Meanwhile............[RESOLVED]

Lurch987 · September 18, 2008

I've been posting logs to fix my friends computer, but in the mean time my own computer got infected.

I did some scans but it didn't get every thing. Getting pop ups.

Here's the hjt:

Logfile of HijackThis v1.99.1

Scan saved at 11:58:49 PM, on 9/17/2008

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16705)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\system32\CTsvcCDA.exe

C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe

C:\PROGRA~1\AVG\AVG8\avgrsx.exe

C:\Program Files\CyberLink\Shared Files\RichVideo.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\SearchIndexer.exe

C:\PROGRA~1\AVG\AVG8\avgemc.exe

C:\WINDOWS\system32\wscntfy.exe

C:\windows\system\hpsysdrv.exe

C:\HP\KBD\KBD.EXE

C:\PROGRA~1\LEXMAR~1\ACMonitor_X84-X85.exe

C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe

C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

C:\PROGRA~1\AVG\AVG8\avgtray.exe

C:\WINDOWS\V0350Mon.exe

C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe

C:\WINDOWS\system32\rundll32.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe

C:\Program Files\SpywareGuard\sgmain.exe

C:\Program Files\SpywareGuard\sgbhp.exe

C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nbc.ca/

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll

O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe

O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE

O4 - HKLM\..\Run: [WCOLOREAL] "C:\Program Files\COMPAQ\Coloreal\coloreal.exe"

O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE

O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe

O4 - HKLM\..\Run: [Lexmark X84-X85 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X84-X85.exe

O4 - HKLM\..\Run: [Lexmark X84-X85 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X84-X85.exe

O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [securDisc] C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe

O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"

O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe

O4 - HKLM\..\Run: [V0350Mon.exe] C:\WINDOWS\V0350Mon.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"

O4 - HKLM\..\Run: [\YUR27.exe] C:\Windows\system32\YUR27.exe

O4 - HKLM\..\Run: [\YUR28.exe] C:\Windows\system32\YUR28.exe

O4 - HKLM\..\Run: [\YUR29.exe] C:\Windows\system32\YUR29.exe

O4 - HKLM\..\Run: [\YUR76.exe] C:\Windows\system32\YUR76.exe

O4 - HKLM\..\Run: [\YUR1.exe] C:\Windows\system32\YUR1.exe

O4 - HKLM\..\Run: [\YUR2.exe] C:\Windows\system32\YUR2.exe

O4 - HKLM\..\Run: [\YUR3.exe] C:\Windows\system32\YUR3.exe

O4 - HKLM\..\Run: [\YUR4.exe] C:\Windows\system32\YUR4.exe

O4 - HKLM\..\Run: [306342cb] rundll32.exe "C:\WINDOWS\system32\wqegmtbd.dll",b

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Creative Live! Cam Manager] "C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe"

O4 - HKCU\..\Run: [\YUR27.exe] C:\Windows\system32\YUR27.exe

O4 - HKCU\..\Run: [\YUR28.exe] C:\Windows\system32\YUR28.exe

O4 - HKCU\..\Run: [\YUR29.exe] C:\Windows\system32\YUR29.exe

O4 - HKCU\..\Run: [\YUR76.exe] C:\Windows\system32\YUR76.exe

O4 - HKCU\..\Run: [\YUR1.exe] C:\Windows\system32\YUR1.exe

O4 - HKCU\..\Run: [\YUR2.exe] C:\Windows\system32\YUR2.exe

O4 - HKCU\..\Run: [\YUR3.exe] C:\Windows\system32\YUR3.exe

O4 - HKCU\..\Run: [\YUR4.exe] C:\Windows\system32\YUR4.exe

O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Owner\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll

O11 - Options group: [iNTERNATIONAL] International*

O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/dow...llerControl.cab

O16 - DPF: RaptisoftGameLoader - http://www.arcadetown.com/swf/hamsterball/...tgameloader.cab

O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/Facebo...toUploader5.cab

O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://pcpitstop.com/pcpitstop/PCPitStop.CAB

