Malware, combofix, and hijack fails to run Options

[MikeC07]

Hey so unfortunately i believe i might have a browser hack...

per the title, none of those work. symanetc refuses to update with a working internet connection and processexplorer shows nothing to my knowledge. safe mode could not be accessed through the bios (hitting f8 repeatedly). this is my built computer so it has nothing from hp or anything else. the way i accessed safe mode was using msconfig but it may not seem like the real safe mode as when entering mozilla, i get redirects using google like without google. go.google trojan or something...
tried downloading and reinstalling the three programs but still failed to run. tried on my laptop and still fails. used a usb to copy a fresh install.exe but nothing, even in safe mode

(that was safe mode with networking. without, none of the antiadware works.)

so in other words, malwarebytes, combofix, hijack this, all failed to open after double clicking. no error messages.
symantec shows no viruses, when clearly there are, and nor does adaware 7.0 the most recent update for symantec is 6/28/09

please advise but dont be in a rush. im already considering gettin a new hard drive and repartitioning but i kinda want to fix it if i can

This post has been edited by MikeC07: Jul 2 2009, 03:46 PM

[MikeC07]

lookin around some more, i found that you can run RSIT.

did and heres the log
Logfile of random's system information tool 1.06 (written by random/random)
Run by Mchang at 2009-07-02 15:56:55
Microsoft Windows XP Professional Service Pack 3
System drive C: has 30 GB (30%) free of 100 GB
Total RAM: 3325 MB (84% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:57:05 PM, on 7/2/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\mmc.exe
C:\Documents and Settings\Mchang\Desktop\RSIT.exe
C:\Program Files\trend micro\Mchang.exe

R3 - Default URLSearchHook is missing
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKUS\S-1-5-21-343818398-746137067-725345543-500\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun (User 'Administrator')
O9 - Extra button: (no name) - AutorunsDisabled - (no file)
O17 - HKLM\System\CCS\Services\Tcpip\..\{9C075CDC-83BB-4BCF-8043-8DE1D62B2A84}: NameServer = 85.255.112.88,85.255.112.236
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.88,85.255.112.236
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 85.255.112.88,85.255.112.236
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.88,85.255.112.236
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
O23 - Service: IS Service (ISSVC) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec Client Security\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Symantec SecurePort (SymSecurePort) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe
O24 - Desktop Component AutorunsDisabled: (no name) - (no file)

