-01-16 18:45 . 2009-01-27 18:27   d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2009-01-16 16:48 . 2009-01-16 16:48   d-------- c:\documents and settings\Andrew\Application Data\Malwarebytes 2009-01-16 15:41 . 2009-01-16 15:41   d-------- c:\documents and settings\Jean\Application Data\Malwarebytes 2009-01-16 15:40 . 2009-01-16 15:41   d-------- c:\program files\Malwarebytes' Anti-Malware 2009-01-16 15:40 . 2009-01-16 15:40   d-------- c:\documents and settings\All Users\Application Data\Malwarebytes 2009-01-16 15:40 . 2009-01-14 16:11 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys 2009-01-16 15:40 . 2009-01-14 16:11 15,504 --a------ c:\windows\system32\drivers\mbam.sys 2009-01-15 15:13 . 2009-01-15 15:13   d-------- c:\documents and settings\Sarah\Application Data\AVG7 2009-01-15 15:13 . 2009-01-15 15:13   d-------- c:\documents and settings\Jake\Application Data\AVG7 2009-01-14 11:37 . 2009-01-14 11:37   d-------- c:\program files\Lavasoft 2009-01-14 11:37 . 2009-01-14 12:14   d-------- c:\documents and settings\All Users\Application Data\Lavasoft 2009-01-14 11:36 . 2009-01-14 11:36   d-------- c:\program files\Common Files\Wise Installation Wizard 2009-01-13 15:52 . 2009-01-13 15:52   d-------- c:\documents and settings\Jacob\Application Data\Yahoo! 2009-01-04 06:37 . 2009-01-04 06:37   d-------- c:\windows\system32\config\systemprofile\Application Data\Yahoo! 2009-01-04 06:37 . 2009-01-04 06:40   d-------- c:\windows\system32\config\systemprofile\Application Data\AVGTOOLBAR 2009-01-03 12:29 . 2009-02-02 21:41   d-------- c:\program files\Spyware Doctor 2009-01-03 12:29 . 2009-01-03 12:29   d-------- c:\documents and settings\Jean\Application Data\PC Tools 2009-01-03 12:29 . 2009-02-03 09:58   d-a------ c:\documents and settings\All Users\Application Data\TEMP 2009-01-03 12:29 . 2008-08-25 12:36 81,288 --a------ c:\windows\system32\drivers\iksyssec.sys 2009-01-03 12:29 . 2008-08-25 12:36 66,952 --a------ c:\windows\system32\drivers\iksysflt.sys 2009-01-03 12:29 . 2008-08-25 12:36 40,840 --a------ c:\windows\system32\drivers\ikfilesec.sys 2009-01-03 12:29 . 2008-06-02 16:19 29,576 --a------ c:\windows\system32\drivers\kcom.sys .((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))).2009-02-03 00:24 --------- d-----w c:\documents and settings\All Users\Application Data\Google Updater2009-01-31 00:21 325,128 ----a-w c:\windows\system32\drivers\avgldx86.sys2009-01-30 20:14 --------- d-----w c:\documents and settings\All Users\Application Data\avg82009-01-17 00:37 --------- d--h--r c:\documents and settings\Jean\Application Data\yahoo!2009-01-16 17:04 --------- d-----w c:\program files\Google2009-01-16 17:03 --------- d-----w c:\documents and settings\Jacob\Application Data\AVGTOOLBAR2009-01-16 00:53 --------- d-----w c:\program files\RGB2009-01-14 01:06 --------- d-----w c:\documents and settings\Jean\Application Data\Lavasoft2009-01-01 07:57 --------- d-----w c:\documents and settings\Andrew\Application Data\AVGTOOLBAR2008-12-20 08:26 --------- d-----w c:\documents and settings\Jake\Application Data\Apple Computer2008-12-19 23:23 --------- d-----w c:\documents and settings\Andrew\Application Data\Yahoo!2008-12-19 03:01 --------- d-----w c:\program files\Pocket Tanks2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys2008-12-06 23:39 --------- d-----w c:\documents and settings\Jake\Application Data\Sonic2008-12-06 23:39 --------- d-----w c:\documents and settings\Jake\Application Data\Leadertech2008-12-06 20:29 --------- d-----w c:\documents and settings\Jake\Application Data\Yahoo!2008-12-06 19:20 --------- d-----w c:\program files\Rhapsody2008-07-10 02:46 88 --sh--r c:\windows\system32\B49E8BE30D.sys2008-07-10 02:46 3,766 --sha-w c:\windows\system32\KGyGaAvL.sys2008-08-05 11:07 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008080520080806\index.dat. (((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]'ModemOnHold'='c:\program files\NetWaiting
etWaiting.exe' [2003-09-09 20480]'DellSupport'='c:\program files\Dell Support\DSAgnt.exe' [2006-07-16 389120]'ctfmon.exe'='c:\windows\system32\ctfmon.exe' [2008-04-13 15360]'swg'='c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe' [2007-04-03 68856]'MSMSGS'='c:\program files\Messenger\msmsgs.exe' [2008-04-13 1695232]'SetDefaultMIDI'='MIDIDef.exe' [2004-12-22 c:\windows\MIDIDEF.EXE] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]'ehTray'='c:\windows\ehome\ehtray.exe' [2005-09-29 67584]'SynTPEnh'='c:\program files\Synaptics\SynTP\SynTPEnh.exe' [2006-03-08 761947]'NvCplDaemon'='c:\windows\system32\NvCpl.dll' [2006-03-21 7557120]'IntelZeroConfig'='c:\program files\Intel\Wireless\bin\ZCfgSvc.exe' [2006-05-01 667718]'IntelWireless'='c:\program files\Intel\Wireless\Bin\ifrmewrk.exe' [2006-05-01 602182]'DMXLauncher'='c:\program files\Dell\Media Experience\DMXLauncher.exe' [2005-10-04 94208]'Dell QuickSet'='c:\program files\Dell\QuickSet\quickset.exe' [2006-06-29 1032192]'CTSysVol'='c:\program files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe' [2005-10-31 57344]'UpdReg'='c:\windows\UpdReg.EXE' [2000-05-10 90112]'VoiceCenter'='c:\program files\Creative\VoiceCenter\AndreaVC.exe' [2006-02-16 1118208]'ISUSPM Startup'='c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe' [2005-06-10 249856]'ISUSScheduler'='c:\program files\Common Files\InstallShield\UpdateService\issch.exe' [2005-06-10 81920]'DLA'='c:\windows\System32\DLA\DLACTRLW.EXE' [2005-09-08 122940]'Google Desktop Search'='c:\program files\Google\Google Desktop Search\GoogleDesktop.exe' [2008-08-08 29744]'Adobe Reader Speed Launcher'='c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe' [2008-01-11 39792]'AVG8_TRAY'='c:\progra~1\AVG\AVG8\avgtray.exe' [2009-01-30 1601304]'QuickTime Task'='c:\program files\QuickTime\qttask.exe' [2008-09-06 413696]'iTunesHelper'='c:\program files\iTunes\iTunesHelper.exe' [2008-10-01 289576]'nwiz'='nwiz.exe' [2006-03-21 c:\windows\system32
wiz.exe]'NVHotkey'='nvHotkey.dll' [2006-03-21 c:\windows\system32
vhotkey.dll]'SigmatelSysTrayApp'='stsystra.exe' [2006-03-24 c:\windows\stsystra.exe]'MBMon'='CTMBHA.DLL' [2006-06-28 c:\windows\system32\CTMBHA.DLL] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]'swg'='c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe' [2007-04-03 68856]'DWQueuedReporting'='c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe' [2007-03-22 39264] c:\documents and settings\Sarah\Start Menu\Programs\Startup\Memeo AutoBackup Launcher.lnk - c:\documents and settings\Sarah\Application Data\Microsoft\Installer\{6BCEB97B-F315-455D-BC2D-565A1A6781E8}\NewShortcut4_51A847D327C24F7797772AF2A4E486ED.exe [2008-03-17 73728] c:\documents and settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-09-26 24576]HotSync Manager.lnk - c:\palm\HOTSYNC.EXE [2006-12-20 299008]LUMIX Simple Viewer.lnk - c:\program files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe [2006-11-24 57344]Service Manager.lnk - c:\program files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2005-05-03 81920] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\avgrsstarter]2009-01-30 15:21 10520 c:\windows\system32\avgrsstx.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center]'AntiVirusDisableNotify'=dword:00000001'UpdatesDisableNotify'=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]'DisableMonitoring'=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]'%windir%\system32\sessmgr.exe'='%windir%\Network Diagnostic\xpnetdiag.exe'='c:\Program Files\Messenger\msmsgs.exe'='c:\Program Files\AVG\AVG8\avgupd.exe'='c:\Program Files\Yahoo!\Messenger\YahooMessenger.exe'='c:\Program Files\Yahoo!\Messenger\YServer.exe'='c:\Program Files\Bonjour\mDNSResponder.exe'='c:\Program Files\iTunes\iTunes.exe'='c:\WINDOWS\system32\WgaTray.exe'='c:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe'='c:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe'='c:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe'='c:\WINDOWS\system32\DLA\DLACTRLW.EXE'='c:\Program Files\AVG\AVG8\avgscanx.exe'= R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-07-08 325128]R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-01-30 298264]S2 PARPEPPY;PARPEPPY;\??\c:\windows\system32\PARPEPPY.SYS --> c:\windows\system32\PARPEPPY.SYS [?]S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [2006-11-03 13592]S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2006-09-26 29744]S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2009-01-03 356920] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}]\Shell\AutoRun\command - E:\setup.exe.Contents of the 'Scheduled Tasks' folder 2009-02-01 c:\windows\Tasks\AppleSoftwareUpdate.job- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:57] 2009-02-03 c:\windows\Tasks\imsmsqej.job- c:\windows\system32\byXRkKbx.dll [].- - - - ORPHANS REMOVED - - - - BHO-{CAEB658C-EA47-496B-892C-F209F7CE7D41} - (no file)Notify-iifgHYsR - iifgHYsR.dll .------- Supplementary Scan -------.uStart Page = hxxp://en.community.dell.com/forums/t/19255839.aspxmStart Page = hxxp://www.msn.commSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.htmluInternet Connection Wizard,ShellNext = hxxp://www.avg.com/ww.special-toolbar-first-run-tlbrfIE: &ieSpell Options - c:\program files\ieSpell\iespell.dll/SPELLOPTION.HTMIE: Check &Spelling - c:\program files\ieSpell\iespell.dll/SPELLCHECK.HTMIE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000IE: Lookup on Merriam Webster - file://c:\program files\ieSpell\Merriam Webster.HTMIE: Lookup on Wikipedia - file://c:\program files\ieSpell\wikipedia.HTMDPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cabFF - ProfilePath - . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.netRootkit scan 2009-02-03 10:14:17Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ...  scanning hidden autostart entries ... scanning hidden files ...  scan completed successfullyhidden files: 0 **************************************************************************.------------------------ Other Running Processes ------------------------.c:\program files\Intel\Wireless\Bin\EvtEng.exec:\program files\Intel\Wireless\Bin\S24EvMon.exec:\program files\Intel\Wireless\Bin\WLKEEPER.exec:\program files\Lavasoft\Ad-Aware\aawservice.exec:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exec:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exec:\program files\Bonjour\mDNSResponder.exec:\program files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exec:\windows\ehome\ehrecvr.exec:\windows\ehome\ehSched.exec:\program files\Google\Common\Google Updater\GoogleUpdaterService.exec:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXEc:\program files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exec:\program files\Dell\QuickSet\NicConfigSvc.exec:\program files\AVG\AVG8\avgrsx.exec:\windows\system32
vsvc32.exec:\program files\Intel\Wireless\Bin\RegSrvc.exec:\windows\system32\stacsv.exec:\program files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exec:\windows\ehome\mcrdsvc.exec:\windows\system32\dllhost.exec:\windows\ehome\ehmsas.exec:\windows\system32undll32.exec:\windows\system32undll32.exec:\progra~1\Intel\Wireless\Bin\Dot1XCfg.exec:\docume~1\ADMINN~1\LOCALS~1\Temp\clclean.0001c:\program files\iPod\bin\iPodService.exec:\program files\Symantec\LiveUpdate\AUPDATE.EXEc:\progra~1\Symantec\LIVEUP~1\LUCOMS~1.EXE.**************************************************************************.Completion time: 2009-02-03 10:18:09 - machine was rebootedComboFix-quarantined-files.txt  2009-02-03 19:18:06 Pre-Run: 18,493,333,504 bytes freePost-Run: 19,007,184,896 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe[boot loader]timeout=2default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS[operating systems]c:\cmdcons\BOOTSECT.DAT='Microsoft Windows Recovery Console' /cmdconsmulti(0)disk(0)rdisk(0)partition(2)\WINDOWS='Windows XP Media Center Edition' /noexecute=optin /fastdetect 260 --- E O F --- 2009-01-16 16:03:41   Thanks so much! Jean

