# many Rundll32.exe's n constant popups



## Danndx (Jul 30, 2007)

Hey ive been having some trouble with my computer for a while, performance of my pc is slacking and im plagued with popups n rundll32's. also when looking through folders it seems to freeze for a while before opening them up, any help appreciated thx 

sorry i forgot the log ^^

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:22:56 AM, on 14/01/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe
C:\xampplite\mysql\bin\mysqld-nt.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\ASUS\Ai Suite\AiNap\AiNap.exe
C:\Program Files\ASUS\Ai Suite\AiGear3\CpuPowerMonitor.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\ASUS\Ai Suite\CpuLevelUpHelp.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\ASUS\AI Direct Link\AsShare.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\btbb_wcm\McciTrayApp.exe
C:\Program Files\BT Broadband Desktop Help\bin\BTHelpNotifier.exe
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://uk.red.clientapps.yahoo.com/...b/*http://uk.docs.yahoo.com/info/bt_side.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/su/*http://uk.search.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O2 - BHO: {7c4fe721-6abd-10f9-9054-2a268841ec56} - {65ce1488-62a2-4509-9f01-dba6127ef4c7} - C:\WINDOWS\system32\qrhogk.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Ai Nap] "C:\Program Files\ASUS\Ai Suite\AiNap\AiNap.exe"
O4 - HKLM\..\Run: [CPU Power Monitor] "C:\Program Files\ASUS\Ai Suite\AiGear3\CpuPowerMonitor.exe"
O4 - HKLM\..\Run: [Cpu Level Up help] C:\Program Files\ASUS\Ai Suite\CpuLevelUpHelp.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [Launch Direct Link] "C:\Program Files\ASUS\AI Direct Link\AsShare.exe"
O4 - HKLM\..\Run: [Launch As Cmd Runner] "C:\Program Files\ASUS\AI Direct Link\AsCmd.exe" -reg
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [btbb_wcm_McciTrayApp] C:\Program Files\btbb_wcm\McciTrayApp.exe
O4 - HKLM\..\Run: [btbb_McciTrayApp] C:\Program Files\BT Broadband Desktop Help\bin\BTHelpNotifier.exe
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [08515e63] rundll32.exe "C:\WINDOWS\system32\tcctsmmi.dll",b
O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O8 - Extra context menu item: &Download All with FlashGet - C:\PROGRA~1\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\PROGRA~1\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: BT Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {4A116A80-85B6-4299-A018-A717FD7AC66A} (AXIDMDCP Class) - http://m1.cdn.gaiaonline.com/plugins/IDMFlash.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-GB/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1194970902234
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: RaySat_3dsmax8 Server (mi-raysat_3dsmax8) - Unknown owner - C:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe
O23 - Service: mysql - Unknown owner - C:\xampplite\mysql\bin\mysqld-nt.exe
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe (file missing)
O24 - Desktop Component 0: (no name) - http://ponddeck.com/abstract/blue_sky_complex.jpg
O24 - Desktop Component 1: (no name) - C:\Documents and Settings\DanneH\My Documents\My Pictures\Wallpapers\Saturn_Planet_3200_x_1200_Dual_Monitor.jpg
O24 - Desktop Component 2: (no name) - C:\Documents and Settings\DanneH\My Documents\My Pictures\Wallpapers\Winter_Dream_2560_x_1024_Dual_Monitor.jpg
O24 - Desktop Component 3: (no name) - C:\Documents and Settings\DanneH\My Documents\My Pictures\Wallpapers\Nigh_in_the_city_2560_x_1024_Dual_Monitor.jpg
O24 - Desktop Component 4: (no name) - (no file)

--
End of file - 12196 bytes


----------



## Danndx (Jul 30, 2007)

bump, 3 days

Eset Scan Log
Scanned C:\windows\

C:\windows\system32\cfcmuetb.dll - Win32/Adware.Virtumonde application - unable to clean
C:\windows\system32\iqpawqxc.dll - Win32/Adware.SuperJuan application - unable to clean
C:\windows\system32\ismvidoe.dll - Win32/Adware.SuperJuan application - unable to clean
C:\windows\system32\lqxtps.dll - Win32/Adware.SuperJuan application - unable to clean
C:\windows\system32\mpfdslgo.dll - Win32/TrojanDownloader.Agent.ONC trojan - unable to clean
C:\windows\system32\ngpxdm.dll - Win32/Adware.SuperJuan application - unable to clean
C:\windows\system32\pcload.exe - Win32/TrojanDownloader.FakeAlert.VY trojan - unable to clean
C:\windows\system32\pfoapcva.dll - Win32/Adware.SuperJuan application - unable to clean
C:\windows\system32\yvxqfgyw.dll - Win32/Adware.Virtumonde application - unable to clean
C:\windows\system32\config\default - error opening [4]
C:\windows\system32\config\default.LOG - error opening [4]
C:\windows\system32\config\SAM - error opening [4]
C:\windows\system32\config\SAM.LOG - error opening [4]
C:\windows\system32\config\SECURITY - error opening [4]
C:\windows\system32\config\SECURITY.LOG - error opening [4]
C:\windows\system32\config\software - error opening [4]
C:\windows\system32\config\software.LOG - error opening [4]
C:\windows\system32\config\system - error opening [4]
C:\windows\system32\config\system.LOG - error opening [4]
C:\windows\system32\drivers\sptd.sys - error opening [4]

The first 8 dll's seem to have random generated names, i have tried to delete them but they reappear and grow in number after each boot


----------



## Danndx (Jul 30, 2007)

bump, 6 days


----------



## Danndx (Jul 30, 2007)

bump


----------



## dvk01 (Dec 14, 2002)

Download ComboFix from *Here* to your Desktop.

***Note: It is important that it is saved directly to your desktop and run from the desktop and not any other folder on your computer***
--------------------------------------------------------------------
1. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.


*Very Important!* Temporarily *disable* your *anti-virus*, *script blocking* and any *anti-malware* real-time protection _*before*_ performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause _"unpredictable results"_
Click on *this link* to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
*Remember to re enable the protection again after combofix has finished*
--------------------------------------------------------------------
2. Close any open browsers and any other programs you might have running 
Double click on *combofix.exe* & follow the prompts.​If you are using windows XP It might display a pop up saying that "Recovery console is not installed, do you want to install?"
Please select yes & let it download the files it needs to do this 
When finished, it will produce a report for you. 
Please post the *"C:\ComboFix.txt" *along with a *new HijackThis log* for further review

*****Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze *****

Note: ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.
Note: Combofix prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell us when you reply. Read  HERE  why we disable autoruns


----------



## Danndx (Jul 30, 2007)

ok here it is

ComboFix 09-01-21.04 - Danneh 2009-01-22 23:08:42.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3327.2860 [GMT 0:00]
Running from: c:\documents and settings\Danneh\Desktop\ComboFix.exe
AV: ESET Smart Security 3.0 *On-access scanning disabled* (Updated)
FW: ESET Personal firewall *disabled*
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\bteumcfc.ini
c:\windows\system32\byywluki.dll
c:\windows\system32\cbfifoap.ini
c:\windows\system32\cbfifoap.ini2
c:\windows\system32\cbfifoap.tmp
c:\windows\system32\cghrvtlm.ini
c:\windows\system32\dhkvnxur.dll
c:\windows\system32\dhmugvhv.ini
c:\windows\system32\djyaweoc.dll
c:\windows\system32\drdmousd.ini
c:\windows\system32\dsgfjyor.ini
c:\windows\system32\dsuomdrd.dll
c:\windows\system32\dtbaxqss.ini
c:\windows\system32\EfeedMoq.ini
c:\windows\system32\EfeedMoq.ini2
c:\windows\system32\flrlmhdx.ini
c:\windows\system32\flyxoxjn.ini
c:\windows\system32\gephnxno.dll
c:\windows\system32\gkpntnag.ini
c:\windows\system32\gokijhda.ini
c:\windows\system32\grwoduco.dll
c:\windows\system32\hhzjir.dll
c:\windows\system32\hkimuscn.dll
c:\windows\system32\hrqudrpl.ini
c:\windows\system32\hwqqwynd.dll
c:\windows\system32\ikulwyyb.ini
c:\windows\system32\immstcct.ini
c:\windows\system32\jefnwuhn.dll
c:\windows\system32\jrhclc.dll
c:\windows\system32\kbhphsfm.dll
c:\windows\system32\kitgynqu.dll
c:\windows\system32\knkkeu.dll
c:\windows\system32\kwpvecet.ini
c:\windows\system32\kyepiitw.dll
c:\windows\system32\ldekfo.dll
c:\windows\system32\mcrh.tmp
c:\windows\system32\midgipkp.ini
c:\windows\system32\mltvrhgc.dll
c:\windows\system32\mnrsikkq.ini
c:\windows\system32\ncsumikh.ini
c:\windows\system32\nfemun.dll
c:\windows\system32\nhuwnfej.ini
c:\windows\system32\njxoxylf.dll
c:\windows\system32\nvqfkw.dll
c:\windows\system32\ohyjhqok.dll
c:\windows\system32\onxnhpeg.ini
c:\windows\system32\pjirstvy.dll
c:\windows\system32\pkpigdim.dll
c:\windows\system32\rcbabbys.dll
c:\windows\system32\rkjeygon.ini
c:\windows\system32\ruxnvkhd.ini
c:\windows\system32\rypdhuus.ini
c:\windows\system32\sfrgykdw.dll
c:\windows\system32\ssdyxvjg.ini
c:\windows\system32\ugbrkfdd.ini
c:\windows\system32\uqnygtik.ini
c:\windows\system32\vhvgumhd.dll
c:\windows\system32\wdkygrfs.ini
c:\windows\system32\woitupwx.ini
c:\windows\system32\wrkancme.dll
c:\windows\system32\wygfqxvy.ini
c:\windows\system32\xdhmlrlf.dll
c:\windows\system32\xwputiow.dll
c:\windows\system32\ysavgcrq.dll
c:\windows\system32\yvtsrijp.ini

.
((((((((((((((((((((((((( Files Created from 2008-12-22 to 2009-01-22 )))))))))))))))))))))))))))))))
.

2009-02-22 19:18 . 2009-02-22 19:18	25,088	--a------	c:\windows\system32\drivers\dxixxbvo.sys
2009-01-22 22:36 . 2009-01-22 22:36 d--------	c:\program files\Kontiki
2009-01-22 22:36 . 2009-01-22 22:36 d--------	c:\program files\Channel4
2009-01-22 22:36 . 2009-01-22 23:16 d--------	c:\documents and settings\All Users\Application Data\Kontiki
2009-01-22 22:36 . 2009-01-22 22:36 d--------	c:\documents and settings\All Users\Application Data\Channel4
2009-01-22 22:36 . 2009-01-22 22:36	25,088	--a------	c:\windows\system32\drivers\nccobtnf.sys
2009-01-22 20:10 . 2009-01-22 20:10	25,088	--a------	c:\windows\system32\drivers\jxvvqfmt.sys
2009-01-22 04:50 . 2009-01-22 04:50	25,088	--a------	c:\windows\system32\drivers\yiffmyhz.sys
2009-01-22 03:15 . 2009-01-22 03:15	25,088	--a------	c:\windows\system32\drivers\ejxykavq.sys
2009-01-21 21:46 . 2009-01-21 21:46	1,438,325	---hs----	c:\windows\system32\ncsumikh.tmp
2009-01-21 21:08 . 2009-01-21 21:08	151,552	--a------	c:\windows\system32\nvRegDev.dll
2009-01-21 21:03 . 2009-01-21 21:03	1,438,902	---hs----	c:\windows\system32\coewayjd.tmp
2009-01-21 19:29 . 2009-01-21 19:29	25,088	--a------	c:\windows\system32\drivers\ijalrfxb.sys
2009-01-21 16:43 . 2009-01-21 16:43	25,088	--a------	c:\windows\system32\drivers\hkshrhxm.sys
2009-01-21 15:40 . 2009-01-21 15:40	25,088	--a------	c:\windows\system32\drivers\rijludss.sys
2009-01-20 23:27 . 2009-01-20 23:27	25,088	--a------	c:\windows\system32\drivers\wgegjkdv.sys
2009-01-20 19:22 . 2009-01-20 19:22	25,088	--a------	c:\windows\system32\drivers\iglpisnu.sys
2009-01-20 16:41 . 2009-01-20 16:41	25,088	--a------	c:\windows\system32\drivers\qyddafru.sys
2009-01-20 03:21 . 2009-01-22 23:14	7,224	--a------	c:\windows\zvwdhsjb
2009-01-19 17:50 . 2009-01-19 17:50	25,088	--a------	c:\windows\system32\drivers\zyzfxngj.sys
2009-01-19 16:49 . 2009-01-19 16:49	25,088	--a------	c:\windows\system32\drivers\kkpvejgv.sys
2009-01-19 13:32 . 2009-01-19 13:32	25,088	--a------	c:\windows\system32\drivers\bifgjrga.sys
2009-01-19 10:28 . 2009-01-19 10:28	25,088	--a------	c:\windows\system32\drivers\qcvcfcyk.sys
2009-01-18 15:23 . 2009-01-18 15:23	25,088	--a------	c:\windows\system32\drivers\gjyakvfh.sys
2009-01-18 13:39 . 2009-01-18 13:39	1,407,285	---hs----	c:\windows\system32\gyyceacc.tmp
2009-01-18 13:35 . 2009-01-18 13:35	25,088	--a------	c:\windows\system32\drivers\tpvaqbgm.sys
2009-01-18 12:38 . 2009-01-18 12:40 d--------	c:\windows\NV2459617388.TMP
2009-01-17 19:57 . 2009-01-17 19:57	25,088	--a------	c:\windows\system32\drivers\cweuagnu.sys
2009-01-17 16:01 . 2009-01-17 16:01	25,088	--a------	c:\windows\system32\drivers\mshlgkqm.sys
2009-01-17 09:38 . 2009-01-17 09:38	25,088	--a------	c:\windows\system32\drivers\fxqzwbux.sys
2009-01-16 19:05 . 2009-01-22 23:07	25,088	--a------	c:\windows\system32\drivers\phqghume.sys
2009-01-16 19:04 . 2009-01-16 19:04	25,088	--a------	c:\windows\system32\drivers\hkcxukuc.sys
2009-01-13 22:44 . 2009-01-19 17:53	11,508	--a------	c:\windows\yxpfduqd
2009-01-13 22:35 . 2009-01-13 22:35 d--------	c:\documents and settings\Administrator
2009-01-13 22:08 . 2009-01-13 22:08	25,088	--a------	c:\windows\system32\drivers\pcyverxy.sys
2009-01-13 18:41 . 2009-01-13 22:27	5,876	--a------	c:\windows\ehtpkavh
2009-01-10 00:06 . 2008-04-29 11:33	16,952	--a------	c:\windows\system32\drivers\RkPavproc1.sys
2009-01-09 23:56 . 2009-01-09 23:56 d--------	c:\program files\Trend Micro
2009-01-08 07:49 . 2008-04-17 13:12	107,368	--a------	c:\windows\system32\GEARAspi.dll
2009-01-08 07:48 . 2009-01-08 07:48 d--------	c:\program files\iPod
2009-01-08 07:48 . 2009-01-08 07:49 d--------	c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2009-01-08 07:47 . 2009-01-14 00:07 d--------	c:\program files\QuickTime
2009-01-08 07:46 . 2009-01-08 07:46 d--------	c:\program files\Apple Software Update
2009-01-07 01:24 . 2009-01-07 01:24 d--------	c:\program files\Adobe Fireworks CS3
2009-01-06 05:31 . 2009-01-06 05:31 d--------	c:\documents and settings\All Users\Application Data\Reflexive
2009-01-06 05:30 . 2009-01-09 18:45 d---s----	c:\program files\Music Catch
2009-01-02 20:12 . 2009-01-02 20:12 d--------	c:\documents and settings\DanneH\Application Data\BWMonitor
2008-12-28 14:45 . 2008-12-28 14:45 d--------	c:\program files\Common Files\INCA Shared
2008-12-28 14:45 . 2003-07-20 18:17	5,174	--a------	c:\windows\system32\nppt9x.vxd
2008-12-28 14:45 . 2005-01-04 09:43	4,682	--a------	c:\windows\system32\npptNT2.sys
2008-12-28 14:24 . 2008-12-28 14:24 d--------	c:\windows\ROSE Online Evolution
2008-12-28 14:24 . 2008-12-28 14:24 d--------	c:\program files\Triggersoft
2008-12-28 13:16 . 2008-12-28 13:16 d--------	c:\documents and settings\DanneH\Application Data\Yahoo!
2008-12-26 00:08 . 2008-12-26 00:08	1,253,376	--a------	c:\windows\system32\NvPVEnc.ax
2008-12-24 16:21 . 2008-12-24 16:21	1,639,241	--ahs----	c:\windows\system32\edacyepa.tmp

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-22 23:16	---------	d-----w	c:\program files\FlashGet
2009-01-21 21:09	---------	d--h--w	c:\program files\InstallShield Installation Information
2009-01-21 21:09	---------	d-----w	c:\program files\NVIDIA Corporation
2009-01-18 12:39	---------	d-----w	c:\program files\Common Files\Wise Installation Wizard
2009-01-14 08:16	---------	d---a-w	c:\documents and settings\All Users\Application Data\TEMP
2009-01-14 00:07	---------	d-----w	c:\program files\iTunes
2009-01-14 00:04	---------	d-----w	c:\program files\Winamp
2009-01-08 07:48	---------	d-----w	c:\program files\Bonjour
2009-01-08 07:48	---------	d-----w	c:\documents and settings\All Users\Application Data\Apple Computer
2009-01-07 00:56	---------	d-----w	c:\program files\Grid
2009-01-07 00:44	---------	d-----w	c:\program files\Multiwinia
2009-01-07 00:26	---------	d-----w	c:\program files\Darwinia
2009-01-07 00:24	---------	d-----w	c:\program files\Electronic Arts
2009-01-07 00:22	---------	d-----w	c:\program files\Project64 1.6
2009-01-07 00:22	---------	d-----w	c:\program files\Mass Effect
2009-01-07 00:19	---------	d-----w	c:\program files\Steam
2008-12-29 15:52	31	----a-w	c:\documents and settings\DanneH\jagex_runescape_preferences.dat
2008-12-28 10:16	---------	d-----w	c:\program files\Yahoo!
2008-12-28 10:09	---------	d-----w	c:\program files\CCP
2008-12-26 00:08	6,301,344	----a-w	c:\windows\system32\drivers\nv4_mini.sys
2008-12-16 21:44	---------	d-----w	c:\program files\Fallout 3
2008-12-14 05:04	---------	d-----w	c:\program files\Unlocker
2008-12-14 05:04	---------	d-----w	c:\documents and settings\DanneH\Application Data\Desktopicon
2008-12-13 22:48	---------	d-----w	c:\program files\Pollux Gamelabs
2008-12-12 21:05	---------	d-----w	c:\program files\Adobe Flash CS3
2008-12-12 14:27	---------	d-----w	c:\documents and settings\DanneH\Application Data\Winamp
2008-12-10 03:06	---------	d-----w	c:\documents and settings\All Users\Application Data\Microsoft Help
2008-12-02 04:46	---------	d-----w	c:\documents and settings\DanneH\Application Data\Red Alert 3
2008-11-28 14:37	---------	d-----w	c:\documents and settings\DanneH\Application Data\Thinstall
2007-12-23 10:38	22,328	----a-w	c:\documents and settings\DanneH\Application Data\PnkBstrK.sys
2008-07-25 08:31	28,672	----a-w	c:\program files\mozilla firefox\components\flashgetXpi.dll
.

