62 Hits For Malware! Hjt Log Included[INACTIVE]

Hybridhawk · September 7, 2008

I was hit with a really nasty set of viruses/trojans/malware about 12 hours ago and I have spent the last 12 hours working on this problem. I think I have flushed most of the nasty stuff out, I ran malwarebytes and removed 62 items from my computer. I re-ran the program and had no hits, but I have run a HJT log and do not know how to read it. I am still having a very obvious problem with my computer because my desktop is white and no amount of fidgeting has fixed it. I also noticed when the problem first hit that there were a lot of "registry" changes made and I have NO idea what that did to my computer or how to fix the changes made, I really dont know anything about what the registry is. I would really appreciate some help interpretting my HJT log.

P.S. You will probably notice from the log however, that I have a ton of PC protection programs that I have installed while trying to fix this problem along with a few I already had, feel free to let me know if any of them are un-necessary. :thumbsup:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 3:04:49 AM, on 9/7/2008

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\WINDOWS\system32\PnkBstrA.exe

C:\Program Files\Spyware Doctor\pctsAuxs.exe

C:\Program Files\Spyware Doctor\pctsSvc.exe

C:\WINDOWS\Explorer.EXE

C:\PROGRA~1\AVG\AVG8\avgrsx.exe

C:\Program Files\Spyware Doctor\pctsTray.exe

C:\Program Files\bin32\nSvcAppFlt.exe

C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe

C:\Program Files\D-Link\D-Link RangeBooster N DWA-140\AirNCFG.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\bin32\nSvcIp.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\System32\alg.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

C:\WINDOWS\System32\wbem\wmiprvse.exe

R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll

O2 - BHO: (no name) - {F883C5A3-4B88-4CE3-AA80-F694D9E93E5F} - (no file)

O3 - Toolbar: gksraemq - {A91B590B-67E6-4CB4-8741-423AD91E8C1A} - C:\WINDOWS\gksraemq.dll (file missing)

O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe

O4 - HKLM\..\Run: [D-Link D-Link RangeBooster N DWA-140] C:\Program Files\D-Link\D-Link RangeBooster N DWA-140\AirNCFG.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [iSTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll

O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo.../sysreqlab3.cab

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1219379737372

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll

O20 - AppInit_DLLs: boqxmt.dll,avgrsstx.dll

O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Wireless Service - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe

O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\bin32\nSvcAppFlt.exe

O23 - Service: ForceWare IP service (nSvcIp) - Unknown owner - C:\Program Files\bin32\nSvcIp.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe

O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe

O24 - Desktop Component 0: Privacy Protection - (no file)

--

End of file - 6412 bytes

Edited September 7, 2008 by Hawk

sarahw · September 7, 2008

Hi,

Welcome to the site

I will be handling your log to help you get cleaned up. Please give me some time to look it over and I will get back to you as soon as possible.

I want you to show hidden files. There are instructions HERE to help you do this.

You should have Administrator rights to perform the fixes. Some of the instructions I give may need to be printed or saved for reference during the fix. Some of the fix will be done in Safe Mode so you will be unable to access this thread at that time.

Please dont use any of the tools without specific instructions. Some of them are dangerous (and could leave your computer in worse condition that it is when infected) if used incorrectly.

These instructions should be read first, then followed. If you do not understand something, don't be afraid to ask, or see if I'm on chat.

sarahw · September 7, 2008

1.

While TeaTimer is an excellent tool for the prevention of spyware, it can sometimes prevent HijackThis from fixing certain things.

Please disable TeaTimer for now until you are clean. TeaTimer can be re-activated once your HijackThis log is clean.

Open Spybot Search & Destroy.
In the Mode menu click "Advanced mode" if not already selected.
Choose "Yes" at the Warning prompt.
Expand the "Tools" menu.
Click "Resident".
Uncheck the "Resident "TeaTimer" (Protection of overall system settings) active." box.
In the File menu click "Exit" to exit Spybot Search & Destroy.

2.

Download SDFix and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%

(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer in Safe Mode by doing the following :

Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, the Advanced Options Menu should appear;
Select the first option, to run Windows in Safe Mode, then press Enter.
Choose your usual account.

