It's another "please check my hijack this log"

**woody123**

Hi,

I've recently been having trouble with viruses both on my home and work computer. The log below is from my home computer.

I think i have eradicated the latest one but thought i would post the log for you guys to have a look at.

The viruses i've had are the "Personal Security" virus which bought up fake alerts whilst looking genuine. It then wanted me to pay to remove them.

Logfile of Trend Micro HijackThis v2.0.3 (BETA)
Scan saved at 16:19:53, on 31/01/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jucheck.exe
C:\WINDOWS\System32\hphmon05.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\SAGEM\SAGEM [EMAIL="F@st"]F@st[/EMAIL] 800-840\dslmon.exe
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
C:\Program Files\AVG\AVG9\avgemc.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\TrendMicro\HiJackThis\HiJackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qgb10.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qgb10.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-qgb10.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-qgb10.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-qgb10.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM [EMAIL="F@st"]F@st[/EMAIL] 800-840\dslmon.exe
O4 - Global Startup: Exif Launcher.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Picture Package Menu.lnk = ?
O4 - Global Startup: Picture Package VCD Maker.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: AVG Free E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgemc.exe
O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
--
End of file - 6728 bytes

Browntoa

did you run Malwarebytes or combofix ??

can I see the log file ??

**woody123**

I'll run malware bytes now thanks.

**woody123**

Here is the Malware bytes log, nothing found.


Malwarebytes' Anti-Malware 1.44
Database version: 3599
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
31/01/2010 17:09:58
mbam-log-2010-01-31 (17-09-58).txt
Scan type: Quick Scan
Objects scanned: 126338
Time elapsed: 26 minute(s), 24 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)

Browntoa

i'm wondering how you removed Personal Security in the first place ??

**woody123**

Browntoa wrote: »

i'm wondering how you removed Personal Security in the first place ??

I ran malware bytes yesterday but it found nothing then.

I also tried ccleaner so that may have got rid of it. Viruses just seem to coming back to me so that is the problem i need to find really.

I have looked at the advice thread on here before posting and thats where i got "hijack this" from, i am just wondering if there is any other sure way of finding out if i have a virus.

Or if there was, i have got rid already which may be the case.

Browntoa

i'd run this

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

and then post the log file

**woody123**

Browntoa wrote: »

i'd run this

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

and then post the log file

Thanks!!!

i tried doing that but its conflicting with AVG which i then disabled and then combofix wouldn't run.

Browntoa

follow the instructions here for turning off AVG

http://www.bleepingcomputer.com/forums/topic114351.html

**woody123**

Thanks i've done it.

Can't see clearly if this scan was sucessful or not.

ComboFix 10-01-30.07 - Owner 31/01/2010 17:57:47.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.247.126 [GMT 0:00]
Running from: c:\documents and settings\Owner\Desktop\ComboFix1.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\hosts
c:\recycler\S-1-5-21-1781551839-1296084637-3148653059-1003
c:\windows\system32\ps2.bat
\Autorun.inf
.
((((((((((((((((((((((((( Files Created from 2009-12-28 to 2010-01-31 )))))))))))))))))))))))))))))))
.
2010-01-31 16:16 . 2010-01-31 16:16 388096 ----a-r- c:\documents and settings\Owner\Application Data\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe
2010-01-31 16:16 . 2010-01-31 16:16

---

d

---

w- c:\program files\TrendMicro
2010-01-30 19:33 . 2010-01-31 13:33

---

d

---

w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2010-01-30 19:33 . 2010-01-30 19:33

---

d

---

w- c:\documents and settings\Owner\Application Data\Yahoo!
2010-01-30 19:33 . 2010-01-30 19:34

---

d

---

w- c:\program files\Yahoo!
2010-01-30 19:32 . 2010-01-30 19:34

---

d

---

w- c:\program files\CCleaner
2010-01-30 18:42 . 2010-01-30 18:42

---

d

---

w- c:\documents and settings\Owner\Local Settings\Application Data\Threat Expert
2010-01-30 17:52 . 2010-01-30 20:41