O16 - DPF: {17D667BA-5675-4AAB-9221-08B9379384D4} (Image Uploader Control) - http://cdnimg.piczo.com/images/uploader/pi...st_uploader.cab

O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab

O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photos.walmart.com/WalmartActivia.cab

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab

O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-CA/a-UNO1/GAME_UNO1.cab

O16 - DPF: {639658F3-B141-4D6B-B936-226F75A5EAC3} (CPlayFirstDinerDash2Control Object) - http://www.shockwave.com/content/dinerdash...h2.1.0.0.67.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1171635541706

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1171647865140

O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.photolab.ca/Upload/ImageUploader4.cab

O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab

O16 - DPF: {BAE1D8DF-0B35-47E3-A1E7-EEB3FF2ECD19} (CPlayFirstddfotgControl Object) -

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O16 - DPF: {CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0_01) -

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O16 - DPF: {DA758BB1-5F89-4465-975F-8D7179A4BCF3} (WheelofFortune Object) - http://messenger.zone.msn.com/binary/WoF.cab57176.cab

O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.shockwave.com/content/bookworma...ader_v10_en.cab

O16 - DPF: {F137B9BA-89EA-4B04-9C67-2074A9DF61FD} (Photo Upload Plugin Class) - http://walmart.pnimedia.com/upload/activex...upv2.0.0.10.cab?

O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupdate/su2...15105/CTPID.cab

O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

O20 - AppInit_DLLs: avgrsstx.dll xppqrf.dll

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - c:\program files\a-squared free\a2service.exe

O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe

O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe

O23 - Service: Content Monitoring Tool (msCMTSrvc) - Unknown owner - C:\WINDOWS\system32\msCMTSrvc.exe (file missing)

O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

Andro1d · September 18, 2008

Hello and Welcome to the forums.

I am MoNsTeReNeRgY22 and I will be assisting you with your malware problem today.

Please download this file - combofix.exe by sUBs

Save it to your Desktop
Please, never rename Combofix unless instructed.
Now physically disconnect from the internet and STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields)
Click on your START button and choose Run. Then copy/paste the entire content of the following quotebox (Including the "" marks and the Symbols) into the run box.
"%userprofile%\desktop\ComboFix.exe" /KillAll
Click OK and this will start ComboFix in a special way.
When finished, it will produce a log. Please save that log to a Notepad File to post in your next reply along with a fresh HJT log.

Note:

Do not mouse-click combofix's window while it is running. That may cause it to stall.

* After you have saved the logs, restart your system to re-enable all the programs that were disabled during the running of ComboFix.

* Reconnect to the internet

* Post the following logs/Reports:

ComboFix.txt
Fresh HijackThis log run after all the other tools have performed their cleanup.

Lurch987 · September 19, 2008

Ran Combofix and it rebooted my computer.

Now it's stuck on the blue shutdown screen.

Andro1d · September 19, 2008

Hi,

Please manually turn off your PC by holding the power button.

Wait 5 minutes and turn it back on.

Then please post the CF log from C:\ComboFix.txt

Lurch987 · September 19, 2008

Here's the ComboFix log

ComboFix 08-09-16.05 - Owner 2008-09-18 19:27:01.1 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.179 [GMT -4:00]

Running from: C:\Documents and Settings\Owner\desktop\ComboFix.exe

Command switches used :: /KillAll

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\Program Files\PCHealthCenter\0.exe

C:\Program Files\PCHealthCenter\2.gif

C:\Program Files\PCHealthCenter\3.gif

C:\Program Files\PCHealthCenter\sc.html

C:\WINDOWS\system32\actskn43.ocx

C:\WINDOWS\system32\buhdkcfe.ini

C:\WINDOWS\system32\dbtmgeqw.ini

C:\WINDOWS\system32\mcrh.tmp

C:\WINDOWS\system32\MSINET.oca

C:\WINDOWS\system32\uryslccw.ini

C:\WINDOWS\system32\vcyajtyo.dll

C:\WINDOWS\system32\vyslas.dll

C:\WINDOWS\system32\wDeeKkkj.ini

C:\WINDOWS\system32\wDeeKkkj.ini2

C:\x

D:\Autorun.inf

.

