32 replies to this topic

[seven stars]

Hi,

First, great work with this forum! I have a stubborn Vundo infection that pops up every time I run mbam. Other problems that might be worth mentioning:

* Yesterday mbam spotted 'Rootkit.ADS'. I think it's been removed though.

* I seem to have some remnants of 'AntiVirus XP 2008' as well. There are icons in my Start menu, although there are only placeholder graphics instead of proper icons, if you know what I mean. I don't think it's a real problem though.

I'd really appreciate any help that comes my way. I've run mbam and HJT (as requested in the sticky thread), so here goes...

Thanks,
Sean

__________________________________________________________________________

***HJT***

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:41:24, on 19/01/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\NetWaiting\netWaiting.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Java\jre1.5.0_11\bin\jucheck.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ie/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.euro.dell.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [nogewajufu] Rundll32.exe "C:\WINDOWS\system32\hapejulu.dll",s
O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netWaiting.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [nogewajufu] Rundll32.exe "C:\WINDOWS\system32\lutazipu.dll",s (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1C11B948-582A-433F-A98D-A8C4D5CC64F2} (20-20 Technologies 3D Room Planner) - http://magnet.2020.net/virtualplanner/Core...yerAX_Win32.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{046D27A9-134B-4AE0-9CEF-1CCD7FF3B79A}: NameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{046D27A9-134B-4AE0-9CEF-1CCD7FF3B79A}: NameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{046D27A9-134B-4AE0-9CEF-1CCD7FF3B79A}: NameServer = 192.168.1.1
O20 - AppInit_DLLs: c:\windows\system32\kefuzego.dll , c:\windows\system32\rapepute.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Intel® PROSet/Wireless SSO Service (WLANKEEPER) - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

--
End of file - 10119 bytes

__________________________________________________________________________
***MBAM***

Malwarebytes' Anti-Malware 1.33
Database version: 1666
Windows 5.1.2600 Service Pack 3

19/01/2009 21:35:24
mbam-log-2009-01-19 (21-35-24).txt

Scan type: Quick Scan
Objects scanned: 54687
Time elapsed: 4 minute(s), 24 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nogewajufu (Trojan.Vundo.H) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

[Tigger93]

Hi.

While TeaTimer is an excellent tool for the prevention of spyware, it can sometimes prevent HijackThis from fixing certain things.
Please disable TeaTimer for now until you are clean. TeaTimer can be re-activated once your HijackThis log is clean.

• Open Spybot Search & Destroy.
  
• In the Mode menu click "Advanced mode" if not already selected.
  
• Choose "Yes" at the Warning prompt.
  
• Expand the "Tools" menu.
  
• Click "Resident".
  
• Uncheck the "Resident "TeaTimer" (Protection of overall system settings) active." box.
  
• In the File menu click "Exit" to exit Spybot Search & Destroy.

---------------------------

Open HijackThis and put a check next to these:
O4 - HKLM\..\Run: [nogewajufu] Rundll32.exe "C:\WINDOWS\system32\hapejulu.dll",s
O4 - HKUS\S-1-5-19\..\Run: [nogewajufu] Rundll32.exe "C:\WINDOWS\system32\lutazipu.dll",s (User 'LOCAL SERVICE')

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

O20 - AppInit_DLLs: c:\windows\system32\kefuzego.dll , c:\windows\system32\rapepute.dll

Click Fix Checked and close HJT.

---------------------------

download OTScanIt2.exe to your Desktop and double-click on it to extract the files. It will create a folder named OTScanIt2 on your desktop.

Note: You must be logged on to the system with an account that has Administrator privileges to run this program.

• Close ALL OTHER PROGRAMS.
  
• Open the OTScanIt2 folder and double-click on OTScanIt2.exe to start the program (if you are running on Vista then right-click the program and choose Run as Administrator).
  
• Click the Scan All Users checkbox on the toolbar.
  
• Do not change any other settings.
  
• Now click the Run Scan button on the toolbar.
  
• Let it run unhindered until it finishes.
  
• When the scan is complete Notepad will open with the report file loaded in it.
  
• Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.
  
• Close Notepad (saving the change if necessry).

Use the Add Reply button and Attach the scan back here (do not copy/paste it as it will be too big to fit into the post). It will be located in the OTScanIt2 folder and named OTScanIt.txt.

I will review it when it comes in.

[seven stars]

Tigger, yer a star - thanks a million. I've attached the text file.

cheers,
Sean

Attached Files

•  OTScanIt.Txt   131.12K   60 downloads

[Tigger93]

Paste this into the fix box (where it says paste fix here):

[Kill Explorer]
[Registry - Safe List]
< Internet Explorer Extensions [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\
YN -> CmdMapping\\"{39FD89BF-D3F1-45b6-BB56-3582CCF489E1}" [HKLM] -> [Reg Error: Key does not exist or could not be opened.]
YN -> CmdMapping\\"{CD67F990-D8E9-11d2-98FE-00C0F0318AFE}" [HKLM] -> [Reg Error: Key does not exist or could not be opened.]
< Standard Profile Authorized Applications List > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
YN -> "C:\WINDOWS\system32\drivers\svchost.exe" -> C:\WINDOWS\system32\drivers\svchost.exe [C:\WINDOWS\system32\drivers\svchost.exe:*:Disabled:svchost]
[Files/Folders - Created Within 30 Days]
NY -> dds.scr -> %UserProfile%\Desktop\dds.scr
NY -> dds.com -> %UserProfile%\Desktop\dds.com
[Files/Folders - Modified Within 30 Days]
NY -> 2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp
NY -> 1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp
NY -> 13 C:\Documents and Settings\Seanie\Local Settings\Temp\*.tmp files -> C:\Documents and Settings\Seanie\Local Settings\Temp\*.tmp
NY -> SSUPDATE.EXE -> %UserProfile%\Local Settings\Temp\SSUPDATE.EXE
NY -> vqmzrt.exe -> %UserProfile%\Local Settings\Temp\vqmzrt.exe
NY -> txdlrf.exe -> %UserProfile%\Local Settings\Temp\txdlrf.exe
[Alternate Data Streams]
NY -> @Alternate Data Stream - 18944 bytes -> %SystemRoot%\explorer.exe:mian.nest.9.10
NY -> @Alternate Data Stream - 288 bytes -> %SystemRoot%\explorer.exe:host.opts.db
NY -> @Alternate Data Stream - 7812 bytes -> %SystemRoot%\explorer.exe:log.dump
NY -> @Alternate Data Stream - 8 bytes -> %SystemRoot%\explorer.exe:extractor6.trg
NY -> @Alternate Data Stream - 896 bytes -> %SystemRoot%\explorer.exe:httpcomm.set
[Purity]
[Empty Temp Folders]
[Start Explorer]

Then run the fix. It will produce a log, please post it here.

Also:

Download Lop S&D < here

Double-click Lop S&D.exe
Choose the language, then choose Option 1 (Search)
Wait till the end of the scan
Post the log which is created: (%SystemDrive%\lopR.txt)

[seven stars]

***OTScanIt2***

Process Explorer.EXE killed successfully!
[Registry - Safe List]
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\\{39FD89BF-D3F1-45b6-BB56-3582CCF489E1} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{39FD89BF-D3F1-45b6-BB56-3582CCF489E1}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\\{CD67F990-D8E9-11d2-98FE-00C0F0318AFE} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CD67F990-D8E9-11d2-98FE-00C0F0318AFE}\ not found.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\WINDOWS\system32\drivers\svchost.exe deleted successfully.
[Files/Folders - Created Within 30 Days]
C:\Documents and Settings\Seanie\Desktop\dds.scr moved successfully.
C:\Documents and Settings\Seanie\Desktop\dds.com moved successfully.
[Files/Folders - Modified Within 30 Days]
C:\Documents and Settings\Seanie\Local Settings\Temp\WMC0000.tmp folder deleted successfully.
C:\Documents and Settings\Seanie\Local Settings\Temp\~nsu.tmp folder deleted successfully.
C:\Documents and Settings\Seanie\Local Settings\Temp\SSUPDATE.EXE moved successfully.
C:\Documents and Settings\Seanie\Local Settings\Temp\vqmzrt.exe moved successfully.
C:\Documents and Settings\Seanie\Local Settings\Temp\txdlrf.exe moved successfully.
[Alternate Data Streams]
ADS C:\WINDOWS\explorer.exe:mian.nest.9.10 deleted successfully.
ADS C:\WINDOWS\explorer.exe:host.opts.db deleted successfully.
ADS C:\WINDOWS\explorer.exe:log.dump deleted successfully.
ADS C:\WINDOWS\explorer.exe:extractor6.trg deleted successfully.
ADS C:\WINDOWS\explorer.exe:httpcomm.set deleted successfully.
[Purity]
Purity scan complete.
[Empty Temp Folders]
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
Windows Temp folder emptied.
Java cache emptied.
FireFox cache emptied.
RecycleBin -> emptied.
Explorer started successfully
< End of fix log >
OTScanIt2 by OldTimer - Version 1.0.6.2 fix logfile created on 01202009_222033

Files moved on Reboot...
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.

Registry entries deleted on Reboot...

