My pc is gunna die soon, can anybody help please?

BullGuard Antivirus Forum > Virus > Virus Questions > My pc is gunna die soon, can anybody help please?

Forum Quick Jump

[ << Previous Thread | Next Thread >> ]

STUPID-VIRUS
New Member

Date Joined Jun 2008
Total Posts : 8

Posted 7-17-2008 2:18 (GMT +2)

I rescently got a trojan horse virus that has taken half of my programs away, i cant get into my programs from the start menu (most options from there have gone too!) I cant get to system restore (unless i go online)and my restore points have gone? I cant browse the net unless my browser is in safe mode, all my email address cant be logged into, i had to create a new one to register here and that took ages because my pc (even as i type) keeps kinda fading in and out, only allowing me to type in 4 second intervals Shocked Also, i cant get to task manager, aparently now somebody else is the admin on MY pc?

Could anybody tell me how i can find the restore point i made rescently or any other suggestions?

Here is the hjt log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:19: VIRUS ALERT!, on 17/07/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\imapi.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: MSSQL$SONY_MEDIAMGR - Unknown owner - J:\Acid Pro\STUFF\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (file missing)
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Roxio UPnP Renderer 9 - Unknown owner - C:\Program Files\Common Files\Sonic Shared\RoxioUPnPRenderer9.exe (file missing)
O23 - Service: Roxio Upnp Server 9 - Unknown owner - C:\Program Files\Common Files\Sonic Shared\RoxioUpnpService9.exe (file missing)
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Unknown owner - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe (file missing)
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: SQLAgent$SONY_MEDIAMGR - Unknown owner - J:\Acid Pro\STUFF\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE (file missing)
O23 - Service: stllssvr - Unknown owner - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe (file missing)

--
End of file - 6833 bytes

many thanks.

Joe

Post Edited (STUPID-VIRUS) : 17-07-2008 12:20:05 GMT

Touch
Forum Moderator

Date Joined Jun 2004
Total Posts : 12707

Posted 7-17-2008 3:01 (GMT +2)

Hello

Try to follow this ->

Please download http://siri.urz.free.fr/Fix/SmitfraudFix.exe (by S!Ri)

If the tool fails to launch from the Desktop, please move SmitfraudFix.exe directly to the root of the system drive (normally C:), and launch from there.

Please print out or copy this page to Notepad as you will be in Safe Mode and unable to refer to this page.

Reboot your computer in Safe Mode (before the Windows icon appears, tap the F8 key continually)

Double-click on SmitfraudFix.exe
Select option #2 - Clean by typing 2 and press "Enter" to delete infected files.

You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing Y and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection.

The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing Y and press "Enter".

The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart it into Normal Windows.
A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report into your next reply.
The report can also be found at the root of the system drive, normally C:\rapport.txt

Post a fresh hijackthis log with rapport txt, and tell how your computer are behaving

+++++++++++++++++++++++++++++++++++++++++++++++++++++++

process.exe is detected by some antivirus programs as a "RiskTool". It is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.

Do NOT post your problem in someone elses thread.

Member of - Alliance of Security Analysis Professionals
Please do NOT PM me any logs. They will be deleted

STUPID-VIRUS
New Member

Date Joined Jun 2008
Total Posts : 8

Posted 7-17-2008 4:07 (GMT +2)

Firstly, thanks for your time :)

Ok... ive done the first bit but it didnt ask to replace wininet.dll it asked if i wanted to clean the registry? i clicked yes, i hope that was ok?

when i restarted (manualy) windows everythin went blue and now i have no icons, toolbar etc? i just mangaged to click my browser before it went!

No idea how to get the logs if i cant see the programs??? ill keep looking.

Touch
Forum Moderator

Date Joined Jun 2004
Total Posts : 12707

Posted 7-17-2008 5:38 (GMT +2)

Try one more reboot.

The log file are located here:

C:\rapport.txt

Do NOT post your problem in someone elses thread.

Member of - Alliance of Security Analysis Professionals
Please do NOT PM me any logs. They will be deleted

STUPID-VIRUS
New Member

Date Joined Jun 2008
Total Posts : 8

Posted 7-17-2008 8:02 (GMT +2)

wow, this this thing is messed up! maybe a windows reinstal is needed?

