Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

DDS, Combofix, HJT logs-Google Redirects/Popups/Spyware ads


  • This topic is locked This topic is locked
2 replies to this topic

#1 wildcat2000

wildcat2000

  • Members
  • 82 posts
  • OFFLINE
  •  
  • Local time:03:37 PM

Posted 30 June 2009 - 10:28 PM

Referred here from: http://www.bleepingcomputer.com/forums/t/237901/wanna-make-sure-my-infection-is-gone/ ~ OB

First DDS log-

DDS (Ver_09-06-26.01) - NTFSx86
Run by Jeremy at 20:16:04.59 on Tue 06/30/2009
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.958.653 [GMT -7:00]


============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Belkin\F5D7001v2000\Belkinwcui.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Jeremy\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.yahoo.com/
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [BitTorrent DNA] "c:\program files\dna\btdna.exe"
uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
mRun: [ehTray] c:\windows\ehome\ehtray.exe
mRun: [Broadcom Wireless Manager UI] c:\windows\system32\WLTRAY.exe
mRun: [SoundMan] SOUNDMAN.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\belkin~1.lnk - c:\program files\belkin\f5d7001v2000\Belkinwcui.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} - hxxps://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {9A57B18E-2F5D-11D5-8997-00104BD12D94} - hxxp://support.gateway.com/support/serialharvest/gwCID.CAB
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Notify: AtiExtEvent - Ati2evxx.dll

============= SERVICES / DRIVERS ===============

R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]
R2 ubsbm;Unibrain 1394 SBM Driver;c:\windows\system32\drivers\UBSBM.sys [2005-7-27 14080]
R2 ubumapi;Unibrain 1394 FireAPI Driver;c:\windows\system32\drivers\UBUMAPI.sys [2005-7-27 36352]
R3 HSFHWATI;HSFHWATI;c:\windows\system32\drivers\HSFHWATI.sys [2005-1-25 200576]
R3 ubohci;Unibrain 1394 OHCI Driver;c:\windows\system32\drivers\ubohci.sys [2005-7-27 77056]
S3 ADM8511;ADMtek ADM8511/AN986 USB To Fast Ethernet Converter;c:\windows\system32\drivers\ADM8511.SYS [2009-5-19 20160]
S3 el575nd5;3Com Megahertz 10/100 LAN CardBus PC Card Driver;c:\windows\system32\drivers\el575ND5.sys [2009-5-3 69692]

