Lurch987

November 22, 2008

Never mind, figured it out.

Thanks.

November 21, 2008

Hey gang, I'm back with another one. I'm cleaning a friends computer and there's multiple users on this system. I cleaned as much as I can and 1 user's profile works great but another one's internet is slow.

It doesn't make sense to me so I did a HJT log.

Logfile of HijackThis v1.99.1

Scan saved at 7:16:32 PM, on 11/20/2008

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16735)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\LEXBCES.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\eHome\ehRecvr.exe

C:\WINDOWS\eHome\ehSched.exe

C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\system32\dllhost.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Picasa2\PicasaMediaDetector.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\WINDOWS\system32\lexpps.exe

C:\Program Files\Microsoft Location Finder\LocationFinder.exe

C:\Program Files\MSN Messenger\msnmsgr.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe

C:\Program Files\Sympatico Starter Kit\bin\confsvr.exe

C:\Program Files\Sympatico Starter Kit\bin\gbConMon.exe

C:\Program Files\Sympatico Starter Kit\bin\gbTask.exe

C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sympatico.ca/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;<local>

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.1121.2472\swg.dll (file missing)

O2 - BHO: MSN Search Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1082\en-ca\msntb.dll

O3 - Toolbar: MSN Search Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1082\en-ca\msntb.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\RunServices: [Gearbox Deferal Check] C:\Program Files\Sympatico Starter Kit\bin\gbdefer.exe

O4 - HKCU\..\Run: [Microsoft Location Finder] "C:\Program Files\Microsoft Location Finder\LocationFinder.exe"

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [Antivirus] C:\Program Files\MS Antivirus\MSA.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe

O8 - Extra context menu item: &MSN Search - res://C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1082\en-ca\msntb.dll/search.htm

O8 - Extra context menu item: &Search - ?p=ZKxdm098YYCA

O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll

O11 - Options group: [iNTERNATIONAL] International*

O16 - DPF: 6th Street Omaha Poker by pogo - http://game1.pogo.com/v/8.1.7.44/applet/om...omaha-en_US.cab

O16 - DPF: Aces Up! by pogo - http://game3.pogo.com/v/9.1.1.8/applet/aces/aces-en_US.cab

O16 - DPF: Addiction by pogo - http://game3.pogo.com/v/9.0.9.8/applet/add...ction-en_US.cab

O16 - DPF: Alibaba Slots - http://game3.pogo.com/v/9.1.1.20/applet/al...ibaba-en_US.cab

O16 - DPF: Bingo Luau by pogo - http://game1.pogo.com/v/8.1.0.30/applet/fr...bingo-en_US.cab

O16 - DPF: Blackjack by pogo - http://game3.pogo.com/v/9.0.9.8/applet/bla...kjack-en_US.cab

O16 - DPF: Blackjack Carnival by pogo - http://game1.pogo.com/v/8.1.1.1/applet/vbj...jack2-en_US.cab

O16 - DPF: Bowling by pogo - http://game1.pogo.com/v/8.1.2.14/applet/bo...wling-en_US.cab

O16 - DPF: Canasta by pogo - http://game1.pogo.com/v/8.1.7.44/applet/ca...nasta-en_US.cab

O16 - DPF: Dice City Roller by pogo - http://game3.pogo.com/v/9.0.9.8/applet/ytz/ytz-en_US.cab

O16 - DPF: Dice Derby by pogo - http://game1.pogo.com/v/8.1.4.1/applet/che...dflag-en_US.cab

O16 - DPF: Dominoes v2 by pogo - http://game3.pogo.com/v/9.0.1.14/applet/do...mino2-en_US.cab

O16 - DPF: Double Deuce Poker by pogo - http://game1.pogo.com/v/8.1.1.1/applet/vid...deuce-en_US.cab

O16 - DPF: Euchre by pogo - http://game3.pogo.com/v/9.1.1.1/applet/euc...uchre-en_US.cab

O16 - DPF: First Class Solitaire by pogo - http://game3.pogo.com/v/9.1.1.8/applet/fir...lass2-en_US.cab