((((((((((((((((((((((((((((( [email protected]_ 1.27.05.12 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-01-08 07:49:31	102,400	----a-r	c:\windows\Installer\{318AB667-3230-41B5-A617-CB3BF748D371}\iTunesIco.exe
+ 2009-01-08 07:46:19	27,136	----a-r	c:\windows\Installer\{6956856F-B6B3-4BE0-BA0B-8F495BE32033}\AppleSoftwareUpdateIco.exe
+ 2009-01-08 07:48:10	86,016	----a-r	c:\windows\Installer\{8A25392D-C5D2-4E79-A2BD-C15DDC5B0959}\PrntWzrdIco.exe
- 2000-08-31 08:00:00	28,672	----a-w	c:\windows\NIRCMD.exe
+ 2000-08-31 08:00:00	29,696	----a-w	c:\windows\NIRCMD.exe
- 2009-01-05 17:40:59	32,768	-c--a-w	c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2009-01-13 23:25:17	32,768	-c--a-w	c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2009-01-05 17:40:59	32,768	-c--a-w	c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2009-01-13 23:25:17	32,768	-c--a-w	c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2008-10-16 01:00:11	3,067,904	-c----w	c:\windows\system32\dllcache\mshtml.dll
+ 2008-12-12 17:01:00	3,067,904	-c----w	c:\windows\system32\dllcache\mshtml.dll
- 2008-10-07 12:33:00	6,133,856	-c--a-w	c:\windows\system32\dllcache\nv4_mini.sys
+ 2008-12-26 00:08:00	6,301,344	-c--a-w	c:\windows\system32\dllcache\nv4_mini.sys
- 2006-02-28 12:41:34	61,440	----a-w	c:\windows\system32\dns-sd.exe
+ 2008-08-29 10:18:58	87,336	----a-w	c:\windows\system32\dns-sd.exe
- 2006-02-28 12:41:22	53,248	----a-w	c:\windows\system32\dnssd.dll
+ 2008-08-29 09:53:50	61,440	----a-w	c:\windows\system32\dnssd.dll
- 2006-07-14 15:03:02	14,448	----a-w	c:\windows\system32\drivers\GEARAspiWDM.sys
+ 2008-04-17 13:12:54	15,464	----a-w	c:\windows\system32\drivers\GEARAspiWDM.sys
- 2007-10-31 14:09:14	30,464	----a-w	c:\windows\system32\drivers\usbaapl.sys
+ 2008-11-07 14:23:30	32,000	----a-w	c:\windows\system32\drivers\usbaapl.sys
+ 2008-04-17 13:12:54	107,368	-c--a-w	c:\windows\system32\DRVSTORE\GEARAspiWD_D213663B6381F01E45A131159A9DEFE018321CB3\x86\GEARAspi.dll
+ 2008-04-17 13:12:54	15,464	-c--a-w	c:\windows\system32\DRVSTORE\GEARAspiWD_D213663B6381F01E45A131159A9DEFE018321CB3\x86\GEARAspiWDM.sys
+ 2008-11-07 14:23:30	32,000	-c--a-w	c:\windows\system32\DRVSTORE\usbaapl_246F92BBD6449C86FC3F3F28C40D59AC1F69C558\usbaapl.sys
- 2008-10-07 12:33:00	425,984	----a-w	c:\windows\system32\keystone.exe
+ 2008-12-26 00:08:00	432,672	----a-w	c:\windows\system32\keystone.exe
+ 2008-10-05 03:16:26	235,936	----a-r	c:\windows\system32\Macromed\Flash\FlashUtil10a.exe
+ 2009-01-22 22:40:59	88,590	----a-w	c:\windows\system32\Macromed\Flash\uninstall_activeX.exe
- 2009-01-05 01:12:21	84,661	----a-w	c:\windows\system32\Macromed\Flash\uninstall_plugin.exe
+ 2009-01-21 19:27:17	84,661	----a-w	c:\windows\system32\Macromed\Flash\uninstall_plugin.exe
- 2008-10-16 01:00:11	3,067,904	----a-w	c:\windows\system32\mshtml.dll
+ 2008-12-12 17:01:00	3,067,904	----a-w	c:\windows\system32\mshtml.dll
- 2003-03-18 20:14:52	499,712	----a-w	c:\windows\system32\msvcp71.dll
+ 2007-11-01 17:23:00	499,712	----a-w	c:\windows\system32\msvcp71.dll
- 2008-10-07 12:33:00	6,058,112	----a-w	c:\windows\system32\nv4_disp.dll
+ 2008-12-26 00:08:00	6,168,960	----a-w	c:\windows\system32\nv4_disp.dll
- 2008-10-07 12:33:00	475,136	----a-w	c:\windows\system32\nvapi.dll
+ 2008-12-26 00:08:00	663,552	----a-w	c:\windows\system32\nvapi.dll
- 2008-10-07 12:33:00	442,368	----a-w	c:\windows\system32\nvappbar.exe
+ 2008-12-26 00:08:00	449,056	----a-w	c:\windows\system32\nvappbar.exe
- 2008-10-07 12:33:00	122,880	----a-w	c:\windows\system32\nvcod.dll
+ 2008-12-26 00:08:00 135,168	----a-w	c:\windows\system32\nvcod.dll
- 2008-10-07 12:33:00	122,880	----a-w	c:\windows\system32\nvcodins.dll
+ 2008-12-26 00:08:00	135,168	----a-w	c:\windows\system32\nvcodins.dll
- 2008-10-07 12:33:00	143,360	----a-w	c:\windows\system32\nvcolor.exe
+ 2008-12-26 00:08:00	143,360	----a-w	c:\windows\system32\nvcolor.exe
- 2008-10-07 12:33:00	13,574,144	----a-w	c:\windows\system32\nvcpl.dll
+ 2008-12-26 00:08:00	13,680,640	----a-w	c:\windows\system32\nvcpl.dll
- 2008-10-07 12:33:00	797,216	----a-w	c:\windows\system32\nvcplui.exe
+ 2008-12-26 00:08:00	801,312	----a-w	c:\windows\system32\nvcplui.exe
- 2008-10-07 12:33:00	1,368,064	----a-w	c:\windows\system32\nvcuda.dll
+ 2008-12-26 00:08:00	1,560,576	----a-w	c:\windows\system32\nvcuda.dll
- 2008-10-07 12:33:00	3,989,504	----a-w	c:\windows\system32\nvdisps.dll
+ 2008-12-26 00:08:00	4,710,400	----a-w	c:\windows\system32\nvdisps.dll
- 2008-10-07 12:33:00	1,339,392	----a-w	c:\windows\system32\nvdspsch.exe
+ 2008-12-26 00:08:00	1,346,080	----a-w	c:\windows\system32\nvdspsch.exe
- 2008-10-07 12:33:00	3,444,736	----a-w	c:\windows\system32\nvgames.dll
+ 2008-12-26 00:08:00	3,489,792	----a-w	c:\windows\system32\nvgames.dll
- 2008-10-07 12:33:00	1,486,848	----a-w	c:\windows\system32\nview.dll
+ 2008-12-26 00:08:00	1,507,328	----a-w	c:\windows\system32\nview.dll
- 2008-10-07 12:33:00	229,376	----a-w	c:\windows\system32\nvmccs.dll
+ 2008-12-26 00:08:00	229,376	----a-w	c:\windows\system32\nvmccs.dll
- 2008-10-07 12:33:00	45,056	----a-w	c:\windows\system32\nvmccsrs.dll
+ 2008-12-26 00:08:00	45,056	----a-w	c:\windows\system32\nvmccsrs.dll
- 2008-10-07 12:33:00	188,416	----a-w	c:\windows\system32\nvmccss.dll
+ 2008-12-26 00:08:00	188,416	----a-w	c:\windows\system32\nvmccss.dll
- 2008-10-07 12:33:00	86,016	----a-w	c:\windows\system32\nvmctray.dll
+ 2008-12-26 00:08:00	86,016	----a-w	c:\windows\system32\nvmctray.dll
- 2008-10-07 12:33:00	1,257,472	----a-w	c:\windows\system32\nvmobls.dll
+ 2008-12-26 00:08:00	1,286,144	----a-w	c:\windows\system32\nvmobls.dll
- 2008-10-07 12:33:00	8,826,880	----a-w	c:\windows\system32\nvoglnt.dll
+ 2008-12-26 00:08:00	9,412,608	----a-w	c:\windows\system32\nvoglnt.dll
- 2008-10-07 12:33:00	466,944	----a-w	c:\windows\system32\nvshell.dll
+ 2008-12-26 00:08:00	466,944	----a-w	c:\windows\system32\nvshell.dll
- 2008-10-07 12:33:00	163,908	----a-w	c:\windows\system32\nvsvc32.exe
+ 2008-12-26 00:08:00	163,908	----a-w	c:\windows\system32\nvsvc32.exe
- 2008-10-07 12:33:00	453,152	----a-w	c:\windows\system32\nvudisp.exe

+ 2008-12-26 00:08:00	453,152	----a-w	c:\windows\system32\nvudisp.exe
- 2008-10-02 09:07:58	453,152	----a-w	c:\windows\system32\NVUNINST.EXE
+ 2008-12-23 21:58:50	453,152	----a-w	c:\windows\system32\NVUNINST.EXE
- 2008-10-07 12:33:00	3,764,224	----a-w	c:\windows\system32\nvvitvs.dll
+ 2008-12-26 00:08:00	3,796,992	----a-w	c:\windows\system32\nvvitvs.dll
- 2008-10-07 12:33:00	81,920	----a-w	c:\windows\system32\nvwddi.dll
+ 2008-12-26 00:08:00	81,920	----a-w	c:\windows\system32\nvwddi.dll
- 2008-10-07 12:33:00	1,703,936	----a-w	c:\windows\system32\nvwdmcpl.dll
+ 2008-12-26 00:08:00	1,724,416	----a-w	c:\windows\system32\nvwdmcpl.dll
- 2008-10-07 12:33:00	1,019,904	----a-w	c:\windows\system32\nvwimg.dll
+ 2008-12-26 00:08:00	1,101,824	----a-w	c:\windows\system32\nvwimg.dll
- 2008-10-07 12:33:00	2,686,976	----a-w	c:\windows\system32\nvwss.dll
+ 2008-12-26 00:08:00	2,744,320	----a-w	c:\windows\system32\nvwss.dll
- 2008-10-07 12:33:00	1,630,208	----a-w	c:\windows\system32\nwiz.exe
+ 2008-12-26 00:08:00	1,657,376	----a-w	c:\windows\system32\nwiz.exe
+ 2008-10-07 12:33:00	6,058,112	----a-w	c:\windows\system32\ReinstallBackups\0014\DriverFiles\nv4_disp.dll
+ 2008-10-07 12:33:00	6,133,856	----a-w	c:\windows\system32\ReinstallBackups\0014\DriverFiles\nv4_mini.sys
+ 2008-10-07 12:33:00	475,136	----a-w	c:\windows\system32\ReinstallBackups\0014\DriverFiles\nvapi.dll
+ 2008-10-07 12:33:00	122,880	----a-w	c:\windows\system32\ReinstallBackups\0014\DriverFiles\nvcod.dll
+ 2008-10-07 12:33:00	13,574,144	----a-w	c:\windows\system32\ReinstallBackups\0014\DriverFiles\nvcpl.dll
+ 2008-10-07 12:33:00	1,368,064	----a-w	c:\windows\system32\ReinstallBackups\0014\DriverFiles\nvcuda.dll
+ 2008-10-07 12:33:00	3,989,504	----a-w	c:\windows\system32\ReinstallBackups\0014\DriverFiles\nvdisps.dll
+ 2008-10-07 12:33:00	3,444,736	----a-w	c:\windows\system32\ReinstallBackups\0014\DriverFiles\nvgames.dll
+ 2008-10-07 12:33:00	229,376	----a-w	c:\windows\system32\ReinstallBackups\0014\DriverFiles\nvmccs.dll
+ 2008-10-07 12:33:00	188,416	----a-w	c:\windows\system32\ReinstallBackups\0014\DriverFiles\nvmccss.dll
+ 2008-10-07 12:33:00	86,016	----a-w	c:\windows\system32\ReinstallBackups\0014\DriverFiles\nvmctray.dll
+ 2008-10-07 12:33:00	1,257,472	----a-w	c:\windows\system32\ReinstallBackups\0014\DriverFiles\nvmobls.dll
+ 2008-10-07 12:33:00	286,720	----a-w	c:\windows\system32\ReinstallBackups\0014\DriverFiles\nvnt4cpl.dll
+ 2008-10-07 12:33:00	8,826,880	----a-w	c:\windows\system32\ReinstallBackups\0014\DriverFiles\nvoglnt.dll
+ 2008-10-07 12:33:00	163,908	----a-w	c:\windows\system32\ReinstallBackups\0014\DriverFiles\nvsvc32.exe
+ 2008-10-07 12:33:00	3,764,224	----a-w	c:\windows\system32\ReinstallBackups\0014\DriverFiles\nvvitvs.dll
+ 2008-10-07 12:33:00	81,920	----a-w	c:\windows\system32\ReinstallBackups\0014\DriverFiles\nvwddi.dll
+ 2008-10-07 12:33:00	2,686,976	----a-w	c:\windows\system32\ReinstallBackups\0014\DriverFiles\nvwss.dll
+ 2007-10-31 14:09:14	30,464	----a-w	c:\windows\system32\ReinstallBackups\0032\DriverFiles\usbaapl.sys
+ 2009-01-22 23:16:42	16,384	----atw	c:\windows\Temp\Perflib_Perfdata_5c8.dat
+ 2009-01-22 23:16:04	16,384	----atw	c:\windows\Temp\Perflib_Perfdata_604.dat
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NVIDIA nTune"="c:\program files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-09-04 81920]
"STYLEXP"="c:\program files\TGTSoft\StyleXP\StyleXP.exe" [2006-05-24 1372160]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"kdx"="c:\program files\Kontiki\KHost.exe" [2007-04-23 1032640]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 39792]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-26 13680640]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"Ai Nap"="c:\program files\ASUS\Ai Suite\AiNap\AiNap.exe" [2007-09-06 1426432]
"CPU Power Monitor"="c:\program files\ASUS\Ai Suite\AiGear3\CpuPowerMonitor.exe" [2007-10-16 626176]
"Cpu Level Up help"="c:\program files\ASUS\Ai Suite\CpuLevelUpHelp.exe" [2007-09-11 880640]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2006-12-18 868352]
"Launch Direct Link"="c:\program files\ASUS\AI Direct Link\AsShare.exe" [2007-08-20 1209856]
"Launch As Cmd Runner"="c:\program files\ASUS\AI Direct Link\AsCmd.exe" [2007-04-11 376832]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-09-12 185896]
"btbb_wcm_McciTrayApp"="c:\program files\btbb_wcm\McciTrayApp.exe" [2006-12-07 935936]
"btbb_McciTrayApp"="c:\program files\BT Broadband Desktop Help\bin\BTHelpNotifier.exe" [2007-05-23 936960]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-14 644696]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-03 1603152]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4\OpwareSE4.exe" [2007-02-04 79400]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2008-03-01 1443072]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-26 86016]
"Flashget"="c:\program files\FlashGet\flashget.exe" [2007-09-25 2007088]
"08515e63"="c:\windows\system32\xdhmlrlf.dll" [BU]
"4oD"="c:\program files\Kontiki\KHost.exe" [2007-04-23 1032640]
"nwiz"="nwiz.exe" [2008-12-26 c:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2008-04-14 c:\windows\system32\narrator.exe]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSetActiveDesktop"= 1 (0x1)
"NoActiveDesktopChanges"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\1]
Source= c:\documents and settings\DanneH\My Documents\My Pictures\Wallpapers\Saturn_Planet_3200_x_1200_Dual_Monitor.jpg
FriendlyName=

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\2]
Source= c:\documents and settings\DanneH\My Documents\My Pictures\Wallpapers\Winter_Dream_2560_x_1024_Dual_Monitor.jpg
FriendlyName=

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\3]
Source= c:\documents and settings\DanneH\My Documents\My Pictures\Wallpapers\Nigh_in_the_city_2560_x_1024_Dual_Monitor.jpg
FriendlyName=

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=enpfbt.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\CCP\\EVE\\bin\\ExeFile.exe"=
"c:\\Program Files\\Autodesk\\3dsMax8\\3dsmax.exe"=
"c:\\Program Files\\Autodesk\\backburner\\monitor.exe"=
"c:\\Program Files\\Autodesk\\backburner\\manager.exe"=
"c:\\Program Files\\Autodesk\\backburner\\server.exe"=

