| I have completed all of the requirements from the "Before Posting a log" thread. I had also started another thread and completed what was asked of me on there thread 3 days ago and can be seen at http://forums.spywareinfo.com/index.php?showtopic=105000
I posted my logs below, please tell me what I need to do???
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:18:32 PM, on 9/1/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Boot mode: Normal
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\SigmaTel\C-Major Audio\ControlPanel\StacSysTray.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINNT\vphc700.exe
C:\Program Files\Logitech\QuickCam10\QuickCam10.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\PROGRA~1\SigmaTel\C-MAJO~1\CONTRO~1\stacsrv.exe
C:\WINNT\system32\rundll32.exe
C:\WINNT\system32\BtUsrBdg.exe
C:\WINNT\system32\BTSetBootKey.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINNT\wanmpsvc.exe
C:\WINNT\System32\WLTRYSVC.EXE
C:\WINNT\System32\bcmwltry.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINNT\system32\notepad.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINNT\notepad.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wikipedia.org/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: support - {991EF04C-93CF-469b-A2BE-CC1B3347566F} - C:\Program Files\BHO\plugin.dll (file missing)
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [StacSysTray] C:\Program Files\SigmaTel\C-Major Audio\ControlPanel\StacSysTray.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [phc700] C:\WINNT\vphc700.exe
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [BTUSRBDG] BtUsrBdg.exe
O4 - HKLM\..\Run: [BTSETBOOTKEY] BTSetBootKey.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\system32\ctfmon.exe
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINNT\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINNT\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1126968266453
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = bad.local
O17 - HKLM\Software\..\Telephony: DomainName = bad.local
O17 - HKLM\System\CCS\Services\Tcpip\..\{AB0A3B3E-840E-4735-9746-75588CFD4E91}: NameServer = 212.216.112.222
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = bad.local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = bad.local
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: qomjjjh - qomjjjh.dll (file missing)
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINNT\system32\Ati2evxx.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Sigmatel PassThru (PassThru) - Unknown owner - C:\Program Files\SigmaTel\C-Major Audio\ControlPanel\passthru.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINNT\wanmpsvc.exe
O23 - Service: WLTRYSVC - Unknown owner - C:\WINNT\System32\WLTRYSVC.EXE
--
End of file - 10576 bytes
ComboFix 07-08-30.3 - "jleone" 2007-09-01 12:25:51.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.189 [GMT -4:00]
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
C:\Temp\1cb
C:\Temp\1cb\syscheck.log
C:\Temp\fse
C:\Temp\fse\tmpZTF.log
C:\WINNT\system32\A1
C:\WINNT\system32\bjymqvn.dll
C:\WINNT\system32\driver
C:\WINNT\system32\f02WtR
C:\WINNT\system32\win
C:\WINNT\system32\Z1
C:\WINNT\system32\Z2
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
-------\LEGACY_DOMAINSERVICE
((((((((((((((((((((((((( Files Created from 2007-08-01 to 2007-09-01 )))))))))))))))))))))))))))))))
2007-09-01 12:28 <DIR> d-------- C:\WINNT\system32\LogFiles
2007-09-01 12:24 51,200 --a------ C:\WINNT\nircmd.exe
2007-09-01 09:22 <DIR> d-------- C:\Program Files\CCleaner
2007-09-01 09:03 <DIR> d-------- C:\Program Files\Uniblue
2007-09-01 09:03 <DIR> d-------- C:\DOCUME~1\jleone\APPLIC~1\Uniblue
2007-08-31 09:15 101,739,296 --a------ C:\SYM_REGISTRY_BACKUP.reg
2007-08-30 15:30 <DIR> d-------- C:\WINNT\system32\Kaspersky Lab
2007-08-30 15:30 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab
2007-08-30 14:50 <DIR> d-------- C:\Program Files\Trend Micro
2007-08-30 00:10 10,872 --a------ C:\WINNT\system32\drivers\AvgAsCln.sys
2007-08-13 07:48 <DIR> d-------- C:\VundoFix Backups
2007-08-12 08:11 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google Updater
2007-08-10 11:23 <DIR> d-------- C:\btinbox
2007-08-10 11:17 33,792 --a------ C:\WINNT\system32\dllcache\custsat.dll
2007-08-10 11:01 <DIR> d-------- C:\DOCUME~1\jleone\APPLIC~1\XTND_BTUIObjects
2007-08-10 10:55 <DIR> d-------- C:\Program Files\Extended Systems
2007-08-10 10:38 836 --a------ C:\WINNT\bthservsdp.dat
2007-08-10 10:38 8,192 --a------ C:\WINNT\system32\wshirda.dll
2007-08-10 10:38 8,192 --a------ C:\WINNT\system32\dllcache\wshirda.dll
2007-08-10 10:38 27,136 --a------ C:\WINNT\system32\irmon.dll
2007-08-10 10:38 27,136 --a------ C:\WINNT\system32\dllcache\irmon.dll
2007-08-10 10:38 152,576 --a------ C:\WINNT\system32\irftp.exe
2007-08-10 10:38 152,576 --a------ C:\WINNT\system32\dllcache\irftp.exe
2007-08-09 17:36 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Logitech
2007-08-09 17:36 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Logishrd
2007-08-09 16:32 <DIR> d-------- C:\Program Files\Skype
2007-08-09 16:32 <DIR> d-------- C:\Program Files\Common Files\Skype
2007-08-07 19:34 <DIR> d-------- C:\DOCUME~1\LOCALS~1\APPLIC~1\Google
2007-08-02 05:52 23,040 --------- C:\WINNT\system32\dllcache\fltmc.exe
2007-08-02 05:52 16,896 --------- C:\WINNT\system32\dllcache\fltlib.dll
2007-08-02 05:52 128,896 --------- C:\WINNT\system32\dllcache\fltmgr.sys
2007-08-02 05:52 <DIR> d-------- C:\Program Files\MSXML 4.0
2007-08-01 12:57 <DIR> d-------- C:\WINNT\ServicePackFiles
2007-08-01 12:48 <DIR> d-------- C:\WINNT\EHome
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-09-01 12:33 --------- d-------- C:\Program Files\Symantec AntiVirus
2007-09-01 12:31 --------- d-------- C:\Program Files\Microsoft AntiSpyware
2007-09-01 10:21 --------- d-------- C:\DOCUME~1\jleone\APPLIC~1\Skype
2007-09-01 09:56 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-08-31 09:13 --------- d-------- C:\Program Files\Common Files\Symantec Shared
2007-08-29 16:10 --------- d--h----- C:\Program Files\InstallShield Installation Information
2007-08-29 16:08 --------- d-------- C:\Program Files\Google
2007-08-29 16:08 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
2007-08-10 11:55 --------- d-------- C:\Program Files\Common Files\logishrd
2007-08-09 17:36 --------- d-------- C:\Program Files\Logitech
2007-08-09 16:32 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
2007-07-30 19:19 92504 --a------ C:\WINNT\system32\dllcache\cdm.dll
2007-07-30 19:19 92504 --a------ C:\WINNT\system32\cdm.dll
2007-07-30 19:19 549720 --a------ C:\WINNT\system32\wuapi.dll
2007-07-30 19:19 549720 --a------ C:\WINNT\system32\dllcache\wuapi.dll
2007-07-30 19:19 53080 --a------ C:\WINNT\system32\wuauclt.exe
2007-07-30 19:19 53080 --a------ C:\WINNT\system32\dllcache\wuauclt.exe
2007-07-30 19:19 43352 --a------ C:\WINNT\system32\wups2.dll
2007-07-30 19:19 325976 --a------ C:\WINNT\system32\wucltui.dll
2007-07-30 19:19 325976 --a------ C:\WINNT\system32\dllcache\wucltui.dll
2007-07-30 19:19 203096 --a------ C:\WINNT\system32\wuweb.dll
2007-07-30 19:19 203096 --a------ C:\WINNT\system32\dllcache\wuweb.dll
2007-07-30 19:19 1712984 --a------ C:\WINNT\system32\wuaueng.dll
2007-07-30 19:19 1712984 --a------ C:\WINNT\system32\dllcache\wuaueng.dll
2007-07-30 19:18 33624 --a------ C:\WINNT\system32\wups.dll
2007-07-30 19:18 33624 --a------ C:\WINNT\system32\dllcache\wups.dll
2007-07-19 02:59 3583488 --a------ C:\WINNT\system32\dllcache\mshtml.dll
2007-07-17 17:40 --------- d-------- C:\DOCUME~1\jleone\APPLIC~1\Google
2007-07-13 17:31 --------- d-------- C:\Program Files\iTunes
2007-07-13 17:30 --------- d-------- C:\Program Files\iPod
2007-07-13 17:28 --------- d-------- C:\Program Files\QuickTime
2007-07-13 17:25 --------- d-------- C:\Program Files\Apple Software Update
