Unsolved

This post is more than 5 years old

28 Posts

2622

March 17th, 2008 01:00

Missing Dll files, and messed up browser

Heres the topic

http://www.dellcommunity.com/supportforums/board/message?board.id=sw_winxp&message.id=249124#M249124

 

 

 

 

 

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 8:10:16 PM, on 3/16/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 (6.00.2900.2180)

Boot mode: Normal



Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\Program Files\Digidesign\Drivers\MMERefresh.exe

C:\Program Files\M-Audio\Fast Track USB\MAUSBFTInst.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Electronic Arts\Need for Speed ProStreet\PB\PnkBstrA.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\M-Audio Uno\UnoInst.exe

C:\WINDOWS\system32\UAService7.exe

C:\Program Files\Viewpoint\Common\ViewpointService.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Analog Devices\Core\smax4pnp.exe

C:\Program Files\Dell\Media Experience\PCMService.exe

C:\Program Files\Common Files\AOL\1146785662\ee\AOLSoftware.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\WINDOWS\system32\dla\tfswctrl.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\Windows Defender\MSASCui.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\WINDOWS\System32\M-AudioTaskBarIcon.exe

C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe

C:\Program Files\DellSupport\DSAgnt.exe

C:\Program Files\DAEMON Tools\daemon.exe

C:\Program Files\ZD Soft\Game Recorder\grecorder.exe

C:\Program Files\Windows Media Player\WMPNSCFG.exe

C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe

C:\Program Files\Hide My IP 2007\SecureSrv.exe

C:\Program Files\iPod\bin\iPodService.exe

F:\HiJackThis.exe

C:\WINDOWS\system32\NOTEPAD.EXE



R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = about:blank

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://bfc.myway.com/search/de_srchlft.html

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?linkid=677

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=54729

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr7/*http://www.yahoo.com/ext/search/search.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
- C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {07E934F7-6FBD-4A08-8E87-37D72CF61720} - (no file)

O2 - BHO: BitComet ClickCapture -
{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program
Files\BitComet\tools\BitCometBHO_1.2.1.2.dll

O2 - BHO: (no name) - {3C21D82D-1BCA-753C-C36B-0BBBD742C11E} - (no file)

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll

O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\Common\YIeTagBm.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll

O2 - BHO: Catcher Class - {ADECBED6-0366-4377-A739-E69DFBA04663} - C:\Program Files\Moyea\FLV Downloader\MoyeaCth.dll

O2 - BHO: Google Toolbar Notifier BHO -
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program
Files\Google\GoogleToolbarNotifier\2.0.1121.2472\swg.dll

O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} -
C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll

O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program
Files\MSN Apps\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll

O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe

O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"

O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1146785662\ee\AOLSoftware.exe

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot

O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe

O4 - HKLM\..\Run: [vshbsqc.dll] C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\vshbsqc.dll,gyvmmcf

O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [PC Pitstop Optimize2 Reminder] C:\Program Files\PCPitstop\Optimize2\Reminder.exe

O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"

O4 - HKLM\..\Run: [DigidesignMMERefresh] C:\Program Files\Digidesign\Drivers\MMERefresh.exe

O4 - HKLM\..\Run: [M-Audio Taskbar Icon] C:\WINDOWS\System32\M-AudioTaskBarIcon.exe

O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe

O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup

O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033

O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear

O4 - HKCU\..\Run: [Game Recorder] "C:\Program Files\ZD Soft\Game Recorder\grecorder.exe"

O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe

O4 - HKCU\..\Policies\Explorer\Run:
[{A04ABEFE-0AE9-1033-1108-040416200001}] "C:\Program Files\Common
Files\{A04ABEFE-0AE9-1033-1108-040416200001}\Update.exe"
mc-110-12-0000272

O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')

O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')

O4 - Global Startup: America Online 9.0 Tray Icon.lnk.disabled

O4 - Global Startup: ymetray.lnk = C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe

O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm

O8 - Extra context menu item: &D&ownload all video with
BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm

O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm

O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm

O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm

O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm

O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console -
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program
Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra button: No More Cookies -
{334C4A3A-7B0F-4C55-B73F-63B37865E8FA} - C:\Program Files\No More
Cookies\No More Cookies.exe (file missing)

O9 - Extra 'Tools' menuitem: No More Cookies -
{334C4A3A-7B0F-4C55-B73F-63B37865E8FA} - C:\Program Files\No More
Cookies\No More Cookies.exe (file missing)

O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll

O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll

O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} -
res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll/206 (file
missing)

O9 - Extra button: MUSICMATCH MX Web Player -
{d81ca86b-ef63-42af-bee3-4502d9a03c2d} -
http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)

O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} -
C:\Documents and Settings\Abraham\Start Menu\Programs\IMVU\Run IMVU.lnk
(file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\securenet.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\securenet.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\securenet.dll

O16 - DPF: {745395C8-D0E1-4227-8586-624CA9A10A8D} - http://webcam.atomicmods.com//activex/AMC.cab

O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} (PCPitstop Exam) - http://utilities.pcpitstop.com/optimize2/pcpitstop2.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - Winlogon Notify: winhld32 - winhld32.dll (file missing)

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program
Files\Common Files\Apple\Mobile Device
Support\bin\AppleMobileDeviceService.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: Digidesign MME Refresh Service (DigiRefresh) -
Digidesign, A Division of Avid Technology, Inc. - C:\Program
Files\Digidesign\Drivers\MMERefresh.exe

O23 - Service: digiSPTIService - Digidesign, A Division of Avid
Technology, Inc. - C:\Program Files\Digidesign\Pro
Tools\digiSPTIService.exe

O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe

O23 - Service: M-Audio Fast Track Installer (FastTrackInstallerService)
- Avid Technology, Inc. - C:\Program Files\M-Audio\Fast Track
USB\MAUSBFTInst.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision
Corporation - C:\Program Files\Common
Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe

O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PunkBuster (PnkBstrA) - Unknown owner - C:\Program Files\Electronic Arts\Need for Speed ProStreet\PB\PnkBstrA.exe

O23 - Service: Remote Packet Capture Protocol v.0 (experimental)
(rpcapd) - NetGroup - Politecnico di Torino - C:\Program
Files\WinPcap\rpcapd.exe

O23 - Service: SecureSrv - Unknown owner - C:\Program Files\Hide My IP 2007\SecureSrv.exe

O23 - Service: Uno Installer (UnoInstallerService) - Unknown owner - C:\Program Files\M-Audio Uno\UnoInst.exe

O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe

O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe



--

End of file - 13772 bytes

28 Posts

March 17th, 2008 01:00

Hello Bugbatter

 

-The first link i posted is the issue.

-done

-done and uninstalled

- It belongs to me, and yes

- I have not fixed anything yet

 

 Thanks for replying

Message Edited by racah15 on 03-16-2008 09:38 PM

4 Apprentice

 • 

20.5K Posts

March 17th, 2008 01:00

I am reviewing your log.
In the meantime, you can help me by doing the following:

* Have you have posted this issue on another forum? If so, please provide a link to the topic.

* If you are using any cracked software, please remove it.
Definition of cracked software:
http://en.wikipedia.org/wiki/Software_cracking

* If you are using any P2P (file sharing) programs, please remove them before we clean your computer.
The nature of such software and the high incidence of malware in files downloaded with them is counter productive to restoring your PC to a healthy state. That would include your BitComet as well.

* If this computer belongs to someone else, do you have authority to apply the fixes we will use?

* Have you already fixed entries using HijackThis? If so, please restore all the backups and then post another log.