________________________________________________________________________
***Lop S&D***


--------------------\\ Lop S&D 4.2.5-0 XP/Vista

Microsoft Windows XP Home Edition ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : Genuine Intel® CPU T2050 @ 1.60GHz )
BIOS : Phoenix ROM BIOS PLUS Version 1.10 A08
USER : Seanie ( Administrator )
BOOT : Normal boot
Antivirus : (Not Activated)
Firewall : (Not Activated)
C:\ (Local Disk) - NTFS - Total:70 Go (Free:3 Go)
D:\ (CD or DVD) - UDF - Total:6 Go (Free:0 Go)
F:\ (Local Disk) - FAT - Total:0 Go (Free:0 Go)

"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
Option : [1] ( 20/01/2009|22:25 )

--------------------\\ Listing folders in APPLIC~1

[23/09/2006|11:42] C:\DOCUME~1\ADMINI~1\APPLIC~1\AOL
[05/12/2008|22:17] C:\DOCUME~1\ADMINI~1\APPLIC~1\AVG7
[14/09/2006|14:24] C:\DOCUME~1\ADMINI~1\APPLIC~1\Corel
[14/09/2006|14:30] C:\DOCUME~1\ADMINI~1\APPLIC~1\Gtek
[10/08/2004|12:08] C:\DOCUME~1\ADMINI~1\APPLIC~1\Identities
[14/09/2006|14:19] C:\DOCUME~1\ADMINI~1\APPLIC~1\Intel
[02/09/2008|21:42] C:\DOCUME~1\ADMINI~1\APPLIC~1\Macromedia
[09/09/2008|20:52] C:\DOCUME~1\ADMINI~1\APPLIC~1\Malwarebytes
[03/09/2008|21:00] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft
[14/09/2006|14:25] C:\DOCUME~1\ADMINI~1\APPLIC~1\You've Got Pictures Screensaver

[23/12/2008|22:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
[11/11/2006|23:01] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
[11/11/2006|23:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe Systems
[23/09/2006|11:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL
[23/12/2008|22:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
[23/12/2008|22:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
[21/02/2007|20:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\avg7
[19/11/2006|19:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\DVD Shrink
[02/01/2007|19:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
[24/09/2006|19:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Grisoft
[14/09/2006|14:30] C:\DOCUME~1\ALLUSE~1\APPLIC~1\GTek
[14/09/2006|14:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield
[14/09/2006|14:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Intel
[05/09/2008|20:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
[14/09/2006|14:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\McAfee
[14/09/2006|14:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\McAfee.com
[24/09/2006|19:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\McAfee.com Personal Firewall
[15/10/2006|19:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[29/10/2006|11:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime
[10/08/2004|12:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBSI
[14/09/2006|14:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sonic
[29/03/2007|20:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sony Ericsson
[05/12/2008|21:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
[05/12/2008|22:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SUPERAntiSpyware.com
[29/03/2007|20:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Teleca
[02/01/2007|19:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage

[23/09/2006|11:42] C:\DOCUME~1\Cora\APPLIC~1\AOL
[17/10/2006|21:12] C:\DOCUME~1\Cora\APPLIC~1\AVG7
[14/09/2006|14:24] C:\DOCUME~1\Cora\APPLIC~1\Corel
[14/09/2006|14:30] C:\DOCUME~1\Cora\APPLIC~1\Gtek
[10/08/2004|12:08] C:\DOCUME~1\Cora\APPLIC~1\Identities
[14/09/2006|14:19] C:\DOCUME~1\Cora\APPLIC~1\Intel
[17/10/2006|21:14] C:\DOCUME~1\Cora\APPLIC~1\Macromedia
[03/09/2008|21:45] C:\DOCUME~1\Cora\APPLIC~1\Microsoft
[14/09/2006|14:25] C:\DOCUME~1\Cora\APPLIC~1\You've Got Pictures Screensaver

[23/09/2006|11:42] C:\DOCUME~1\DEFAUL~1\APPLIC~1\AOL
[14/09/2006|14:24] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Corel
[14/09/2006|14:30] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Gtek
[10/08/2004|12:08] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
[14/09/2006|14:19] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Intel
[14/09/2006|14:17] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
[14/09/2006|14:25] C:\DOCUME~1\DEFAUL~1\APPLIC~1\You've Got Pictures Screensaver

[27/12/2008|08:00] C:\DOCUME~1\LOCALS~1\APPLIC~1\AVG7
[23/09/2006|11:50] C:\DOCUME~1\LOCALS~1\APPLIC~1\McAfee.com Personal Firewall
[10/08/2004|11:57] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

[24/09/2006|19:12] C:\DOCUME~1\NETWOR~1\APPLIC~1\Intel
[10/08/2004|11:57] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

[27/10/2007|18:14] C:\DOCUME~1\Seanie\APPLIC~1\Adobe
[02/10/2006|19:12] C:\DOCUME~1\Seanie\APPLIC~1\AdobeUM
[23/09/2006|11:42] C:\DOCUME~1\Seanie\APPLIC~1\AOL
[17/11/2006|00:19] C:\DOCUME~1\Seanie\APPLIC~1\Apple Computer
[27/10/2008|08:47] C:\DOCUME~1\Seanie\APPLIC~1\Aventail
[17/01/2009|10:58] C:\DOCUME~1\Seanie\APPLIC~1\AVG7
[02/05/2007|22:05] C:\DOCUME~1\Seanie\APPLIC~1\Corel
[06/10/2006|21:53] C:\DOCUME~1\Seanie\APPLIC~1\CyberLink
[01/06/2008|19:40] C:\DOCUME~1\Seanie\APPLIC~1\dvdcss
[17/02/2007|12:36] C:\DOCUME~1\Seanie\APPLIC~1\Google
[14/09/2006|14:30] C:\DOCUME~1\Seanie\APPLIC~1\Gtek
[11/11/2006|11:36] C:\DOCUME~1\Seanie\APPLIC~1\Help
[10/08/2004|12:08] C:\DOCUME~1\Seanie\APPLIC~1\Identities
[14/09/2006|14:19] C:\DOCUME~1\Seanie\APPLIC~1\Intel
[30/09/2006|20:40] C:\DOCUME~1\Seanie\APPLIC~1\Leadertech
[24/09/2006|20:14] C:\DOCUME~1\Seanie\APPLIC~1\Macromedia
[09/09/2008|21:13] C:\DOCUME~1\Seanie\APPLIC~1\Malwarebytes
[23/09/2006|11:26] C:\DOCUME~1\Seanie\APPLIC~1\McAfee.com Personal Firewall
[27/10/2008|08:47] C:\DOCUME~1\Seanie\APPLIC~1\Microsoft
[16/12/2008|22:01] C:\DOCUME~1\Seanie\APPLIC~1\Mozilla
[02/01/2007|19:41] C:\DOCUME~1\Seanie\APPLIC~1\Real
[30/09/2006|20:40] C:\DOCUME~1\Seanie\APPLIC~1\Sonic
[16/10/2006|18:00] C:\DOCUME~1\Seanie\APPLIC~1\Sun
[05/12/2008|22:23] C:\DOCUME~1\Seanie\APPLIC~1\SUPERAntiSpyware.com
[29/03/2007|20:19] C:\DOCUME~1\Seanie\APPLIC~1\Teleca
[31/12/2006|13:47] C:\DOCUME~1\Seanie\APPLIC~1\Template
[10/11/2007|22:40] C:\DOCUME~1\Seanie\APPLIC~1\uTorrent
[29/10/2006|11:46] C:\DOCUME~1\Seanie\APPLIC~1\vlc
[03/02/2008|20:42] C:\DOCUME~1\Seanie\APPLIC~1\Vso
[14/09/2006|14:25] C:\DOCUME~1\Seanie\APPLIC~1\You've Got Pictures Screensaver

--------------------\\ Scheduled Tasks located in C:\WINDOWS\Tasks

[05/01/2009 23:54][--a------] C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[20/01/2009 22:22][--ah-----] C:\WINDOWS\tasks\SA.DAT
[04/08/2004 04:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini

--------------------\\ Listing Folders in C:\Program Files

[11/11/2006|23:01] C:\Program Files\Adobe
[31/12/2006|18:06] C:\Program Files\Ahead
[23/12/2008|22:50] C:\Program Files\Apple Software Update
[23/12/2008|22:52] C:\Program Files\Bonjour
[14/09/2006|14:18] C:\Program Files\Broadcom
[05/12/2008|21:39] C:\Program Files\CCleaner
[23/12/2008|22:50] C:\Program Files\Common Files
[14/09/2006|14:16] C:\Program Files\CONEXANT
[02/05/2007|22:04] C:\Program Files\Corel
[14/09/2006|14:19] C:\Program Files\CyberLink
[23/09/2006|11:44] C:\Program Files\Dell
[14/09/2006|14:30] C:\Program Files\Dell Support
[14/09/2006|14:18] C:\Program Files\Digital Line Detect
[02/01/2007|20:46] C:\Program Files\DivX
[03/02/2008|21:17] C:\Program Files\DVDFab Platinum 3
[15/02/2008|19:13] C:\Program Files\Google
[24/09/2006|19:55] C:\Program Files\Grisoft
[17/02/2007|12:35] C:\Program Files\InstallShield Installation Information
[14/09/2006|14:19] C:\Program Files\Intel
[13/12/2008|17:51] C:\Program Files\Internet Explorer
[23/12/2008|22:52] C:\Program Files\iPod
[23/12/2008|22:53] C:\Program Files\iTunes
[04/04/2007|20:23] C:\Program Files\Java
[02/05/2007|21:51] C:\Program Files\MagicISO
[18/01/2009|22:43] C:\Program Files\Malwarebytes' Anti-Malware
[14/09/2006|14:28] C:\Program Files\McAfee
[15/08/2008|23:33] C:\Program Files\Messenger
[17/02/2007|10:54] C:\Program Files\microsoft frontpage
[17/02/2007|10:55] C:\Program Files\Microsoft Office
[14/09/2006|14:29] C:\Program Files\Microsoft Works
[29/10/2008|12:10] C:\Program Files\Modem Helper
[27/07/2008|21:25] C:\Program Files\Movie Maker
[20/01/2009|22:23] C:\Program Files\Mozilla Firefox
[01/09/2007|23:45] C:\Program Files\MSN
[10/08/2004|12:01] C:\Program Files\MSN Gaming Zone
[17/11/2006|00:51] C:\Program Files\MSXML 4.0
[27/07/2008|21:21] C:\Program Files\NetMeeting
[14/09/2006|14:18] C:\Program Files\NetWaiting
[10/08/2004|12:01] C:\Program Files\Online Services
[27/07/2008|21:21] C:\Program Files\Outlook Express
[20/10/2007|22:14] C:\Program Files\PartyGaming
[23/12/2008|22:52] C:\Program Files\QuickTime
[27/12/2006|18:54] C:\Program Files\Real
[02/09/2008|21:36] C:\Program Files\RogueRemover FREE
[14/09/2006|14:16] C:\Program Files\Sigmatel
[14/09/2006|14:21] C:\Program Files\Sonic
[04/05/2007|22:41] C:\Program Files\Sony Ericsson
[18/01/2009|22:26] C:\Program Files\Sophos
[04/12/2008|22:22] C:\Program Files\Spybot - Search & Destroy
[10/12/2008|22:07] C:\Program Files\SUPERAntiSpyware
[14/09/2006|14:17] C:\Program Files\Synaptics
[14/09/2006|14:21] C:\Program Files\Tiscali
[19/01/2009|21:41] C:\Program Files\Trend Micro
[02/01/2007|19:44] C:\Program Files\Uninstall Information
[15/10/2006|01:18] C:\Program Files\uTorrent
[29/10/2006|11:39] C:\Program Files\VideoLAN
[02/01/2007|20:54] C:\Program Files\Windows Media Connect 2
[27/07/2008|21:21] C:\Program Files\Windows Media Player
[27/07/2008|21:21] C:\Program Files\Windows NT
[24/09/2006|19:38] C:\Program Files\WindowsUpdate
[18/10/2006|20:10] C:\Program Files\WinRAR
[10/08/2004|12:04] C:\Program Files\xerox