---

d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-01-29 20:00 . 2010-01-29 20:02

---

d

---

w- c:\program files\Microsoft Works
2010-01-24 16:58 . 2010-01-24 16:58

---

d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2010-01-24 15:34 . 2010-01-24 15:34

---

d

---

w- c:\windows\system32\scripting
2010-01-24 15:34 . 2010-01-24 15:34

---

d

---

w- c:\windows\system32\en
2010-01-24 15:34 . 2010-01-24 15:34

---

d

---

w- c:\windows\system32\bits
2010-01-21 20:20 . 2009-12-21 19:14 594432 -c----w- c:\windows\system32\dllcache\msfeeds.dll
2010-01-21 20:20 . 2009-12-21 19:14 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll
2010-01-21 20:20 . 2009-12-21 19:14 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2010-01-21 20:20 . 2009-12-21 19:14 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2010-01-21 20:19 . 2009-12-21 19:14 1985536 -c----w- c:\windows\system32\dllcache\iertutil.dll
2010-01-21 20:19 . 2009-12-21 19:14 11070464 -c----w- c:\windows\system32\dllcache\ieframe.dll
2010-01-21 20:18 . 2009-10-02 04:44 92160 -c----w- c:\windows\system32\dllcache\iecompat.dll
2010-01-19 22:12 . 2008-04-14 00:12 208896 -c----w- c:\windows\system32\dllcache\unregmp2.exe
2010-01-19 22:12 . 2008-04-14 00:12 50688

---

w- c:\windows\system32\tspkg.dll
2010-01-19 22:12 . 2008-04-14 00:12 53248

---

w- c:\windows\system32\tsgqec.dll
2010-01-19 22:12 . 2008-04-14 00:12 152064 -c----w- c:\windows\system32\dllcache\shmedia.dll
2010-01-19 22:12 . 2008-04-13 18:40 10240

---

w- c:\windows\system32\drivers\sffp_mmc.sys
2010-01-19 22:12 . 2008-04-14 00:12 774144 -c----w- c:\windows\system32\dllcache\setup_wm.exe
2010-01-19 22:12 . 2008-04-14 00:12 32768

---

w- c:\windows\system32\setupn.exe
2010-01-19 22:10 . 2008-04-14 00:12 176640

---

w- c:\windows\system32\napstat.exe
2010-01-19 22:09 . 2008-04-14 00:12 786432 -c----w- c:\windows\system32\dllcache\migrate.exe
2010-01-19 22:09 . 2008-04-14 00:11 6656 -c----w- c:\windows\system32\dllcache\laprxy.dll
2010-01-19 22:09 . 2008-04-14 00:11 37376

---

w- c:\windows\system32\l2gpstore.dll
2010-01-19 22:09 . 2008-04-14 00:11 61440

---

w- c:\windows\system32\kmsvc.dll
2010-01-19 22:09 . 2008-04-14 00:09 6144

---

w- c:\windows\system32\kbdpash.dll
2010-01-19 22:09 . 2008-04-14 00:09 6144

---

w- c:\windows\system32\kbdnepr.dll
2010-01-19 22:09 . 2008-04-14 00:09 6144

---

w- c:\windows\system32\kbdiultn.dll
2010-01-19 22:09 . 2008-04-14 00:09 6144

---

w- c:\windows\system32\kbdbhc.dll
2010-01-19 22:09 . 2008-04-14 00:11 81920

---

w- c:\windows\system32\ieencode.dll
2010-01-19 22:08 . 2008-04-13 16:36 144384

---

w- c:\windows\system32\drivers\hdaudbus.sys
2010-01-19 22:08 . 2008-04-14 00:11 33792

---

w- c:\windows\system32\eapsvc.dll
2010-01-19 22:06 . 2008-04-14 00:11 33792 -c----w- c:\windows\system32\dllcache\custsat.dll
2010-01-19 22:06 . 2008-04-14 00:11 12800

