After my fiance click some zango thing my comp went insane.
I already ran windows defender,AVG,trend micro,the microsoft malicious remover and several others. After reading the other posts on the subject and trying every one of em I still have the problem.
heres that data I collected. First is the Combofix report then the Hijack this report.
ComboFix 08-12-02.02 - Owner 2008-12-03 14:45:17.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2463 [GMT -6:00]
Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\ddcDwvTm.dll
c:\windows\system32\mTvwDcdd.ini
c:\windows\system32\mTvwDcdd.ini2
.
((((((((((((((((((((((((( Files Created from 2008-11-03 to 2008-12-03 )))))))))))))))))))))))))))))))
.
2008-12-03 11:50 . 2008-12-03 11:50 155 --a------ c:\windows\TmProxy.ini
2008-12-03 11:10 . 2008-02-18 14:05 138,384 --a------ c:\windows\SYSTEM32\DRIVERS\tmcomm.sys
2008-12-03 11:10 . 2008-02-18 14:05 52,496 --a------ c:\windows\SYSTEM32\DRIVERS\tmactmon.sys
2008-12-03 11:10 . 2008-02-18 14:05 52,240 --a------ c:\windows\SYSTEM32\DRIVERS\tmevtmgr.sys
2008-12-03 11:09 . 2008-12-03 11:25 <DIR> d-------- c:\program files\Trend Micro
2008-12-03 11:09 . 2008-12-03 11:09 <DIR> d-------- c:\documents and settings\All Users.WINDOWS\Application Data\Trend Micro
2008-12-03 09:45 . 2008-12-03 10:58 <DIR> d-------- c:\documents and settings\Owner\.housecall6.6
2008-12-03 09:22 . 2008-12-03 09:22 <DIR> d-------- c:\documents and settings\Administrator.MOUSE
2008-12-03 00:37 . 2008-12-03 03:02 <DIR> d--h-c--- C:\$AVG8.VAULT$
2008-12-03 00:35 . 2008-12-03 00:39 <DIR> d-------- c:\windows\SYSTEM32\DRIVERS\Avg
2008-12-03 00:35 . 2008-12-03 00:35 <DIR> d-------- c:\program files\AVG
2008-12-03 00:35 . 2008-12-03 00:35 <DIR> d-------- c:\documents and settings\All Users.WINDOWS\Application Data\avg8
2008-12-03 00:35 . 2008-12-03 00:35 98,440 --a------ c:\windows\SYSTEM32\DRIVERS\avgldx86.sys
2008-12-03 00:35 . 2008-12-03 00:35 90,632 --a------ c:\windows\SYSTEM32\DRIVERS\avgtdix.sys
2008-12-03 00:35 . 2008-12-03 00:35 12,936 --a------ c:\windows\SYSTEM32\DRIVERS\avgrkx86.sys
2008-12-03 00:35 . 2008-12-03 00:35 10,520 --a------ c:\windows\SYSTEM32\avgrsstx.dll
2008-12-03 00:24 . 2008-12-03 00:24 9,216 --ahs---- c:\windows\Thumbs.db
2008-12-03 00:22 . 2008-12-03 08:57 <DIR> d----c--- C:\a730d229c727c06994ad19412061d0f5
2008-12-02 23:52 . 2008-12-02 23:52 2 --a--c--- C:\1347789113
2008-12-02 23:51 . 2008-12-02 23:51 34,816 --a------ c:\windows\SYSTEM32\ljJBuuTN.dll
2008-11-30 23:12 . 2008-11-30 23:12 <DIR> d-------- c:\program files\Ventrilo
2008-11-30 23:12 . 2008-11-30 23:12 262 --a------ c:\windows\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
2008-11-29 16:19 . 2008-11-29 16:19 <DIR> d-------- c:\program files\WeGame
2008-11-29 16:19 . 2008-11-29 16:29 <DIR> d-------- c:\documents and settings\Owner\Application Data\WeGame
2008-11-29 16:19 . 2008-01-15 11:21 488,800 --a------ c:\windows\SYSTEM32\Ltkrn15u.dll
2008-11-29 16:19 . 2008-01-15 11:21 390,496 --a------ c:\windows\SYSTEM32\Lfcmp15u.dll
2008-11-29 16:19 . 2008-01-15 11:21 185,688 --a------ c:\windows\SYSTEM32\Ltfil15u.dll
2008-11-25 10:02 . 2008-08-14 04:11 2,189,184 -----c--- c:\windows\SYSTEM32\DLLCACHE\ntoskrnl.exe
2008-11-25 10:02 . 2008-08-14 04:09 2,145,280 -----c--- c:\windows\SYSTEM32\DLLCACHE\ntkrnlmp.exe
2008-11-25 10:02 . 2008-08-14 03:33 2,066,048 -----c--- c:\windows\SYSTEM32\DLLCACHE\ntkrnlpa.exe