--------------------\\ Listing Folders in C:\Program Files\Common Files

[11/11/2006|23:01] C:\Program Files\Common Files\Adobe
[11/11/2006|23:03] C:\Program Files\Common Files\Adobe Systems Shared
[23/09/2006|11:44] C:\Program Files\Common Files\AOL
[23/12/2008|22:52] C:\Program Files\Common Files\Apple
[02/05/2007|22:05] C:\Program Files\Common Files\Corel
[17/02/2007|10:55] C:\Program Files\Common Files\Designer
[14/09/2006|14:20] C:\Program Files\Common Files\InstallShield
[14/09/2006|14:11] C:\Program Files\Common Files\Java
[17/02/2007|10:55] C:\Program Files\Common Files\Microsoft Shared
[10/08/2004|12:02] C:\Program Files\Common Files\MSSoap
[14/09/2006|14:25] C:\Program Files\Common Files\Nullsoft
[02/01/2007|19:42] C:\Program Files\Common Files\Real
[28/10/2008|22:30] C:\Program Files\Common Files\Roxio Shared
[10/08/2004|12:02] C:\Program Files\Common Files\Services
[28/10/2008|22:30] C:\Program Files\Common Files\Sonic Shared
[10/08/2004|11:57] C:\Program Files\Common Files\SpeechEngines
[27/07/2008|21:21] C:\Program Files\Common Files\System
[29/03/2007|20:18] C:\Program Files\Common Files\Teleca Shared
[14/09/2006|14:20] C:\Program Files\Common Files\TiVo Shared
[23/01/2008|21:40] C:\Program Files\Common Files\Wise Installation Wizard

--------------------\\ Process

( 58 Processes )

... OK !

--------------------\\ Searching with S_Lop

No Lop folder found !

--------------------\\ Searching for Lop Files - Folders

No Lop folder found !

--------------------\\ Searching within the Registry

..... OK !

--------------------\\ Checking the Hosts file

Hosts file CLEAN


--------------------\\ Searching for hidden files with Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-20 22:26:33
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 0

--------------------\\ Searching for other infections

--------------------\\ ROOTKIT !!

Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_TDSSSERV]
Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_TDSSSERV]
Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TDSSSERV]
Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TDSSserv]
Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\TDSSserv]
Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TDSSserv]

--------------------\\ Cracks & Keygens ..

