Malware Infected Machine.. Hijack Log, Thanks For Your Help[RESOLVED]

arojas4570 · May 21, 2008

Hi there.. I humbly request your help in fixing my machine that was infected horribly. I installed a stupid program called PowerISO and another called "super internet tv". Ever since my IE is running incredibly slow. When I try to google, I get sent to a site called antispywaremaster.com. A rogue application called utorrent.upx was executing some garbage upon boot up. It looks like I was able to remove the utorrent.upx but the worst problem I am having is that my Windows Updates are disabled and greyed out! Please help and thank you in advanced. I've run adaware and Symantec Antivirus but no resolution as of yet. Here is the Hijack log.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 12:58:48 AM, on 5/21/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16640)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe

C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe

C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe

C:\Program Files\Symantec AntiVirus\DefWatch.exe

C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

C:\Program Files\lotus\notes\ntmulti.exe

C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\PROGRA~1\SYMANT~1\VPTray.exe

C:\Program Files\Common Files\AOL\1156821003\ee\AOLSoftware.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Pinnacle\Drivers\pctvsvc.exe

C:\Program Files\Common Files\AOL\Loader\aolload.exe

C:\WINDOWS\system32\IoctlSvc.exe

C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe

C:\WINDOWS\system32\PnkBstrA.exe

C:\WINDOWS\system32\taskswitch.exe

C:\WINDOWS\system32\LVCOMSX.EXE

C:\Program Files\Logitech\Video\LogiTray.exe

C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

c:\program files\common files\aol\1156821003\ee\services\antiSpywareApp\ver2_0_32_1\AOLSP Scheduler.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe

C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe

C:\WINDOWS\system32\CTHELPER.EXE

C:\Program Files\Brother\ControlCenter3\brccMCtl.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Symantec AntiVirus\Rtvscan.exe

C:\Program Files\Logitech\Video\FxSvr2.exe

C:\Program Files\TVersity\Media Server\MediaServer.exe

C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe

C:\Program Files\Brother\Brmfcmon\BrMfimon.exe

C:\Program Files\MSN Messenger\MsnMsgr.Exe

C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE

C:\Program Files\Citrix\GoToMeeting\198\g2mstart.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Citrix\GoToMeeting\198\g2mcomm.exe

C:\Program Files\TechSmith\SnagIt 8\SnagIt32.exe

C:\Program Files\Citrix\GoToMeeting\198\g2mlauncher.exe

C:\Program Files\Common Files\AOL\1156821003\EE\AOLDesktop.exe

C:\Program Files\Common Files\AOL\Loader\aolload.exe

C:\Program Files\TechSmith\SnagIt 8\TSCHelp.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

C:\Program Files\Common Files\AOL\1156821003\EE\aolsoftware.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe

C:\WINDOWS\explorer.exe

C:\Program Files\America Online 9.0\waol.exe

C:\Program Files\America Online 9.0\shellmon.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 8\SnagItBHO.dll

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {65193335-DC04-4110-94E7-228FAE5D5470} - C:\WINDOWS\system32\fccaxxuu.dll (file missing)

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll

O2 - BHO: (no name) - {E23136A1-1AC4-4D1B-926F-5D537CFFF359} - C:\WINDOWS\system32\awtrSjhf.dll

O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll

O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe

O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1156821003\ee\AOLSoftware.exe

O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe

O4 - HKLM\..\Run: [Pure Networks Port Magic] "C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" -Run

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"

O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\system32\taskswitch.exe

O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE

O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe

O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [sSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot

O4 - HKLM\..\Run: [PaperPort PTD] "C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe"

O4 - HKLM\..\Run: [indexSearch] "C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe"

O4 - HKLM\..\Run: [PPort11reminder] "C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe" -r "C:\Documents and Settings\All Users\Application Data\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini

O4 - HKLM\..\Run: [brMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN

O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun

O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"

O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"

O4 - HKLM\..\Run: [VTTimer] VTTimer.exe

O4 - HKLM\..\Run: [updReg] C:\WINDOWS\UpdReg.EXE

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"

O4 - HKLM\..\Run: [DevconDefaultDB] C:\WINDOWS\READREG /PSCONV={NO} /NO_DEFPS

O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

O4 - HKLM\..\RunOnce: [spybot - Search & Destroy] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck

O4 - HKLM\..\RunOnce: [spybotDeletingA6058] command /c del "C:\WINDOWS\system32\fccaxxuu.dll_old"

O4 - HKLM\..\RunOnce: [spybotDeletingC8342] cmd /c del "C:\WINDOWS\system32\fccaxxuu.dll_old"

