Hijack this help

Reluctant_spender

Ok, I have an idea which is straight out of the suck it and see guide!

Before I post it however, have you uninstalled the AOL software. I ask this because I can write a script that will remove and stragglers.

Let me know

tranmererovers

I have just finished uninstalling all the AOL software. What do you have up your sleeve next then

Reluctant_spender

Ok, as previous

Disable Teatimer and other anti virus, malware, registry protective products;

into notepad copy and paste the below;

KillAll::

Registry::
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\!!7bef049a-2c00-11dc-a1ea-000e505b3b81}]

This time there is no space and I have removed !! and replaced it with !!

Told you this was cutting edge finger in the sky stuff!

tranmererovers

ComboFix 08-10-27.02 - another 2008-10-30 21:45:04.6 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.46 [GMT 0:00]
Running from: C:\Documents and Settings\another\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\another\Desktop\CFScript.txt
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2008-09-28 to 2008-10-30 )))))))))))))))))))))))))))))))
.

2008-10-30 18:56 . 2008-10-30 18:56 2 --a

---

C:\WINDOWS\msoffice.ini
2008-10-28 22:47 . 2008-10-28 22:47 <DIR> d

---

C:\Program Files\Belarc
2008-10-27 22:24 . 2008-10-27 22:24 410,976 --a

---

C:\WINDOWS\SYSTEM32\deploytk.dll
2008-10-27 22:24 . 2008-10-27 22:24 73,728 --a

---

C:\WINDOWS\SYSTEM32\javacpl.cpl
2008-10-27 22:01 . 2001-08-17 13:28 794,654 --a

---

C:\WINDOWS\SYSTEM32\DLLCACHE\usr1801.sys
2008-10-27 22:00 . 2001-08-17 22:36 386,560 --a

---

C:\WINDOWS\SYSTEM32\DLLCACHE\sgiul50.dll
2008-10-27 21:59 . 2001-08-17 13:28 899,146 --a

---

C:\WINDOWS\SYSTEM32\DLLCACHE\r2mdkxga.sys
2008-10-27 21:58 . 2001-08-17 14:05 351,616 --a

---

C:\WINDOWS\SYSTEM32\DLLCACHE\ovcodek2.sys
2008-10-27 21:57 . 2002-08-29 04:00 1,875,968 --a

---

C:\WINDOWS\SYSTEM32\DLLCACHE\msir3jp.lex
2008-10-27 21:56 . 2002-08-29 04:00 1,158,818 --a

---

C:\WINDOWS\SYSTEM32\DLLCACHE\korwbrkr.lex
2008-10-27 21:55 . 2002-08-29 04:00 10,129,408 --a

---

C:\WINDOWS\SYSTEM32\DLLCACHE\hwxkor.dll
2008-10-27 21:54 . 2001-08-17 14:56 1,733,120 --a

---

C:\WINDOWS\SYSTEM32\DLLCACHE\g400d.dll
2008-10-27 21:53 . 2001-08-17 12:14 952,007 --a

---

C:\WINDOWS\SYSTEM32\DLLCACHE\diwan.sys
2008-10-27 21:52 . 2002-08-29 04:00 1,677,824 --a

---

C:\WINDOWS\SYSTEM32\DLLCACHE\chsbrkr.dll
2008-10-27 21:51 . 2001-08-17 13:28 871,388 --a

---

C:\WINDOWS\SYSTEM32\DLLCACHE\bcmdm.sys
2008-10-27 21:50 . 2001-08-17 13:28 762,780 --a

---

C:\WINDOWS\SYSTEM32\DLLCACHE\3cwmcru.sys
2008-10-27 21:49 . 2001-08-17 14:56 66,048 --a

---

C:\WINDOWS\SYSTEM32\DLLCACHE\s3legacy.dll
2008-10-23 20:34 . 2008-10-23 20:34 <DIR> d

---

C:\WINDOWS\SYSTEM32\scripting
2008-10-23 20:34 . 2008-10-23 20:34 <DIR> d

---

C:\WINDOWS\SYSTEM32\en
2008-10-23 20:34 . 2008-10-23 20:34 <DIR> d

---

C:\WINDOWS\l2schemas
2008-10-22 10:59 . 2008-04-14 00:12 712,704

---

C:\WINDOWS\SYSTEM32\windowscodecs.dll
2008-10-22 10:59 . 2008-04-14 00:12 346,112

---

C:\WINDOWS\SYSTEM32\windowscodecsext.dll
2008-10-22 10:59 . 2008-04-14 00:12 276,992