C:\DOCUME~1\Seanie\Desktop\cracking
C:\DOCUME~1\Seanie\Desktop\cracking\01 Cardiac Arrest.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\01 Panther Dash.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\01 Tell Me Why.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\02 All You Good Good People.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\04 Cut Your Hair.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\05 Come Back to What You Know.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\05 Till the Morning Comes.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\06 Junior Kickstart.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\06 Supersonic.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\07 Eight Miles High.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\08 - Mr. Grieves.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\09 Texarkana.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\9 - Aphex Twin - Avril 14th.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\AlbumArtSmall.jpg
C:\DOCUME~1\Seanie\Desktop\cracking\AlbumArt_{0064FE52-9192-44A2-8B79-21C2D331ECFF}_Large.jpg
C:\DOCUME~1\Seanie\Desktop\cracking\AlbumArt_{0064FE52-9192-44A2-8B79-21C2D331ECFF}_Small.jpg
C:\DOCUME~1\Seanie\Desktop\cracking\clare
C:\DOCUME~1\Seanie\Desktop\cracking\dec
C:\DOCUME~1\Seanie\Desktop\cracking\desktop.ini
C:\DOCUME~1\Seanie\Desktop\cracking\Folder.jpg
C:\DOCUME~1\Seanie\Desktop\cracking\for andreas
C:\DOCUME~1\Seanie\Desktop\cracking\Mamma Mia (2008) - Soundtrack
C:\DOCUME~1\Seanie\Desktop\cracking\next version
C:\DOCUME~1\Seanie\Desktop\cracking\old
C:\DOCUME~1\Seanie\Desktop\cracking\xmas
C:\DOCUME~1\Seanie\Desktop\cracking\clare\01 Bladhm.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\clare\01 Headache.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\clare\01 Meicsiceo.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\clare\01-glasvegas-flowers_and_football_tops.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\clare\02 Can't Take My Eyes off You.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\clare\02 Don't Take Your Gun to Town.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\clare\02 Shut Up.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\clare\03 Cail¡n na Gaillimhe.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\clare\03 Denise.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\clare\03 Grace.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\clare\03 suffering jukebox.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\clare\03 Veronica.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\clare\04 I Try.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\clare\04 Near Wild Heaven.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\clare\04 Sister Isabel.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\clare\07 Go, Hippie.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\clare\09 Digsy's Dinner.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\clare\11 Donna Donna.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\clare\11 People Are Strange.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\clare\12 Touch Me.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\clare\17 Goin' Back.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\clare\22 September Gurls.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\clare\Blondie - Call Me {Theme from American Gigolo}.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\dec\01 - Abdul and Cleopatra.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\dec\01 - Knickerbocker.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\dec\01 Neon Beanbag.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\dec\01_Good Lies.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\dec\03-stereolab-eye_of_the_volcano.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\dec\03-stereolab-french_disko.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\dec\06 Valley Hi!.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\dec\06-stereolab-visionary_road_maps.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\dec\07 - Party in the Woods Tonight.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\dec\07 Silver Sands.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\dec\09 Maggie May.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\dec\09-stereolab-excursions_into_oh,_a-oh.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\dec\13 Daisy Click Clack.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\for andreas\01 - One With The Birds.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\for andreas\01 Time to Pretend.wma
C:\DOCUME~1\Seanie\Desktop\cracking\for andreas\02 Weekend Wars.wma
C:\DOCUME~1\Seanie\Desktop\cracking\for andreas\02-black_francis-garbage_heap.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\for andreas\02-the_accidental-wolves.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\for andreas\02. mistaken for strangers.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\for andreas\03 No Warning Given.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\for andreas\03 selkie bride.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\for andreas\03 suffering jukebox.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\for andreas\03 The Youth.wma
C:\DOCUME~1\Seanie\Desktop\cracking\for andreas\04 my pillow is the threshold.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\for andreas\05 - beauty.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\for andreas\05 Kids.wma
C:\DOCUME~1\Seanie\Desktop\cracking\for andreas\05. An Audience with the Pope.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\for andreas\06 He Doesn't Know Why.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\for andreas\07 Pieces of What.wma
C:\DOCUME~1\Seanie\Desktop\cracking\for andreas\07-the_accidental-illuminated_red.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\for andreas\203-michael_andrews-the_artifact_and_living.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\for andreas\9 - Aphex Twin - Avril 14th.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\for andreas\Hamish Imlach - 05 - cod liver oil and orange juice.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\for andreas\Simpsons - We Put The Spring In Springfield.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\Mamma Mia (2008) - Soundtrack\Mamma Mia (2008) - Soundtrack
C:\DOCUME~1\Seanie\Desktop\cracking\Mamma Mia (2008) - Soundtrack\Mamma Mia (2008) - Soundtrack\01-amanda_seyfried_ashley_lilley_and_rachel_mcdowall-honey_honey.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\Mamma Mia (2008) - Soundtrack\Mamma Mia (2008) - Soundtrack\02-amanda_seyfried_ashley_lilley_and_rachel_mcdowall-money_money_money.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\Mamma Mia (2008) - Soundtrack\Mamma Mia (2008) - Soundtrack\03-meryl_streep-mamma_mia.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\Mamma Mia (2008) - Soundtrack\Mamma Mia (2008) - Soundtrack\04-meryl_streep_julie_walters_and_christine_baranski-dancing_queen.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\Mamma Mia (2008) - Soundtrack\Mamma Mia (2008) - Soundtrack\05-colin_firth_pierce_brosnan_stellan_skarsgard_amanda_seyfried_and_meryl_streep-our_last_summer.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\Mamma Mia (2008) - Soundtrack\Mamma Mia (2008) - Soundtrack\06-dominic_cooper_and_amanda_seyfried-lay_all_your_love_on_me.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\Mamma Mia (2008) - Soundtrack\Mamma Mia (2008) - Soundtrack\07-meryl_streep_julie_walters_and_christine_baranski-super_trouper.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\Mamma Mia (2008) - Soundtrack\Mamma Mia (2008) - Soundtrack\08-amanda_seyfried_ashley_lilley_and_rachel_mcdowall-gimme_gimme_gimme_(a_man_after_midnight).mp3
C:\DOCUME~1\Seanie\Desktop\cracking\Mamma Mia (2008) - Soundtrack\Mamma Mia (2008) - Soundtrack\09-amanda_seyfried_and_stellan_skarsgard-the_name_of_the_game.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\Mamma Mia (2008) - Soundtrack\Mamma Mia (2008) - Soundtrack\10-full_cast_philip_michael_christine_baranski_julie_walters_and_stellan_skarsgard-voulez-vous.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\Mamma Mia (2008) - Soundtrack\Mamma Mia (2008) - Soundtrack\11-pierce_brosnan_and_meryl_streep-sos.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\Mamma Mia (2008) - Soundtrack\Mamma Mia (2008) - Soundtrack\12-christine_baranski_and_philip_michael-does_your_mother_know.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\Mamma Mia (2008) - Soundtrack\Mamma Mia (2008) - Soundtrack\13-meryl_streep_and_amanda_seyfried-slipping_through_my_fingers.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\Mamma Mia (2008) - Soundtrack\Mamma Mia (2008) - Soundtrack\14-meryl_streep-the_winner_takes_it_all.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\Mamma Mia (2008) - Soundtrack\Mamma Mia (2008) - Soundtrack\15-pierce_brosnan_and_meryl_streep-when_all_is_said_and_done.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\Mamma Mia (2008) - Soundtrack\Mamma Mia (2008) - Soundtrack\16-julie_walters_and_stellan_skarsgard-take_a_chance_on_me.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\Mamma Mia (2008) - Soundtrack\Mamma Mia (2008) - Soundtrack\17-amanda_seyfried-i_have_a_dream-thank_you_for_the_music_(hidden_track).mp3
C:\DOCUME~1\Seanie\Desktop\cracking\Mamma Mia (2008) - Soundtrack\Mamma Mia (2008) - Soundtrack\mama.jpg
C:\DOCUME~1\Seanie\Desktop\cracking\Mamma Mia (2008) - Soundtrack\Mamma Mia (2008) - Soundtrack\Thumbs.db
C:\DOCUME~1\Seanie\Desktop\cracking\next version\04 A Soldier's Song.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\next version\11 Cripple Creek Ferry.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\next version\12 Whare's Me Jumper-.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\next version\16 $1000 Wedding.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\next version\16 Hello, I Love You.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\next version\16 What's Going Ahn.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\next version\21 You Ain't Going Nowhere.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\next version\23 You're Still on My Mind.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\old\01 The Rocky Road To Dublin.wma
C:\DOCUME~1\Seanie\Desktop\cracking\old\01 Time to Pretend.wma
C:\DOCUME~1\Seanie\Desktop\cracking\old\02 Weekend Wars.wma
C:\DOCUME~1\Seanie\Desktop\cracking\old\02-black_francis-garbage_heap.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\old\02-the_accidental-wolves.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\old\02. mistaken for strangers.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\old\03 A Rainy night In Soho.wma
C:\DOCUME~1\Seanie\Desktop\cracking\old\03 Boys From The County Hell.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\old\03 selkie bride.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\old\03 The Youth.wma
C:\DOCUME~1\Seanie\Desktop\cracking\old\04 my pillow is the threshold.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\old\04 Red Army Choir - The Cossacks.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\old\04 Stand.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\old\05 - Here Comes Your Man.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\old\05 In the City.wma
C:\DOCUME~1\Seanie\Desktop\cracking\old\05 Kids.wma
C:\DOCUME~1\Seanie\Desktop\cracking\old\06 He Doesn't Know Why.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\old\06. Silently.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\old\07 - Dark Streets of London.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\old\07 Pieces of What.wma
C:\DOCUME~1\Seanie\Desktop\cracking\old\07-the_accidental-illuminated_red.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\old\Mr. Blue Sky.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\xmas\01-kate_and_anna_mcgarrigle-seven_joys_of_mary.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\xmas\02-kate_and_anna_mcgarrigle-old_waits_carol.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\xmas\03-kate_and_anna_mcgarrigle-o_little_town_of_bethlehem.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\xmas\04-kate_and_anna_mcgarrigle-il_est_ne_-_ca_bergers.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\xmas\05-kate_and_anna_mcgarrigle-what_are_you_doing_new_years_eve.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\xmas\06-kate_and_anna_mcgarrigle-rebel_jesus.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\xmas\07-kate_and_anna_mcgarrigle-some_children_see_him.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\xmas\08-kate_and_anna_mcgarrigle-merry_christmas_and_happy_new_year.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\xmas\09-kate_and_anna_mcgarrigle-counting_stars.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\xmas\10-kate_and_anna_mcgarrigle-spotlight_on_christmas.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\xmas\11-kate_and_anna_mcgarrigle-wise_men.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\xmas\12-kate_and_anna_mcgarrigle-port_starboard_sox.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\xmas\13-kate_and_anna_mcgarrigle-god_rest_ye_merry_gentlemen.mp3
C:\DOCUME~1\Seanie\Desktop\cracking\xmas\14-kate_and_anna_mcgarrigle-blue_christmas.mp3
C:\DOCUME~1\Seanie\Recent\PSP keygen.lnk


[F:2][D:1]-> C:\DOCUME~1\Seanie\LOCALS~1\Temp
[F:2][D:0]-> C:\DOCUME~1\Seanie\Cookies
[F:20][D:5]-> C:\DOCUME~1\Seanie\LOCALS~1\TEMPOR~1\content.IE5

1 - "C:\Lop SD\LopR_1.txt" - 20/01/2009|22:27 - Option : [1]

--------------------\\ Scan completed at 22:27:29

[Tigger93]

As you are using cracks, we can no longer help you.

[seven stars]

Hi Tigger - what do you mean by 'cracks'? (I'm not the brightest!) That 'cracking' folder is a music folder for a CD compilation I was making for the car. The folder used to be called 'Cracking tunes' (as in 'very good tunes'). Not sure whether you use that expression, but it's common in Ireland and Britain.

[Tigger93]

This shows you have been using Keygens or cracks:
C:\DOCUME~1\Seanie\Recent\PSP keygen.lnk

[AdvancedSetup]

We're sorry but since you have evidence of cracked or pirated software you're using on the system we have to close this thread now.
If you feel this is inaccurate information please send any Moderator a private message explaining in detail and they will review your information in private.

HiJack This! Forum Policy
[indent]

Quote

We will not be party to obvious use of key gens, cracks, warez or other illegal means of downloading software, music, videos ect. This means no P2P evidence will be supported. Logs that show these in them, will given the option to remove the P2P items. Keygens, cracks, warez and similar will have the thread closed period. It's theft and against the law.

[/indent]

[AdvancedSetup]

Per discussion in PM I've re-opened the post. If there are ANY signs of illegal software in use the post will be closed again permanently.

Please run the following.

Restart the computer and close ALL applications and run this tool.


Please download the following scanning tool. GMER
[indent]

• Open the zip file and copy the file gmer.exe to your Desktop.
  
• Double click on gmer.exe and run it.
  
• It may take a minute to load and become available.
  
• Do not make any changes. As soon as it's done and the COPY button is available click on the COPY button.
  
• DO NOT Click on the SCAN button.
  
• This will place the scan in your clipboard. Paste that into notepad or into your next reply post please.
  
• Click OK and quit the GMER program.

[/indent]


Then run the following

Update and Scan with Malwarebytes' Anti-Malware

• Start MalwareBytes AntiMalware (Vista users must Right click and choose RunAs Admin)
  
• Please DO NOT run MBAM in Safe Mode unless requested to, you MUST run it in normal Windows mode.
  
  • Update Malwarebytes' Anti-Malware
    
  • Select the Update tab
    
  • Click Update
• When the update is complete, select the Scanner tab
  
• Select Perform quick scan, then click Scan.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Be sure that everything is checked, and click Remove Selected.
  
• When completed, a log will open in Notepad. please copy and paste the log into your next reply
  • If you accidently close it, the log file is saved here and will be named like this:
    
  • C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt

Then run HJT Do a system scan and save a logfile and post back all 3 logs.

[seven stars]

_______________________________GMER________________________________________

GMER 1.0.14.14536 - http://www.gmer.net
Rootkit scan 2009-01-27 21:06:34
Windows 5.1.2600 Service Pack 3


---- Devices - GMER 1.0.14 ----

AttachedDevice \FileSystem\Ntfs \Ntfs avg7rsw.sys (AVG Resident Shield Unload Helper/GRISOFT, s.r.o.)

Device \Driver\Tcpip \Device\Ip avgtdi.sys (AVG Network connection watcher/GRISOFT, s.r.o.)

AttachedDevice \Driver\Tcpip \Device\Ip odptdi.sys (OnDemand Proxy TDI Driver/Aventail Corporation)

Device \Driver\Tcpip \Device\Tcp avgtdi.sys (AVG Network connection watcher/GRISOFT, s.r.o.)