SmitFraudFix v2.329

Scan done at 14:56:08.00, 17/07/2008
Run from C:\Documents and Settings\Jo\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process

»»»»»»»»»»»»»»»»»»»»»»»» hosts

127.0.0.1 localhost

Post Edited (Touch) : 17-07-2008 18:06:03 GMT

Touch
Forum Moderator

Date Joined Jun 2004
Total Posts : 12707

Posted 7-17-2008 8:11 (GMT +2)

I´ve deleted your last post, and edit in the first smitfraud log smile

No need to reinstall Windows, as I was not surprised with the size of smitfraudfix log ;-)

Please download Malwarebytes' Anti-Malware:

http://www.besttechie.net/tools/mbam-setup.exe

to your desktop.

Double-click mbam-setup.exe and follow the prompts to install the program.

At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch

Malwarebytes' Anti-Malware, then click Finish.

If an update is found, it will download and install the latest version.

Once the program has loaded, select Perform full scan, then click Scan.

When the scan is complete, click OK, then Show Results to view the results.

Be sure that everything is checked, and click Remove Selected.

When completed, a log will open in Notepad. Please save it to a convenient location.

-----------------------------------------

Please download Combofix:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

And save to the desktop.

Close all other browser windows.

Please connect all your external hard drive/flash drive before running Combofix

Important-> Temporarily disable your anti-virus, real-time protection before performing a scan. They can interfere with combofix or remove some of its embedded files which may cause "unpredictable results".

Go to Start->Run and copy/paste: ComboFix /snapshot and hit OK. It should run Combofix.

Please note, that once you start combofix you should not click anywhere on the combofix window as it can cause the program to stall. In fact, when combofix is running, do not touch your computer at all and just take a break as it may take a while for it to complete.

When finished, it will produce a logfile located at C:\combofix.txt.

Post the contents of that log in your next reply with a new hijackthis log, and Malwarebytes' Anti-Malware log.

Please copy and paste your log files. DO NOT add it as an attachment

NB. If you are using any P2P (file sharing) programs, please remove them before we clean your computer.. We do not clean logs that have P2P applications installed as this can cause reinfection during your cleaning.

Do NOT post your problem in someone elses thread.

Member of - Alliance of Security Analysis Professionals
Please do NOT PM me any logs. They will be deleted

STUPID-VIRUS
New Member

Date Joined Jun 2008
Total Posts : 8

Posted 7-17-2008 11:35 (GMT +2)

I can now type with ease again and see all my icons/control panel etc... Many thanks.

Malewarebytes restarted my pc without warning before i got a chance to get the log? sorry, is there some where that i should be able to get it from? excuse my pc stupidity.

Combo log

ComboFix 08-07-15.4 - Jo 2008-07-17 22:09:01.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.831 [GMT 1:00]
Running from: C:\Documents and Settings\Jo\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\bLTwvyay.ini
C:\WINDOWS\system32\bLTwvyay.ini2
C:\WINDOWS\system32\byXnklKe.dll
C:\WINDOWS\system32\yayvwTLb.dll

.
((((((((((((((((((((((((( Files Created from 2008-06-17 to 2008-07-17 )))))))))))))))))))))))))))))))
.

