Spyware problem

  1. 09-03-2008  #1
    TSilk
    TSilk is offline Junior Member

    Spyware problem

    The past week or so my HD space has been eaten up by some form of spyware. I went from having multiple GB of space left to only a few Kb and whenever i try to resolve it through windows it only frees up a few MB. Can anyone help me with this problem?


    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 10:24:36 AM, on 3/9/2008
    Platform: Windows Vista (WinNT 6.00.1904)
    MSIE: Internet Explorer v7.00 (7.00.6000.16609)
    Boot mode: Normal

    Running processes:
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\Elantech\Ktp.exe
    C:\Windows\vsnp2uvc.exe
    C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
    C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe
    C:\Program Files\Compal\Wireless Select Switch\WLSS.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Symantec AntiVirus\VPTray.exe
    C:\Program Files\Protector Suite QL\psqltray.exe
    C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Windows\ehome\ehtray.exe
    C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
    C:\Windows\ehome\ehmsas.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Program Files\Java\jre1.6.0_03\bin\jucheck.exe
    C:\Program Files\uTorrent\uTorrent.exe
    C:\Program Files\AIM6\aim6.exe
    C:\Program Files\AIM6\aolsoftware.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    O1 - Hosts: ::1 localhost
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    O4 - HKLM\..\Run: [KTPWare] C:\Program Files\Elantech\ktp.exe
    O4 - HKLM\..\Run: [snp2uvc] C:\Windows\vsnp2uvc.exe
    O4 - HKLM\..\Run: [PSQLLauncher] "C:\Program Files\Protector Suite QL\launcher.exe" /startup
    O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
    O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [WLSS] C:\Program Files\Compal\Wireless Select Switch\WLSS.exe
    O4 - HKLM\..\Run: [Smart Watch Dog] -C:\Program Files\Compal Electronics, INC\Smart Watchdog\SmartWD.exe
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
    O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
    O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
    O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe (file missing)
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe (file missing)
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O13 - Gopher Prefix:
    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
    O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
    O23 - Service: Smart Watchdog Service (Smart Watchdog) - Unknown owner - C:\Program Files\Compal Electronics, INC\Smart Watchdog\SWDsvc.exe
    O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

    --
    End of file - 7483 bytes

  3. 11-03-2008  #2
    Neal
    Neal is offline Dedicated Member
    Welcome,


    Open Hijackthis.

    Click the "Open the Misc Tools" section Button.

    Click the "Open Uninstall Manager" Button.

    Click the "Save list..." Button.

    Save it to your desktop. Copy and paste the contents into your reply.




    * Please download Malwarebytes' Anti-Malware from HERE or HERE

    Double Click mbam-setup.exe to install the application.

    * Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and zLaunch Malwarebytes Anti-Malware, then click Finish.
    * If an update is found, it will download and install the latest version.
    * Once the program has loaded, select "Perform Quick Scan", then click Scan.
    * The scan may take some time to finish,so please be patient.
    * When the scan is complete, click OK, then Show Results to view the results.
    * Make sure that everything is checked, and click Remove Selected.
    * When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
    * The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
    * Copy&Paste the entire report in your next reply along with a fresh HijackThis log.


    Extra Note:
    If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.
  4. 15-03-2008  #3
    TSilk
    TSilk is offline Junior Member
    Malwarebytes' Anti-Malware 1.08
    Database version: 483

    Scan type: Quick Scan
    Objects scanned: 28166
    Time elapsed: 6 minute(s), 40 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 7:12:24 PM, on 3/14/2008
    Platform: Windows Vista (WinNT 6.00.1904)
    MSIE: Internet Explorer v7.00 (7.00.6000.16609)
    Boot mode: Normal