--
End of file - 4999 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\Driver Robot.job
C:\WINDOWS\tasks\{5B57CF47-0BFA-43c6-ACF9-3B3653DCADBA}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
&Yahoo! Toolbar Helper - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll [2008-07-28 882416]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
AskBar BHO - C:\Program Files\AskBarDis\bar\bin\askBar.dll [2008-11-18 333192]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}]
SingleInstance Class - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll [2008-07-28 160496]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"MSConfig"=C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe [2008-04-13 169984]
"vptray"=C:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe [2007-10-07 125368]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2009-05-14 17881088]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2009-05-01 86016]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2009-05-01 13750272]
"amd_dc_opt"=C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe [2008-07-22 77824]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Malwarebytes' Anti-Malware"=C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe [2009-06-17 414992]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]
C:\WINDOWS\system32\NavLogon.dll [2007-10-07 43448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 239496]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe"="C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe:*:Enabled:Apache HTTP Server"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\WINDOWS\system32\PnkBstrA.exe"="C:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\WINDOWS\system32\PnkBstrB.exe"="C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB"
"C:\GAMES!\cod4\iw3mp.exe"="C:\GAMES!\cod4\iw3mp.exe:*:Enabled:Call of Duty® 4 - Modern Warfare™ "
"C:\Program Files\Guild Wars\Gw.exe"="C:\Program Files\Guild Wars\Gw.exe:*:Enabled:Guild Wars"
"C:\Program Files\Steam\Steam.exe"="C:\Program Files\Steam\Steam.exe:*:Enabled:Steam"
"C:\Program Files\Steam\steamapps\common\peggle extreme\PeggleExtreme.exe"="C:\Program Files\Steam\steamapps\common\peggle extreme\PeggleExtreme.exe:*:Enabled:Peggle Extreme"
"C:\Program Files\Saints Row 2\SR2_pc.exe"="C:\Program Files\Saints Row 2\SR2_pc.exe:*:Enabled:SR2_pc"
"C:\Program Files\Steam\steamapps\chickon_hunter\team fortress 2\hl2.exe"="C:\Program Files\Steam\steamapps\chickon_hunter\team fortress 2\hl2.exe:*:Enabled:hl2"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\DNA\btdna.exe"="C:\Program Files\DNA\btdna.exe:*:Enabled:DNA"
"G:\_games\Left 4 Dead\left4dead.exe"="G:\_games\Left 4 Dead\left4dead.exe:*:Enabled:left4dead"
"C:\BF2\BF2.exe"="C:\BF2\BF2.exe:*:Enabled:Battlefield 2"
"C:\Program Files\Steam\steamapps\common\killingfloor\System\KillingFloor.exe"="C:\Program Files\Steam\steamapps\common\killingfloor\System\KillingFloor.exe:*:Enabled:Killing Floor"
"C:\Program Files\Steam\steamapps\common\killingfloor\System\KFEd.exe"="C:\Program Files\Steam\steamapps\common\killingfloor\System\KFEd.exe:*:Enabled:Killing Floor SDK"
"C:\Program Files\Ventrilo\Ventrilo.exe"="C:\Program Files\Ventrilo\Ventrilo.exe:*:Enabled:Ventrilo.exe"
"D:\Games\Prototype\prototypef.exe"="D:\Games\Prototype\prototypef.exe:*:Enabled:Prototype™"
"C:\Program Files\Steam\steamapps\common\america's army 3\Binaries\AA3Game.exe"="C:\Program Files\Steam\steamapps\common\america's army 3\Binaries\AA3Game.exe:*:Enabled:America's Army 3"
"C:\Program Files\Steam\steamapps\common\left 4 dead\left4dead.exe"="C:\Program Files\Steam\steamapps\common\left 4 dead\left4dead.exe:*:Enabled:Left 4 Dead"
"D:\OL2\Overlord2.exe"="D:\OL2\Overlord2.exe:*:Enabled:Overlord II"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
shell\AutoRun\command - E:\Launch.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{88291625-6134-11de-a0de-00241d2528a3}]
shell\AutoRun\command - G:\WDSetup.exe


