Webuser Forums: Trojan problem

Ok I used a different keyboard and stuck to plan A. Everything seems to be working alot better. Here are all three logs.

Thank you

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:26:31 AM, on 5/25/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Dell Photo AIO Printer 922\dlbtbmgr.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Dell Photo AIO Printer 922\dlbtbmon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\HijackThis\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [Dell Photo AIO Printer 922] "C:\Program Files\Dell Photo AIO Printer 922\dlbtbmgr.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [IntelMeM] "C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: dlbt_device - Dell - C:\WINDOWS\System32\dlbtcoms.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe

--
End of file - 7055 bytes

ComboFix 08-05-21.3 - Robbie 2008-05-25 7:10:47.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.196 [GMT -6:00]
Running from: C:\Documents and Settings\Robbie\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Robbie\Desktop\CFScript.txt
* Created a new restore point

FILE ::
C:\startup.exe
C:\WINDOWS\SYSTEM32\28.tmp
C:\WINDOWS\SYSTEM32\blackster.scr
C:\WINDOWS\system32\scvhost.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\startup.exe
C:\WINDOWS\SYSTEM32\blackster.scr

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_WINDOWS_ACTION_SCRIPT
-------\Service_Windows Action Script

((((((((((((((((((((((((( Files Created from 2008-04-25 to 2008-05-25 )))))))))))))))))))))))))))))))
.