    Running processes:
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\Elantech\Ktp.exe
    C:\Windows\vsnp2uvc.exe
    C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
    C:\Windows\System32\rundll32.exe
    C:\Program Files\Compal\Wireless Select Switch\WLSS.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Windows\System32\rundll32.exe
    C:\Program Files\Symantec AntiVirus\VPTray.exe
    C:\Program Files\Protector Suite QL\psqltray.exe
    C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Windows\ehome\ehtray.exe
    C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
    C:\Windows\ehome\ehmsas.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Java\jre1.6.0_03\bin\jucheck.exe
    C:\Program Files\AIM6\aim6.exe
    C:\Program Files\AIM6\aolsoftware.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    O1 - Hosts: ::1 localhost
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    O4 - HKLM\..\Run: [KTPWare] C:\Program Files\Elantech\ktp.exe
    O4 - HKLM\..\Run: [snp2uvc] C:\Windows\vsnp2uvc.exe
    O4 - HKLM\..\Run: [PSQLLauncher] "C:\Program Files\Protector Suite QL\launcher.exe" /startup
    O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
    O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [WLSS] C:\Program Files\Compal\Wireless Select Switch\WLSS.exe
    O4 - HKLM\..\Run: [Smart Watch Dog] -C:\Program Files\Compal Electronics, INC\Smart Watchdog\SmartWD.exe
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
    O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
    O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
    O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe (file missing)
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe (file missing)
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O13 - Gopher Prefix:
    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
    O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
    O23 - Service: Smart Watchdog Service (Smart Watchdog) - Unknown owner - C:\Program Files\Compal Electronics, INC\Smart Watchdog\SWDsvc.exe
    O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

    --
    End of file - 7401 bytes

    Also when I load up there are a list of trojans that say quarantined, there all .tmp files if that helps and sometimes it quarantines a file called catchme.exe
  5. 15-03-2008  #4
    Neal
    Neal is offline Dedicated Member
    Neal requested
    Open Hijackthis.

    Click the "Open the Misc Tools" section Button.

    Click the "Open Uninstall Manager" Button.

    Click the "Save list..." Button.

    Save it to your desktop. Copy and paste the contents into your reply.

    You can uninstall MBAM scanner


    Perform in this order please:


    Please download ATF Cleaner by Atribune to desktop.
    ATF CLEANER

    Double-click ATF-Cleaner.exe to run the program.

    If you would like to keep your cookies don't check that item

    * Under Main "Select Files to Delete" choose: Select All.
    * Click the Empty Selected button.
    * If you use Firefox browser click Firefox at the top and choose: Select All
    * Click the Empty Selected button.
    NOTE: If you would like to keep your saved passwords, please click No at the prompt.
    * If you use Opera browser click Opera at the top and choose: Select All
    * Click the Empty Selected button.
    NOTE: If you would like to keep your saved passwords, please click No at the prompt.

    Click Exit on the Main menu to close the program.



    If you have previously downloaded ComboFix,please delete that version now.

    Now download ComboFix and save to your desktop:

    Note:

    It is IMPORTANT that it is saved directly to your desktop

    Close any open browsers.

    Disconnect from the Internet.

    Please do not re-connect your machine back to the Internet until Combofix has completely finished.

    Disable your antivirus program and any realtime malware scanners now


    How To Disable



    Double click on combofix.exe and follow the prompts.

    When it's finished it will produce a log.
    Post the entire contents of C:\ComboFix.txt into your next reply.

    Note:
    Do not mouseclick combofix's window while it's running.

    That may cause the program to freeze/hang.

    Do NOT post the ComboFix-quarantined-files.txt unless I ask.

    Re-enable your anti-virus and re-connect back to the internet and post the combofix log.



    *Note*
    In case your Antivirus or any other realtime scanner is displaying an alert after you downloaded Combofix or while you use Combofix,please disable your scanner and redownload Combofix again.
    Some scanners may see some combofix related components as suspicious and block or delete them while there's nothing wrong with them.

    ComboFix SHOULD NOT be used unless requested by a forum helper.


    New hijackthis log please.
  6. 15-03-2008  #5
    TSilk
    TSilk is offline Junior Member
    ComboFix 08-03-14.4 - Turner 2008-03-14 2033.2 - NTFSx86
    Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1033.18.1311 [GMT -4:00]
    Running from: C:\Users\Turner\Desktop\ComboFix.exe
    .

    ((((((((((((((((((((((((( Files Created from 2008-02-15 to 2008-03-15 )))))))))))))))))))))))))))))))
    .