=============== Created Last 30 ================

2009-06-30 19:27 --d----- c:\program files\CCleaner
2009-06-29 22:42 578,560 ac------ c:\windows\system32\dllcache\user32.dll
2009-06-29 22:35 --d----- c:\windows\ERUNT
2009-06-29 22:16 -cd----- c:\windows\system32\dllcache\cache
2009-06-29 22:07 a-dshr-- C:\cmdcons
2009-06-29 22:05 161,792 a------- c:\windows\SWREG.exe
2009-06-29 22:05 155,136 a------- c:\windows\PEV.exe
2009-06-29 22:05 98,816 a------- c:\windows\sed.exe
2009-06-29 22:04 --ds---- C:\ComboFixprogram
2009-06-29 21:58 --d----- C:\SDFix
2009-06-29 21:58 --d----- c:\program files\Trend Micro
2009-06-28 23:04 --d----- c:\program files\common files\xing shared
2009-06-28 23:04 --d----- c:\program files\common files\Real
2009-06-26 17:48 32,128 ac------ c:\windows\system32\dllcache\usbccgp.sys
2009-06-26 17:48 32,128 a------- c:\windows\system32\drivers\usbccgp.sys
2009-06-23 16:06 16 a------- c:\windows\popcinfo.dat
2009-06-21 19:55 --d----- c:\program files\GlobFX
2009-06-21 19:50 --d----- c:\docume~1\jeremy\applic~1\SWF.max
2009-06-21 19:49 --d----- c:\program files\SWF.max
2009-06-21 19:23 --d----- c:\windows\system32\Adobe
2009-06-13 20:26 --d----- c:\program files\Microsoft
2009-06-11 14:50 208,744 a------- c:\windows\system32\muweb.dll
2009-06-11 14:50 268,648 a------- c:\windows\system32\mucltui.dll
2009-06-11 14:50 27,496 a------- c:\windows\system32\mucltui.dll.mui
2009-06-10 23:45 --d----- c:\documents and settings\jeremy\Tracing
2009-06-10 23:44 --d----- c:\program files\Windows Live SkyDrive
2009-06-10 23:38 --d----- c:\program files\common files\Windows Live
2009-06-10 18:54 --d----- c:\program files\VideoLAN
2009-06-10 17:45 --d-h--- c:\windows\PIF
2009-06-10 17:03 --d----- c:\documents and settings\jeremy\.thumbnails
2009-06-10 15:59 118,784 a------- c:\windows\system32\ac3acm.acm
2009-06-10 15:59 3,596,288 a------- c:\windows\system32\qt-dx331.dll
2009-06-10 15:59 1,565,480 a------- c:\windows\system32\wmv9vcm.dll
2009-06-10 15:59 765,952 a------- c:\windows\system32\xvidcore.dll
2009-06-10 15:59 200,704 a------- c:\windows\system32\ssldivx.dll
2009-06-10 15:59 180,224 a------- c:\windows\system32\xvidvfw.dll
2009-06-10 15:59 1,044,480 a------- c:\windows\system32\libdivx.dll
2009-06-10 15:59 635,486 a------- c:\windows\system32\divx.dll
2009-06-10 15:59 196,608 a------- c:\windows\system32\dtu100.dll
2009-06-10 15:59 73,728 a------- c:\windows\system32\dpl100.dll
2009-06-10 15:59 10,752 a------- c:\windows\system32\ff_vfw.dll
2009-06-10 15:59 547 a------- c:\windows\system32\ff_vfw.dll.manifest
2009-06-10 15:59 --d----- c:\program files\K-Lite Codec Pack
2009-06-10 15:50 --d----- c:\documents and settings\jeremy\.gimp-2.6
2009-06-10 15:50 --d----- c:\documents and settings\jeremy\.gegl-0.0
2009-06-10 15:49 --d----- c:\program files\GIMP-2.0
2009-06-10 15:43 --d----- c:\docume~1\jeremy\applic~1\BitTorrent
2009-06-10 15:43 --d----- c:\program files\DNA
2009-06-10 15:43 --d----- c:\program files\BitTorrent
2009-06-10 15:43 --d----- c:\docume~1\jeremy\applic~1\DNA
2009-06-10 15:41 --d----- c:\docume~1\jeremy\applic~1\Malwarebytes
2009-06-10 15:41 40,160 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-10 15:41 19,096 a------- c:\windows\system32\drivers\mbam.sys
2009-06-10 15:41 --d----- c:\program files\Malwarebytes' Anti-Malware
2009-06-10 15:41 --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-06-10 14:55 246,272 -c------ c:\windows\system32\dllcache\ieproxy.dll