2008-07-17 16:39 . 2008-07-17 16:40 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-07-17 16:38 . 2008-07-17 16:38 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-07-17 14:56 . 2008-07-17 14:56 1,588 --a------ C:\WINDOWS\system32\tmp.reg
2008-07-17 14:27 . 2008-07-17 15:58 <DIR> d-------- C:\Documents and Settings\Administrator
2008-07-17 14:21 . 2008-07-17 14:22 1,478,367 --a------ C:\SmitfraudFix.exe
2008-07-17 10:23 . 2008-07-17 10:23 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll
2008-07-17 10:22 . 2008-07-17 10:25 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg
2008-07-17 10:22 . 2008-07-17 15:58 <DIR> d-------- C:\Documents and Settings\Jo\Application Data\AVGTOOLBAR
2008-07-17 10:22 . 2008-07-17 10:22 96,520 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys
2008-07-17 10:22 . 2008-07-17 10:22 76,040 --a------ C:\WINDOWS\system32\drivers\avgtdix.sys
2008-07-16 23:52 . 2008-07-17 15:58 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-07-16 23:52 . 2008-07-17 15:58 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-07-16 18:49 . 2008-07-16 18:49 <DIR> d-------- C:\Program Files\SystemRequirementsLab
2008-07-16 18:49 . 2008-07-16 18:49 <DIR> d-------- C:\Documents and Settings\Jo\Application Data\SystemRequirementsLab
2008-07-16 18:45 . 2008-07-16 18:45 <DIR> d-------- C:\New Folder
2008-07-16 18:01 . 2008-07-16 18:01 <DIR> d-------- C:\Program Files\Driver-Soft
2008-07-15 13:03 . 2008-07-15 13:03 <DIR> d-------- C:\Documents and Settings\Jo\New Folder
2008-07-15 12:56 . 2008-07-15 12:57 7,024,640 --a------ C:\winzip112.msi
2008-07-09 10:45 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-07-08 18:04 . 2008-07-08 18:04 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-07-08 18:04 . 2008-07-08 18:04 <DIR> d-------- C:\Documents and Settings\Jo\Application Data\Malwarebytes
2008-07-08 18:04 . 2008-07-08 18:04 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-07-08 18:04 . 2008-07-07 17:35 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-07-08 18:04 . 2008-07-07 17:35 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-07-08 12:45 . 2008-07-08 13:24 <DIR> d-------- C:\Program Files\Spyware Doctor
2008-07-08 12:45 . 2008-07-08 12:45 <DIR> d-------- C:\Documents and Settings\Jo\Application Data\PC Tools
2008-07-08 12:45 . 2007-12-10 14:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2008-07-08 12:45 . 2007-12-10 14:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2008-07-08 12:45 . 2008-07-08 12:47 42,376 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-07-08 12:45 . 2007-12-10 14:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2008-07-08 12:19 . 2008-07-17 18:56 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-07-08 12:15 . 2008-07-08 12:16 <DIR> d-------- C:\Program Files\SpywareDetector
2008-07-08 12:08 . 2008-07-08 12:08 <DIR> d-------- C:\Documents and Settings\Jo\Application Data\MalwareRemovalBot
2008-07-08 11:40 . 2008-07-08 11:40 <DIR> d-------- C:\Program Files\Trend Micro
2008-07-05 09:26 . 2008-07-05 09:26 <DIR> d-------- C:\Program Files\AVG
2008-07-05 09:26 . 2008-07-17 15:59 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg8
2008-07-04 09:54 . 2008-07-04 09:54 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Nero
2008-07-04 09:49 . 2008-07-04 09:49 <DIR> d-------- C:\WINDOWS\system32\NtmsData
2008-07-03 11:16 . 2008-07-03 11:16 <DIR> d-------- C:\Program Files\uTorrent
2008-07-03 11:16 . 2008-07-17 00:14 <DIR> d-------- C:\Documents and Settings\Jo\Application Data\uTorrent
2008-06-26 21:10 . 2008-06-26 21:10 42,320 --a--c--- C:\WINDOWS\system32\xfcodec.dll
2008-06-26 17:11 . 2008-06-26 17:11 <DIR> d-------- C:\Programme
2008-06-20 18:41 . 2008-06-20 18:41 245,248 -----c--- C:\WINDOWS\system32\dllcache\mswsock.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-17 15:39 --------- d-----w C:\Program Files\Lavasoft
2008-07-16 20:59 --------- d-----w C:\Documents and Settings\Jo\Application Data\Xfire
2008-07-16 20:12 137,840 -c--a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-07-15 11:58 --------- d-----w C:\Documents and Settings\All Users\Application Data\WinZip
2008-07-15 10:19 --------- d-----w C:\Program Files\XoftSpySE
2008-07-11 19:45 --------- d-s---w C:\Program Files\Xfire
2008-07-10 08:45 --------- d-----w C:\Program Files\Java
2008-07-08 22:36 --------- d-----w C:\Program Files\MSN Messenger
2008-07-04 08:53 --------- d-----w C:\Documents and Settings\Jo\Application Data\My Games
2008-07-04 08:06 --------- d-----w C:\Program Files\Common Files\Ahead
2008-07-03 10:15 --------- d-----w C:\Documents and Settings\Jo\Application Data\Azureus
2008-06-26 14:59 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-12 16:57 --------- d-----w C:\Documents and Settings\Jo\Application Data\dvdcss
2008-06-05 19:39 30,704 ----a-w C:\Documents and Settings\Jo\Application Data\GDIPFONTCACHEV1.DAT
2008-06-02 02:14 --------- d-----w C:\Documents and Settings\Jo\Application Data\DNA
2008-06-01 21:50 --------- d-----w C:\Documents and Settings\Jo\Application Data\IObit
2008-05-30 18:44 --------- d-----w C:\Program Files\Windows Live
2008-05-30 18:39 --------- d-----w C:\Program Files\Google
2008-05-29 07:36 --------- d-----w C:\Documents and Settings\Jo\Application Data\MSN6
2008-05-29 07:35 --------- d-----w C:\Documents and Settings\All Users\Application Data\MSN6
2008-05-27 16:12 --------- d-----w C:\Documents and Settings\Jo\Application Data\SmartDraw
2008-05-18 16:32 --------- d-----w C:\Program Files\LG Electronics
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