    No new files created in this timespan

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
    .
    2008-03-15 00:05 16,464 ----a-w C:\Users\Turner\AppData\Roaming\nvModes.dat
    2008-03-15 00:02 --------- d-----w C:\Users\Turner\AppData\Roaming\uTorrent
    2008-03-13 07:41 --------- d-----w C:\Users\Turner\AppData\Roaming\Malwarebytes
    2008-03-13 07:41 --------- d-----w C:\ProgramData\Malwarebytes
    2008-03-12 15:06 --------- d-----w C:\Users\Turner\AppData\Roaming\Download Manager
    2008-03-04 12:22 --------- d-----w C:\Users\Turner\AppData\Roaming\Skype
    2008-03-03 02:55 --------- d-----w C:\Program Files\iTunes
    2008-03-03 02:55 --------- d-----w C:\Program Files\iPod
    2008-02-27 16:54 22,328 ----a-w C:\Windows\system32\drivers\PnkBstrK.sys
    2008-02-27 16:54 107,832 ----a-w C:\Windows\System32\PnkBstrB.exe
    2008-02-13 18:55 194,560 ----a-w C:\Windows\System32\WebClnt.dll
    2008-02-13 18:55 110,080 ----a-w C:\Windows\system32\drivers\mrxdav.sys
    2008-02-13 18:52 803,328 ----a-w C:\Windows\system32\drivers\tcpip.sys
    2008-02-13 18:52 24,064 ----a-w C:\Windows\System32\netcfg.exe
    2008-02-13 18:52 22,016 ----a-w C:\Windows\System32\netiougc.exe
    2008-02-13 18:52 216,632 ----a-w C:\Windows\system32\drivers\netio.sys
    2008-02-13 18:52 167,424 ----a-w C:\Windows\System32\tcpipcfg.dll
    2008-02-13 18:52 --------- d-----w C:\ProgramData\Microsoft Help
    2008-02-13 18:50 824,832 ----a-w C:\Windows\System32\wininet.dll
    2008-02-13 18:50 56,320 ----a-w C:\Windows\System32\iesetup.dll
    2008-02-13 18:50 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
    2008-02-13 18:50 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
    2008-02-13 03:58 --------- d-----w C:\Program Files\QuickTime
    2008-02-11 19:09 --------- d-----w C:\Program Files\Michael K. Weise
    2008-02-04 04:12 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-01-09 08:01 11,776 ----a-w C:\Windows\System32\sbunattend.exe
    2007-11-21 00:13 22,328 ----a-w C:\Users\Turner\AppData\Roaming\PnkBstrK.sys
    2007-09-12 13:51 174 --sha-w C:\Program Files\desktop.ini
    2007-08-23 17:21 16,384 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\ Local\Microsoft\Windows\History\History.IE5\index. dat
    2007-08-23 17:21 32,768 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\ Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    2007-08-23 17:21 16,384 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\ Roaming\Microsoft\Windows\Cookies\index.dat
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\explorer\shelliconoverlayidentifiers\UE AFOverlay]
    @={F2F31467-B1AC-4df0-AE79-FD5FA085E22B}

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\explorer\shelliconoverlayidentifiers\UE AFOverlayOpen]
    @={A3E208F7-0E3A-4182-A7A6-B169D5D691AA}

    [HKEY_CLASSES_ROOT\CLSID\{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}]
    2007-03-28 22:59 2953216 --a------ C:\Program Files\Protector Suite QL\farchns.dll

    [HKEY_CLASSES_ROOT\CLSID\{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}]
    2007-03-28 22:59 2953216 --a------ C:\Program Files\Protector Suite QL\farchns.dll

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
    "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-09 04:01 1232896]
    "Aim6"="" []
    "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 08:36 201728]
    "ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 08:35 125440]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
    "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-08-15 15:40 1006264]
    "KTPWare"="C:\Program Files\Elantech\ktp.exe" [2007-01-05 17:07 516096]
    "snp2uvc"="C:\Windows\vsnp2uvc.exe" [2006-12-29 14:48 569344]
    "PSQLLauncher"="C:\Program Files\Protector Suite QL\launcher.exe" [2007-03-28 22:23 49168]
    "SMSERIAL"="C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe" [2006-11-22 20:31 630784]
    "NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-04-04 22:41 86016]
    "NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-04-04 22:41 8429568]
    "NvMediaCenter"="C:\Windows\system32\NvMcTray. dll" [2007-04-04 22:41 81920]
    "WLSS"="C:\Program Files\Compal\Wireless Select Switch\WLSS.exe" [2007-04-23 21:55 190000]
    "Smart Watch Dog"="-C:\Program Files\Compal Electronics" [ ]
    "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 20:51 39792]
    "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-11-22 17:12 107112]
    "vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2006-11-28 06:34 134808]
    "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 02:11 132496]
    "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-02-01 00:13 385024]
    "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 14:10 267048]