* After we begin working, please print or copy all instructions to Notepad in order to assist you when carrying out procedures.
Please follow all instructions in sequence. Do not, on your own, install/re-install any programs or run any fixes or scanners that you have not been instructed to use because this may cause conflicts with the tools that I am using.

** We may be using some specialized tools during our fix. Certain embedded files that are part of legitimate programs or specialized fix tools such as process.exe, restart.exe, SmiUpdate.exe, reboot.exe, ws2fix.exe, prcviewer.exe and nircmd.exe may at times be detected by some anti-virus/anti-malware scanners as a "RiskTool", "Hacking tool", "Potentially unwanted tool", or even "malware (virus/trojan)" when that is not the case.
Such programs have legitimate uses in contexts where an authorized user or administrator has knowingly installed it. These detections do not necessarily mean the file is malware or a bad program. It means it has the potential for being misused by others. Anti-virus scanners cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert you or even automatically remove them.

* If your replies do not fit in one post while we are handling your issue, please reply to yourself until all text is submitted. It may take several posts.

I look forward to your reply.

4 Apprentice

 • 

20.5K Posts

March 17th, 2008 01:00

Okay, here we go...

First, please open Notepad. Go to the File menu and UNcheck Wordwrap. Close Notepad.

Please print these instructions and refer to them for downloading and running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix


Post the log from ComboFix when you've accomplished that, along with a new HijackThis log.

Note: The above instructions were created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.
You should NOT use Combofix unless you have been instructed to do so by a Malware Removal Expert. It is intended by its creator to be used under the guidance and supervision of an expert, not for private use.





Please move your HijackThis to a folder on your C-drive. It should have been installed to your Program Files.
Message Edited by Bugbatter on 03-16-2008 10:51 PM

28 Posts

March 17th, 2008 21:00

ComboFix 08-03-14.4 - Abraham 2008-03-17 15:48:31.1 - NTFSx86
Microsoft Windows XP Home Edition  5.1.2600.2.1252.1.1033.18.179 [GMT -6:00]
Running from: C:\Documents and Settings\Abraham\Desktop\ComboFix.exe
 * Created a new restore point
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Abraham\Application Data\macromedia\Flash Player\#SharedObjects\F6ZFEFE8\www.broadcaster.com
C:\Documents and Settings\Abraham\Application Data\macromedia\Flash Player\#SharedObjects\F6ZFEFE8\www.broadcaster.com\played_list.sol
C:\Documents and Settings\Abraham\Application Data\macromedia\Flash Player\#SharedObjects\F6ZFEFE8\www.broadcaster.com\video_queue.sol
C:\Documents and Settings\Abraham\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com
C:\Documents and Settings\Abraham\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol
C:\Documents and Settings\Angelica\Desktop\poker shortcut.lnk
C:\Program Files\Common Files\{304AB~1
C:\Program Files\Common Files\{A04AB~1
C:\Program Files\vsadd-in
C:\Program Files\winupdates
C:\WINDOWS\system32\components
C:\WINDOWS\system32\drivers\npf.sys
C:\WINDOWS\system32\grecorder.dll
C:\WINDOWS\system32\packet.dll
C:\WINDOWS\system32\pthreadVC.dll
C:\WINDOWS\system32\wanpacket.dll
C:\WINDOWS\system32\wpcap.dll

.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\LEGACY_NPF
-------\NPF


(((((((((((((((((((((((((   Files Created from 2008-02-17 to 2008-03-17  )))))))))))))))))))))))))))))))
.