AttachedDevice \Driver\Tcpip \Device\Tcp odptdi.sys (OnDemand Proxy TDI Driver/Aventail Corporation)

Device \Driver\Tcpip \Device\Udp avgtdi.sys (AVG Network connection watcher/GRISOFT, s.r.o.)

AttachedDevice \Driver\Tcpip \Device\Udp odptdi.sys (OnDemand Proxy TDI Driver/Aventail Corporation)

Device \Driver\Tcpip \Device\RawIp avgtdi.sys (AVG Network connection watcher/GRISOFT, s.r.o.)

AttachedDevice \Driver\Tcpip \Device\RawIp odptdi.sys (OnDemand Proxy TDI Driver/Aventail Corporation)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)

---- Services - GMER 1.0.14 ----

Service system32\drivers\TDSSserv.sys (*** hidden *** ) [SYSTEM] TDSSserv <-- ROOTKIT !!!

---- EOF - GMER 1.0.14 ----



_______________________________MBAM__________________________________________

Malwarebytes' Anti-Malware 1.33
Database version: 1700
Windows 5.1.2600 Service Pack 3

27/01/2009 21:11:28
mbam-log-2009-01-27 (21-11-28).txt

Scan type: Quick Scan
Objects scanned: 55113
Time elapsed: 3 minute(s), 7 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)



_______________________________HJT________________________________________

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:15:36, on 27/01/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\NetWaiting\netWaiting.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Seanie\Desktop\gmer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ie/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.euro.dell.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netWaiting.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1C11B948-582A-433F-A98D-A8C4D5CC64F2} (20-20 Technologies 3D Room Planner) - http://magnet.2020.net/virtualplanner/Core...yerAX_Win32.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{046D27A9-134B-4AE0-9CEF-1CCD7FF3B79A}: NameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{046D27A9-134B-4AE0-9CEF-1CCD7FF3B79A}: NameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{046D27A9-134B-4AE0-9CEF-1CCD7FF3B79A}: NameServer = 192.168.1.1
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Intel® PROSet/Wireless SSO Service (WLANKEEPER) - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

--
End of file - 9038 bytes

[AdvancedSetup]

Please uninstall Adobe Acrobat Reader 7 and ALL versions of Java if installed.
Update available for vulnerability in versions 8.1 and earlier of Adobe Reader and Acrobat
Here are the download links for Adobe Reader 9.0.0 but do not install it yet. Wait until we're done.
You're also running an out of date version of AVG Anti-Virus 7 they're now at version 8 DO NOT remove or update it right now but when we're close to being done we'll look at updating it.


With all other applications closed (Taskbar empty), open HijackThis again
and run Do a system scan only and place a check mark on the following items.

• R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
  
• O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
  
• O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
  
• O17 - HKLM\System\CCS\Services\Tcpip\..\{046D27A9-134B-4AE0-9CEF-1CCD7FF3B79A}: NameServer = 192.168.1.1
  
• O17 - HKLM\System\CS1\Services\Tcpip\..\{046D27A9-134B-4AE0-9CEF-1CCD7FF3B79A}: NameServer = 192.168.1.1
  
• O17 - HKLM\System\CS2\Services\Tcpip\..\{046D27A9-134B-4AE0-9CEF-1CCD7FF3B79A}: NameServer = 192.168.1.1
  Then Quit All Browsers including the one you're reading this in now.
  Then click on Fix checked and then quit HJT

When the above is done then run the following in this exact order. IF you have any copy of Combofix delete it now and get a new copy.
[indent]You will want to print out or copy these instructions to Notepad for Safe Mode/offline reference!
These steps are for member seven stars only. If you are a lurker, do NOT try this on your system!
If you are not seven stars and have a similar problem, do NOT post here; start your own topic

Do not run or start any other programs while these utilities and tools are in use!
Do NOT run any other tools on your own or do any fixes other than what is listed here.
If you have questions, please ask before you do something on your own.
But it is important that you get going on these following steps.

STEP01
Reconfigure Windows XP to show hidden files:
To enable the viewing of Hidden files follow these steps:

* Close all programs so that you are at your desktop.
* Double-click on the My Computer icon.
* Select the Tools menu and click Folder Options.
* After the new window appears select the View tab.
* Put a checkmark in the checkbox labeled Display the contents of system folders.
* Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.
* Remove the checkmark from the checkbox labeled Hide file extensions for known file types.
* Remove the checkmark from the checkbox labeled Hide protected operating system files.
* Press the Apply button and then the OK button and exit My Computer.
* Now your computer is configured to show all hidden files.


STEP02

Download and install CCleaner

• CCleaner
  
• Double-click on the downloaded file "ccsetup215.exe" and install the application.
  
• Keep the default installation folder "C:\Program Files\CCleaner"
  
• Uncheck "Add CCleaner Yahoo! Toolbar and use CCleaner from your browser"
  
• Click finish when done and close ALL PROGRAMS
  
• Start the CCleaner program.
  
• Click on Registry and Uncheck Registry Integrity so that it does not run
  
• Click on Options - Advanced and Uncheck "Only delete files in Windows Temp folders older than 48 hours"
  
• Click back to Cleaner and under SYSTEM uncheck the Memory Dumps and Windows Log Files
  
• Click on Run Cleaner button on the bottom right side of the program.
  
• Click OK to any prompts

STEP03
Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools.
This should apply to AVG8:
To disable the Resident Shield, please:
open AVG User Interface
double-click on the Resident Shield
un-tick the option Resident Shield active
save the changes.

STEP04
Please download and run the following file to repair file and registry permissions
fixacl.exe

STEP05

• Download FixPolicies.exe by Bill Castner and save it to your desktop.
  
• Double click on FixPolicies.exe to run it.
  
• Click on Install. It will create a folder named FixPolicies on your desktop.
  
• Open the FixPolicies folder.
  
• Double click on Fix_policies.cmd to run it. Command Prompt will open and close quickly this is normal.
  
• Reboot your computer after it runs
  
• This fix may prove temporary. Active malware may revert these changes at your next startup. You can safely run the utility again.
  
• Note: some malware will block the running of this tool. So if you cannot run Fixpolicies, then, RENAME the EXE file to something like Mytool.exe and then run it.

STEP06
Download this INF repair file by MS-MVP Miekiemoes: http://users.telenet.be/bluepatchy/miekiemoes/tools/VArestorepolicies.zip
Unzip the download. Open the folder VArestorepolicies and Right-click the file inside, VArestorepolicies.INF and choose Install

STEP07
If you have a prior copy of Combofix, delete it now !

Download ComboFix from one of these locations, saving to DESKTOP:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop
If your I.E. browser shows a warning message at the top, do a Right-Click on the bar and select Download, saving it to the Desktop.

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
  
  
  
• Double click on Combo-Fix.exe & follow the prompts.
  
  
• If and only if you are prompted to download a new version of Combofix, reply NO .
  
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
  
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.





Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:




Click on Yes, to continue scanning for malware.

Please watch Combofix as it runs, as you may see messages which require your response, or the pressing of OK button.

IF you should see a message like this:

then, be sure to write down fully and also copy that into your next reply here and then await for my response.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
-------------------------------------------------------

A caution - Do not run Combofix more than once.
Do not touch your mouse/keyboard until the scan has completed, as this may cause the process to stall or your computer to lock.
The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled.
If this occurs, please reboot to restore the desktop.
Even when ComboFix appears to be doing nothing, look at your Drive light.
If it is flashing, Combofix is still at work.

STEP08
IF and only IF the Combofix has worked without exceptions, only then, do the following. IF it has exceptions, then please provide all details and put that in a reply pronto, and STOP, and await my reply.

Only if Combofix has a good finish:
I'm going to have you get and run a special tool. It will hopefully take out most remains of this beast. Keep in mind that not all files I list here will be found on your system; so do not be alarmed. This is a general-type list of typical infectors.

Download The Avenger by Swandog46 from here.

• Unzip/extract it to a folder on your desktop.
  
• Double click on avenger.exe to run The Avenger.
  
• Click OK.
  
• Make sure that the box next to Scan for rootkits has a tick in it and that the box next to Automatically disable any rootkits found does not have a tick in it.
  
• Copy all of the text in the below textbox to the clibpboard by highlighting it and then pressing Ctrl+C.
  

  Files to delete:
  C:\WINDOWS\system32\brsvc01a.exe
  C:\WINDOWS\system32\brss01a.exe
  C:\WINDOWS\SYSTEM32\TDSSixgp.dll
  C:\WINDOWS\SYSTEM32\TDSSproc.log
  C:\WINDOWS\SYSTEM32\TDSSwkod.log
  C:\Documents and Settings\Chelsea\Local Settings\Temp\TDSSe8db.tmp
  c:\windows\system32\drivers\msqpdxserv.sys
  C:\resycled
  D:\resycled
  e:\resycled
  f:\resycled
  g:\resycled
  c:\windows\system32\TDSSweat.dat
  C:\WINDOWS\system32\drivers\TDSSmqlt.sys
  C:\windows\system32\drivers\tdssserv.sys
  C:\WINDOWS\system32\drivers\TDSSmact.sys
  C:\WINDOWS\system32\TDSSfpmp.dll
  C:\WINDOWS\system32\TDSSwpyd.dat
  C:\WINDOWS\system32\TDSStkdv.log
  C:\WINDOWS\system32\TDSSotxb.dll
  C:\WINDOWS\system32\TDSScrrn.dll
  C:\WINDOWS\system32\TDSSbvqh.dll
  C:\WINDOWS\system32\TDSSjnmx.dll
  c:\windows\system32\TDSShrxr.dll
  c:\windows\system32\TDSSkkbi.log
  c:\windows\system32\TDSSlrvd.dat
  c:\windows\system32\TDSSlxwp.dll
  c:\windows\system32\TDSSnmxh.log
  c:\windows\system32\TDSSoiqt.dll
  c:\windows\system32\TDSSrhyp.log
  c:\windows\system32\TDSSrtqp.dll
  c:\windows\system32\TDSSsihc.dll
  c:\windows\system32\TDSSxfum.dll
  c:\windows\system32\TDSSmtve.dat
  c:\windows\system32\TDSSnirj.dat
  
  Drivers to delete:
  tdss
  tdssserv
  TDSSserv.SYS
  Service_TDSSSERV.SYS
  Legacy_TDSSSERV.SYS
  msqpdxserv.sys
  msqpdxserv
  
  Registry keys to delete:
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TDSSserv.sys
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\TDSSserv.sys
  HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\tdssserv
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tdssserv
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata
  HKEY_LOCAL_MACHINE\SOFTWARE\tdss
  HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\tdssserv.sys
  HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\tdssserv.sys
  HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\tdssserv
  HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_TDSSSERV
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TDSSSERV

• In the avenger window, click the Paste Script from Clipboard icon, button.
  