    C:\Users\Turner\AppData\Roaming\Microsoft\Windows\ Start Menu\Programs\Startup\
    OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 20:24:54 98632]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\policies\system]
    "EnableLUA"= 0 (0x0)
    "DisableCAD"= 1 (0x1)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]
    C:\Windows\system32\psqlpwd.dll 2007-03-28 22:46 90112 C:\Windows\System32\psqlpwd.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpo licy\FirewallRules]
    "{876ECBE6-CD17-421F-996E-05A039994E93}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
    "{7CE22032-20FD-454C-B5F1-668797FBED11}"= UDP:C:\Program Files\Common Files\AOL\Loader\aolload.exe:AOL Loader
    "{78A27508-00D1-4AF5-9915-8A86E239B4C5}"= TCP:C:\Program Files\Common Files\AOL\Loader\aolload.exe:AOL Loader
    "TCP Query User{5B4C5C88-32CD-4044-A9A0-6D452F13B51B}C:\\program files\\steam\\steamapps\\darkstarsilk\\counter-strike source\\hl2.exe"= UDP:C:\program files\steam\steamapps\darkstarsilk\counter-strike source\hl2.exe:hl2
    "UDP Query User{DDF45C72-9788-4F47-809A-972509C0791C}C:\\program files\\steam\\steamapps\\darkstarsilk\\counter-strike source\\hl2.exe"= TCP:C:\program files\steam\steamapps\darkstarsilk\counter-strike source\hl2.exe:hl2
    "{FA4FDCA5-84A7-4148-ABF3-A5448A880E86}"= UDP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent
    "{CD264FB2-C892-4ADF-9902-6BB65146EB63}"= TCP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent
    "{E3FB1593-4010-4E52-8C98-26A78B810C64}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
    "{AA48234D-A654-4C01-927A-84B060FD3301}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
    "TCP Query User{0DD877BD-DC70-4E1B-A91E-D193453B04BC}C:\\program files\\america's army\\system\\armyops.exe"= UDP:C:\program files\america's army\system\armyops.exe:ArmyOps
    "UDP Query User{D708DFF9-B000-4657-BBCA-679DDADF86B9}C:\\program files\\america's army\\system\\armyops.exe"= TCP:C:\program files\america's army\system\armyops.exe:ArmyOps
    "TCP Query User{630D90F9-7738-4A73-8BC4-03E04262E2AE}C:\\program files\\aim6\\aim6.exe"= UDP:C:\program files\aim6\aim6.exe:AIM
    "UDP Query User{59844B46-B8BA-4632-BA14-ECA2EC1BC15E}C:\\program files\\aim6\\aim6.exe"= TCP:C:\program files\aim6\aim6.exe:AIM
    "TCP Query User{E5599755-3F2D-4A74-9B45-BE04890F9E41}C:\\program files\\utorrent\\utorrent.exe"= UDP:C:\program files\utorrent\utorrent.exe:uTorrent
    "UDP Query User{84541490-6EF6-4A5E-88F5-9896B1A8D64E}C:\\program files\\utorrent\\utorrent.exe"= TCP:C:\program files\utorrent\utorrent.exe:uTorrent
    "{95D647E9-4BB0-4A4F-90D1-3423CF44933F}"= UDP:F:\Program Files\BF2.exe:Battlefield 2
    "{56B0F1CD-0F57-4222-B6B3-1907379823CB}"= TCP:F:\Program Files\BF2.exe:Battlefield 2
    "TCP Query User{82AE1BB8-66E9-4558-AA35-49E390684B45}F:\\battlefield 2\\bf2.exe"= UDP:F:\battlefield 2\bf2.exe:BF2
    "UDP Query User{82A99710-EF72-45DF-BB6E-B6469C332579}F:\\battlefield 2\\bf2.exe"= TCP:F:\battlefield 2\bf2.exe:BF2