((((((((((((((((((((((((( Files Created from 2008-08-19 to 2008-09-19 )))))))))))))))))))))))))))))))

.

2100-02-16 16:09 . 2001-02-16 15:37 62 --a------ C:\WINDOWS\system32\LXBOUSCI.INI

2008-09-18 06:25 . 2008-09-18 06:24 137,344 --a------ C:\WINDOWS\system32\tcvdhd.dll

2008-09-18 06:24 . 2008-09-18 06:24 137,344 --a------ C:\WINDOWS\system32\rvfduvbf.dll

2008-09-17 01:40 . 2008-09-17 01:40 136,832 --a------ C:\WINDOWS\system32\bcamtryd.dll

2008-09-16 15:26 . 2008-09-16 15:26 328,448 --a------ C:\WINDOWS\system32\jkkKeeDw.dll

2008-09-16 15:16 . 2008-09-18 20:33 <DIR> d-------- C:\Program Files\PCHealthCenter

2008-09-08 08:23 . 2008-09-08 08:23 <DIR> d-------- C:\Program Files\HGTV Landscapes Screensaver

2008-09-05 07:57 . 2008-09-05 07:57 <DIR> d-------- C:\Live! Cam

2008-09-01 20:47 . 2008-09-01 20:48 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\muvee Technologies

2008-09-01 20:41 . 2008-09-01 20:43 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Creative

2008-09-01 20:34 . 2003-06-12 23:25 7,062 --a------ C:\WINDOWS\system32\audiopid.vxd

2008-09-01 20:32 . 2007-06-14 09:52 90,112 --a------ C:\WINDOWS\CtDrvIns.exe

2008-09-01 20:32 . 2007-03-02 14:30 670 -ra------ C:\WINDOWS\CtDrvIns.exe.manifest

2008-09-01 20:31 . 2008-04-13 20:12 53,760 --a------ C:\WINDOWS\system32\vfwwdm32.dll

2008-09-01 20:31 . 2008-04-13 20:12 53,760 --a--c--- C:\WINDOWS\system32\dllcache\vfwwdm32.dll

2008-09-01 20:31 . 2005-07-07 01:07 36,864 --a------ C:\WINDOWS\system32\CtCamMgr.dll

2008-09-01 20:31 . 2007-03-28 01:01 20,480 --a------ C:\WINDOWS\system32\V0350Srv.exe

2008-09-01 20:30 . 2006-08-30 07:10 158,456 --------- C:\WINDOWS\system32\pxwma.dll

2008-09-01 20:30 . 2006-08-30 07:10 36,528 --------- C:\WINDOWS\system32\drivers\PxHelp20.sys

2008-09-01 20:30 . 2006-08-30 07:10 2,560 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys

2008-09-01 20:30 . 2006-08-30 07:10 2,432 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys

2008-09-01 20:29 . 2008-09-01 20:29 <DIR> d-------- C:\Program Files\muvee Technologies

2008-09-01 20:29 . 2008-09-01 20:29 <DIR> d-------- C:\Program Files\Common Files\muvee Technologies

2008-09-01 20:28 . 2008-09-01 20:28 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\muvee Technologies

2008-09-01 20:28 . 2008-04-13 14:45 60,032 --a------ C:\WINDOWS\system32\drivers\USBAUDIO.sys

2008-09-01 20:28 . 2008-04-13 14:45 60,032 --a--c--- C:\WINDOWS\system32\dllcache\usbaudio.sys

2008-09-01 20:27 . 2008-04-13 14:45 32,128 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys

2008-09-01 20:27 . 2008-04-13 14:45 32,128 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys

2008-09-01 20:26 . 2008-09-01 20:26 <DIR> d-------- C:\Program Files\SightSpeed

2008-09-01 20:21 . 2006-08-29 04:11 1,047,552 --------- C:\WINDOWS\system32\MFC71u.dll