2008-03-17 15:28 . 2008-03-17 15:28        d--------    C:\Program Files\Trend Micro
2008-03-17 12:12 . 2008-03-17 12:12        d--------    C:\Program Files\DigiTech
2008-03-15 16:25 . 2004-08-04 00:56    116,224    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\xrxwiadr.dll
2008-03-15 16:25 . 2001-08-17 22:36    23,040    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\xrxwbtmp.dll
2008-03-15 16:25 . 2001-08-17 22:36    17,408    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\xrxscnui.dll
2008-03-15 16:24 . 2004-08-03 22:31    154,624    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\wlluc48.sys
2008-03-15 16:24 . 2001-08-17 22:37    99,865    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\xlog.exe
2008-03-15 16:24 . 2001-08-17 12:12    34,890    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\wlandrv2.sys
2008-03-15 16:24 . 2001-08-17 22:37    27,648    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\xrxftplt.exe
2008-03-15 16:24 . 2004-08-03 22:29    19,455    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\wvchntxx.sys
2008-03-15 16:24 . 2001-08-17 12:11    16,970    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\xem336n5.sys
2008-03-15 16:24 . 2004-08-03 22:29    12,063    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\wsiintxx.sys
2008-03-15 16:24 . 2004-08-03 23:07    8,832    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\wmiacpi.sys
2008-03-15 16:24 . 2004-08-04 00:56    8,192    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\wshirda.dll
2008-03-15 16:24 . 2001-08-17 22:37    4,608    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\xrxflnch.exe
2008-03-15 16:22 . 2001-08-17 13:28    794,654    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\usr1801.sys
2008-03-15 16:21 . 2001-08-17 22:36    525,568    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\tridxp.dll
2008-03-15 16:20 . 2001-08-17 14:56    315,520    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\trid3d.dll
2008-03-15 16:19 . 2001-08-17 12:18    285,760    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\stlnata.sys
2008-03-15 16:18 . 2004-08-04 05:00    456,704    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\smtpsvc.dll
2008-03-15 16:17 . 2004-08-03 22:41    404,990    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\slntamr.sys
2008-03-15 16:16 . 2001-08-17 22:36    386,560    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\sgiul50.dll
2008-03-15 16:15 . 2001-08-17 22:36    495,616    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\sblfx.dll
2008-03-15 16:14 . 2001-08-17 13:28    899,146    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\r2mdkxga.sys
2008-03-15 16:13 . 2004-08-04 00:56    363,520    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\psisdecd.dll
2008-03-15 16:12 . 2001-08-17 14:05    351,616    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\ovcodek2.sys
2008-03-15 16:11 . 2001-08-17 12:50    198,144    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\nv3.sys
2008-03-15 16:10 . 2004-08-04 00:56    1,737,856    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\mtxparhd.dll
2008-03-15 16:09 . 2004-08-03 22:41    1,309,184    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\mtlstrm.sys
2008-03-15 16:08 . 2001-08-17 13:28    802,683    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\ltsm.sys
2008-03-15 16:07 . 2001-08-17 22:36    242,176    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\kdsusd.dll
2008-03-15 16:06 . 2001-08-17 22:36    372,824    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\iconf32.dll
2008-03-15 16:05 . 2004-08-03 22:41    1,041,536    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\hsfdpsp2.sys
2008-03-15 16:04 . 2001-08-17 13:28    907,456    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\hcf_msft.sys
2008-03-15 16:03 . 2001-08-17 14:56    1,733,120    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\g400d.dll
2008-03-15 16:02 . 2001-08-17 13:28    634,134    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\el656ct5.sys
2008-03-15 16:01 . 2001-08-17 12:14    952,007    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\diwan.sys
2008-03-15 16:00 . 2001-08-17 22:36    419,357    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\dgconfig.dll
2008-03-15 15:59 . 2001-08-17 12:13    980,034    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\cicap.sys
2008-03-15 15:58 . 2004-08-04 00:56    1,888,992    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\ati3duag.dll
2008-03-15 15:57 . 2001-08-17 13:28    762,780    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\3cwmcru.sys
2008-03-15 15:56 . 2004-05-13 00:39    876,653    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\fp4awel.dll
2008-03-15 15:19 . 2008-03-15 15:19        d--------    C:\Documents and Settings\All Users\Application Data\Ableton
2008-03-15 15:19 . 2008-03-15 21:59        d--------    C:\Documents and Settings\Abraham\Application Data\Ableton
2008-03-12 17:19 . 2008-03-12 17:19        d--------    C:\Documents and Settings\Recording\Application Data\DSound
2008-03-11 22:29 . 2008-03-11 22:29        d--------    C:\Program Files\M-Audio Fast Track USB
2008-03-11 22:29 . 2006-04-04 15:45    2,400,648    --a------    C:\WINDOWS\SYSTEM32\madiousb.dll
2008-03-11 22:29 . 2006-04-04 14:42    186,368    --a------    C:\WINDOWS\SYSTEM32\M-AudioFastTrackControlPanelApplet.cpl
2008-03-11 22:29 . 2006-04-04 14:42    106,112    --a------    C:\WINDOWS\SYSTEM32\DRIVERS\mausbft.sys
2008-03-11 22:29 . 2006-04-04 14:42    99,840    --a------    C:\WINDOWS\SYSTEM32\M-AudioTaskBarIcon.exe
2008-03-11 22:29 . 2006-04-04 14:42    19,456    --a------    C:\WINDOWS\SYSTEM32\mausbasio.dll
2008-03-10 23:56 . 2004-08-31 15:57    30,848    --a------    C:\WINDOWS\SYSTEM32\DRIVERS\MA763010.sys
2008-03-10 21:06 . 2008-03-10 21:07        d--------    C:\Documents and Settings\Recording\Application Data\Cakewalk
2008-03-10 20:52 . 2004-10-20 16:50    85,504    --a------    C:\WINDOWS\SYSTEM32\evolusbn.dll
2008-03-10 20:52 . 2004-10-20 16:50    21,984    --a------    C:\WINDOWS\SYSTEM32\DRIVERS\evolusb.sys
2008-03-10 20:51 . 2008-03-10 23:12        d--------    C:\Program Files\M-Audio Uno
2008-03-09 01:04 . 2008-03-09 01:04        d--------    C:\Documents and Settings\Recording\Application Data\Apple Computer
2008-03-05 19:45 . 2008-03-05 19:45        d--h-----    C:\Documents and Settings\Recording\Application Data\GTek
2008-03-05 19:44 . 2005-01-21 16:36        d--------    C:\Documents and Settings\Recording\Application Data\Sonic
2008-03-05 19:44 . 2005-01-21 16:29        d--------    C:\Documents and Settings\Recording\Application Data\Jasc Software Inc
2008-03-05 18:54 . 2008-03-05 18:54    230    --a------    C:\WINDOWS\SYSTEM32\spupdsvc.inf
2008-03-05 18:35 . 2008-03-05 18:35        d--------    C:\Documents and Settings\Abraham\Application Data\DSound
2008-02-19 22:47 . 2008-02-19 22:47    4,208    --a------    C:\untitled.wav
2008-02-18 20:33 . 2008-03-12 20:54        d--------    C:\Documents and Settings\Abraham\Application Data\Digidesign
2008-02-17 17:53 . 2008-03-11 22:29        d--------    C:\Program Files\M-Audio
2008-02-17 16:36 . 2008-02-17 16:36        d--------    C:\Program Files\Common Files\PACE Anti-Piracy
2008-02-17 16:36 . 2008-02-17 16:36        d--------    C:\Documents and Settings\All Users\Application Data\PACE Anti-Piracy
2008-02-17 16:36 . 2008-02-17 16:36        d--------    C:\Documents and Settings\Abraham\Application Data\PACE Anti-Piracy
2008-02-17 16:36 . 2008-02-17 16:36        d--------    C:\Digidesign Databases
2008-02-17 16:03 . 2008-02-17 16:03        d--------    C:\Program Files\DSound
2008-02-17 16:03 . 2008-02-17 16:03        d--------    C:\Program Files\ASIO
2008-02-17 13:33 . 2008-02-17 13:33        d--------    C:\Program Files\InterLok
2008-02-17 13:32 . 2006-11-13 22:38    16,384    --a------    C:\WINDOWS\SYSTEM32\DRIVERS\DigiFilt.sys
2008-02-17 13:31 . 2008-02-17 13:33        d--------    C:\Program Files\Digidesign
2008-02-17 13:31 . 2006-11-14 06:12    3,638,655    --a------    C:\WINDOWS\SYSTEM32\DirectIO.dll
2008-02-17 13:31 . 2006-11-13 22:35    1,900,132    --a------    C:\WINDOWS\SYSTEM32\ExpansionHD_Firmware.bin
2008-02-17 13:31 . 2006-09-19 23:17    638,976    ---------    C:\WINDOWS\SYSTEM32\ilinet.dll
2008-02-17 13:31 . 2006-11-13 22:37    483,328    --a------    C:\WINDOWS\SYSTEM32\DSI.dll
2008-02-17 13:31 . 2001-06-27 10:13    217,088    ---------    C:\WINDOWS\SYSTEM32\qtmlClient.dll
2008-02-17 13:31 . 2006-11-13 22:35    192,512    --a------    C:\WINDOWS\SYSTEM32\DigiPlatformSupport.dll
2008-02-17 13:31 . 2006-11-13 23:07    90,112    --a------    C:\WINDOWS\SYSTEM32\WinMMFix.dll
2008-02-17 13:30 . 2008-02-17 13:30        d--------    C:\Documents and Settings\Abraham\Application Data\InstallShield
2008-02-17 13:11 . 2008-02-17 13:11        d--------    C:\Program Files\Ableton

28 Posts

March 17th, 2008 21:00


catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-17 15:59:38
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.2180]
-> C:\WINDOWS\system32\securenet.dll

PROCESS: C:\WINDOWS\explorer.exe [6.00.2900.3156]
-> C:\Program Files\ZD Soft\Game Recorder\grechook.dll
-> C:\Program Files\ZD Soft\Game Recorder\grecddraw.dll
-> C:\Program Files\ZD Soft\Game Recorder\grecd3d8.dll
-> C:\Program Files\ZD Soft\Game Recorder\grecd3d9.dll
-> C:\Program Files\ZD Soft\Game Recorder\grecogl.dll
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Windows Defender\MsMpEng.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\M-Audio\Fast Track USB\MAUSBFTInst.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Electronic Arts\Need for Speed ProStreet\PB\PnkBstrA.exe
C:\WINDOWS\system32\UAService7.exe
C:\Program Files\Windows Media Player\WMPNetwk.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2008-03-17 16:07:06 - machine was rebooted [Abraham]
ComboFix-quarantined-files.txt  2008-03-17 22:07:00
.
2008-03-17 20:53:58    --- E O F --- 