---

w- c:\windows\system32\credssp.dll
2010-01-19 22:06 . 2008-04-14 00:11 159232 -c----w- c:\windows\system32\dllcache\cewmdm.dll
2010-01-19 22:06 . 2008-04-14 00:11 286720 -c----w- c:\windows\system32\dllcache\blackbox.dll
2010-01-19 22:06 . 2008-04-14 00:11 7168

---

w- c:\windows\system32\bitsprx4.dll
2010-01-19 22:05 . 2008-04-14 00:11 233472

---

w- c:\windows\system32\azroles.dll
2010-01-19 22:05 . 2008-04-13 17:23 8192 -c----w- c:\windows\system32\dllcache\asferror.dll
2010-01-19 22:04 . 2008-04-14 00:11 136192

---

w- c:\windows\system32\aaclient.dll
2010-01-19 18:40 . 2010-01-19 18:40

---

d

---

w- c:\documents and settings\Owner\Application Data\Malwarebytes
2010-01-19 18:39 . 2010-01-07 16:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-19 18:39 . 2010-01-19 18:39

---

d

---

w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-01-19 18:39 . 2010-01-07 16:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-19 18:39 . 2010-01-19 18:40

---

d

---

w- c:\program files\Malwarebytes' Anti-Malware
2010-01-19 17:29 . 2004-08-20 15:56 159744 ----a-w- c:\windows\system32\igfxres.dll
2010-01-18 13:34 . 2008-06-13 11:05 272128 -c----w- c:\windows\system32\dllcache\bthport.sys
2010-01-18 13:33 . 2008-08-14 10:04 138496 -c----w- c:\windows\system32\dllcache\afd.sys
2010-01-18 13:29 . 2009-03-06 14:22 284160 -c----w- c:\windows\system32\dllcache\pdh.dll
2010-01-18 13:29 . 2009-02-09 12:10 401408 -c----w- c:\windows\system32\dllcache\rpcss.dll
2010-01-18 13:29 . 2009-02-06 11:11 110592 -c----w- c:\windows\system32\dllcache\services.exe
2010-01-18 13:29 . 2009-02-09 12:10 473600 -c----w- c:\windows\system32\dllcache\fastprox.dll
2010-01-18 13:29 . 2009-02-06 10:10 227840 -c----w- c:\windows\system32\dllcache\wmiprvse.exe
2010-01-18 13:29 . 2009-02-09 12:10 453120 -c----w- c:\windows\system32\dllcache\wmiprvsd.dll
2010-01-18 13:29 . 2009-06-25 08:25 730112 -c----w- c:\windows\system32\dllcache\lsasrv.dll
2010-01-18 13:29 . 2009-02-09 12:10 617472 -c----w- c:\windows\system32\dllcache\advapi32.dll
2010-01-18 13:29 . 2009-02-09 12:10 714752 -c----w- c:\windows\system32\dllcache\ntdll.dll
2010-01-18 13:29 . 2009-08-04 15:13 2145280 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe
2010-01-18 13:28 . 2009-08-04 20:44 2189184 -c----w- c:\windows\system32\dllcache\ntoskrnl.exe
2010-01-18 13:28 . 2009-08-04 14:20 2023936 -c----w- c:\windows\system32\dllcache\ntkrpamp.exe
2010-01-18 13:28 . 2009-06-21 21:44 153088 -c----w- c:\windows\system32\dllcache\triedit.dll
2010-01-18 13:22 . 2008-05-08 14:02 203136 -c----w- c:\windows\system32\dllcache\rmcast.sys
2010-01-18 13:21 . 2008-10-24 11:21 455296 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2010-01-18 13:21 . 2008-12-11 10:57 333952 -c----w- c:\windows\system32\dllcache\srv.sys
2010-01-18 13:21 . 2008-05-01 14:33 331776 -c----w- c:\windows\system32\dllcache\msadce.dll
2010-01-18 13:21 . 2009-07-10 13:27 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll
2010-01-18 13:20 . 2008-04-11 19:04 691712 -c----w- c:\windows\system32\dllcache\inetcomm.dll
2010-01-18 13:18 . 2009-06-22 06:44 726528 -c--a-w- c:\windows\system32\dllcache\jscript.dll
2010-01-18 13:16 . 2009-06-10 09:19 2066432 -c----w- c:\windows\system32\dllcache\mstscax.dll
2010-01-18 13:14 . 2008-10-15 16:34 337408 -c----w- c:\windows\system32\dllcache\netapi32.dll
2010-01-18 13:14 . 2009-07-31 04:35 1172480 -c----w- c:\windows\system32\dllcache\msxml3.dll
2010-01-18 13:13 . 2008-05-03 11:55 2560