"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\xampplite\\mysql\\bin\\mysqld.exe"=
"c:\\xampplite\\apache\\bin\\apache.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Java\\jre1.6.0_06\\bin\\java.exe"=
"c:\\WINDOWS\\system32\\java.exe"=
"c:\\Program Files\\Steam\\steamapps\\dx14\\half-life 2 deathmatch\\hl2.exe"=
"c:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"=
"c:\\Program Files\\Mass Effect\\Binaries\\MassEffect.exe"=
"c:\\Program Files\\Mass Effect\\MassEffectLauncher.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\Grid\\GRID.exe"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"c:\\Program Files\\Pollux Gamelabs\\Lost Empire - Immortals\\LostEmpire.exe"=
"c:\\Program Files\\FlashGet\\FlashGet.exe"=
"c:\\WINDOWS\\system32\\taskmgr.exe"=
"c:\\WINDOWS\\system32\\imapi.exe"=
"c:\\Program Files\\ESET\\ESET Smart Security\\ekrn.exe"=
"c:\\WINDOWS\\system32\\userinit.exe"=
"c:\\Program Files\\ESET\\ESET Smart Security\\egui.exe"=
"c:\\Program Files\\Autodesk\\3dsMax8\\mentalray\\satellite\\raysat_3dsmax8server.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Kontiki\\KService.exe"=


----------



## Danndx (Jul 30, 2007)

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2008-12-14 28544]
R3 P1130VID;Creative WebCam NX Pro;c:\windows\system32\drivers\P1130Vid.sys [2007-11-18 90229]
R4 ekrn;Eset Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [2007-12-21 468224]
S0 aglwtmau;aglwtmau;c:\windows\system32\drivers\dxixxbvo.sys [2009-02-22 25088]
S0 aylnlfdx;aylnlfdx;c:\windows\system32\drivers\phqghume.sys [2009-01-16 25088]
S0 bsbkxcth;bsbkxcth;c:\windows\system32\drivers\gjyakvfh.sys [2009-01-18 25088]
S0 cffzjdzt;cffzjdzt;c:\windows\system32\drivers\mshlgkqm.sys [2009-01-17 25088]
S0 cjxubvxo;cjxubvxo;c:\windows\system32\drivers\jxvvqfmt.sys [2009-01-22 25088]
S0 dswxyjjw;dswxyjjw;c:\windows\system32\drivers\zyzfxngj.sys [2009-01-19 25088]
S0 ehppmcdu;ehppmcdu;c:\windows\system32\drivers\yiffmyhz.sys [2009-01-22 25088]
S0 ehtpkavh;ehtpkavh;c:\windows\system32\drivers\qkjicusy.sys --> c:\windows\system32\drivers\qkjicusy.sys [?]
S0 ejlyrmyy;ejlyrmyy;c:\windows\system32\drivers\tbpusrww.sys --> c:\windows\system32\drivers\tbpusrww.sys [?]
S0 ggcpbuky;ggcpbuky;c:\windows\system32\drivers\wgegjkdv.sys [2009-01-20 25088]
S0 gifepmgl;gifepmgl;c:\windows\system32\drivers\juwtpxnb.sys --> c:\windows\system32\drivers\juwtpxnb.sys [?]
S0 gldshmcx;gldshmcx;c:\windows\system32\drivers\rqmuxrhv.sys --> c:\windows\system32\drivers\rqmuxrhv.sys [?]
S0 hdxdnccu;hdxdnccu;c:\windows\system32\drivers\qyddafru.sys [2009-01-20 25088]
S0 ijwcnhyt;ijwcnhyt;c:\windows\system32\drivers\xrozomcn.sys --> c:\windows\system32\drivers\xrozomcn.sys [?]
S0 jcmmfoxd;jcmmfoxd;c:\windows\system32\drivers\hkcxukuc.sys [2009-01-16 25088]
S0 kpwsmylg;kpwsmylg;c:\windows\system32\drivers\bycwrmhq.sys --> c:\windows\system32\drivers\bycwrmhq.sys [?]
S0 mewvxeix;mewvxeix;c:\windows\system32\drivers\bifgjrga.sys [2009-01-19 25088]
S0 mjlkfvoy;mjlkfvoy;c:\windows\system32\drivers\jpqgnitu.sys --> c:\windows\system32\drivers\jpqgnitu.sys [?]
S0 nuleolvr;nuleolvr;c:\windows\system32\drivers\vyzwvlhn.sys --> c:\windows\system32\drivers\vyzwvlhn.sys [?]
S0 nxrkutqx;nxrkutqx;c:\windows\system32\drivers\tpvaqbgm.sys [2009-01-18 25088]
S0 oxnzuveo;oxnzuveo;c:\windows\system32\drivers\hkshrhxm.sys [2009-01-21 25088]
S0 plubbaoh;plubbaoh;c:\windows\system32\drivers\iglpisnu.sys [2009-01-20 25088]
S0 ppyigjia;ppyigjia;c:\windows\system32\drivers\nbztsbyb.sys --> c:\windows\system32\drivers\nbztsbyb.sys [?]
S0 ptqybfpj;ptqybfpj;c:\windows\system32\drivers\ejxykavq.sys [2009-01-22 25088]
S0 qfvljyky;qfvljyky;c:\windows\system32\drivers\nccobtnf.sys [2009-01-22 25088]
S0 qmodgtfl;qmodgtfl;c:\windows\system32\drivers\cweuagnu.sys [2009-01-17 25088]
S0 rmjhdgeo;rmjhdgeo;c:\windows\system32\drivers\fxqzwbux.sys [2009-01-17 25088]
S0 rpdqlwyy;rpdqlwyy;c:\windows\system32\drivers\yabfzycw.sys --> c:\windows\system32\drivers\yabfzycw.sys [?]
S0 soplkdgh;soplkdgh;c:\windows\system32\drivers\rijludss.sys [2009-01-21 25088]
S0 tdghrkbh;tdghrkbh;c:\windows\system32\drivers\ijalrfxb.sys [2009-01-21 25088]
S0 ujbgdytz;ujbgdytz;c:\windows\system32\drivers\qcvcfcyk.sys [2009-01-19 25088]
S0 vtgtqfah;vtgtqfah;c:\windows\system32\drivers\eunqpdlk.sys --> c:\windows\system32\drivers\eunqpdlk.sys [?]
S0 vtlzamym;vtlzamym;c:\windows\system32\drivers\kkpvejgv.sys [2009-01-19 25088]
S0 wzyodiqj;wzyodiqj;c:\windows\system32\drivers\dthbbdmh.sys --> c:\windows\system32\drivers\dthbbdmh.sys [?]
S0 xkfdprxp;xkfdprxp;c:\windows\system32\drivers\paerjqcx.sys --> c:\windows\system32\drivers\paerjqcx.sys [?]
S0 yxpfduqd;yxpfduqd;c:\windows\system32\drivers\pcyverxy.sys [2009-01-13 25088]
S0 zvwdhsjb;zvwdhsjb;c:\windows\system32\drivers\kvmazgux.sys []
S3 RkPavproc1;RkPavproc1;c:\windows\system32\drivers\RkPavproc1.sys [2009-01-10 16952]
S3 SkLaggProtocol;Marvell Link Aggregation Protocol (LAGG) Support;c:\windows\system32\DRIVERS\yk51lagg.sys --> c:\windows\system32\DRIVERS\yk51lagg.sys [?]
S3 SkVlanProtocol;Marvell Virtual LAN (VLAN) Support;c:\windows\system32\drivers\skvlan.sys [2006-05-17 19328]
.
- - - - ORPHANS REMOVED - - - -

BHO-{48ae196c-3c63-47a2-ab5c-b2258672df16} - (no file)

.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.co.uk/
mSearch Bar = hxxp://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/sb/*http://uk.docs.yahoo.com/info/bt_side.html
uInternet Settings,ProxyOverride = 127.0.0.1;*.local
uSearchURL,(Default) = hxxp://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/su/*http://uk.search.yahoo.com/
IE: &Download All with FlashGet - c:\program files\FlashGet\jc_all.htm
IE: &Download with FlashGet - c:\program files\FlashGet\jc_link.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {4A116A80-85B6-4299-A018-A717FD7AC66A} - hxxp://m1.cdn.gaiaonline.com/plugins/IDMFlash.cab
FF - ProfilePath - c:\documents and settings\DanneH\Application Data\Mozilla\Firefox\Profiles\j4w2u3tm.default\
FF - prefs.js: browser.startup.homepage - hxxp://en-GB.start2.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-GBfficial
FF - prefs.js: network.proxy.http - 133.1.16.172
FF - prefs.js: network.proxy.http_port - 3128
FF - prefs.js: network.proxy.type - 4
FF - component: c:\documents and settings\DanneH\Application Data\Mozilla\Firefox\Profiles\j4w2u3tm.default\extensions\[email protected]\components\piclensstub.dll
FF - component: c:\program files\Mozilla Firefox\components\flashgetXpi.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npyaxmpb.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-22 23:16:48
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

c:\windows\system32\drivers\kvmazgux.sys 25088 bytes executable

scan completed successfully
hidden files: 1

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\mysql]
"ImagePath"="c:\xampplite\mysql\bin\mysqld-nt --defaults-file=c:\xampplite\mysql\bin\my.cnf mysql"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-73586283-630328440-839522115-1004\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_USERS\S-1-5-21-73586283-630328440-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID]
@Denied: (Full) (LocalSystem)
"{20D04FE0-3AEA-1069-A2D8-08002B30309D}"="c:\\WINDOWS\\System32\\shell32.dll,15"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="c:\\WINDOWS\\system32\\SHELL32.dll,17"
"{208D2C60-3AEA-1069-A2D7-08002B30309D}"="c:\\WINDOWS\\system32\\SHELL32.dll,17"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="c:\\WINDOWS\\system32\\shell32.dll,22"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="c:\\WINDOWS\\system32\\shell32.dll,23"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="c:\\WINDOWS\\system32\\shell32.dll,24"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="c:\\WINDOWS\\system32\\shell32.dll,-175"
"{21EC2020-3AEA-1069-A2DD-08002B30309D}"="c:\\WINDOWS\\System32\\shell32.dll,-137"
"{2227A280-3AEA-1069-A2DE-08002B30309D}"="c:\\WINDOWS\\System32\\shell32.dll,-138"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="c:\\WINDOWS\\system32\\shell32.dll,38"
"AudioCD"="c:\\WINDOWS\\System32\\shell32.dll,40"
"{FBF23B42-E3F0-101B-8488-00AA003E56F8}"="c:\\WINDOWS\\system32\\shell32.dll,220"
"{450D8FBA-AD25-11D0-98A8-0800361B1103}"="c:\\WINDOWS\\system32\\mydocs.dll,0"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="c:\\WINDOWS\\system32\\main.cpl,10"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="c:\\WINDOWS\\system32\\wiashext.dll,0"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="c:\\WINDOWS\\system32\\mstask.dll,-100"
"{88C6C381-2E85-11D0-94DE-444553540000}"="c:\\WINDOWS\\System32\\occache.dll,0"
"{BDEADF00-C265-11d0-BCED-00A0C90AB50F}"="c:\\Program Files\\COMMON~1\\MICROS~1\\WEBFOL~1\\MSONSEXT.DLL,0"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="c:\\WINDOWS\\System32\\shdocvw.dll,-20785"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="c:\\WINDOWS\\System32\\webcheck.dll,0"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="c:\\WINDOWS\\system32\\syncui.dll,0"

[HKEY_USERS\S-1-5-21-73586283-630328440-839522115-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:0a,60,1d,32,0f,64,29,95,ab,89,39,b0,90,89,7e,22,1c,ca,a3,32,33,cb,30,
ac,8b,47,06,c2,17,0b,c3,75,3d,b0,ef,70,d6,38,fa,a0,3e,28,a9,ab,17,f7,c1,9d,\
"??"=hex:ca,8b,ff,70,e7,92,0d,16,c1,db,ec,89,74,e3,b3,d9

[HKEY_USERS\S-1-5-21-73586283-630328440-839522115-1004\Software\SecuROM\License information*]
"datasecu"=hex:de,fc,d0,ac,3e,91,01,8c,94,46,fc,ce,92,59,55,8b,f6,30,40,71,c4,
0a,6d,6d,ad,ee,9d,4f,93,79,2b,ba,72,4c,01,de,b2,63,dd,85,90,66,71,36,22,67,\
"rkeysecu"=hex:75,fa,ed,3e,bb,21,cc,e6,32,b2,73,1c,4e,62,9a,47
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\savedump.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Kontiki\KService.exe
c:\program files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe
c:\program files\NVIDIA Corporation\nTune\nTuneService.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\rundll32.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2009-01-22 23:20:37 - machine was rebooted
ComboFix-quarantined-files.txt 2009-01-22 23:20:35
ComboFix2.txt 2009-01-13 23:50:04
ComboFix3.txt 2009-01-06 01:27:26

Pre-Run: 2,476,331,008 bytes free
Post-Run: 2,555,068,416 bytes free

Current=3 Default=3 Failed=0 LastKnownGood=8 Sets=1,2,3,4,5,6,7,8
528	--- E O F ---	2009-01-06 03:00:59

HJT

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:21:46 PM, on 22/01/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Kontiki\KService.exe
C:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\ASUS\Ai Suite\AiNap\AiNap.exe
C:\Program Files\ASUS\Ai Suite\AiGear3\CpuPowerMonitor.exe
C:\Program Files\ASUS\Ai Suite\CpuLevelUpHelp.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\btbb_wcm\McciTrayApp.exe
C:\Program Files\BT Broadband Desktop Help\bin\BTHelpNotifier.exe
C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://uk.red.clientapps.yahoo.com/...b/*http://uk.docs.yahoo.com/info/bt_side.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/su/*http://uk.search.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Ai Nap] "C:\Program Files\ASUS\Ai Suite\AiNap\AiNap.exe"
O4 - HKLM\..\Run: [CPU Power Monitor] "C:\Program Files\ASUS\Ai Suite\AiGear3\CpuPowerMonitor.exe"
O4 - HKLM\..\Run: [Cpu Level Up help] C:\Program Files\ASUS\Ai Suite\CpuLevelUpHelp.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [Launch Direct Link] "C:\Program Files\ASUS\AI Direct Link\AsShare.exe"
O4 - HKLM\..\Run: [Launch As Cmd Runner] "C:\Program Files\ASUS\AI Direct Link\AsCmd.exe" -reg
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [btbb_wcm_McciTrayApp] C:\Program Files\btbb_wcm\McciTrayApp.exe
O4 - HKLM\..\Run: [btbb_McciTrayApp] C:\Program Files\BT Broadband Desktop Help\bin\BTHelpNotifier.exe
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Flashget] C:\Program Files\FlashGet\flashget.exe /min
O4 - HKLM\..\Run: [08515e63] rundll32.exe "C:\WINDOWS\system32\xdhmlrlf.dll",b
O4 - HKLM\..\Run: [4oD] "C:\Program Files\Kontiki\KHost.exe" -all
O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe -all
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: BT Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {4A116A80-85B6-4299-A018-A717FD7AC66A} (AXIDMDCP Class) - http://m1.cdn.gaiaonline.com/plugins/IDMFlash.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-GB/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1194970902234
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - AppInit_DLLs: enpfbt.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe
O23 - Service: RaySat_3dsmax8 Server (mi-raysat_3dsmax8) - Unknown owner - C:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe
O23 - Service: mysql - Unknown owner - C:\xampplite\mysql\bin\mysqld-nt.exe
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe (file missing)
O24 - Desktop Component 0: (no name) - http://ponddeck.com/abstract/blue_sky_complex.jpg
O24 - Desktop Component 1: (no name) - C:\Documents and Settings\DanneH\My Documents\My Pictures\Wallpapers\Saturn_Planet_3200_x_1200_Dual_Monitor.jpg
O24 - Desktop Component 2: (no name) - C:\Documents and Settings\DanneH\My Documents\My Pictures\Wallpapers\Winter_Dream_2560_x_1024_Dual_Monitor.jpg
O24 - Desktop Component 3: (no name) - C:\Documents and Settings\DanneH\My Documents\My Pictures\Wallpapers\Nigh_in_the_city_2560_x_1024_Dual_Monitor.jpg
O24 - Desktop Component 4: (no name) - (no file)

--
End of file - 12397 bytes

Thanks for the help, sorry its lengthy


----------



## dvk01 (Dec 14, 2002)

Download the attached CFScript.txt and save it to your desktop ( click on the link underneath this post & if you are using internet explorer when the "File download" pop up comes press *SAVE * and choose desktop in the list of selections in that window & press save)

Close any open browsers 
Then drag the CFScript.txt into the ComboFix.exe as shown in the screenshot below.










This will start ComboFix again. It may ask to reboot. Post the contents of Combofix.txt in your next reply together with a new HijackThis log.

*Note: these instructions and script were created specifically for this user. If you are not this user, do NOT follow these instructions or use this script as it could damage the workings of your system and will not fix your problem. If you have a similar problem start your own topic in the malware fixing forum *

This will create a zip file inside C:\QooBox\ named something like [38][email protected]

at the end it will pop up an alert & open your browser and ask you to send the zip file

please follow those instructions. We need to see the zip file before we can carry on with the fix

If there is no pop up alert or open browser then

please go to http://www.thespykiller.co.uk/index.php?board=1.0 and upload these files so I can examine them and if needed distribute them to antivirus companies.
Just press new topic, fill in the needed details and just give a link to your post here & then press the browse button and then navigate to & select the files on your computer, If there is more than 1 file then press the more attachments button for each extra file and browse and select etc and then when all the files are listed in the windows press send to upload the files ( do not post HJT logs there as they will not get dealt with)

Files to submit:
the zip file inside C:\QooBox\ created by combofix named something like [38][email protected]


----------



## Danndx (Jul 30, 2007)

Hey ive finish that, but it didnt open a brower window or create a zip file in C:\Qoobox
shall i still submit the logs?

thx again


----------



## dvk01 (Dec 14, 2002)

just post the logs here please


----------



## Danndx (Jul 30, 2007)

ComboFix 09-01-21.04 - DanneH 2009-01-23 16:32:17.6 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3327.2776 [GMT 0:00]
Running from: c:\documents and settings\DanneH\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\DanneH\Desktop\cfscript.txt
AV: ESET Smart Security 3.0 *On-access scanning disabled* (Updated)
FW: ESET Personal firewall *disabled*
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2008-12-23 to 2009-01-23 )))))))))))))))))))))))))))))))
.