Open the extracted SDFix folder and double click RunThis.bat to start the script.
Type Y to begin the cleanup process.
It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
Press any Key and it will restart the PC.
When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
(Report.txt will also be copied to Clipboard ready for posting back on the forum).
Finally paste the contents of the Report.txt back on the forum with a new HijackThis log

Hybridhawk · September 7, 2008

Okay I selected to show hidden files, I also disabled TeaTime. I am trying to restart the computer in safe mode but when I tap F8 it brings up a "Boot Menu" and it says "select a boot first device" and I have the options of "removable" "hard disk" and "cdrom" I dont think this is the advanced menu I need but I am not sure how to bring the menu up. I do not have a login screen because when I first got my computer I found and used a command (of which I dont know anymore) to automatically log me in to my master account. On boot up my computer screen is black, then I have a green ASUS screen, then it is a blue screen which shows me logging in, and then Im on my desktop.

sarahw · September 8, 2008

Ok, run it in normal mode.

Hybridhawk · September 8, 2008

It will not let me, It tells me I have to be in safe mode to run it. =/

Hybridhawk · September 8, 2008

Okay, I figured out how to get to that menu, I ran the program and saved the log, then ran another HjT log. I can see part of my desktop now but there is still a white box in the upper left hand corner that blocks out the desktop in that area, I can see and use the icons that are on top of it but I do not know how to remove the box or what it is. Here are the two new logs that I have:

SDFix: Version 1.222

Run by Hawk on Sun 09/07/2008 at 05:54 PM

Microsoft Windows XP [Version 5.1.2600]

Running From: C:\SDFix

Checking Services :

Restoring Default Security Values

Restoring Default Hosts File

Rebooting

Checking Files :

No Trojan Files Found

Removing Temp Files

ADS Check :

Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-09-07 17:58:14

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully

hidden processes: 0

hidden services: 0

hidden files: 0

Remaining Services :

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

"C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:Ã¦Torrent"

"C:\\WINDOWS\\system32\\PnkBstrA.exe"="C:\\WINDOWS\\system32\\PnkBstrA.exe:*:Enabled:PnkBstrA"

"C:\\WINDOWS\\system32\\PnkBstrB.exe"="C:\\WINDOWS\\system32\\PnkBstrB.exe:*:Enabled:PnkBstrB"

"C:\\WINDOWS\\system32\\dpvsetup.exe"="C:\\WINDOWS\\system32\\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"

"C:\\WINDOWS\\system32\\rundll32.exe"="C:\\WINDOWS\\system32\\rundll32.exe:*:Enabled:Run a DLL as an App"

"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"

"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe:*:Enabled:Yahoo! FT Server"

"C:\\Program Files\\Steam\\steamapps\\[email protected]\\counter-strike source\\hl2.exe"="C:\\Program Files\\Steam\\steamapps\\[email protected]\\counter-strike source\\hl2.exe:*:Enabled:hl2"

"C:\\Program Files\\Steam\\steamapps\\[email protected]\\day of defeat source\\hl2.exe"="C:\\Program Files\\Steam\\steamapps\\[email protected]\\day of defeat source\\hl2.exe:*:Enabled:hl2"

"C:\\Documents and Settings\\Hawk\\Local Settings\\Temp\\WZSE0.TMP\\SymNRT.exe"="C:\\Documents and Settings\\Hawk\\Local Settings\\Temp\\WZSE0.TMP\\SymNRT.exe:*:Enabled:Norton Removal Tool"

"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"="C:\\Program Files\\AVG\\AVG8\\avgupd.exe:*:Enabled:avgupd.exe"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

Remaining Files :

File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes :

Mon 7 Jul 2008 1,429,840 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDUpdate.exe"

Mon 7 Jul 2008 4,891,472 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"

Sat 16 Aug 2008 60,416 A..H. --- "C:\Documents and Settings\Hawk\Desktop\Val's Employment\~WRL0005.tmp"

Fri 22 Aug 2008 16,151,113 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\28f9157a46d0b6f12275c9aae1093110\BIT1A0.tmp"

Finished!