O4 - HKLM\..\RunOnce: [spybotDeletingA2093] command /c del "C:\WINDOWS\system32\fccaxxuu.dll_old"

O4 - HKLM\..\RunOnce: [spybotDeletingC8511] cmd /c del "C:\WINDOWS\system32\fccaxxuu.dll_old"

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"

O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"

O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot

O4 - HKCU\..\Run: [GoToMeeting] C:\Program Files\Citrix\GoToMeeting\198\g2mstart.exe "/Trigger RunAtLogon"

O4 - HKCU\..\Run: [setDefaultMIDI] MIDIDef.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\RunOnce: [spybotDeletingB54] command /c del "C:\WINDOWS\system32\fccaxxuu.dll_old"

O4 - HKCU\..\RunOnce: [spybotDeletingD1684] cmd /c del "C:\WINDOWS\system32\fccaxxuu.dll_old"

O4 - Startup: AOL Desktop.lnk = C:\Program Files\Common Files\AOL\Launch\aollaunch.exe

O4 - Global Startup: BlueSoleil.lnk = ?

O4 - Global Startup: SnagIt 8.lnk = C:\Program Files\TechSmith\SnagIt 8\SnagIt32.exe

O8 - Extra context menu item: &Search - ?p=ZUzeb004NYUS_ZUxdm080NUUS

O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL

O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL

O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O15 - Trusted Zone: http://*.win2k8

O16 - DPF: {1D9EFA3B-4E85-41A8-9092-14012CD447C9} (NetCamPlayerWeb Control) - http://192.168.2.175/img/NetCamPlayerWeb.ocx

O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.2.100.cab

O16 - DPF: {6022B0FE-B1BD-4306-9A21-E5C8171DDB3E} (CSMProviderEnv Class) - http://192.168.3.249/edgesight40/app/smgr/...ads/CSMCore.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1156806161841

O16 - DPF: {85D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin class) - http://secure2.comned.com/signuptemplates/...login-devel.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O20 - Winlogon Notify: awtrSjhf - C:\WINDOWS\SYSTEM32\awtrSjhf.dll

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe

O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe

O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe

O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Multi-user Cleanup Service - IBM Corp - C:\Program Files\lotus\notes\ntmulti.exe

O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PCTV Service (pctvsvc) - Pinnacle Systems Inc. - C:\Program Files\Pinnacle\PCTV To Go Setup Wizard\..\Drivers\pctvsvc.exe

O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe

O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe

O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe

O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe

O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe

O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe

O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe

O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe

O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

O23 - Service: TVersityMediaServer - Unknown owner - C:\Program Files\TVersity\Media Server\MediaServer.exe

--

End of file - 18058 bytes

Andro1d · May 23, 2008

Hello and Welcome to BT.

I am MoNsTeReNeRgY22 and I will be assisting you with your malware problem today.

Sorry for the delay!

Please visit this web page for instructions for downloading and running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

This includes installing the Windows XP Recovery Console in case you have not installed it yet.

For more information on the Windows XP Recovery Console read http://support.microsoft.com/kb/314058.

Once you install the Recovery Console, when you reboot your computer, you'll see the option for the Recovery Console now as well. Don't select Recovery Console as we don't need it. By default, your main OS is selected there. The screen stays for 2 seconds and then it proceeds to load Windows. That is normal.

Once you have finished installing the Windows Recovery Console, please continue with the rest of the tutorial at the above link.

Post the log from ComboFix when you've accomplished that, along with a new HijackThis log.

arojas4570 · May 23, 2008

Thank you for all your help. Here is the Combo and new HijackThis file. Please let me know if you need any other info.

Alex

CoboFix:

ComboFix 08-05-21.3 - Alex Rojas 2008-05-23 0:20:55.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1330 [GMT -4:00]

Running from: C:\Documents and Settings\Alex Rojas\Desktop\ComboFix.exe

Command switches used :: C:\Documents and Settings\Alex Rojas\Desktop\WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