2008-08-27 13:10 . 2008-08-27 13:10 244 --ah----- C:\sqmnoopt04.sqm

2008-08-27 13:10 . 2008-08-27 13:10 232 --ah----- C:\sqmdata04.sqm

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-09-18 23:18 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP

2008-09-16 22:02 --------- d-----w C:\Program Files\SpywareBlaster

2008-09-16 12:30 --------- d-----w C:\Program Files\a-squared Free

2008-09-10 12:42 --------- d-----w C:\Documents and Settings\Owner\Application Data\LimeWire

2008-09-08 14:58 --------- d--h--w C:\Program Files\InstallShield Installation Information

2008-09-07 16:24 --------- d-----w C:\Documents and Settings\Owner\Application Data\Apple Computer

2008-09-07 11:08 --------- d-----w C:\Program Files\Apple Software Update

2008-09-05 12:01 --------- d-----w C:\Program Files\Creative

2008-09-02 00:43 --------- d-----w C:\Documents and Settings\Owner\Application Data\Creative

2008-08-29 23:51 --------- d-----w C:\Program Files\Spybot - Search & Destroy

2008-08-29 19:57 97,928 ----a-w C:\WINDOWS\system32\drivers\avgldx86.sys

2008-08-21 08:52 3,299,840 ----a-w C:\WINDOWS\system32\drivers\ati2mtag.sys

2008-08-21 05:17 53,248 ----a-w C:\WINDOWS\system32\drivers\ati2erec.dll

2008-08-19 07:01 --------- d-----w C:\Program Files\Microsoft Silverlight

2008-08-15 04:22 --------- d-----w C:\Documents and Settings\Owner\Application Data\Windows Search

2008-08-15 02:36 --------- d-----w C:\Documents and Settings\Owner\Application Data\Windows Desktop Search

2008-08-15 02:35 --------- d-----w C:\Program Files\Windows Desktop Search

2008-08-12 00:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy

2008-08-06 13:11 --------- d-----w C:\Program Files\Java

2007-06-11 22:15 50 --sh--r C:\Program Files\Common Files\desSktop.ini

2007-01-16 03:07 299 ----a-w C:\Documents and Settings\Owner\Application Data\internaldb1942.dat