---

C:\WINDOWS\SYSTEM32\wmphoto.dll
2008-10-22 10:59 . 2008-04-14 00:12 69,120

---

C:\WINDOWS\SYSTEM32\wlanapi.dll
2008-10-22 10:59 . 2008-04-14 00:12 69,120 --a

---

C:\WINDOWS\SYSTEM32\DLLCACHE\wlanapi.dll
2008-10-22 10:59 . 2008-04-14 00:12 53,248

---

C:\WINDOWS\SYSTEM32\tsgqec.dll
2008-10-22 10:59 . 2008-04-14 00:12 53,248 --a

---

C:\WINDOWS\SYSTEM32\DLLCACHE\tsgqec.dll
2008-10-22 10:59 . 2008-04-14 00:12 50,688

---

C:\WINDOWS\SYSTEM32\tspkg.dll
2008-10-22 10:59 . 2008-04-14 00:12 50,688 --a

---

C:\WINDOWS\SYSTEM32\DLLCACHE\tspkg.dll
2008-10-22 10:57 . 2008-04-14 00:09 13,463,552 --a

---

C:\WINDOWS\SYSTEM32\DLLCACHE\hwxjpn.dll
2008-10-22 10:56 . 2008-04-13 16:36 144,384

---

C:\WINDOWS\SYSTEM32\DRIVERS\hdaudbus.sys
2008-10-22 10:55 . 2008-04-14 00:11 650,752

---

C:\WINDOWS\SYSTEM32\dot3ui.dll
2008-10-22 10:54 . 2008-04-14 00:11 136,192 --a

---

C:\WINDOWS\SYSTEM32\DLLCACHE\aaclient.dll
2008-10-22 10:54 . 2008-04-14 00:11 136,192

---

C:\WINDOWS\SYSTEM32\aaclient.dll
2008-10-18 10:58 . 2008-10-18 10:58 <DIR> d--hs---- C:\Documents and Settings\another\UserData
2008-10-17 18:32 . 2008-08-14 10:09 2,145,280 --a

---

C:\WINDOWS\SYSTEM32\DLLCACHE\ntkrnlmp.exe
2008-10-17 18:32 . 2008-08-14 09:33 2,023,936 --a

---

C:\WINDOWS\SYSTEM32\DLLCACHE\ntkrpamp.exe
2008-10-16 21:22 . 2008-10-25 21:18 1,393 --a

---

C:\WINDOWS\imsins.BAK
2008-10-14 21:47 . 2008-10-14 21:47 <DIR> d

---

C:\WINDOWS\ERUNT
2008-10-14 21:42 . 2008-10-15 19:04 <DIR> d

---

C:\SDFix
2008-10-13 21:36 . 2008-10-26 12:40 <DIR> d--h

---

C:\$AVG8.VAULT$
2008-10-11 11:19 . 2008-10-23 22:06 <DIR> d

---

C:\Documents and Settings\NetworkService\Application Data\yahoo!
2008-10-11 11:06 . 2008-10-26 12:41 <DIR> d

---

C:\WINDOWS\SYSTEM32\DRIVERS\Avg
2008-10-11 11:06 . 2008-10-11 11:06 <DIR> d

---

C:\Program Files\AVG
2008-10-11 11:06 . 2008-10-11 11:06 <DIR> d

---

C:\Documents and Settings\All Users\Application Data\avg8
2008-10-11 11:06 . 2008-10-11 11:06 97,928 --a

---

C:\WINDOWS\SYSTEM32\DRIVERS\avgldx86.sys
2008-10-11 11:06 . 2008-10-11 11:06 76,040 --a

---

C:\WINDOWS\SYSTEM32\DRIVERS\avgtdix.sys
2008-10-11 11:06 . 2008-10-11 11:06 10,520 --a

---

C:\WINDOWS\SYSTEM32\avgrsstx.dll
2008-10-11 11:00 . 2004-10-15 17:32 83,096 --a

---

C:\WINDOWS\SYSTEM32\SSSensor.dll
2008-10-11 11:00 . 2004-10-15 17:17 60,496 --a

---

C:\WINDOWS\SYSTEM32\DRIVERS\Teefer.sys
2008-10-11 11:00 . 2004-10-15 17:18 21,075 --a

---

C:\WINDOWS\SYSTEM32\DRIVERS\wpsdrvnt.sys
2008-10-11 11:00 . 2004-10-15 17:32 14,568 --a

---

C:\WINDOWS\SYSTEM32\DRIVERS\wg6n.sys
2008-10-11 11:00 . 2004-10-15 17:32 14,568 --a