Bugbatter · Answer

Ah, ha! It looks as if we caught your critter. I will review those logs and post the next steps as soon as possible.

motherthing1 · Answer

Excellent!. No rush, however as that laptop and I are parting ways for a week. I won't be home to fuss with it until next Wednesday. I'll give the kids a tutorial on keeping the AVG and spyware up-to date so it doesn't catch something else while I'm gone.

Bugbatter · Answer

That computer should not be used online until this is cleaned up. We will also need to remove all the files and folders ComboFix has left on there. Disconnect from the internet....pull the plug! Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray. Otherwise, they may interfere with running ComboFix. Open Notepad and copy/paste the following text between the lines below. Do not copy the dotted lines. ** Make sure you copy/paste ALL the text at once. Do not try to edit extra spaces. It will copy correctly to Notepad if you highlight and copy as is. -----------------------------------------------------------------------------------   File:: c:\windows\Tasks\imsmsqej.jobc:\windows\system32\byXRkKbx.dll []   ---------------------------------------------------------------------------- Save this as CFScript.txt Referring to the picture above, drag CFScript into ComboFix.exe You will be prompted to run Combofix again. Follow the same instructions you did before for running ComboFix. CAUTION: Do not mouse-click ComboFix while it is running. It may cause it to stall. When finished, a log is produced here: C:\ComboFix.txt In your next reply, please post that log along with a new HijackThis log.