Then the HJT Log:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 6:07:33 PM, on 9/7/2008

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe

C:\Program Files\D-Link\D-Link RangeBooster N DWA-140\AirNCFG.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\WINDOWS\system32\spoolsv.exe

C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\WINDOWS\system32\PnkBstrA.exe

C:\Program Files\bin32\nSvcAppFlt.exe

C:\Program Files\bin32\nSvcIp.exe

C:\PROGRA~1\AVG\AVG8\avgrsx.exe

C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll

O2 - BHO: (no name) - {F883C5A3-4B88-4CE3-AA80-F694D9E93E5F} - (no file)

O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe

O4 - HKLM\..\Run: [D-Link D-Link RangeBooster N DWA-140] C:\Program Files\D-Link\D-Link RangeBooster N DWA-140\AirNCFG.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll

O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo.../sysreqlab3.cab

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1219379737372

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll

O20 - AppInit_DLLs: boqxmt.dll,avgrsstx.dll

O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Wireless Service - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe

O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\bin32\nSvcAppFlt.exe

O23 - Service: ForceWare IP service (nSvcIp) - Unknown owner - C:\Program Files\bin32\nSvcIp.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

O24 - Desktop Component 1: Privacy Protection - (no file)

--

End of file - 5638 bytes

sarahw · September 8, 2008

Download GMER from here:

http://www.gmer.net/files.php

Unzip it to the desktop.

Open the program and click on the Rootkit tab.

Make sure all the boxes on the right of the screen are checked, EXCEPT for â€˜Show Allâ€™.

Click on Scan.

When the scan has run click Copy and paste the results (if any) into this thread.

Hybridhawk · September 8, 2008

There were no results, it came up clean.

sarahw · September 8, 2008

Can you post the results anyways, your computer surely isn't clean.

Hybridhawk · September 8, 2008

I ran it three more times and the last time I ran it this is what is showed:

GMER 1.0.14.14536 - http://www.gmer.net

Rootkit scan 2008-09-07 21:35:40

Windows 5.1.2600 Service Pack 3

---- Devices - GMER 1.0.14 ----

AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

---- EOF - GMER 1.0.14 ----

I had also plugged in my MP3 player to a usb port to charge it, so I think that is what that is.

sarahw · September 8, 2008

Download ComboFix from one of the locations below, and save it to your Desktop.

Link 1

Link 2

Link 3

Double click combofix.exe and follow the prompts. Please, never rename Combofix unless instructed.

When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply

Note: Do not mouseclick combofix's window while its running. That may cause it to stall

Hybridhawk · September 8, 2008

Okay I ran that program and it put the icons I had lost when the viruses hit back on my desktop so I know it fixed something, however the big white block in the upper left of my desktop is still there. Here are the logs:

ComboFix 08-09-05.05 - Hawk 2008-09-07 22:50:46.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3023 [GMT -7:00]

Running from: C:\Documents and Settings\Hawk\Desktop\ComboFix.exe

* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((( Files Created from 2008-08-08 to 2008-09-08 )))))))))))))))))))))))))))))))

.

2008-09-07 19:40 . 2008-09-07 21:22 250 --a------ C:\WINDOWS\gmer.ini

2008-09-07 17:53 . 2008-09-07 17:53 578,560 --a--c--- C:\WINDOWS\system32\dllcache\user32.dll

2008-09-07 17:52 . 2008-09-07 17:52 <DIR> d-------- C:\WINDOWS\ERUNT

2008-09-07 14:52 . 2008-09-07 17:59 <DIR> d-------- C:\SDFix

2008-09-07 03:24 . 2008-09-07 03:24 <DIR> d-------- C:\Program Files\Lavasoft

2008-09-07 00:58 . 2008-09-07 00:58 <DIR> d--h----- C:\$AVG8.VAULT$

2008-09-06 23:39 . 2008-09-06 23:39 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware

2008-09-06 23:39 . 2008-09-06 23:39 <DIR> d-------- C:\Documents and Settings\Hawk\Application Data\Malwarebytes

2008-09-06 23:39 . 2008-09-06 23:39 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes

2008-09-06 23:39 . 2008-09-02 00:16 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys

2008-09-06 23:39 . 2008-09-02 00:16 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys

2008-09-06 23:31 . 2008-09-06 23:31 <DIR> d-------- C:\Program Files\Trend Micro

2008-09-06 23:19 . 2008-09-06 23:19 97,928 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys

2008-09-06 23:19 . 2008-09-06 23:19 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll

2008-09-06 23:18 . 2008-09-06 23:18 <DIR> d-------- C:\Program Files\AVG

2008-09-06 23:18 . 2008-09-06 23:18 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg8

2008-09-06 23:10 . 2008-09-06 23:20 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg

2008-09-06 20:10 . 2008-09-06 20:10 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\NortonInstaller

2008-09-06 15:19 . 2008-09-06 20:11 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared

2008-09-06 15:09 . 2008-09-06 15:10 255 --a------ C:\WINDOWS\wininit.ini

2008-09-06 14:47 . 2008-09-05 11:47 553,472 --a------ C:\Documents and Settings\Hawk\IMSPTpb.exe

2008-09-06 14:47 . 2008-06-05 07:01 344,064 --a------ C:\Documents and Settings\Hawk\sqlite3.dll

2008-08-31 00:57 . 2008-08-31 01:41 <DIR> d-------- C:\Program Files\PublicTest

2008-08-31 00:34 . 2008-09-07 19:04 <DIR> d-------- C:\Program Files\Steam

2008-08-26 12:25 . 2008-08-26 12:25 <DIR> d-------- C:\Documents and Settings\Hawk\Application Data\Yahoo!

2008-08-26 12:23 . 2008-09-06 20:15 <DIR> d-------- C:\Program Files\Yahoo!

2008-08-26 12:23 . 2008-08-26 12:23 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Yahoo!

2008-08-23 22:25 . 2008-08-23 22:25 <DIR> d-------- C:\Program Files\Hewlett-Packard

2008-08-23 22:25 . 2008-08-23 22:25 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\HP

2008-08-23 22:24 . 2005-05-10 20:49 37,376 --a------ C:\WINDOWS\system32\hpz3l3xu.dll

2008-08-23 22:23 . 1998-10-29 16:45 306,688 --a------ C:\WINDOWS\IsUninst.exe

2008-08-23 22:23 . 2004-09-29 12:12 278,584 --a------ C:\WINDOWS\system32\HPZidr12.dll

2008-08-23 22:23 . 2004-09-29 12:15 204,800 --a------ C:\WINDOWS\system32\HPZipr12.dll

2008-08-23 22:23 . 2004-09-29 12:09 94,208 --a------ C:\WINDOWS\system32\HPZipt12.dll

2008-08-23 22:23 . 2004-09-29 12:14 69,632 --a------ C:\WINDOWS\system32\HPZipm12.exe

2008-08-23 22:23 . 2004-09-29 12:08 61,440 --a------ C:\WINDOWS\system32\HPZinw12.exe

2008-08-23 22:23 . 2004-09-29 12:09 57,344 --a------ C:\WINDOWS\system32\HPZisn12.dll

2008-08-23 22:22 . 2008-08-23 22:25 <DIR> d-------- C:\Program Files\HP

2008-08-23 22:21 . 2008-08-23 22:33 79,357 --a------ C:\WINDOWS\hpfins05.dat

2008-08-23 22:21 . 2005-07-15 15:15 1,350 --------- C:\WINDOWS\hpfmdl05.dat

2008-08-23 22:20 . 2008-08-23 22:20 <DIR> d-------- C:\Documents and Settings\Hawk\Application Data\HP

2008-08-23 22:20 . 2005-04-27 18:38 372,736 --a------ C:\WINDOWS\system32\hpzidi01.dll

2008-08-23 22:20 . 2005-04-27 18:37 77,824 --a------ C:\WINDOWS\system32\hpzids01.dll

2008-08-23 22:18 . 2008-08-23 22:18 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\PC Drivers HeadQuarters

2008-08-22 18:37 . 2008-08-22 18:37 <DIR> d-------- C:\Program Files\QuickTime

2008-08-22 18:37 . 2008-08-22 18:37 <DIR> d-------- C:\Program Files\Apple Software Update

2008-08-22 18:37 . 2008-08-22 18:37 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer

2008-08-22 18:37 . 2008-08-22 18:37 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple

2008-08-22 01:55 . 2008-08-22 01:55 <DIR> dr-h----- C:\Documents and Settings\Hawk\Application Data\SecuROM

2008-08-22 01:55 . 2008-08-22 01:55 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll

2008-08-22 01:50 . 2008-09-07 19:02 <DIR> d-------- C:\Documents and Settings\Hawk\Application Data\Ventrilo

2008-08-22 01:47 . 2008-08-22 01:47 <DIR> d-------- C:\WINDOWS\system32\Lang

2008-08-22 01:47 . 2008-08-22 01:47 940,794 --a------ C:\WINDOWS\system32\LoopyMusic.wav

2008-08-22 01:47 . 2008-08-22 01:47 146,650 --a------ C:\WINDOWS\system32\BuzzingBee.wav