======List of files/folders created in the last 1 months======

2009-12-28 00:21:18 ----A---- C:\WINDOWS\system32\11958not-a-zirus47c.exe
2009-12-24 21:32:16 ----A---- C:\WINDOWS\system32\54088no9-a-virusz94.exe
2009-12-21 03:26:05 ----A---- C:\WINDOWS\system32\1226sp5mzot249.dll
2009-12-19 01:35:06 ----A---- C:\WINDOWS\system32\279789ackzool56.dll
2009-12-18 16:53:29 ----A---- C:\WINDOWS\system32\5ez1spywa592184.exe
2009-12-15 18:41:36 ----A---- C:\WINDOWS\system32\z5e5addwa5e1299.dll
2009-11-19 13:49:19 ----A---- C:\WINDOWS\system32\9745rzj39a.dll
2009-11-18 06:06:27 ----A---- C:\WINDOWS\system32\1e0z5ddwa9e2744.dll
2009-11-11 17:18:07 ----A---- C:\WINDOWS\system32\6z7cthreat5689.exe
2009-11-11 04:58:24 ----A---- C:\WINDOWS\system32\6f459hief54z7.dll
2009-11-10 19:41:53 ----A---- C:\WINDOWS\system32\57z9ddware969.dll
2009-10-19 02:49:24 ----A---- C:\WINDOWS\system32\5a96sparsez592.exe
2009-10-19 02:48:42 ----A---- C:\WINDOWS\system32\39368ha5ktzol547.dll
2009-10-09 15:51:46 ----A---- C:\WINDOWS\system32\142zstea921045.exe
2009-10-04 04:32:35 ----A---- C:\WINDOWS\system32\245z4s5ambot95f.dll
2009-10-02 05:11:38 ----A---- C:\WINDOWS\system32\6698sza9se975.exe
2009-09-27 04:10:44 ----A---- C:\WINDOWS\system32\7fadth9za520670.exe
2009-09-23 09:30:40 ----A---- C:\WINDOWS\system32\3a29sp9zare758.exe
2009-09-15 10:45:00 ----A---- C:\WINDOWS\system32\6d4edownlza59r92.dll
2009-09-13 09:10:32 ----A---- C:\WINDOWS\system32\94zaspy5are2400.exe
2009-08-16 07:49:19 ----A---- C:\WINDOWS\system32\12z71vir9s5fd.dll
2009-08-04 14:37:04 ----A---- C:\WINDOWS\system32\27550spzmbot390.dll
2009-07-27 21:36:00 ----A---- C:\WINDOWS\system32\75aaspzw9re1758.exe
2009-07-13 06:20:06 ----A---- C:\WINDOWS\system32\4a3dv5rz8339.exe
2009-07-11 03:17:08 ----A---- C:\WINDOWS\system32\7z6aspy5are2669.exe
2009-07-08 04:00:27 ----A---- C:\WINDOWS\system32\27846ha95tool3z5.exe
2009-07-02 15:56:55 ----D---- C:\rsit
2009-07-02 15:18:39 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2009-07-02 15:18:39 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2009-07-02 14:30:29 ----SHD---- C:\WINDOWS\CSC
2009-07-02 14:12:04 ----D---- C:\hj
2009-07-02 14:03:56 ----D---- C:\WINDOWS\pss
2009-07-02 13:38:10 ----D---- C:\Documents and Settings\All Users\Application Data\Avg7
2009-07-02 13:31:23 ----D---- C:\Program Files\Trend Micro
2009-07-02 13:06:20 ----A---- C:\WINDOWS\Copy of 960bthzef11255.dll
2009-07-02 13:06:20 ----A---- C:\WINDOWS\Copy of 91567szy61e.exe
2009-07-02 13:06:20 ----A---- C:\WINDOWS\Copy of 5999vir3571z.exe
2009-07-02 13:06:20 ----A---- C:\WINDOWS\Copy of 4a319d5wzre3015.dll
2009-07-02 13:06:20 ----A---- C:\WINDOWS\Copy of 3abfth5zf2591.dll
2009-07-02 13:06:20 ----A---- C:\WINDOWS\Copy of 19559spambot54fz.exe
2009-07-02 13:06:20 ----A---- C:\WINDOWS\Copy of 1394z59y3fe.dll
2009-07-02 13:06:20 ----A---- C:\WINDOWS\Copy of {789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
2009-07-02 13:06:18 ----A---- C:\WINDOWS\Copy of RTHDCPL.EXE
2009-07-02 12:48:28 ----A---- C:\WINDOWS\system32\9e0fdo5nloadez767.exe
2009-07-02 12:48:28 ----A---- C:\WINDOWS\system32\9d85zddware3210.dll
2009-07-02 12:48:28 ----A---- C:\WINDOWS\system32\97024zro51c4.exe
2009-07-02 12:48:28 ----A---- C:\WINDOWS\system32\96aathiefz955.dll
2009-07-02 12:48:28 ----A---- C:\WINDOWS\system32\7e1downzoader2955.exe
2009-07-02 12:48:28 ----A---- C:\WINDOWS\system32\7697zparse5225.exe
2009-07-02 12:48:28 ----A---- C:\WINDOWS\system32\6cd0ad5w9rz3242.exe
2009-07-02 12:48:28 ----A---- C:\WINDOWS\system32\59a5zt5a92265.exe
2009-07-02 12:48:28 ----A---- C:\WINDOWS\system32\552sparse6z99.exe
2009-07-02 12:48:28 ----A---- C:\WINDOWS\system32\53z0back9o5r429.exe
2009-07-02 12:48:28 ----A---- C:\WINDOWS\system32\4b7zspyw9re1051.exe
2009-07-02 12:48:28 ----A---- C:\WINDOWS\system32\32382spam9zt7075.dll
2009-07-02 12:48:28 ----A---- C:\WINDOWS\system32\322z89acktool635.exe
2009-07-02 12:48:28 ----A---- C:\WINDOWS\system32\2d9zvi53973.exe