O16 - DPF: Fortune Bingo by pogo - http://game3.pogo.com/v/9.1.1.1/applet/sup...bingo-en_US.cab

O16 - DPF: Harvest Mania by pogo - http://game1.pogo.com/v/8.1.1.1/applet/har...rvest-en_US.cab

O16 - DPF: Hearts by pogo - http://game3.pogo.com/v/8.1.7.44/applet/he...earts-en_US.cab

O16 - DPF: High Stakes Poker by pogo - http://game3.pogo.com/v/8.1.6.3/applet/dra...poker-en_US.cab

O16 - DPF: Hog Heaven Slots by pogo - http://game3.pogo.com/v/9.1.4.5/applet/fancy/fancy-en_US.cab

O16 - DPF: Jokers Wild Poker by pogo - http://game3.pogo.com/v/9.1.3.19/applet/vi...swild-en_US.cab

O16 - DPF: Jungle Gin by pogo - http://game3.pogo.com/v/9.1.1.1/applet/gin2/gin2-en_US.cab

O16 - DPF: Lost Temple Poker by pogo - http://game3.pogo.com/v/9.1.4.5/applet/mhp...poker-en_US.cab

O16 - DPF: Lottso by pogo - http://game1.pogo.com/applet-8.0.8.30/lott...ottso-en_US.cab

O16 - DPF: Mah Jong Garden by pogo - http://game3.pogo.com/v/9.1.4.5/applet/mah...jong2-en_US.cab

O16 - DPF: Makeover Madness by pogo - http://game1.pogo.com/v/8.1.7.44/applet/sh...shoes-en_US.cab

O16 - DPF: Pai Gow by pogo - http://game1.pogo.com/v/8.1.1.1/applet/pai...aigow-en_US.cab

O16 - DPF: Perfect Pair Solitaire by pogo - http://game1.pogo.com/v/8.1.1.1/applet/wat...wheel-en_US.cab

O16 - DPF: Phlinx by pogo - http://game1.pogo.com/applet-8.0.9.41/flin...inger-en_US.cab

O16 - DPF: Pop Fu by pogo - http://game1.pogo.com/applet-8.0.8.30/popfu/popfu-en_US.cab

O16 - DPF: Poppit by pogo - http://game3.pogo.com/v/9.1.3.19/applet/po...ppit2-en_US.cab

O16 - DPF: Quick Quack by pogo - http://game3.pogo.com/v/9.1.1.8/applet/hot...treak-en_US.cab

O16 - DPF: Shuffle Bump by pogo - http://game1.pogo.com/applet-8.0.8.30/puck/puck-en_US.cab

O16 - DPF: Spider Solitaire by pogo - http://game1.pogo.com/applet-8.0.8.30/spid...pider-en_US.cab

O16 - DPF: Squelchies by pogo - http://game3.pogo.com/v/9.1.1.1/applet/squ...chies-en_US.cab

O16 - DPF: Sweet Tooth 2 by Pogo - http://game1.pogo.com/v/8.1.6.21/applet/sw...ooth2-en_US.cab

O16 - DPF: Texas Hold'em Poker by pogo - http://game3.pogo.com/v/9.1.5.8/applet/hol...oldem-en_US.cab

O16 - DPF: Thousand Island Solitaire by pogo - http://game3.pogo.com/v/9.1.1.8/applet/mil...lbrae-en_US.cab

O16 - DPF: Tri-Peaks by pogo - http://game3.pogo.com/v/9.1.1.1/applet/peaks/peaks-en_US.cab

O16 - DPF: Turbo 21 v2 by pogo - http://game3.pogo.com/v/9.1.1.8/applet/tur...rbo22-en_US.cab

O16 - DPF: Vaults of Atlantis Slots by pogo - http://game3.pogo.com/v/9.1.1.1/applet/mls...slots-en_US.cab

O16 - DPF: Video Poker by pogo - http://game1.pogo.com/v/8.1.1.1/applet/vid...poker-en_US.cab

O16 - DPF: Wonderland Memories by pogo - http://game3.pogo.com/v/9.0.8.20/applet/me...ories-en_US.cab