motherthing1 · Answer

Hello again. I am home for awhile so will have time to finish dealing with this. ComboFix 09-02-02.04 - Adminnistrator 2009-02-12  6:36:41.2 - NTFSx86Microsoft Windows XP Professional  5.1.2600.3.1252.1.1033.18.1022.537 [GMT -9:00]Running from: c:\documents and settings\Adminnistrator\Desktop\ComboFix.exeCommand switches used :: c:\documents and settings\Adminnistrator\Desktop\CFScript.txt.txtAV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)FW: Norton Internet Worm Protection *disabled* * Created a new restore point.- REDUCED FUNCTIONALITY MODE - FILE ::c:\windows\system32\byXRkKbx.dll []c:\windows\Tasks\imsmsqej.job. (((((((((((((((((((((((((((((((((((((((   Other Deletions   ))))))))))))))))))))))))))))))))))))))))))))))))). c:\windows\Tasks\imsmsqej.job .(((((((((((((((((((((((((   Files Created from 2009-01-12 to 2009-02-12  ))))))))))))))))))))))))))))))). 2009-02-11 03:40 . 2009-02-11 03:40   d-------- c:\windows\$SQLUninstallSQL2000-KB960082-v8.00.2055-x86-ENU$ 2009-02-01 14:44 . 2009-02-01 14:44   d-------- c:\program files\ieSpell 2009-01-31 06:48 . 2009-01-31 06:48   d-------- c:\windows\system32\XPSViewer 2009-01-31 06:47 . 2009-01-31 06:47   d-------- c:\program files\Reference Assemblies 2009-01-31 06:47 . 2009-01-31 06:47   d-------- c:\program files\MSBuild 2009-01-31 06:47 . 2009-01-31 06:47   d-------- C:\64fda4fdd64004d80be0a99673 2009-01-31 06:47 . 2008-07-06 03:06 1,676,288 --------- c:\windows\system32\xpssvcs.dll 2009-01-31 06:47 . 2008-07-06 03:06 1,676,288 --------- c:\windows\system32\dllcache\xpssvcs.dll 2009-01-31 06:47 . 2008-07-06 01:50 597,504 --------- c:\windows\system32\dllcache\printfilterpipelinesvc.exe 2009-01-31 06:47 . 2008-07-06 03:06 575,488 --------- c:\windows\system32\xpsshhdr.dll 2009-01-31 06:47 . 2008-07-06 03:06 575,488 --------- c:\windows\system32\dllcache\xpsshhdr.dll 2009-01-31 06:47 . 2008-07-06 03:06 117,760 --------- c:\windows\system32\prntvpt.dll 2009-01-31 06:47 . 2008-07-06 03:06 89,088 --------- c:\windows\system32\dllcache\filterpipelineprintproc.dll 2009-01-31 06:46 . 2009-01-31 07:04   d-------- c:\windows\SxsCaPendDel 2009-01-30 15:21 . 2009-01-30 15:21 10,520 --a------ c:\windows\system32\avgrsstx.dll 2009-01-22 13:01 . 2009-01-22 13:01   d-------- c:\windows\2DMW5ENW6FOX6GPY 2009-01-21 07:50 . 2009-01-21 07:50   d-------- c:\program files\Trend Micro 2009-01-19 12:57 . 2009-01-21 06:16   d-------- c:\documents and settings\Adminnistrator\.housecall6.6 2009-01-19 09:47 . 2009-01-20 12:01   d-------- c:\documents and settings\Adminnistrator\Application Data\Yahoo! 2009-01-19 09:43 . 2009-02-01 12:38   d-------- c:\documents and settings\Adminnistrator\Application Data\AVGTOOLBAR 2009-01-18 17:59 . 2009-01-18 17:59   d-------- c:\documents and settings\Adminnistrator\Application Data\Malwarebytes 2009-01-18 14:41 . 2006-09-26 19:36   d-------- c:\documents and settings\Adminnistrator\Application Data\Intel 2009-01-18 14:41 . 2006-09-26 20:03   d--h----- c:\documents and settings\Adminnistrator\Application Data\Gtek 2009-01-18 14:41 . 2009-01-31 07:02   d-------- c:\documents and settings\Adminnistrator 2009-01-17 11:49 . 2009-01-17 11:49   d-------- c:\documents and settings\Sarah\Application Data\Malwarebytes 2009-01-16 18:45 . 2009-01-19 10:47   d-------- c:\program files\Spybot - Search & Destroy 2009-01-16 18:45 . 2009-01-27 18:27   d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2009-01-16 16:48 . 2009-01-16 16:48   d-------- c:\documents and settings\Andrew\Application Data\Malwarebytes 2009-01-16 15:41 . 2009-01-16 15:41   d-------- c:\documents and settings\Jean\Application Data\Malwarebytes 2009-01-16 15:40 . 2009-01-16 15:41   d-------- c:\program files\Malwarebytes' Anti-Malware 2009-01-16 15:40 . 2009-01-16 15:40   d-------- c:\documents and settings\All Users\Application Data\Malwarebytes 2009-01-16 15:40 . 2009-01-14 16:11 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys 2009-01-16 15:40 . 2009-01-14 16:11 15,504 --a------ c:\windows\system32\drivers\mbam.sys 2009-01-15 15:13 . 2009-01-15 15:13   d-------- c:\documents and settings\Sarah\Application Data\AVG7 2009-01-15 15:13 . 2009-01-15 15:13   d-------- c:\documents and settings\Jake\Application Data\AVG7 2009-01-14 11:37 . 2009-01-14 11:37   d-------- c:\program files\Lavasoft 2009-01-14 11:37 . 2009-01-14 12:14   d-------- c:\documents and settings\All Users\Application Data\Lavasoft 2009-01-14 11:36 . 2009-01-14 11:36   d-------- c:\program files\Common Files\Wise Installation Wizard 2009-01-13 15:52 . 2009-01-13 15:52   d-------- c:\documents and settings\Jacob\Application Data\Yahoo! .((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))).2009-02-10 10:48 --------- d-----w c:\documents and settings\All Users\Application Data\Google Updater2009-02-03 18:58 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP2009-02-03 06:41 --------- d-----w c:\program files\Spyware Doctor2009-01-31 00:21 325,128 ----a-w c:\windows\system32\drivers\avgldx86.sys2009-01-30 20:14 --------- d-----w c:\documents and settings\All Users\Application Data\avg82009-01-17 00:37 --------- d--h--r c:\documents and settings\Jean\Application Data\yahoo!2009-01-16 17:04 --------- d-----w c:\program files\Google2009-01-16 17:03 --------- d-----w c:\documents and settings\Jacob\Application Data\AVGTOOLBAR2009-01-16 00:53 --------- d-----w c:\program files\RGB2009-01-14 01:06 --------- d-----w c:\documents and settings\Jean\Application Data\Lavasoft2009-01-04 15:40 --------- d-----w c:\windows\system32\config\systemprofile\Application Data\AVGTOOLBAR2009-01-04 15:37 --------- d-----w c:\windows\system32\config\systemprofile\Application Data\Yahoo!2009-01-03 21:29 --------- d-----w c:\documents and settings\Jean\Application Data\PC Tools2009-01-01 07:57 --------- d-----w c:\documents and settings\Andrew\Application Data\AVGTOOLBAR2008-12-20 08:26 --------- d-----w c:\documents and settings\Jake\Application Data\Apple Computer2008-12-19 23:23 --------- d-----w c:\documents and settings\Andrew\Application Data\Yahoo!2008-12-19 03:01 --------- d-----w c:\program files\Pocket Tanks2008-07-10 02:46 88 --sh--r c:\windows\system32\B49E8BE30D.sys2008-07-10 02:46 3,766 --sha-w c:\windows\system32\KGyGaAvL.sys2008-08-05 11:07 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008080520080806\index.dat. (((((((((((((((((((((((((((((   snapshot@2009-02-03_10.17.03.43   ))))))))))))))))))))))))))))))))))))))))).+ 2008-05-26 01:44:10 57,344 -c----w c:\windows\$SQLUninstallSQL2000-KB960082-v8.00.2055-x86-ENU$\MICROSOFTSMLBIZ\osql.exe+ 2008-05-26 01:44:10 163,840 -c----w c:\windows\$SQLUninstallSQL2000-KB960082-v8.00.2055-x86-ENU$\MICROSOFTSMLBIZeplmerg.exe+ 2008-05-26 01:44:10 315,392 -c----w c:\windows\$SQLUninstallSQL2000-KB960082-v8.00.2055-x86-ENU$\MICROSOFTSMLBIZeplrec.dll+ 2008-05-26 01:44:16 9,154,560 -c----w c:\windows\$SQLUninstallSQL2000-KB960082-v8.00.2055-x86-ENU$\MICROSOFTSMLBIZ\sqlservr.exe+ 2008-12-18 19:49:42 2,322,432 -c----w c:\windows\$SQLUninstallSQL2000-KB960082-v8.00.2055-x86-ENU$\MICROSOFTSMLBIZ\sqlstpcustomdll.dll+ 2008-12-18 19:49:42 57,344 ----a-w c:\windows\$SQLUninstallSQL2000-KB960082-v8.00.2055-x86-ENU$\spuninst\OSQL.exe+ 2008-12-08 04:46:12 213,216 ------w c:\windows\$SQLUninstallSQL2000-KB960082-v8.00.2055-x86-ENU$\spuninst\spuninst.exe+ 2008-12-18 19:49:42 2,322,432 ----a-w c:\windows\$SQLUninstallSQL2000-KB960082-v8.00.2055-x86-ENU$\spuninst\SQLSTPCustomDLL.dll+ 2008-12-08 04:46:12 371,424 ------w c:\windows\$SQLUninstallSQL2000-KB960082-v8.00.2055-x86-ENU$\spuninst\updspapi.dll+ 2008-10-16 20:38:34 124,928 -c----w c:\windows\ie7updates\KB961260-IE7\advpack.dll+ 2008-10-16 20:38:34 347,136 -c----w c:\windows\ie7updates\KB961260-IE7\dxtmsft.dll+ 2008-10-16 20:38:34 214,528 -c----w c:\windows\ie7updates\KB961260-IE7\dxtrans.dll+ 2008-10-16 20:38:35 133,120 -c----w c:\windows\ie7updates\KB961260-IE7\extmgr.dll+ 2008-10-16 20:38:35 63,488 -c----w c:\windows\ie7updates\KB961260-IE7\icardie.dll+ 2008-10-16 13:11:09 70,656 -c----w c:\windows\ie7updates\KB961260-IE7\ie4uinit.exe+ 2008-10-16 20:38:35 153,088 -c----w c:\windows\ie7updates\KB961260-IE7\ieakeng.dll+ 2008-10-16 20:38:35 230,400 -c----w c:\windows\ie7updates\KB961260-IE7\ieaksie.dll+ 2008-10-15 07:04:53 161,792 -c----w c:\windows\ie7updates\KB961260-IE7\ieakui.dll+ 2008-10-16 20:38:35 383,488 -c----w c:\windows\ie7updates\KB961260-IE7\ieapfltr.dll+ 2008-10-16 20:38:35 384,512 -c----w c:\windows\ie7updates\KB961260-IE7\iedkcs32.dll+ 2008-10-16 20:38:37 6,066,176 -c----w c:\windows\ie7updates\KB961260-IE7\ieframe.dll+ 2008-10-16 20:38:37 44,544 -c----w c:\windows\ie7updates\KB961260-IE7\iernonce.dll+ 2008-10-16 20:38:37 267,776 -c----w c:\windows\ie7updates\KB961260-IE7\iertutil.dll+ 2008-10-16 13:11:09 13,824 -c----w c:\windows\ie7updates\KB961260-IE7\ieudinit.exe+ 2008-10-15 