2008-05-25 07:03 . 2004-08-04 02:56 21,504 --a------ C:\WINDOWS\SYSTEM32\hidserv.dll
2008-05-25 07:03 . 2004-08-04 02:56 21,504 --a------ C:\WINDOWS\SYSTEM32\DLLCACHE\hidserv.dll
2008-05-25 07:03 . 2004-08-04 00:58 14,848 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\kbdhid.sys
2008-05-25 07:03 . 2004-08-04 00:58 14,848 --a------ C:\WINDOWS\SYSTEM32\DLLCACHE\kbdhid.sys
2008-05-25 06:41 . 2008-05-25 06:41 <DIR> d-------- C:\WINDOWS\ERUNT
2008-05-24 08:56 . 2008-05-25 07:05 <DIR> d-------- C:\SDFix
2008-05-23 13:43 . 2008-05-24 08:33 <DIR> d-------- C:\HijackThis
2008-05-21 22:46 . 2008-03-01 07:06 6,066,176 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\ieframe.dll
2008-05-21 22:46 . 2007-04-17 03:32 2,455,488 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\ieapfltr.dat
2008-05-21 22:46 . 2007-03-07 23:10 991,232 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\ieframe.dll.mui
2008-05-21 22:46 . 2008-03-01 07:06 459,264 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\msfeeds.dll
2008-05-21 22:46 . 2008-03-01 07:06 383,488 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\ieapfltr.dll
2008-05-21 22:46 . 2008-03-01 07:06 267,776 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\iertutil.dll
2008-05-21 22:46 . 2008-03-01 07:06 63,488 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\icardie.dll
2008-05-21 22:46 . 2008-03-01 07:06 52,224 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\msfeedsbs.dll
2008-05-21 22:46 . 2008-02-22 04:00 13,824 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\ieudinit.exe
2008-05-21 21:55 . 2008-05-21 21:56 <DIR> d-------- C:\Program Files\CCleaner
2008-05-21 21:20 . 2008-05-23 22:36 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-05-21 19:43 . 2007-03-29 06:56 409,600 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\qmgr.dll
2008-05-21 19:43 . 2007-03-29 06:56 18,944 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\qmgrprxy.dll
2008-05-21 19:43 . 2007-03-29 06:56 8,192 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\bitsprx2.dll
2008-05-21 19:43 . 2007-03-29 06:56 7,168 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\bitsprx4.dll
2008-05-21 19:43 . 2007-03-29 06:56 7,168 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\bitsprx3.dll
2008-05-21 19:43 . 2007-03-29 06:56 7,168 --a------ C:\WINDOWS\SYSTEM32\bitsprx4.dll
2008-05-21 18:51 . 2008-05-21 19:19 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\PrevxCSI
2008-05-21 18:28 . 2008-05-21 18:28 <DIR> d-------- C:\VundoFix Backups
2008-05-21 16:00 . 2004-08-05 09:04 <DIR> d-------- C:\Documents and Settings\Administrator.DORNBUSH\Application Data\Symantec
2008-05-21 16:00 . 2004-08-05 09:02 <DIR> d-------- C:\Documents and Settings\Administrator.DORNBUSH\Application Data\Sonic
2008-05-21 16:00 . 2004-08-05 09:03 <DIR> d-------- C:\Documents and Settings\Administrator.DORNBUSH\Application Data\Jasc Software Inc
2008-05-21 16:00 . 2008-05-21 16:00 <DIR> d-------- C:\Documents and Settings\Administrator.DORNBUSH
2008-05-21 13:52 . 2008-05-21 19:15 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2008-05-21 13:52 . 2008-05-21 19:15 <DIR> d-------- C:\Documents and Settings\Kelly\Application Data\SUPERAntiSpyware.com
2008-05-21 13:52 . 2008-05-21 13:52 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-05-21 09:20 . 2008-05-21 09:20 100,000 --a------ C:\WINDOWS\SYSTEM32\wyfeenhj.dll
2008-05-21 06:41 . 2008-05-21 06:41 100,000 --a------ C:\WINDOWS\SYSTEM32\vlcfjrbm.dll
2008-05-20 23:46 . 2008-05-23 21:45 <DIR> d--h----- C:\$AVG8.VAULT$
2008-05-20 23:41 . 2008-05-24 09:16 <DIR> d-------- C:\WINDOWS\SYSTEM32\DRIVERS\Avg
2008-05-20 23:41 . 2008-05-20 23:41 <DIR> d-------- C:\Program Files\AVG
2008-05-20 23:41 . 2008-05-20 23:41 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg8
2008-05-20 23:41 . 2008-05-20 23:41 96,520 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\avgldx86.sys
2008-05-20 23:41 . 2008-05-20 23:41 75,272 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\avgtdix.sys
2008-05-20 23:41 . 2008-05-20 23:41 10,520 --a------ C:\WINDOWS\SYSTEM32\avgrsstx.dll
2008-05-20 23:28 . 2008-05-20 23:42 8,192 --a------ C:\Documents and Settings\Bob
2008-05-20 23:19 . 2008-05-25 07:20 4,192,288 --ahs---- C:\WINDOWS\SYSTEM32\DRIVERS\fidbox.dat
2008-05-20 23:19 . 2008-05-25 07:14 50,180 --ahs---- C:\WINDOWS\SYSTEM32\DRIVERS\fidbox.idx
2008-05-20 23:14 . 2008-05-20 23:14 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier
2008-05-20 23:14 . 2008-04-02 21:07 75,248 --a------ C:\WINDOWS\zllsputility.exe
2008-05-20 23:14 . 2008-05-20 23:17 4,212 --ah----- C:\WINDOWS\SYSTEM32\zllictbl.dat
2008-05-20 23:13 . 2008-05-20 23:13 <DIR> d-------- C:\Program Files\Zone Labs
2008-05-20 23:12 . 2008-05-25 07:19 <DIR> d-------- C:\WINDOWS\Internet Logs