    "TCP Query User{61319512-50BE-4883-85B1-C51AC17458E3}C:\\program files\\steam\\steamapps\\darkstarsilk\\day of defeat source\\hl2.exe"= UDP:C:\program files\steam\steamapps\darkstarsilk\day of defeat source\hl2.exe:hl2
    "UDP Query User{6C1D38D7-AB3E-4E6B-A914-B87D4A157BD9}C:\\program files\\steam\\steamapps\\darkstarsilk\\day of defeat source\\hl2.exe"= TCP:C:\program files\steam\steamapps\darkstarsilk\day of defeat source\hl2.exe:hl2
    "TCP Query User{03B6A715-7A52-42C5-B432-69A2869B9A44}C:\\program files\\steam\\steamapps\\darkstarsilk\\half-life 2 deathmatch\\hl2.exe"= UDP:C:\program files\steam\steamapps\darkstarsilk\half-life 2 deathmatch\hl2.exe:hl2
    "UDP Query User{785A23DB-F1C6-43CC-8C82-C4A016753D71}C:\\program files\\steam\\steamapps\\darkstarsilk\\half-life 2 deathmatch\\hl2.exe"= TCP:C:\program files\steam\steamapps\darkstarsilk\half-life 2 deathmatch\hl2.exe:hl2
    "{92A3F0F0-A91C-4F11-B3B0-86F8DEC26F54}"= UDP:C:\Program Files\Symantec AntiVirus\Rtvscan.exe:Symantec Antivirus
    "{5195E153-9F61-440F-8C3A-96313589FA51}"= TCP:C:\Program Files\Symantec AntiVirus\Rtvscan.exe:Symantec Antivirus
    "{B4822211-9BD0-4E97-B88B-15CCD6B396BB}"= UDP:C:\Program Files\Common Files\Symantec Shared\ccApp.exe:Symantec Email
    "{9C616B7C-5DB8-4A4D-9AAD-99CFEBC9CA6B}"= TCP:C:\Program Files\Common Files\Symantec Shared\ccApp.exe:Symantec Email
    "TCP Query User{162B3E2A-3B96-4DE3-B94C-6FD60E5732A0}C:\\program files\\aim6\\aim6.exe"= UDP:C:\program files\aim6\aim6.exe:AIM
    "UDP Query User{28DE7874-4478-48AD-B289-56E73D564D05}C:\\program files\\aim6\\aim6.exe"= TCP:C:\program files\aim6\aim6.exe:AIM
    "TCP Query User{E2837D67-00ED-48C1-9AB3-FD158A5F61B1}C:\\program files\\steam\\steamapps\\darkstarsilk\\day of defeat source\\hl2.exe"= UDP:C:\program files\steam\steamapps\darkstarsilk\day of defeat source\hl2.exe:hl2
    "UDP Query User{F7A523F1-7E9D-471C-9594-9EC10ADFABC0}C:\\program files\\steam\\steamapps\\darkstarsilk\\day of defeat source\\hl2.exe"= TCP:C:\program files\steam\steamapps\darkstarsilk\day of defeat source\hl2.exe:hl2
    "{9BAE928D-F0F0-4A40-A7D6-A476144C3EF9}"= UDP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
    "{C22E904C-DB6A-4F68-A02A-CC22A8E534A0}"= TCP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
    "{BFD2AE02-B693-4DE4-B389-CF753240FCC4}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
    "{AFD9AEF9-AE66-4C6A-841D-D24C2D338DB5}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
    "TCP Query User{901FC811-87BA-4214-AD2B-0D3072956AFB}C:\\program files\\mozilla firefox\\firefox.exe"= UDP:C:\program files\mozilla firefox\firefox.exe:Firefox
    "UDP Query User{2A0B106B-0EB4-4DD0-AC28-0F230DF13D69}C:\\program files\\mozilla firefox\\firefox.exe"= TCP:C:\program files\mozilla firefox\firefox.exe:Firefox
    "TCP Query User{F08FC16E-8922-49CB-AF59-0A7F658CB01B}C:\\program files\\steam\\steamapps\\darkstarsilk\\counter-strike source\\hl2.exe"= UDP:C:\program files\steam\steamapps\darkstarsilk\counter-strike source\hl2.exe:hl2