07:06:26 633,632 -c----w c:\windows\ie7updates\KB961260-IE7\iexplore.exe+ 2008-10-16 20:38:37 27,648 -c----w c:\windows\ie7updates\KB961260-IE7\jsproxy.dll+ 2008-10-16 20:38:37 459,264 -c----w c:\windows\ie7updates\KB961260-IE7\msfeeds.dll+ 2008-10-16 20:38:37 52,224 -c----w c:\windows\ie7updates\KB961260-IE7\msfeedsbs.dll+ 2008-12-13 06:40:02 3,593,216 -c----w c:\windows\ie7updates\KB961260-IE7\mshtml.dll+ 2008-10-16 20:38:38 477,696 -c----w c:\windows\ie7updates\KB961260-IE7\mshtmled.dll+ 2008-10-16 20:38:38 193,024 -c----w c:\windows\ie7updates\KB961260-IE7\msrating.dll+ 2008-10-16 20:38:39 671,232 -c----w c:\windows\ie7updates\KB961260-IE7\mstime.dll+ 2008-10-16 20:38:39 102,912 -c----w c:\windows\ie7updates\KB961260-IE7\occache.dll+ 2008-10-16 20:38:39 44,544 -c----w c:\windows\ie7updates\KB961260-IE7\pngfilt.dll+ 2007-03-06 01:22:41 213,216 -c----w c:\windows\ie7updates\KB961260-IE7\spuninst\spuninst.exe+ 2007-03-06 01:23:51 371,424 -c----w c:\windows\ie7updates\KB961260-IE7\spuninst\updspapi.dll+ 2008-10-16 20:38:39 105,984 -c----w c:\windows\ie7updates\KB961260-IE7\url.dll+ 2008-10-16 20:38:39 1,160,192 -c----w c:\windows\ie7updates\KB961260-IE7\urlmon.dll+ 2008-10-16 20:38:39 233,472 -c----w c:\windows\ie7updates\KB961260-IE7\webcheck.dll+ 2008-10-16 20:38:40 826,368 -c----w c:\windows\ie7updates\KB961260-IE7\wininet.dll- 2009-01-16 16:03:31 12,288 ----a-r c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\cagicon.exe+ 2009-02-11 12:39:52 12,288 ----a-r c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\cagicon.exe- 2009-01-16 16:03:31 135,168 ----a-r c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\misc.exe+ 2009-02-11 12:39:52 135,168 ----a-r c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\misc.exe- 2009-01-16 16:03:31 11,264 ----a-r c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\mspicons.exe+ 2009-02-11 12:39:52 11,264 ----a-r c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\mspicons.exe- 2009-01-16 16:03:31 27,136 ----a-r c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\oisicon.exe+ 2009-02-11 12:39:52 27,136 ----a-r c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\oisicon.exe- 2009-01-16 16:03:31 4,096 ----a-r c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\opwicon.exe+ 2009-02-11 12:39:52 4,096 ----a-r c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\opwicon.exe- 2009-01-16 16:03:31 794,624 ----a-r c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\outicon.exe+ 2009-02-11 12:39:53 794,624 ----a-r c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\outicon.exe- 2009-01-16 16:03:31 249,856 ----a-r c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\pptico.exe+ 2009-02-11 12:39:52 249,856 ----a-r c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\pptico.exe- 2009-01-16 16:03:31 61,440 ----a-r c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\pubs.exe+ 2009-02-11 12:39:52 61,440 ----a-r c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\pubs.exe- 2009-01-16 16:03:31 23,040 ----a-r c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\unbndico.exe+ 2009-02-11 12:39:53 23,040 ----a-r c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\unbndico.exe- 2009-01-16 16:03:31 286,720 ----a-r c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\wordicon.exe+ 2009-02-11 12:39:52 286,720 ----a-r c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\wordicon.exe- 2009-01-16 16:03:31 409,600 ----a-r c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\xlicons.exe+ 2009-02-11 12:39:52 409,600 ----a-r c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\xlicons.exe- 2008-10-16 20:38:34 124,928 ----a-w c:\windows\system32\advpack.dll+ 2008-12-20 23:15:11 124,928 ----a-w c:\windows\system32\advpack.dll- 2008-10-16 20:38:34 124,928 ------w c:\windows\system32\dllcache\advpack.dll+ 2008-12-20 23:15:11 124,928 ------w c:\windows\system32\dllcache\advpack.dll- 2008-10-16 20:38:34 347,136 ----a-w c:\windows\system32\dllcache\dxtmsft.dll+ 2008-12-20 23:15:12 347,136 ----a-w c:\windows\system32\dllcache\dxtmsft.dll- 2008-10-16 20:38:34 214,528 ----a-w c:\windows\system32\dllcache\dxtrans.dll+ 2008-12-20 23:15:13 214,528 ----a-w c:\windows\system32\dllcache\dxtrans.dll- 2008-10-16 20:38:35 133,120 ----a-w c:\windows\system32\dllcache\extmgr.dll+ 2008-12-20 23:15:13 133,120 ----a-w c:\windows\system32\dllcache\extmgr.dll- 2008-10-16 20:38:35 63,488 ------w c:\windows\system32\dllcache\icardie.dll+ 2008-12-20 23:15:13 63,488 ------w c:\windows\system32\dllcache\icardie.dll- 2008-10-16 13:11:09 70,656 ------w c:\windows\system32\dllcache\ie4uinit.exe+ 2008-12-19 09:10:15 70,656 ------w c:\windows\system32\dllcache\ie4uinit.exe- 2008-10-16 20:38:35 153,088 ------w c:\windows\system32\dllcache\ieakeng.dll+ 2008-12-20 23:15:14 153,088 ------w c:\windows\system32\dllcache\ieakeng.dll- 2008-10-16 20:38:35 230,400 ------w c:\windows\system32\dllcache\ieaksie.dll+ 2008-12-20 23:15:14 230,400 ------w c:\windows\system32\dllcache\ieaksie.dll- 2008-10-15 07:04:53 161,792 ------w c:\windows\system32\dllcache\ieakui.dll+ 2008-12-19 05:23:56 161,792 ------w c:\windows\system32\dllcache\ieakui.dll- 2008-10-16 20:38:35 383,488 ------w c:\windows\system32\dllcache\ieapfltr.dll+ 2008-12-20 23:15:15 383,488 ------w c:\windows\system32\dllcache\ieapfltr.dll- 2008-10-16 20:38:35 384,512 ------w c:\windows\system32\dllcache\iedkcs32.dll+ 2008-12-20 23:15:16 384,512 ------w c:\windows\system32\dllcache\iedkcs32.dll- 2008-10-16 20:38:37 6,066,176 ------w c:\windows\system32\dllcache\ieframe.dll+ 2008-12-20 23:15:21 6,066,688 ------w c:\windows\system32\dllcache\ieframe.dll- 2008-10-16 20:38:37 44,544 ------w c:\windows\system32\dllcache\iernonce.dll+ 2008-12-20 23:15:21 44,544 ------w c:\windows\system32\dllcache\iernonce.dll- 2008-10-16 20:38:37 267,776 ------w c:\windows\system32\dllcache\iertutil.dll+ 2008-12-20 23:15:22 267,776 ------w c:\windows\system32\dllcache\iertutil.dll- 2008-10-16 13:11:09 13,824 ------w c:\windows\system32\dllcache\ieudinit.exe+ 2008-12-19 09:10:15 13,824 ------w c:\windows\system32\dllcache\ieudinit.exe- 2008-10-15 07:06:26 633,632 ------w c:\windows\system32\dllcache\iexplore.exe+ 2008-12-19 05:25:25 634,024 ------w c:\windows\system32\dllcache\iexplore.exe- 2008-10-16 20:38:37 27,648 ----a-w c:\windows\system32\dllcache\jsproxy.dll+ 2008-12-20 23:15:23 27,648 ----a-w c:\windows\system32\dllcache\jsproxy.dll- 2008-10-16 20:38:37 459,264 ------w c:\windows\system32\dllcache\msfeeds.dll+ 2008-12-20 23:15:23 459,264 ------w c:\windows\system32\dllcache\msfeeds.dll- 2008-10-16 20:38:37 52,224 ------w c:\windows\system32\dllcache\msfeedsbs.dll+ 2008-12-20 23:15:24 52,224 ------w c:\windows\system32\dllcache\msfeedsbs.dll- 2008-12-13 06:40:02 3,593,216 ----a-w c:\windows\system32\dllcache\mshtml.dll+ 2009-01-17 06:35:14 3,594,752 ----a-w c:\windows\system32\dllcache\mshtml.dll- 2008-10-16 20:38:38 477,696 ----a-w c:\windows\system32\dllcache\mshtmled.dll+ 2008-12-20 23:15:30 477,696 ----a-w c:\windows\system32\dllcache\mshtmled.dll- 2008-10-16 20:38:38 193,024 ----a-w c:\windows\system32\dllcache\msrating.dll+ 2008-12-20 23:15:31 193,024 ----a-w c:\windows\system32\dllcache\msrating.dll- 2008-10-16 20:38:39 671,232 ----a-w c:\windows\system32\dllcache\mstime.dll+ 2008-12-20 23:15:32 671,232 ----a-w c:\windows\system32\dllcache\mstime.dll- 2008-10-16 20:38:39 102,912 ------w c:\windows\system32\dllcache\occache.dll+ 2008-12-20 23:15:38 102,912 ------w c:\windows\system32\dllcache\occache.dll- 2008-10-16 20:38:39 44,544 ----a-w c:\windows\system32\dllcache\pngfilt.dll+ 2008-12-20 23:15:38 44,544 ----a-w c:\windows\system32\dllcache\pngfilt.dll- 2008-10-16 20:38:39 105,984 ------w c:\windows\system32\dllcache\url.dll+ 2008-12-20 23:15:39 105,984 ------w c:\windows\system32\dllcache\url.dll- 2008-10-16 20:38:39 1,160,192 ----a-w c:\windows\system32\dllcache\urlmon.dll+ 2008-12-20 23:15:40 1,160,192 ----a-w c:\windows\system32\dllcache\urlmon.dll- 2008-10-16 20:38:39 233,472 ------w c:\windows\system32\dllcache\webcheck.dll+ 2008-12-20 23:15:40 233,472 ------w c:\windows\system32\dllcache\webcheck.dll- 2008-10-16 20:38:40 826,368 ----a-w c:\windows\system32\dllcache\wininet.dll+ 2008-12-20 23:15:41 826,368 ----a-w c:\windows\system32\dllcache\wininet.dll- 2008-10-16 20:38:34 347,136 ----a-w c:\windows\system32\dxtmsft.dll+ 2008-12-20 23:15:12 347,136 ----a-w c:\windows\system32\dxtmsft.dll- 2008-10-16 20:38:34 214,528 ----a-w c:\windows\system32\dxtrans.dll+ 2008-12-20 23:15:13 214,528 ----a-w c:\windows\system32\dxtrans.dll- 2008-10-16 20:38:35 133,120 ----a-w c:\windows\system32\extmgr.dll+ 2008-12-20 23:15:13 133,120 ----a-w c:\windows\system32\extmgr.dll- 2008-10-16 20:38:35 63,488 ----a-w c:\windows\system32\icardie.dll+ 2008-12-20 23:15:13 63,488 ----a-w c:\windows\system32\icardie.dll- 2008-10-16 13:11:09 70,656 ----a-w c:\windows\system32\ie4uinit.exe+ 2008-12-19 09:10:15 70,656 ----a-w c:\windows\system32\ie4uinit.exe- 2008-10-16 20:38:35 153,088 ----a-w c:\windows\system32\ieakeng.dll+ 2008-12-20 23:15:14 153,088 ----a-w c:\windows\system32\ieakeng.dll- 2008-10-16 20:38:35 230,400 ----a-w c:\windows\system32\ieaksie.dll+ 2008-12-20 23:15:14 230,400 ----a-w c:\windows\system32\ieaksie.dll- 2008-10-15 07:04:53 161,792 ----a-w c:\windows\system32\ieakui.dll+ 2008-12-19 05:23:56 161,792 ----a-w c:\windows\system32\ieakui.dll- 2008-10-16 20:38:35 383,488 ----a-w c:\windows\system32\ieapfltr.dll+ 2008-12-20 23:15:15 383,488 ----a-w c:\windows\system32\ieapfltr.dll- 2008-10-16 20:38:35 384,512 ----a-w c:\windows\system32\iedkcs32.dll+ 2008-12-20 23:15:16 384,512 ----a-w c:\windows\system32\iedkcs32.dll- 2008-10-16 20:38:37 6,066,176 ----a-w c:\windows\system32\ieframe.dll+ 2008-12-20 23:15:21 6,066,688 ----a-w c:\windows\system32\ieframe.dll- 2008-10-16 20:38:37 44,544 ----a-w c:\windows\system32\iernonce.dll+ 2008-12-20 23:15:21 44,544 ----a-w c:\windows\system32\iernonce.dll- 2008-10-16 20:38:37 267,776 ----a-w c:\windows\system32\iertutil.dll+ 2008-12-20 23:15:22 267,776 ----a-w c:\windows\system32\iertutil.dll- 2008-10-16 13:11:09 13,824 ----a-w c:\windows\system32\ieudinit.exe+ 2008-12-19 09:10:15 13,824 ----a-w c:\windows\system32\ieudinit.exe- 2008-10-16 20:38:37 27,648 ----a-w c:\windows\system32\jsproxy.dll+ 2008-12-20 23:15:23 27,648 ----a-w c:\windows\system32\jsproxy.dll- 2009-01-10 02:35:30 20,853,704 ----a-w c:\windows\system32\MRT.exe+ 2009-02-03 23:21:12 21,244,864 ----a-w c:\windows\system32\MRT.exe- 2008-10-16 20:38:37 459,264 ----a-w c:\windows\system32\msfeeds.dll+ 2008-12-20 23:15:23 459,264 ----a-w c:\windows\system32\msfeeds.dll- 2008-10-16 20:38:37 52,224 ----a-w c:\windows\system32\msfeedsbs.dll+ 2008-12-20 23:15:24 52,224 ----a-w c:\windows\system32\msfeedsbs.dll- 2008-12-13 06:40:02 3,593,216 ----a-w c:\windows\system32\mshtml.dll+ 2009-01-17 06:35:14 3,594,752 ----a-w c:\windows\system32\mshtml.dll- 2008-10-16 20:38:38 477,696 ----a-w c:\windows\system32\mshtmled.dll+ 2008-12-20 23:15:30 477,696 ----a-w c:\windows\system32\mshtmled.dll- 2008-10-16 20:38:38 193,024 ----a-w c:\windows\system32\msrating.dll+ 2008-12-20 23:15:31 193,024 ----a-w c:\windows\system32\msrating.dll- 2008-10-16 20:38:39 671,232 ----a-w c:\windows\system32\mstime.dll+ 2008-12-20 23:15:32 671,232 ----a-w c:\windows\system32\mstime.dll- 2008-10-16 20:38:39 102,912 ----a-w c:\windows\system32\occache.dll+ 2008-12-20 23:15:38 102,912 ----a-w c:\windows\system32\occache.dll- 2008-10-16 20:38:39 44,544 ----a-w c:\windows\system32\pngfilt.dll+ 2008-12-20 23:15:38 44,544 ----a-w c:\windows\system32\pngfilt.dll- 2008-10-16 20:38:39 105,984 ----a-w c:\windows\system32\url.dll+ 2008-12-20 23:15:39 105,984 ----a-w c:\windows\system32\url.dll- 2008-10-16 20:38:39 1,160,192 ----a-w c:\windows\system32\urlmon.dll+ 2008-12-20 23:15:40 1,160,192 ----a-w c:\windows\system32\urlmon.dll- 2008-10-16 20:38:39 233,472 ----a-w c:\windows\system32\webcheck.dll+ 2008-12-20 23:15:40 233,472 ----a-w c:\windows\system32\webcheck.dll- 2008-10-16 20:38:40 826,368 ----a-w c:\windows\system32\wininet.dll+ 2008-12-20 23:15:41 826,368 ----a-w c:\windows\system32\wininet.dll+ 2009-02-12 15:31:48 16,384 ----atw c:\windows	emp\Perflib_Perfdata_b70.dat.-- Snapshot reset to current date --.(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]'ModemOnHold'='c:\program files\NetWaiting
etWaiting.exe' [2003-09-09 20480]'DellSupport'='c:\program files\Dell Support\DSAgnt.exe' [2006-07-16 389120]'ctfmon.exe'='c:\windows\system32\ctfmon.exe' [2008-04-13 15360]'swg'='c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe' [2007-04-03 68856]'MSMSGS'='c:\program files\Messenger\msmsgs.exe' [2008-04-13 1695232]'SetDefaultMIDI'='MIDIDef.exe' [2004-12-22 c:\windows\MIDIDEF.EXE] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]'ehTray'='c:\windows\ehome\ehtray.exe' [2005-09-29 67584]'SynTPEnh'='c:\program files\Synaptics\SynTP\SynTPEnh.exe' [2006-03-08 761947]'NvCplDaemon'='c:\windows\system32\NvCpl.dll' [2006-03-21 7557120]'IntelZeroConfig'='c:\program files\Intel\Wireless\bin\ZCfgSvc.exe' [2006-05-01 667718]'IntelWireless'='c:\program files\Intel\Wireless\Bin\ifrmewrk.exe' [2006-05-01 602182]'DMXLauncher'='c:\program files\Dell\Media Experience\DMXLauncher.exe' [2005-10-04 94208]'Dell QuickSet'='c:\program files\Dell\QuickSet\quickset.exe' [2006-06-29 1032192]'CTSysVol'='c:\program files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe' [2005-10-31 57344]'UpdReg'='c:\windows\UpdReg.EXE' [2000-05-10 90112]'VoiceCenter'='c:\program files\Creative\VoiceCenter\AndreaVC.exe' [2006-02-16 1118208]'ISUSPM Startup'='c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe' [2005-06-10 249856]'ISUSScheduler'='c:\program files\Common Files\InstallShield\UpdateService\issch.exe' [2005-06-10 81920]'DLA'='c:\windows\System32\DLA\DLACTRLW.EXE' [2005-09-08 122940]'Google Desktop Search'='c:\program files\Google\Google Desktop Search\GoogleDesktop.exe' [2008-08-08 29744]'Adobe Reader Speed Launcher'='c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe' [2008-01-11 39792]'AVG8_TRAY'='c:\progra~1\AVG\AVG8\avgtray.exe' [2009-01-30 1601304]'QuickTime Task'='c:\program files\QuickTime\qttask.exe' [2008-09-06 413696]'iTunesHelper'='c:\program files\iTunes\iTunesHelper.exe' [2008-10-01 289576]'nwiz'='nwiz.exe' [2006-03-21 c:\windows\system32
wiz.exe]'NVHotkey'='nvHotkey.dll' [2006-03-21 c:\windows\system32
vhotkey.dll]'SigmatelSysTrayApp'='stsystra.exe' [2006-03-24 c:\windows\stsystra.exe]'MBMon'='CTMBHA.DLL' [2006-06-28 c:\windows\system32\CTMBHA.DLL] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]'swg'='c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe' [2007-04-03 68856]'DWQueuedReporting'='c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe' [2007-03-22 39264] c:\documents and settings\Sarah\Start Menu\Programs\Startup\Memeo AutoBackup Launcher.lnk - c:\documents and settings\Sarah\Application Data\Microsoft\Installer\{6BCEB97B-F315-455D-BC2D-565A1A6781E8}\NewShortcut4_51A847D327C24F7797772AF2A4E486ED.exe [2008-03-17 73728] c:\documents and settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-09-26 24576]HotSync Manager.lnk - c:\palm\HOTSYNC.EXE [2006-12-20 299008]LUMIX Simple Viewer.lnk - c:\program files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe [2006-11-24 57344]Service Manager.lnk - c:\program files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2005-05-03 81920] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\avgrsstarter]2009-01-30 15:21 10520 c:\windows\system32\avgrsstx.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center]'AntiVirusDisableNotify'=dword:00000001'UpdatesDisableNotify'=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]'DisableMonitoring'=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]'%windir%\system32\sessmgr.exe'='%windir%\Network Diagnostic\xpnetdiag.exe'='c:\Program Files\Messenger\msmsgs.exe'='c:\Program Files\AVG\AVG8\avgupd.exe'='c:\Program Files\Yahoo!\Messenger\YahooMessenger.exe'='c:\Program Files\Yahoo!\Messenger\YServer.exe'='c:\Program Files\Bonjour\mDNSResponder.exe'='c:\Program Files\iTunes\iTunes.exe'='c:\WINDOWS\system32\WgaTray.exe'='c:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe'='c:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe'='c:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe'='c:\WINDOWS\system32\DLA\DLACTRLW.EXE'='c:\Program Files\AVG\AVG8\avgscanx.exe'= R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-07-08 325128]R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-01-30 298264]R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [2006-11-03 13592]S2 PARPEPPY;PARPEPPY;\??\c:\windows\system32\PARPEPPY.SYS --> c:\windows\system32\PARPEPPY.SYS [?]S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2006-09-26 29744]S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2009-01-03 356920] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}]\Shell\AutoRun\command - E:\setup.exe.Contents of the 'Scheduled Tasks' folder 2009-02-01 c:\windows\Tasks\AppleSoftwareUpdate.job- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:57] 2009-02-12 c:\windows\Tasks\MP Scheduled Scan.job- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 18:20]..------- Supplementary Scan -------.uStart Page = hxxp://en.community.dell.com/forums/t/19255839.aspxmStart Page = hxxp://www.msn.commSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.htmluInternet Connection Wizard,ShellNext = hxxp://www.avg.com/ww.special-toolbar-first-run-tlbrfIE: &ieSpell Options - c:\program files\ieSpell\iespell.dll/SPELLOPTION.HTMIE: Check &Spelling - c:\program files\ieSpell\iespell.dll/SPELLCHECK.HTMIE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000IE: Lookup on Merriam Webster - file://c:\program files\ieSpell\Merriam Webster.HTMIE: Lookup on Wikipedia - file://c:\program files\ieSpell\wikipedia.HTMDPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cabFF - ProfilePath - . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.netRootkit scan 2009-02-12 06:37:31Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ...  scanning hidden autostart entries ... scanning hidden files ...  scan completed successfullyhidden files: 0 **************************************************************************.Completion time: 2009-02-12  6:40:08ComboFix-quarantined-files.txt  2009-02-12 15:40:06ComboFix2.txt  2009-02-03 19:18:10 Pre-Run: 19,001,942,016 bytes freePost-Run: 18,995,322,880 bytes free 379 --- E O F --- 2009-02-11 12:43:59 Logfile of Trend Micro HijackThis v2.0.2Scan saved at 6:46:17 AM, on 2/12/2009Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.6000.16791)Boot mode: Normal Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Windows Defender\MsMpEng.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Intel\Wireless\Bin\EvtEng.exeC:\Program Files\Intel\Wireless\Bin\S24EvMon.exeC:\Program Files\Intel\Wireless\Bin\WLKeeper.exeC:\Program Files\Lavasoft\Ad-Aware\aawservice.exeC:\WINDOWS\ehome\ehtray.exeC:\Program Files\Synaptics\SynTP\SynTPEnh.exeC:\Program Files\Intel\Wireless\bin\ZCfgSvc.exeC:\Program Files\Intel\Wireless\Bin\ifrmewrk.exeC:\WINDOWS\stsystra.exeC:\Program Files\Dell\Media Experience\DMXLauncher.exeC:\Program Files\Dell\QuickSet\quickset.exeC:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exeC:\Program Files\Creative\VoiceCenter\AndreaVC.exeC:\Program Files\Common Files\InstallShield\UpdateService\issch.exeC:\WINDOWS\System32\DLA\DLACTRLW.EXEC:\Program Files\Google\Google Desktop Search\GoogleDesktop.exeC:\PROGRA~1\AVG\AVG8\avgtray.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\Dell Support\DSAgnt.exeC:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exeC:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exeC:\Program Files\Digital Line Detect\DLG.exeC:\Palm\HOTSYNC.EXEC:\Program Files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exeC:\PROGRA~1\AVG\AVG8\avgwdsvc.exeC:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exeC:\Program Files\Bonjour\mDNSResponder.exeC:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exeC:\WINDOWS\eHome\ehRecvr.exeC:\WINDOWS\eHome\ehSched.exeC:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exeC:\PROGRA~1\AVG\AVG8\avgrsx.exeC:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXEC:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exeC:\Program Files\Dell\QuickSet\NICCONFIGSVC.exeC:\WINDOWS\system32
vsvc32.exeC:\Program Files\Intel\Wireless\Bin\RegSrvc.exeC:\WINDOWS\system32\stacsv.exeC:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exeC:\Program Files\iPod\bin\iPodService.exeC:\WINDOWS\system32\dllhost.exeC:\WINDOWS\eHome\ehmsas.exeC:\WINDOWS\system32
otepad.exeC:\WINDOWS\system32\imapi.exeC:\WINDOWS\explorer.exeC:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://en.community.dell.com/forums/t/19255839.aspxR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.htmlR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.avg.com/ww.special-toolbar-first-run-tlbrfO2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dllO2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dllO2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLLO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLLO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dllO2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dllO2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dllO2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dllO3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dllO3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLLO3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dllO4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exeO4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exeO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [nwiz] nwiz.exe /installquietO4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,StartO4 - HKLM\..\Run: [IntelZeroConfig] 'C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe'O4 - HKLM\..\Run: [IntelWireless] 'C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe' /tf Intel PROSet/WirelessO4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exeO4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exeO4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exeO4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /rO4 - HKLM\..\Run: [MBMon] Rundll32 CTMBHA.DLL,MBMonO4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXEO4 - HKLM\..\Run: [VoiceCenter] 'C:\Program Files\Creative\VoiceCenter\AndreaVC.exe' /trayO4 - HKLM\..\Run: [ISUSPM Startup] 'C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe' -startupO4 - HKLM\..\Run: [ISUSScheduler] 'C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe' -startO4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXEO4 - HKLM\..\Run: [Google Desktop Search] 'C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe' /startupO4 - HKLM\..\Run: [Adobe Reader Speed Launcher] 'C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe'O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exeO4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottimeO4 - HKLM\..\Run: [iTunesHelper] 'C:\Program Files\iTunes\iTunesHelper.exe'O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting
etWaiting.exeO4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exeO4 - HKCU\..\Run: [DellSupport] 'C:\Program Files\Dell Support\DSAgnt.exe' /startupO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exeO4 - HKCU\..\Run: [MSMSGS] 'C:\Program Files\Messenger\msmsgs.exe' /backgroundO4 - HKUS\S-1-5-18\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'SYSTEM')O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] 'C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe' -t (User 'SYSTEM')O4 - HKUS\.DEFAULT\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Default user')O4 - Global Startup: Digital Line Detect.lnk = ?O4 - Global Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXEO4 - Global Startup: LUMIX Simple Viewer.lnk = ?O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exeO8 - Extra context menu item: &ieSpell Options - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTMO8 - Extra context menu item: Check &Spelling - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTMO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000O8 - Extra context menu item: Lookup on Merriam Webster - file://C:\Program Files\ieSpell\Merriam Webster.HTMO8 - Extra context menu item: Lookup on Wikipedia - file://C:\Program Files\ieSpell\wikipedia.HTMO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dllO9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dllO9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dllO9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dllO9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dllO9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLLO9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dllO9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dllO16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1163118805953O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cabO16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cabO16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cabO16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/virtools.download.akamai.com/6712/player/install/installer.exeO18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dllO20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dllO23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exeO23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeO23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exeO23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exeO23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exeO23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exeO23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exeO23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exeO23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exeO23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXEO23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exeO23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exeO23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exeO23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exeO23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exeO23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\WINDOWS\system32\stacsv.exeO23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exeO23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe --End of file - 13937 bytes