2008-08-22 01:44 . 2008-08-22 01:44 <DIR> d-------- C:\Program Files\Realtek

2008-08-22 01:44 . 2008-05-07 00:39 16,862,208 -r------- C:\WINDOWS\RTHDCPL.exe

2008-08-22 01:44 . 2006-05-04 01:26 2,808,832 -r------- C:\WINDOWS\alcwzrd.exe

2008-08-22 01:44 . 2007-06-28 01:44 2,165,760 -r------- C:\WINDOWS\MicCal.exe

2008-08-22 01:44 . 2008-03-05 03:07 520,192 -r------- C:\WINDOWS\RtlExUpd.dll

2008-08-22 01:44 . 2005-09-20 19:25 299,008 -ra------ C:\WINDOWS\system32\ALSndMgr.cpl

2008-08-22 01:44 . 2005-05-03 03:43 69,632 -r------- C:\WINDOWS\Alcmtr.exe

2008-08-22 01:13 . 2008-09-07 03:49 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy

2008-08-22 01:13 . 2008-09-07 12:38 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy

2008-08-22 01:11 . 2008-08-22 01:15 <DIR> d-------- C:\Program Files\SpywareBlaster

2008-08-22 01:07 . 2008-08-22 01:07 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft

2008-08-22 01:02 . 2008-08-22 01:02 <DIR> d-------- C:\Program Files\Ventrilo

2008-08-22 00:59 . 2008-08-22 00:59 <DIR> d-------- C:\WINDOWS\system32\URTTemp

2008-08-22 00:59 . 2008-08-22 00:59 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys

2008-08-22 00:59 . 2008-08-22 00:59 22,328 --a------ C:\Documents and Settings\Hawk\Application Data\PnkBstrK.sys

2008-08-22 00:50 . 2008-09-07 03:24 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard

2008-08-22 00:28 . 2008-08-22 00:28 <DIR> d-------- C:\Program Files\uTorrent

2008-08-22 00:28 . 2008-09-06 23:02 <DIR> d-------- C:\Documents and Settings\Hawk\Application Data\uTorrent

2008-08-22 00:28 . 2003-06-18 17:31 17,920 --a------ C:\WINDOWS\system32\mdimon.dll

2008-08-22 00:28 . 2008-08-22 00:28 376 --a------ C:\WINDOWS\ODBC.INI

2008-08-22 00:27 . 2008-08-22 00:27 <DIR> d-------- C:\WINDOWS\SHELLNEW

2008-08-22 00:27 . 2008-08-22 00:27 <DIR> d-------- C:\Program Files\Microsoft ActiveSync

2008-08-22 00:24 . 2008-08-22 00:24 <DIR> dr-h----- C:\MSOCache

2008-08-22 00:24 . 2008-09-07 04:08 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP

2008-08-22 00:24 . 2005-04-15 20:58 1,071,088 --a------ C:\WINDOWS\system32\MSCOMCTL.OCX

2008-08-21 23:32 . 2008-08-21 23:32 <DIR> d-------- C:\Program Files\Common Files\Adobe AIR

2008-08-21 23:31 . 2008-08-21 23:31 <DIR> d-------- C:\Program Files\Common Files\Adobe

2008-08-21 23:00 . 2008-08-21 23:20 <DIR> d-------- C:\Documents and Settings\Hawk\Application Data\U3

2008-08-21 23:00 . 2008-04-13 11:45 26,368 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys

2008-08-21 22:49 . 2008-05-19 18:16 186,407 --a------ C:\WINDOWS\system32\nvapps.nvb

2008-08-21 22:46 . 2008-05-01 07:33 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll

2008-08-21 22:45 . 2008-04-11 12:04 691,712 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll

2008-08-21 22:44 . 2008-06-13 04:05 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys

2008-08-21 22:44 . 2008-05-08 07:02 203,136 -----c--- C:\WINDOWS\system32\dllcache\rmcast.sys

2008-08-21 22:37 . 2008-08-21 22:37 <DIR> d-------- C:\WINDOWS\system32\scripting

2008-08-21 22:37 . 2008-08-21 22:37 <DIR> d-------- C:\WINDOWS\system32\en

2008-08-21 22:37 . 2008-08-21 22:37 <DIR> d-------- C:\WINDOWS\l2schemas

2008-08-21 22:29 . 2008-04-13 17:11 136,192 --a------ C:\WINDOWS\system32\aaclient.dll

2008-08-21 22:29 . 2008-04-13 10:23 8,192 -----c--- C:\WINDOWS\system32\dllcache\asferror.dll