Touch
Forum Moderator

Date Joined Jun 2004
Total Posts : 12707

Posted 7-18-2008 7:30 (GMT +2)

Sounds good smile

Please post the part below this line:

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

from combofix log

Do NOT post your problem in someone elses thread.

Member of - Alliance of Security Analysis Professionals
Please do NOT PM me any logs. They will be deleted

STUPID-VIRUS
New Member

Date Joined Jun 2008
Total Posts : 8

Posted 7-18-2008 10:01 (GMT +2)

Oops, sorry mate.

Here is the whole thing.

ComboFix 08-07-15.4 - Jo 2008-07-17 22:09:01.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.831 [GMT 1:00]
Running from: C:\Documents and Settings\Jo\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\bLTwvyay.ini
C:\WINDOWS\system32\bLTwvyay.ini2
C:\WINDOWS\system32\byXnklKe.dll
C:\WINDOWS\system32\yayvwTLb.dll

.
((((((((((((((((((((((((( Files Created from 2008-06-17 to 2008-07-17 )))))))))))))))))))))))))))))))
.

2008-07-17 16:39 . 2008-07-17 16:40 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-07-17 16:38 . 2008-07-17 16:38 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-07-17 14:56 . 2008-07-17 14:56 1,588 --a------ C:\WINDOWS\system32\tmp.reg
2008-07-17 14:27 . 2008-07-17 15:58 <DIR> d-------- C:\Documents and Settings\Administrator
2008-07-17 14:21 . 2008-07-17 14:22 1,478,367 --a------ C:\SmitfraudFix.exe
2008-07-17 10:23 . 2008-07-17 10:23 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll
2008-07-17 10:22 . 2008-07-17 10:25 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg
2008-07-17 10:22 . 2008-07-17 15:58 <DIR> d-------- C:\Documents and Settings\Jo\Application Data\AVGTOOLBAR
2008-07-17 10:22 . 2008-07-17 10:22 96,520 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys
2008-07-17 10:22 . 2008-07-17 10:22 76,040 --a------ C:\WINDOWS\system32\drivers\avgtdix.sys
2008-07-16 23:52 . 2008-07-17 15:58 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-07-16 23:52 . 2008-07-17 15:58 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-07-16 18:49 . 2008-07-16 18:49 <DIR> d-------- C:\Program Files\SystemRequirementsLab
2008-07-16 18:49 . 2008-07-16 18:49 <DIR> d-------- C:\Documents and Settings\Jo\Application Data\SystemRequirementsLab
2008-07-16 18:45 . 2008-07-16 18:45 <DIR> d-------- C:\New Folder
2008-07-16 18:01 . 2008-07-16 18:01 <DIR> d-------- C:\Program Files\Driver-Soft
2008-07-15 13:03 . 2008-07-15 13:03 <DIR> d-------- C:\Documents and Settings\Jo\New Folder
2008-07-15 12:56 . 2008-07-15 12:57 7,024,640 --a------ C:\winzip112.msi
2008-07-09 10:45 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-07-08 18:04 . 2008-07-08 18:04 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-07-08 18:04 . 2008-07-08 18:04 <DIR> d-------- C:\Documents and Settings\Jo\Application Data\Malwarebytes
2008-07-08 18:04 . 2008-07-08 18:04 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-07-08 18:04 . 2008-07-07 17:35 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-07-08 18:04 . 2008-07-07 17:35 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-07-08 12:45 . 2008-07-08 13:24 <DIR> d-------- C:\Program Files\Spyware Doctor
2008-07-08 12:45 . 2008-07-08 12:45 <DIR> d-------- C:\Documents and Settings\Jo\Application Data\PC Tools
2008-07-08 12:45 . 2007-12-10 14:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2008-07-08 12:45 . 2007-12-10 14:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2008-07-08 12:45 . 2008-07-08 12:47 42,376 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-07-08 12:45 . 2007-12-10 14:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2008-07-08 12:19 . 2008-07-17 18:56 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-07-08 12:15 . 2008-07-08 12:16 <DIR> d-------- C:\Program Files\SpywareDetector