28 Posts

March 17th, 2008 21:00

O4 - HKLM\..\Run: [vshbsqc.dll] C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\vshbsqc.dll,gyvmmcf

i think i found the source for my missing .dll files

28 Posts

March 17th, 2008 21:00

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:08:54 PM, on 3/17/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Digidesign\Drivers\MMERefresh.exe
C:\Program Files\M-Audio\Fast Track USB\MAUSBFTInst.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Electronic Arts\Need for Speed ProStreet\PB\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\M-Audio Uno\UnoInst.exe
C:\WINDOWS\system32\UAService7.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Hide My IP 2007\SecureSrv.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Common Files\AOL\1146785662\ee\AOLSoftware.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\M-AudioTaskBarIcon.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\ZD Soft\Game Recorder\grecorder.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?linkid=677
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr7/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\Common\YIeTagBm.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Catcher Class - {ADECBED6-0366-4377-A739-E69DFBA04663} - C:\Program Files\Moyea\FLV Downloader\MoyeaCth.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.1121.2472\swg.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1146785662\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [vshbsqc.dll] C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\vshbsqc.dll,gyvmmcf
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [PC Pitstop Optimize2 Reminder] C:\Program Files\PCPitstop\Optimize2\Reminder.exe
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [DigidesignMMERefresh] C:\Program Files\Digidesign\Drivers\MMERefresh.exe
O4 - HKLM\..\Run: [M-Audio Taskbar Icon] C:\WINDOWS\System32\M-AudioTaskBarIcon.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear
O4 - HKCU\..\Run: [Game Recorder] "C:\Program Files\ZD Soft\Game Recorder\grecorder.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Policies\Explorer\Run: [{A04ABEFE-0AE9-1033-1108-040416200001}] "C:\Program Files\Common Files\{A04ABEFE-0AE9-1033-1108-040416200001}\Update.exe" mc-110-12-0000272
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Global Startup: America Online 9.0 Tray Icon.lnk.disabled
O4 - Global Startup: ymetray.lnk = C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: No More Cookies - {334C4A3A-7B0F-4C55-B73F-63B37865E8FA} - C:\Program Files\No More Cookies\No More Cookies.exe (file missing)
O9 - Extra 'Tools' menuitem: No More Cookies - {334C4A3A-7B0F-4C55-B73F-63B37865E8FA} - C:\Program Files\No More Cookies\No More Cookies.exe (file missing)
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Abraham\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\securenet.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\securenet.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\securenet.dll
O16 - DPF: {745395C8-D0E1-4227-8586-624CA9A10A8D} - http://webcam.atomicmods.com//activex/AMC.cab
O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} (PCPitstop Exam) - http://utilities.pcpitstop.com/optimize2/pcpitstop2.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: winhld32 - winhld32.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Digidesign MME Refresh Service (DigiRefresh) - Digidesign, A Division of Avid Technology, Inc. - C:\Program Files\Digidesign\Drivers\MMERefresh.exe
O23 - Service: digiSPTIService - Digidesign, A Division of Avid Technology, Inc. - C:\Program Files\Digidesign\Pro Tools\digiSPTIService.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: M-Audio Fast Track Installer (FastTrackInstallerService) - Avid Technology, Inc. - C:\Program Files\M-Audio\Fast Track USB\MAUSBFTInst.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PunkBuster (PnkBstrA) - Unknown owner - C:\Program Files\Electronic Arts\Need for Speed ProStreet\PB\PnkBstrA.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - NetGroup - Politecnico di Torino - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: SecureSrv - Unknown owner - C:\Program Files\Hide My IP 2007\SecureSrv.exe
O23 - Service: Uno Installer (UnoInstallerService) - Unknown owner - C:\Program Files\M-Audio Uno\UnoInst.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--
End of file - 12741 bytes

28 Posts

March 17th, 2008 21:00


((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-17 02:33    ---------    d-----w    C:\Program Files\LimeWire
2008-03-17 02:32    ---------    d-----w    C:\Program Files\BitComet
2008-03-11 02:52    ---------    d--h--w    C:\Program Files\InstallShield Installation Information
2008-03-09 06:58    11,102    -c--a-w    C:\Documents and Settings\Abraham\Application Data\wklnhst.dat
2008-03-09 06:58    ---------    d-----w    C:\Program Files\iTunes
2008-03-06 02:02    ---------    d-----w    C:\Program Files\Total Video Converter
2008-03-06 01:42    ---------    d-----w    C:\Program Files\Incomplete
2008-03-06 01:31    ---------    d-----w    C:\Program Files\Acoustica Shared Effects
2008-03-06 01:31    ---------    d-----w    C:\Program Files\Acoustica Beatcraft
2008-02-17 22:03    ---------    d-----w    C:\Program Files\Vstplugins
2008-02-17 21:39    ---------    d-----w    C:\Program Files\Music Coach
2008-02-17 19:31    ---------    d-----w    C:\Program Files\Common Files\Digidesign
2008-02-12 02:01    ---------    d-----w    C:\Documents and Settings\All Users\Application Data\SupportSoft
2008-02-12 01:58    ---------    d-----w    C:\Program Files\Dell Support Center
2008-02-12 01:57    ---------    d-----w    C:\Program Files\Common Files\supportsoft
2008-02-12 01:52    ---------    d-----w    C:\Documents and Settings\All Users\Application Data\Dell
2008-01-21 16:56    ---------    d-----w    C:\Program Files\Microsoft Games
2008-01-21 16:46    ---------    d-----w    C:\Program Files\Rockstar Games
2008-01-17 00:07    ---------    d-----w    C:\Documents and Settings\All Users\Application Data\PCPitstop
2008-01-17 00:03    ---------    d-----w    C:\Program Files\PCPitstop
2007-02-03 07:11    9,932    -csh--w    C:\Program Files\Folder.jpg
2007-02-03 07:11    9,932    -csh--w    C:\Program Files\AlbumArt_{06F8645A-277E-4FDA-B3D8-230C656490EA}_Large.jpg
2007-02-03 07:11    2,542    -csh--w    C:\Program Files\AlbumArtSmall.jpg
2007-02-03 07:11    2,542    -csh--w    C:\Program Files\AlbumArt_{06F8645A-277E-4FDA-B3D8-230C656490EA}_Small.jpg
2007-01-25 02:43    70,120    -c--a-w    C:\Documents and Settings\Abraham\Application Data\GDIPFONTCACHEV1.DAT
2005-02-27 23:40    154    -c--a-w    C:\Documents and Settings\Angelica\Application Data\wklnhst.dat
2005-12-09 04:38    56    -csh--r    C:\WINDOWS\SYSTEM32\92807604D0.sys
2006-12-05 06:28    1,316,766    -csh--w    C:\WINDOWS\SYSTEM32\utvwa.bak1
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 11:09 460784]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-04-03 16:29 165784]
"NVIDIA nTune"="C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-07-03 12:32 81920]
"Game Recorder"="C:\Program Files\ZD Soft\Game Recorder\grecorder.exe" [2006-06-27 12:02 823296]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 22:05 204288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 15:42 1404928]
"PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2004-04-11 20:15 290816]
"HostManager"="C:\Program Files\Common Files\AOL\1146785662\ee\AOLSoftware.exe" [2006-09-25 18:52 50736]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-07-25 23:22 180269]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-11-16 01:05 127035]
"vshbsqc.dll"="C:\WINDOWS\system32\vshbsqc.dll" [ ]
"GameXL"="" []
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-09-20 09:35 94208]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-09-20 09:36 114688]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 07:00 79224]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-09-17 01:07 8491008]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-09-17 01:07 81920]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20 866584]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-10 16:27 385024]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-01-15 04:22 267048]
"PC Pitstop Optimize2 Reminder"="C:\Program Files\PCPitstop\Optimize2\Reminder.exe" [2007-12-12 17:19 145112]
"dscactivate"="C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 10:24 16384]
"DigidesignMMERefresh"="C:\Program Files\Digidesign\Drivers\MMERefresh.exe" [2006-11-14 01:05 61440]
"M-Audio Taskbar Icon"="C:\WINDOWS\System32\M-AudioTaskBarIcon.exe" [2006-04-04 14:42 99840]
"Microsoft Works Update Detection"="C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2003-12-05 22:08 50688]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 16:38 39264]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2004-08-04 05:00 53760 C:\WINDOWS\SYSTEM32\NARRATOR.EXE]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
America Online 9.0 Tray Icon.lnk.disabled [2005-01-21 16:35:13 831]
ymetray.lnk - C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe [2007-01-26 14:00:22 54776]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"RunStartupScriptSync"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoChangeAnimation"= 1 (0x1)
"NoStrCmpLogical"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"MemCheckBoxInRunDlg"= 1 (0x1)
"NoStrCmpLogical"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run]
"{A04ABEFE-0AE9-1033-1108-040416200001}"= "C:\Program Files\Common Files\{A04ABEFE-0AE9-1033-1108-040416200001}\Update.exe" mc-110-12-0000272