2009-06-10 14:55 12,800 -c------ c:\windows\system32\dllcache\xpshims.dll
2009-06-10 14:55 1,985,024 -c------ c:\windows\system32\dllcache\iertutil.dll
2009-06-10 14:55 11,064,832 -c------ c:\windows\system32\dllcache\ieframe.dll
2009-06-08 15:06 169 a------- c:\windows\RtlRack.ini
2009-06-08 12:41 --d----- c:\program files\Realtek Sound Manager
2009-06-08 12:41 --d----- c:\program files\AvRack
2009-06-08 12:41 164 -------- c:\windows\avrack.ini
2009-06-08 12:36 391,424 -------- c:\windows\system32\drivers\alcxsens.sys
2009-06-06 16:39 --d----- c:\program files\Realtek AC97
2009-06-06 16:35 --d----- c:\windows\pss
2009-06-06 16:07 49,152 a------- c:\windows\system32\ChCfg.exe
2009-06-06 16:07 6,272 ac------ c:\windows\system32\dllcache\splitter.sys
2009-06-06 16:07 6,272 a------- c:\windows\system32\drivers\splitter.sys
2009-06-06 16:07 83,072 ac------ c:\windows\system32\dllcache\wdmaud.sys
2009-06-06 16:07 83,072 a------- c:\windows\system32\drivers\wdmaud.sys
2009-06-06 16:07 52,864 ac------ c:\windows\system32\dllcache\dmusic.sys
2009-06-06 16:07 52,864 a------- c:\windows\system32\drivers\DMusic.sys
2009-06-06 16:07 56,576 ac------ c:\windows\system32\dllcache\swmidi.sys
2009-06-06 16:07 56,576 a------- c:\windows\system32\drivers\swmidi.sys
2009-06-06 15:49 --d----- c:\program files\Realtek
2009-06-06 14:54 35,840 a------- c:\windows\system32\drivers\AmdK8.sys
2009-06-06 14:54 --d----- c:\program files\AMD
2009-06-06 14:36 --dsh--- c:\documents and settings\jeremy\IECompatCache
2009-06-06 14:36 --dsh--- c:\documents and settings\jeremy\PrivacIE
2009-06-06 14:35 1,089,593 -c------ c:\windows\system32\dllcache\ntprint.cat
2009-06-04 16:46 0 a------- C:\LOG61.tmp
2009-06-04 16:34 --dsh--- c:\documents and settings\jeremy\IETldCache
2009-06-04 16:29 --d----- c:\windows\system32\XPSViewer
2009-06-04 16:28 1,676,288 -c------ c:\windows\system32\dllcache\xpssvcs.dll
2009-06-04 16:28 597,504 -c------ c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-06-04 16:28 575,488 -c------ c:\windows\system32\dllcache\xpsshhdr.dll
2009-06-04 16:28 89,088 -c------ c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-06-04 16:28 --d----- C:\4df7d723677382ba7fa18e85162d
2009-06-04 16:28 1,676,288 -------- c:\windows\system32\xpssvcs.dll
2009-06-04 16:28 575,488 -------- c:\windows\system32\xpsshhdr.dll
2009-06-04 16:28 117,760 -------- c:\windows\system32\prntvpt.dll
2009-06-04 16:26 --d----- c:\windows\ie8updates
2009-06-04 16:25 102,912 -c------ c:\windows\system32\dllcache\iecompat.dll
2009-06-04 16:24 -cd-h--- c:\windows\ie8
2009-06-04 16:03 434,022 a------- c:\windows\system32\bcmwl5.inf
2009-06-04 16:03 425,216 a------- c:\windows\system32\bcmwl5.sys
2009-06-04 16:03 122,880 a------- c:\windows\system32\bcmwls32.exe
2009-06-04 16:03 81,920 a------- c:\windows\system32\bcmwliss.dll
2009-06-04 16:03 76,710 a------- c:\windows\system32\bcmwls.ini
2009-06-04 16:03 33,664 a------- c:\windows\system32\bcmwlnpf.sys
2009-06-04 16:03 8,300 a------- c:\windows\system32\bcm43xx.cat
2009-06-04 16:03 --d----- c:\program files\Belkin
2009-06-04 16:01 --d----- c:\program files\Unibrain
2009-06-04 16:01 --d----- c:\windows\Downloaded Installations
2009-06-04 16:01 --d----- c:\program files\Intel Desktop Board
2009-06-04 15:46 --d----- c:\docume~1\alluse~1\applic~1\PC Drivers HeadQuarters
2009-06-04 15:16 --d----- c:\program files\SigmaTel