2008-07-08 12:08 . 2008-07-08 12:08 <DIR> d-------- C:\Documents and Settings\Jo\Application Data\MalwareRemovalBot
2008-07-08 11:40 . 2008-07-08 11:40 <DIR> d-------- C:\Program Files\Trend Micro
2008-07-05 09:26 . 2008-07-05 09:26 <DIR> d-------- C:\Program Files\AVG
2008-07-05 09:26 . 2008-07-17 15:59 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg8
2008-07-04 09:54 . 2008-07-04 09:54 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Nero
2008-07-04 09:49 . 2008-07-04 09:49 <DIR> d-------- C:\WINDOWS\system32\NtmsData
2008-07-03 11:16 . 2008-07-03 11:16 <DIR> d-------- C:\Program Files\uTorrent
2008-07-03 11:16 . 2008-07-17 00:14 <DIR> d-------- C:\Documents and Settings\Jo\Application Data\uTorrent
2008-06-26 21:10 . 2008-06-26 21:10 42,320 --a--c--- C:\WINDOWS\system32\xfcodec.dll
2008-06-26 17:11 . 2008-06-26 17:11 <DIR> d-------- C:\Programme
2008-06-20 18:41 . 2008-06-20 18:41 245,248 -----c--- C:\WINDOWS\system32\dllcache\mswsock.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-17 15:39 --------- d-----w C:\Program Files\Lavasoft
2008-07-16 20:59 --------- d-----w C:\Documents and Settings\Jo\Application Data\Xfire
2008-07-16 20:12 137,840 -c--a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-07-15 11:58 --------- d-----w C:\Documents and Settings\All Users\Application Data\WinZip
2008-07-15 10:19 --------- d-----w C:\Program Files\XoftSpySE
2008-07-11 19:45 --------- d-s---w C:\Program Files\Xfire
2008-07-10 08:45 --------- d-----w C:\Program Files\Java
2008-07-08 22:36 --------- d-----w C:\Program Files\MSN Messenger
2008-07-04 08:53 --------- d-----w C:\Documents and Settings\Jo\Application Data\My Games
2008-07-04 08:06 --------- d-----w C:\Program Files\Common Files\Ahead
2008-07-03 10:15 --------- d-----w C:\Documents and Settings\Jo\Application Data\Azureus
2008-06-26 14:59 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-12 16:57 --------- d-----w C:\Documents and Settings\Jo\Application Data\dvdcss
2008-06-05 19:39 30,704 ----a-w C:\Documents and Settings\Jo\Application Data\GDIPFONTCACHEV1.DAT
2008-06-02 02:14 --------- d-----w C:\Documents and Settings\Jo\Application Data\DNA
2008-06-01 21:50 --------- d-----w C:\Documents and Settings\Jo\Application Data\IObit
2008-05-30 18:44 --------- d-----w C:\Program Files\Windows Live
2008-05-30 18:39 --------- d-----w C:\Program Files\Google
2008-05-29 07:36 --------- d-----w C:\Documents and Settings\Jo\Application Data\MSN6
2008-05-29 07:35 --------- d-----w C:\Documents and Settings\All Users\Application Data\MSN6
2008-05-27 16:12 --------- d-----w C:\Documents and Settings\Jo\Application Data\SmartDraw
2008-05-18 16:32 --------- d-----w C:\Program Files\LG Electronics
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:56 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-27 02:11 68856]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24 286720]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 01:56 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveSearch"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.XFR1"= xfcodec.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Xfire\\xfire.exe"=
"C:\\Program Files\\Common Files\\Ahead\\Nero Web\\SetupX.exe"=
"C:\\Program Files\\Return to Castle Wolfenstein\\WolfMP.exe"=
"C:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"=
"C:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"=
"C:\\WINDOWS\\system32\\dpnsvr.exe"=
"C:\\WINDOWS\\system32\\dxdiag.exe"=
"C:\\Program Files\\DNA\\btdna.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"K:\\PPMate\\ppmate.exe"=
"K:\\PPMate\\ppamnet.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