2008-05-20 22:23 . 2008-05-20 23:19 <DIR> d-------- C:\Program Files\AXPDefender
2008-05-20 22:23 . 2008-05-20 22:23 <DIR> d-------- C:\Documents and Settings\Kelly\Application Data\AXPDefender
2008-05-20 22:16 . 2008-05-23 22:35 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-05-20 22:05 . 2008-05-20 22:05 <DIR> d-------- C:\Documents and Settings\Kelly\Application Data\Lavasoft
2008-05-20 21:57 . 2008-05-20 21:57 <DIR> d---s---- C:\Documents and Settings\Kelly\UserData
2008-05-19 20:50 . 2008-05-19 20:50 <DIR> d-------- C:\Documents and Settings\Robbie\Application Data\AXPDefender
2008-05-18 15:01 . 2008-05-18 15:01 164 --a------ C:\install.dat
2008-05-17 17:53 . 2008-05-17 17:53 <DIR> d-------- C:\Documents and Settings\Kelly\Contacts
2008-05-17 15:42 . 2008-05-17 15:42 <DIR> d-------- C:\Program Files\The Little App Factory
2008-05-17 15:28 . 2008-05-21 18:49 <DIR> dr-h----- C:\Documents and Settings\Kelly\Application Data\yahoo!
2008-05-17 15:19 . 2008-05-17 17:44 <DIR> d-------- C:\Documents and Settings\Kelly\Application Data\Apple Computer
2008-05-17 14:57 . 2008-05-17 15:14 <DIR> d--h----- C:\Documents and Settings\Kelly\Application Data\GTek
2008-05-17 14:54 . 2004-08-05 09:04 <DIR> d-------- C:\Documents and Settings\Kelly\Application Data\Symantec
2008-05-17 14:54 . 2004-08-05 09:02 <DIR> d-------- C:\Documents and Settings\Kelly\Application Data\Sonic
2008-05-17 14:54 . 2004-08-05 09:03 <DIR> d-------- C:\Documents and Settings\Kelly\Application Data\Jasc Software Inc
2008-05-17 14:54 . 2008-05-21 22:26 <DIR> d-------- C:\Documents and Settings\Kelly
2008-04-28 22:09 . 2008-04-28 22:09 9,662 --a------ C:\WINDOWS\SYSTEM32\ZoneAlarmIconUS.ico
2008-04-28 21:07 . 2008-05-21 18:49 <DIR> d-------- C:\Program Files\Windows Live Safety Center
2008-04-28 18:54 . 2008-04-28 18:55 <DIR> d-------- C:\Program Files\RcvSystem
2008-04-27 11:11 . 2002-08-29 04:00 4,224 --a------ C:\WINDOWS\SYSTEM32\beep.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-25 12:12 86,016 ----a-w C:\WINDOWS\Internet Logs\xDB8.tmp
2008-05-24 15:31 240,128 ----a-w C:\WINDOWS\Internet Logs\xDB6.tmp
2008-05-24 15:31 1,453,056 ----a-w C:\WINDOWS\Internet Logs\xDB7.tmp
2008-05-24 03:59 1,448,448 ----a-w C:\WINDOWS\Internet Logs\xDB5.tmp
2008-05-22 22:23 569,856 ----a-w C:\WINDOWS\Internet Logs\xDB3.tmp
2008-05-22 22:23 1,445,376 ----a-w C:\WINDOWS\Internet Logs\xDB4.tmp
2008-05-22 04:05 --------- d-----w C:\Program Files\Yahoo!
2008-05-22 03:26 1,418,752 ----a-w C:\WINDOWS\Internet Logs\xDB2.tmp
2008-05-22 00:49 --------- d--h--r C:\Documents and Settings\All Users\Application Data\yahoo!
2008-05-21 15:49 1,340,416 ----a-w C:\WINDOWS\Internet Logs\xDB1.tmp
2008-05-21 04:17 --------- d-----w C:\Program Files\Lavasoft
2008-04-28 04:01 --------- d-----w C:\Program Files\Common Files\Adobe
2008-04-23 00:04 --------- d-----w C:\Program Files\John Deere American Farmer
2008-04-19 03:45 --------- d-----w C:\Documents and Settings\All Users\Application Data\FLEXnet
2008-04-03 03:07 1,086,952 ----a-w C:\WINDOWS\SYSTEM32\zpeng24.dll
2008-03-27 08:12 151,583 ----a-w C:\WINDOWS\SYSTEM32\msjint40.dll
2008-03-27 08:12 151,583 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\msjint40.dll
2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\SYSTEM32\win32k.sys
2008-03-19 09:47 1,845,248 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\win32k.sys
2008-03-02 00:36 3,591,680 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\mshtml.dll
2008-02-29 08:55 70,656 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\ie4uinit.exe
2008-02-29 08:55 625,664 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\iexplore.exe
1998-04-02 22:51 77,312 --sha-r C:\WINDOWS\ic.exe
1998-04-02 22:55 80,384 --sha-r C:\WINDOWS\icfire.exe
1997-07-23 17:03 11,338 -csha-r C:\WINDOWS\ts.dll
2005-02-01 03:34 32 -csha-w C:\WINDOWS\{3428C5EB-E2C4-4D21-9540-AC08C6B6A426}.dat
2005-02-01 03:34 32 -csha-w C:\WINDOWS\{36168E7F-889D-4096-9F09-6B5B8F053D01}.dat
2005-02-01 03:35 32 -csha-w C:\WINDOWS\{4C58F17D-90C4-4FBD-AAFD-65BEE7C000F4}.dat
2005-02-01 03:35 32 -csha-w C:\WINDOWS\{7F3F0BDF-1B9E-454C-A325-B06786DEBC2F}.dat
2005-02-01 03:35 32 -csha-w C:\WINDOWS\{94BDA1C0-AA82-498C-A673-E86D2FC51F35}.dat
2005-02-01 03:34 32 -csha-w C:\WINDOWS\{AFD3D1DD-313A-4171-B062-9AB425048A42}.dat
2005-02-01 03:35 32 --sha-w C:\WINDOWS\SYSTEM32\{0FF0D07F-8BD6-4BC1-AA77-FF7E7E0CAABC}.dat
2005-02-01 03:34 32 --sha-w C:\WINDOWS\SYSTEM32\{14EA3416-765B-46DD-B71D-0F22CA273181}.dat
2005-02-01 03:35 32 --sha-w C:\WINDOWS\SYSTEM32\{1F6B4FF7-22B6-4B48-B495-FDA7E0CABA42}.dat
2005-02-01 03:34 32 --sha-w C:\WINDOWS\SYSTEM32\{82AE451B-4167-44C4-A089-3B51123F6120}.dat
2005-02-01 03:35 32 --sha-w C:\WINDOWS\SYSTEM32\{989DA4A2-5E78-4D4F-9221-3962EF8999CE}.dat
2005-02-01 03:34 32 --sha-w C:\WINDOWS\SYSTEM32\{CB99ED97-D119-40E8-A494-709D1084512B}.dat
.