---

C:\WINDOWS\SYSTEM32\DRIVERS\wg5n.sys
2008-10-11 11:00 . 2004-10-15 17:32 14,568 --a

---

C:\WINDOWS\SYSTEM32\DRIVERS\wg4n.sys
2008-10-11 11:00 . 2004-10-15 17:32 14,568 --a

---

C:\WINDOWS\SYSTEM32\DRIVERS\wg3n.sys
2008-10-11 10:59 . 2008-10-11 10:59 <DIR> d

---

C:\Program Files\Sygate
2008-10-11 10:50 . 2008-10-11 10:50 <DIR> d

---

C:\Program Files\Lavasoft
2008-10-11 10:50 . 2008-10-11 10:53 <DIR> d

---

C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-10-11 10:48 . 2008-10-11 10:59 <DIR> d

---

C:\Program Files\Common Files\Wise Installation Wizard
2008-10-11 10:33 . 2008-10-30 21:36 <DIR> d-a

---

C:\Documents and Settings\All Users\Application Data\TEMP
2008-10-11 10:32 . 2008-10-11 10:32 <DIR> d

---

C:\Program Files\SpywareBlaster
2008-10-11 10:23 . 2008-10-11 10:25 <DIR> d

---

C:\Program Files\Spybot - Search & Destroy
2008-10-11 10:23 . 2008-10-15 18:05 <DIR> d

---

C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-10-11 09:41 . 2008-10-11 09:41 <DIR> d

---

C:\Documents and Settings\Administrator\Application Data\Malwarebytes
2008-10-11 09:39 . 2004-09-24 16:05 <DIR> d

---

C:\Documents and Settings\Administrator\Application Data\You've Got Pictures Screensaver
2008-10-11 09:39 . 2004-09-24 16:07 <DIR> d

---

C:\Documents and Settings\Administrator\Application Data\Sonic
2008-10-11 09:39 . 2004-09-24 16:02 <DIR> d

---

C:\Documents and Settings\Administrator\Application Data\Jasc Software Inc
2008-10-11 09:39 . 2004-09-24 16:07 <DIR> d

---

C:\Documents and Settings\Administrator\Application Data\AOL
2008-10-11 09:39 . 2008-10-11 09:39 <DIR> d

---

C:\Documents and Settings\Administrator
2008-10-11 09:35 . 2008-10-15 20:53 <DIR> d

---

C:\Program Files\Malwarebytes' Anti-Malware
2008-10-11 09:35 . 2008-10-11 09:35 <DIR> d

---

C:\Documents and Settings\another\Application Data\Malwarebytes
2008-10-11 09:35 . 2008-10-11 09:35 <DIR> d

---

C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-10-11 09:35 . 2008-09-09 23:07 38,528 --a

---

C:\WINDOWS\SYSTEM32\DRIVERS\mbamswissarmy.sys
2008-10-11 09:35 . 2008-09-09 23:07 17,200 --a

---

C:\WINDOWS\SYSTEM32\DRIVERS\mbam.sys
2008-10-11 09:32 . 2008-10-11 09:32 <DIR> d

---

C:\Program Files\Trend Micro
2008-09-30 20:51 . 2008-09-30 20:51 <DIR> d

---

C:\Program Files\Samsung
2008-09-30 20:02 . 2008-09-30 20:02 <DIR> d

---

C:\Program Files\Windows Media Connect 2
2008-09-30 20:00 . 2008-09-30 20:00 <DIR> d

---

C:\WINDOWS\SYSTEM32\LogFiles
2008-09-30 20:00 . 2008-09-30 20:01 <DIR> d

---

C:\WINDOWS\SYSTEM32\DRIVERS\UMDF
2008-09-30 19:15 . 2006-05-03 21:53 174,592 --a

---

C:\WINDOWS\SYSTEM32\framedyn.dll
2008-09-30 19:14 . 2008-09-30 19:15 <DIR> d

---

C:\WINDOWS\SYSTEM32\Samsung_USB_Drivers
2008-09-30 19:14 . 2006-07-24 15:05 5,632 --a

---

C:\WINDOWS\SYSTEM32\DRIVERS\StarOpen.sys
2008-09-30 19:14 . 2005-08-28 19:51 766 --a

---

C:\WINDOWS\SYSTEM32\Uninstall.ico

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-30 17:23

---

d

---

w C:\Program Files\Yahoo!
2008-10-30 16:51

---

d

---

w C:\Program Files\Common Files\AOL
2008-10-30 16:27

---

d

---

w C:\Documents and Settings\All Users\Application Data\AOL
2008-10-29 23:15

---

d--h--w C:\Program Files\InstallShield Installation Information
2008-10-27 22:24

---

d

---

w C:\Program Files\Java
2008-10-15 16:34 337,408 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\netapi32.dll
2008-10-03 17:41 6,066,176