R0 SI3112r;Silicon Image SiI 3512 SATARaid Controller;C:\WINDOWS\system32\DRIVERS\SI3112r.sys [2006-01-12 13:56]
R1 atitray;atitray;C:\Program Files\Radeon Omega Drivers\v3.8.330\ATI Tray Tools\atitray.sys [2006-11-30 09:05]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-07-17 10:22]
R1 c2scsi;c2scsi;C:\WINDOWS\system32\drivers\c2scsi.sys [2006-03-04 13:00]
R2 avg8wd;AVG Free8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-07-17 10:22]
R2 AvgTdiX;AVG Free8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-07-17 10:22]
R2 LBeepKE;LBeepKE;C:\WINDOWS\system32\Drivers\LBeepKE.sys [2006-09-01 12:32]
S2 avg8emc;AVG Free8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-07-17 10:22]
.
Contents of the 'Scheduled Tasks' folder
"2008-07-16 02:00:00 C:\WINDOWS\Tasks\MalwareRemovalBot Scheduled Scan.job"
- C:\Program Files\MalwareRemovalBot\MalwareRemovalBot.ex
- C:\Program Files\MalwareRemovalBot
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{4F11ACBB-393F-4C86-A214-FF3D0D155CC3} - (no file)
HKCU-Run-avgnt - C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-17 22:14:07
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
.
**************************************************************************
.
Completion time: 2008-07-17 22:27:19 - machine was rebooted
ComboFix-quarantined-files.txt 2008-07-17 21:26:54

Pre-Run: 39,211,917,312 bytes free
Post-Run: 39,137,353,728 bytes free

175 --- E O F --- 2008-07-11 09:40:22

Touch
Forum Moderator

Date Joined Jun 2004
Total Posts : 12707

Posted 7-18-2008 10:12 (GMT +2)

Open notepad and copy/paste the text in the quote box below into it:

Quote:

-----------------------------------------------------

KILLALL::

Snapshot::

File::

C:\WINDOWS\Tasks\MalwareRemovalBot Scheduled Scan.job

Folder::

C:\Program Files\AntiVir PersonalEdition Classic

C:\Program Files\MalwareRemovalBot

----------------------------------------------

Save this as CFScript.txt

http://www.fromsej.saknet.dk/billeder/cfscript.gif

At this point, You MUST EXIT ALL BROWSERS NOW before continuing!

Referring to the picture above, drag CFScript.txt into ComboFix.exe.

ComboFix will now run a scan on your system.

It may reboot your system when it finishes. This is normal.

Post new hijackthis log along with fresh combofix log

Do NOT post your problem in someone elses thread.

Member of - Alliance of Security Analysis Professionals
Please do NOT PM me any logs. They will be deleted

STUPID-VIRUS
New Member

Date Joined Jun 2008
Total Posts : 8

Posted 7-18-2008 10:47 (GMT +2)

ok, here we go.

combofix log

ComboFix 08-07-15.4 - Jo 2008-07-18 9:22:28.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.885 [GMT 1:00]
Running from: C:\Documents and Settings\Jo\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Jo\Desktop\CFScript.txt
* Created a new restore point

FILE ::
C:\WINDOWS\Tasks\MalwareRemovalBot Scheduled Scan.job
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\AntiVir PersonalEdition Classic
C:\WINDOWS\Tasks\MalwareRemovalBot Scheduled Scan.job

.
((((((((((((((((((((((((( Files Created from 2008-06-18 to 2008-07-18 )))))))))))))))))))))))))))))))
.