((((((((((((((((((((((((((((( snapshot@2008-05-23_22.59.07.89 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-24 04:50:34 2,048 --s-a-w C:\WINDOWS\BOOTSTAT.DAT
+ 2008-05-25 13:15:25 2,048 --s-a-w C:\WINDOWS\BOOTSTAT.DAT
+ 2008-05-23 09:54:18 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
+ 2008-05-25 12:41:37 745,472 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000001\NTUSER.DAT
+ 2008-05-25 12:41:37 8,192 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000002\UsrClass.dat
+ 2008-05-23 09:54:18 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2008-05-25 12:41:23 745,472 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000001\NTUSER.DAT
+ 2008-05-25 12:41:23 8,192 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000002\UsrClass.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [2007-08-30 17:43 4670704]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:54 5674352]
"SsAAD.exe"="C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe" [2006-05-08 04:17 81920]
"WebCamRT.exe"="" []
"ISUSPM"="C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-09-11 04:40 218032]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:56 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 00:01 110592]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-06-21 23:48 155648]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-06-21 23:44 126976]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-04-11 10:43 53248]
"Dell Photo AIO Printer 922"="C:\Program Files\Dell Photo AIO Printer 922\dlbtbmgr.exe" [2004-03-29 13:12 290816]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 22:46 57344]
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2004-08-05 09:00 26112]
"IntelMeM"="C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-03 19:12 221184]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-03-15 00:04 122933]
"PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2004-04-11 19:15 290816]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41 282624]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-06-28 09:14 270648]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-04-02 21:07 919016]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-05-20 23:41 1177368]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.D263"= xl_x263dec.dll
"VIDC.YV12"= xl_yv12.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"gusvc"=3 (0x3)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Internet Explorer\\iexplore.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=