2009-02-22 19:18 . 2009-02-22 19:18	25,088	--a------	c:\windows\system32\drivers\dxixxbvo.sys
2009-01-23 03:01 . 2009-01-23 03:01	127	--a------	c:\windows\system32\MRT.INI
2009-01-23 00:47 . 2009-01-23 00:47	25,088	--a------	c:\windows\system32\drivers\buuwzlqm.sys
2009-01-22 23:58 . 2009-01-22 23:58	25,088	--a------	c:\windows\system32\drivers\svpavisu.sys
2009-01-22 23:22 . 2009-01-22 23:22	25,088	--a------	c:\windows\system32\drivers\wkcleauu.sys
2009-01-22 22:36 . 2009-01-22 22:36 d--------	c:\program files\Kontiki
2009-01-22 22:36 . 2009-01-22 22:36 d--------	c:\program files\Channel4
2009-01-22 22:36 . 2009-01-23 16:38 d--------	c:\documents and settings\All Users\Application Data\Kontiki
2009-01-22 22:36 . 2009-01-22 22:36 d--------	c:\documents and settings\All Users\Application Data\Channel4
2009-01-22 22:36 . 2009-01-22 22:36	25,088	--a------	c:\windows\system32\drivers\nccobtnf.sys
2009-01-22 20:10 . 2009-01-22 20:10	25,088	--a------	c:\windows\system32\drivers\jxvvqfmt.sys
2009-01-22 04:50 . 2009-01-22 04:50	25,088	--a------	c:\windows\system32\drivers\yiffmyhz.sys
2009-01-22 03:15 . 2009-01-22 03:15	25,088	--a------	c:\windows\system32\drivers\ejxykavq.sys
2009-01-21 21:46 . 2009-01-21 21:46	1,438,325	---hs----	c:\windows\system32\ncsumikh.tmp
2009-01-21 21:08 . 2009-01-21 21:08	151,552	--a------	c:\windows\system32\nvRegDev.dll
2009-01-21 21:03 . 2009-01-21 21:03	1,438,902	---hs----	c:\windows\system32\coewayjd.tmp
2009-01-21 19:29 . 2009-01-21 19:29	25,088	--a------	c:\windows\system32\drivers\ijalrfxb.sys
2009-01-21 16:43 . 2009-01-21 16:43	25,088	--a------	c:\windows\system32\drivers\hkshrhxm.sys
2009-01-21 15:40 . 2009-01-21 15:40	25,088	--a------	c:\windows\system32\drivers\rijludss.sys
2009-01-20 23:27 . 2009-01-20 23:27	25,088	--a------	c:\windows\system32\drivers\wgegjkdv.sys
2009-01-20 19:22 . 2009-01-20 19:22	25,088	--a------	c:\windows\system32\drivers\iglpisnu.sys
2009-01-20 16:41 . 2009-01-20 16:41	25,088	--a------	c:\windows\system32\drivers\qyddafru.sys
2009-01-20 03:21 . 2009-01-23 16:34	9,060	--a------	c:\windows\zvwdhsjb
2009-01-19 17:50 . 2009-01-19 17:50	25,088	--a------	c:\windows\system32\drivers\zyzfxngj.sys
2009-01-19 16:49 . 2009-01-19 16:49	25,088	--a------	c:\windows\system32\drivers\kkpvejgv.sys
2009-01-19 13:32 . 2009-01-19 13:32	25,088	--a------	c:\windows\system32\drivers\bifgjrga.sys
2009-01-19 10:28 . 2009-01-19 10:28	25,088	--a------	c:\windows\system32\drivers\qcvcfcyk.sys
2009-01-18 15:23 . 2009-01-18 15:23	25,088	--a------	c:\windows\system32\drivers\gjyakvfh.sys
2009-01-18 13:39 . 2009-01-18 13:39	1,407,285	---hs----	c:\windows\system32\gyyceacc.tmp
2009-01-18 13:35 . 2009-01-18 13:35	25,088	--a------	c:\windows\system32\drivers\tpvaqbgm.sys
2009-01-18 12:38 . 2009-01-18 12:40 d--------	c:\windows\NV2459617388.TMP
2009-01-17 19:57 . 2009-01-17 19:57	25,088	--a------	c:\windows\system32\drivers\cweuagnu.sys
2009-01-17 16:01 . 2009-01-17 16:01	25,088	--a------	c:\windows\system32\drivers\mshlgkqm.sys
2009-01-17 09:38 . 2009-01-17 09:38	25,088	--a------	c:\windows\system32\drivers\fxqzwbux.sys
2009-01-16 19:05 . 2009-01-23 00:46	25,088	--a------	c:\windows\system32\drivers\phqghume.sys
2009-01-16 19:04 . 2009-01-16 19:04	25,088	--a------	c:\windows\system32\drivers\hkcxukuc.sys
2009-01-13 22:44 . 2009-01-19 17:53	11,508	--a------	c:\windows\yxpfduqd
2009-01-13 22:35 . 2009-01-13 22:35 d--------	c:\documents and settings\Administrator
2009-01-13 22:08 . 2009-01-13 22:08	25,088	--a------	c:\windows\system32\drivers\pcyverxy.sys
2009-01-13 18:41 . 2009-01-13 22:27	5,876	--a------	c:\windows\ehtpkavh
2009-01-10 00:06 . 2008-04-29 11:33	16,952	--a------	c:\windows\system32\drivers\RkPavproc1.sys
2009-01-09 23:56 . 2009-01-09 23:56 d--------	c:\program files\Trend Micro
2009-01-08 07:49 . 2008-04-17 13:12	107,368	--a------	c:\windows\system32\GEARAspi.dll
2009-01-08 07:48 . 2009-01-08 07:48 d--------	c:\program files\iPod
2009-01-08 07:48 . 2009-01-08 07:49 d--------	c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2009-01-08 07:47 . 2009-01-14 00:07 d--------	c:\program files\QuickTime
2009-01-08 07:46 . 2009-01-08 07:46 d--------	c:\program files\Apple Software Update
2009-01-07 01:24 . 2009-01-07 01:24 d--------	c:\program files\Adobe Fireworks CS3
2009-01-06 05:31 . 2009-01-06 05:31 d--------	c:\documents and settings\All Users\Application Data\Reflexive
2009-01-06 05:30 . 2009-01-09 18:45 d---s----	c:\program files\Music Catch
2009-01-02 20:12 . 2009-01-02 20:12 d--------	c:\documents and settings\DanneH\Application Data\BWMonitor
2008-12-28 14:45 . 2008-12-28 14:45 d--------	c:\program files\Common Files\INCA Shared
2008-12-28 14:45 . 2003-07-20 18:17	5,174	--a------	c:\windows\system32\nppt9x.vxd
2008-12-28 14:45 . 2005-01-04 09:43	4,682	--a------	c:\windows\system32\npptNT2.sys
2008-12-28 14:24 . 2008-12-28 14:24 d--------	c:\windows\ROSE Online Evolution
2008-12-28 14:24 . 2008-12-28 14:24 d--------	c:\program files\Triggersoft
2008-12-28 13:16 . 2008-12-28 13:16 d--------	c:\documents and settings\DanneH\Application Data\Yahoo!
2008-12-26 00:08 . 2008-12-26 00:08	1,253,376	--a------	c:\windows\system32\NvPVEnc.ax
2008-12-24 16:21 . 2008-12-24 16:21	1,639,241	--ahs----	c:\windows\system32\edacyepa.tmp

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-23 16:37	---------	d-----w	c:\program files\FlashGet
2009-01-23 03:02	---------	d-----w	c:\documents and settings\All Users\Application Data\Microsoft Help
2009-01-21 21:09	---------	d--h--w	c:\program files\InstallShield Installation Information
2009-01-21 21:09	---------	d-----w	c:\program files\NVIDIA Corporation
2009-01-18 12:39	---------	d-----w	c:\program files\Common Files\Wise Installation Wizard
2009-01-14 08:16	---------	d---a-w	c:\documents and settings\All Users\Application Data\TEMP
2009-01-14 00:07	---------	d-----w	c:\program files\iTunes
2009-01-14 00:04	---------	d-----w	c:\program files\Winamp
2009-01-08 07:48	---------	d-----w	c:\program files\Bonjour
2009-01-08 07:48	---------	d-----w	c:\documents and settings\All Users\Application Data\Apple Computer
2009-01-07 00:56	---------	d-----w	c:\program files\Grid
2009-01-07 00:44	---------	d-----w	c:\program files\Multiwinia
2009-01-07 00:26	---------	d-----w	c:\program files\Darwinia
2009-01-07 00:24	---------	d-----w	c:\program files\Electronic Arts
2009-01-07 00:22	---------	d-----w	c:\program files\Project64 1.6
2009-01-07 00:22	---------	d-----w	c:\program files\Mass Effect
2009-01-07 00:19	---------	d-----w	c:\program files\Steam
2008-12-29 15:52	31	----a-w	c:\documents and settings\DanneH\jagex_runescape_preferences.dat
2008-12-28 10:16	---------	d-----w	c:\program files\Yahoo!
2008-12-28 10:09	---------	d-----w	c:\program files\CCP
2008-12-26 00:08	6,301,344	----a-w	c:\windows\system32\drivers\nv4_mini.sys
2008-12-16 21:44	---------	d-----w	c:\program files\Fallout 3
2008-12-14 05:04	---------	d-----w	c:\program files\Unlocker
2008-12-14 05:04	---------	d-----w	c:\documents and settings\DanneH\Application Data\Desktopicon
2008-12-13 22:48	---------	d-----w	c:\program files\Pollux Gamelabs
2008-12-12 21:05	---------	d-----w	c:\program files\Adobe Flash CS3
2008-12-12 14:27	---------	d-----w	c:\documents and settings\DanneH\Application Data\Winamp
2008-12-11 10:57	333,952	----a-w	c:\windows\system32\drivers\srv.sys
2008-12-02 04:46	---------	d-----w	c:\documents and settings\DanneH\Application Data\Red Alert 3
2008-11-28 14:37	---------	d-----w	c:\documents and settings\DanneH\Application Data\Thinstall
2007-12-23 10:38	22,328	----a-w	c:\documents and settings\DanneH\Application Data\PnkBstrK.sys
2008-07-25 08:31	28,672	----a-w	c:\program files\mozilla firefox\components\flashgetXpi.dll
.

((((((((((((((((((((((((((((( snapshot_2009-01-22_23.19.58.42 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-12-10 03:06:10	1,165,584	----a-r	c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\accicons.exe
+ 2009-01-23 03:02:54	1,165,584	----a-r	c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\accicons.exe
- 2008-12-10 03:06:11	20,240	----a-r	c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\cagicon.exe
+ 2009-01-23 03:02:55	20,240	----a-r	c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\cagicon.exe
- 2008-12-10 03:06:10	159,504	----a-r	c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\inficon.exe
+ 2009-01-23 03:02:55	159,504	----a-r	c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\inficon.exe
- 2008-12-10 03:06:10	184,080	----a-r	c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\joticon.exe
+ 2009-01-23 03:02:55	184,080	----a-r	c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\joticon.exe
- 2008-12-10 03:06:10	217,864	----a-r	c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\misc.exe
+ 2009-01-23 03:02:55	217,864	----a-r	c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\misc.exe
- 2008-12-10 03:06:11	18,704	----a-r	c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\mspicons.exe
+ 2009-01-23 03:02:55	18,704	----a-r	c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\mspicons.exe
- 2008-12-10 03:06:11	35,088	----a-r	c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\oisicon.exe
+ 2009-01-23 03:02:56	35,088	----a-r	c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\oisicon.exe
- 2008-12-10 03:06:10	845,584	----a-r	c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\outicon.exe
+ 2009-01-23 03:02:55	845,584	----a-r	c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\outicon.exe
- 2008-12-10 03:06:10	922,384	----a-r	c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pptico.exe
+ 2009-01-23 03:02:55	922,384	----a-r	c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pptico.exe
- 2008-12-10 03:06:10	272,648	----a-r	c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pubs.exe
+ 2009-01-23 03:02:55	272,648	----a-r	c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pubs.exe
- 2008-12-10 03:06:11	888,080	----a-r	c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\wordicon.exe
+ 2009-01-23 03:02:56	888,080	----a-r	c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\wordicon.exe
- 2008-12-10 03:06:10	1,172,240	----a-r	c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\xlicons.exe
+ 2009-01-23 03:02:55	1,172,240	----a-r	c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\xlicons.exe
- 2008-09-08 10:41:42	333,824	-c----w	c:\windows\system32\dllcache\srv.sys
+ 2008-12-11 10:57:09	333,952	-c----w	c:\windows\system32\dllcache\srv.sys
+ 2009-01-09 17:35:30	20,853,704	----a-w	c:\windows\system32\MRT.exe
+ 2009-01-23 16:36:23	16,384	----atw	c:\windows\temp\Perflib_Perfdata_318.dat
+ 2009-01-23 16:36:28	16,384	----atw	c:\windows\temp\Perflib_Perfdata_5dc.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NVIDIA nTune"="c:\program files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-09-04 81920]
"STYLEXP"="c:\program files\TGTSoft\StyleXP\StyleXP.exe" [2006-05-24 1372160]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"kdx"="c:\program files\Kontiki\KHost.exe" [2007-04-23 1032640]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 39792]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-26 13680640]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"Ai Nap"="c:\program files\ASUS\Ai Suite\AiNap\AiNap.exe" [2007-09-06 1426432]
"CPU Power Monitor"="c:\program files\ASUS\Ai Suite\AiGear3\CpuPowerMonitor.exe" [2007-10-16 626176]
"Cpu Level Up help"="c:\program files\ASUS\Ai Suite\CpuLevelUpHelp.exe" [2007-09-11 880640]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2006-12-18 868352]
"Launch Direct Link"="c:\program files\ASUS\AI Direct Link\AsShare.exe" [2007-08-20 1209856]
"Launch As Cmd Runner"="c:\program files\ASUS\AI Direct Link\AsCmd.exe" [2007-04-11 376832]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-09-12 185896]
"btbb_wcm_McciTrayApp"="c:\program files\btbb_wcm\McciTrayApp.exe" [2006-12-07 935936]
"btbb_McciTrayApp"="c:\program files\BT Broadband Desktop Help\bin\BTHelpNotifier.exe" [2007-05-23 936960]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-14 644696]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-03 1603152]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4\OpwareSE4.exe" [2007-02-04 79400]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2008-03-01 1443072]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-26 86016]
"Flashget"="c:\program files\FlashGet\flashget.exe" [2007-09-25 2007088]
"4oD"="c:\program files\Kontiki\KHost.exe" [2007-04-23 1032640]
"08515e63"="c:\windows\system32\gijktecl.dll" [BU]
"nwiz"="nwiz.exe" [2008-12-26 c:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2008-04-14 c:\windows\system32\narrator.exe]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSetActiveDesktop"= 1 (0x1)
"NoActiveDesktopChanges"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\1]
Source= c:\documents and settings\DanneH\My Documents\My Pictures\Wallpapers\Saturn_Planet_3200_x_1200_Dual_Monitor.jpg
FriendlyName=

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\2]
Source= c:\documents and settings\DanneH\My Documents\My Pictures\Wallpapers\Winter_Dream_2560_x_1024_Dual_Monitor.jpg
FriendlyName=

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\3]
Source= c:\documents and settings\DanneH\My Documents\My Pictures\Wallpapers\Nigh_in_the_city_2560_x_1024_Dual_Monitor.jpg
FriendlyName=

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=enpfbt.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\CCP\\EVE\\bin\\ExeFile.exe"=
"c:\\Program Files\\Autodesk\\3dsMax8\\3dsmax.exe"=
"c:\\Program Files\\Autodesk\\backburner\\monitor.exe"=
"c:\\Program Files\\Autodesk\\backburner\\manager.exe"=
"c:\\Program Files\\Autodesk\\backburner\\server.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\xampplite\\mysql\\bin\\mysqld.exe"=
"c:\\xampplite\\apache\\bin\\apache.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Java\\jre1.6.0_06\\bin\\java.exe"=
"c:\\WINDOWS\\system32\\java.exe"=
"c:\\Program Files\\Steam\\steamapps\\dx14\\half-life 2 deathmatch\\hl2.exe"=
"c:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"=
"c:\\Program Files\\Mass Effect\\Binaries\\MassEffect.exe"=
"c:\\Program Files\\Mass Effect\\MassEffectLauncher.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\Grid\\GRID.exe"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"c:\\Program Files\\Pollux Gamelabs\\Lost Empire - Immortals\\LostEmpire.exe"=
"c:\\Program Files\\FlashGet\\FlashGet.exe"=
"c:\\WINDOWS\\system32\\taskmgr.exe"=
"c:\\WINDOWS\\system32\\imapi.exe"=
"c:\\Program Files\\ESET\\ESET Smart Security\\ekrn.exe"=
"c:\\WINDOWS\\system32\\userinit.exe"=
"c:\\Program Files\\ESET\\ESET Smart Security\\egui.exe"=
"c:\\Program Files\\Autodesk\\3dsMax8\\mentalray\\satellite\\raysat_3dsmax8server.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Kontiki\\KService.exe"=