• :!: Make sure that what appears in Avenger matches exactly what you were asked to Copy/Paste from the Code box above.
  
• Click the Execute button.
  
• You will be asked Are you sure you want to execute the current script?.
  
• Click Yes.
  
• You will now be asked First step completed --- The Avenger has been successfully set up to run on next boot. Reboot now?.
  
• Click Yes.
  
• Your PC will now be rebooted.
  
• Note: If the above script contains Drivers to delete: or Drivers to disable:, then The Avenger will require two reboots to complete its operation.
  
• If that is the case, it will force a BSOD on the first reboot. This is normal & expected behaviour.
  
• After your PC has completed the necessary reboots, a log should automatically open. Please copy/paste the contents of c:\avenger.txt into your next reply.

Not all the items will be found; so do not worry. Hopefully enough of the rootkit will be removed so that we can continue forward with more cleaning.
If you get a blue screen abort when it reboots, please write down all the information, STOP codes and description.
and then reboot the system again.

STEP09
Download DDS and save it to your desktop from one of these 3 locations
1 http://www.techsupportforum.com/sectools/sUBs/dds
2 http://download.bleepingcomputer.com/sUBs/dds.scr
3 http://www.forospyware.com/sUBs/dds

Disable any script blocker if your antivirus/antimalware has it.
Then double click dds.scr to run the tool.
When done, DDS.txt will open.
Click Yes at the next prompt for Optional Scan.

• When done, DDS will open two (2) logs:
  • DDS.txt
    
  • Attach.txt
• Save both reports to your desktop.

Please include the following logs in your next reply:
DDS.txt
Attach.txt

Please then reply with a copy of C:\Combofix.txt, C:\Avenger.txt, and a new HijackThis

RE-Enable your AntiVirus and AntiSpyware applications.[/indent]

[seven stars]

Hi,

I got to STEP07 (download and run combofix), but it wouldn't run for me. Instead I got an error message (like the dialogs you get when IE crashes): "prep.com has encountered a problem and needs to close" with the Send and Don't send buttons.

[AdvancedSetup]

Did you rename Combofix.exe to another name?

If you did not rename it, please try renaming it. You can also try to start in SAFE MODE and run it from there if you have to.

[seven stars]

I renamed combofix and ran it in safe mode. Before I ran it, it said that AVG was still running, even though I'd done all I could to disable it. I didn't want to take any chances, so I uninstalled AVG altogether before running combofix (it's an out of date version anyway and you said I'd be better to get more up-to-date a/v software when we're done).

Here are the logs:

DDS, Attach (this reply)
Combofix, Avenger, HJT (next reply)

cheers,
Sean



_____________________DDS.TXT_________________________


DDS (Ver_09-01-19.01) - NTFSx86
Run by Seanie at 21:32:52.35 on 2009-01-29
Internet Explorer: 7.0.5730.11

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.ie/
uInternet Connection Wizard,ShellNext = hxxp://www.euro.dell.com/
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: NoExplorer - No File
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\tfswshx.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn\YTSingleInstance.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
uRun: [ModemOnHold] c:\program files\netwaiting\netWaiting.exe
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe
mRun: [igfxtray] c:\windows\system32\igfxtray.exe
mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe
mRun: [igfxpers] c:\windows\system32\igfxpers.exe
mRun: [SigmatelSysTrayApp] stsystra.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [Dell QuickSet] c:\program files\dell\quickset\quickset.exe
mRun: [IntelZeroConfig] "c:\program files\intel\wireless\bin\ZCfgSvc.exe"
mRun: [IntelWireless] "c:\program files\intel\wireless\bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
mRun: [dla] c:\windows\system32\dla\tfswctrl.exe
mRun: [ISUSPM Startup] "c:\program files\common files\installshield\updateservice\isuspm.exe" -startup
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [Sony Ericsson PC Suite] "c:\program files\sony ericsson\mobile2\application launcher\Application Launcher.exe" /startoptions
mRun: [MSKDetectorExe] c:\program files\mcafee\spamkiller\MSKDetct.exe /uninstall
mRun: [DVDLauncher] "c:\program files\cyberlink\powerdvd\DVDLauncher.exe"
mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [MSConfig] c:\windows\pchealth\helpctr\binaries\MSConfig.exe /auto
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {00000055-9980-0010-8000-00AA00389B71} - hxxp://codecs.microsoft.com/codecs/i386/fhg.CAB
DPF: {1C11B948-582A-433F-A98D-A8C4D5CC64F2} - hxxp://magnet.2020.net/virtualplanner/Core/Player/2020PlayerAX_Win32.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab
Filter: application/x-internet-signup - {A173B69A-1F9B-4823-9FDA-412F641E65D6} - c:\program files\tiscali\tiscali internet\dlls\tiscalifilter.dll
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\seanie\applic~1\mozilla\firefox\profiles\mj2nxr7s.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.ie/

============= SERVICES / DRIVERS ===============


=============== Created Last 30 ================

2009-01-29 07:23 <DIR> a-dshr-- C:\cmdcons
2009-01-29 06:56 286,720 a------- c:\windows\SWREG.exe
2009-01-29 06:56 98,816 a------- c:\windows\sed.exe
2009-01-28 20:27 <DIR> --d----- c:\program files\Yahoo!
2009-01-27 21:05 250 a------- c:\windows\gmer.ini
2009-01-22 22:05 <DIR> --d----- C:\as_xyz
2009-01-20 22:24 <DIR> --d----- C:\Lop SD
2009-01-20 22:20 <DIR> --d----- C:\_OTScanIt
2009-01-19 21:41 <DIR> --d----- c:\program files\Trend Micro
2009-01-18 22:26 <DIR> --d----- c:\program files\Sophos
2009-01-05 10:14 7,552 a------- c:\windows\system32\drivers\SONYPVU1.SYS
2009-01-05 10:14 7,552 a------- c:\windows\system32\dllcache\sonypvu1.sys

==================== Find3M ====================

2009-01-18 22:10 1,033,728 a------- c:\windows\system32\dllcache\explorer.exe
2009-01-18 22:10 1,033,728 a------- c:\windows\explorer.exe
2009-01-14 16:11 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-14 16:11 15,504 a------- c:\windows\system32\drivers\mbam.sys
2008-12-13 06:40 3,593,216 a------- c:\windows\system32\dllcache\mshtml.dll
2008-12-11 10:57 333,952 a------- c:\windows\system32\drivers\srv.sys
2008-12-11 10:57 333,952 -------- c:\windows\system32\dllcache\srv.sys
2008-12-05 21:55 1,312,755 a------- C:\MGtools.exe
2007-11-17 14:13 81,920 a------- c:\docume~1\seanie\applic~1\ezpinst.exe
2007-11-17 14:13 47,360 a------- c:\docume~1\seanie\applic~1\pcouffin.sys
2006-12-31 13:48 88 ac------ c:\docume~1\seanie\applic~1\wklnhst.dat
2007-05-02 22:00 56 -c-shr-- c:\windows\system32\A96C0B895C.sys
2007-10-18 19:29 3,766 ac-sh--- c:\windows\system32\KGyGaAvL.sys
2008-09-09 21:07 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008090120080908\index.dat
2008-09-09 21:07 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008090920080910\index.dat

============= FINISH: 21:33:20.35 ===============




_____________________ATTACH.TXT_________________________


==== Installed Programs ======================

Adobe Flash Player 10 Plugin
Adobe Flash Player 9 ActiveX
Adobe SVG Viewer 3.0
Apple Mobile Device Support
Apple Software Update
Aventail Access Manager
Aventail OnDemand Proxy Agent
Aventail Web Proxy Agent
Aventail Webifiers
Bonjour
Broadcom Management Programs
CCleaner (remove only)
CinepPlayer 30 Update
Conexant HDA D110 MDC V.92 Modem
Dell Support 3.2
Dell System Restore
Digital Line Detect
DVDFab Platinum 3.0.4.5 Beta Ghosthunter relase
Google Earth
High Definition Audio Driver Package - KB835221
HijackThis 2.0.2
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB952287)
Intel® Graphics Media Accelerator Driver
Intel® PROSet/Wireless Software
iTunes
Magic ISO Maker v5.4 (build 0239)
Malwarebytes' Anti-Malware
Malwarebytes' RogueRemover
mCore
MCU
mDrWiFi
mHlpDell
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
Microsoft National Language Support Downlevel APIs
Microsoft Office 2000 Professional
Microsoft Office Web Components
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Works
mIWA
mLogView
mMHouse
Modem Helper
Mozilla Firefox (3.0.5)
mPfMgr
mPfWiz
mProSafe
MSN
mSSO
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
mWlsSafe
mWMI
mXML
mZConfig
NetWaiting
PowerDVD 5.7
QuickSet
QuickTime
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Internet Explorer 7 (KB928090)
Security Update for Windows Internet Explorer 7 (KB929969)
Security Update for Windows Internet Explorer 7 (KB931768)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB917734)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Sonic Activation Module
Sonic DLA
Sonic MyDVD LE
Sonic RecordNow Audio
Sonic RecordNow Copy
Sonic RecordNow Data
Sonic Update Manager
Sony Ericsson PC Suite 1.20.173
Sophos Anti-Rootkit 1.3.1
Spybot - Search & Destroy
SUPERAntiSpyware Free Edition
Synaptics Pointing Device Driver
Tiscali Internet
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Update Service
VideoLAN VLC media player 0.8.5
WebFldrs XP
Windows Genuine Advantage Validation Tool (KB892130)
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Media Format 11 runtime
Windows Media Player 11
Windows XP Service Pack 3
WinRAR archiver
Yahoo! Toolbar