    "UDP Query User{66604610-C715-4FF7-9FB1-EFBF941D0AA7}C:\\program files\\steam\\steamapps\\darkstarsilk\\counter-strike source\\hl2.exe"= TCP:C:\program files\steam\steamapps\darkstarsilk\counter-strike source\hl2.exe:hl2
    "TCP Query User{25B6F8F1-3811-434B-97AF-EF75DC89E9F6}C:\\program files\\steam\\steam.exe"= UDP:C:\program files\steam\steam.exe:Steam
    "UDP Query User{5D3E7BAE-29C5-4A2F-9F3A-F1925776D228}C:\\program files\\steam\\steam.exe"= TCP:C:\program files\steam\steam.exe:Steam
    "TCP Query User{F5879BF2-CFED-44FC-BD3F-13053C48A4C4}F:\\steam\\steam.exe"= UDP:F:\steam\steam.exe:Steam
    "UDP Query User{CE9C8D0F-E9B7-4EFF-9164-0F74E15D65C8}F:\\steam\\steam.exe"= TCP:F:\steam\steam.exe:Steam
    "TCP Query User{242D1B99-A7BA-4B93-AE11-BB4CFEFC3F87}F:\\steam\\steam.exe"= UDP:F:\steam\steam.exe:Steam
    "UDP Query User{F7259878-678A-4500-A8CA-D0F4C170170C}F:\\steam\\steam.exe"= TCP:F:\steam\steam.exe:Steam
    "TCP Query User{554A025A-9F0E-4F55-81A0-A9ED5C44F604}F:\\steam\\steamapps\\darkstarsilk\\t eam fortress 2\\hl2.exe"= UDP:F:\steam\steamapps\darkstarsilk\team fortress 2\hl2.exe:hl2
    "UDP Query User{E4990D02-083D-4870-AB6D-BC0512498505}F:\\steam\\steamapps\\darkstarsilk\\t eam fortress 2\\hl2.exe"= TCP:F:\steam\steamapps\darkstarsilk\team fortress 2\hl2.exe:hl2
    "TCP Query User{70FFABC1-17B6-41D5-857A-89A4C78824B3}F:\\steam\\steamapps\\darkstarsilk\\t eam fortress 2\\hl2.exe"= UDP:F:\steam\steamapps\darkstarsilk\team fortress 2\hl2.exe:hl2
    "UDP Query User{9AD8E1EE-4FF3-4D55-B708-7D5444054CB0}F:\\steam\\steamapps\\darkstarsilk\\t eam fortress 2\\hl2.exe"= TCP:F:\steam\steamapps\darkstarsilk\team fortress 2\hl2.exe:hl2
    "{6B35E123-DAD6-41A3-AD78-1464B944F52F}"= UDP:C:\Windows\System32\PnkBstrA.exe:PnkBstrA
    "{AA2FFFC5-224D-40CA-8E7F-40B5DC0BB0AC}"= TCP:C:\Windows\System32\PnkBstrA.exe:PnkBstrA
    "{9487EE11-28FF-4C08-A261-1F255929683F}"= UDP:C:\Windows\System32\PnkBstrB.exe:PnkBstrB
    "{C378B00D-7E84-4B49-9A0B-8B78D1B5784F}"= TCP:C:\Windows\System32\PnkBstrB.exe:PnkBstrB
    "{64EB28A2-51C5-43A7-8F8F-1C978AF3050D}"= UDP:C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
    "{1C4F251D-C7E5-49C5-BC30-91537D56086B}"= TCP:C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
    "{40BA820F-D9B6-46C2-82CC-E3DF6C7862E9}"= Disabled:UDP:C:\Program Files\Skype\Phone\Skype.exe:Skype
    "{3AB05D77-BA2B-4EF9-BCBD-0E2C92F6A6C5}"= Disabled:TCP:C:\Program Files\Skype\Phone\Skype.exe:Skype
    "{37B91610-05E8-48DB-895D-4903B1C5D121}"= UDP:C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
    "{29E5F8E3-87E5-4F28-A412-D374F1459B92}"= TCP:C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
    "{61ABD372-6056-4741-A87D-2EC35C9991DD}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
    "{388B2627-55A9-46EC-B5F1-6A68DDA9AE72}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
    "{41B31C2E-C665-4488-BC9E-1AE45C3AF8E4}"= Disabled:UDP:C:\Program Files\Skype\Phone\Skype.exe:Skype
    "{9E91CD50-6EAE-4B1F-AC94-7D879FE1253F}"= Disabled:TCP:C:\Program Files\Skype\Phone\Skype.exe:Skype