==================== Find3M ====================

2009-06-08 12:51 2,012 a------- c:\program files\DriversHQ.DriverDetective.Client.InstallState
2009-06-08 12:51 124,288 a------- c:\program files\DriversHQ.DriverDetective.Client.Updater.exe
2009-06-08 12:51 2,237,808 a------- c:\program files\DriversHQ.DriverDetective.Client.exe
2009-06-08 12:51 140,656 a------- c:\program files\DriversHQ.DriverDetective.Common.dll
2009-06-08 12:51 157,104 a------- c:\program files\DriversHQ.DriverDetective.Client.Communication.XmlSerializers.dll
2009-06-08 12:51 120,208 a------- c:\program files\DriversHQ.DriverDetective.Client.Communication.dll
2009-06-08 12:51 66,968 a------- c:\program files\DriversHQ.DriverDetective.Client.ExceptionLogging.dll
2009-06-08 12:51 38,280 a------- c:\program files\DriversHQ.DriverDetective.ExceptionLogging.dll
2009-06-08 12:51 21,944 a------- c:\program files\DriversHQ.DriverDetective.Client.ExceptionLogging.XmlSerializers.dll
2009-05-21 11:29 61,440 a------- c:\program files\Microsoft.ApplicationBlocks.Updater.ActivationProcessors.dll
2009-05-21 11:29 28,672 a------- c:\program files\Microsoft.ApplicationBlocks.Updater.Downloaders.dll
2009-05-21 11:29 36,864 a------- c:\program files\Interop.WindowsInstaller.dll
2009-05-21 11:29 118,784 a------- c:\program files\Microsoft.ApplicationBlocks.Updater.dll
2009-05-21 11:28 69,632 a------- c:\program files\Microsoft.Practices.EnterpriseLibrary.Security.Cryptography.dll
2009-05-21 11:28 90,112 a------- c:\program files\Microsoft.Practices.EnterpriseLibrary.Common.dll
2009-05-21 11:28 8,192 a------- c:\program files\ISUninstall.exe
2009-05-21 11:28 57,344 a------- c:\program files\Microsoft.Practices.ObjectBuilder.dll
2009-05-21 11:28 3,581 a------- c:\program files\DriversHQ.DriverDetective.Client.Updater.exe.config
2009-05-21 11:28 49,152 a------- c:\program files\XPBurnComponent.dll
2009-05-21 11:28 5,294 a------- c:\program files\DriversHQ.DriverDetective.Client.exe.config
2009-05-21 09:32 55,116 a------- c:\program files\DriverDetective.chm
2009-05-19 14:22 86,811 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat
2009-05-12 22:15 915,456 a------- c:\windows\system32\wininet.dll
2009-05-07 08:32 345,600 a------- c:\windows\system32\localspl.dll
2009-04-30 10:01 113 a------- c:\program files\DriversHQ.com Knowledge Base.url
2009-04-17 05:26 1,847,168 a------- c:\windows\system32\win32k.sys
2009-04-15 07:51 585,216 a------- c:\windows\system32\rpcrt4.dll