2006-06-03 00:17 167,064 ----a-w C:\Program Files\custom.dat

2006-06-03 00:17 0 -c--a-w C:\Program Files\landgen.log

2006-06-02 23:50 0 -c--a-w C:\Program Files\rew2.log

2006-02-07 22:15 774,144 ----a-w C:\Program Files\RngInterstitial.dll

2005-02-05 22:51 1,638 ----a-w C:\Program Files\INSTALL.LOG

2005-01-25 14:05 512,103 ----a-w C:\Program Files\StarterSetup.exe

2004-10-27 21:43 249,608 ----a-w C:\Program Files\Uninst.isu

1999-05-26 16:23 70,541 -c--a-w C:\Program Files\readme.rtf

1999-05-26 16:23 3,265,024 ----a-w C:\Program Files\wa.exe

1999-04-26 18:29 83,456 ------r C:\Program Files\DirectX2D.dll

1999-04-26 18:28 240,128 ------r C:\Program Files\DXMfc.dll

1999-04-26 18:28 10,240 ------r C:\Program Files\DirectSound.dll

1999-03-31 17:00 2,257,920 ------w C:\Program Files\HSBRCiv.exe

1999-03-29 17:48 34,304 ------r C:\Program Files\lfbmp10N.dll

1999-03-29 17:48 31,744 ------r C:\Program Files\lflmb10N.dll

1999-03-29 17:48 297,984 ------r C:\Program Files\ltkrn10N.dll

1999-03-29 17:48 27,648 ------r C:\Program Files\lftga10N.dll

1999-03-29 17:48 269,312 ------r C:\Program Files\LFCMP10N.DLL

1999-03-29 17:48 105,472 ------r C:\Program Files\ltfil10N.DLL

1999-01-09 16:42 132,608 ------r C:\Program Files\Landgen.exe

1998-12-23 14:06 9,304 ------r C:\Program Files\thm01309.dat

1998-12-23 14:06 9,304 ------r C:\Program Files\thm01308.dat

1998-12-23 14:06 9,304 ------r C:\Program Files\thm01307.dat

1998-12-23 14:06 9,304 ------r C:\Program Files\thm01306.dat

1998-12-23 14:06 9,304 ------r C:\Program Files\thm01305.dat

1998-12-23 14:06 9,304 ------r C:\Program Files\thm01304.dat

1998-12-23 14:06 9,304 ------r C:\Program Files\thm01303.dat

1998-12-23 14:06 9,304 ------r C:\Program Files\thm01302.dat

1998-05-12 00:01 954,128 ------r C:\Program Files\MFC42.DLL

1998-05-12 00:01 280,576 ------r C:\Program Files\MSVCRT.DLL

2008-06-14 07:09 16,384 --sha-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat

2008-06-14 07:09 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat

2008-06-14 07:08 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008061420080615\index.dat

2008-06-14 07:09 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3ab3a1ea-08b8-4537-9be4-75014d32fe81}]

2008-09-18 06:24 137344 --a------ C:\WINDOWS\system32\tcvdhd.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{71DAD6B9-06A8-4F66-A93F-ACBACC67B651}]

2008-09-16 15:26 328448 --a------ C:\WINDOWS\system32\jkkKeeDw.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 15360]

"Creative Live! Cam Manager"="C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe" [2007-06-07 155648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]

"KBD"="C:\HP\KBD\KBD.EXE" [2001-07-07 61440]

"WCOLOREAL"="C:\Program Files\COMPAQ\Coloreal\coloreal.exe" [2002-02-20 143360]

"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2002-09-14 212992]

"PS2"="C:\WINDOWS\system32\ps2.exe" [2002-08-01 81920]

"Lexmark X84-X85 Button Monitor"="C:\PROGRA~1\LEXMAR~1\ACMonitor_X84-X85.exe" [2003-01-08 40960]

"Lexmark X84-X85 Button Manager"="C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X84-X85.exe" [2002-09-04 53248]

"PrinTray"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe" [2002-09-18 36864]

"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]

"SecurDisc"="C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe" [2007-05-15 1628208]

"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2006-11-23 56928]

"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-08-29 1235736]

"V0350Mon.exe"="C:\WINDOWS\V0350Mon.exe" [2007-08-23 28672]

"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]

C:\Documents and Settings\Owner\Start Menu\Programs\Startup\

SpywareGuard.lnk - C:\Program Files\SpywareGuard\sgmain.exe [2003-08-29 360448]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=avgrsstx.dll xppqrf.dll tcvdhd.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"C:\\WINDOWS\\system32\\rtcshare.exe"=

"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"C:\\Program Files\\LimeWire\\LimeWire.exe"=

"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

"C:\\Program Files\\SightSpeed\\SightSpeed.exe"=

R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-08-29 97928]

R2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-08-29 875288]

R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-08-29 231704]

R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-07-04 76040]

R3 VF0350Afx;VF0350 Audio FX;C:\WINDOWS\system32\Drivers\V0350Afx.sys [2007-06-11 142656]

R3 VF0350Vfx;VF0350 Video FX;C:\WINDOWS\system32\DRIVERS\V0350VFx.sys [2007-03-05 7424]

R3 VF0350Vid;Live! Cam Video Chat (VF0350);C:\WINDOWS\system32\DRIVERS\V0350Vid.sys [2007-08-29 170368]

S3 gkmixern;gkmixern;C:\DOCUME~1\Owner\LOCALS~1\Temp\gkmixern.sys [ ]

S3 msCMTSrvc;Content Monitoring Tool;C:\WINDOWS\system32\msCMTSrvc.exe [ ]

S3 PCDRDRV;Pcdr Helper Driver;C:\PROGRA~1\PC-DOC~1\DIAGNO~1\PCDRDRV.sys [ ]

.

Contents of the 'Scheduled Tasks' folder

.