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2008-12-14 28544]
R3 P1130VID;Creative WebCam NX Pro;c:\windows\system32\drivers\P1130Vid.sys [2007-11-18 90229]
R4 ekrn;Eset Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [2007-12-21 468224]
S0 aglwtmau;aglwtmau;c:\windows\system32\drivers\dxixxbvo.sys [2009-02-22 25088]
S0 aylnlfdx;aylnlfdx;c:\windows\system32\drivers\phqghume.sys [2009-01-16 25088]
S0 bsbkxcth;bsbkxcth;c:\windows\system32\drivers\gjyakvfh.sys [2009-01-18 25088]
S0 cffzjdzt;cffzjdzt;c:\windows\system32\drivers\mshlgkqm.sys [2009-01-17 25088]
S0 cjxubvxo;cjxubvxo;c:\windows\system32\drivers\jxvvqfmt.sys [2009-01-22 25088]
S0 dswxyjjw;dswxyjjw;c:\windows\system32\drivers\zyzfxngj.sys [2009-01-19 25088]
S0 ehppmcdu;ehppmcdu;c:\windows\system32\drivers\yiffmyhz.sys [2009-01-22 25088]
S0 ehtpkavh;ehtpkavh;c:\windows\system32\drivers\qkjicusy.sys --> c:\windows\system32\drivers\qkjicusy.sys [?]
S0 ejlyrmyy;ejlyrmyy;c:\windows\system32\drivers\tbpusrww.sys --> c:\windows\system32\drivers\tbpusrww.sys [?]
S0 ggcpbuky;ggcpbuky;c:\windows\system32\drivers\wgegjkdv.sys [2009-01-20 25088]
S0 gifepmgl;gifepmgl;c:\windows\system32\drivers\juwtpxnb.sys --> c:\windows\system32\drivers\juwtpxnb.sys [?]
S0 gldshmcx;gldshmcx;c:\windows\system32\drivers\rqmuxrhv.sys --> c:\windows\system32\drivers\rqmuxrhv.sys [?]
S0 hdxdnccu;hdxdnccu;c:\windows\system32\drivers\qyddafru.sys [2009-01-20 25088]
S0 ijwcnhyt;ijwcnhyt;c:\windows\system32\drivers\xrozomcn.sys --> c:\windows\system32\drivers\xrozomcn.sys [?]
S0 jcmmfoxd;jcmmfoxd;c:\windows\system32\drivers\hkcxukuc.sys [2009-01-16 25088]
S0 kpwsmylg;kpwsmylg;c:\windows\system32\drivers\bycwrmhq.sys --> c:\windows\system32\drivers\bycwrmhq.sys [?]
S0 mewvxeix;mewvxeix;c:\windows\system32\drivers\bifgjrga.sys [2009-01-19 25088]
S0 mjlkfvoy;mjlkfvoy;c:\windows\system32\drivers\jpqgnitu.sys --> c:\windows\system32\drivers\jpqgnitu.sys [?]
S0 nuleolvr;nuleolvr;c:\windows\system32\drivers\vyzwvlhn.sys --> c:\windows\system32\drivers\vyzwvlhn.sys [?]
S0 nxrkutqx;nxrkutqx;c:\windows\system32\drivers\tpvaqbgm.sys [2009-01-18 25088]
S0 oxnzuveo;oxnzuveo;c:\windows\system32\drivers\hkshrhxm.sys [2009-01-21 25088]
S0 plubbaoh;plubbaoh;c:\windows\system32\drivers\iglpisnu.sys [2009-01-20 25088]
S0 ppyigjia;ppyigjia;c:\windows\system32\drivers\nbztsbyb.sys --> c:\windows\system32\drivers\nbztsbyb.sys [?]
S0 ptqybfpj;ptqybfpj;c:\windows\system32\drivers\ejxykavq.sys [2009-01-22 25088]
S0 qfvljyky;qfvljyky;c:\windows\system32\drivers\nccobtnf.sys [2009-01-22 25088]
S0 qmodgtfl;qmodgtfl;c:\windows\system32\drivers\cweuagnu.sys [2009-01-17 25088]
S0 rmjhdgeo;rmjhdgeo;c:\windows\system32\drivers\fxqzwbux.sys [2009-01-17 25088]
S0 rpdqlwyy;rpdqlwyy;c:\windows\system32\drivers\yabfzycw.sys --> c:\windows\system32\drivers\yabfzycw.sys [?]
S0 rprofjen;rprofjen;c:\windows\system32\drivers\wkcleauu.sys [2009-01-22 25088]
S0 snfsbjjt;snfsbjjt;c:\windows\system32\drivers\buuwzlqm.sys [2009-01-23 25088]
S0 soplkdgh;soplkdgh;c:\windows\system32\drivers\rijludss.sys [2009-01-21 25088]
S0 tdghrkbh;tdghrkbh;c:\windows\system32\drivers\ijalrfxb.sys [2009-01-21 25088]
S0 ujbgdytz;ujbgdytz;c:\windows\system32\drivers\qcvcfcyk.sys [2009-01-19 25088]
S0 vtgtqfah;vtgtqfah;c:\windows\system32\drivers\eunqpdlk.sys --> c:\windows\system32\drivers\eunqpdlk.sys [?]
S0 vtlzamym;vtlzamym;c:\windows\system32\drivers\kkpvejgv.sys [2009-01-19 25088]
S0 wzyodiqj;wzyodiqj;c:\windows\system32\drivers\dthbbdmh.sys --> c:\windows\system32\drivers\dthbbdmh.sys [?]
S0 xkfdprxp;xkfdprxp;c:\windows\system32\drivers\paerjqcx.sys --> c:\windows\system32\drivers\paerjqcx.sys [?]
S0 yxpfduqd;yxpfduqd;c:\windows\system32\drivers\pcyverxy.sys [2009-01-13 25088]
S0 zolujjud;zolujjud;c:\windows\system32\drivers\svpavisu.sys [2009-01-22 25088]
S0 zvwdhsjb;zvwdhsjb;c:\windows\system32\drivers\kvmazgux.sys []
S3 RkPavproc1;RkPavproc1;c:\windows\system32\drivers\RkPavproc1.sys [2009-01-10 16952]
S3 SkLaggProtocol;Marvell Link Aggregation Protocol (LAGG) Support;c:\windows\system32\DRIVERS\yk51lagg.sys --> c:\windows\system32\DRIVERS\yk51lagg.sys [?]
S3 SkVlanProtocol;Marvell Virtual LAN (VLAN) Support;c:\windows\system32\drivers\skvlan.sys [2006-05-17 19328]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.co.uk/
mSearch Bar = hxxp://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/sb/*http://uk.docs.yahoo.com/info/bt_side.html
uInternet Settings,ProxyOverride = 127.0.0.1;*.local
uSearchURL,(Default) = hxxp://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/su/*http://uk.search.yahoo.com/
IE: &Download All with FlashGet - c:\program files\FlashGet\jc_all.htm
IE: &Download with FlashGet - c:\program files\FlashGet\jc_link.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {4A116A80-85B6-4299-A018-A717FD7AC66A} - hxxp://m1.cdn.gaiaonline.com/plugins/IDMFlash.cab
FF - ProfilePath - c:\documents and settings\DanneH\Application Data\Mozilla\Firefox\Profiles\j4w2u3tm.default\
FF - prefs.js: browser.startup.homepage - hxxp://en-GB.start2.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-GBfficial
FF - prefs.js: network.proxy.http - 133.1.16.172
FF - prefs.js: network.proxy.http_port - 3128
FF - prefs.js: network.proxy.type - 4
FF - component: c:\documents and settings\DanneH\Application Data\Mozilla\Firefox\Profiles\j4w2u3tm.default\extensions\[email protected]\components\piclensstub.dll
FF - component: c:\program files\Mozilla Firefox\components\flashgetXpi.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npyaxmpb.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-23 16:38:10
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

c:\windows\system32\drivers\kvmazgux.sys 25088 bytes executable

scan completed successfully
hidden files: 1

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\mysql]
"ImagePath"="c:\xampplite\mysql\bin\mysqld-nt --defaults-file=c:\xampplite\mysql\bin\my.cnf mysql"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-73586283-630328440-839522115-1004\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_USERS\S-1-5-21-73586283-630328440-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID]
@Denied: (Full) (LocalSystem)
"{20D04FE0-3AEA-1069-A2D8-08002B30309D}"="c:\\WINDOWS\\System32\\shell32.dll,15"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="c:\\WINDOWS\\system32\\SHELL32.dll,17"
"{208D2C60-3AEA-1069-A2D7-08002B30309D}"="c:\\WINDOWS\\system32\\SHELL32.dll,17"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="c:\\WINDOWS\\system32\\shell32.dll,22"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="c:\\WINDOWS\\system32\\shell32.dll,23"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="c:\\WINDOWS\\system32\\shell32.dll,24"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="c:\\WINDOWS\\system32\\shell32.dll,-175"
"{21EC2020-3AEA-1069-A2DD-08002B30309D}"="c:\\WINDOWS\\System32\\shell32.dll,-137"
"{2227A280-3AEA-1069-A2DE-08002B30309D}"="c:\\WINDOWS\\System32\\shell32.dll,-138"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="c:\\WINDOWS\\system32\\shell32.dll,38"
"AudioCD"="c:\\WINDOWS\\System32\\shell32.dll,40"
"{FBF23B42-E3F0-101B-8488-00AA003E56F8}"="c:\\WINDOWS\\system32\\shell32.dll,220"
"{450D8FBA-AD25-11D0-98A8-0800361B1103}"="c:\\WINDOWS\\system32\\mydocs.dll,0"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="c:\\WINDOWS\\system32\\main.cpl,10"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="c:\\WINDOWS\\system32\\wiashext.dll,0"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="c:\\WINDOWS\\system32\\mstask.dll,-100"
"{88C6C381-2E85-11D0-94DE-444553540000}"="c:\\WINDOWS\\System32\\occache.dll,0"
"{BDEADF00-C265-11d0-BCED-00A0C90AB50F}"="c:\\Program Files\\COMMON~1\\MICROS~1\\WEBFOL~1\\MSONSEXT.DLL,0"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="c:\\WINDOWS\\System32\\shdocvw.dll,-20785"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="c:\\WINDOWS\\System32\\webcheck.dll,0"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="c:\\WINDOWS\\system32\\syncui.dll,0"

[HKEY_USERS\S-1-5-21-73586283-630328440-839522115-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:0a,60,1d,32,0f,64,29,95,ab,89,39,b0,90,89,7e,22,1c,ca,a3,32,33,cb,30,
ac,8b,47,06,c2,17,0b,c3,75,3d,b0,ef,70,d6,38,fa,a0,3e,28,a9,ab,17,f7,c1,9d,\
"??"=hex:ca,8b,ff,70,e7,92,0d,16,c1,db,ec,89,74,e3,b3,d9

[HKEY_USERS\S-1-5-21-73586283-630328440-839522115-1004\Software\SecuROM\License information*]
"datasecu"=hex:de,fc,d0,ac,3e,91,01,8c,94,46,fc,ce,92,59,55,8b,f6,30,40,71,c4,
0a,6d,6d,ad,ee,9d,4f,93,79,2b,ba,72,4c,01,de,b2,63,dd,85,90,66,71,36,22,67,\
"rkeysecu"=hex:75,fa,ed,3e,bb,21,cc,e6,32,b2,73,1c,4e,62,9a,47
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Kontiki\KService.exe
c:\program files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe
c:\xampplite\mysql\bin\mysqld-nt.exe
c:\program files\NVIDIA Corporation\nTune\nTuneService.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\rundll32.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-01-23 16:41:48 - machine was rebooted
ComboFix-quarantined-files.txt 2009-01-23 16:41:45
ComboFix2.txt 2009-01-23 16:23:40
ComboFix3.txt 2009-01-23 01:00:06
ComboFix4.txt 2009-01-22 23:20:38
ComboFix5.txt 2009-01-23 16:31:23

Pre-Run: 2,157,154,304 bytes free
Post-Run: 2,137,165,824 bytes free

Current=3 Default=3 Failed=0 LastKnownGood=8 Sets=1,2,3,4,5,6,7,8
383	--- E O F ---	2009-01-23 03:02:58


----------



## Danndx (Jul 30, 2007)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:15:47 PM, on 23/01/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\ASUS\Ai Suite\AiNap\AiNap.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\ASUS\Ai Suite\AiGear3\CpuPowerMonitor.exe
C:\Program Files\ASUS\Ai Suite\CpuLevelUpHelp.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\ASUS\AI Direct Link\AsShare.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\btbb_wcm\McciTrayApp.exe
C:\Program Files\BT Broadband Desktop Help\bin\BTHelpNotifier.exe
C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Kontiki\KService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Analog Devices\SoundMAX\smax4.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://uk.red.clientapps.yahoo.com/...b/*http://uk.docs.yahoo.com/info/bt_side.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/su/*http://uk.search.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Ai Nap] "C:\Program Files\ASUS\Ai Suite\AiNap\AiNap.exe"
O4 - HKLM\..\Run: [CPU Power Monitor] "C:\Program Files\ASUS\Ai Suite\AiGear3\CpuPowerMonitor.exe"
O4 - HKLM\..\Run: [Cpu Level Up help] C:\Program Files\ASUS\Ai Suite\CpuLevelUpHelp.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [Launch Direct Link] "C:\Program Files\ASUS\AI Direct Link\AsShare.exe"
O4 - HKLM\..\Run: [Launch As Cmd Runner] "C:\Program Files\ASUS\AI Direct Link\AsCmd.exe" -reg
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [btbb_wcm_McciTrayApp] C:\Program Files\btbb_wcm\McciTrayApp.exe
O4 - HKLM\..\Run: [btbb_McciTrayApp] C:\Program Files\BT Broadband Desktop Help\bin\BTHelpNotifier.exe
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Flashget] C:\Program Files\FlashGet\flashget.exe /min
O4 - HKLM\..\Run: [08515e63] rundll32.exe "C:\WINDOWS\system32\gijktecl.dll",b
O4 - HKLM\..\Run: [4oD] "C:\Program Files\Kontiki\KHost.exe" -all
O4 - HKLM\..\Run: [SoundMax] "C:\Program Files\Analog Devices\SoundMAX\smax4.exe" /tray
O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe -all
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: BT Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {4A116A80-85B6-4299-A018-A717FD7AC66A} (AXIDMDCP Class) - http://m1.cdn.gaiaonline.com/plugins/IDMFlash.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-GB/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1194970902234
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - AppInit_DLLs: enpfbt.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe
O23 - Service: RaySat_3dsmax8 Server (mi-raysat_3dsmax8) - Unknown owner - C:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe
O23 - Service: mysql - Unknown owner - C:\xampplite\mysql\bin\mysqld-nt.exe
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe (file missing)
O24 - Desktop Component 0: (no name) - http://ponddeck.com/abstract/blue_sky_complex.jpg
O24 - Desktop Component 1: (no name) - C:\Documents and Settings\DanneH\My Documents\My Pictures\Wallpapers\Saturn_Planet_3200_x_1200_Dual_Monitor.jpg
O24 - Desktop Component 2: (no name) - C:\Documents and Settings\DanneH\My Documents\My Pictures\Wallpapers\Winter_Dream_2560_x_1024_Dual_Monitor.jpg
O24 - Desktop Component 3: (no name) - C:\Documents and Settings\DanneH\My Documents\My Pictures\Wallpapers\Nigh_in_the_city_2560_x_1024_Dual_Monitor.jpg
O24 - Desktop Component 4: (no name) - (no file)

--
End of file - 12642 bytes


----------



## dvk01 (Dec 14, 2002)

I made a mistake in the first script so that is why it didn't work

lets try again

Download the attached CFScript.txt and save it to your desktop ( click on the link underneath this post & if you are using internet explorer when the "File download" pop up comes press *SAVE * and choose desktop in the list of selections in that window & press save)

Close any open browsers 
Then drag the CFScript.txt into the ComboFix.exe as shown in the screenshot below.










This will start ComboFix again. It may ask to reboot. Post the contents of Combofix.txt in your next reply together with a new HijackThis log.

*Note: these instructions and script were created specifically for this user. If you are not this user, do NOT follow these instructions or use this script as it could damage the workings of your system and will not fix your problem. If you have a similar problem start your own topic in the malware fixing forum *

This will create a zip file inside C:\QooBox\ named something like [38][email protected]

at the end it will pop up an alert & open your browser and ask you to send the zip file

please follow those instructions. We need to see the zip file before we can carry on with the fix

If there is no pop up alert or open browser then

please go to http://www.thespykiller.co.uk/index.php?board=1.0 and upload these files so I can examine them and if needed distribute them to antivirus companies.
Just press new topic, fill in the needed details and just give a link to your post here & then press the browse button and then navigate to & select the files on your computer, If there is more than 1 file then press the more attachments button for each extra file and browse and select etc and then when all the files are listed in the windows press send to upload the files ( do not post HJT logs there as they will not get dealt with)

Files to submit:
the zip file inside C:\QooBox\ created by combofix named something like [38][email protected]


----------



## Danndx (Jul 30, 2007)

ComboFix 09-01-21.04 - DanneH 2009-01-23 19:15:36.7 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3327.2774 [GMT 0:00]
Running from: c:\documents and settings\DanneH\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\DanneH\Desktop\cfscript-5.txt
AV: ESET Smart Security 3.0 *On-access scanning disabled* (Updated)
FW: ESET Personal firewall *disabled*
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2008-12-23 to 2009-01-23 )))))))))))))))))))))))))))))))
.