2008-11-25 10:02 . 2008-08-14 03:33 2,023,936 -----c--- c:\windows\SYSTEM32\DLLCACHE\ntkrpamp.exe
2008-11-25 10:02 . 2008-09-15 06:12 1,846,400 -----c--- c:\windows\SYSTEM32\DLLCACHE\win32k.sys
2008-11-25 10:02 . 2008-09-08 04:41 333,824 -----c--- c:\windows\SYSTEM32\DLLCACHE\srv.sys
2008-11-25 10:01 . 2008-09-04 11:15 1,106,944 -----c--- c:\windows\SYSTEM32\DLLCACHE\msxml3.dll
2008-11-25 10:01 . 2008-10-24 05:21 455,296 -----c--- c:\windows\SYSTEM32\DLLCACHE\mrxsmb.sys
2008-11-25 10:01 . 2008-10-15 10:34 337,408 -----c--- c:\windows\SYSTEM32\DLLCACHE\netapi32.dll
2008-11-04 18:39 . 2008-11-04 18:39 <DIR> d-------- c:\documents and settings\Owner\Application Data\Ideazon
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-03 20:57 --------- d---a-w c:\documents and settings\All Users.WINDOWS\Application Data\TEMP
2008-12-01 05:12 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2008-11-27 15:01 --------- d-----w c:\program files\Microsoft Silverlight
2008-11-25 15:58 --------- d-----w c:\program files\OneStep
2008-11-16 01:52 --------- d-----w c:\documents and settings\Owner\Application Data\uTorrent
2008-11-13 07:13 --------- d-----w c:\program files\World of Warcraft
2008-11-09 02:57 --------- d-----w c:\documents and settings\Owner\Application Data\U3
2008-11-08 11:35 --------- d-----w c:\documents and settings\Owner\Application Data\LimeWire
2008-11-05 00:37 --------- d-----w c:\program files\Ideazon
2008-11-05 00:36 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-03 00:09 --------- d-----w c:\program files\FT8D91
2008-10-30 07:53 --------- d-----w c:\program files\DivX
2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-24 01:02 --------- d-----w c:\documents and settings\Owner\Application Data\Ventrilo
2008-10-16 20:13 202,776 ----a-w c:\windows\SYSTEM32\wuweb.dll
2008-10-16 20:13 1,809,944 ----a-w c:\windows\SYSTEM32\wuaueng.dll
2008-10-16 20:12 561,688 ----a-w c:\windows\SYSTEM32\wuapi.dll
2008-10-16 20:12 323,608 ----a-w c:\windows\SYSTEM32\wucltui.dll
2008-10-16 20:09 92,696 ----a-w c:\windows\SYSTEM32\cdm.dll
2008-10-16 20:09 51,224 ----a-w c:\windows\SYSTEM32\wuauclt.exe
2008-10-16 20:09 43,544 ----a-w c:\windows\SYSTEM32\wups2.dll
2008-10-16 20:08 34,328 ----a-w c:\windows\SYSTEM32\wups.dll
2008-10-16 20:06 268,648 ----a-w c:\windows\SYSTEM32\mucltui.dll
2008-10-16 20:06 208,744 ----a-w c:\windows\SYSTEM32\muweb.dll
2008-10-15 00:50 --------- d-----w c:\program files\Common Files\Blizzard Entertainment
2008-10-14 17:38 --------- d-----w c:\documents and settings\All Users.WINDOWS\Application Data\Blizzard
2008-10-09 20:51 --------- d-----w c:\documents and settings\Owner\Application Data\GPass-3
2008-10-09 20:01 --------- d-----w c:\program files\BellSouth
2008-10-09 20:01 --------- d-----w c:\documents and settings\All Users.WINDOWS\Application Data\Visual Networks
2008-10-09 00:43 --------- d-----w c:\program files\AviSynth 2.5
2008-10-09 00:41 --------- d-----w c:\program files\Gabest
2008-10-08 22:45 --------- d-----w c:\program files\Haali
2008-10-08 22:32 --------- d-----w c:\program files\LimeWire
2008-10-08 21:43 --------- d-----w c:\program files\Windows Live
2008-10-08 21:37 --------- d-----w c:\program files\Mozilla Thunderbird
2008-10-08 19:37 --------- d-----w c:\documents and settings\All Users.WINDOWS\Application Data\HP
2008-10-07 22:40 --------- d-----w c:\documents and settings\Owner\Application Data\HP