- - - - ORPHANS REMOVED - - - -

BHO-{ADFD5FD2-2DD2-4572-80DA-C74F1193FBA1} - C:\WINDOWS\system32\ljJDtqrp.dll

WebBrowser-{6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - (no file)

HKCU-Run-\YUR27.exe - C:\Windows\system32\YUR27.exe

HKCU-Run-\YUR28.exe - C:\Windows\system32\YUR28.exe

HKCU-Run-\YUR29.exe - C:\Windows\system32\YUR29.exe

HKCU-Run-\YUR76.exe - C:\Windows\system32\YUR76.exe

HKCU-Run-\YUR1.exe - C:\Windows\system32\YUR1.exe

HKCU-Run-\YUR2.exe - C:\Windows\system32\YUR2.exe

HKCU-Run-\YUR3.exe - C:\Windows\system32\YUR3.exe

HKCU-Run-\YUR4.exe - C:\Windows\system32\YUR4.exe

HKLM-Run-\YUR27.exe - C:\Windows\system32\YUR27.exe

HKLM-Run-\YUR28.exe - C:\Windows\system32\YUR28.exe

HKLM-Run-\YUR29.exe - C:\Windows\system32\YUR29.exe

HKLM-Run-\YUR76.exe - C:\Windows\system32\YUR76.exe

HKLM-Run-\YUR1.exe - C:\Windows\system32\YUR1.exe

HKLM-Run-\YUR2.exe - C:\Windows\system32\YUR2.exe

HKLM-Run-\YUR3.exe - C:\Windows\system32\YUR3.exe

HKLM-Run-\YUR4.exe - C:\Windows\system32\YUR4.exe

HKLM-Run-306342cb - C:\WINDOWS\system32\wcclsyru.dll

ShellExecuteHooks-{ADFD5FD2-2DD2-4572-80DA-C74F1193FBA1} - C:\WINDOWS\system32\ljJDtqrp.dll

Notify-ljJDtqrp - ljJDtqrp.dll

.

------- Supplementary Scan -------

.

FireFox -: Profile - C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\l94vc8cl.default\

FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.facebook.com/home.php?

FF -: plugin - C:\Program Files\Viewpoint\Viewpoint Media Player\npViewpoint.dll

.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-09-18 20:35:32

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

------------------------ Other Running Processes ------------------------

.

C:\WINDOWS\system32\ati2evxx.exe

C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\AVG\AVG8\avgrsx.exe

C:\WINDOWS\system32\CTSVCCDA.EXE

C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe

C:\Program Files\CyberLink\Shared Files\RichVideo.exe

C:\WINDOWS\system32\fxssvc.exe

C:\Program Files\SpywareGuard\sgbhp.exe

C:\Program Files\AVG\AVG8\avgrsx.exe

.

**************************************************************************

.

Completion time: 2008-09-18 20:58:02 - machine was rebooted

ComboFix-quarantined-files.txt 2008-09-19 00:57:42

Pre-Run: 7,706,095,616 bytes free

Post-Run: 7,741,399,040 bytes free

238 --- E O F --- 2008-09-10 07:07:00

Lurch987 · September 19, 2008

Here's a new HJT log

Logfile of HijackThis v1.99.1

Scan saved at 21:09, on 2008-09-18

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16705)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

C:\WINDOWS\system32\spoolsv.exe

C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\system32\CTsvcCDA.exe

C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe

C:\Program Files\CyberLink\Shared Files\RichVideo.exe

C:\WINDOWS\System32\svchost.exe

C:\PROGRA~1\AVG\AVG8\avgemc.exe

C:\windows\system\hpsysdrv.exe

C:\HP\KBD\KBD.EXE

C:\WINDOWS\system32\fxssvc.exe

C:\PROGRA~1\LEXMAR~1\ACMonitor_X84-X85.exe

C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe

C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

C:\PROGRA~1\AVG\AVG8\avgtray.exe

C:\WINDOWS\V0350Mon.exe

C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe

C:\Program Files\SpywareGuard\sgmain.exe

C:\Program Files\SpywareGuard\sgbhp.exe

C:\Program Files\AVG\AVG8\avgrsx.exe

C:\WINDOWS\system32\rundll32.exe

C:\WINDOWS\explorer.exe

C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nbc.ca/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896