---

w- c:\windows\system32\xpsp4res.dll
2010-01-18 13:13 . 2008-04-21 12:08 215552 -c----w- c:\windows\system32\dllcache\wordpad.exe
2010-01-18 12:57 . 2009-10-15 16:28 119808 -c----w- c:\windows\system32\dllcache\t2embed.dll
2010-01-18 12:57 . 2009-10-15 16:28 81920 -c----w- c:\windows\system32\dllcache\fontsub.dll
2010-01-18 12:51 . 2009-11-21 15:51 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll
2010-01-17 23:10 . 2010-01-25 20:50

---

dcsh--r- c:\windows\system32\dllcache
2010-01-17 22:37 . 2009-11-25 13:01 1230080 ----a-w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar\IEToolbar.dll
2010-01-17 21:07 . 2010-01-17 22:31

---

d

---

w- C:\$AVG
2010-01-17 21:07 . 2010-01-17 21:07 12464 ----a-w- c:\windows\system32\avgrsstx.dll
2010-01-17 21:06 . 2010-01-17 21:06 360584 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2010-01-17 21:06 . 2010-01-17 21:06 333192 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2010-01-17 21:06 . 2010-01-17 21:06 28424 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2010-01-17 21:06 . 2010-01-31 13:05

---

d

---

w- c:\windows\system32\drivers\Avg
2010-01-17 21:06 . 2010-01-21 21:31

---

d

---

w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar
2010-01-17 21:04 . 2010-01-17 21:04

---

d

---

w- c:\program files\AVG
2010-01-17 21:04 . 2010-01-17 21:04

---

d

---

w- c:\documents and settings\All Users\Application Data\avg9
2010-01-17 19:14 . 2010-01-17 20:46

---

d

---

w- c:\documents and settings\All Users\Application Data\SITEguard
2010-01-17 19:13 . 2010-01-17 19:13

---

d

---

w- c:\program files\Common Files\iS3
2010-01-17 19:13 . 2010-01-19 18:23

---

d

---

w- c:\documents and settings\All Users\Application Data\STOPzilla!
2010-01-17 19:03 . 2010-01-24 15:40

---

d

---

w- c:\windows\system32\wbem\AutoRecover
2010-01-17 18:46 . 2008-04-14 00:12 221184 ----a-w- c:\windows\system32\wmpns.dll
2010-01-17 18:43 . 2008-04-14 01:12 1737856