    [HKLM\~\services\sharedaccess\parameters\firewallpo licy\RestrictedServices\Static\System]
    "DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|S vc=DFSR:Allow inbound TCP traffic|

    R0 EMSC;COMPAL Embedded System Control;C:\Windows\system32\DRIVERS\EMSC.SYS [2007-02-13 13:29]
    R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;C:\Windows\system32\DRIVERS\b57nd60x.sys [2006-11-02 03:30]
    R3 CamFilter;CamFilter;C:\Windows\system32\Drivers\Ca mFilter.sys [2007-05-11 18:56]
    R3 enecir;ENE CIR Receiver;C:\Windows\system32\DRIVERS\enecir.sys [2007-04-25 15:50]
    R3 Ktp;Elantech Touchpad;C:\Windows\system32\DRIVERS\Ktp.sys [2006-11-17 20:55]

    .
    Contents of the 'Scheduled Tasks' folder
    "2008-03-15 00:50:00 C:\Windows\Tasks\User_Feed_Synchronization-{420FB75D-FC9E-4349-8FC2-4F0688C7128B}.job"
    - C:\Windows\system32\msfeedssync.exe
    .
    ************************************************** ************************

    catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-03-14 2058
    Windows 6.0.6000 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    ************************************************** ************************
    .
    ------------------------ Other Running Processes ------------------------
    .
    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\Program Files\Protector Suite QL\upeksvr.exe
    C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe
    C:\Program Files\Symantec AntiVirus\VPTray.exe
    C:\Program Files\Protector Suite QL\psqltray.exe
    C:\Windows\ehome\ehmsas.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Symantec AntiVirus\DefWatch.exe
    C:\Windows\system32\PnkBstrA.exe
    C:\Program Files\Symantec AntiVirus\SavRoam.exe
    C:\Program Files\Compal Electronics, INC\Smart Watchdog\SWDsvc.exe
    C:\Program Files\Symantec AntiVirus\Rtvscan.exe
    C:\Program Files\iPod\bin\iPodService.exe
    .
    ************************************************** ************************
    .
    Completion time: 2008-03-14 20:59:11 - machine was rebooted
    .
    2008-03-14 07:01:08 --- E O F ---

    2007 Microsoft Office system
    Ad-Aware 2007
    Adobe Reader 8.1.1
    Adobe Shockwave Player
    AIM 6
    Apple Mobile Device Support
    Apple Software Update
    Call of Duty(R) 4 - Modern Warfare(TM)
    Call of Duty(R) 4 - Modern Warfare(TM) 1.2 Patch
    Call of Duty(R) 4 - Modern Warfare(TM) 1.3 Patch
    Call of Duty(R) 4 - Modern Warfare(TM) 1.4 Patch
    Call of Duty(R) 4 - Modern Warfare(TM) 1.5 Multiplayer Patch
    Canon MP600
    DivX Content Uploader
    DivX Web Player
    HijackThis 2.0.2
    iTunes
    Java(TM) 6 Update 3
    KTP Ware PS/2-x86 5.0.3.13
    LiveUpdate 3.2 (Symantec Corporation)
    Microsoft Office Access MUI (English) 2007
    Microsoft Office Access Setup Metadata MUI (English) 2007
    Microsoft Office Excel MUI (English) 2007
    Microsoft Office Groove MUI (English) 2007
    Microsoft Office Groove Setup Metadata MUI (English) 2007
    Microsoft Office InfoPath MUI (English) 2007
    Microsoft Office OneNote MUI (English) 2007
    Microsoft Office Outlook MUI (English) 2007
    Microsoft Office PowerPoint MUI (English) 2007
    Microsoft Office Professional Hybrid 2007
    Microsoft Office Proof (English) 2007
    Microsoft Office Proof (French) 2007
    Microsoft Office Proof (Spanish) 2007
    Microsoft Office Proofing (English) 2007
    Microsoft Office Publisher MUI (English) 2007
    Microsoft Office Shared MUI (English) 2007
    Microsoft Office Shared Setup Metadata MUI (English) 2007
    Microsoft Office Ultimate 2007
    Microsoft Office Ultimate 2007
    Microsoft Office Word MUI (English) 2007
    Microsoft Visual C++ 2005 Redistributable
    mkw Audio Compression Toolkit
    Motorola SM56 Data Fax Modem
    Mozilla Firefox (2.0.0.12)
    NVIDIA Drivers
    Power Tab Editor 1.7
    Protector Suite QL 5.6
    QuickTime
    RICOH R5C83x/84x Flash Media Controller Driver Ver.3.51.01
    Security Update for CAPICOM (KB931906)
    Security Update for CAPICOM (KB931906)
    Security Update for Excel 2007 (KB936509)
    Security Update for Excel 2007 (KB936509)
    Security Update for Office 2007 (KB934062)
    Security Update for Office 2007 (KB934062)
    Security Update for Office 2007 (KB936514)
    Security Update for Office 2007 (KB936514)
    Security Update for Publisher 2007 (KB936646)
    Security Update for Publisher 2007 (KB936646)
    Security Update for the 2007 Microsoft Office System (KB936960)
    Security Update for the 2007 Microsoft Office System (KB936960)
    Skype™ 3.5
    Smart Watchdog
    Switch
    Symantec AntiVirus
    System Requirements Lab
    Update for Office 2007 (KB932080)
    Update for Office 2007 (KB932080)
    Update for Office 2007 (KB934391)
    Update for Office 2007 (KB934391)
    Update for Office 2007 (KB934393)
    Update for Office 2007 (KB934393)
    Update for Outlook 2007 (KB937608)
    Update for Outlook 2007 (KB937608)
    Update for Outlook 2007 Junk Email Filter (kb944965)
    Update for Outlook 2007 Junk Email Filter (kb944965)
    Update for Word 2007 (KB934173)
    Update for Word 2007 (KB934173)
    USB Video Device
    Ventrilo Client
    Viewpoint Media Player
    Windows Media Player Firefox Plugin
    Wireless Select Switch