2008-07-18 09:03 . 2008-07-18 09:03 <DIR> d-------- C:\Documents and Settings\Jo\Application Data\aAvgApi
2008-07-17 16:39 . 2008-07-17 16:40 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-07-17 16:38 . 2008-07-17 16:38 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-07-17 14:56 . 2008-07-17 14:56 1,588 --a------ C:\WINDOWS\system32\tmp.reg
2008-07-17 14:27 . 2008-07-17 15:58 <DIR> d-------- C:\Documents and Settings\Administrator
2008-07-17 14:21 . 2008-07-17 14:22 1,478,367 --a------ C:\SmitfraudFix.exe
2008-07-17 10:23 . 2008-07-17 10:23 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll
2008-07-17 10:22 . 2008-07-17 10:25 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg
2008-07-17 10:22 . 2008-07-17 15:58 <DIR> d-------- C:\Documents and Settings\Jo\Application Data\AVGTOOLBAR
2008-07-17 10:22 . 2008-07-17 10:22 96,520 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys
2008-07-17 10:22 . 2008-07-17 10:22 76,040 --a------ C:\WINDOWS\system32\drivers\avgtdix.sys
2008-07-16 23:52 . 2008-07-17 15:58 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-07-16 23:52 . 2008-07-17 15:58 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-07-16 18:49 . 2008-07-16 18:49 <DIR> d-------- C:\Program Files\SystemRequirementsLab
2008-07-16 18:49 . 2008-07-16 18:49 <DIR> d-------- C:\Documents and Settings\Jo\Application Data\SystemRequirementsLab
2008-07-16 18:45 . 2008-07-16 18:45 <DIR> d-------- C:\New Folder
2008-07-16 18:01 . 2008-07-16 18:01 <DIR> d-------- C:\Program Files\Driver-Soft
2008-07-15 13:03 . 2008-07-15 13:03 <DIR> d-------- C:\Documents and Settings\Jo\New Folder
2008-07-15 12:56 . 2008-07-15 12:57 7,024,640 --a------ C:\winzip112.msi
2008-07-09 10:45 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-07-08 18:04 . 2008-07-08 18:04 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-07-08 18:04 . 2008-07-08 18:04 <DIR> d-------- C:\Documents and Settings\Jo\Application Data\Malwarebytes
2008-07-08 18:04 . 2008-07-08 18:04 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-07-08 18:04 . 2008-07-07 17:35 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-07-08 18:04 . 2008-07-07 17:35 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-07-08 12:45 . 2008-07-08 13:24 <DIR> d-------- C:\Program Files\Spyware Doctor
2008-07-08 12:45 . 2008-07-08 12:45 <DIR> d-------- C:\Documents and Settings\Jo\Application Data\PC Tools
2008-07-08 12:45 . 2007-12-10 14:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2008-07-08 12:45 . 2007-12-10 14:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2008-07-08 12:45 . 2008-07-08 12:47 42,376 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-07-08 12:45 . 2007-12-10 14:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2008-07-08 12:19 . 2008-07-17 18:56 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-07-08 12:15 . 2008-07-08 12:16 <DIR> d-------- C:\Program Files\SpywareDetector
2008-07-08 12:08 . 2008-07-08 12:08 <DIR> d-------- C:\Documents and Settings\Jo\Application Data\MalwareRemovalBot
2008-07-08 11:40 . 2008-07-08 11:40 <DIR> d-------- C:\Program Files\Trend Micro
2008-07-05 09:26 . 2008-07-05 09:26 <DIR> d-------- C:\Program Files\AVG
2008-07-05 09:26 . 2008-07-17 15:59 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg8
2008-07-04 09:54 . 2008-07-04 09:54 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Nero
2008-07-04 09:49 . 2008-07-04 09:49 <DIR> d-------- C:\WINDOWS\system32\NtmsData
2008-06-26 21:10 . 2008-06-26 21:10 42,320 --a--c--- C:\WINDOWS\system32\xfcodec.dll
2008-06-26 17:11 . 2008-06-26 17:11 <DIR> d-------- C:\Programme
2008-06-20 18:41 . 2008-06-20 18:41 245,248 -----c--- C:\WINDOWS\system32\dllcache\mswsock.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-17 15:39 --------- d-----w C:\Program Files\Lavasoft
2008-07-16 20:59 --------- d-----w C:\Documents and Settings\Jo\Application Data\Xfire
2008-07-16 20:12 137,840 -c--a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-07-15 11:58 --------- d-----w C:\Documents and Settings\All Users\Application Data\WinZip
2008-07-15 10:19 --------- d-----w C:\Program Files\XoftSpySE
2008-07-11 19:45 --------- d-s---w C:\Program Files\Xfire
2008-07-10 08:45 --------- d-----w C:\Program Files\Java
2008-07-08 22:36 --------- d-----w C:\Program Files\MSN Messenger
2008-07-04 08:53 --------- d-----w C:\Documents and Settings\Jo\Application Data\My Games
2008-07-04 08:06 --------- d-----w C:\Program Files\Common Files\Ahead
2008-07-03 10:15 --------- d-----w C:\Documents and Settings\Jo\Application Data\Azureus
2008-06-26 14:59 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-12 16:57 --------- d-----w C:\Documents and Settings\Jo\Application Data\dvdcss
2008-06-05 19:39 30,704 ----a-w C:\Documents and Settings\Jo\Application Data\GDIPFONTCACHEV1.DAT
2008-06-02 02:14 --------- d-----w C:\Documents and Settings\Jo\Application Data\DNA
2008-06-01 21:50 --------- d-----w C:\Documents and Settings\Jo\Application Data\IObit
2008-05-30 18:44 --------- d-----w C:\Program Files\Windows Live
2008-05-30 18:39 --------- d-----w C:\Program Files\Google
2008-05-29 07:36 --------- d-----w C:\Documents and Settings\Jo\Application Data\MSN6
2008-05-29 07:35 --------- d-----w C:\Documents and Settings\All Users\Application Data\MSN6
2008-05-27 16:12 --------- d-----w C:\Documents and Settings\Jo\Application Data\SmartDraw
2008-05-18 16:32 --------- d-----w C:\Program Files\LG Electronics
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:56 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-27 02:11 68856]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24 286720]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 01:56 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveSearch"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.XFR1"= xfcodec.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Xfire\\xfire.exe"=
"C:\\Program Files\\Common Files\\Ahead\\Nero Web\\SetupX.exe"=
"C:\\Program Files\\Return to Castle Wolfenstein\\WolfMP.exe"=
"C:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"=
"C:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"=
"C:\\WINDOWS\\system32\\dpnsvr.exe"=
"C:\\WINDOWS\\system32\\dxdiag.exe"=
"C:\\Program Files\\DNA\\btdna.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"K:\\PPMate\\ppmate.exe"=
"K:\\PPMate\\ppamnet.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