2008-10-07 22:40 --------- d-----w c:\documents and settings\All Users.WINDOWS\Application Data\WEBREG
2008-10-07 22:39 --------- d-----w c:\documents and settings\All Users.WINDOWS\Application Data\Hewlett-Packard
2008-10-04 23:57 --------- d-----w c:\program files\DAP
2008-10-04 23:57 --------- d-----w c:\documents and settings\All Users.WINDOWS\Application Data\SpeedBit
2008-09-30 22:43 1,286,152 ----a-w c:\windows\SYSTEM32\msxml4.dll
2008-09-19 21:55 200,704 ----a-w c:\windows\SYSTEM32\ssldivx.dll
2008-09-19 21:55 1,044,480 ----a-w c:\windows\SYSTEM32\libdivx.dll
2008-09-16 00:14 524,288 ----a-w c:\windows\SYSTEM32\DivXsm.exe
2008-09-16 00:14 3,596,288 ----a-w c:\windows\SYSTEM32\qt-dx331.dll
2008-09-16 00:12 81,920 ----a-w c:\windows\SYSTEM32\dpl100.dll
2008-09-16 00:12 593,920 ----a-w c:\windows\SYSTEM32\dpuGUI11.dll
2008-09-16 00:12 57,344 ----a-w c:\windows\SYSTEM32\dpv11.dll
2008-09-16 00:12 53,248 ----a-w c:\windows\SYSTEM32\dpuGUI10.dll
2008-09-16 00:12 344,064 ----a-w c:\windows\SYSTEM32\dpus11.dll
2008-09-16 00:12 294,912 ----a-w c:\windows\SYSTEM32\dpu11.dll
2008-09-16 00:12 294,912 ----a-w c:\windows\SYSTEM32\dpu10.dll
2008-09-16 00:12 196,608 ----a-w c:\windows\SYSTEM32\dtu100.dll
2008-09-16 00:11 823,296 ----a-w c:\windows\SYSTEM32\divx_xx0c.dll
2008-09-16 00:11 823,296 ----a-w c:\windows\SYSTEM32\divx_xx07.dll
2008-09-16 00:11 815,104 ----a-w c:\windows\SYSTEM32\divx_xx0a.dll
2008-09-16 00:11 802,816 ----a-w c:\windows\SYSTEM32\divx_xx11.dll
2008-09-16 00:11 683,520 ----a-w c:\windows\SYSTEM32\DivX.dll
2008-09-16 00:11 161,096 ----a-w c:\windows\SYSTEM32\DivXCodecVersionChecker.exe
2008-09-16 00:11 12,288 ----a-w c:\windows\SYSTEM32\DivXWMPExtType.dll
2008-09-15 12:12 1,846,400 ----a-w c:\windows\SYSTEM32\win32k.sys
2008-09-10 01:14 1,307,648 ----a-w c:\windows\SYSTEM32\msxml6.dll
2008-09-04 17:15 1,106,944 ----a-w c:\windows\SYSTEM32\msxml3.dll
2008-03-02 06:18 32 ----a-w c:\documents and settings\All Users.WINDOWS\Application Data\ezsid.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{12E9307D-CE72-43D5-A90D-A1742641C467}]
2008-12-03 15:01 302592 --a------ c:\windows\system32\opnonkLC.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C}]
2008-12-02 23:51 34816 --a------ c:\windows\system32\ljJBuuTN.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DownloadAccelerator"="c:\program files\DAP\DAP.EXE" [2008-10-04 3061248]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LXCCCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\LXCCtime.dll" [2005-01-10 69632]
"Zboard"="c:\program files\Ideazon\ZEngine\Zboard.exe" [2008-11-12 57344]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]
"{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C}"= "c:\windows\system32\ljJBuuTN.dll" [2008-12-02 34816]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ljJBuuTN]
2008-12-02 23:51 34816 c:\windows\SYSTEM32\ljJBuuTN.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 c:\windows\system32\opnonkLC
[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^WeGame.lnk]
path=c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\Startup\WeGame.lnk
backup=c:\windows\pss\WeGame.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Windows Search.lnk]
path=c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\Startup\Windows Search.lnk
backup=c:\windows\pss\Windows Search.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^IMVU.lnk]