2009-07-02 12:48:28 ----A---- C:\WINDOWS\system32\2515zno9-a-virus653.exe
2009-07-02 12:48:28 ----A---- C:\WINDOWS\system32\23z3viru985.dll
2009-07-02 12:48:28 ----A---- C:\WINDOWS\system32\1fbb9tzal17805.exe
2009-07-02 12:48:28 ----A---- C:\WINDOWS\system32\1517do9n5oaderz026.exe
2009-07-02 12:48:27 ----A---- C:\WINDOWS\system32\z732spa9s52094.dll
2009-07-02 12:48:27 ----A---- C:\WINDOWS\system32\z1da5own9oader874.exe
2009-07-02 12:48:27 ----A---- C:\WINDOWS\system32\932z9i5us3e.dll
2009-07-02 12:48:27 ----A---- C:\WINDOWS\system32\900zw9rm5f4.dll
2009-07-02 12:48:27 ----A---- C:\WINDOWS\system32\7000sp559cz.dll
2009-07-02 12:48:27 ----A---- C:\WINDOWS\system32\619zspambot591.exe
2009-07-02 12:48:27 ----A---- C:\WINDOWS\system32\490zsteal185.exe
2009-07-02 12:48:27 ----A---- C:\WINDOWS\system32\31132vi5usz94.dll
2009-07-02 12:48:27 ----A---- C:\WINDOWS\system32\2f1fthiez925.exe
2009-06-28 15:20:45 ----D---- C:\Program Files\DAEMON Tools Lite
2009-06-24 05:40:14 ----A---- C:\WINDOWS\system32\2990not5a-viruszf4.dll
2009-06-23 14:48:47 ----A---- C:\WINDOWS\system32\5259baczd5or609.dll
2009-06-22 13:53:00 ----A---- C:\WINDOWS\91567szy61e.exe
2009-06-20 11:25:11 ----A---- C:\WINDOWS\system32\ba59hreat7z735.dll
2009-06-14 12:27:37 ----A---- C:\WINDOWS\system32\d3dx10_40.dll
2009-06-14 12:27:37 ----A---- C:\WINDOWS\system32\D3DCompiler_40.dll
2009-06-14 12:27:36 ----A---- C:\WINDOWS\system32\XAPOFX1_2.dll
2009-06-14 12:27:36 ----A---- C:\WINDOWS\system32\D3DX9_40.dll
2009-06-14 12:27:35 ----A---- C:\WINDOWS\system32\XAudio2_3.dll
2009-06-14 12:27:35 ----A---- C:\WINDOWS\system32\xactengine3_3.dll
2009-06-14 12:27:35 ----A---- C:\WINDOWS\system32\X3DAudio1_5.dll
2009-06-14 12:27:34 ----A---- C:\WINDOWS\system32\XAudio2_2.dll
2009-06-14 12:27:34 ----A---- C:\WINDOWS\system32\XAPOFX1_1.dll
2009-06-14 12:27:33 ----A---- C:\WINDOWS\system32\xactengine3_2.dll
2009-06-14 12:27:33 ----A---- C:\WINDOWS\system32\d3dx10_39.dll
2009-06-14 12:27:33 ----A---- C:\WINDOWS\system32\D3DCompiler_39.dll
2009-06-14 12:27:32 ----A---- C:\WINDOWS\system32\D3DX9_39.dll
2009-06-12 23:05:19 ----D---- C:\Documents and Settings\Mchang\Application Data\Ventrilo
2009-06-12 23:05:07 ----D---- C:\Program Files\Ventrilo
2009-06-12 23:05:02 ----A---- C:\WINDOWS\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
2009-06-12 18:07:45 ----A---- C:\WINDOWS\system32\D3DX81ab.dll
2009-06-12 18:05:04 ----D---- C:\Program Files\WC3Banlist
2009-06-12 03:01:53 ----HDC---- C:\WINDOWS\$NtUninstallKB961501$
2009-06-12 03:01:42 ----HDC---- C:\WINDOWS\$NtUninstallKB969897$
2009-06-12 03:01:36 ----HDC---- C:\WINDOWS\$NtUninstallKB969898$
2009-06-12 03:00:37 ----HDC---- C:\WINDOWS\$NtUninstallKB970238$
2009-06-12 03:00:28 ----HDC---- C:\WINDOWS\$NtUninstallKB968537$
2009-06-10 08:29:34 ----A---- C:\WINDOWS\system32\nwiz.exe
2009-06-10 08:29:34 ----A---- C:\WINDOWS\system32\nvwimg.dll
2009-06-10 08:29:34 ----A---- C:\WINDOWS\system32\nvwdmcpl.dll
2009-06-10 08:29:34 ----A---- C:\WINDOWS\system32\nvshell.dll
2009-06-10 08:29:34 ----A---- C:\WINDOWS\system32\nvappbar.exe
2009-06-10 08:29:34 ----A---- C:\WINDOWS\system32\keystone.exe
2009-06-10 08:29:32 ----A---- C:\WINDOWS\system32\nview.dll
2009-06-10 08:29:30 ----A---- C:\WINDOWS\system32\nvcplui.exe
2009-06-10 08:29:20 ----A---- C:\WINDOWS\system32\nvwddi.dll
2009-06-10 08:29:12 ----A---- C:\WINDOWS\system32\nvwss.dll
2009-06-10 08:29:06 ----A---- C:\WINDOWS\system32\nvvitvs.dll
2009-06-10 08:29:02 ----A---- C:\WINDOWS\system32\nvmobls.dll
2009-06-10 08:29:00 ----A---- C:\WINDOWS\system32\nvmccss.dll
2009-06-10 08:28:58 ----A---- C:\WINDOWS\system32\nvgames.dll
2009-06-10 08:28:52 ----A---- C:\WINDOWS\system32\nvdisps.dll
2009-06-10 08:28:50 ----A---- C:\WINDOWS\system32\nvsvc32.exe
2009-06-10 08:28:50 ----A---- C:\WINDOWS\system32\nvmctray.dll
2009-06-10 08:28:50 ----A---- C:\WINDOWS\system32\nvcpl.dll
2009-06-10 08:28:50 ----A---- C:\WINDOWS\system32\nvcolor.exe
2009-06-10 08:28:48 ----A---- C:\WINDOWS\system32\nvmccs.dll