2007-07-13 17:25 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
2007-07-12 19:31 765952 --a------ C:\WINNT\system32\dllcache\vgx.dll
2007-06-27 10:34 823808 --a------ C:\WINNT\system32\dllcache\wininet.dll
2007-06-27 10:34 671232 --a------ C:\WINNT\system32\dllcache\mstime.dll
2007-06-27 10:34 6058496 --------- C:\WINNT\system32\dllcache\ieframe.dll
2007-06-27 10:34 52224 --------- C:\WINNT\system32\dllcache\msfeedsbs.dll
2007-06-27 10:34 477696 --a------ C:\WINNT\system32\dllcache\mshtmled.dll
2007-06-27 10:34 459264 --------- C:\WINNT\system32\dllcache\msfeeds.dll
2007-06-27 10:34 44544 --------- C:\WINNT\system32\dllcache\iernonce.dll
2007-06-27 10:34 384512 --------- C:\WINNT\system32\dllcache\iedkcs32.dll
2007-06-27 10:34 383488 --------- C:\WINNT\system32\dllcache\ieapfltr.dll
2007-06-27 10:34 27648 --a------ C:\WINNT\system32\dllcache\jsproxy.dll
2007-06-27 10:34 267776 --------- C:\WINNT\system32\dllcache\iertutil.dll
2007-06-27 10:34 232960 --------- C:\WINNT\system32\dllcache\webcheck.dll
2007-06-27 10:34 230400 --------- C:\WINNT\system32\dllcache\ieaksie.dll
2007-06-27 10:34 193024 --a------ C:\WINNT\system32\dllcache\msrating.dll
2007-06-27 10:34 153088 --------- C:\WINNT\system32\dllcache\ieakeng.dll
2007-06-27 10:34 132608 --a------ C:\WINNT\system32\dllcache\extmgr.dll
2007-06-27 10:34 124928 --------- C:\WINNT\system32\dllcache\advpack.dll
2007-06-27 10:34 1152000 --a------ C:\WINNT\system32\dllcache\urlmon.dll
2007-06-27 10:34 105984 --------- C:\WINNT\system32\dllcache\url.dll
2007-06-27 10:34 102400 --------- C:\WINNT\system32\dllcache\occache.dll
2007-06-27 04:27 63488 --------- C:\WINNT\system32\dllcache\ie4uinit.exe
2007-06-27 04:27 625152 --------- C:\WINNT\system32\dllcache\iexplore.exe
2007-06-27 04:27 13824 --------- C:\WINNT\system32\dllcache\ieudinit.exe
2007-06-27 03:00 161792 --a------ C:\WINNT\system32\dllcache\ieakui.dll
2007-06-26 02:08 1104896 --a------ C:\WINNT\system32\msxml3.dll
2007-06-26 02:08 1104896 --a------ C:\WINNT\system32\dllcache\msxml3.dll
2007-06-19 09:31 282112 --a------ C:\WINNT\system32\gdi32.dll
2007-06-19 09:31 282112 --------- C:\WINNT\system32\dllcache\gdi32.dll
2007-06-13 06:23 1033216 --a------ C:\WINNT\explorer.exe
2007-06-13 06:23 1033216 --------- C:\WINNT\system32\dllcache\explorer.exe
2004-06-18 11:05 45056 --a------ C:\WINNT\inf\Slntinst.exe
2003-08-27 19:31 565248 --a------ C:\DOCUME~1\jleone.BAD\chatlnk.exe
2003-08-22 11:09 45056 --a------ C:\WINNT\inf\slntinst_staticW2k.exe
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{991EF04C-93CF-469b-A2BE-CC1B3347566F}]
C:\Program Files\BHO\plugin.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2003-07-25 15:49]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2003-07-25 15:47]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-07-19 22:10]
"StacSysTray"="C:\Program Files\SigmaTel\C-Major Audio\ControlPanel\StacSysTray.exe" [2003-10-15 18:13]
"gcasServ"="C:\Program Files\Microsoft AntiSpyware\gcasServ.exe" [2005-02-10 22:32]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2005-10-04 12:42]
"vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2005-11-15 13:28]
"phc700"="C:\WINNT\vphc700.exe" [2005-07-20 20:56]
"LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" [2007-05-17 10:53]
"LogitechCommunicationsManager"="C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-05-17 10:52]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 00:56 C:\WINNT\system32\bthprops.cpl]
"BTUSRBDG"="BtUsrBdg.exe" [2003-11-05 22:21 C:\WINNT\system32\BtUsrBdg.exe]
"BTSETBOOTKEY"="BTSetBootKey.exe" [2003-04-15 10:48 C:\WINNT\system32\BTSetBootKey.exe]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 05:25]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2005-05-31 02:04]
"ctfmon.exe"="C:\WINNT\system32\ctfmon.exe" [2004-08-04 00:56]