path=c:\documents and settings\Owner\Start Menu\Programs\Startup\IMVU.lnk
backup=c:\windows\pss\IMVU.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^YouTube Uploader.lnk]
path=c:\documents and settings\Owner\Start Menu\Programs\Startup\YouTube Uploader.lnk
backup=c:\windows\pss\YouTube Uploader.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^YPOPs.lnk]
path=c:\documents and settings\Owner\Start Menu\Programs\Startup\YPOPs.lnk
backup=c:\windows\pss\YPOPs.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 21:16 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater]
--a------ 2008-12-03 09:48 2356088 c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG8_TRAY]
--a------ 2008-12-03 00:35 1261336 c:\progra~1\AVG\AVG8\avgtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2008-04-13 18:12 15360 c:\windows\SYSTEM32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CurseClient]
--a------ 2008-10-15 01:15 4789760 c:\program files\Curse\CurseClient.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DownloadAccelerator]
--a------ 2008-10-04 17:57 3061248 c:\program files\DAP\DAP.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
--a----t- 2008-05-19 00:29 51184 c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\1.1.25.0\GoogleUpdate.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
--a------ 2005-07-07 22:55 176128 c:\windows\SYSTEM32\SPOOL\DRIVERS\W32X86\3\hpztsb09.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHmon05]
--a------ 2005-07-07 22:55 491520 c:\windows\SYSTEM32\hphmon05.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHUPD05]
--a------ 2005-07-07 22:55 49152 c:\program files\Hewlett-Packard\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\hphupd05.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
--a------ 2006-03-23 19:13 77824 c:\windows\SYSTEM32\hkcmd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]
--a------ 2006-03-23 19:17 118784 c:\windows\SYSTEM32\igfxpers.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]
--a------ 2006-03-23 19:17 94208 c:\windows\SYSTEM32\igfxtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
--a------ 2004-08-04 06:00 208952 c:\windows\IME\IMJP8_1\imjpmig.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IPInSightLAN 01]
--a------ 2003-06-11 13:52 380928 c:\program files\BellSouth\Connection Tool\IPClient.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IPInSightMonitor 01]
--a------ 2003-06-11 13:52 122880 c:\program files\BellSouth\Connection Tool\ipmon32.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lxccmon.exe]
--a------ 2005-02-21 06:21 192512 c:\program files\Lexmark 3300 Series\lxccmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 09:50 155648 c:\windows\SYSTEM32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
--a------ 2004-08-04 06:00 455168 c:\windows\SYSTEM32\IME\TINTLGNT\TINTSETP.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
--a------ 2004-08-04 06:00 455168 c:\windows\SYSTEM32\IME\TINTLGNT\TINTSETP.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-01-31 22:13 385024 c:\program files\QuickTime\QTTask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--a------ 2003-10-31 19:42 32768 c:\program files\CyberLink\PowerDVD\PDVDServ.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\snpstd]