R0 SI3112r;Silicon Image SiI 3512 SATARaid Controller;C:\WINDOWS\system32\DRIVERS\SI3112r.sys [2006-01-12 13:56]
R1 atitray;atitray;C:\Program Files\Radeon Omega Drivers\v3.8.330\ATI Tray Tools\atitray.sys [2006-11-30 09:05]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-07-17 10:22]
R1 c2scsi;c2scsi;C:\WINDOWS\system32\drivers\c2scsi.sys [2006-03-04 13:00]
R2 avg8wd;AVG Free8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-07-17 10:22]
R2 AvgTdiX;AVG Free8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-07-17 10:22]
R2 LBeepKE;LBeepKE;C:\WINDOWS\system32\Drivers\LBeepKE.sys [2006-09-01 12:32]
S2 avg8emc;AVG Free8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-07-17 10:22]
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-18 09:27:28
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
.
**************************************************************************
.
Completion time: 2008-07-18 9:42:43 - machine was rebooted
ComboFix-quarantined-files.txt 2008-07-18 08:42:20
ComboFix2.txt 2008-07-17 21:27:20

Pre-Run: 39,102,836,736 bytes free
Post-Run: 39,088,062,464 bytes free

168 --- E O F --- 2008-07-11 09:40:22

and the hjt log...

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:47:34, on 18/07/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: MSSQL$SONY_MEDIAMGR - Unknown owner - J:\Acid Pro\STUFF\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (file missing)
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Roxio UPnP Renderer 9 - Unknown owner - C:\Program Files\Common Files\Sonic Shared\RoxioUPnPRenderer9.exe (file missing)
O23 - Service: Roxio Upnp Server 9 - Unknown owner - C:\Program Files\Common Files\Sonic Shared\RoxioUpnpService9.exe (file missing)
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Unknown owner - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe (file missing)
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: SQLAgent$SONY_MEDIAMGR - Unknown owner - J:\Acid Pro\STUFF\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE (file missing)
O23 - Service: stllssvr - Unknown owner - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe (file missing)

--
End of file - 7718 bytes