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 9:35:28 PM, on 3/14/2008
    Platform: Windows Vista (WinNT 6.00.1904)
    MSIE: Internet Explorer v7.00 (7.00.6000.16609)
    Boot mode: Normal

    Running processes:
    C:\Windows\system32\Dwm.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\Elantech\Ktp.exe
    C:\Windows\vsnp2uvc.exe
    C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
    C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe
    C:\Program Files\Compal\Wireless Select Switch\WLSS.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Symantec AntiVirus\VPTray.exe
    C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\Program Files\Protector Suite QL\psqltray.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Windows\ehome\ehtray.exe
    C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
    C:\Windows\ehome\ehmsas.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\Explorer.exe
    C:\Windows\system32\notepad.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\AIM6\aim6.exe
    C:\Program Files\AIM6\aolsoftware.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    O4 - HKLM\..\Run: [KTPWare] C:\Program Files\Elantech\ktp.exe
    O4 - HKLM\..\Run: [snp2uvc] C:\Windows\vsnp2uvc.exe
    O4 - HKLM\..\Run: [PSQLLauncher] "C:\Program Files\Protector Suite QL\launcher.exe" /startup
    O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
    O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [WLSS] C:\Program Files\Compal\Wireless Select Switch\WLSS.exe
    O4 - HKLM\..\Run: [Smart Watch Dog] -C:\Program Files\Compal Electronics, INC\Smart Watchdog\SmartWD.exe
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
    O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
    O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
    O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe (file missing)
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe (file missing)
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O13 - Gopher Prefix:
    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
    O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
    O23 - Service: Smart Watchdog Service (Smart Watchdog) - Unknown owner - C:\Program Files\Compal Electronics, INC\Smart Watchdog\SWDsvc.exe
    O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

    --
    End of file - 7398 bytes
  7. 15-03-2008  #6
    Neal
    Neal is offline Dedicated Member
    Save 20% on AVG Internet Security 2012 Suite!
    Thanks for all that.

    There isn't any malware showing up anywhere!!

    Is symantec subscription up to date or is it out of date? If out of date might consider a free anti-virus and free firewall that is not a resource hog like symantec.

    Let's do an online scan and see if it shows anything if it doesn't then you will need to look in a different direction.




    Do an online scan (scan only tool) with Kaspersky WebScanner
    [Internet Explorer required]


    Click on Kaspersky Online Scanner

    You will be prompted to install an ActiveX component from Kaspersky, Click Yes.
    • The program will launch and then begin downloading the latest definition files:
    • Once the files have been downloaded click on NEXT
    • Now click on Scan Settings
    • In the scan settings make sure that the following are selected:
      • Scan using the following Anti-Virus database:
        - Extended (if available otherwise Standard)
      • Scan Options:
        - Scan Archives
        - Scan Mail Bases
    • Click OK
    • Now under select a target to scan:
      • Select My Computer
    • This program will start and scan your system.
    • The scan will take a while so be patient and let it run.
    • Once the scan is complete it will display if your system has been infected.
      • Now click on the Save as Text button:
    • Save the file to your desktop.

    Post the results of the scan back here please and a new hijackthis log.
+ Reply to Thread
« Help with "broke PC" | browser(RESOLVED) »