* Created a new restore point

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\WINDOWS\BMd35cca40.xml

C:\WINDOWS\cookies.ini

C:\WINDOWS\pskt.ini

C:\WINDOWS\system32\ajpmigig.dll

C:\WINDOWS\system32\ckigbxrv.dll

C:\WINDOWS\system32\cvbkrwym.ini

C:\WINDOWS\system32\eeulyoup.dll

C:\WINDOWS\system32\egnbfhmf.exe

C:\WINDOWS\system32\gigimpja.ini

C:\WINDOWS\system32\hwcljvjs.dll

C:\WINDOWS\system32\iifcDWmK.dll

C:\WINDOWS\system32\ivhjreoy.dll

C:\WINDOWS\system32\KmWDcfii.ini

C:\WINDOWS\system32\KmWDcfii.ini2

C:\WINDOWS\system32\LSYxaGgh.ini

C:\WINDOWS\system32\LSYxaGgh.ini2

C:\WINDOWS\system32\ojsktsgt.ini

C:\WINDOWS\system32\qaerqepv.exe

C:\WINDOWS\system32\qrYbHRqr.ini

C:\WINDOWS\system32\qrYbHRqr.ini2

C:\WINDOWS\system32\taqqyyie.dll

C:\WINDOWS\system32\uuxxaccf.ini

C:\WINDOWS\system32\uuxxaccf.ini2

C:\WINDOWS\system32\vrxbgikc.ini

C:\WINDOWS\system32\wynufidp.exe

C:\WINDOWS\system32\ybhpbywq.dll

.

((((((((((((((((((((((((( Files Created from 2008-04-23 to 2008-05-23 )))))))))))))))))))))))))))))))

.

2008-05-22 00:34 . 2008-05-22 00:34 400,733 --a------ C:\WINDOWS\system32\nwiz.rar

2008-05-20 23:47 . 2008-05-20 23:47 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy

2008-05-20 23:47 . 2008-05-21 01:04 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy

2008-05-20 22:06 . 2008-05-20 22:17 <DIR> d-------- C:\VundoFix Backups

2008-05-20 02:15 . 2008-05-20 02:15 <DIR> d-------- C:\Program Files\Lavasoft

2008-05-20 02:15 . 2008-05-20 02:16 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft

2008-05-20 02:10 . 2008-05-20 02:10 <DIR> d-------- C:\Program Files\Trend Micro

2008-05-20 00:18 . 2008-05-20 00:18 <DIR> d-------- C:\temp\sixaxis

2008-05-20 00:10 . 2008-05-20 01:36 <DIR> d-------- C:\Program Files\Super Internet TV

2008-05-20 00:09 . 2008-05-20 00:14 <DIR> d-------- C:\temp\Super.Internet.TV.7.2-NEW

2008-05-20 00:09 . 2008-05-20 00:09 56,320 --a------ C:\WINDOWS\system32\awtrSjhf.dll

2008-05-14 00:47 . 2008-05-14 00:47 <DIR> d-------- C:\Program Files\VSO

2008-05-14 00:47 . 2008-05-14 00:50 <DIR> d-------- C:\Documents and Settings\Alex Rojas\Application Data\Vso

2008-05-14 00:47 . 2004-05-04 11:53 1,645,320 --a------ C:\WINDOWS\gdiplus.dll

2008-05-14 00:47 . 2006-05-20 16:16 1,184,984 --a------ C:\WINDOWS\system32\wvc1dmod.dll

2008-05-14 00:47 . 2006-05-11 19:21 626,688 --a------ C:\WINDOWS\system32\vp7vfw.dll

2008-05-14 00:47 . 2006-09-29 12:24 217,127 --a------ C:\WINDOWS\system32\drv43260.dll

2008-05-14 00:47 . 2006-09-29 12:25 208,935 --a------ C:\WINDOWS\system32\drv33260.dll

2008-05-14 00:47 . 2006-09-29 12:26 176,165 --a------ C:\WINDOWS\system32\drv23260.dll

2008-05-14 00:47 . 2008-05-14 00:47 87,608 --a------ C:\Documents and Settings\Alex Rojas\Application Data\inst.exe

2008-05-14 00:47 . 2007-03-18 20:37 65,602 --a------ C:\WINDOWS\system32\cook3260.dll

2008-05-14 00:47 . 2008-05-14 00:47 47,360 --a------ C:\WINDOWS\system32\drivers\pcouffin.sys

2008-05-14 00:47 . 2008-05-14 00:47 47,360 --a------ C:\Documents and Settings\Alex Rojas\Application Data\pcouffin.sys

2008-05-13 23:24 . 2008-05-13 23:24 <DIR> d-------- C:\temp\PM8

2008-05-12 21:20 . 2008-05-12 21:20 <DIR> d-------- C:\Program Files\Common Files\Macrovision Shared

2008-05-12 21:20 . 2008-05-12 21:20 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\FLEXnet

2008-05-12 20:15 . 2008-05-12 20:38 <DIR> d-------- C:\Fraps

2008-05-12 20:15 . 2008-05-20 01:10 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP

2008-05-12 20:04 . 2008-05-12 20:04 <DIR> d-------- C:\Program Files\NeroInstall.bak