============= FINISH: 20:16:11.42 ===============

Combofix log (Note some rootkits files were found but program supposedly deleted them)


ComboFix 09-06-29.07 - Jeremy 06/30/2009 20:03.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.958.693 [GMT -7:00]
Running from: c:\documents and settings\Jeremy\My Documents\ComboFixsoftware.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\drivers\hjgruixmijyidu.sys
c:\windows\system32\hjgruipobuyavr.dll
c:\windows\system32\hjgruirhcjmsqs.dll
c:\windows\system32\hjgruisrnttklf.dat
c:\windows\system32\hjgruiuwogturu.dat

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_hjgruiwbpfnxep
-------\Service_hjgruiwbpfnxep


((((((((((((((((((((((((( Files Created from 2009-06-01 to 2009-07-01 )))))))))))))))))))))))))))))))
.

2009-07-01 02:27 . 2009-07-01 02:27 -------- d-----w- c:\program files\CCleaner
2009-06-30 05:42 . 2009-06-30 05:42 578560 -c--a-w- c:\windows\system32\dllcache\user32.dll
2009-06-30 05:35 . 2009-06-30 05:35 -------- d-----w- c:\windows\ERUNT
2009-06-30 05:04 . 2009-06-30 05:19 -------- d-s---w- C:\ComboFixprogram
2009-06-30 04:58 . 2009-06-30 22:38 -------- d-----w- C:\SDFix
2009-06-30 04:58 . 2009-06-30 04:58 -------- d-----w- c:\program files\Trend Micro
2009-06-30 03:01 . 2009-06-30 03:01 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2009-06-29 06:04 . 2009-06-29 06:04 -------- d-----w- c:\program files\Common Files\xing shared
2009-06-29 06:04 . 2009-06-29 06:04 -------- d-----w- c:\program files\Real
2009-06-29 06:04 . 2009-06-29 06:07 -------- d-----w- c:\program files\Common Files\Real
2009-06-27 00:48 . 2008-04-13 18:45 32128 -c--a-w- c:\windows\system32\dllcache\usbccgp.sys
2009-06-27 00:48 . 2008-04-13 18:45 32128 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2009-06-23 23:06 . 2009-06-23 23:06 16 ----a-w- c:\windows\popcinfo.dat
2009-06-22 02:55 . 2009-06-22 02:55 -------- d-----w- c:\program files\GlobFX
2009-06-22 02:50 . 2009-06-22 02:53 -------- d-----w- c:\documents and settings\Jeremy\Application Data\SWF.max
2009-06-22 02:49 . 2009-06-27 05:21 -------- d-----w- c:\program files\SWF.max
2009-06-22 02:45 . 2009-06-22 02:45 -------- d-----w- c:\program files\FLV Player
2009-06-22 02:26 . 2009-06-22 02:37 -------- d-----w- c:\documents and settings\Jeremy\Local Settings\Application Data\Adobe
2009-06-22 02:26 . 2009-06-22 02:26 86016 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\arh.exe
2009-06-22 02:26 . 2009-06-22 02:37 -------- d-----w- c:\program files\NOS
2009-06-22 02:26 . 2009-06-22 02:37 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2009-06-22 02:23 . 2009-06-22 02:24 -------- d-----w- c:\windows\system32\Adobe
2009-06-14 03:26 . 2009-06-14 03:26 -------- d-----w- c:\program files\Microsoft
2009-06-14 03:26 . 2009-06-14 03:26 -------- d-----w- c:\program files\Windows Live
2009-06-13 05:38 . 2009-06-13 05:38 -------- d-----w- c:\documents and settings\Jeremy\Local Settings\Application Data\Identities
2009-06-11 21:50 . 2008-10-16 21:06 208744 ----a-w- c:\windows\system32\muweb.dll
2009-06-11 21:50 . 2008-10-16 21:06 268648 ----a-w- c:\windows\system32\mucltui.dll
2009-06-11 06:45 . 2009-07-01 03:06 -------- d-----w- c:\documents and settings\Jeremy\Tracing
2009-06-11 06:44 . 2009-06-11 06:44 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-06-11 06:38 . 2009-06-11 06:38 -------- d-----w- c:\program files\Common Files\Windows Live
2009-06-11 01:55 . 2009-06-17 02:59 -------- d-----w- c:\documents and settings\Jeremy\Application Data\vlc
2009-06-11 01:54 . 2009-06-11 01:54 -------- d-----w- c:\program files\VideoLAN
2009-06-11 00:45 . 2009-06-11 00:45 -------- d--h--w- c:\windows\PIF
2009-06-11 00:03 . 2009-06-27 03:35 -------- d-----w- c:\documents and settings\Jeremy\Application Data\gtk-2.0
2009-06-11 00:03 . 2009-06-11 00:03 -------- d-----w- c:\documents and settings\Jeremy\.thumbnails
2009-06-10 23:41 . 2009-06-10 23:41 -------- d-----w- c:\documents and settings\Jeremy\Application Data\Media Player Classic
2009-06-10 22:59 . 2007-01-21 04:26 1565480 ----a-w- c:\windows\system32\wmv9vcm.dll
2009-06-10 22:59 . 2006-11-01 21:54 180224 ----a-w- c:\windows\system32\xvidvfw.dll
2009-06-10 22:59 . 2006-11-01 21:52 765952 ----a-w- c:\windows\system32\xvidcore.dll
2009-06-10 22:59 . 2006-07-28 02:28 3596288 ----a-w- c:\windows\system32\qt-dx331.dll
2009-06-10 22:59 . 2006-07-12 08:40 200704 ----a-w- c:\windows\system32\ssldivx.dll
2009-06-10 22:59 . 2007-01-10 01:46 10752 ----a-w- c:\windows\system32\ff_vfw.dll
2009-06-10 22:59 . 2006-10-03 04:04 635486 ----a-w- c:\windows\system32\divx.dll
2009-06-10 22:59 . 2006-08-11 08:04 73728 ----a-w- c:\windows\system32\dpl100.dll
2009-06-10 22:59 . 2006-08-11 08:03 196608 ----a-w- c:\windows\system32\dtu100.dll
2009-06-10 22:59 . 2006-07-12 08:40 1044480 ----a-w- c:\windows\system32\libdivx.dll
2009-06-10 22:59 . 2009-06-10 22:59 -------- d-----w- c:\program files\K-Lite Codec Pack
2009-06-10 22:50 . 2009-06-27 03:36 -------- d-----w- c:\documents and settings\Jeremy\.gimp-2.6
2009-06-10 22:50 . 2009-06-10 22:50 -------- d-----w- c:\documents and settings\Jeremy\.gegl-0.0
2009-06-10 22:49 . 2009-06-10 22:49 -------- d-----w- c:\program files\GIMP-2.0
2009-06-10 22:43 . 2009-06-30 09:36 -------- d-----w- c:\documents and settings\Jeremy\Application Data\BitTorrent
2009-06-10 22:43 . 2009-06-10 22:43 -------- d-----w- c:\documents and settings\Jeremy\Local Settings\Application Data\DNA