--a------ 2003-12-31 17:39 40960 c:\windows\vsnpstd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2008-06-10 03:27 144784 c:\program files\Java\jre1.6.0_07\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UfSeAgnt.exe]
--a------ 2008-07-29 14:57 1398024 c:\program files\Trend Micro\Internet Security\UfSeAgnt.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Veoh]
--a------ 2008-08-28 10:18 3660848 c:\program files\Veoh Networks\Veoh\VeohClient.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
--a------ 2006-11-03 18:20 866584 c:\program files\Windows Defender\MSASCui.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\WINDOWS\\SYSTEM32\\javaw.exe"=
"c:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"=
"c:\\WINDOWS\\SYSTEM32\\dpvsetup.exe"=
"c:\\Program Files\\Curse\\CurseClient.exe"=
"c:\\Documents and Settings\\Owner\\Desktop\\UnrealTournament\\System\\UnrealTournament.exe"=
"c:\\Program Files\\DAP\\DAP.exe"=
"c:\\Program Files\\World of Warcraft\\Launcher.exe"=
"c:\\Program Files\\uTorrent\\utorrent.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.0.2.9056-to-3.0.3.9183-enUS-downloader.exe"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgam.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:WOW
"3724:UDP"= 3724:UDP:WOW VOICE
R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\Drivers\avgrkx86.sys [2008-12-03 12936]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-12-03 98440]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2008-12-03 90632]
R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-12-03 874776]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-12-03 231704]
R2 tmevtmgr;tmevtmgr;\??\c:\windows\system32\drivers\tmevtmgr.sys [2008-12-03 52240]
R2 tmpreflt;tmpreflt;c:\windows\system32\DRIVERS\tmpreflt.sys [2008-02-18 36368]
R3 Alpham1;Ideazon ZBoard USB Human Interface Device;c:\windows\system32\DRIVERS\Alpham1.sys [2007-07-23 42624]
R3 Alpham2;Ideazon ZBoard MM USB Human Interface Device;c:\windows\system32\DRIVERS\Alpham2.sys [2007-03-20 18432]
R3 MAC607;MAC607 Filter;c:\windows\system32\DRIVERS\MAC607.sys [2008-11-02 23808]
R3 tmproxy;Trend Micro Proxy Service;"c:\program files\Trend Micro\Internet Security\TmProxy.exe" [2008-12-03 648456]
S2 WinDefend;Windows Defender;"c:\program files\Windows Defender\MsMpEng.exe" [2006-11-03 13592]
S3 ASPI;Advanced SCSI Programming Interface Driver;\??\c:\windows\System32\DRIVERS\ASPI32.sys [2008-10-08 16512]
S3 USB-100;USB 10/100 Ethernet Adapter;c:\windows\system32\DRIVERS\USBER100.SYS [2008-02-05 23938]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{66d9f98d-fe86-11dc-8e22-001143b39db1}]
\Shell\AutoRun\command - E:\LaunchU3.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{add7efdc-8d15-11dd-8e9d-001143b39db1}]
\Shell\AutoRun\command - E:\rcaeasyrip_setup.exe
\Shell\install\command - E:\rcaeasyrip_setup.exe
\Shell\usermanualEnglish\command - E:\rcaeasyrip_setup.exe /pdf_English
\Shell\usermanualFrench\command - E:\rcaeasyrip_setup.exe /pdf_French
\Shell\usermanualSpanish\command - E:\rcaeasyrip_setup.exe /pdf_Spanish
.
Contents of the 'Scheduled Tasks' folder
2008-12-03 c:\windows\Tasks\HP Usg Daily.job
- c:\program files\Hewlett-Packard\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\pexpress\hphped05.exe [2005-07-07 22:55]
.
- - - - ORPHANS REMOVED - - - -
BHO-{EF9C5273-47F9-4F1E-802A-ACC336780542} - c:\windows\system32\ddcDwvTm.dll
.
------- Supplementary Scan -------
.