2008-05-12 20:00 . 2008-05-12 20:00 <DIR> d-------- C:\Documents and Settings\Alex Rojas\Application Data\Nero

2008-05-12 19:55 . 2008-05-12 19:58 <DIR> d-------- C:\Program Files\Common Files\Nero

2008-05-12 19:55 . 2008-05-12 19:55 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Nero

2008-05-12 19:33 . 2008-05-12 19:41 <DIR> d-------- C:\temp\nero8

2008-05-10 22:41 . 2008-05-10 22:45 227 --a------ C:\WINDOWS\RtlRack.ini

2008-05-10 00:59 . 2008-05-10 00:59 439 --a------ C:\temp\rarreg.zip

2008-05-10 00:58 . 2008-05-10 00:58 1,035,271 --a------ C:\temp\wrar362.exe

2008-04-27 18:20 . 2007-05-16 16:45 3,497,832 --a------ C:\WINDOWS\system32\d3dx9_34.dll

2008-04-27 18:20 . 2007-03-12 16:42 3,495,784 --a------ C:\WINDOWS\system32\d3dx9_33.dll

2008-04-27 18:20 . 2007-05-16 16:45 1,124,720 --a------ C:\WINDOWS\system32\D3DCompiler_34.dll

2008-04-27 18:20 . 2007-03-12 16:42 1,123,696 --a------ C:\WINDOWS\system32\D3DCompiler_33.dll

2008-04-27 18:20 . 2007-05-16 16:45 443,752 --a------ C:\WINDOWS\system32\d3dx10_34.dll

2008-04-27 18:20 . 2007-03-15 16:57 443,752 --a------ C:\WINDOWS\system32\d3dx10_33.dll

2008-04-27 18:20 . 2007-05-31 19:30 266,088 --a------ C:\WINDOWS\system32\xactengine2_8.dll

2008-04-27 18:20 . 2007-04-04 18:55 261,480 --a------ C:\WINDOWS\system32\xactengine2_7.dll

2008-04-27 18:20 . 2007-01-24 15:27 255,848 --a------ C:\WINDOWS\system32\xactengine2_6.dll

2008-04-27 18:20 . 2007-05-31 19:29 18,280 --a------ C:\WINDOWS\system32\x3daudio1_2.dll

2008-04-27 18:18 . 2008-04-27 18:18 22,328 --a------ C:\Documents and Settings\Alex Rojas\Application Data\PnkBstrK.sys

2008-04-27 18:18 . 2008-04-27 18:18 319 --a------ C:\WINDOWS\game.ini

2008-04-27 18:07 . 2008-04-27 18:07 <DIR> d-------- C:\Program Files\Activision

2008-04-26 20:51 . 2008-04-26 20:52 <DIR> d-------- C:\Program Files\Creative

2008-04-26 20:51 . 2002-06-14 13:49 10,194 --a------ C:\WINDOWS\system32\PFMODNT.SYS

2008-04-26 20:50 . 2008-04-26 20:50 24,451,404 --a------ C:\temp\LiveDrvUni-Pack(ENG).exe

2008-04-26 20:49 . 2008-04-26 20:49 6,465,104 --a------ C:\temp\LiveDrvPack_Patch.exe

2008-04-26 20:15 . 2001-08-17 12:19 3,712 --a------ C:\WINDOWS\system32\drivers\ctljystk.sys

2008-04-26 02:06 . 2008-05-19 00:54 <DIR> d-------- C:\temp\new NDS

2008-04-26 00:17 . 2008-04-26 00:17 <DIR> d-------- C:\Program Files\Winnydows

2008-04-25 00:23 . 2008-04-25 00:24 <DIR> d-------- C:\Documents and Settings\Alex Rojas\Application Data\PC-FAX TX

2008-04-24 17:59 . 2001-08-17 13:53 6,784 --a------ C:\WINDOWS\system32\drivers\serscan.sys

2008-04-24 17:59 . 2001-08-17 13:53 6,784 --a--c--- C:\WINDOWS\system32\dllcache\serscan.sys

2008-04-24 17:59 . 2008-04-25 01:03 1,187 --a------ C:\WINDOWS\Brpfx04a.ini

2008-04-24 17:59 . 2008-04-24 17:59 419 --a------ C:\WINDOWS\BRWMARK.INI

2008-04-24 17:59 . 2008-04-25 00:23 153 --a------ C:\WINDOWS\brpcfx.ini

2008-04-24 17:59 . 2008-04-24 17:59 50 --a------ C:\WINDOWS\system32\bridf07a.dat