2008-08-21 22:22 . 2008-08-21 22:47 <DIR> d--h----- C:\WINDOWS\$hf_mig$

2008-08-21 22:11 . 2008-08-21 22:11 <DIR> d-------- C:\WINDOWS\provisioning

2008-08-21 22:11 . 2008-08-21 22:37 <DIR> d-------- C:\WINDOWS\peernet

2008-08-21 22:11 . 2008-08-21 22:42 316,640 --a------ C:\WINDOWS\WMSysPr9.prx

2008-08-21 22:10 . 2008-08-21 22:10 <DIR> d-------- C:\WINDOWS\ServicePackFiles

2008-08-21 22:07 . 2007-08-10 20:46 26,488 --a------ C:\WINDOWS\system32\spupdsvc.exe

2008-08-21 22:06 . 2008-08-21 22:31 <DIR> d-------- C:\WINDOWS\EHome

2008-08-21 21:48 . 2008-04-14 05:42 11,264 --a------ C:\WINDOWS\system32\spnpinst.exe

2008-08-21 21:48 . 2004-08-02 14:20 7,208 --a------ C:\WINDOWS\system32\secupd.sig

2008-08-21 21:48 . 2004-08-02 14:20 4,569 --a------ C:\WINDOWS\system32\secupd.dat

2008-08-21 21:43 . 2008-09-07 18:06 181,718 --a------ C:\WINDOWS\system32\nvapps.xml

2008-08-21 21:43 . 2008-05-16 14:01 18,070 --a------ C:\WINDOWS\system32\nvdisp.nvu

2008-08-21 21:40 . 2008-07-18 22:09 25,800 --a------ C:\WINDOWS\system32\wuapi.dll.mui

2008-08-21 21:37 . 2008-08-21 22:37 <DIR> d-------- C:\WINDOWS\system32\bits

2008-08-21 21:37 . 2008-04-13 10:39 438,784 --a------ C:\WINDOWS\system32\xpob2res.dll

2008-08-21 21:37 . 2008-04-13 17:12 354,304 --a------ C:\WINDOWS\system32\winhttp.dll

2008-08-21 21:37 . 2008-04-13 17:12 18,944 --a------ C:\WINDOWS\system32\qmgrprxy.dll

2008-08-21 21:37 . 2008-04-13 17:11 8,192 --a------ C:\WINDOWS\system32\bitsprx2.dll

2008-08-21 21:37 . 2008-04-13 17:11 7,168 --a------ C:\WINDOWS\system32\bitsprx3.dll

2008-08-21 21:36 . 2008-07-18 22:09 563,912 --a------ C:\WINDOWS\system32\wuapi.dll

2008-08-21 21:36 . 2008-07-18 22:09 563,912 --a--c--- C:\WINDOWS\system32\dllcache\wuapi.dll

2008-08-21 21:36 . 2008-07-18 22:09 325,832 --a------ C:\WINDOWS\system32\wucltui.dll

2008-08-21 21:36 . 2008-07-18 22:09 215,752 --a------ C:\WINDOWS\system32\wuaucpl.cpl

2008-08-21 21:36 . 2008-07-18 22:10 45,768 --a------ C:\WINDOWS\system32\wups2.dll

2008-08-21 21:36 . 2008-07-18 22:10 36,552 --a------ C:\WINDOWS\system32\wups.dll

2008-08-21 21:36 . 2008-07-18 22:10 36,552 --a--c--- C:\WINDOWS\system32\dllcache\wups.dll

2008-08-21 21:36 . 2008-07-18 22:10 33,992 --a------ C:\WINDOWS\system32\wucltui.dll.mui

2008-08-21 21:36 . 2008-07-18 22:09 25,800 --a------ C:\WINDOWS\system32\wuaucpl.cpl.mui

2008-08-21 21:36 . 2008-07-18 22:08 20,680 --a------ C:\WINDOWS\system32\wuaueng.dll.mui

2008-08-21 21:35 . 2008-08-21 21:35 <DIR> d---s---- C:\Documents and Settings\Hawk\UserData

2008-08-21 21:22 . 2008-08-21 21:22 <DIR> d-------- C:\Program Files\SystemRequirementsLab

2008-08-21 21:22 . 2008-08-21 21:22 552 --a------ C:\WINDOWS\system32\d3d8caps.dat

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-08-26 05:12 --------- d--h--w C:\Program Files\InstallShield Installation Information