---

w C:\WINDOWS\SYSTEM32\DLLCACHE\ieframe.dll
2008-09-15 12:12 1,846,400 ----a-w C:\WINDOWS\SYSTEM32\win32k.sys
2008-09-15 12:12 1,846,400 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\win32k.sys
2008-09-08 10:41 333,824 ----a-w C:\WINDOWS\system32\drivers\srv.sys
2008-09-08 10:41 333,824 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\srv.sys
2008-09-01 19:13

---

d

---

w C:\Documents and Settings\another\Application Data\AdobeUM
2008-08-27 08:24 3,593,216 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\mshtml.dll
2008-08-25 08:38 13,824

---

w C:\WINDOWS\SYSTEM32\DLLCACHE\ieudinit.exe
2008-08-25 08:37 70,656 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\ie4uinit.exe
2008-08-23 05:56 635,848 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\iexplore.exe
2008-08-23 05:54 161,792 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\ieakui.dll
2008-08-14 10:11 2,189,184 ----a-w C:\WINDOWS\SYSTEM32\ntoskrnl.exe
2008-08-14 10:11 2,189,184 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\ntoskrnl.exe
2008-08-14 10:04 138,496 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\afd.sys
2008-08-14 09:33 2,066,048 ----a-w C:\WINDOWS\SYSTEM32\ntkrnlpa.exe
2008-08-14 09:33 2,066,048 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\ntkrnlpa.exe
2008-07-18 21:10 94,920 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\cdm.dll
2008-07-18 21:10 94,920 ----a-w C:\WINDOWS\SYSTEM32\cdm.dll
2008-07-18 21:10 53,448 ----a-w C:\WINDOWS\SYSTEM32\wuauclt.exe
2008-07-18 21:10 53,448 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wuauclt.exe
2008-07-18 21:10 45,768 ----a-w C:\WINDOWS\SYSTEM32\wups2.dll
2008-07-18 21:10 36,552 ----a-w C:\WINDOWS\SYSTEM32\wups.dll
2008-07-18 21:10 36,552 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wups.dll
2008-07-18 21:09 563,912 ----a-w C:\WINDOWS\SYSTEM32\wuapi.dll
2008-07-18 21:09 563,912 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wuapi.dll
2008-07-18 21:09 325,832 ----a-w C:\WINDOWS\SYSTEM32\wucltui.dll
2008-07-18 21:09 325,832 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wucltui.dll
2008-07-18 21:09 205,000 ----a-w C:\WINDOWS\SYSTEM32\wuweb.dll
2008-07-18 21:09 205,000 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wuweb.dll
2008-07-18 21:09 1,811,656 ----a-w C:\WINDOWS\SYSTEM32\wuaueng.dll
2008-07-18 21:09 1,811,656 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wuaueng.dll
2008-07-07 20:26 253,952 ----a-w C:\WINDOWS\SYSTEM32\es.dll
2008-07-07 20:26 253,952 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\es.dll
.

((((((((((((((((((((((((((((( snapshot_2008-10-30_12.40.33.15 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-10-30 21:51:39 16,384 ----atw C:\WINDOWS\temp\Perflib_Perfdata_610.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"STManager"="C:\Program Files\SpeedTouch\Dr SpeedTouch\drst.exe" [2003-10-16 118784]
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe" [2005-08-31 2478080]
"NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [2004-09-07 1871872]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2004-04-11 290816]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-04-11 53248]
"IntelMeM"="C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-03 221184]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-03-15 122933]
"UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2004-09-24 98304]
"EPSON Stylus C64 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE" [2003-05-27 99840]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 155648]
"PinnacleDriverCheck"="C:\WINDOWS\System32\PSDrvCheck.exe" [2004-03-10 406016]
"REGSHAVE"="C:\Program Files\REGSHAVE\REGSHAVE.EXE" [2002-02-04 53248]
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 866816]
"YBrowser"="C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe" [2006-07-21 129536]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2005-07-16 180269]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-09-20 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-09-20 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-09-20 114688]
"EPSON Stylus Photo R220 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIE.EXE" [2005-03-09 98304]
"SmcService"="C:\PROGRA~1\Sygate\SPF\smc.exe" [2004-10-15 2577632]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-10-11 1234712]
"SunJavaUpdateSched"="C:\Program Files\Java\jre6\bin\jusched.exe" [2008-10-27 136600]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2008-04-14 15360]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-12-14 113664]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.MJPG"= Pvmjpg21.dll
"VIDC.PIM1"= pclepim1.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\PROGRA~1\\Yahoo!\\MESSEN~1\\YPAGER.EXE"=
"C:\\PROGRA~1\\Yahoo!\\MESSEN~1\\yserver.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\SpeedTouch\\Dr SpeedTouch\\drst.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-10-11 97928]
R2 avg8emc;AVG Free8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-10-11 875288]
R2 avg8wd;AVG Free8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-10-11 231704]
R2 AvgTdiX;AVG Free8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-10-11 76040]
R2 JavaQuickStarterService;Java Quick Starter;C:\Program Files\Java\jre6\bin\jqs.exe [2008-10-27 152984]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\!!7bef049a-2c00-11dc-a1ea-000e505b3b81}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Toy.exe
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-30 22:47:16
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\vsdatant]
"ImagePath"=""
.