"Uniblue RegistryBooster 2"="C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe" [2007-08-14 16:52]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PCANotify]
PCANotify.dll 2003-10-31 11:01 8704 C:\WINNT\system32\PCANotify.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\qomjjjh]
qomjjjh.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGRSMMSG]
AGRSMMSG.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
"C:\Program Files\Common Files\AOL\Launch\AOLLaunch.exe" /d locale=en-US ee://aol/imApp
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP AutoIndexer]
F:\Program Files\Hewlett-Packard\LaserJet All-in-one\hppautoindexer.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP SchedIndexer]
F:\Program Files\Hewlett-Packard\LaserJet All-in-one\hppschedindexer.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
%systemroot%\system32\dumprep 0 -k
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM]
C:\Program Files\MySpace\IM\MySpaceIM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINNT\System32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\QTTask.exe" -atboottime
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
"C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioDragToDisc]
"C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
"C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
R1 cdudf_xp;cdudf_xp;C:\WINNT\system32\drivers\cdudf_xp.sys
R1 DVDVRRdr_xp;DVDVRRdr_xp;C:\WINNT\system32\drivers\DVDVRRdr_xp.sys
R1 pwd_2k;pwd_2k;C:\WINNT\system32\drivers\pwd_2k.sys
R1 UDFReadr;UDFReadr;C:\WINNT\system32\drivers\UDFReadr.sys
R3 BTCOMM;BTCOMM;C:\WINNT\system32\drivers\Btcomm.sys
R3 BTKRNBDG;Bluetooth COM Bridge;C:\WINNT\system32\DRIVERS\btkrnbdg.sys
R3 mmc_2K;mmc_2K;C:\WINNT\system32\drivers\mmc_2K.sys
R3 vad_multi;Windigo Virtual Audio Device (WDM);C:\WINNT\system32\drivers\vadmulti.sys
S3 CSRBC01;%CSRBC01.SvcDesc%;C:\WINNT\system32\Drivers\csrbc01.sys
S3 dvd_2K;dvd_2K;C:\WINNT\system32\drivers\dvd_2K.sys
S3 phc700;USB PC Camera (phc700);C:\WINNT\system32\DRIVERS\phc700.sys
S3 SQLAgent$MICROSOFTBCM;SQLAgent$MICROSOFTBCM;C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlagent.EXE -i MICROSOFTBCM
*Newly Created Service* - HTTPFILTER
Contents of the 'Scheduled Tasks' folder
2007-08-30 03:14:08 C:\WINNT\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
2004-08-28 12:25:00 C:\WINNT\Tasks\ISP signup reminder 1.job - C:\WINNT\System32\OOBE\oobebaln.exe
2004-08-28 12:25:00 C:\WINNT\Tasks\ISP signup reminder 2.job - C:\WINNT\System32\OOBE\oobebaln.exe
2007-09-01 15:50:30 C:\WINNT\Tasks\Symantec NetDetect.job - C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE
**************************************************************************
catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-01 12:31:08
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
Completion time: 2007-09-01 12:35:35 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-09-01 12:35
--- E O F ---
********************************* ROOTCHK-(22-08-07)-LOG, by ejvindh
Sat 09/01/2007 12:52:32.04
The rootkits that are detected by this tool were not found.
********************************* ROOTCHK-LOG-end
catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.netRootkit scan 2007-09-01 12:52:32 Windows 5.1.2600 Service Pack 2 scanning hidden processes ... scanning hidden services & system hive ...
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\00025b00ed3c]
"00192c69e3c6"=hex:0b,37,db,ff,15,d2,5a,f2,41,ab,73,57,bd,1d,bd,5e
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\00025b00ed3c]
"00192c69e3c6"=hex:0b,37,db,ff,15,d2,5a,f2,41,ab,73,57,bd,1d,bd,5e
scanning hidden registry entries ...
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:0000010b
scanning hidden files ...
hidden processes: 0
hidden files: 0
The AVG File I goofed on but I did do a print screen and here is what it said:
Tracking Cookies.Pointroll Done Medium
Tracking Cookies.Questionmarket Done Medium
Tracking Cookies.Liveperson Done Medium
| 
|