O16 - DPF: Word Search Daily by pogo - http://game1.pogo.com/v/8.1.8.23/applet/wo...earch-en_US.cab

O16 - DPF: Word Whomp Whackdown by pogo - http://game1.pogo.com/v/8.1.7.44/applet/wh...kdown-en_US.cab

O16 - DPF: World Class Solitaire by pogo - http://game3.pogo.com/v/9.0.8.20/applet/wo...class-en_US.cab

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab

O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/Facebo...toUploader3.cab

O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo...otoUploader.cab

O16 - DPF: {615F158E-D5CA-422F-A8E7-F6A5EED7063B} (Bejeweled Control) - http://www.worldwinner.com/games/v45/bejeweled/bejeweled.cab

O16 - DPF: {76716694-EADA-4810-8C3B-4826328A317F} (SmartCouponPrinter Control) - http://content.dll1.com/Connectus/SmartCou...ter20080208.cab

O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab

O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)

O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

September 23, 2008

Thank you!

September 22, 2008

Monday, September 22, 2008

Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)

Kaspersky Online Scanner 7 version: 7.0.25.0

Program database last update: Sunday, September 21, 2008 17:55:35

Records in database: 1248303

Scan settings

Scan using the following database extended

Scan archives yes

Scan mail databases yes

Scan area My Computer

A:\

C:\

D:\

E:\

Scan statistics

Files scanned 167495

Threat name 0

Infected objects 0

Suspicious objects 0

Duration of the scan 04:56:35

No malware has been detected. The scan area is clean.

The selected area was scanned.

September 19, 2008

Here it is again.

ComboFix 08-09-16.05 - Owner 2008-09-19 0:05:08.3 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.159 [GMT -4:00]

Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe

Command switches used :: C:\Documents and Settings\Owner\Desktop\CFScript.txt

* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\WINDOWS\system32\iuujefha.dll

C:\WINDOWS\system32\mgwlun.dll

C:\WINDOWS\system32\qdoahcie.dll

C:\WINDOWS\system32\qsxjef.dll

.

((((((((((((((((((((((((( Files Created from 2008-08-19 to 2008-09-19 )))))))))))))))))))))))))))))))

.

2100-02-16 16:09 . 2001-02-16 15:37 62 --a------ C:\WINDOWS\system32\LXBOUSCI.INI

2008-09-18 22:10 . 2008-09-18 22:10 <DIR> d-------- C:\_OTMoveIt

2008-09-08 08:23 . 2008-09-08 08:23 <DIR> d-------- C:\Program Files\HGTV Landscapes Screensaver

2008-09-05 07:57 . 2008-09-05 07:57 <DIR> d-------- C:\Live! Cam

2008-09-01 20:47 . 2008-09-01 20:48 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\muvee Technologies

2008-09-01 20:41 . 2008-09-01 20:43 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Creative

2008-09-01 20:34 . 2003-06-12 23:25 7,062 --a------ C:\WINDOWS\system32\audiopid.vxd

2008-09-01 20:32 . 2007-06-14 09:52 90,112 --a------ C:\WINDOWS\CtDrvIns.exe

2008-09-01 20:32 . 2007-03-02 14:30 670 -ra------ C:\WINDOWS\CtDrvIns.exe.manifest

2008-09-01 20:31 . 2008-04-13 20:12 53,760 --a------ C:\WINDOWS\system32\vfwwdm32.dll

2008-09-01 20:31 . 2008-04-13 20:12 53,760 --a--c--- C:\WINDOWS\system32\dllcache\vfwwdm32.dll

2008-09-01 20:31 . 2005-07-07 01:07 36,864 --a------ C:\WINDOWS\system32\CtCamMgr.dll

2008-09-01 20:31 . 2007-03-28 01:01 20,480 --a------ C:\WINDOWS\system32\V0350Srv.exe

2008-09-01 20:30 . 2006-08-30 07:10 158,456 --a------ C:\WINDOWS\system32\pxwma.dll

2008-09-01 20:30 . 2006-08-30 07:10 36,528 --a------ C:\WINDOWS\system32\drivers\PxHelp20.sys

2008-09-01 20:30 . 2006-08-30 07:10 2,560 --a------ C:\WINDOWS\system32\drivers\cdralw2k.sys

2008-09-01 20:30 . 2006-08-30 07:10 2,432 --a------ C:\WINDOWS\system32\drivers\cdr4_xp.sys

2008-09-01 20:29 . 2008-09-01 20:29 <DIR> d-------- C:\Program Files\muvee Technologies

2008-09-01 20:29 . 2008-09-01 20:29 <DIR> d-------- C:\Program Files\Common Files\muvee Technologies

2008-09-01 20:28 . 2008-09-01 20:28 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\muvee Technologies

2008-09-01 20:28 . 2008-04-13 14:45 60,032 --a------ C:\WINDOWS\system32\drivers\USBAUDIO.sys

2008-09-01 20:28 . 2008-04-13 14:45 60,032 --a--c--- C:\WINDOWS\system32\dllcache\usbaudio.sys

2008-09-01 20:27 . 2008-04-13 14:45 32,128 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys

2008-09-01 20:27 . 2008-04-13 14:45 32,128 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys

2008-09-01 20:26 . 2008-09-01 20:26 <DIR> d-------- C:\Program Files\SightSpeed

2008-09-01 20:21 . 2006-08-29 04:11 1,047,552 --a------ C:\WINDOWS\system32\MFC71u.dll

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-09-19 01:50 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP

2008-09-16 22:02 --------- d-----w C:\Program Files\SpywareBlaster

2008-09-16 12:30 --------- d-----w C:\Program Files\a-squared Free

2008-09-13 02:49 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll

2008-09-10 12:42 --------- d-----w C:\Documents and Settings\Owner\Application Data\LimeWire

2008-09-08 14:58 --------- d--h--w C:\Program Files\InstallShield Installation Information

2008-09-07 16:24 --------- d-----w C:\Documents and Settings\Owner\Application Data\Apple Computer

2008-09-07 11:08 --------- d-----w C:\Program Files\Apple Software Update

2008-09-05 12:01 --------- d-----w C:\Program Files\Creative

2008-09-02 00:43 --------- d-----w C:\Documents and Settings\Owner\Application Data\Creative

2008-08-29 23:51 --------- d-----w C:\Program Files\Spybot - Search & Destroy

2008-08-29 19:57 97,928 ----a-w C:\WINDOWS\system32\drivers\avgldx86.sys

2008-08-21 08:52 3,299,840 ----a-w C:\WINDOWS\system32\drivers\ati2mtag.sys

2008-08-21 06:19 425,984 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll

2008-08-21 06:18 314,880 ----a-w C:\WINDOWS\system32\ati2dvag.dll

2008-08-21 06:08 184,320 ----a-w C:\WINDOWS\system32\atipdlxx.dll

2008-08-21 06:08 143,360 ----a-w C:\WINDOWS\system32\Oemdspif.dll

2008-08-21 06:07 43,520 ----a-w C:\WINDOWS\system32\ati2edxx.dll

2008-08-21 06:07 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe

2008-08-21 06:07 143,360 ----a-w C:\WINDOWS\system32\ati2evxx.dll

2008-08-21 06:05 573,440 ----a-w C:\WINDOWS\system32\ati2evxx.exe

2008-08-21 06:04 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL

2008-08-21 06:01 10,084,352 ----a-w C:\WINDOWS\system32\atioglxx.dll

2008-08-21 05:55 4,094,560 ----a-w C:\WINDOWS\system32\ati3duag.dll

2008-08-21 05:50 307,200 ----a-w C:\WINDOWS\system32\atiiiexx.dll

2008-08-21 05:38 2,377,856 ----a-w C:\WINDOWS\system32\ativvaxx.dll

2008-08-21 05:23 48,640 ----a-w C:\WINDOWS\system32\amdpcom32.dll

2008-08-21 05:19 380,928 ----a-w C:\WINDOWS\system32\atikvmag.dll

2008-08-21 05:18 37,376 ----a-w C:\WINDOWS\system32\atiadlxx.dll

2008-08-21 05:18 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll

2008-08-21 05:17 53,248 ----a-w C:\WINDOWS\system32\drivers\ati2erec.dll

2008-08-21 05:17 253,952 ----a-w C:\WINDOWS\system32\atiok3x2.dll

2008-08-21 05:11 561,152 ----a-w C:\WINDOWS\system32\ati2cqag.dll

2008-08-19 07:01 --------- d-----w C:\Program Files\Microsoft Silverlight

2008-08-15 04:22 --------- d-----w C:\Documents and Settings\Owner\Application Data\Windows Search

2008-08-15 02:36 --------- d-----w C:\Documents and Settings\Owner\Application Data\Windows Desktop Search

2008-08-15 02:35 --------- d-----w C:\Program Files\Windows Desktop Search

2008-08-12 00:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy

2008-08-06 13:11 --------- d-----w C:\Program Files\Java

2008-08-06 01:14 90,112 ----a-w C:\WINDOWS\system32\ATIBRTMON.EXE

2008-07-19 02:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll

2008-07-19 02:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe

2008-07-19 02:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll

2008-07-19 02:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll

2008-07-19 02:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll

2008-07-19 02:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll

2008-07-19 02:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll

2008-07-19 02:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll

2008-07-19 02:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll

2008-07-19 02:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll

2008-07-07 20:26 253,952 ----a-w C:\WINDOWS\system32\es.dll

2008-07-04 13:24 10,520 ----a-w C:\WINDOWS\system32\avgrsstx.dll

2008-07-04 07:48 9,490,432 ----a-w C:\WINDOWS\system32\atioglx2.dll

2008-06-24 22:12 295,936 ----a-w C:\WINDOWS\system32\wmpeffects.dll

2008-06-24 16:43 74,240 ----a-w C:\WINDOWS\system32\mscms.dll

2008-06-23 16:57 826,368 ----a-w C:\WINDOWS\system32\wininet.dll

2008-06-20 17:46 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll

2007-06-11 22:15 50 --sh--r C:\Program Files\Common Files\desSktop.ini

2007-01-16 03:07 299 ----a-w C:\Documents and Settings\Owner\Application Data\internaldb1942.dat

2006-06-03 00:17 167,064 ----a-w C:\Program Files\custom.dat

2006-06-03 00:17 0 -c--a-w C:\Program Files\landgen.log

2006-06-02 23:50 0 -c--a-w C:\Program Files\rew2.log

2006-02-07 22:15 774,144 ----a-w C:\Program Files\RngInterstitial.dll

2005-02-05 22:51 1,638 ----a-w C:\Program Files\INSTALL.LOG

2005-01-25 14:05 512,103 ----a-w C:\Program Files\StarterSetup.exe

2004-10-27 21:43 249,608 ----a-w C:\Program Files\Uninst.isu

2002-06-04 10:06 65,536 ------w C:\WINDOWS\inf\copyinf.exe

1999-05-26 16:23 70,541 -c--a-w C:\Program Files\readme.rtf

1999-05-26 16:23 3,265,024 ----a-w C:\Program Files\wa.exe

1999-04-26 18:29 83,456 ------r C:\Program Files\DirectX2D.dll

1999-04-26 18:28 240,128 ------r C:\Program Files\DXMfc.dll

1999-04-26 18:28 10,240 ------r C:\Program Files\DirectSound.dll

1999-03-31 17:00 2,257,920 ------w C:\Program Files\HSBRCiv.exe

1999-03-29 17:48 34,304 ------r C:\Program Files\lfbmp10N.dll

1999-03-29 17:48 31,744 ------r C:\Program Files\lflmb10N.dll

1999-03-29 17:48 297,984 ------r C:\Program Files\ltkrn10N.dll

1999-03-29 17:48 27,648 ------r C:\Program Files\lftga10N.dll

1999-03-29 17:48 269,312 ------r C:\Program Files\LFCMP10N.DLL

1999-03-29 17:48 105,472 ------r C:\Program Files\ltfil10N.DLL

1999-01-09 16:42 132,608 ------r C:\Program Files\Landgen.exe

1998-12-23 14:06 9,304 ------r C:\Program Files\thm01309.dat

1998-12-23 14:06 9,304 ------r C:\Program Files\thm01308.dat

1998-12-23 14:06 9,304 ------r C:\Program Files\thm01307.dat

1998-12-23 14:06 9,304 ------r C:\Program Files\thm01306.dat

1998-12-23 14:06 9,304 ------r C:\Program Files\thm01305.dat

1998-12-23 14:06 9,304 ------r C:\Program Files\thm01304.dat

1998-12-23 14:06 9,304 ------r C:\Program Files\thm01303.dat

1998-12-23 14:06 9,304 ------r C:\Program Files\thm01302.dat

1998-05-12 00:01 954,128 ------r C:\Program Files\MFC42.DLL

1998-05-12 00:01 280,576 ------r C:\Program Files\MSVCRT.DLL

2008-06-14 07:09 16,384 --sha-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat

2008-06-14 07:09 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat

2008-06-14 07:08 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008061420080615\index.dat

2008-06-14 07:09 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 15360]

"Creative Live! Cam Manager"="C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe" [2007-06-07 155648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]

"KBD"="C:\HP\KBD\KBD.EXE" [2001-07-07 61440]

"WCOLOREAL"="C:\Program Files\COMPAQ\Coloreal\coloreal.exe" [2002-02-20 143360]

"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2002-09-14 212992]

"PS2"="C:\WINDOWS\system32\ps2.exe" [2002-08-01 81920]

"Lexmark X84-X85 Button Monitor"="C:\PROGRA~1\LEXMAR~1\ACMonitor_X84-X85.exe" [2003-01-08 40960]

"Lexmark X84-X85 Button Manager"="C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X84-X85.exe" [2002-09-04 53248]

"PrinTray"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe" [2002-09-18 36864]

"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]

"SecurDisc"="C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe" [2007-05-15 1628208]

"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2006-11-23 56928]

"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-08-29 1235736]

"V0350Mon.exe"="C:\WINDOWS\V0350Mon.exe" [2007-08-23 28672]

"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]

C:\Documents and Settings\Owner\Start Menu\Programs\Startup\

SpywareGuard.lnk - C:\Program Files\SpywareGuard\sgmain.exe [2003-08-29 360448]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"C:\\WINDOWS\\system32\\rtcshare.exe"=

"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"C:\\Program Files\\LimeWire\\LimeWire.exe"=

"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

"C:\\Program Files\\SightSpeed\\SightSpeed.exe"=

.

Contents of the 'Scheduled Tasks' folder

.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-09-19 00:13:46

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

Completion time: 2008-09-19 0:29:52

ComboFix-quarantined-files.txt 2008-09-19 04:29:38

ComboFix2.txt 2008-09-19 03:27:06

ComboFix3.txt 2008-09-19 00:58:06

Pre-Run: 7,632,138,240 bytes free

Post-Run: 7,614,627,840 bytes free

200 --- E O F --- 2008-09-10 07:07:00

Logfile of HijackThis v1.99.1

Scan saved at 00:36, on 2008-09-19

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16705)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

C:\WINDOWS\system32\spoolsv.exe

C:\windows\system\hpsysdrv.exe

C:\HP\KBD\KBD.EXE

C:\PROGRA~1\LEXMAR~1\ACMonitor_X84-X85.exe

C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe

C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

C:\PROGRA~1\AVG\AVG8\avgtray.exe

C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

C:\WINDOWS\V0350Mon.exe

C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\system32\CTsvcCDA.exe

C:\Program Files\SpywareGuard\sgmain.exe

C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe

C:\Program Files\CyberLink\Shared Files\RichVideo.exe

C:\Program Files\SpywareGuard\sgbhp.exe

C:\WINDOWS\System32\svchost.exe

C:\PROGRA~1\AVG\AVG8\avgrsx.exe

C:\WINDOWS\system32\SearchIndexer.exe

C:\PROGRA~1\AVG\AVG8\avgemc.exe

C:\WINDOWS\system32\notepad.exe

C:\WINDOWS\explorer.exe

C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nbc.ca/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll

O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe

O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE

O4 - HKLM\..\Run: [WCOLOREAL] "C:\Program Files\COMPAQ\Coloreal\coloreal.exe"

O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE

O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe

O4 - HKLM\..\Run: [Lexmark X84-X85 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X84-X85.exe

O4 - HKLM\..\Run: [Lexmark X84-X85 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X84-X85.exe

O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [securDisc] C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe

O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"

O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe

O4 - HKLM\..\Run: [V0350Mon.exe] C:\WINDOWS\V0350Mon.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Creative Live! Cam Manager] "C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe"

O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Owner\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll

O11 - Options group: [iNTERNATIONAL] International*

O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/dow...llerControl.cab

O16 - DPF: RaptisoftGameLoader - http://www.arcadetown.com/swf/hamsterball/...tgameloader.cab

O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/Facebo...toUploader5.cab

O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://pcpitstop.com/pcpitstop/PCPitStop.CAB

O16 - DPF: {17D667BA-5675-4AAB-9221-08B9379384D4} (Image Uploader Control) - http://cdnimg.piczo.com/images/uploader/pi...st_uploader.cab

O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab

O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photos.walmart.com/WalmartActivia.cab

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab

O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-CA/a-UNO1/GAME_UNO1.cab

O16 - DPF: {639658F3-B141-4D6B-B936-226F75A5EAC3} (CPlayFirstDinerDash2Control Object) - http://www.shockwave.com/content/dinerdash...h2.1.0.0.67.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1171635541706

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1171647865140

O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.photolab.ca/Upload/ImageUploader4.cab

O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab

O16 - DPF: {BAE1D8DF-0B35-47E3-A1E7-EEB3FF2ECD19} (CPlayFirstddfotgControl Object) -

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O16 - DPF: {CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0_01) -

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O16 - DPF: {DA758BB1-5F89-4465-975F-8D7179A4BCF3} (WheelofFortune Object) - http://messenger.zone.msn.com/binary/WoF.cab57176.cab

O16 - DPF: {F137B9BA-89EA-4B04-9C67-2074A9DF61FD} (Photo Upload Plugin Class) - http://walmart.pnimedia.com/upload/activex...upv2.0.0.10.cab?

O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupdate/su2...15105/CTPID.cab

O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)

O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - c:\program files\a-squared free\a2service.exe

O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe

O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe

O23 - Service: Content Monitoring Tool (msCMTSrvc) - Unknown owner - C:\WINDOWS\system32\msCMTSrvc.exe (file missing)

O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

September 19, 2008

There's no log there because it didn't finish.

Anyway, I tried ComboFix again and it worked. Here's the log along with a new HJT.

ComboFix 08-09-16.05 - Owner 2008-09-18 22:55:12.2 - NTFSx86

Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe

Command switches used :: C:\Documents and Settings\Owner\Desktop\CFScript.txt

* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\WINDOWS\system32\wDeeKkkj.ini

C:\WINDOWS\system32\wDeeKkkj.ini2

.

((((((((((((((((((((((((( Files Created from 2008-08-19 to 2008-09-19 )))))))))))))))))))))))))))))))

.

2100-02-16 16:09 . 2001-02-16 15:37 62 --a------ C:\WINDOWS\system32\LXBOUSCI.INI

2008-09-18 22:10 . 2008-09-18 22:10 <DIR> d-------- C:\_OTMoveIt

2008-09-18 21:03 . 2008-09-18 21:03 137,344 --a------ C:\WINDOWS\system32\qdoahcie.dll

2008-09-18 21:03 . 2008-09-18 21:03 137,344 --a------ C:\WINDOWS\system32\mgwlun.dll

2008-09-18 21:01 . 2008-09-18 21:01 137,344 --a------ C:\WINDOWS\system32\qsxjef.dll

2008-09-18 21:01 . 2008-09-18 21:01 137,344 --a------ C:\WINDOWS\system32\iuujefha.dll