FireFox -: Profile - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\9zqf49fo.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.com/ig?hl=en#
FF -: plugin - c:\program files\DivX\DivX Content Uploader\npUpload.dll
FF -: plugin - c:\program files\Microsoft Silverlight\2.0.31005.0\npctrl.1.0.30716.0.dll
FF -: plugin - c:\program files\Microsoft Silverlight\2.0.31005.0\npctrl.dll
FF -: plugin - c:\program files\Veoh Networks\Veoh\Plugins\noreg\NPVeohVersion.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-03 14:55:00
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
LXCCCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\LXCCtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
scanning hidden files ...
c:\windows\TEMP\6e3ed996-a8c7-4bf9-bc8e-fb7a989af376.tmp 0 bytes
c:\windows\TEMP\b23dc233-9252-4664-ad38-9106d8bf28fe.tmp 0 bytes
scan completed successfully
hidden files: 2
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(628)
c:\windows\system32\ljJBuuTN.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Trend Micro\Internet Security\SfCtlCom.exe
c:\program files\Analog Devices\SoundMAX\spkrmon.exe
c:\windows\SYSTEM32\searchindexer.exe
c:\program files\Trend Micro\BM\TMBMSRV.exe
c:\progra~1\AVG\AVG8\avgam.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\windows\SYSTEM32\wscntfy.exe
c:\windows\SYSTEM32\searchprotocolhost.exe
c:\windows\SYSTEM32\rundll32.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\windows\SYSTEM32\searchfilterhost.exe
.
**************************************************************************
.
Completion time: 2008-12-03 15:04:07 - machine was rebooted
ComboFix-quarantined-files.txt 2008-12-03 21:03:50
ComboFix2.txt 2008-12-03 18:25:50
Pre-Run: 42,786,918,400 bytes free
Post-Run: 42,781,442,048 bytes free
320 --- E O F --- 2008-11-27 08:49:54
HIJACKTHIS REPORT
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:20, on 12/3/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Trend Micro\BM\TMBMSRV.exe
C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Ideazon\ZEngine\Zboard.exe
C:\Program Files\DAP\DAP.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=56626&homepage=http://search.speedbit.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O4 - HKLM\..\Run: [LXCCCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCCtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [Zboard] C:\Program Files\Ideazon\ZEngine\Zboard.exe
O4 - HKCU\..\Run: [DownloadAccelerator] "C:\Program Files\DAP\DAP.EXE" /STARTUP
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Owner\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.amaena.com
O15 - Trusted Zone: *.antimalwareguard.com
O15 - Trusted Zone: *.antispyexpert.com
O15 - Trusted Zone: *.avsystemcare.com
O15 - Trusted Zone: *.gomyhit.com
O15 - Trusted Zone: *.imagesrvr.com
O15 - Trusted Zone: *.onerateld.com
O15 - Trusted Zone: *.safetydownload.com
O15 - Trusted Zone: *.spyguardpro.com
O15 - Trusted Zone: *.storageguardsoft.com
O15 - Trusted Zone: *.trustedantivirus.com
O15 - Trusted Zone: *.virusremover2008.com
O15 - Trusted Zone: *.virusschlacht.com
O15 - Trusted Zone: *.amaena.com (HKLM)
O15 - Trusted Zone: *.antimalwareguard.com (HKLM)
O15 - Trusted Zone: *.antispyexpert.com (HKLM)
O15 - Trusted Zone: *.avsystemcare.com (HKLM)
O15 - Trusted Zone: *.gomyhit.com (HKLM)
O15 - Trusted Zone: *.imageservr.com (HKLM)
O15 - Trusted Zone: *.imagesrvr.com (HKLM)
O15 - Trusted Zone: *.onerateld.com (HKLM)
O15 - Trusted Zone: *.safetydownload.com (HKLM)
O15 - Trusted Zone: *.spyguardpro.com (HKLM)
O15 - Trusted Zone: *.storageguardsoft.com (HKLM)
O15 - Trusted Zone: *.trustedantivirus.com (HKLM)
O15 - Trusted Zone: *.virusremover2008.com (HKLM)
O15 - Trusted Zone: *.virusschlacht.com (HKLM)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: lxcc_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxcccoms.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Trend Micro Central Control Component (SfCtlCom) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
O23 - Service: spkrmon - Unknown owner - C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
O23 - Service: Trend Micro Unauthorized Change Prevention Service (TMBMServer) - Trend Micro Inc. - C:\Program Files\Trend Micro\BM\TMBMSRV.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
--
End of file - 6003 bytes
Please help me try and fix this I'm losing WoW time lol