2009-06-10 22:43 . 2009-07-01 03:06 -------- d-----w- c:\program files\DNA
2009-06-10 22:43 . 2009-07-01 03:06 -------- d-----w- c:\documents and settings\Jeremy\Application Data\DNA
2009-06-10 22:43 . 2009-06-10 22:43 -------- d-----w- c:\program files\BitTorrent
2009-06-10 22:41 . 2009-06-10 22:41 -------- d-----w- c:\documents and settings\Jeremy\Application Data\Malwarebytes
2009-06-10 22:41 . 2009-05-26 20:20 40160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-10 22:41 . 2009-06-10 22:41 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-06-10 22:41 . 2009-06-10 22:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-06-10 22:41 . 2009-05-26 20:19 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-06-10 21:55 . 2009-04-30 21:22 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2009-06-10 21:55 . 2009-04-30 21:22 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2009-06-10 21:55 . 2009-04-30 21:22 1985024 -c----w- c:\windows\system32\dllcache\iertutil.dll
2009-06-10 21:55 . 2009-04-30 21:22 11064832 -c----w- c:\windows\system32\dllcache\ieframe.dll
2009-06-10 21:52 . 2009-06-10 21:52 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2009-06-08 19:41 . 2009-06-08 19:41 -------- d-----w- c:\program files\Realtek Sound Manager
2009-06-08 19:41 . 2009-06-08 19:41 -------- d-----w- c:\program files\AvRack
2009-06-08 19:36 . 2003-12-12 06:54 391424 ------w- c:\windows\system32\drivers\alcxsens.sys
2009-06-06 23:39 . 2009-06-06 23:39 -------- d-----w- c:\program files\Realtek AC97
2009-06-06 23:07 . 2006-08-01 22:02 49152 ----a-w- c:\windows\system32\ChCfg.exe
2009-06-06 23:07 . 2008-04-13 18:45 6272 -c--a-w- c:\windows\system32\dllcache\splitter.sys
2009-06-06 23:07 . 2008-04-13 18:45 6272 ----a-w- c:\windows\system32\drivers\splitter.sys
2009-06-06 23:07 . 2008-04-13 19:17 83072 -c--a-w- c:\windows\system32\dllcache\wdmaud.sys
2009-06-06 23:07 . 2008-04-13 19:17 83072 ----a-w- c:\windows\system32\drivers\wdmaud.sys
2009-06-06 23:07 . 2008-04-13 18:45 52864 -c--a-w- c:\windows\system32\dllcache\dmusic.sys
2009-06-06 23:07 . 2008-04-13 18:45 52864 ----a-w- c:\windows\system32\drivers\DMusic.sys
2009-06-06 23:07 . 2008-04-13 18:45 56576 -c--a-w- c:\windows\system32\dllcache\swmidi.sys
2009-06-06 23:07 . 2008-04-13 18:45 56576 ----a-w- c:\windows\system32\drivers\swmidi.sys
2009-06-06 22:49 . 2009-06-06 22:49 -------- d-----w- c:\program files\Realtek
2009-06-06 21:54 . 2009-06-06 21:54 -------- d-----w- c:\program files\AMD
2009-06-06 21:54 . 2004-05-08 17:21 35840 ----a-w- c:\windows\system32\drivers\AmdK8.sys
2009-06-06 21:36 . 2009-06-06 21:36 -------- d-sh--w- c:\documents and settings\Jeremy\IECompatCache
2009-06-06 21:36 . 2009-06-06 21:36 -------- d-sh--w- c:\documents and settings\Jeremy\PrivacIE
2009-06-04 23:48 . 2006-12-14 17:00 110592 ----a-w- c:\documents and settings\Jeremy\Application Data\U3\temp\cleanup.exe
2009-06-04 23:46 . 2007-02-13 00:46 3096576 ---ha-w- c:\documents and settings\Jeremy\Application Data\U3\temp\Launchpad Removal.exe
2009-06-04 23:45 . 2009-06-04 23:46 -------- d-----w- c:\documents and settings\Jeremy\Application Data\U3
2009-06-04 23:34 . 2009-06-04 23:34 -------- d-sh--w- c:\documents and settings\Jeremy\IETldCache
2009-06-04 23:29 . 2009-06-04 23:29 -------- d-----w- c:\windows\system32\XPSViewer
2009-06-04 23:29 . 2009-06-04 23:29 -------- d-----w- c:\program files\MSBuild
2009-06-04 23:29 . 2009-06-04 23:29 -------- d-----w- c:\program files\Reference Assemblies
2009-06-04 23:28 . 2009-06-04 23:29 -------- d-----w- C:\4df7d723677382ba7fa18e85162d
2009-06-04 23:28 . 2008-07-06 12:06 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-06-04 23:28 . 2008-07-06 12:06 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll
2009-06-04 23:28 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll
2009-06-04 23:28 . 2008-07-06 12:06 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll
2009-06-04 23:28 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll
2009-06-04 23:28 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll
2009-06-04 23:28 . 2008-07-06 10:50 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-06-04 23:26 . 2009-06-04 23:26 -------- d-----w- c:\windows\ie8updates
2009-06-04 23:25 . 2009-05-12 05:11 102912 -c----w- c:\windows\system32\dllcache\iecompat.dll
2009-06-04 23:24 . 2009-06-04 23:25 -------- dc-h--w- c:\windows\ie8
2009-06-04 23:03 . 2006-01-20 09:16 425216 ----a-w- c:\windows\system32\bcmwl5.sys
2009-06-04 23:03 . 2006-01-20 09:15 81920 ----a-w- c:\windows\system32\bcmwliss.dll
2009-06-04 23:03 . 2006-01-20 09:15 33664 ----a-w- c:\windows\system32\bcmwlnpf.sys
2009-06-04 23:03 . 2006-01-20 09:15 122880 ----a-w- c:\windows\system32\bcmwls32.exe
2009-06-04 23:03 . 2009-06-04 23:03 -------- d-----w- c:\program files\Belkin
2009-06-04 23:01 . 2009-06-04 23:01 -------- d-----w- c:\program files\Unibrain
2009-06-04 23:01 . 2009-06-04 23:01 -------- d-----w- c:\windows\Downloaded Installations
2009-06-04 23:01 . 2009-06-04 23:01 -------- d-----w- c:\program files\Intel Desktop Board
2009-06-04 22:46 . 2009-06-04 22:46 -------- d-----w- c:\documents and settings\Jeremy\Local Settings\Application Data\PC_Drivers_Headquarters
2009-06-04 22:46 . 2009-06-04 22:46 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Drivers HeadQuarters
2009-06-04 22:16 . 2009-06-04 22:16 -------- d-----w- c:\program files\SigmaTel