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="LogonUI.EXE"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winhld32]
winhld32.dll

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"MyWebSearch Email Plugin"=C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
"PlaxoUpdate"=C:\Program Files\Plaxo\2.11.1.5\PlaxoHelper.exe -a
"Aim6"=
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"BearFlix"="C:\Program Files\BearFlix\BearFlix.exe" /pause
"My Web Search Bar Search Scope Monitor"="C:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe" /m=0
"MyWebSearch Email Plugin"=C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
"StarSkin"=C:\PROGRAM FILES\ROCKET DIVISION SOFTWARE\STARSKIN\STARSKIN.EXE -H
"EmailScan"=C:\Program Files\mcafee.com\antivirus\mcvsescn.exe
"AOLDialer"=C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
"AOLSPScheduler"=C:\Program Files\Common Files\AOL\1146785662\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exe
"PCPitstop Optimize Registration Reminder"=C:\Program Files\PCPitstop\Optimize\Reminder.exe
"PCPitstop Disk MD Registration Reminder"=C:\Program Files\PCPitstop\Disk MD\Reminder.exe
"nwiz"=nwiz.exe /install

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"C:\\Program Files\\AIM\\aim.exe"=
"C:\\Program Files\\Windows Media Player\\wmplayer.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"C:\\Program Files\\Common Files\\AOL\\1146785662\\ee\\aolsoftware.exe"=
"C:\\Program Files\\Electronic Arts\\Need for Speed Carbon\\nfsc.exe"=
"C:\\Program Files\\Native Instruments\\Reaktor 5\\Reaktor5.exe"=
"C:\\WINDOWS\\SYSTEM32\\DPVSETUP.EXE"=
"C:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"2303:TCP"= 2303:TCP:Line
"2302:TCP"= 2302:TCP:line2
"25186:TCP"= 25186:TCP:BitComet 25186 TCP
"25186:UDP"= 25186:UDP:BitComet 25186 UDP

R0 DigiFilter;DigiFilter;C:\WINDOWS\system32\drivers\DigiFilt.sys [2006-11-13 22:38]
R1 rxp;rxp;C:\WINDOWS\system32\drivers\rxp.sys [2004-05-05 09:03]
R2 NwSapAgent;SAP Agent;C:\WINDOWS\system32\svchost.exe [2004-08-04 05:00]
R2 UnoInstallerService;Uno Installer;C:\Program Files\M-Audio Uno\UnoInst.exe [2004-12-04 01:06]
R2 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" [2007-01-04 15:38]
R3 SecureSrv;SecureSrv;C:\Program Files\Hide My IP 2007\SecureSrv.exe [2007-06-21 03:09]
S3 DVC;USB DVC Svc;C:\WINDOWS\system32\Drivers\DVC.sys [2001-09-10 08:43]
S3 EVOLUSB;%EVOL_USB_SvcDesc%;C:\WINDOWS\system32\drivers\evolusb.sys [2004-10-20 16:50]
S3 MA763010;M-Audio Fast Track;C:\WINDOWS\system32\drivers\MA763010.sys [2004-08-31 15:57]
S3 MAUSBFT;Service for M-Audio Fast Track USB (WDM);C:\WINDOWS\system32\DRIVERS\mausbft.sys [2006-04-04 14:42]
S3 SDVC05;USB SDVC05;C:\WINDOWS\system32\Drivers\SDVC05.sys [2003-07-22 18:50]
S3 StMp3Rec;Player Recovery Device Control Driver;C:\WINDOWS\system32\Drivers\StMp3Rec.sys [2007-06-15 11:49]
S3 usbprint;Microsoft USB PRINTER Class;C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 23:01]

.
Contents of the 'Scheduled Tasks' folder
"2008-03-17 22:01:11 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************

28 Posts

March 17th, 2008 22:00


ill post the other two in a sec. via rapidshare to make things easier and not expand this page,
unless you want me to post it here.
File 92807604D0.sys received on 03.18.2008 00:35:57 (CET)
Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED
Result: 0/32 (0%)
File size: 56 bytes
MD5: 2abc76445370ec167a2f4c564025a482
SHA1: 52dd0149623fc3dfa69b926ff9ff55354adc3bb4
PEiD: -

4 Apprentice

 • 

20.5K Posts

March 17th, 2008 22:00

Please post in this thread. Thanks. :)

4 Apprentice

 • 

20.5K Posts

March 17th, 2008 22:00


Please submit a sample of this file:

C:\WINDOWS\SYSTEM32\ 92807604D0.sys

to Virus Total --
http://www.virustotal.com/en/indexf.html

At the top of the page you will see:
Select file>Browse>Send
Just follow the prompts.
The submission will then be tested against many different AV vendors’ scanners.
That will give you an idea what it is and who recognizes it. In addition, unless told
otherwise, Virus Total will provide the sample to all participating vendors.

When you get the report, please post back the exact results along with all others requested.

Please ensure that your security programs are still disabled.

Open Notepad and copy/paste the following text between the lines below. Do not copy the dotted lines.
** Make sure you copy/paste ALL the text at once. Do not try to edit extra spaces. It will copy correctly to Notepad if you highlight and copy as is.

-----------------------------------------------------------------------------------

File::
C:\WINDOWS\system32\vshbsqc.dll
C:\WINDOWS\SYSTEM32\utvwa.bak1



Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"vshbsqc.dll"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winhld32]

----------------------------------------------------------------------------

Save this as CFScript.txt
Photobucket

Referring to the picture above, drag CFScript into ComboFix.exe
You will be prompted to run Combofix again. Follow the same instructions you did before for running ComboFix.
CAUTION: Do not mouse-click ComboFix while it is running. It may cause it to stall.

When finished, a log is produced here: C:\ComboFix.txt

In your next reply, please post that log along with a new HijackThis log. Let me know how things are running.
Message Edited by Bugbatter on 03-17-2008 07:11 PM

28 Posts

March 17th, 2008 23:00

Question: Howcome if i deleted Bitcomet and Limewire, it still shows up?  I uninstalled it because i never used it haha, as soon as i got it, i moved my computer to my room which has no internet. kinda pointless so i didn't care for it.