---

w- c:\windows\system32\mtxparhd.dll
2010-01-17 18:34 . 2009-01-07 18:21 26144 ----a-w- c:\windows\system32\spupdsvc.exe
2010-01-17 17:59 . 2010-01-17 17:59 152576 ----a-w- c:\documents and settings\Owner\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2010-01-17 17:59 . 2010-01-17 17:59 79488 ----a-w- c:\documents and settings\Owner\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2010-01-17 17:20 . 2009-08-06 19:24 327896 ----a-w- c:\windows\system32\wucltui.dll
2010-01-17 17:20 . 2009-08-06 19:24 209632 ----a-w- c:\windows\system32\wuweb.dll
2010-01-17 17:20 . 2009-08-06 19:24 35552 -c--a-w- c:\windows\system32\dllcache\wups.dll
2010-01-17 17:20 . 2009-08-06 19:24 35552 ----a-w- c:\windows\system32\wups.dll
2010-01-17 17:20 . 2009-08-06 19:23 575704 ----a-w- c:\windows\system32\wuapi.dll
2010-01-17 17:20 . 2008-04-14 00:12 165888 ----a-w- c:\windows\system32\wuauclt1.exe
2010-01-17 17:20 . 2008-04-14 00:12 183296 ----a-w- c:\windows\system32\wuaueng1.dll
2010-01-17 16:49 . 2008-04-13 18:47 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys
2010-01-17 16:43 . 2008-04-14 00:11 191488 ----a-w- c:\windows\system32\iuengine.dll
2010-01-17 16:42 . 2008-04-13 18:45 2944 ----a-w- c:\windows\system32\drivers\drmkaud.sys
2010-01-17 16:42 . 2008-04-13 19:17 83072 ----a-w- c:\windows\system32\drivers\wdmaud.sys
2010-01-17 16:42 . 2008-04-13 18:45 172416 ----a-w- c:\windows\system32\drivers\kmixer.sys
2010-01-17 16:42 . 2008-04-13 19:15 60800 ----a-w- c:\windows\system32\drivers\sysaudio.sys
2010-01-17 16:42 . 2008-04-13 18:45 52864 ----a-w- c:\windows\system32\drivers\dmusic.sys
2010-01-17 16:42 . 2008-04-13 18:45 56576 ----a-w- c:\windows\system32\drivers\swmidi.sys
2010-01-17 16:42 . 2008-04-13 16:39 142592 ----a-w- c:\windows\system32\drivers\aec.sys
2010-01-17 16:42 . 2008-04-13 18:45 6272 ----a-w- c:\windows\system32\drivers\splitter.sys
2010-01-17 16:40 . 2004-01-02 04:05

---

d

---

w- c:\windows\system32\config\systemprofile\WINDOWS
2010-01-17 16:40 . 2008-04-14 00:11 40960 ----a-w- c:\windows\system32\mf3216.dll
2010-01-17 16:40 . 2004-03-30 01:48 40960 -c----w- c:\windows\system32\dllcache\evtgprov.dll
2010-01-17 16:40 . 2008-04-13 17:39 2897920 ----a-w- c:\windows\system32\xpsp2res.dll
2010-01-17 16:40 . 2008-04-14 00:11 331264 ----a-w- c:\windows\system32\ipnathlp.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-31 17:43 . 2004-05-30 20:44 28040 ----a-w- c:\documents and settings\Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-01-28 19:23 . 2004-06-07 13:51

---

d

---

w- c:\documents and settings\Owner\Application Data\AdobeUM
2010-01-25 22:05 . 2004-01-02 00:42

---

d

---

w- c:\program files\Symantec
2010-01-25 22:05 . 2004-01-02 00:42

---

d

---

w- c:\documents and settings\All Users\Application Data\Symantec
2010-01-25 22:02 . 2004-01-02 04:09

---

d

---

w- c:\program files\Easy Internet signup
2010-01-19 17:57 . 2010-01-19 17:45 992 ----a-w- c:\windows\system32\drivers\kgpcpy.cfg
2010-01-17 16:44 . 2010-01-17 16:44 3706 --sha-r- c:\windows\system32\drivers\HP_PC179A-ABU S7390UK GB420_YC_Pres_QCZB420_E42GBheREF2_4_IGamila Giovani Neon series_SMICRO-STAR INTERNATIONAL CO., LTD_V030_B3.10_T040415_WXH1_L409_M248_J80_7Intel_8Pentium 4_92.8_111063044_N10EC8139_P_Z14F12F00_K.MRK
2010-01-17 16:36 . 2004-01-02 03:56

---

d

---

w- c:\program files\InterVideo
2010-01-17 16:36 . 2004-01-02 03:57

---

d

---

w- c:\program files\Common Files\InterVideo
2010-01-17 16:36 . 2004-01-02 03:56

---

d--h--w- c:\program files\InstallShield Installation Information
2010-01-08 16:37 . 2006-01-03 21:35

---

d

---

w- c:\documents and settings\Owner\Application Data\Image Zone Express
2009-12-28 20:41 . 2009-12-28 20:40