==== End Of File ===========================

[seven stars]

_____________________C:\COMBOFIX.TXT_________________________


ComboFix 09-01-24.01 - Administrator 2009-01-29 7:24:33.1 - NTFSx86 NETWORK
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1014.820 [GMT 0:00]
Running from: c:\documents and settings\Administrator\Desktop\seanfix.exe
AV: *On-access scanning disabled* (Outdated)
FW: *disabled*
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\Readme.txt

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_PACKET
-------\Legacy_TDSSSERV
-------\Service_TDSSserv


((((((((((((((((((((((((( Files Created from 2008-12-28 to 2009-01-29 )))))))))))))))))))))))))))))))
.

2009-01-28 20:27 . 2009-01-28 20:27 <DIR> d-------- c:\program files\Yahoo!
2009-01-28 20:27 . 2009-01-28 20:27 <DIR> d-------- c:\documents and settings\Seanie\Application Data\Yahoo!
2009-01-28 20:27 . 2009-01-28 20:27 <DIR> d-------- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2009-01-27 21:05 . 2009-01-27 21:05 250 --a------ c:\windows\gmer.ini
2009-01-22 22:05 . 2009-01-22 22:19 <DIR> d-------- C:\as_xyz
2009-01-20 22:24 . 2009-01-20 22:27 <DIR> d-------- C:\Lop SD
2009-01-20 22:20 . 2009-01-20 22:20 <DIR> d-------- C:\_OTScanIt
2009-01-19 21:41 . 2009-01-19 21:41 <DIR> d-------- c:\program files\Trend Micro
2009-01-18 22:26 . 2009-01-18 22:26 <DIR> d-------- c:\program files\Sophos
2009-01-05 10:14 . 2001-08-17 13:56 7,552 --a------ c:\windows\system32\drivers\SONYPVU1.SYS
2009-01-05 10:14 . 2001-08-17 13:56 7,552 --a------ c:\windows\system32\dllcache\sonypvu1.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-29 07:20 --------- d-----w c:\documents and settings\Seanie\Application Data\AVG7
2009-01-29 07:20 --------- d-----w c:\documents and settings\LocalService\Application Data\AVG7
2009-01-29 07:20 --------- d-----w c:\documents and settings\All Users\Application Data\avg7
2009-01-29 07:20 --------- d-----w c:\documents and settings\Administrator\Application Data\AVG7
2009-01-28 20:33 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-01-28 20:27 --------- d-----w c:\program files\CCleaner
2009-01-26 22:24 --------- d-----w c:\program files\PartyGaming
2009-01-23 07:37 --------- d-----w c:\program files\Java
2009-01-23 07:30 --------- d-----w c:\program files\Corel
2009-01-23 07:27 --------- d-----w c:\program files\Common Files\Adobe
2009-01-18 22:43 --------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-01-18 22:10 1,033,728 ----a-w c:\windows\explorer.exe
2009-01-14 16:11 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-14 16:11 15,504 ----a-w c:\windows\system32\drivers\mbam.sys
2008-12-23 22:53 --------- d-----w c:\program files\iTunes
2008-12-23 22:53 --------- d-----w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-12-23 22:52 --------- d-----w c:\program files\QuickTime
2008-12-23 22:52 --------- d-----w c:\program files\iPod
2008-12-23 22:52 --------- d-----w c:\program files\Common Files\Apple
2008-12-23 22:52 --------- d-----w c:\program files\Bonjour
2008-12-23 22:51 --------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
2008-12-23 22:50 --------- d-----w c:\program files\Apple Software Update
2008-12-23 22:50 --------- d-----w c:\documents and settings\All Users\Application Data\Apple
2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys
2008-12-10 22:07 --------- d-----w c:\program files\SUPERAntiSpyware
2008-12-05 22:24 --------- d-----w c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2008-12-05 22:23 --------- d-----w c:\documents and settings\Seanie\Application Data\SUPERAntiSpyware.com
2008-12-05 21:55 1,312,755 ----a-w C:\MGtools.exe
2008-12-04 22:22 --------- d-----w c:\program files\Spybot - Search & Destroy
2007-11-17 14:13 81,920 ----a-w c:\documents and settings\Seanie\Application Data\ezpinst.exe
2007-11-17 14:13 47,360 ----a-w c:\documents and settings\Seanie\Application Data\pcouffin.sys
2006-12-31 13:48 88 -c--a-w c:\documents and settings\Seanie\Application Data\wklnhst.dat
2007-05-02 22:00 56 -csh--r c:\windows\system32\A96C0B895C.sys
2007-10-18 19:29 3,766 -csha-w c:\windows\system32\KGyGaAvL.sys
2008-09-09 21:07 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008090120080908\index.dat
2008-09-09 21:07 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008090920080910\index.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ModemOnHold"="c:\program files\NetWaiting\netWaiting.exe" [2003-09-10 20480]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-12-10 1809648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-12-13 98304]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-12-13 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-12-13 118784]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-08 761947]
"Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2006-06-29 1032192]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2006-05-01 667718]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2006-05-01 602182]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-12-06 127035]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 249856]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 81920]
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 159744]
"MSKDetectorExe"="c:\program files\McAfee\SpamKiller\MSKDetct.exe" [2005-07-12 1117184]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-12-09 49152]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-01-14 1273488]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"MSConfig"="c:\windows\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2008-04-14 169984]
"SigmatelSysTrayApp"="stsystra.exe" [2006-03-24 c:\windows\stsystra.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-10 22:07 352256 c:\program files\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Sony Ericsson\\Update Service\\ma3platform.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\WINDOWS\\system32\\wbem\\wmiprvse.exe"=
"c:\\WINDOWS\\stsystra.exe"=
"c:\\Program Files\\Intel\\Wireless\\Bin\\ZCfgSvc.exe"=
"c:\\WINDOWS\\system32\\taskmgr.exe"=
"c:\\Program Files\\Intel\\Wireless\\Bin\\iFrmewrk.exe"=
"c:\\Program Files\\Common Files\\Teleca Shared\\Generic.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"%windir%\\explorer.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"23562:TCP"= 23562:TCP:uTorr_TCP
"23562:UDP"= 23562:UDP:uTorr_UDP

R1 Odptdi;Odptdi;c:\windows\system32\drivers\odptdi.sys [2008-10-27 46744]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2008-11-17 8944]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2008-11-17 55024]
S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\10.tmp --> c:\windows\system32\10.tmp [?]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-11-17 7408]
.
Contents of the 'Scheduled Tasks' folder

2009-01-05 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-DMXLauncher - c:\program files\Dell\Media Experience\DMXLauncher.exe
Notify-WgaLogon - (no file)
MSConfigStartUp-AVG7_CC - c:\progra~1\Grisoft\AVGFRE~1\avgcc.exe


.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.ie/
uInternet Connection Wizard,ShellNext = hxxp://www.euro.dell.com/
DPF: {1C11B948-582A-433F-A98D-A8C4D5CC64F2} - hxxp://magnet.2020.net/virtualplanner/Core/Player/2020PlayerAX_Win32.cab
FF - ProfilePath - c:\documents and settings\Seanie\Application Data\Mozilla\Firefox\Profiles\mj2nxr7s.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.ie/
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-29 07:27:04
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MEMSWEEP2]
"ImagePath"="\??\c:\windows\system32\10.tmp"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Intel\Wireless\Folders\p*& 2*]
"Path"="c:\\WINDOWS\\system32\\config\\systemprofile\\Application Data\\Intel\\Wireless\\"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(916)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\program files\Intel\Wireless\Bin\WLKEEPER.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Dell\QuickSet\NicConfigSvc.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\Common Files\Teleca Shared\CapabilityManager.exe
c:\program files\Digital Line Detect\DLG.exe
c:\progra~1\Intel\Wireless\Bin\Dot1XCfg.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Common Files\Teleca Shared\Generic.exe
c:\program files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
.
**************************************************************************
.
Completion time: 2009-01-29 7:29:51 - machine was rebooted [Seanie]
ComboFix-quarantined-files.txt 2009-01-29 07:29:48

Pre-Run: 5,296,717,824 bytes free
Post-Run: 4,155,936,768 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

200 --- E O F --- 2009-01-15 21:36:05









_____________________C:\AVENGER.TXT_________________________

Logfile of The Avenger Version 2.0, © by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!