anyways here are the logs:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:45:52 PM, on 3/17/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Digidesign\Drivers\MMERefresh.exe
C:\Program Files\M-Audio\Fast Track USB\MAUSBFTInst.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Electronic Arts\Need for Speed ProStreet\PB\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\M-Audio Uno\UnoInst.exe
C:\WINDOWS\system32\UAService7.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Hide My IP 2007\SecureSrv.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?linkid=677
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr7/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\Common\YIeTagBm.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Catcher Class - {ADECBED6-0366-4377-A739-E69DFBA04663} - C:\Program Files\Moyea\FLV Downloader\MoyeaCth.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.1121.2472\swg.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1146785662\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [PC Pitstop Optimize2 Reminder] C:\Program Files\PCPitstop\Optimize2\Reminder.exe
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [DigidesignMMERefresh] C:\Program Files\Digidesign\Drivers\MMERefresh.exe
O4 - HKLM\..\Run: [M-Audio Taskbar Icon] C:\WINDOWS\System32\M-AudioTaskBarIcon.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear
O4 - HKCU\..\Run: [Game Recorder] "C:\Program Files\ZD Soft\Game Recorder\grecorder.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Policies\Explorer\Run: [{A04ABEFE-0AE9-1033-1108-040416200001}] "C:\Program Files\Common Files\{A04ABEFE-0AE9-1033-1108-040416200001}\Update.exe" mc-110-12-0000272
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Global Startup: America Online 9.0 Tray Icon.lnk.disabled
O4 - Global Startup: ymetray.lnk = C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: No More Cookies - {334C4A3A-7B0F-4C55-B73F-63B37865E8FA} - C:\Program Files\No More Cookies\No More Cookies.exe (file missing)
O9 - Extra 'Tools' menuitem: No More Cookies - {334C4A3A-7B0F-4C55-B73F-63B37865E8FA} - C:\Program Files\No More Cookies\No More Cookies.exe (file missing)
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Abraham\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\securenet.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\securenet.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\securenet.dll
O16 - DPF: {745395C8-D0E1-4227-8586-624CA9A10A8D} - http://webcam.atomicmods.com//activex/AMC.cab
O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} (PCPitstop Exam) - http://utilities.pcpitstop.com/optimize2/pcpitstop2.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Digidesign MME Refresh Service (DigiRefresh) - Digidesign, A Division of Avid Technology, Inc. - C:\Program Files\Digidesign\Drivers\MMERefresh.exe
O23 - Service: digiSPTIService - Digidesign, A Division of Avid Technology, Inc. - C:\Program Files\Digidesign\Pro Tools\digiSPTIService.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: M-Audio Fast Track Installer (FastTrackInstallerService) - Avid Technology, Inc. - C:\Program Files\M-Audio\Fast Track USB\MAUSBFTInst.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PunkBuster (PnkBstrA) - Unknown owner - C:\Program Files\Electronic Arts\Need for Speed ProStreet\PB\PnkBstrA.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - NetGroup - Politecnico di Torino - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: SecureSrv - Unknown owner - C:\Program Files\Hide My IP 2007\SecureSrv.exe
O23 - Service: Uno Installer (UnoInstallerService) - Unknown owner - C:\Program Files\M-Audio Uno\UnoInst.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--
End of file - 11732 bytes

28 Posts

March 17th, 2008 23:00

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 11:09 460784]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-04-03 16:29 165784]
"NVIDIA nTune"="C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-07-03 12:32 81920]
"Game Recorder"="C:\Program Files\ZD Soft\Game Recorder\grecorder.exe" [2006-06-27 12:02 823296]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 22:05 204288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 15:42 1404928]
"PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2004-04-11 20:15 290816]
"HostManager"="C:\Program Files\Common Files\AOL\1146785662\ee\AOLSoftware.exe" [2006-09-25 18:52 50736]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-07-25 23:22 180269]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-11-16 01:05 127035]
"GameXL"="" []
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-09-20 09:35 94208]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-09-20 09:36 114688]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 07:00 79224]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-09-17 01:07 8491008]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-09-17 01:07 81920]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20 866584]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-10 16:27 385024]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-01-15 04:22 267048]
"PC Pitstop Optimize2 Reminder"="C:\Program Files\PCPitstop\Optimize2\Reminder.exe" [2007-12-12 17:19 145112]
"dscactivate"="C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 10:24 16384]
"DigidesignMMERefresh"="C:\Program Files\Digidesign\Drivers\MMERefresh.exe" [2006-11-14 01:05 61440]
"M-Audio Taskbar Icon"="C:\WINDOWS\System32\M-AudioTaskBarIcon.exe" [2006-04-04 14:42 99840]
"Microsoft Works Update Detection"="C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2003-12-05 22:08 50688]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 16:38 39264]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2004-08-04 05:00 53760 C:\WINDOWS\SYSTEM32\NARRATOR.EXE]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
America Online 9.0 Tray Icon.lnk.disabled [2005-01-21 16:35:13 831]
ymetray.lnk - C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe [2007-01-26 14:00:22 54776]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"RunStartupScriptSync"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoChangeAnimation"= 1 (0x1)
"NoStrCmpLogical"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"MemCheckBoxInRunDlg"= 1 (0x1)
"NoStrCmpLogical"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run]
"{A04ABEFE-0AE9-1033-1108-040416200001}"= "C:\Program Files\Common Files\{A04ABEFE-0AE9-1033-1108-040416200001}\Update.exe" mc-110-12-0000272

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="LogonUI.EXE"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"MyWebSearch Email Plugin"=C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
"PlaxoUpdate"=C:\Program Files\Plaxo\2.11.1.5\PlaxoHelper.exe -a
"Aim6"=
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"BearFlix"="C:\Program Files\BearFlix\BearFlix.exe" /pause
"My Web Search Bar Search Scope Monitor"="C:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe" /m=0
"MyWebSearch Email Plugin"=C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
"StarSkin"=C:\PROGRAM FILES\ROCKET DIVISION SOFTWARE\STARSKIN\STARSKIN.EXE -H
"EmailScan"=C:\Program Files\mcafee.com\antivirus\mcvsescn.exe
"AOLDialer"=C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
"AOLSPScheduler"=C:\Program Files\Common Files\AOL\1146785662\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exe
"PCPitstop Optimize Registration Reminder"=C:\Program Files\PCPitstop\Optimize\Reminder.exe
"PCPitstop Disk MD Registration Reminder"=C:\Program Files\PCPitstop\Disk MD\Reminder.exe
"nwiz"=nwiz.exe /install

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"C:\\Program Files\\AIM\\aim.exe"=
"C:\\Program Files\\Windows Media Player\\wmplayer.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"C:\\Program Files\\Common Files\\AOL\\1146785662\\ee\\aolsoftware.exe"=
"C:\\Program Files\\Electronic Arts\\Need for Speed Carbon\\nfsc.exe"=
"C:\\Program Files\\Native Instruments\\Reaktor 5\\Reaktor5.exe"=
"C:\\WINDOWS\\SYSTEM32\\DPVSETUP.EXE"=
"C:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"2303:TCP"= 2303:TCP:Line
"2302:TCP"= 2302:TCP:line2
"25186:TCP"= 25186:TCP:BitComet 25186 TCP
"25186:UDP"= 25186:UDP:BitComet 25186 UDP

R0 DigiFilter;DigiFilter;C:\WINDOWS\system32\drivers\DigiFilt.sys [2006-11-13 22:38]
R1 rxp;rxp;C:\WINDOWS\system32\drivers\rxp.sys [2004-05-05 09:03]
R2 NwSapAgent;SAP Agent;C:\WINDOWS\system32\svchost.exe [2004-08-04 05:00]
R2 UnoInstallerService;Uno Installer;C:\Program Files\M-Audio Uno\UnoInst.exe [2004-12-04 01:06]
R2 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" [2007-01-04 15:38]
R3 SecureSrv;SecureSrv;C:\Program Files\Hide My IP 2007\SecureSrv.exe [2007-06-21 03:09]
S3 DVC;USB DVC Svc;C:\WINDOWS\system32\Drivers\DVC.sys [2001-09-10 08:43]
S3 EVOLUSB;%EVOL_USB_SvcDesc%;C:\WINDOWS\system32\drivers\evolusb.sys [2004-10-20 16:50]
S3 MA763010;M-Audio Fast Track;C:\WINDOWS\system32\drivers\MA763010.sys [2004-08-31 15:57]
S3 MAUSBFT;Service for M-Audio Fast Track USB (WDM);C:\WINDOWS\system32\DRIVERS\mausbft.sys [2006-04-04 14:42]
S3 SDVC05;USB SDVC05;C:\WINDOWS\system32\Drivers\SDVC05.sys [2003-07-22 18:50]
S3 StMp3Rec;Player Recovery Device Control Driver;C:\WINDOWS\system32\Drivers\StMp3Rec.sys [2007-06-15 11:49]
S3 usbprint;Microsoft USB PRINTER Class;C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 23:01]