R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-05-20 23:41]
R2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-05-20 23:41]
R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-05-20 23:41]
R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-05-20 23:41]
S3 ADM8511;ADMtek ADM8511/AN986 USB To Fast Ethernet Converter;C:\WINDOWS\system32\DRIVERS\ADM8511.SYS [2001-08-17 11:11]
S3 XIRLINK;IBM PC Camera;C:\WINDOWS\system32\DRIVERS\C-itnt.sys [2001-08-01 15:49]

.
Contents of the 'Scheduled Tasks' folder
"2008-05-17 21:47:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-25 07:16:31
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Program Files\Dell Photo AIO Printer 922\dlbtbmon.exe
C:\WINDOWS\SYSTEM32\wscntfy.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\Ymsgr_tray.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
.
**************************************************************************
.
Completion time: 2008-05-25 7:24:51 - machine was rebooted
ComboFix-quarantined-files.txt 2008-05-25 13:24:45
ComboFix2.txt 2008-05-24 04:59:41

Pre-Run: 51,199,479,808 bytes free
Post-Run: 51,186,991,104 bytes free

240 --- E O F --- 2008-05-23 19:43:56

SDFix: Version 1.185
Run by Administrator on Sun 05/25/2008 at 06:49 AM

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix

Checking Services :

Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting

Checking Files :

Trojan Files Found:

C:\WINDOWS\system32\28.tmp - Deleted
C:\WINDOWS\system32\drivers\hosts - Deleted

Removing Temp Files

ADS Check :

Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-25 07:00:41
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

Remaining Services :

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe:*:Enabled:Yahoo! FT Server"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\Internet Explorer\\iexplore.exe"="C:\\Program Files\\Internet Explorer\\iexplore.exe:*:Disabled:Internet Explorer"
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Disabled:Yahoo! Messenger"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"="C:\\Program Files\\AVG\\AVG8\\avgupd.exe:*:Enabled:avgupd.exe"
"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"="C:\\Program Files\\AVG\\AVG8\\avgemc.exe:*:Enabled:avgemc.exe"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

Remaining Files :

File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes :

Thu 2 Apr 1998 77,312 A.SHR --- "C:\WINDOWS\ic.exe"
Thu 2 Apr 1998 80,384 A.SHR --- "C:\WINDOWS\icfire.exe"
Wed 23 Jul 1997 11,338 A.SHR --- "C:\WINDOWS\ts.dll"
Tue 27 Dec 2005 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Wed 12 Dec 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\cf0471ca1f3f12affe6c8fea1ffc6ddb\BIT28.tmp"
Sat 17 May 2008 8 A..H. --- "C:\Documents and Settings\Kelly\Application Data\GTek\GTUpdate\AUpdate\Channels\ch_u1\lock.tmp"
Sat 17 May 2008 8 A..H. --- "C:\Documents and Settings\Kelly\Application Data\GTek\GTUpdate\AUpdate\Channels\ch_u2\lock.tmp"
Sat 17 May 2008 8 A..H. --- "C:\Documents and Settings\Kelly\Application Data\GTek\GTUpdate\AUpdate\Channels\ch_u3\lock.tmp"
Sat 17 May 2008 8 A..H. --- "C:\Documents and Settings\Kelly\Application Data\GTek\GTUpdate\AUpdate\Channels\ch_u4\lock.tmp"

Finished!

Post Extras