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-11 06:45 . 2005-11-23 09:38 15808 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-08 19:51 . 2009-06-04 22:46 2012 ----a-w- c:\program files\DriversHQ.DriverDetective.Client.InstallState
2009-06-08 19:51 . 2009-05-21 16:32 124288 ----a-w- c:\program files\DriversHQ.DriverDetective.Client.Updater.exe
2009-06-08 19:51 . 2009-05-21 16:32 140656 ----a-w- c:\program files\DriversHQ.DriverDetective.Common.dll
2009-06-08 19:51 . 2009-05-21 16:32 2237808 ----a-w- c:\program files\DriversHQ.DriverDetective.Client.exe
2009-06-08 19:51 . 2009-05-21 16:32 120208 ----a-w- c:\program files\DriversHQ.DriverDetective.Client.Communication.dll
2009-06-08 19:51 . 2009-05-21 16:32 38280 ----a-w- c:\program files\DriversHQ.DriverDetective.ExceptionLogging.dll
2009-06-08 19:51 . 2009-05-21 16:32 66968 ----a-w- c:\program files\DriversHQ.DriverDetective.Client.ExceptionLogging.dll
2009-06-08 19:51 . 2009-05-21 16:32 21944 ----a-w- c:\program files\DriversHQ.DriverDetective.Client.ExceptionLogging.XmlSerializers.dll
2009-06-08 19:51 . 2009-05-21 16:32 157104 ----a-w- c:\program files\DriversHQ.DriverDetective.Client.Communication.XmlSerializers.dll
2009-06-06 23:06 . 2009-05-09 02:38 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-06-04 23:46 . 2009-06-04 23:46 0 ----a-w- C:\LOG61.tmp
2009-06-04 23:01 . 2009-05-09 02:38 -------- d-----w- c:\program files\Common Files\InstallShield
2009-05-21 18:29 . 2009-05-21 18:29 61440 ----a-w- c:\program files\Microsoft.ApplicationBlocks.Updater.ActivationProcessors.dll
2009-05-21 18:29 . 2009-05-21 18:29 28672 ----a-w- c:\program files\Microsoft.ApplicationBlocks.Updater.Downloaders.dll
2009-05-21 18:29 . 2009-05-21 18:29 36864 ----a-w- c:\program files\Interop.WindowsInstaller.dll
2009-05-21 18:29 . 2009-05-21 18:29 118784 ----a-w- c:\program files\Microsoft.ApplicationBlocks.Updater.dll
2009-05-21 18:28 . 2009-05-21 18:28 69632 ----a-w- c:\program files\Microsoft.Practices.EnterpriseLibrary.Security.Cryptography.dll
2009-05-21 18:28 . 2009-05-21 18:28 90112 ----a-w- c:\program files\Microsoft.Practices.EnterpriseLibrary.Common.dll
2009-05-21 18:28 . 2009-05-21 18:28 8192 ----a-w- c:\program files\ISUninstall.exe
2009-05-21 18:28 . 2009-05-21 18:28 57344 ----a-w- c:\program files\Microsoft.Practices.ObjectBuilder.dll
2009-05-21 18:28 . 2009-05-21 18:28 3581 ----a-w- c:\program files\DriversHQ.DriverDetective.Client.Updater.exe.config
2009-05-21 18:28 . 2009-05-21 18:28 5294 ----a-w- c:\program files\DriversHQ.DriverDetective.Client.exe.config
2009-05-21 18:28 . 2009-05-21 18:28 49152 ----a-w- c:\program files\XPBurnComponent.dll
2009-05-21 16:32 . 2009-05-21 16:32 55116 ----a-w- c:\program files\DriverDetective.chm
2009-05-20 19:34 . 2009-05-20 19:34 -------- d-----w- c:\program files\Broadcom
2009-05-19 21:22 . 2005-11-23 08:58 86811 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-05-13 05:15 . 2009-05-04 05:33 915456 ----a-w- c:\windows\system32\wininet.dll
2009-05-08 05:38 . 2009-05-08 05:38 -------- d-----w- c:\program files\CONEXANT
2009-05-07 15:32 . 2009-05-04 05:29 345600 ----a-w- c:\windows\system32\localspl.dll
2009-05-05 06:28 . 2009-05-05 06:28 129 ----a-w- c:\documents and settings\Jeremy\Local Settings\Application Data\fusioncache.dat
2009-05-05 06:27 . 2009-05-05 06:27 664 ----a-w- c:\windows\system32\d3d9caps.dat
2009-05-05 06:08 . 2009-05-05 06:08 -------- d-----w- c:\program files\Gateway
2009-05-04 05:39 . 2009-05-04 05:39 60 ----a-w- c:\windows\system32\SYSDRV.DAT
2009-04-30 17:01 . 2009-04-30 17:01 113 ----a-w- c:\program files\DriversHQ.com Knowledge Base.url
2009-04-17 12:26 . 2009-05-04 05:33 1847168 ----a-w- c:\windows\system32\win32k.sys
2009-04-15 14:51 . 2009-05-04 05:32 585216 ----a-w- c:\windows\system32\rpcrt4.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-06-30_05.16.03 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-11-23 09:03 . 2009-06-30 23:04 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2005-11-23 09:03 . 2009-06-30 03:00 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2009-06-30 03:01 . 2009-06-30 03:00 16384 c:\windows\system32\config\systemprofile\IETldCache\index.dat
+ 2009-06-30 03:01 . 2009-06-30 23:04 16384 c:\windows\system32\config\systemprofile\IETldCache\index.dat
+ 2005-11-23 09:03 . 2009-06-30 23:04 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2009-06-30 05:35 . 2009-06-30 05:35 65536 c:\windows\ERUNT\SDFIX_First_Run\Users\00000002\UsrClass.dat
+ 2009-06-30 22:18 . 2009-06-30 22:18 65536 c:\windows\ERUNT\SDFIX\Users\00000002\UsrClass.dat
+ 2009-06-30 05:35 . 2008-08-07 22:27 163328 c:\windows\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2009-06-30 22:18 . 2008-08-07 22:27 163328 c:\windows\ERUNT\SDFIX\ERDNT.EXE
+ 2009-06-30 05:35 . 2009-06-30 05:35 3059712 c:\windows\ERUNT\SDFIX_First_Run\Users\00000001\NTUSER.DAT
+ 2009-06-30 22:18 . 2009-06-30 22:18 3059712 c:\windows\ERUNT\SDFIX\Users\00000001\NTUSER.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2009-06-10 321344]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-07 3885408]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-06 64512]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2006-10-12 1282048]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\soundman.exe [2003-12-20 65024]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Belkin Wireless Utility.lnk - c:\program files\Belkin\F5D7001v2000\Belkinwcui.exe [2009-6-4 1572864]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