======List of files/folders modified in the last 1 months======

2009-07-02 15:30:56 ----D---- C:\Program Files\Mozilla Firefox
2009-07-02 15:26:52 ----D---- C:\WINDOWS\system32
2009-07-02 15:18:40 ----D---- C:\WINDOWS\system32\drivers
2009-07-02 15:18:39 ----RD---- C:\Program Files
2009-07-02 14:53:27 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-07-02 14:52:16 ----RSH---- C:\boot.ini
2009-07-02 14:52:16 ----A---- C:\WINDOWS\win.ini
2009-07-02 14:52:16 ----A---- C:\WINDOWS\system.ini
2009-07-02 14:32:13 ----SHD---- C:\RECYCLER
2009-07-02 14:31:38 ----D---- C:\Documents and Settings
2009-07-02 14:30:29 ----D---- C:\WINDOWS
2009-07-02 14:15:00 ----D---- C:\WINDOWS\Prefetch
2009-07-02 14:14:59 ----D---- C:\WINDOWS\Temp
2009-07-02 14:03:31 ----D---- C:\Program Files\Common Files\Symantec Shared
2009-07-02 13:38:09 ----D---- C:\WINDOWS\system
2009-07-02 13:37:46 ----SD---- C:\Documents and Settings\Mchang\Application Data\Microsoft
2009-07-02 13:37:21 ----D---- C:\Documents and Settings\Mchang\Application Data\Move Networks
2009-07-02 13:34:21 ----D---- C:\WINDOWS\Minidump
2009-07-02 13:34:21 ----D---- C:\WINDOWS\Debug
2009-07-02 13:23:58 ----D---- C:\WINDOWS\system32\CatRoot2
2009-07-02 13:19:32 ----SHD---- C:\System Volume Information
2009-07-02 13:19:32 ----D---- C:\WINDOWS\system32\Restore
2009-07-02 00:14:03 ----D---- C:\Program Files\Warcraft III
2009-06-29 14:20:37 ----HD---- C:\Program Files\InstallShield Installation Information
2009-06-29 14:04:06 ----D---- C:\Documents and Settings\Mchang\Application Data\uTorrent
2009-06-28 17:36:55 ----D---- C:\Program Files\Steam
2009-06-28 15:46:05 ----SHD---- C:\WINDOWS\Installer
2009-06-28 15:46:05 ----SHD---- C:\Config.Msi
2009-06-28 15:46:00 ----D---- C:\Program Files\AMD
2009-06-28 15:37:30 ----SD---- C:\WINDOWS\Tasks
2009-06-28 14:23:29 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-06-28 14:23:29 ----D---- C:\Program Files\AGEIA Technologies
2009-06-28 01:15:13 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2009-06-28 01:13:56 ----HD---- C:\WINDOWS\inf
2009-06-28 01:13:19 ----D---- C:\NVIDIA
2009-06-23 20:17:44 ----A---- C:\WINDOWS\system32\PnkBstrB.exe
2009-06-23 18:11:59 ----D---- C:\WINDOWS\system32\DirectX
2009-06-23 18:11:47 ----RSD---- C:\WINDOWS\assembly
2009-06-17 23:54:47 ----D---- C:\Documents and Settings\Mchang\Application Data\DNA
2009-06-16 21:21:40 ----D---- C:\GAMES!
2009-06-13 18:57:07 ----D---- C:\Program Files\Crayon Physics Deluxe
2009-06-12 18:12:15 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-06-12 03:01:36 ----HD---- C:\WINDOWS\$hf_mig$
2009-06-10 06:03:00 ----A---- C:\WINDOWS\system32\nv4_disp(2).dll