2008-08-22 07:58 669,184 ----a-w C:\WINDOWS\system32\pbsvc.exe

2008-08-22 07:58 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe

2008-08-22 07:58 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe

2008-08-22 04:17 0 ----a-w C:\Program Files\FirstPacketPrograms.txt

2008-08-22 03:48 --------- d-----w C:\Program Files\Common Files\InstallShield

2008-08-22 03:48 --------- d-----w C:\Program Files\ANI

2008-08-22 03:47 --------- d-----w C:\Program Files\D-Link

2008-08-22 03:47 --------- d-----w C:\Documents and Settings\Hawk\Application Data\InstallShield

2008-08-22 03:40 315,392 ----a-w C:\WINDOWS\HideWin.exe

2008-08-22 03:37 --------- d-----w C:\Program Files\profile

2008-08-22 03:37 --------- d-----w C:\Program Files\log

2008-08-22 03:37 --------- d-----w C:\Program Files\bin32

2008-08-22 03:30 --------- d-----w C:\Program Files\microsoft frontpage

2008-07-19 05:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll

2008-07-19 05:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe

2008-07-19 05:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll

2008-07-19 05:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll

2008-07-07 20:26 253,952 ----a-w C:\WINDOWS\system32\es.dll

2008-06-24 16:43 74,240 ----a-w C:\WINDOWS\system32\mscms.dll

2008-06-23 15:09 666,112 ----a-w C:\WINDOWS\system32\wininet.dll

2008-06-20 17:46 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ANIWZCS2Service"="C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [2007-01-19 49152]

"D-Link D-Link RangeBooster N DWA-140"="C:\Program Files\D-Link\D-Link RangeBooster N DWA-140\AirNCFG.exe" [2007-08-20 1671168]

"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-16 13529088]

"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-16 86016]

"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]

"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 413696]

"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 49152]

"nwiz"="nwiz.exe" [2008-05-16 C:\WINDOWS\system32\nwiz.exe]

"RTHDCPL"="RTHDCPL.EXE" [2008-05-07 C:\WINDOWS\RTHDCPL.exe]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\

HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-11 282624]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=boqxmt.dll,avgrsstx.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"C:\\Program Files\\uTorrent\\uTorrent.exe"=

"C:\\WINDOWS\\system32\\PnkBstrA.exe"=

"C:\\WINDOWS\\system32\\PnkBstrB.exe"=

"C:\\WINDOWS\\system32\\dpvsetup.exe"=

"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=

"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=

"C:\\Program Files\\Steam\\steamapps\\[email protected]\\counter-strike source\\hl2.exe"=

"C:\\Program Files\\Steam\\steamapps\\[email protected]\\day of defeat source\\hl2.exe"=

"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-09-06 97928]

R2 avg8wd;AVG Free8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-09-06 231704]

R3 rt2870;Ralink 802.11n USB Wireless LAN Card Driver;C:\WINDOWS\system32\DRIVERS\rt2870.sys [2007-07-28 517632]

*Newly Created Service* - GMER

*Newly Created Service* - PROCEXP90

.

Contents of the 'Scheduled Tasks' folder

.

- - - - ORPHANS REMOVED - - - -

BHO-{F883C5A3-4B88-4CE3-AA80-F694D9E93E5F} - (no file)

.

------- Supplementary Scan -------

.

FireFox -: Profile - C:\Documents and Settings\Hawk\Application Data\Mozilla\Firefox\Profiles\bok15fqv.default\

FireFox -: prefs.js - STARTUP.HOMEPAGE - www.dogpile.com

FF -: plugin - C:\Program Files\Yahoo!\Shared\npYState.dll

.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-09-07 22:51:36

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

Completion time: 2008-09-07 22:52:04

ComboFix-quarantined-files.txt 2008-09-08 05:52:02

Pre-Run: 90,584,371,200 bytes free

Post-Run: 90,623,823,872 bytes free

222

________________________________________________________________________________

___________________________

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 10:53:30 PM, on 9/7/2008

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe

C:\Program Files\D-Link\D-Link RangeBooster N DWA-140\AirNCFG.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\WINDOWS\system32\spoolsv.exe

C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\WINDOWS\system32\PnkBstrA.exe

C:\Program Files\bin32\nSvcAppFlt.exe

C:\Program Files\bin32\nSvcIp.exe

C:\PROGRA~1\AVG\AVG8\avgrsx.exe

C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\explorer.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896