Error: file "C:\WINDOWS\system32\brsvc01a.exe" not found!
Deletion of file "C:\WINDOWS\system32\brsvc01a.exe" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "C:\WINDOWS\system32\brss01a.exe" not found!
Deletion of file "C:\WINDOWS\system32\brss01a.exe" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "C:\WINDOWS\SYSTEM32\TDSSixgp.dll" not found!
Deletion of file "C:\WINDOWS\SYSTEM32\TDSSixgp.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "C:\WINDOWS\SYSTEM32\TDSSproc.log" not found!
Deletion of file "C:\WINDOWS\SYSTEM32\TDSSproc.log" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "C:\WINDOWS\SYSTEM32\TDSSwkod.log" not found!
Deletion of file "C:\WINDOWS\SYSTEM32\TDSSwkod.log" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: could not open file "C:\Documents and Settings\Chelsea\Local Settings\Temp\TDSSe8db.tmp"
Deletion of file "C:\Documents and Settings\Chelsea\Local Settings\Temp\TDSSe8db.tmp" failed!
Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)
--> bad path / the parent directory does not exist


Error: file "c:\windows\system32\drivers\msqpdxserv.sys" not found!
Deletion of file "c:\windows\system32\drivers\msqpdxserv.sys" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "C:\resycled" not found!
Deletion of file "C:\resycled" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: could not open file "D:\resycled"
Deletion of file "D:\resycled" failed!
Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)
--> bad path / the parent directory does not exist


Error: could not open file "e:\resycled"
Deletion of file "e:\resycled" failed!
Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)
--> bad path / the parent directory does not exist


Error: could not open file "f:\resycled"
Deletion of file "f:\resycled" failed!
Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)
--> bad path / the parent directory does not exist


Error: could not open file "g:\resycled"
Deletion of file "g:\resycled" failed!
Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)
--> bad path / the parent directory does not exist


Error: file "c:\windows\system32\TDSSweat.dat" not found!
Deletion of file "c:\windows\system32\TDSSweat.dat" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "C:\WINDOWS\system32\drivers\TDSSmqlt.sys" not found!
Deletion of file "C:\WINDOWS\system32\drivers\TDSSmqlt.sys" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "C:\windows\system32\drivers\tdssserv.sys" not found!
Deletion of file "C:\windows\system32\drivers\tdssserv.sys" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "C:\WINDOWS\system32\drivers\TDSSmact.sys" not found!
Deletion of file "C:\WINDOWS\system32\drivers\TDSSmact.sys" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "C:\WINDOWS\system32\TDSSfpmp.dll" not found!
Deletion of file "C:\WINDOWS\system32\TDSSfpmp.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "C:\WINDOWS\system32\TDSSwpyd.dat" not found!
Deletion of file "C:\WINDOWS\system32\TDSSwpyd.dat" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "C:\WINDOWS\system32\TDSStkdv.log" not found!
Deletion of file "C:\WINDOWS\system32\TDSStkdv.log" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "C:\WINDOWS\system32\TDSSotxb.dll" not found!
Deletion of file "C:\WINDOWS\system32\TDSSotxb.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "C:\WINDOWS\system32\TDSScrrn.dll" not found!
Deletion of file "C:\WINDOWS\system32\TDSScrrn.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "C:\WINDOWS\system32\TDSSbvqh.dll" not found!
Deletion of file "C:\WINDOWS\system32\TDSSbvqh.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "C:\WINDOWS\system32\TDSSjnmx.dll" not found!
Deletion of file "C:\WINDOWS\system32\TDSSjnmx.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "c:\windows\system32\TDSShrxr.dll" not found!
Deletion of file "c:\windows\system32\TDSShrxr.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "c:\windows\system32\TDSSkkbi.log" not found!
Deletion of file "c:\windows\system32\TDSSkkbi.log" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "c:\windows\system32\TDSSlrvd.dat" not found!
Deletion of file "c:\windows\system32\TDSSlrvd.dat" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "c:\windows\system32\TDSSlxwp.dll" not found!
Deletion of file "c:\windows\system32\TDSSlxwp.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "c:\windows\system32\TDSSnmxh.log" not found!
Deletion of file "c:\windows\system32\TDSSnmxh.log" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "c:\windows\system32\TDSSoiqt.dll" not found!
Deletion of file "c:\windows\system32\TDSSoiqt.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "c:\windows\system32\TDSSrhyp.log" not found!
Deletion of file "c:\windows\system32\TDSSrhyp.log" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "c:\windows\system32\TDSSrtqp.dll" not found!
Deletion of file "c:\windows\system32\TDSSrtqp.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "c:\windows\system32\TDSSsihc.dll" not found!
Deletion of file "c:\windows\system32\TDSSsihc.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "c:\windows\system32\TDSSxfum.dll" not found!
Deletion of file "c:\windows\system32\TDSSxfum.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "c:\windows\system32\TDSSmtve.dat" not found!
Deletion of file "c:\windows\system32\TDSSmtve.dat" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "c:\windows\system32\TDSSnirj.dat" not found!
Deletion of file "c:\windows\system32\TDSSnirj.dat" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\tdss" not found!
Deletion of driver "tdss" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\tdssserv" not found!
Deletion of driver "tdssserv" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\TDSSserv.SYS" not found!
Deletion of driver "TDSSserv.SYS" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\Service_TDSSSERV.SYS" not found!
Deletion of driver "Service_TDSSSERV.SYS" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\Legacy_TDSSSERV.SYS" not found!
Deletion of driver "Legacy_TDSSSERV.SYS" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\msqpdxserv.sys" not found!
Deletion of driver "msqpdxserv.sys" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\msqpdxserv" not found!
Deletion of driver "msqpdxserv" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TDSSserv.sys" not found!
Deletion of registry key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TDSSserv.sys" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\TDSSserv.sys" not found!
Deletion of registry key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\TDSSserv.sys" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\tdssserv" not found!
Deletion of registry key "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\tdssserv" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tdssserv" not found!
Deletion of registry key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tdssserv" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\tdssserv.sys" not found!
Deletion of registry key "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\tdssserv.sys" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\tdssserv.sys" not found!
Deletion of registry key "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\tdssserv.sys" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\tdssserv" not found!
Deletion of registry key "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\tdssserv" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_TDSSSERV" not found!
Deletion of registry key "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_TDSSSERV" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TDSSSERV" not found!
Deletion of registry key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TDSSSERV" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata" not found!
Deletion of registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "HKEY_LOCAL_MACHINE\SOFTWARE\tdss" not found!
Deletion of registry key "HKEY_LOCAL_MACHINE\SOFTWARE\tdss" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Completed script processing.

*******************

Finished! Terminate.







_____________________HJT_________________________

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:34, on 2009-01-29
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\NetWaiting\netWaiting.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ie/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.euro.dell.com/
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netWaiting.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1C11B948-582A-433F-A98D-A8C4D5CC64F2} (20-20 Technologies 3D Room Planner) - http://magnet.2020.net/virtualplanner/Core...yerAX_Win32.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Intel® PROSet/Wireless SSO Service (WLANKEEPER) - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

--
End of file - 7665 bytes

[AdvancedSetup]

How is the computer running now?

Are there still any signs of an infection?

Please run another round of updates and scan.

Update and Scan with Malwarebytes' Anti-Malware

• Start MalwareBytes AntiMalware (Vista users must Right click and choose RunAs Admin)
  
• Please DO NOT run MBAM in Safe Mode unless requested to, you MUST run it in normal Windows mode.
  
  • Update Malwarebytes' Anti-Malware
    
  • Select the Update tab
    
  • Click Update
• When the update is complete, select the Scanner tab
  
• Select Perform quick scan, then click Scan.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Be sure that everything is checked, and click Remove Selected.
  
• When completed, a log will open in Notepad. please copy and paste the log into your next reply
  • If you accidently close it, the log file is saved here and will be named like this:
    
  • C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt

Then RESTART the computer

AFTER the reboot run HJT Do a system scan and save a logfile
The post back NEW MBAM and HJT logs in that order please.

[seven stars]

Seems to be running fine. MBAM was clear anyway


____________________MBAM________________________

Malwarebytes' Anti-Malware 1.33
Database version: 1707
Windows 5.1.2600 Service Pack 3

2009-01-30 07:13:46
mbam-log-2009-01-30 (07-13-46).txt

Scan type: Quick Scan
Objects scanned: 54745
Time elapsed: 2 minute(s), 44 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)



____________________MBAM________________________


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 07:17, on 2009-01-30
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe
C:\Program Files\NetWaiting\netWaiting.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ie/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.euro.dell.com/
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netWaiting.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1C11B948-582A-433F-A98D-A8C4D5CC64F2} (20-20 Technologies 3D Room Planner) - http://magnet.2020.net/virtualplanner/Core...yerAX_Win32.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Intel® PROSet/Wireless SSO Service (WLANKEEPER) - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

--
End of file - 7706 bytes

[seven stars]

Whoops - meant "HJT" for the second log obviously. Still a bit tired...

[AdvancedSetup]

Okay, current logs look clean. Let's run one more tool again though to make sure.

Please download the following scanning tool. GMER
[indent]

• Open the zip file and copy the file gmer.exe to your Desktop.
  
• Double click on gmer.exe and run it.
  
• It may take a minute to load and become available.
  
• Do not make any changes. Click on the SCAN button and DO NOT use the computer while it's scanning.
  
• Once the scan is done click on the SAVE button and browse to your Desktop and save the file as GMER.LOG
  
• Zip up the GMER.LOG file and save it as gmerlog.zip and attach it to your reply post.
  
• DO NOT directly post this log into a reply. You MUST attach it as a .ZIP file.
  
• Click OK and quit the GMER program.

How To Use Compressed (Zipped) Folders in Windows XP
Compress and uncompress files (zip files) in Vista
[/indent]


Then update your Anti-Virus and do another Full Scan and let me know if it finds anything or not.