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-13 14592]
R1 NVTCP;NVIDIA TCP/IP Protocol Driver; C:\WINDOWS\System32\DRIVERS\NVTcp.sys [2005-02-24 99840]
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2008-04-13 8832]
R1 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-08-23 12032]
R3 AmdLLD;AMD Low Level Device Driver; C:\WINDOWS\system32\DRIVERS\AmdLLD.sys [2007-06-29 34304]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 hidusb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-23 12160]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2008-08-07 111360]
R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-13 17152]
S1 AmdPPM;AMD HwPState Processor Driver; C:\WINDOWS\system32\DRIVERS\AmdPPM.sys [2007-04-16 33792]
S1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys []
S1 SAVRT;SAVRT; \??\C:\Program Files\Symantec Client Security\Symantec AntiVirus\savrt.sys []
S1 SAVRTPEL;SAVRTPEL; \??\C:\Program Files\Symantec Client Security\Symantec AntiVirus\Savrtpel.sys []
S1 SYMTDI;SYMTDI; C:\WINDOWS\System32\Drivers\SYMTDI.SYS [2007-08-27 189320]
S3 agqhsdfp;agqhsdfp; C:\WINDOWS\system32\drivers\agqhsdfp.sys []
S3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2008-01-24 4127488]
S3 Ambfilt;Ambfilt; C:\WINDOWS\system32\drivers\Ambfilt.sys [2008-08-05 1684736]
S3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys []
S3 gdrv;gdrv; \??\C:\WINDOWS\gdrv.sys []
S3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2009-05-15 5080064]
S3 Monfilt;Monfilt; C:\WINDOWS\system32\drivers\Monfilt.sys [2006-01-04 1389056]
S3 NAVENG;NAVENG; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20090628.006\naveng.sys []
S3 NAVEX15;NAVEX15; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20090628.006\navex15.sys []
S3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
S3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2009-04-30 8055584]
S3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2005-02-24 33408]
S3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2005-02-24 12928]
S3 PnkBstrK;PnkBstrK; \??\C:\WINDOWS\system32\drivers\PnkBstrK.sys []
S3 SPBBCDrv;SPBBCDrv; \??\C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys []
S3 SYMDNS;SYMDNS; C:\WINDOWS\System32\Drivers\SYMDNS.SYS [2007-08-27 12680]
S3 SymEvent;SymEvent; \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS []
S3 SYMFW;SYMFW; C:\WINDOWS\System32\Drivers\SYMFW.SYS [2007-08-27 97672]
S3 SYMIDS;SYMIDS; C:\WINDOWS\System32\Drivers\SYMIDS.SYS [2007-08-27 31624]
S3 SYMIDSCO;SYMIDSCO; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\SymcData\SCFIDS~1\20090618.001\symidsco.sys []
S3 SYMNDIS;SYMNDIS; C:\WINDOWS\System32\Drivers\SYMNDIS.SYS [2007-08-27 28040]
S3 SYMREDRV;SYMREDRV; C:\WINDOWS\System32\Drivers\SYMREDRV.SYS [2007-08-27 23944]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []
S4 sr;System Restore Filter Driver; C:\WINDOWS\system32\DRIVERS\sr.sys [2008-04-13 73472]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aawservice;Ad-Aware 2007 Service; C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe [2008-01-04 587096]
S2 ccEvtMgr;Symantec Event Manager; C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe [2007-05-29 192104]
S2 ccProxy;Symantec Network Proxy; C:\Program Files\Common Files\Symantec Shared\ccProxy.exe [2007-05-29 202344]
S2 ccSetMgr;Symantec Settings Manager; C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe [2007-05-29 169576]
S2 DefWatch;Symantec AntiVirus Definition Watcher; C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe [2007-10-07 31160]
S2 ForceWare Intelligent Application Manager (IAM);ForceWare Intelligent Application Manager (IAM); C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe [2005-02-24 139264]
S2 ForcewareWebInterface;Forceware Web Interface; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe [2004-11-30 20543]
S2 ISSVC;IS Service; C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe [2007-09-07 87416]
S2 nSvcIp;ForceWare IP service; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe [2005-02-24 131133]
S2 nSvcLog;ForceWare user log service; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe [2005-02-24 57409]
S2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2009-05-01 168004]
S2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2009-05-31 75064]
S2 PnkBstrB;PnkBstrB; C:\WINDOWS\system32\PnkBstrB.exe [2009-06-23 189288]
S2 Symantec AntiVirus;Symantec AntiVirus; C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe [2007-10-07 1822648]
S2 SymSecurePort;Symantec SecurePort; C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe [2007-09-07 173432]
S2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [2006-10-20 36864]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2006-10-30 741376]
S3 LiveUpdate;LiveUpdate; C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE [2007-08-28 2999664]
S3 SavRoam;SAVRoam; C:\Program Files\Symantec Client Security\Symantec AntiVirus\SavRoam.exe [2007-10-07 116664]
S3 SNDSrvc;Symantec Network Drivers Service; C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe [2007-08-27 214408]
S3 SPBBCSvc;Symantec SPBBCSvc; C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe [2007-07-26 1181016]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2006-10-30 122880]