2009-02-22 19:18 . 2009-02-22 19:18	25,088	--a------	c:\windows\system32\drivers\dxixxbvo.sys
2009-01-23 17:05 . 2009-01-23 17:05 d-------- c:\program files\Kontiki
2009-01-23 17:05 . 2009-01-23 17:05 d--------	c:\program files\Channel4
2009-01-23 03:01 . 2009-01-23 03:01	127	--a------	c:\windows\system32\MRT.INI
2009-01-23 00:47 . 2009-01-23 00:47	25,088	--a------	c:\windows\system32\drivers\buuwzlqm.sys
2009-01-22 23:58 . 2009-01-22 23:58	25,088	--a------	c:\windows\system32\drivers\svpavisu.sys
2009-01-22 23:22 . 2009-01-22 23:22	25,088	--a------	c:\windows\system32\drivers\wkcleauu.sys
2009-01-22 22:36 . 2009-01-23 19:21 d--------	c:\documents and settings\All Users\Application Data\Kontiki
2009-01-22 22:36 . 2009-01-22 22:36 d--------	c:\documents and settings\All Users\Application Data\Channel4
2009-01-22 22:36 . 2009-01-22 22:36	25,088	--a------	c:\windows\system32\drivers\nccobtnf.sys
2009-01-22 20:10 . 2009-01-22 20:10	25,088	--a------	c:\windows\system32\drivers\jxvvqfmt.sys
2009-01-22 04:50 . 2009-01-22 04:50	25,088	--a------	c:\windows\system32\drivers\yiffmyhz.sys
2009-01-22 03:15 . 2009-01-22 03:15	25,088	--a------	c:\windows\system32\drivers\ejxykavq.sys
2009-01-21 21:46 . 2009-01-21 21:46	1,438,325	---hs----	c:\windows\system32\ncsumikh.tmp
2009-01-21 21:08 . 2009-01-21 21:08	151,552	--a------	c:\windows\system32\nvRegDev.dll
2009-01-21 21:03 . 2009-01-21 21:03	1,438,902	---hs----	c:\windows\system32\coewayjd.tmp
2009-01-21 19:29 . 2009-01-21 19:29	25,088	--a------	c:\windows\system32\drivers\ijalrfxb.sys
2009-01-21 16:43 . 2009-01-21 16:43	25,088	--a------	c:\windows\system32\drivers\hkshrhxm.sys
2009-01-21 15:40 . 2009-01-21 15:40	25,088	--a------	c:\windows\system32\drivers\rijludss.sys
2009-01-20 23:27 . 2009-01-20 23:27	25,088	--a------	c:\windows\system32\drivers\wgegjkdv.sys
2009-01-20 19:22 . 2009-01-20 19:22	25,088	--a------	c:\windows\system32\drivers\iglpisnu.sys
2009-01-20 16:41 . 2009-01-20 16:41	25,088	--a------	c:\windows\system32\drivers\qyddafru.sys
2009-01-20 03:21 . 2009-01-23 19:18	9,060	--a------	c:\windows\zvwdhsjb
2009-01-19 17:50 . 2009-01-19 17:50	25,088	--a------	c:\windows\system32\drivers\zyzfxngj.sys
2009-01-19 16:49 . 2009-01-19 16:49	25,088	--a------	c:\windows\system32\drivers\kkpvejgv.sys
2009-01-19 13:32 . 2009-01-19 13:32	25,088	--a------	c:\windows\system32\drivers\bifgjrga.sys
2009-01-19 10:28 . 2009-01-19 10:28	25,088	--a------	c:\windows\system32\drivers\qcvcfcyk.sys
2009-01-18 15:23 . 2009-01-18 15:23	25,088	--a------	c:\windows\system32\drivers\gjyakvfh.sys
2009-01-18 13:39 . 2009-01-18 13:39	1,407,285	---hs----	c:\windows\system32\gyyceacc.tmp
2009-01-18 13:35 . 2009-01-18 13:35	25,088	--a------	c:\windows\system32\drivers\tpvaqbgm.sys
2009-01-18 12:38 . 2009-01-18 12:40 d--------	c:\windows\NV2459617388.TMP
2009-01-17 19:57 . 2009-01-17 19:57	25,088	--a------	c:\windows\system32\drivers\cweuagnu.sys
2009-01-17 16:01 . 2009-01-17 16:01	25,088	--a------	c:\windows\system32\drivers\mshlgkqm.sys
2009-01-17 09:38 . 2009-01-17 09:38	25,088	--a------	c:\windows\system32\drivers\fxqzwbux.sys
2009-01-16 19:05 . 2009-01-23 00:46	25,088	--a------	c:\windows\system32\drivers\phqghume.sys
2009-01-16 19:04 . 2009-01-16 19:04	25,088	--a------	c:\windows\system32\drivers\hkcxukuc.sys
2009-01-13 22:44 . 2009-01-19 17:53	11,508	--a------	c:\windows\yxpfduqd
2009-01-13 22:35 . 2009-01-13 22:35 d--------	c:\documents and settings\Administrator
2009-01-13 22:08 . 2009-01-13 22:08	25,088	--a------	c:\windows\system32\drivers\pcyverxy.sys
2009-01-13 18:41 . 2009-01-13 22:27	5,876	--a------	c:\windows\ehtpkavh
2009-01-10 00:06 . 2008-04-29 11:33	16,952	--a------	c:\windows\system32\drivers\RkPavproc1.sys
2009-01-09 23:56 . 2009-01-09 23:56 d--------	c:\program files\Trend Micro
2009-01-08 07:49 . 2008-04-17 13:12	107,368	--a------	c:\windows\system32\GEARAspi.dll
2009-01-08 07:48 . 2009-01-08 07:48 d--------	c:\program files\iPod
2009-01-08 07:48 . 2009-01-08 07:49 d--------	c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2009-01-08 07:47 . 2009-01-14 00:07 d--------	c:\program files\QuickTime
2009-01-08 07:46 . 2009-01-08 07:46 d--------	c:\program files\Apple Software Update
2009-01-07 01:24 . 2009-01-07 01:24 d--------	c:\program files\Adobe Fireworks CS3
2009-01-06 05:31 . 2009-01-06 05:31 d--------	c:\documents and settings\All Users\Application Data\Reflexive
2009-01-06 05:30 . 2009-01-09 18:45 d---s----	c:\program files\Music Catch
2009-01-02 20:12 . 2009-01-02 20:12 d--------	c:\documents and settings\DanneH\Application Data\BWMonitor
2008-12-28 14:45 . 2008-12-28 14:45 d--------	c:\program files\Common Files\INCA Shared
2008-12-28 14:45 . 2003-07-20 18:17	5,174	--a------	c:\windows\system32\nppt9x.vxd
2008-12-28 14:45 . 2005-01-04 09:43	4,682	--a------	c:\windows\system32\npptNT2.sys
2008-12-28 14:24 . 2008-12-28 14:24 d--------	c:\windows\ROSE Online Evolution
2008-12-28 14:24 . 2008-12-28 14:24 d--------	c:\program files\Triggersoft
2008-12-28 13:16 . 2008-12-28 13:16 d--------	c:\documents and settings\DanneH\Application Data\Yahoo!
2008-12-26 00:08 . 2008-12-26 00:08	1,253,376	--a------	c:\windows\system32\NvPVEnc.ax
2008-12-24 16:21 . 2008-12-24 16:21	1,639,241	--ahs----	c:\windows\system32\edacyepa.tmp

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-23 19:21	---------	d-----w	c:\program files\FlashGet
2009-01-23 03:02	---------	d-----w	c:\documents and settings\All Users\Application Data\Microsoft Help
2009-01-21 21:09	---------	d--h--w	c:\program files\InstallShield Installation Information
2009-01-21 21:09	---------	d-----w	c:\program files\NVIDIA Corporation
2009-01-18 12:39	---------	d-----w	c:\program files\Common Files\Wise Installation Wizard
2009-01-14 08:16	---------	d---a-w	c:\documents and settings\All Users\Application Data\TEMP
2009-01-14 00:07	---------	d-----w	c:\program files\iTunes
2009-01-14 00:04	---------	d-----w	c:\program files\Winamp
2009-01-08 07:48	---------	d-----w	c:\program files\Bonjour
2009-01-08 07:48	---------	d-----w	c:\documents and settings\All Users\Application Data\Apple Computer
2009-01-07 00:56	---------	d-----w	c:\program files\Grid
2009-01-07 00:44	---------	d-----w	c:\program files\Multiwinia
2009-01-07 00:26	---------	d-----w	c:\program files\Darwinia
2009-01-07 00:24	---------	d-----w	c:\program files\Electronic Arts
2009-01-07 00:22	---------	d-----w	c:\program files\Project64 1.6
2009-01-07 00:22	---------	d-----w	c:\program files\Mass Effect
2009-01-07 00:19	---------	d-----w	c:\program files\Steam
2008-12-29 15:52	31	----a-w	c:\documents and settings\DanneH\jagex_runescape_preferences.dat
2008-12-28 10:16	---------	d-----w	c:\program files\Yahoo!
2008-12-28 10:09	---------	d-----w	c:\program files\CCP
2008-12-26 00:08	6,301,344	----a-w	c:\windows\system32\drivers\nv4_mini.sys
2008-12-16 21:44	---------	d-----w	c:\program files\Fallout 3
2008-12-14 05:04	---------	d-----w	c:\program files\Unlocker
2008-12-14 05:04	---------	d-----w	c:\documents and settings\DanneH\Application Data\Desktopicon
2008-12-13 22:48	---------	d-----w	c:\program files\Pollux Gamelabs
2008-12-12 21:05	---------	d-----w	c:\program files\Adobe Flash CS3
2008-12-12 14:27	---------	d-----w	c:\documents and settings\DanneH\Application Data\Winamp
2008-12-11 10:57	333,952	----a-w	c:\windows\system32\drivers\srv.sys
2008-12-02 04:46	---------	d-----w	c:\documents and settings\DanneH\Application Data\Red Alert 3
2008-11-28 14:37	---------	d-----w	c:\documents and settings\DanneH\Application Data\Thinstall
2007-12-23 10:38	22,328	----a-w	c:\documents and settings\DanneH\Application Data\PnkBstrK.sys
2008-07-25 08:31	28,672	----a-w	c:\program files\mozilla firefox\components\flashgetXpi.dll
.

((((((((((((((((((((((((((((( snapshot_2009-01-22_23.19.58.42 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-12-10 03:06:10	1,165,584	----a-r	c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\accicons.exe
+ 2009-01-23 03:02:54	1,165,584	----a-r	c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\accicons.exe
- 2008-12-10 03:06:11	20,240	----a-r	c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\cagicon.exe
+ 2009-01-23 03:02:55	20,240	----a-r	c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\cagicon.exe
- 2008-12-10 03:06:10	159,504	----a-r	c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\inficon.exe
+ 2009-01-23 03:02:55	159,504	----a-r	c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\inficon.exe
- 2008-12-10 03:06:10	184,080	----a-r	c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\joticon.exe
+ 2009-01-23 03:02:55	184,080	----a-r	c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\joticon.exe
- 2008-12-10 03:06:10	217,864	----a-r	c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\misc.exe
+ 2009-01-23 03:02:55	217,864	----a-r	c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\misc.exe
- 2008-12-10 03:06:11	18,704	----a-r	c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\mspicons.exe
+ 2009-01-23 03:02:55	18,704	----a-r	c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\mspicons.exe
- 2008-12-10 03:06:11	35,088	----a-r	c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\oisicon.exe
+ 2009-01-23 03:02:56	35,088	----a-r	c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\oisicon.exe
- 2008-12-10 03:06:10	845,584	----a-r	c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\outicon.exe
+ 2009-01-23 03:02:55	845,584	----a-r	c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\outicon.exe
- 2008-12-10 03:06:10	922,384	----a-r	c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pptico.exe
+ 2009-01-23 03:02:55	922,384	----a-r	c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pptico.exe
- 2008-12-10 03:06:10	272,648	----a-r	c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pubs.exe
+ 2009-01-23 03:02:55	272,648	----a-r	c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pubs.exe
- 2008-12-10 03:06:11	888,080	----a-r	c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\wordicon.exe
+ 2009-01-23 03:02:56	888,080	----a-r	c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\wordicon.exe
- 2008-12-10 03:06:10	1,172,240	----a-r	c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\xlicons.exe
+ 2009-01-23 03:02:55	1,172,240	----a-r	c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\xlicons.exe
- 2008-09-08 10:41:42	333,824	-c----w	c:\windows\system32\dllcache\srv.sys
+ 2008-12-11 10:57:09	333,952	-c----w	c:\windows\system32\dllcache\srv.sys
+ 2007-06-11 13:04:38	190,696	----a-w	c:\windows\system32\Macromed\Flash\FlashUtil9d.exe
+ 2009-01-09 17:35:30	20,853,704	----a-w	c:\windows\system32\MRT.exe
+ 2009-01-23 19:20:13	16,384	----atw	c:\windows\temp\Perflib_Perfdata_1d0.dat
+ 2009-01-23 19:20:12	16,384	----atw	c:\windows\temp\Perflib_Perfdata_a8.dat
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NVIDIA nTune"="c:\program files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-09-04 81920]
"STYLEXP"="c:\program files\TGTSoft\StyleXP\StyleXP.exe" [2006-05-24 1372160]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"kdx"="c:\program files\Kontiki\KHost.exe" [2007-04-23 1032640]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 39792]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-26 13680640]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"Ai Nap"="c:\program files\ASUS\Ai Suite\AiNap\AiNap.exe" [2007-09-06 1426432]
"CPU Power Monitor"="c:\program files\ASUS\Ai Suite\AiGear3\CpuPowerMonitor.exe" [2007-10-16 626176]
"Cpu Level Up help"="c:\program files\ASUS\Ai Suite\CpuLevelUpHelp.exe" [2007-09-11 880640]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2006-12-18 868352]
"Launch Direct Link"="c:\program files\ASUS\AI Direct Link\AsShare.exe" [2007-08-20 1209856]
"Launch As Cmd Runner"="c:\program files\ASUS\AI Direct Link\AsCmd.exe" [2007-04-11 376832]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-09-12 185896]
"btbb_wcm_McciTrayApp"="c:\program files\btbb_wcm\McciTrayApp.exe" [2006-12-07 935936]
"btbb_McciTrayApp"="c:\program files\BT Broadband Desktop Help\bin\BTHelpNotifier.exe" [2007-05-23 936960]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-14 644696]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-03 1603152]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4\OpwareSE4.exe" [2007-02-04 79400]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2008-03-01 1443072]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-26 86016]
"Flashget"="c:\program files\FlashGet\flashget.exe" [2007-09-25 2007088]
"08515e63"="c:\windows\system32\gijktecl.dll" [BU]
"4oD"="c:\program files\Kontiki\KHost.exe" [2007-04-23 1032640]
"nwiz"="nwiz.exe" [2008-12-26 c:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2008-04-14 c:\windows\system32\narrator.exe]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSetActiveDesktop"= 1 (0x1)
"NoActiveDesktopChanges"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\1]
Source= c:\documents and settings\DanneH\My Documents\My Pictures\Wallpapers\Saturn_Planet_3200_x_1200_Dual_Monitor.jpg
FriendlyName=

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\2]
Source= c:\documents and settings\DanneH\My Documents\My Pictures\Wallpapers\Winter_Dream_2560_x_1024_Dual_Monitor.jpg
FriendlyName=

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\3]
Source= c:\documents and settings\DanneH\My Documents\My Pictures\Wallpapers\Nigh_in_the_city_2560_x_1024_Dual_Monitor.jpg
FriendlyName=

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=enpfbt.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\CCP\\EVE\\bin\\ExeFile.exe"=
"c:\\Program Files\\Autodesk\\3dsMax8\\3dsmax.exe"=
"c:\\Program Files\\Autodesk\\backburner\\monitor.exe"=
"c:\\Program Files\\Autodesk\\backburner\\manager.exe"=
"c:\\Program Files\\Autodesk\\backburner\\server.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\xampplite\\mysql\\bin\\mysqld.exe"=
"c:\\xampplite\\apache\\bin\\apache.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Java\\jre1.6.0_06\\bin\\java.exe"=
"c:\\WINDOWS\\system32\\java.exe"=
"c:\\Program Files\\Steam\\steamapps\\dx14\\half-life 2 deathmatch\\hl2.exe"=
"c:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"=
"c:\\Program Files\\Mass Effect\\Binaries\\MassEffect.exe"=
"c:\\Program Files\\Mass Effect\\MassEffectLauncher.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\Grid\\GRID.exe"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"c:\\Program Files\\Pollux Gamelabs\\Lost Empire - Immortals\\LostEmpire.exe"=
"c:\\Program Files\\FlashGet\\FlashGet.exe"=
"c:\\WINDOWS\\system32\\taskmgr.exe"=
"c:\\WINDOWS\\system32\\imapi.exe"=
"c:\\Program Files\\ESET\\ESET Smart Security\\ekrn.exe"=
"c:\\WINDOWS\\system32\\userinit.exe"=
"c:\\Program Files\\ESET\\ESET Smart Security\\egui.exe"=
"c:\\Program Files\\Autodesk\\3dsMax8\\mentalray\\satellite\\raysat_3dsmax8server.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Kontiki\\KService.exe"=