R2 ubsbm;Unibrain 1394 SBM Driver;c:\windows\system32\drivers\UBSBM.sys [7/27/2005 5:25 PM 14080]
R2 ubumapi;Unibrain 1394 FireAPI Driver;c:\windows\system32\drivers\UBUMAPI.sys [7/27/2005 5:25 PM 36352]
R3 HSFHWATI;HSFHWATI;c:\windows\system32\drivers\HSFHWATI.sys [1/25/2005 2:26 PM 200576]
R3 ubohci;Unibrain 1394 OHCI Driver;c:\windows\system32\drivers\ubohci.sys [7/27/2005 5:25 PM 77056]
S3 ADM8511;ADMtek ADM8511/AN986 USB To Fast Ethernet Converter;c:\windows\system32\drivers\ADM8511.SYS [5/19/2009 1:05 PM 20160]
S3 el575nd5;3Com Megahertz 10/100 LAN CardBus PC Card Driver;c:\windows\system32\drivers\el575ND5.sys [5/3/2009 10:36 PM 69692]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-30 20:06
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(500)
c:\windows\system32\Ati2evxx.dll
c:\windows\System32\BCMLogon.dll

- - - - - - - > 'explorer.exe'(3464)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\WLTRYSVC.EXE
c:\windows\system32\BCMWLTRY.EXE
c:\windows\system32\ati2evxx.exe
c:\windows\ehome\ehRecvr.exe
c:\windows\ehome\ehSched.exe
c:\windows\ehome\mcrdsvc.exe
c:\windows\system32\dllhost.exe
c:\windows\ehome\ehmsas.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-07-01 20:08 - machine was rebooted
ComboFix-quarantined-files.txt 2009-07-01 03:08
ComboFix2.txt 2009-06-30 05:19

Pre-Run: 91,643,219,968 bytes free
Post-Run: 91,581,509,632 bytes free

264 --- E O F --- 2009-06-24 09:56

Hijackthis log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:09:31 PM, on 6/30/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Belkin\F5D7001v2000\Belkinwcui.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Belkin Wireless Utility.lnk = ?
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {9A57B18E-2F5D-11D5-8997-00104BD12D94} (compid Class) - http://support.gateway.com/support/serialharvest/gwCID.CAB
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

--
End of file - 3832 bytes

Edited by Orange Blossom, 30 June 2009 - 11:01 PM.


BC AdBot (Login to Remove)

 


m

#2 Guest_superbird_*

Guest_superbird_*

  • Guests
  • OFFLINE
  •  

Posted 04 July 2009 - 08:27 AM

Hello and welcome to Bleeping Computer

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.

If you have already posted a DDS log, please do so again, as your situation may have changed.
Use the 'Add Reply' and add the new log to this thread.


Thanks and again sorry for the delay.

We need to see some information about what is happening in your machine. Please perform the following scan:
  • Download DDS by sUBs from one of the following links. Save it to your desktop.
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explaination about the tool. No input is needed, the scan is running.
  • Notepad will open with the results.
  • Follow the instructions that pop up for posting the results.
  • Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE

#3 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 36,696 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN

Posted 11 July 2009 - 10:41 AM

Due to the lack of feedback, this Topic is now closed.

In case you still have problems, please send me a Private message to reopen this topic within the next 5 days. Beyond that point, please start a new topic.

Orange Blossom :thumbup2:
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users