.
Contents of the 'Scheduled Tasks' folder
"2008-03-18 00:39:15 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-17 18:36:43
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.2180]
-> C:\WINDOWS\system32\securenet.dll
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Windows Defender\MsMpEng.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\M-Audio\Fast Track USB\MAUSBFTInst.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Electronic Arts\Need for Speed ProStreet\PB\PnkBstrA.exe
C:\WINDOWS\system32\UAService7.exe
C:\Program Files\Windows Media Player\WMPNetwk.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
.
**************************************************************************
.
Completion time: 2008-03-17 18:42:29 - machine was rebooted [Abraham]
ComboFix-quarantined-files.txt  2008-03-18 00:42:23
ComboFix2.txt  2008-03-17 22:07:07
.
2008-03-17 20:53:58    --- E O F --- 

28 Posts

March 17th, 2008 23:00

ComboFix 08-03-14.4 - Abraham 2008-03-17 18:27:59.2 - NTFSx86
Microsoft Windows XP Home Edition  5.1.2600.2.1252.1.1033.18.160 [GMT -6:00]
Running from: F:\ComboFix.exe
Command switches used :: C:\Documents and Settings\Abraham\Desktop\CFScript.txt
 * Created a new restore point

FILE ::
C:\WINDOWS\SYSTEM32\utvwa.bak1
C:\WINDOWS\system32\vshbsqc.dll
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\SYSTEM32\utvwa.bak1

.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\LEGACY_NPF


(((((((((((((((((((((((((   Files Created from 2008-02-18 to 2008-03-18  )))))))))))))))))))))))))))))))
.

2008-03-17 15:28 . 2008-03-17 15:28        d--------    C:\Program Files\Trend Micro
2008-03-17 12:12 . 2008-03-17 12:12        d--------    C:\Program Files\DigiTech
2008-03-15 16:25 . 2004-08-04 00:56    116,224    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\xrxwiadr.dll
2008-03-15 16:25 . 2001-08-17 22:36    23,040    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\xrxwbtmp.dll
2008-03-15 16:25 . 2001-08-17 22:36    17,408    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\xrxscnui.dll
2008-03-15 16:24 . 2004-08-03 22:31    154,624    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\wlluc48.sys
2008-03-15 16:24 . 2001-08-17 22:37    99,865    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\xlog.exe
2008-03-15 16:24 . 2001-08-17 12:12    34,890    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\wlandrv2.sys
2008-03-15 16:24 . 2001-08-17 22:37    27,648    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\xrxftplt.exe
2008-03-15 16:24 . 2004-08-03 22:29    19,455    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\wvchntxx.sys
2008-03-15 16:24 . 2001-08-17 12:11    16,970    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\xem336n5.sys
2008-03-15 16:24 . 2004-08-03 22:29    12,063    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\wsiintxx.sys
2008-03-15 16:24 . 2004-08-03 23:07    8,832    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\wmiacpi.sys
2008-03-15 16:24 . 2004-08-04 00:56    8,192    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\wshirda.dll
2008-03-15 16:24 . 2001-08-17 22:37    4,608    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\xrxflnch.exe
2008-03-15 16:22 . 2001-08-17 13:28    794,654    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\usr1801.sys
2008-03-15 16:21 . 2001-08-17 22:36    525,568    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\tridxp.dll
2008-03-15 16:20 . 2001-08-17 14:56    315,520    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\trid3d.dll
2008-03-15 16:19 . 2001-08-17 12:18    285,760    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\stlnata.sys
2008-03-15 16:18 . 2004-08-04 05:00    456,704    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\smtpsvc.dll
2008-03-15 16:17 . 2004-08-03 22:41    404,990    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\slntamr.sys
2008-03-15 16:16 . 2001-08-17 22:36    386,560    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\sgiul50.dll
2008-03-15 16:15 . 2001-08-17 22:36    495,616    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\sblfx.dll
2008-03-15 16:14 . 2001-08-17 13:28    899,146    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\r2mdkxga.sys
2008-03-15 16:13 . 2004-08-04 00:56    363,520    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\psisdecd.dll
2008-03-15 16:12 . 2001-08-17 14:05    351,616    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\ovcodek2.sys
2008-03-15 16:11 . 2001-08-17 12:50    198,144    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\nv3.sys
2008-03-15 16:10 . 2004-08-04 00:56    1,737,856    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\mtxparhd.dll
2008-03-15 16:09 . 2004-08-03 22:41    1,309,184    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\mtlstrm.sys
2008-03-15 16:08 . 2001-08-17 13:28    802,683    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\ltsm.sys
2008-03-15 16:07 . 2001-08-17 22:36    242,176    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\kdsusd.dll
2008-03-15 16:06 . 2001-08-17 22:36    372,824    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\iconf32.dll
2008-03-15 16:05 . 2004-08-03 22:41    1,041,536    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\hsfdpsp2.sys
2008-03-15 16:04 . 2001-08-17 13:28    907,456    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\hcf_msft.sys
2008-03-15 16:03 . 2001-08-17 14:56    1,733,120    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\g400d.dll
2008-03-15 16:02 . 2001-08-17 13:28    634,134    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\el656ct5.sys
2008-03-15 16:01 . 2001-08-17 12:14    952,007    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\diwan.sys
2008-03-15 16:00 . 2001-08-17 22:36    419,357    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\dgconfig.dll
2008-03-15 15:59 . 2001-08-17 12:13    980,034    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\cicap.sys
2008-03-15 15:58 . 2004-08-04 00:56    1,888,992    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\ati3duag.dll
2008-03-15 15:57 . 2001-08-17 13:28    762,780    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\3cwmcru.sys
2008-03-15 15:56 . 2004-05-13 00:39    876,653    --a------    C:\WINDOWS\SYSTEM32\DLLCACHE\fp4awel.dll
2008-03-15 15:19 . 2008-03-15 15:19        d--------    C:\Documents and Settings\All Users\Application Data\Ableton
2008-03-15 15:19 . 2008-03-15 21:59        d--------    C:\Documents and Settings\Abraham\Application Data\Ableton
2008-03-12 17:19 . 2008-03-12 17:19        d--------    C:\Documents and Settings\Recording\Application Data\DSound
2008-03-11 22:29 . 2008-03-11 22:29        d--------    C:\Program Files\M-Audio Fast Track USB
2008-03-11 22:29 . 2006-04-04 15:45    2,400,648    --a------    C:\WINDOWS\SYSTEM32\madiousb.dll
2008-03-11 22:29 . 2006-04-04 14:42    186,368    --a------    C:\WINDOWS\SYSTEM32\M-AudioFastTrackControlPanelApplet.cpl
2008-03-11 22:29 . 2006-04-04 14:42    106,112    --a------    C:\WINDOWS\SYSTEM32\DRIVERS\mausbft.sys
2008-03-11 22:29 . 2006-04-04 14:42    99,840    --a------    C:\WINDOWS\SYSTEM32\M-AudioTaskBarIcon.exe
2008-03-11 22:29 . 2006-04-04 14:42    19,456    --a------    C:\WINDOWS\SYSTEM32\mausbasio.dll
2008-03-10 23:56 . 2004-08-31 15:57    30,848    --a------    C:\WINDOWS\SYSTEM32\DRIVERS\MA763010.sys
2008-03-10 21:06 . 2008-03-10 21:07        d--------    C:\Documents and Settings\Recording\Application Data\Cakewalk
2008-03-10 20:52 . 2004-10-20 16:50    85,504    --a------    C:\WINDOWS\SYSTEM32\evolusbn.dll
2008-03-10 20:52 . 2004-10-20 16:50    21,984    --a------    C:\WINDOWS\SYSTEM32\DRIVERS\evolusb.sys
2008-03-10 20:51 . 2008-03-10 23:12        d--------    C:\Program Files\M-Audio Uno
2008-03-09 01:04 . 2008-03-09 01:04        d--------    C:\Documents and Settings\Recording\Application Data\Apple Computer
2008-03-05 19:45 . 2008-03-05 19:45        d--h-----    C:\Documents and Settings\Recording\Application Data\GTek
2008-03-05 19:44 . 2005-01-21 16:36        d--------    C:\Documents and Settings\Recording\Application Data\Sonic
2008-03-05 19:44 . 2005-01-21 16:29        d--------    C:\Documents and Settings\Recording\Application Data\Jasc Software Inc
2008-03-05 18:54 . 2008-03-05 18:54    230    --a------    C:\WINDOWS\SYSTEM32\spupdsvc.inf
2008-03-05 18:35 . 2008-03-05 18:35        d--------    C:\Documents and Settings\Abraham\Application Data\DSound
2008-02-19 22:47 . 2008-02-19 22:47    4,208    --a------    C:\untitled.wav
2008-02-18 20:33 . 2008-03-12 20:54        d--------    C:\Documents and Settings\Abraham\Application Data\Digidesign