2008-04-24 17:59 . 2008-04-24 17:59 27 --a------ C:\WINDOWS\BRPP2KA.INI

2008-04-24 17:58 . 2008-04-24 17:58 <DIR> d-------- C:\Program Files\Brother

2008-04-24 17:55 . 2008-04-24 17:55 <DIR> d-------- C:\Program Files\Nuance

2008-04-24 17:55 . 2006-10-24 15:34 31,567 --a------ C:\WINDOWS\maxlink.ini

2008-04-24 17:54 . 2008-04-24 17:54 <DIR> d-------- C:\Program Files\ScanSoft

2008-04-24 17:54 . 2008-04-24 17:54 <DIR> d-------- C:\Program Files\Common Files\ScanSoft Shared

2008-04-24 17:54 . 2008-04-24 17:55 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ScanSoft

2008-04-24 17:47 . 2008-04-24 17:47 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Brother

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-05-23 04:31 --------- d-----w C:\Program Files\Symantec AntiVirus

2008-05-23 03:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater

2008-05-20 06:15 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard

2008-05-20 05:27 --------- d-----w C:\Documents and Settings\Alex Rojas\Application Data\Azureus

2008-05-20 03:58 --------- d-----w C:\Program Files\Total Video Converter

2008-05-20 02:56 --------- d-----w C:\Program Files\Microsoft Silverlight

2008-05-19 01:36 --------- d-----w C:\Program Files\MSN Messenger

2008-05-16 03:16 --------- d-----w C:\Documents and Settings\Alex Rojas\Application Data\LimeWire

2008-05-14 02:31 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help

2008-05-13 23:16 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe

2008-05-13 23:16 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys

2008-05-13 23:16 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe

2008-05-13 01:09 --------- d-----w C:\Program Files\Common Files\Adobe

2008-05-12 23:55 --------- d-----w C:\Program Files\Nero

2008-05-12 23:43 --------- d-----w C:\Program Files\Common Files\Ahead

2008-05-11 02:26 --------- d-----w C:\Program Files\Zune

2008-04-27 22:18 --------- d--h--w C:\Program Files\InstallShield Installation Information

2008-04-26 15:04 --------- d-s---w C:\Program Files\Xfire

2008-04-26 05:36 --------- d-----w C:\Program Files\Replay Converter

2008-04-26 03:44 --------- d-----w C:\Documents and Settings\Alex Rojas\Application Data\Xfire

2008-04-23 01:25 --------- d-----w C:\Documents and Settings\All Users\Application Data\OrbNetworks

2008-04-19 19:25 --------- d-----w C:\Documents and Settings\All Users\Application Data\Bluetooth

2008-04-19 18:58 --------- d-----w C:\Program Files\IVT Corporation

2008-04-19 05:24 --------- d-----w C:\Program Files\Reference Assemblies

2008-04-17 23:34 --------- d-----w C:\Program Files\Azureus

2008-04-16 05:45 --------- d-----w C:\Program Files\BatchDPG

2008-04-05 04:59 --------- d-----w C:\Program Files\LimeWire

2008-04-04 21:31 41,296 ----a-w C:\WINDOWS\system32\xfcodec.dll

2008-04-03 23:24 --------- d-----w C:\Program Files\DOSBox-0.72

2008-04-03 01:30 --------- d-----w C:\Program Files\Matroska Pack

2008-04-02 04:53 --------- d-----w C:\Program Files\7-Zip

2008-04-02 03:07 --------- d-----w C:\Program Files\AviSynth 2.5

2008-04-02 03:06 --------- d-----w C:\Program Files\eRightSoft

2008-04-02 02:52 --------- d-----w C:\Documents and Settings\Alex Rojas\Application Data\Media Player Classic

2008-04-01 21:31 --------- d-----w C:\Program Files\TechSmith

2008-04-01 21:31 --------- d-----w C:\Documents and Settings\All Users\Application Data\TechSmith

2008-03-30 04:39 --------- d-----w C:\Program Files\Memorex exPressit Label Design Studio

2008-03-30 04:36 --------- d-----w C:\Program Files\Common Files\SureThing Shared