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2008-12-14 28544]
R3 P1130VID;Creative WebCam NX Pro;c:\windows\system32\drivers\P1130Vid.sys [2007-11-18 90229]
R4 ekrn;Eset Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [2007-12-21 468224]
S0 aglwtmau;aglwtmau;c:\windows\system32\drivers\dxixxbvo.sys [2009-02-22 25088]
S0 aylnlfdx;aylnlfdx;c:\windows\system32\drivers\phqghume.sys [2009-01-16 25088]
S0 bsbkxcth;bsbkxcth;c:\windows\system32\drivers\gjyakvfh.sys [2009-01-18 25088]
S0 cffzjdzt;cffzjdzt;c:\windows\system32\drivers\mshlgkqm.sys [2009-01-17 25088]
S0 cjxubvxo;cjxubvxo;c:\windows\system32\drivers\jxvvqfmt.sys [2009-01-22 25088]
S0 dswxyjjw;dswxyjjw;c:\windows\system32\drivers\zyzfxngj.sys [2009-01-19 25088]
S0 ehppmcdu;ehppmcdu;c:\windows\system32\drivers\yiffmyhz.sys [2009-01-22 25088]
S0 ehtpkavh;ehtpkavh;c:\windows\system32\drivers\qkjicusy.sys --> c:\windows\system32\drivers\qkjicusy.sys [?]
S0 ejlyrmyy;ejlyrmyy;c:\windows\system32\drivers\tbpusrww.sys --> c:\windows\system32\drivers\tbpusrww.sys [?]
S0 ggcpbuky;ggcpbuky;c:\windows\system32\drivers\wgegjkdv.sys [2009-01-20 25088]
S0 gifepmgl;gifepmgl;c:\windows\system32\drivers\juwtpxnb.sys --> c:\windows\system32\drivers\juwtpxnb.sys [?]
S0 gldshmcx;gldshmcx;c:\windows\system32\drivers\rqmuxrhv.sys --> c:\windows\system32\drivers\rqmuxrhv.sys [?]
S0 hdxdnccu;hdxdnccu;c:\windows\system32\drivers\qyddafru.sys [2009-01-20 25088]
S0 ijwcnhyt;ijwcnhyt;c:\windows\system32\drivers\xrozomcn.sys --> c:\windows\system32\drivers\xrozomcn.sys [?]
S0 jcmmfoxd;jcmmfoxd;c:\windows\system32\drivers\hkcxukuc.sys [2009-01-16 25088]
S0 kpwsmylg;kpwsmylg;c:\windows\system32\drivers\bycwrmhq.sys --> c:\windows\system32\drivers\bycwrmhq.sys [?]
S0 mewvxeix;mewvxeix;c:\windows\system32\drivers\bifgjrga.sys [2009-01-19 25088]
S0 mjlkfvoy;mjlkfvoy;c:\windows\system32\drivers\jpqgnitu.sys --> c:\windows\system32\drivers\jpqgnitu.sys [?]
S0 nuleolvr;nuleolvr;c:\windows\system32\drivers\vyzwvlhn.sys --> c:\windows\system32\drivers\vyzwvlhn.sys [?]
S0 nxrkutqx;nxrkutqx;c:\windows\system32\drivers\tpvaqbgm.sys [2009-01-18 25088]
S0 oxnzuveo;oxnzuveo;c:\windows\system32\drivers\hkshrhxm.sys [2009-01-21 25088]
S0 plubbaoh;plubbaoh;c:\windows\system32\drivers\iglpisnu.sys [2009-01-20 25088]
S0 ppyigjia;ppyigjia;c:\windows\system32\drivers\nbztsbyb.sys --> c:\windows\system32\drivers\nbztsbyb.sys [?]
S0 ptqybfpj;ptqybfpj;c:\windows\system32\drivers\ejxykavq.sys [2009-01-22 25088]
S0 qfvljyky;qfvljyky;c:\windows\system32\drivers\nccobtnf.sys [2009-01-22 25088]
S0 qmodgtfl;qmodgtfl;c:\windows\system32\drivers\cweuagnu.sys [2009-01-17 25088]
S0 rmjhdgeo;rmjhdgeo;c:\windows\system32\drivers\fxqzwbux.sys [2009-01-17 25088]
S0 rpdqlwyy;rpdqlwyy;c:\windows\system32\drivers\yabfzycw.sys --> c:\windows\system32\drivers\yabfzycw.sys [?]
S0 rprofjen;rprofjen;c:\windows\system32\drivers\wkcleauu.sys [2009-01-22 25088]
S0 snfsbjjt;snfsbjjt;c:\windows\system32\drivers\buuwzlqm.sys [2009-01-23 25088]
S0 soplkdgh;soplkdgh;c:\windows\system32\drivers\rijludss.sys [2009-01-21 25088]
S0 tdghrkbh;tdghrkbh;c:\windows\system32\drivers\ijalrfxb.sys [2009-01-21 25088]
S0 ujbgdytz;ujbgdytz;c:\windows\system32\drivers\qcvcfcyk.sys [2009-01-19 25088]
S0 vtgtqfah;vtgtqfah;c:\windows\system32\drivers\eunqpdlk.sys --> c:\windows\system32\drivers\eunqpdlk.sys [?]
S0 vtlzamym;vtlzamym;c:\windows\system32\drivers\kkpvejgv.sys [2009-01-19 25088]
S0 wzyodiqj;wzyodiqj;c:\windows\system32\drivers\dthbbdmh.sys --> c:\windows\system32\drivers\dthbbdmh.sys [?]
S0 xkfdprxp;xkfdprxp;c:\windows\system32\drivers\paerjqcx.sys --> c:\windows\system32\drivers\paerjqcx.sys [?]
S0 yxpfduqd;yxpfduqd;c:\windows\system32\drivers\pcyverxy.sys [2009-01-13 25088]
S0 zolujjud;zolujjud;c:\windows\system32\drivers\svpavisu.sys [2009-01-22 25088]
S0 zvwdhsjb;zvwdhsjb;c:\windows\system32\drivers\kvmazgux.sys []
S3 RkPavproc1;RkPavproc1;c:\windows\system32\drivers\RkPavproc1.sys [2009-01-10 16952]
S3 SkLaggProtocol;Marvell Link Aggregation Protocol (LAGG) Support;c:\windows\system32\DRIVERS\yk51lagg.sys --> c:\windows\system32\DRIVERS\yk51lagg.sys [?]
S3 SkVlanProtocol;Marvell Virtual LAN (VLAN) Support;c:\windows\system32\drivers\skvlan.sys [2006-05-17 19328]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.co.uk/
mSearch Bar = hxxp://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/sb/*http://uk.docs.yahoo.com/info/bt_side.html
uInternet Settings,ProxyOverride = 127.0.0.1;*.local
uSearchURL,(Default) = hxxp://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/su/*http://uk.search.yahoo.com/
IE: &Download All with FlashGet - c:\program files\FlashGet\jc_all.htm
IE: &Download with FlashGet - c:\program files\FlashGet\jc_link.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {4A116A80-85B6-4299-A018-A717FD7AC66A} - hxxp://m1.cdn.gaiaonline.com/plugins/IDMFlash.cab
FF - ProfilePath - c:\documents and settings\DanneH\Application Data\Mozilla\Firefox\Profiles\j4w2u3tm.default\
FF - prefs.js: browser.startup.homepage - hxxp://en-GB.start2.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-GBfficial
FF - prefs.js: network.proxy.http - 133.1.16.172
FF - prefs.js: network.proxy.http_port - 3128
FF - prefs.js: network.proxy.type - 4
FF - component: c:\documents and settings\DanneH\Application Data\Mozilla\Firefox\Profiles\j4w2u3tm.default\extensions\[email protected]\components\piclensstub.dll
FF - component: c:\program files\Mozilla Firefox\components\flashgetXpi.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npyaxmpb.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-23 19:21:23
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

c:\windows\system32\drivers\kvmazgux.sys 25088 bytes executable

scan completed successfully
hidden files: 1

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\mysql]
"ImagePath"="c:\xampplite\mysql\bin\mysqld-nt --defaults-file=c:\xampplite\mysql\bin\my.cnf mysql"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-73586283-630328440-839522115-1004\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_USERS\S-1-5-21-73586283-630328440-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID]
@Denied: (Full) (LocalSystem)
"{20D04FE0-3AEA-1069-A2D8-08002B30309D}"="c:\\WINDOWS\\System32\\shell32.dll,15"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="c:\\WINDOWS\\system32\\SHELL32.dll,17"
"{208D2C60-3AEA-1069-A2D7-08002B30309D}"="c:\\WINDOWS\\system32\\SHELL32.dll,17"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="c:\\WINDOWS\\system32\\shell32.dll,22"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="c:\\WINDOWS\\system32\\shell32.dll,23"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="c:\\WINDOWS\\system32\\shell32.dll,24"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="c:\\WINDOWS\\system32\\shell32.dll,-175"
"{21EC2020-3AEA-1069-A2DD-08002B30309D}"="c:\\WINDOWS\\System32\\shell32.dll,-137"
"{2227A280-3AEA-1069-A2DE-08002B30309D}"="c:\\WINDOWS\\System32\\shell32.dll,-138"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="c:\\WINDOWS\\system32\\shell32.dll,38"
"AudioCD"="c:\\WINDOWS\\System32\\shell32.dll,40"
"{FBF23B42-E3F0-101B-8488-00AA003E56F8}"="c:\\WINDOWS\\system32\\shell32.dll,220"
"{450D8FBA-AD25-11D0-98A8-0800361B1103}"="c:\\WINDOWS\\system32\\mydocs.dll,0"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="c:\\WINDOWS\\system32\\main.cpl,10"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="c:\\WINDOWS\\system32\\wiashext.dll,0"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="c:\\WINDOWS\\system32\\mstask.dll,-100"
"{88C6C381-2E85-11D0-94DE-444553540000}"="c:\\WINDOWS\\System32\\occache.dll,0"
"{BDEADF00-C265-11d0-BCED-00A0C90AB50F}"="c:\\Program Files\\COMMON~1\\MICROS~1\\WEBFOL~1\\MSONSEXT.DLL,0"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="c:\\WINDOWS\\System32\\shdocvw.dll,-20785"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="c:\\WINDOWS\\System32\\webcheck.dll,0"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="c:\\WINDOWS\\system32\\syncui.dll,0"

[HKEY_USERS\S-1-5-21-73586283-630328440-839522115-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:0a,60,1d,32,0f,64,29,95,ab,89,39,b0,90,89,7e,22,1c,ca,a3,32,33,cb,30,
ac,8b,47,06,c2,17,0b,c3,75,3d,b0,ef,70,d6,38,fa,a0,3e,28,a9,ab,17,f7,c1,9d,\
"??"=hex:ca,8b,ff,70,e7,92,0d,16,c1,db,ec,89,74,e3,b3,d9

[HKEY_USERS\S-1-5-21-73586283-630328440-839522115-1004\Software\SecuROM\License information*]
"datasecu"=hex:de,fc,d0,ac,3e,91,01,8c,94,46,fc,ce,92,59,55,8b,f6,30,40,71,c4,
0a,6d,6d,ad,ee,9d,4f,93,79,2b,ba,72,4c,01,de,b2,63,dd,85,90,66,71,36,22,67,\
"rkeysecu"=hex:75,fa,ed,3e,bb,21,cc,e6,32,b2,73,1c,4e,62,9a,47
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\savedump.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Kontiki\KService.exe
c:\program files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe
c:\xampplite\mysql\bin\mysqld-nt.exe
c:\program files\NVIDIA Corporation\nTune\nTuneService.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\rundll32.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2009-01-23 19:25:12 - machine was rebooted
ComboFix-quarantined-files.txt 2009-01-23 19:25:09
ComboFix2.txt 2009-01-23 16:41:49
ComboFix3.txt 2009-01-23 16:23:40
ComboFix4.txt 2009-01-23 01:00:06
ComboFix5.txt 2009-01-23 19:15:08

Pre-Run: 1,992,196,096 bytes free
Post-Run: 2,010,198,016 bytes free

Current=3 Default=3 Failed=0 LastKnownGood=8 Sets=1,2,3,4,5,6,7,8
387	--- E O F ---	2009-01-23 03:02:58


----------



## Danndx (Jul 30, 2007)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:28:58 PM, on 23/01/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Kontiki\KService.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\ASUS\Ai Suite\AiNap\AiNap.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\ASUS\Ai Suite\AiGear3\CpuPowerMonitor.exe
C:\Program Files\ASUS\Ai Suite\CpuLevelUpHelp.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\ASUS\AI Direct Link\AsShare.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\btbb_wcm\McciTrayApp.exe
C:\Program Files\BT Broadband Desktop Help\bin\BTHelpNotifier.exe
C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://uk.red.clientapps.yahoo.com/...b/*http://uk.docs.yahoo.com/info/bt_side.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/su/*http://uk.search.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Ai Nap] "C:\Program Files\ASUS\Ai Suite\AiNap\AiNap.exe"
O4 - HKLM\..\Run: [CPU Power Monitor] "C:\Program Files\ASUS\Ai Suite\AiGear3\CpuPowerMonitor.exe"
O4 - HKLM\..\Run: [Cpu Level Up help] C:\Program Files\ASUS\Ai Suite\CpuLevelUpHelp.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [Launch Direct Link] "C:\Program Files\ASUS\AI Direct Link\AsShare.exe"
O4 - HKLM\..\Run: [Launch As Cmd Runner] "C:\Program Files\ASUS\AI Direct Link\AsCmd.exe" -reg
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [btbb_wcm_McciTrayApp] C:\Program Files\btbb_wcm\McciTrayApp.exe
O4 - HKLM\..\Run: [btbb_McciTrayApp] C:\Program Files\BT Broadband Desktop Help\bin\BTHelpNotifier.exe
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Flashget] C:\Program Files\FlashGet\flashget.exe /min
O4 - HKLM\..\Run: [08515e63] rundll32.exe "C:\WINDOWS\system32\gijktecl.dll",b
O4 - HKLM\..\Run: [4oD] "C:\Program Files\Kontiki\KHost.exe" -all
O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe -all
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: BT Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {4A116A80-85B6-4299-A018-A717FD7AC66A} (AXIDMDCP Class) - http://m1.cdn.gaiaonline.com/plugins/IDMFlash.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-GB/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1194970902234
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - AppInit_DLLs: enpfbt.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe
O23 - Service: RaySat_3dsmax8 Server (mi-raysat_3dsmax8) - Unknown owner - C:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe
O23 - Service: mysql - Unknown owner - C:\xampplite\mysql\bin\mysqld-nt.exe
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe (file missing)
O24 - Desktop Component 0: (no name) - http://ponddeck.com/abstract/blue_sky_complex.jpg
O24 - Desktop Component 1: (no name) - C:\Documents and Settings\DanneH\My Documents\My Pictures\Wallpapers\Saturn_Planet_3200_x_1200_Dual_Monitor.jpg
O24 - Desktop Component 2: (no name) - C:\Documents and Settings\DanneH\My Documents\My Pictures\Wallpapers\Winter_Dream_2560_x_1024_Dual_Monitor.jpg
O24 - Desktop Component 3: (no name) - C:\Documents and Settings\DanneH\My Documents\My Pictures\Wallpapers\Nigh_in_the_city_2560_x_1024_Dual_Monitor.jpg
O24 - Desktop Component 4: (no name) - (no file)

--
End of file - 12381 bytes

-------------------------------------

Same problem with the zip file, could it be possible to zip the files manually?

thx again


----------



## dvk01 (Dec 14, 2002)

for some reason combofix isn't deleting the files and I don't know why

it is just skipping over everything & not doing anything

lets try a different way

start off with seeing what this shows

Download *OTScanIt2.exe *to your Desktop and double-click on it to extract the files. It will create a folder named *OTScanIt2* on your desktop.

Close any open browsers.
Open the *OTScanit2* folder and double-click on *OTScanit2.exe* to start the program.
If your Real protection or Antivirus intervenes with OTScanIt, allow it to run.
In the *Processes * group click *ALL* 
In the * Services * group click *Safe List* 
In the *Drivers* group click *Safe List* 
In the *Registry * group click *ALL*
In the *Rootkit Search* group select *YES* 
In the *Files Age* drop down box click *90 days* 
Make sure use white list and include all unicode names boxes are checked
 In the Files created and Files modified groups select *whitelist/file age *
in the *Additional scans sections* please press select * Everything *and make sure safe list box is checked
Now on the toolbar at the top select "Scan all users" then click the *Run Scan* button
The program will be scanning huge amounts of data so depending on your system it could take a long time to complete. Let it run unhindered until it finishes.
When the scan is complete Notepad will open with the report file loaded in it.
Save that notepad file 
Use the * Reply* button and *attach the notepad file here*. I will review it when it comes in. 

It will be much too big so you will need to zip the file before it will be able to be uploaded