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-17 02:33    ---------    d-----w    C:\Program Files\LimeWire
2008-03-17 02:32    ---------    d-----w    C:\Program Files\BitComet
2008-03-12 04:29    ---------    d-----w    C:\Program Files\M-Audio
2008-03-11 02:52    ---------    d--h--w    C:\Program Files\InstallShield Installation Information
2008-03-09 06:58    11,102    -c--a-w    C:\Documents and Settings\Abraham\Application Data\wklnhst.dat
2008-03-09 06:58    ---------    d-----w    C:\Program Files\iTunes
2008-03-06 02:02    ---------    d-----w    C:\Program Files\Total Video Converter
2008-03-06 01:42    ---------    d-----w    C:\Program Files\Incomplete
2008-03-06 01:31    ---------    d-----w    C:\Program Files\Acoustica Shared Effects
2008-03-06 01:31    ---------    d-----w    C:\Program Files\Acoustica Beatcraft
2008-02-17 22:36    ---------    d-----w    C:\Program Files\Common Files\PACE Anti-Piracy
2008-02-17 22:36    ---------    d-----w    C:\Documents and Settings\All Users\Application Data\PACE Anti-Piracy
2008-02-17 22:36    ---------    d-----w    C:\Documents and Settings\Abraham\Application Data\PACE Anti-Piracy
2008-02-17 22:03    ---------    d-----w    C:\Program Files\Vstplugins
2008-02-17 22:03    ---------    d-----w    C:\Program Files\DSound
2008-02-17 22:03    ---------    d-----w    C:\Program Files\ASIO
2008-02-17 21:39    ---------    d-----w    C:\Program Files\Music Coach
2008-02-17 19:33    ---------    d-----w    C:\Program Files\InterLok
2008-02-17 19:33    ---------    d-----w    C:\Program Files\Digidesign
2008-02-17 19:31    ---------    d-----w    C:\Program Files\Common Files\Digidesign
2008-02-17 19:30    ---------    d-----w    C:\Documents and Settings\Abraham\Application Data\InstallShield
2008-02-17 19:11    ---------    d-----w    C:\Program Files\Ableton
2008-02-12 02:01    ---------    d-----w    C:\Documents and Settings\All Users\Application Data\SupportSoft
2008-02-12 01:58    ---------    d-----w    C:\Program Files\Dell Support Center
2008-02-12 01:57    ---------    d-----w    C:\Program Files\Common Files\supportsoft
2008-02-12 01:52    ---------    d-----w    C:\Documents and Settings\All Users\Application Data\Dell
2008-01-21 16:56    ---------    d-----w    C:\Program Files\Microsoft Games
2008-01-21 16:46    ---------    d-----w    C:\Program Files\Rockstar Games
2007-02-03 07:11    9,932    -csh--w    C:\Program Files\Folder.jpg
2007-02-03 07:11    9,932    -csh--w    C:\Program Files\AlbumArt_{06F8645A-277E-4FDA-B3D8-230C656490EA}_Large.jpg
2007-02-03 07:11    2,542    -csh--w    C:\Program Files\AlbumArtSmall.jpg
2007-02-03 07:11    2,542    -csh--w    C:\Program Files\AlbumArt_{06F8645A-277E-4FDA-B3D8-230C656490EA}_Small.jpg
2007-01-25 02:43    70,120    -c--a-w    C:\Documents and Settings\Abraham\Application Data\GDIPFONTCACHEV1.DAT
2005-02-27 23:40    154    -c--a-w    C:\Documents and Settings\Angelica\Application Data\wklnhst.dat
2005-12-09 04:38    56    -csh--r    C:\WINDOWS\SYSTEM32\92807604D0.sys
.

(((((((((((((((((((((((((((((   snapshot@2008-03-17_16.05.13.34   )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-03-18 00:36:33    16,384    ----atw    C:\WINDOWS\Temp\Perflib_Perfdata_30c.dat
+ 2008-03-18 00:37:44    16,384    ----atw    C:\WINDOWS\Temp\Perflib_Perfdata_658.dat
.

4 Apprentice

 • 

20.5K Posts

March 18th, 2008 00:00

Limewire and BitComet are showing up because you uninstalled them and made changes to the system by uninstalling them.

Please launch Hijackthis and place a checkmark next to this:

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)

Close all other windows and click "Fix Checked". Close Hijackthis.

Run Disk Cleanup in each user's profile:
Click "Start > Programs > Accessories > System Tools > Disk Cleanup"
Please make sure only the following are checked:
-- Downloaded Program Files
-- Temporary Internet Files
-- Recycle Bin
-- Temporary Files
Click "OK" and Disk Cleanup will delete those files for you.

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. It is possible that you may be running Java code in your applications that absolutely require a specific version of the JRE to run. Please follow these steps to remove older version Java components and update.

Updating Java:

  • Download the latest version of Java Runtime Environment (JRE) 6.
  • Scroll down to where it says "Java Runtime Environment (JRE) 6u5 allows end-users to run Java applications".
  • Click the "Download" button to the right.
  • Check the box that says: "Accept License Agreement".
  • The page will refresh.
  • Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
  • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each of the Java versions.

  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u5-windows-i586-p.exe to install the newest version.

Official JAVA Installation Instructions if needed.



If you do not know what this is?
C:\Program Files\Common Files\{A04ABEFE-0AE9-1033-1108-040416200001}\ Update.exe" mc-110-12-0000272

Please have it scanned at VirusTotal as you did with the other file. Please post the report along with a fresh HijackThis log.
No Events found!

Top