Bugbatter · Answer

Welcome back! We are making good progress. Please update MBAM, REBOOT.  Run a new scan. Please post that log. Let me know how things are running at that point. If everything looks good, we'll clean some odds and ends and update Java so this machine isn't so vulnerable.

motherthing1 · Answer

The computer seems to be working well. The error message that initiated this whole venture did not pop up this morning when I first started up, which was before the combifix trick. I made the assumption that MBAM is the malware bites program-here is the scan log you requested.

Malwarebytes' Anti-Malware 1.34
Database version: 1754
Windows 5.1.2600 Service Pack 3

2/12/2009 10:54:56 AM
mbam-log-2009-02-12 (10-54-56).txt

Scan type: Quick Scan
Objects scanned: 94211
Time elapsed: 5 minute(s), 18 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Bugbatter · Answer

Super! :emotion-1: Next, please run Disk Cleanup in each user's profile: Click 'Start > Programs > Accessories > System Tools > Disk Cleanup' Please make sure only the following are checked: -- Downloaded Program Files -- Temporary Internet Files -- Recycle Bin -- Temporary Files Click 'OK' and Disk Cleanup will delete those files for you. Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. It is possible that you may be running Java code in your applications that absolutely require a specific version of the JRE to run. Please follow these steps to remove older version Java components and update. Download the latest version of Java Runtime Environment (JRE) 6. Scroll down to where it says Java SE Runtime Environment (JRE) 6 Update 12 . Click the 'Download' button to the right. Check the box that says: 'Accept License Agreement'. NOTE: As always during installations, beware of any pre-checked option to install a toolbar. If you do not want it, UNcheck it. The page will refresh. Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop. Close any programs you may have running - especially your web browser. Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java. Check any item with Java Runtime Environment (JRE or J2SE) in the name. In your case I see  only J2SE Runtime Environment 5.0 Update 6. Click the Remove or Change/Remove button.Close Add/Remove. * In Windows Explorer, navigate to C:\Program Files\Java =this folder. Delete any subfolders. * Do NOT delete C:\Program Files\ JavaVM =this folder, if found! Reboot your computer once all Java components are removed. Then from your desktop double-click on jre-6u12-windows-i586-p.exe to install the newest version. Please post a fresh HijackThis log so I make sure Java installed correctly. If everything looks good we'll remove Combofix and flush System Restore. That will have you in good shape.