----------



## Danndx (Jul 30, 2007)

OTScanIt Log Attached

Thx


----------



## dvk01 (Dec 14, 2002)

Start *OTScanIt*. Copy/Paste the information in the Code box below into the pane where it says *"Paste fix here"* and then click the Run Fix button.


```
[Unregister Dlls]
[Driver Services - Safe List]
YY -> (aglwtmau) aglwtmau [Kernel | Boot | Stopped] -> %SystemRoot%\system32\drivers\dxixxbvo.sys
YY -> (atksgt) atksgt [Kernel | Auto | Running] -> %SystemRoot%\system32\drivers\atksgt.sys
YY -> (aylnlfdx) aylnlfdx [Kernel | Boot | Stopped] -> %SystemRoot%\system32\drivers\phqghume.sys
YY -> (bsbkxcth) bsbkxcth [Kernel | Boot | Stopped] -> %SystemRoot%\system32\drivers\gjyakvfh.sys
YY -> (cffzjdzt) cffzjdzt [Kernel | Boot | Stopped] -> %SystemRoot%\system32\drivers\mshlgkqm.sys
YY -> (cjxubvxo) cjxubvxo [Kernel | Boot | Stopped] -> %SystemRoot%\system32\drivers\jxvvqfmt.sys
YY -> (dswxyjjw) dswxyjjw [Kernel | Boot | Stopped] -> %SystemRoot%\system32\drivers\zyzfxngj.sys
NY -> (E100B) Intel(R) PRO Adapter Driver [Kernel | On_Demand | Stopped] -> %SystemRoot%\system32\drivers\e100b325.sys
NY -> (eamon) eamon [Kernel | Auto | Running] -> %SystemRoot%\system32\drivers\eamon.sys
NY -> (easdrv) easdrv [Kernel | System | Running] -> %SystemRoot%\system32\drivers\easdrv.sys
YY -> (ehppmcdu) ehppmcdu [Kernel | Boot | Stopped] -> %SystemRoot%\system32\drivers\yiffmyhz.sys
YY -> (ehtpkavh) ehtpkavh [Kernel | Boot | Stopped] -> %SystemRoot%\ehtpkavh
YY -> (ggcpbuky) ggcpbuky [Kernel | Boot | Stopped] -> %SystemRoot%\system32\drivers\wgegjkdv.sys
YY -> (hdxdnccu) hdxdnccu [Kernel | Boot | Stopped] -> %SystemRoot%\system32\drivers\qyddafru.sys
YY -> (jcmmfoxd) jcmmfoxd [Kernel | Boot | Stopped] -> %SystemRoot%\system32\drivers\hkcxukuc.sys
YY -> (lirsgt) lirsgt [Kernel | Auto | Running] -> %SystemRoot%\system32\drivers\lirsgt.sys
YY -> (mewvxeix) mewvxeix [Kernel | Boot | Stopped] -> %SystemRoot%\system32\drivers\bifgjrga.sys
YY -> (nxrkutqx) nxrkutqx [Kernel | Boot | Stopped] -> %SystemRoot%\system32\drivers\tpvaqbgm.sys
YY -> (oxnzuveo) oxnzuveo [Kernel | Boot | Stopped] -> %SystemRoot%\system32\drivers\hkshrhxm.sys
YY -> (plubbaoh) plubbaoh [Kernel | Boot | Stopped] -> %SystemRoot%\system32\drivers\iglpisnu.sys
YY -> (ptqybfpj) ptqybfpj [Kernel | Boot | Stopped] -> %SystemRoot%\system32\drivers\ejxykavq.sys
YY -> (qfvljyky) qfvljyky [Kernel | Boot | Stopped] -> %SystemRoot%\system32\drivers\nccobtnf.sys
YY -> (qmodgtfl) qmodgtfl [Kernel | Boot | Stopped] -> %SystemRoot%\system32\drivers\cweuagnu.sys
YY -> (rmjhdgeo) rmjhdgeo [Kernel | Boot | Stopped] -> %SystemRoot%\system32\drivers\fxqzwbux.sys
YY -> (rprofjen) rprofjen [Kernel | Boot | Stopped] -> %SystemRoot%\system32\drivers\wkcleauu.sys
YY -> (snfsbjjt) snfsbjjt [Kernel | Boot | Stopped] -> %SystemRoot%\system32\drivers\buuwzlqm.sys
YY -> (soplkdgh) soplkdgh [Kernel | Boot | Stopped] -> %SystemRoot%\system32\drivers\rijludss.sys
YY -> (tdghrkbh) tdghrkbh [Kernel | Boot | Stopped] -> %SystemRoot%\system32\drivers\ijalrfxb.sys
YY -> (ujbgdytz) ujbgdytz [Kernel | Boot | Stopped] -> %SystemRoot%\system32\drivers\qcvcfcyk.sys
YY -> (vtlzamym) vtlzamym [Kernel | Boot | Stopped] -> %SystemRoot%\system32\drivers\kkpvejgv.sys
YY -> (yxpfduqd) yxpfduqd [Kernel | Boot | Stopped] -> %SystemRoot%\system32\drivers\pcyverxy.sys
YY -> (zolujjud) zolujjud [Kernel | Boot | Stopped] -> %SystemRoot%\system32\drivers\svpavisu.sys
YY -> (zvwdhsjb) zvwdhsjb [Kernel | Boot | Stopped] -> %SystemRoot%\zvwdhsjb
[Registry - All]
< Internet Explorer Settings [HKEY_CURRENT_USER\] > -> 
YN -> HKEY_CURRENT_USER\: "ProxyEnable" -> 0
< Internet Explorer Settings [HKEY_USERS\.DEFAULT\] > -> 
YN -> HKEY_USERS\.DEFAULT\: "ProxyEnable" -> 0
< Internet Explorer Settings [HKEY_USERS\S-1-5-18\] > -> 
YN -> HKEY_USERS\S-1-5-18\: "ProxyEnable" -> 0
< Internet Explorer Settings [HKEY_USERS\S-1-5-19\] > -> 
YN -> HKEY_USERS\S-1-5-19\: "ProxyEnable" -> 0
< Internet Explorer Settings [HKEY_USERS\S-1-5-20\] > -> 
YN -> HKEY_USERS\S-1-5-20\: "ProxyEnable" -> 0
< Internet Explorer Settings [HKEY_USERS\S-1-5-21-73586283-630328440-839522115-1004\] > -> 
YN -> HKEY_USERS\S-1-5-21-73586283-630328440-839522115-1004\: "ProxyEnable" -> 0
< Run [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
YN -> "08515e63" -> %SystemRoot%\system32\gijktecl.DLL [rundll32.exe "C:\WINDOWS\system32\gijktecl.dll",b]
< AppInit_DLLs [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs
*AppInit_DLLs* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls
YN -> enpfbt.dll -> 
< AppInit_DLLs [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs
[Files/Folders - Created Within 90 Days]
NY -> dxixxbvo.sys -> %SystemRoot%\System32\drivers\dxixxbvo.sys
NY -> buuwzlqm.sys -> %SystemRoot%\System32\drivers\buuwzlqm.sys
NY -> svpavisu.sys -> %SystemRoot%\System32\drivers\svpavisu.sys
NY -> wkcleauu.sys -> %SystemRoot%\System32\drivers\wkcleauu.sys
NY -> nccobtnf.sys -> %SystemRoot%\System32\drivers\nccobtnf.sys
NY -> jxvvqfmt.sys -> %SystemRoot%\System32\drivers\jxvvqfmt.sys
NY -> yiffmyhz.sys -> %SystemRoot%\System32\drivers\yiffmyhz.sys
NY -> ejxykavq.sys -> %SystemRoot%\System32\drivers\ejxykavq.sys
NY -> ijalrfxb.sys -> %SystemRoot%\System32\drivers\ijalrfxb.sys
NY -> hkshrhxm.sys -> %SystemRoot%\System32\drivers\hkshrhxm.sys
NY -> rijludss.sys -> %SystemRoot%\System32\drivers\rijludss.sys
NY -> wgegjkdv.sys -> %SystemRoot%\System32\drivers\wgegjkdv.sys
NY -> iglpisnu.sys -> %SystemRoot%\System32\drivers\iglpisnu.sys
NY -> qyddafru.sys -> %SystemRoot%\System32\drivers\qyddafru.sys
NY -> zvwdhsjb -> %SystemRoot%\zvwdhsjb
NY -> zyzfxngj.sys -> %SystemRoot%\System32\drivers\zyzfxngj.sys
NY -> kkpvejgv.sys -> %SystemRoot%\System32\drivers\kkpvejgv.sys
NY -> bifgjrga.sys -> %SystemRoot%\System32\drivers\bifgjrga.sys
NY -> qcvcfcyk.sys -> %SystemRoot%\System32\drivers\qcvcfcyk.sys
NY -> gjyakvfh.sys -> %SystemRoot%\System32\drivers\gjyakvfh.sys
NY -> tpvaqbgm.sys -> %SystemRoot%\System32\drivers\tpvaqbgm.sys
NY -> cweuagnu.sys -> %SystemRoot%\System32\drivers\cweuagnu.sys
NY -> mshlgkqm.sys -> %SystemRoot%\System32\drivers\mshlgkqm.sys
NY -> fxqzwbux.sys -> %SystemRoot%\System32\drivers\fxqzwbux.sys
NY -> phqghume.sys -> %SystemRoot%\System32\drivers\phqghume.sys
NY -> hkcxukuc.sys -> %SystemRoot%\System32\drivers\hkcxukuc.sys
NY -> yxpfduqd -> %SystemRoot%\yxpfduqd
NY -> pcyverxy.sys -> %SystemRoot%\System32\drivers\pcyverxy.sys
NY -> ehtpkavh -> %SystemRoot%\ehtpkavh
[CatchMe Rootkit Scan by GMER]
NY -> C:\WINDOWS\system32\drivers\kvmazgux.sys 25088 bytes executable -> 
[Empty Temp Folders]
[ZipFiles]
[Reboot]
```
The fix should only take a very short time. When the fix is completed a message box will popup telling you that it is finished. CLick the Ok button and Notepad will open with a log of actions taken during the fix. *Post that information back here along with a new OTScanIt scan*.

I will review the information when it comes back in.

Also let me know of any problems you encountered performing the steps above or any continuing problems you are still having with the computer.


----------



## Danndx (Jul 30, 2007)

[Driver Services - Safe List]
Service aglwtmau stopped successfully!
Service aglwtmau deleted successfully!
C:\WINDOWS\system32\drivers\dxixxbvo.sys moved successfully.
Service atksgt stopped successfully!
Service atksgt deleted successfully!
C:\WINDOWS\system32\drivers\atksgt.sys moved successfully.
Service aylnlfdx stopped successfully!
Service aylnlfdx deleted successfully!
C:\WINDOWS\system32\drivers\phqghume.sys moved successfully.
Service bsbkxcth stopped successfully!
Service bsbkxcth deleted successfully!
C:\WINDOWS\system32\drivers\gjyakvfh.sys moved successfully.
Service cffzjdzt stopped successfully!
Service cffzjdzt deleted successfully!
C:\WINDOWS\system32\drivers\mshlgkqm.sys moved successfully.
Service cjxubvxo stopped successfully!
Service cjxubvxo deleted successfully!
C:\WINDOWS\system32\drivers\jxvvqfmt.sys moved successfully.
Service dswxyjjw stopped successfully!
Service dswxyjjw deleted successfully!
C:\WINDOWS\system32\drivers\zyzfxngj.sys moved successfully.
Service E100B stopped successfully!
Service E100B deleted successfully!
C:\WINDOWS\system32\drivers\e100b325.sys moved successfully.
Unable to stop service eamon!
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\eamon deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_eamon deleted successfully.
Unable to delete service eamon!
C:\WINDOWS\system32\drivers\eamon.sys moved successfully.
Unable to stop service easdrv!
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\easdrv deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_easdrv deleted successfully.
Unable to delete service easdrv!
C:\WINDOWS\system32\drivers\easdrv.sys moved successfully.
Service ehppmcdu stopped successfully!
Service ehppmcdu deleted successfully!
C:\WINDOWS\system32\drivers\yiffmyhz.sys moved successfully.
Service ehtpkavh stopped successfully!
Service ehtpkavh deleted successfully!
C:\WINDOWS\ehtpkavh moved successfully.
Service ggcpbuky stopped successfully!
Service ggcpbuky deleted successfully!
C:\WINDOWS\system32\drivers\wgegjkdv.sys moved successfully.
Service hdxdnccu stopped successfully!
Service hdxdnccu deleted successfully!
C:\WINDOWS\system32\drivers\qyddafru.sys moved successfully.
Service jcmmfoxd stopped successfully!
Service jcmmfoxd deleted successfully!
C:\WINDOWS\system32\drivers\hkcxukuc.sys moved successfully.
Service lirsgt stopped successfully!
Service lirsgt deleted successfully!
C:\WINDOWS\system32\drivers\lirsgt.sys moved successfully.
Service mewvxeix stopped successfully!
Service mewvxeix deleted successfully!
C:\WINDOWS\system32\drivers\bifgjrga.sys moved successfully.
Service nxrkutqx stopped successfully!
Service nxrkutqx deleted successfully!
C:\WINDOWS\system32\drivers\tpvaqbgm.sys moved successfully.
Service oxnzuveo stopped successfully!
Service oxnzuveo deleted successfully!
C:\WINDOWS\system32\drivers\hkshrhxm.sys moved successfully.
Service plubbaoh stopped successfully!
Service plubbaoh deleted successfully!
C:\WINDOWS\system32\drivers\iglpisnu.sys moved successfully.
Service ptqybfpj stopped successfully!
Service ptqybfpj deleted successfully!
C:\WINDOWS\system32\drivers\ejxykavq.sys moved successfully.
Service qfvljyky stopped successfully!
Service qfvljyky deleted successfully!
C:\WINDOWS\system32\drivers\nccobtnf.sys moved successfully.
Service qmodgtfl stopped successfully!
Service qmodgtfl deleted successfully!
C:\WINDOWS\system32\drivers\cweuagnu.sys moved successfully.
Service rmjhdgeo stopped successfully!
Service rmjhdgeo deleted successfully!
C:\WINDOWS\system32\drivers\fxqzwbux.sys moved successfully.
Service rprofjen stopped successfully!
Service rprofjen deleted successfully!
C:\WINDOWS\system32\drivers\wkcleauu.sys moved successfully.
Service snfsbjjt stopped successfully!
Service snfsbjjt deleted successfully!
C:\WINDOWS\system32\drivers\buuwzlqm.sys moved successfully.
Service soplkdgh stopped successfully!
Service soplkdgh deleted successfully!
C:\WINDOWS\system32\drivers\rijludss.sys moved successfully.
Service tdghrkbh stopped successfully!
Service tdghrkbh deleted successfully!
C:\WINDOWS\system32\drivers\ijalrfxb.sys moved successfully.
Service ujbgdytz stopped successfully!
Service ujbgdytz deleted successfully!
C:\WINDOWS\system32\drivers\qcvcfcyk.sys moved successfully.
Service vtlzamym stopped successfully!
Service vtlzamym deleted successfully!
C:\WINDOWS\system32\drivers\kkpvejgv.sys moved successfully.
Service yxpfduqd stopped successfully!
Service yxpfduqd deleted successfully!
C:\WINDOWS\system32\drivers\pcyverxy.sys moved successfully.
Service zolujjud stopped successfully!
Service zolujjud deleted successfully!
C:\WINDOWS\system32\drivers\svpavisu.sys moved successfully.
Service zvwdhsjb stopped successfully!
Service zvwdhsjb deleted successfully!
C:\WINDOWS\zvwdhsjb moved successfully.
[Registry - All]
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable deleted successfully.
Registry key HKEY_USERS\EFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ not found.
Registry key HKEY_USERS\1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ not found.
Registry key HKEY_USERS\1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ not found.
Registry key HKEY_USERS\1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ not found.
Registry key HKEY_USERS\1-5-21-73586283-630328440-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\08515e63 deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:enpfbt.dll deleted successfully.
[Files/Folders - Created Within 90 Days]
File C:\WINDOWS\System32\drivers\dxixxbvo.sys not found!
File C:\WINDOWS\System32\drivers\buuwzlqm.sys not found!
File C:\WINDOWS\System32\drivers\svpavisu.sys not found!
File C:\WINDOWS\System32\drivers\wkcleauu.sys not found!
File C:\WINDOWS\System32\drivers\nccobtnf.sys not found!
File C:\WINDOWS\System32\drivers\jxvvqfmt.sys not found!
File C:\WINDOWS\System32\drivers\yiffmyhz.sys not found!
File C:\WINDOWS\System32\drivers\ejxykavq.sys not found!
File C:\WINDOWS\System32\drivers\ijalrfxb.sys not found!
File C:\WINDOWS\System32\drivers\hkshrhxm.sys not found!
File C:\WINDOWS\System32\drivers\rijludss.sys not found!
File C:\WINDOWS\System32\drivers\wgegjkdv.sys not found!
File C:\WINDOWS\System32\drivers\iglpisnu.sys not found!
File C:\WINDOWS\System32\drivers\qyddafru.sys not found!
File C:\WINDOWS\zvwdhsjb not found!
File C:\WINDOWS\System32\drivers\zyzfxngj.sys not found!
File C:\WINDOWS\System32\drivers\kkpvejgv.sys not found!
File C:\WINDOWS\System32\drivers\bifgjrga.sys not found!
File C:\WINDOWS\System32\drivers\qcvcfcyk.sys not found!
File C:\WINDOWS\System32\drivers\gjyakvfh.sys not found!
File C:\WINDOWS\System32\drivers\tpvaqbgm.sys not found!
File C:\WINDOWS\System32\drivers\cweuagnu.sys not found!
File C:\WINDOWS\System32\drivers\mshlgkqm.sys not found!
File C:\WINDOWS\System32\drivers\fxqzwbux.sys not found!
File C:\WINDOWS\System32\drivers\phqghume.sys not found!
File C:\WINDOWS\System32\drivers\hkcxukuc.sys not found!
C:\WINDOWS\yxpfduqd moved successfully.
File C:\WINDOWS\System32\drivers\pcyverxy.sys not found!
File C:\WINDOWS\ehtpkavh not found!
[Empty Temp Folders]
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_1c0.dat scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_ac.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
FireFox cache emptied.
RecycleBin -> emptied.
< End of fix log >
OTScanIt2 by OldTimer - Version 1.0.6.2 fix logfile created on 01242009_193613

Files moved on Reboot...
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.
File C:\WINDOWS\temp\Perflib_Perfdata_1c0.dat not found!
File C:\WINDOWS\temp\Perflib_Perfdata_ac.dat not found!

Registry entries deleted on Reboot...

--------------------

The Popups have stopped completely, but the 2 rundll32's remain and when i attempted to end those processes, i get a series of error messages popup saying alot of background programs have need to close/have errors

Also the real time scanner on eset security has changed status to Malfunctioning after that fix

Thx


----------



## dvk01 (Dec 14, 2002)

post a new HJT log please


----------



## Danndx (Jul 30, 2007)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:47:24 PM, on 25/01/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\ASUS\Ai Suite\AiNap\AiNap.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\ASUS\Ai Suite\AiGear3\CpuPowerMonitor.exe
C:\Program Files\ASUS\Ai Suite\CpuLevelUpHelp.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\ASUS\AI Direct Link\AsShare.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\btbb_wcm\McciTrayApp.exe
C:\Program Files\BT Broadband Desktop Help\bin\BTHelpNotifier.exe
C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Analog Devices\SoundMAX\smax4.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://uk.red.clientapps.yahoo.com/...b/*http://uk.docs.yahoo.com/info/bt_side.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/su/*http://uk.search.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Ai Nap] "C:\Program Files\ASUS\Ai Suite\AiNap\AiNap.exe"
O4 - HKLM\..\Run: [CPU Power Monitor] "C:\Program Files\ASUS\Ai Suite\AiGear3\CpuPowerMonitor.exe"
O4 - HKLM\..\Run: [Cpu Level Up help] C:\Program Files\ASUS\Ai Suite\CpuLevelUpHelp.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [Launch Direct Link] "C:\Program Files\ASUS\AI Direct Link\AsShare.exe"
O4 - HKLM\..\Run: [Launch As Cmd Runner] "C:\Program Files\ASUS\AI Direct Link\AsCmd.exe" -reg
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [btbb_wcm_McciTrayApp] C:\Program Files\btbb_wcm\McciTrayApp.exe
O4 - HKLM\..\Run: [btbb_McciTrayApp] C:\Program Files\BT Broadband Desktop Help\bin\BTHelpNotifier.exe
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Flashget] C:\Program Files\FlashGet\flashget.exe /min
O4 - HKLM\..\Run: [4oD] "C:\Program Files\Kontiki\KHost.exe" -all
O4 - HKLM\..\Run: [SoundMax] "C:\Program Files\Analog Devices\SoundMAX\smax4.exe" /tray
O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe -all
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: BT Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {4A116A80-85B6-4299-A018-A717FD7AC66A} (AXIDMDCP Class) - http://m1.cdn.gaiaonline.com/plugins/IDMFlash.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-GB/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1194970902234
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe
O23 - Service: RaySat_3dsmax8 Server (mi-raysat_3dsmax8) - Unknown owner - C:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe
O23 - Service: mysql - Unknown owner - C:\xampplite\mysql\bin\mysqld-nt.exe
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe (file missing)
O24 - Desktop Component 0: (no name) - http://ponddeck.com/abstract/blue_sky_complex.jpg
O24 - Desktop Component 1: (no name) - C:\Documents and Settings\DanneH\My Documents\My Pictures\Wallpapers\Saturn_Planet_3200_x_1200_Dual_Monitor.jpg
O24 - Desktop Component 2: (no name) - C:\Documents and Settings\DanneH\My Documents\My Pictures\Wallpapers\Winter_Dream_2560_x_1024_Dual_Monitor.jpg
O24 - Desktop Component 3: (no name) - C:\Documents and Settings\DanneH\My Documents\My Pictures\Wallpapers\Nigh_in_the_city_2560_x_1024_Dual_Monitor.jpg
O24 - Desktop Component 4: (no name) - (no file)

--
End of file - 12460 bytes


----------



## dvk01 (Dec 14, 2002)

That all looks clear now

how is it 

are there any more problems


----------



## Danndx (Jul 30, 2007)

yeah its all running perfectly now, thanks for all your help, much appreciated


----------



## dvk01 (Dec 14, 2002)

*Follow these steps to uninstall Combofix and the other tools it downloaded to remove the malware*
* Click *START* then *RUN*
* Now type *Combofix /u* in the runbox and click *OK*. Note the *space* between the *X* and the *U*, it needs to be there.









then 
Turn off system restore by following instructions here 
for XP http://www.thespykiller.co.uk/index.php?page=8
or for Vista http://www.bleepingcomputer.com/tutorials/tutorial143.html

That will purge the restore folder and clear any malware that has been put in there. Then reboot & then re-enable system restore & create a new restore point. Now Empty Recycle bin on desktop

go here* http://www.thespykiller.co.uk/index.php?page=3 *for info on how to tighten your security settings and how to help prevent future attacks.

and scan here* http://secunia.com/software_inspector/ * for out of date & vulnerable common applications on your computer

Then pay an urgent visit to windows update & make sure you are fully updated, that will help to plug the security holes that let these pests on in the first place


----------