---

d

---

w- c:\program files\Veetle
2009-12-21 19:14 . 2004-01-21 16:16 916480 ----a-w- c:\windows\system32\wininet.dll
2006-10-11 08:04 . 2008-06-08 12:05 61036 ----a-w- c:\program files\mozilla firefox\components\jar50.dll
2006-10-11 08:04 . 2008-06-08 12:05 48742 ----a-w- c:\program files\mozilla firefox\components\jsd3250.dll
2006-10-11 08:05 . 2008-06-08 12:05 29313 ----a-w- c:\program files\mozilla firefox\components\myspell.dll
2006-10-11 08:05 . 2008-06-08 12:05 41082 ----a-w- c:\program files\mozilla firefox\components\spellchk.dll
2006-10-11 08:04 . 2008-06-08 12:05 166510 ----a-w- c:\program files\mozilla firefox\components\xpinstal.dll
2004-06-11 19:55 . 2004-06-11 19:55 32 --sha-w- c:\windows\{DC2AA610-22A8-4B22-878B-92E1FF471B48}.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-11-25 1230080]
[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-11-25 13:01 1230080 ----a-w- c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-11-25 1230080]
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-11-25 1230080]
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\j2re1.4.2_03\bin\jusched.exe" [2004-01-02 32881]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-08-20 118784]
"HPHUPD05"="c:\program files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" [2003-08-21 49152]
"HPHmon05"="c:\windows\System32\hphmon05.exe" [2003-08-21 483328]
"KBD"="c:\hp\KBD\KBD.EXE" [2003-02-11 61440]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2003-11-03 221184]
"PS2"="c:\windows\system32\ps2.exe" [2003-09-12 98304]
"Reminder"="c:\windows\Creator\Remind_XP.exe" [2003-12-17 118784]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-08-20 155648]
"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2010-01-18 2033432]
"AlcxMonitor"="ALCXMNTR.EXE" [2004-09-07 57344]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
DSLMON.lnk - c:\program files\SAGEM\SAGEM [EMAIL="F@st"]F@st[/EMAIL] 800-840\dslmon.exe [2006-12-25 966756]
Exif Launcher.lnk - c:\program files\FinePixViewer\QuickDCF.exe [2004-8-29 200704]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2003-9-16 237568]
Picture Package Menu.lnk - c:\program files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe [2004-5-30 151552]
Picture Package VCD Maker.lnk - c:\program files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe [2004-5-30 106496]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [17/01/2010 21:06 333192]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [17/01/2010 21:06 360584]
R2 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [17/01/2010 21:05 906520]
R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [17/01/2010 21:05 285392]
.
Contents of the 'Scheduled Tasks' folder
2010-01-31 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-06 20:39]
2010-01-31 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-06 20:39]
2010-01-31 c:\windows\Tasks\HPpromotions journeysoftware.job
- c:\program files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe [2005-04-22 17:36]
2008-02-05 c:\windows\Tasks\McDefragTask.job
- c:\program files\mcafee\mqc\QcConsol.exe [2008-02-05 12:32]
2008-02-05 c:\windows\Tasks\McQcTask.job
- c:\program files\mcafee\mqc\QcConsol.exe [2008-02-05 12:32]
.
.

---

Supplementary Scan

---

.
uStart Page = hxxp://www.google.com
uDefault_Search_URL = hxxp://srch-qgb10.hpwis.com/
mSearch Bar = hxxp://srch-qgb10.hpwis.com/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
.
- - - - ORPHANS REMOVED - - - -
Toolbar-SITEguard - (no file)
HKCU-Run-RecordNow! - (no file)

**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-31 18:10
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2010-01-31 18:16:55
ComboFix-quarantined-files.txt 2010-01-31 18:16
Pre-Run: 59,369,205,760 bytes free
Post-Run: 59,908,321,280 bytes free
- - End Of File - - 6699190E0B158D5296A370C5846A79EC

Browntoa

Combofix did remove some stuff, alienRik will advise if anything else needs removing