2008-03-27 08:12 151,583 ----a-w C:\WINDOWS\system32\msjint40.dll

2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys

2008-03-01 13:06 826,368 ----a-w C:\WINDOWS\system32\wininet.dll

2008-02-28 21:38 972,072 ----a-w C:\WINDOWS\UNNeroMediaHome.exe

2008-02-26 20:14 972,072 ----a-w C:\WINDOWS\UNRecode.exe

2008-02-25 06:29 2,293,848 ----a-w C:\Program Files\FLV PlayerFCSetup.exe

2008-02-25 06:28 737,280 ----a-w C:\WINDOWS\iun6002.exe

2008-02-25 06:28 411,248 ----a-w C:\Program Files\FLV PlayerRCSetup.exe

2008-02-25 06:28 3,955,352 ----a-w C:\Program Files\FLV PlayerRCATSetup.exe

2008-02-25 06:12 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE

2008-02-25 06:12 282,624 ----a-r C:\WINDOWS\Setup1.exe

2008-02-25 06:12 102,400 ----a-w C:\WINDOWS\system32\VB6STKIT.DLL

2007-05-21 02:12 630,784 ----a-w C:\Documents and Settings\Alex Rojas\GoToAssist_chat2way__317_en.exe

2007-03-15 21:37 56,912 ----a-w C:\Documents and Settings\Alex Rojas\g2mdlhlpx.exe

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{50064432-0C5A-404C-934F-19370F3F8AF4}]

C:\WINDOWS\system32\hgGaxYSL.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{65193335-DC04-4110-94E7-228FAE5D5470}]

C:\WINDOWS\system32\fccaxxuu.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{93CB77C9-282D-4D4A-9BE5-83D62D6B8FFA}]

C:\WINDOWS\system32\rqRHbYrq.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C69F5E00-7BF3-4565-B78C-6623F70DC1A8}]

2008-05-23 00:35 370688 --a------ C:\WINDOWS\system32\tuvWonMe.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E23136A1-1AC4-4D1B-926F-5D537CFFF359}]

2008-05-20 00:09 56320 --a------ C:\WINDOWS\system32\awtrSjhf.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 13:54 5674352]

"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE" [2004-02-03 17:42 401491]

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [ ]

"LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [2005-06-08 15:44 196608]

"GoToMeeting"="C:\Program Files\Citrix\GoToMeeting\198\g2mstart.exe" [2007-11-03 09:02 31816]

"SetDefaultMIDI"="MIDIDef.exe" [2002-01-14 14:42 61440 C:\WINDOWS\MIDIDEF.EXE]

"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 08:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"VTTrayp"="VTtrayp.exe" [2005-03-11 13:33 147456 C:\WINDOWS\system32\VTTrayp.exe]

"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2005-10-04 12:42 48752]

"vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2005-11-15 13:28 85744]

"HostManager"="C:\Program Files\Common Files\AOL\1156821003\ee\AOLSoftware.exe" [2007-10-08 17:50 41824]

"AOLDialer"="C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" [2006-10-23 08:50 71216]

"Pure Networks Port Magic"="C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" [2004-04-05 17:33 99480]

"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]

"CoolSwitch"="C:\WINDOWS\system32\taskswitch.exe" [2002-03-19 18:30 45632]

"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2005-07-19 18:32 221184]

"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2005-06-08 16:24 458752]

"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2005-06-08 16:14 217088]

"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 20:24 32768]

"nwiz"="nwiz.exe" [2006-08-12 00:43 1519616 C:\WINDOWS\system32\nwiz.exe]

"Synchronization Manager"="C:\WINDOWS\system32\mobsync.exe" [2004-08-04 08:00 143360]

"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]

"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-03-07 00:28 185896]

"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-01-31 23:13 385024]

"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 13:10 267048]

"SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 09:03 210472]

"PaperPort PTD"="C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe" [2007-01-29 21:12 30248]

"IndexSearch"="C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe" [2007-01-29 21:10 46632]

"PPort11reminder"="C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-02-01 13:46 255528]

"BrMfcWnd"="C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe" [2007-03-23 13:14 663552]

"ControlCenter3"="C:\Program Files\Brother\ControlCenter3\brctrcen.exe" [2007-01-26 15:58 65536]

"WINDVDPatch"="CTHELPER.EXE" [2002-07-02 17:56 24576 C:\WINDOWS\system32\CTHELPER.EXE]

"NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [2008-02-28 09:59 570664]

"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-02-18 16:29 2221352]

"Acrobat Assistant 8.0"="C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2007-05-10 22:46 624248]

"VTTimer"="VTTimer.exe" [2005-03-07 23:33 53248 C:\WINDOWS\system32\VTTimer.exe]

"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 01:00 90112]

"SoundMan"="SOUNDMAN.EXE" [2005-09-22 12:42 90112 C:\WINDOWS\soundman.exe]

"RoxWatchTray"="C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2007-03-26 07:07 228088]

"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-08-12 00:43 86016]

"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-08-12 00:43 7630848]

"Jet Detection"="C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe" [2001-11-29 01:00 28672]