motherthing1 · Answer

All done-   Logfile of Trend Micro HijackThis v2.0.2Scan saved at 1:36:26 PM, on 2/12/2009Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.6000.16791)Boot mode: Normal Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Windows Defender\MsMpEng.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Intel\Wireless\Bin\EvtEng.exeC:\Program Files\Intel\Wireless\Bin\S24EvMon.exeC:\Program Files\Intel\Wireless\Bin\WLKeeper.exeC:\Program Files\Lavasoft\Ad-Aware\aawservice.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeC:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exeC:\PROGRA~1\AVG\AVG8\avgwdsvc.exeC:\Program Files\Bonjour\mDNSResponder.exeC:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exeC:\WINDOWS\eHome\ehRecvr.exeC:\WINDOWS\eHome\ehSched.exeC:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exeC:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXEC:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exeC:\PROGRA~1\AVG\AVG8\avgrsx.exeC:\Program Files\Dell\QuickSet\NICCONFIGSVC.exeC:\WINDOWS\system32
vsvc32.exeC:\Program Files\Intel\Wireless\Bin\RegSrvc.exeC:\WINDOWS\system32\stacsv.exeC:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exeC:\WINDOWS\system32\dllhost.exeC:\WINDOWS\ehome\ehtray.exeC:\WINDOWS\eHome\ehmsas.exeC:\Program Files\Synaptics\SynTP\SynTPEnh.exeC:\WINDOWS\system32undll32.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Intel\Wireless\bin\ZCfgSvc.exeC:\Program Files\Intel\Wireless\Bin\ifrmewrk.exeC:\WINDOWS\stsystra.exeC:\Program Files\Dell\Media Experience\DMXLauncher.exeC:\Program Files\Dell\QuickSet\quickset.exeC:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exeC:\WINDOWS\system32\Rundll32.exeC:\DOCUME~1\ADMINN~1\LOCALS~1\Temp\clclean.0001C:\Program Files\Creative\VoiceCenter\AndreaVC.exeC:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exeC:\Program Files\Common Files\InstallShield\UpdateService\issch.exeC:\WINDOWS\System32\DLA\DLACTRLW.EXEC:\Program Files\Google\Google Desktop Search\GoogleDesktop.exeC:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exeC:\PROGRA~1\AVG\AVG8\avgtray.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\NetWaiting
etWaiting.exeC:\Program Files\Dell Support\DSAgnt.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exeC:\Program Files\Messenger\msmsgs.exeC:\Program Files\Digital Line Detect\DLG.exeC:\WINDOWS\system32\wuauclt.exeC:\Palm\HOTSYNC.EXEC:\Program Files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exeC:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exeC:\Program Files\iPod\bin\iPodService.exeC:\WINDOWS\system32\msiexec.exeC:\Program Files\Java\jre6\bin\jqs.exeC:\Program Files\Trend Micro\HijackThis\HijackThis.exeC:\Program Files\internet explorer\iexplore.exeC:\PROGRA~1\AVG\AVG8\aAvgApi.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://en.community.dell.com/forums/t/19255839.aspxR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.htmlR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.avg.com/ww.special-toolbar-first-run-tlbrfO2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dllO2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dllO2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLLO2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLLO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dllO2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dllO2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dllO2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dllO2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dllO2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dllO3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dllO3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLLO3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dllO4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exeO4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exeO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [nwiz] nwiz.exe /installquietO4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,StartO4 - HKLM\..\Run: [IntelZeroConfig] 'C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe'O4 - HKLM\..\Run: [IntelWireless] 'C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe' /tf Intel PROSet/WirelessO4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exeO4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exeO4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exeO4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /rO4 - HKLM\..\Run: [MBMon] Rundll32 CTMBHA.DLL,MBMonO4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXEO4 - HKLM\..\Run: [VoiceCenter] 'C:\Program Files\Creative\VoiceCenter\AndreaVC.exe' /trayO4 - HKLM\..\Run: [ISUSPM Startup] 'C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe' -startupO4 - HKLM\..\Run: [ISUSScheduler] 'C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe' -startO4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXEO4 - HKLM\..\Run: [Google Desktop Search] 'C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe' /startupO4 - HKLM\..\Run: [Adobe Reader Speed Launcher] 'C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe'O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exeO4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottimeO4 - HKLM\..\Run: [iTunesHelper] 'C:\Program Files\iTunes\iTunesHelper.exe'O4 - HKLM\..\Run: [SunJavaUpdateSched] 'C:\Program Files\Java\jre6\bin\jusched.exe'O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting
etWaiting.exeO4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exeO4 - HKCU\..\Run: [DellSupport] 'C:\Program Files\Dell Support\DSAgnt.exe' /startupO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exeO4 - HKCU\..\Run: [MSMSGS] 'C:\Program Files\Messenger\msmsgs.exe' /backgroundO4 - HKUS\S-1-5-18\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'SYSTEM')O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] 'C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe' -t (User 'SYSTEM')O4 - HKUS\.DEFAULT\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Default user')O4 - Global Startup: Digital Line Detect.lnk = ?O4 - Global Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXEO4 - Global Startup: LUMIX Simple Viewer.lnk = ?O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exeO8 - Extra context menu item: &ieSpell Options - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTMO8 - Extra context menu item: Check &Spelling - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTMO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000O8 - Extra context menu item: Lookup on Merriam Webster - file://C:\Program Files\ieSpell\Merriam Webster.HTMO8 - Extra context menu item: Lookup on Wikipedia - file://C:\Program Files\ieSpell\wikipedia.HTMO9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dllO9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dllO9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dllO9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dllO9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dllO9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLLO9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dllO9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dllO16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1163118805953O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cabO16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cabO16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cabO16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/virtools.download.akamai.com/6712/player/install/installer.exeO18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dllO20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dllO23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exeO23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeO23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exeO23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exeO23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exeO23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exeO23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exeO23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exeO23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exeO23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exeO23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXEO23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exeO23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exeO23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exeO23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exeO23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exeO23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\WINDOWS\system32\stacsv.exeO23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exeO23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe --End of file - 14500 bytes

Bugbatter · Answer

Super!

It's time for some housekeeping. Sweeping Because the tools we used to scan the computer, as well as tools to delete files and folders, are no longer needed, they should be removed, along with the folders created by these tools.
* Click Start then Run
Copy and paste next command in the field:

ComboFix /u

Make sure there's a space between Combofix and / Then hit enter.

This will remove ComboFix, run some cleanup procedures, and flush System Restore, thus creating a clean Restore Point.

Here is my standard list of simple steps that you can take to reduce the chance of infection in the future.

If you have installed Malwarebytes' Anti-Malware as part of your cleaning procedures, keep it updated and use it to scan every so often for malware, or upgrade to the paid version for realtime scanning and auto updating.

The following suggestions are general prevention and are not customized for your computer. You may have already taken some of these steps, and depending on your current security, you may not need to implement all of these:

1. Visit Microsoft Update: Make sure that you have all the Critical Updates recommended for your operating system and IE. The first defense against infection is a properly patched OS. Microsoft's widows Update: http://v4.windowsupdate.microsoft.com/en/default.asp

2. Please use a firewall and realtime anti-virus. Keep the anti-virus software and firewall software up to date. Note: Zone Alarm Firewall (by Checkpoint) has a free version http://www.zonelabs.com/store/content/company/products/trial_zaFamily/trial_zaFamily.jsp?lid=home_freedownloads

3.You might consider installing Mozilla / Firefox.
http://www.mozilla.com/en-US/

4. Do not use file sharing. Even the safest P2P file sharing programs that do not contain bundled spyware, still expose you to risks because of the very nature of the P2P file sharing process. By default, most P2P file sharing programs are configured to automatically launch at startup. They are also configured to allow other P2P users on the same network open access to a shared directory on your computer. The reason for this is simple. File sharing relies on its members giving and gaining unfettered access to computers across the P2P network. However, this practice can make you vulnerable to data and identity theft. Even if you change those risky default settings to a safer configuration, the act of downloading files from an anonymous source greatly increases your exposure to infection. That is because the files you are downloading may actually contain a disguised threat. Many very malicious worms and trojans, such as the Storm Worm, target and spread across P2P files sharing networks because of their known vulnerabilities.

5. Before using or purchasing any Spyware/Malware protection/removal program, always check the following Rogue/Suspect Spyware Lists. http://www.spywarewarrior.com/rogue_anti-spyware.htm http://www.malwarebytes.org/database.php

6. If you have not already done so, you might want to install CCleaner and run it in each user's profile: http://www.ccleaner.com/ ** UNcheck the option to install the Yahoo toolbar that is checked by default for the Standard version, or download the toolbar-free versions (Slim or Basic) when given the option for those.

7. Practice Safe Surfing with with TrendProtect by Trend Micro. This is not compatible with Firefox 3.0 yet. TrendProtect is a browser plugin that assigns a safety rating to domains listed in your search engine. TrendProtect also adds a new button to your browser's toolbar area. The icon and color of the button changes to indicate whether the page currently open is safe, unsafe, trusted, or unrated, or whether it contains unwanted content. The following color codes are used by TrendProtect to indicate the safety of each site.

Red for Warning
Yellow for Use Caution
Green for Safe
Grey for Unknown

Alternatively, Web Of Trust is a similar add-on that can also be used for Internet Explorer. It uses colored alerts to warn about risky websites that try to scam visitors, deliver malware, or send spam. There is a Web Of Trust version for Firefox as well.

8. You might consider installing SpywareBlaster: http://www.javacoolsoftware.com/spywareblaster.html
It will:
Prevent the installation of ActiveX-based spyware, adware, browser hijackers, dialers, and other potentially unwanted software.
Block spyware/tracking cookies in Internet Explorer and Mozilla Firefox.
Restrict the actions of potentially unwanted sites in Internet Explorer.
Tutorial here:http://www.bleepingcomputer.com/forums/tutorial49.html
Periodically check for updates

9. Here are some helpful articles:
"How did I get infected?"
http://www.bleepingcomputer.com/forums/topic2520.html

"I'm not pulling your leg, honest"
by Sandi Hardmeier
http://www.microsoft.com/windows/IE/community/columns/pulling.mspx

If your issue has been resolved, please click all five stars in this post so that we receive credit for completing the cleanup. Thank you and Safe Surfing.

Virus & Spyware

application or DLL C:\WINDOWS\system32\rusunife.dll is not a valid Windows image

Was this post helpful?