-----------------EOF-----------------

[garmanma]

I'm sorry, but you need to repost you log.

I have moved your Topic that included a HijackThis/DDS log here to the Misplaced HJT Logs forum. You posted your log in a forum not intended for HijackThis/DDS logs analysis. We can only allow topics with such logs in the HijackThis Logs and Malware Removal forum. This restriction is to ensure you get the best help available, from those who specialize in malware anlaysis and removal. It also should prevent you from receiving ineffective or even potentially dangerous advice, whether well meaning or not.

We understand that dealing with malware issues and getting help can be frustrating but improperly posting a log usually happens if you missed the directions we provide to those who require malware removal assistance. Prior to posting a log, we ask that you please read and follow all instructions in the pinned topic titled Preparation Guide For Use Before Posting A Hijackthis Log. Following the steps in this Guide will allow the HJT Team to quickly help you with specific fixes for what may remain on your system.

Please complete all the steps in the Guide. If you can't perform a step, then skip it and continue with the next. In Step 6 there are instructions for downloading and running DDS which will create a Pseudo HJT Report as part of its log.

When you have completed those steps, start a new topic in the HijackThis Logs and Malware Removal forum as directed in the Prep Guide to post a new log.

Please do not post any more logs to this topic as it just a placeholder to be used to help you post the information in the proper way and in the proper forum. Going forward, HijackThis logs should only be posted in the HijackThis Logs and Virus/Trojan/Spyware/Malware Removal in order to make it easier for our helpers to respond to your topic

The Misplaced HJT Logs forum is strictly a holding area where the BC Staff can assist you with preparations for and to properly post your log. If you have a question or encounter a problem in the Prep Guide, please do post back to this topic; that is what it is here for.

When your new DDS/HJT log is posted in the proper forum, please reply to this topic with a link to your new topic. Once that is done, a Member of the HJT Team will analyze your log and assist you with step by step instructions to clean your computer or otherwise advise what needs to be done.

Thanks for your cooperation and good luck.
The BC Staff

[Orange Blossom]

Hello

Now that your log is properly posted, you should NOT make further changes to your computer (install/uninstall programs, use special fix tools, delete files, edit the registry, etc) unless advised by a HJT Team member, nor should you ask for help elsewhere. Doing so can result in system changes which may not show in the log you already posted. Further, any modifications you make on your own may cause confusion for the helper assisting you and could complicate the malware removal process which would extend the time it takes to clean your computer.

From this point on the HJT Team should be the only members that you take advice from, until they have verified your log as clean.

Please be patient. It may take a while to get a response because the HJT Team members are EXTREMELY busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Once you have made your post and are waiting, please DO NOT make another reply until it has been responded to by a member of the HJT Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another HJT Team member is already assisting you and not open the thread to respond. Please be patient. It may take a while to get a response but your log will be reviewed and answered as soon as possible

To avoid confusion, I am closing this topic. Good luck with your log.

The BC Staff