"DevconDefaultDB"="C:\WINDOWS\READREG /PSCONV={NO} /NO_DEFPS" [ ]

"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-06-05 12:35 335872]

"BMd35cca40"="C:\WINDOWS\system32\cwlikepy.dll" [2008-05-23 00:41 126464]

C:\Documents and Settings\Alex Rojas\Start Menu\Programs\Startup\

AOL Desktop.lnk - C:\Program Files\Common Files\AOL\Launch\aollaunch.exe [2007-10-08 17:50:57 41824]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\

BlueSoleil.lnk - C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe [2008-04-19 14:58:35 1183744]

SnagIt 8.lnk - C:\Program Files\TechSmith\SnagIt 8\SnagIt32.exe [2005-12-22 08:00:00 5513216]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]

"{E23136A1-1AC4-4D1B-926F-5D537CFFF359}"= C:\WINDOWS\system32\awtrSjhf.dll [2008-05-20 00:09 56320]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\awtrSjhf]

awtrSjhf.dll 2008-05-20 00:09 56320 C:\WINDOWS\system32\awtrSjhf.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PCANotify]

PCANotify.dll 2005-05-20 12:51 8704 C:\WINDOWS\system32\PCANotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"MSACM.CEGSM"= mobilev.acm

"VIDC.NTN1"= nuvision.ax

"vidc.yv12"= yv12vfw.dll

"VIDC.XFR1"= xfcodec.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Authentication Packages REG_MULTI_SZ msv1_0 C:\WINDOWS\system32\tuvWonMe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=

"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=

"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=

"C:\\Program Files\\America Online 9.0\\waol.exe"=

"C:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltsmon.exe"=

"C:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltpspd.exe"=

"C:\\Program Files\\Common Files\\AOL\\1156821003\\EE\\AOLServiceHost.exe"=

"C:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe"=

"C:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"=

"C:\\Program Files\\Xfire\\Xfire.exe"=

"C:\\Program Files\\Sony\\Station\\Launchpad\\LaunchPad.exe"=

"C:\\Program Files\\LimeWire\\LimeWire.exe"=

"C:\\Program Files\\Microsoft ActiveSync\\WCESCOMM.EXE"=

"C:\\Program Files\\Microsoft ActiveSync\\WCESMGR.EXE"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"C:\\Program Files\\Common Files\\AOL\\TopSpeed\\3.0\\aoltpsd3.exe"=

"C:\\Program Files\\Common Files\\AOL\\1156821003\\EE\\aolsoftware.exe"=

"C:\\Program Files\\EA GAMES\\Medal of Honor Pacific Assault\\mohpa.exe"=

"C:\\Program Files\\Sierra\\FEAR\\FEAR.exe"=

"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=

"C:\\Program Files\\MSN Messenger\\livecall.exe"=

"C:\\WINDOWS\\system32\\dpvsetup.exe"=

"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=

"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=

"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"C:\\Program Files\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\XR_3DA.exe"=

"C:\\Program Files\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\dedicated\\XR_3DA.exe"=

"C:\\Program Files\\Common Files\\AOL\\1156821003\\EE\\AOLDesktop.exe"=

"C:\\Program Files\\Azureus\\Azureus.exe"=

"C:\\Program Files\\TVersity\\Media Server\\MediaServer.exe"=

"C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=

"C:\\Program Files\\Brother\\Brmfl07a\\FAXRX.exe"=

"C:\\WINDOWS\\system32\\PnkBstrA.exe"=

"C:\\WINDOWS\\system32\\PnkBstrB.exe"=

"C:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"1778:UDP"= 1778:UDP:PCTV Service

"54925:UDP"= 54925:UDP:Brother Network Scanner

R2 pctvsvc;PCTV Service;C:\Program Files\Pinnacle\PCTV To Go Setup Wizard\..\Drivers\pctvsvc.exe [2007-06-27 18:03]

R2 zumbus;Zune Bus Enumerator Driver;C:\WINDOWS\system32\DRIVERS\zumbus.sys [2008-01-11 17:39]

R3 BoosterKey;PCTV key Service;C:\WINDOWS\system32\DRIVERS\pctvkey.sys [2007-06-27 18:03]

R3 havanet;PCTV To Go NDIS Protocol Driver;C:\WINDOWS\system32\DRIVERS\pctvnet.sys [2007-06-27 18:03]

R3 HAVATV;PCTV To Go Video Device;C:\WINDOWS\system32\DRIVERS\PCTV.sys [2007-06-27 18:03]

R3 HavaTV_10;PCTV To Go Remote Video Device;C:\WINDOWS\system32\DRIVERS\PCTV_10.sys [2007-06-27 18:03]

R3 libusb0;LibUsb-Win32 - Kernel Driver 11/20/2005, 20051120;C:\WINDOWS\system32\drivers\libusb0.sys [2007-03-20 11:33]

R3 NuVision;Hauppauge WinTV USB (NTSC);C:\WINDOWS\system32\DRIVERS\NUVision.sys [2005-07-08 17:40]

R3 pctvbus;PCTV To Go Bus Enumerator;C:\WINDOWS\system32\DRIVERS\pctvbus.sys [2007-06-27 18:03]

.