---

Other Running Processes

---

.
C:\Program Files\Sygate\SPF\Smc.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\SYSTEM32\MsPMSPSv.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\SYSTEM32\wscntfy.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\Ymsgr_tray.exe
C:\Program Files\FinePixViewer\QuickDCF.exe
.
**************************************************************************
.
Completion time: 2008-10-30 22:59:29 - machine was rebooted
ComboFix-quarantined-files.txt 2008-10-30 22:59:04
ComboFix2.txt 2008-10-30 12:42:10
ComboFix3.txt 2008-10-28 10:23:09
ComboFix4.txt 2008-10-18 10:21:45
ComboFix5.txt 2008-10-30 21:42:53

Pre-Run: 11,300,323,328 bytes free
Post-Run: 11,342,008,320 bytes free

231 --- E O F --- 2008-10-25 21:19:05

Reluctant_spender

It's still there!!!!!

Have you rebooted the machine? - Scratch that - I've seen that it has been.

Reluctant_spender

Can't remember if we have done this already and the site is sooo slow;

Please go to Eset Onlinescan (NOD32)
(You need to use InternetExplorer or enable IEView in Firefox)

• You will then see the Terms of Use, tick the check-box infront of YES, I accept the Terms of Use
• Now click Start
• Should you face a Security Warning that asks if you want to install and run a file called "OnlineScanner.cab", click Yes
• Click Start (the Onlinescanner will now prepare itself for running on your pc)
• To do a full-scan, tick: "Remove found threats" and "Scan potentially unwanted applications"
• Press Scan
  The Onlinescan will now start and scan your pc (please let it run to completion)
• When the scan has finished, it will show a screen with two tabs "overview" and "details" and the option to get information or buy software, just close the window
• Click Start >> Run... >> type: C:\Program Files\EsetOnlineScanner\log.txt
  The Scan results will now open in Notepad
• Click into the text area, right-click and chose "select all"
• Right-click again and chose "copy"
• Close Notepad

Note for Vista Users: Eset is compatible but Internet Explorer must be run as Administrator. To do this, right-click on the IE icon in the Start Menu or Quick Launch Bar on the Taskbar and select "Run as Administrator" from the context menu.)

Include this log in your reply by right-clicking and "paste" in the text area of the reply post you just created.

tranmererovers

Reluctant_spender wrote: »

Can't remember if we have done this already and the site is sooo slow;

Please go to Eset Onlinescan (NOD32)

Hi reluctant spender - I'm glad you haven't lost the will to live with this one yet :rolleyes: .

To do the next step, i am going to have to take the pc back to my friends house as I can't connect it to the internet here.

Next installment to follow

tranmererovers

Yes - I am still here

Here is the log

# version=4
# OnlineScanner.ocx=1.0.0.635
# OnlineScannerDLLA.dll=1, 0, 0, 79
# OnlineScannerDLLW.dll=1, 0, 0, 78
# OnlineScannerUninstaller.exe=1, 0, 0, 49 # vers_standard_module=3588 (20081105) # vers_arch_module=1.064 (20080214) # vers_adv_heur_module=1.066 (20070917) # EOSSerial=b6432a0e2b3e7b42ae178092d75858fd
# end=finished
# remove_checked=true
# unwanted_checked=true
# utc_time=2008-11-06 12:21:10
# local_time=2008-11-06 12:21:10 (+0000, GMT Standard Time) # country="United Kingdom"
# osver=5.1.2600 NT Service Pack 3
# scanned=238460
# found=0
# scan_time=6406

Reluctant_spender

That looks clean - how's it running?

tranmererovers

It's running fine - bit slower that before but that is probably the firewall and avg.

(Still can't get usb mouse or pen to connect though!)