Contents of the 'Scheduled Tasks' folder

"2008-03-16 00:51:34 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"

- C:\Program Files\Apple Software Update\SoftwareUpdate.exe

.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-05-23 00:30:58

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\winlogon.exe

-> C:\WINDOWS\system32\awtrSjhf.dll

PROCESS: C:\WINDOWS\explorer.exe

-> C:\WINDOWS\system32\cwlikepy.dll

-> C:\WINDOWS\system32\tuvWonMe.dll

.

------------------------ Other Running Processes ------------------------

.

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe

C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltpspd.exe

C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe

C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe

C:\Program Files\Symantec AntiVirus\DefWatch.exe

C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

C:\Program Files\lotus\notes\ntmulti.exe

C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Pinnacle\Drivers\pctvsvc.exe

C:\WINDOWS\system32\IoctlSvc.exe

C:\WINDOWS\system32\PnkBstrA.exe

C:\Program Files\Symantec AntiVirus\Rtvscan.exe

C:\Program Files\TVersity\Media Server\MediaServer.exe

C:\Program Files\Common Files\AOL\Loader\aolload.exe

C:\Program Files\Common Files\AOL\1156821003\EE\services\antiSpywareApp\ver2_0_32_1\AOLSP Scheduler.exe

C:\Program Files\Logitech\Video\FxSvr2.exe

C:\Program Files\Brother\ControlCenter3\BrccMCtl.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Brother\Brmfcmon\BrMfimon.exe

C:\WINDOWS\system32\rundll32.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

C:\Program Files\Citrix\GoToMeeting\198\g2mcomm.exe

C:\Program Files\Common Files\AOL\1156821003\EE\AOLDesktop.exe

C:\Program Files\Citrix\GoToMeeting\198\g2mlauncher.exe

C:\Program Files\TechSmith\SnagIt 8\TscHelp.exe

C:\WINDOWS\system32\rundll32.exe

C:\WINDOWS\system32\verclsid.exe

.

**************************************************************************

.

Completion time: 2008-05-23 0:44:10 - machine was rebooted

ComboFix-quarantined-files.txt 2008-05-23 04:43:29

Pre-Run: 26,271,731,712 bytes free

Post-Run: 26,280,259,584 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

369 --- E O F --- 2008-05-20 02:56:05

________________________________________________________________________________

____________________________________________

New HijackThis file:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 12:53:52 AM, on 5/23/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16640)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe

C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe

C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe

C:\Program Files\Symantec AntiVirus\DefWatch.exe

C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

C:\Program Files\lotus\notes\ntmulti.exe

C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Pinnacle\Drivers\pctvsvc.exe

C:\WINDOWS\system32\IoctlSvc.exe

C:\WINDOWS\system32\PnkBstrA.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Symantec AntiVirus\Rtvscan.exe

C:\Program Files\TVersity\Media Server\MediaServer.exe

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\PROGRA~1\SYMANT~1\VPTray.exe

C:\Program Files\Common Files\AOL\1156821003\ee\AOLSoftware.exe

C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe

C:\WINDOWS\system32\taskswitch.exe

C:\Program Files\Common Files\AOL\Loader\aolload.exe

C:\WINDOWS\system32\LVCOMSX.EXE

C:\Program Files\Logitech\Video\LogiTray.exe

C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe

c:\program files\common files\aol\1156821003\ee\services\antiSpywareApp\ver2_0_32_1\AOLSP Scheduler.exe

C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe

C:\Program Files\Logitech\Video\FxSvr2.exe

C:\WINDOWS\system32\CTHELPER.EXE

C:\Program Files\Brother\ControlCenter3\brccMCtl.exe

C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe

C:\WINDOWS\system32\VTTimer.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Brother\Brmfcmon\BrMfimon.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\Common Files\AOL\1156821003\EE\aolsoftware.exe

C:\Program Files\MSN Messenger\MsnMsgr.Exe

C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE

C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

C:\Program Files\Citrix\GoToMeeting\198\g2mstart.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe