please look at my logs regarding adware

Question

adam444 0 Newbie Poster

14 Years Ago

-Anytime i do a search in a search engine, i click on a link and it redirects me to an advertisment. Im not clicking on a advertisment.

-also i see this exclamation point on a yellow shield down in my taskbar near the clock. when i put my mouse over it. it says downloading updates 0%. always says 0%. also I cannot click on it to open it. It looks like one of those windows updates things. It comes and goes.

Thank you

-adam

I have my 2 DDS logs zipped. my 2 GMER logs zipped. plus my MB A-M log. and i did the ATF cleaner.

i also have AVG 9, spybot/teatimer and highjack this as a FYI.

windows-virus

This attachment is potentially unsafe to open. It may be an executable that is capable of making changes to your file system, or it may require specific software to open. Use caution and only open this attachment if you are comfortable working with zip files.

dds_files.zip (10.74 KB)

This attachment is potentially unsafe to open. It may be an executable that is capable of making changes to your file system, or it may require specific software to open. Use caution and only open this attachment if you are comfortable working with zip files.

gmer.zip (1.55 KB)

mbam-log-2010-08-22_(11-58-13).txt (1.02 KB)

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4460

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

8/22/2010 11:58:13 AM
mbam-log-2010-08-22 (11-58-13).txt

Scan type: Full scan (C:\|)
Objects scanned: 228101
Time elapsed: 1 hour(s), 29 minute(s), 13 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\System Volume Information\_restore{D296143C-1E0D-4768-97F5-97E08A2F16CC}\RP1470\A0251616.DLL (PUP.FunWebProducts) -> Quarantined and deleted successfully.

2 Contributors
9 Replies
204 Views
2 Days Discussion Span
Latest Post 14 Years Ago Latest Post by crunchie

crunchie 990 Most Valuable Poster

14 Years Ago

Sorry, but I am not going to be opening any zip files from an infected pc.
Please paste the logs into your reply and I will take a look then.

crunchie 990 Most Valuable Poster

14 Years Ago

DDS (Ver_10-03-17.01)
sorry the instructions in the "view before requesting help" says to zip files.
also it wouldn't let me attach .log files. but i pasted everything as you requested.

Actually, nowhere in those instructions are there any directions to zip the files up. Here is what is written;

When you post your request for assistance, please be sure to submit (Copy & Paste) these requested scanlogs:

I am looking at the logs now.

crunchie 990 Most Valuable Poster

14 Years Ago

DDS is not running from the desktop as requested. Please move it to the desktop.

Please download ComboFix by sUBs from HERE or HERE

You must download it to and run it from your Desktop
Physically disconnect from the internet.
Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
Double click combofix.exe & follow the prompts.
When finished, it will produce a log. Please save that log to post in your next reply.
Re-enable all the programs that were disabled during the running of ComboFix..

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Run Combofix ONCE only!!

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

adam444 0 Newbie Poster · Answer 1 · 2010-08-24T03:10:16+00:00

DDS (Ver_10-03-17.01)
sorry the instructions in the "view before requesting help" says to zip files.
also it wouldn't let me attach .log files. but i pasted everything as you requested.

DDS ATTACH file.

Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume1
Install Date: 10/5/2005 12:57:06 AM
System Uptime: 8/21/2010 8:27:14 PM (3 hours ago)

Motherboard: Intel Corporation | | D845HV
Processor: Intel(R) Pentium(R) 4 CPU 1.50GHz | J2E1 | 1495/100mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 75 GiB total, 41.817 GiB free.
D: is CDROM ()
E: is CDROM ()
F: is FIXED (NTFS) - 19 GiB total, 0.406 GiB free.

==== Disabled Device Manager Items =============

Class GUID: {4D36E96C-E325-11CE-BFC1-08002BE10318}
Description: Unimodem Half-Duplex Audio Device
Device ID: MODEMWAVE\0\{76AF5771-AEEA-4946-91DC-8376D2D3156C}
Manufacturer: Microsoft
Name: Unimodem Half-Duplex Audio Device
PNP Device ID: MODEMWAVE\0\{76AF5771-AEEA-4946-91DC-8376D2D3156C}
Service: MODEMCSA

Class GUID: {4D36E96F-E325-11CE-BFC1-08002BE10318}
Description: Microsoft PS/2 Mouse
Device ID: ACPI\PNP0F03\4&163C0F35&0
Manufacturer: Microsoft
Name: Microsoft PS/2 Mouse
PNP Device ID: ACPI\PNP0F03\4&163C0F35&0
Service: i8042prt

==== System Restore Points ===================

RP1403: 5/21/2010 7:57:30 PM - System Checkpoint
RP1404: 5/23/2010 2:09:48 PM - System Checkpoint
RP1405: 5/25/2010 10:33:52 AM - System Checkpoint
RP1406: 5/26/2010 2:18:36 PM - System Checkpoint
RP1407: 5/26/2010 2:33:01 PM - Software Distribution Service 3.0
RP1408: 5/27/2010 2:50:40 PM - System Checkpoint
RP1409: 5/28/2010 3:46:08 PM - System Checkpoint
RP1410: 5/29/2010 4:49:30 PM - System Checkpoint
RP1411: 5/31/2010 9:39:41 AM - Avg Update
RP1412: 6/1/2010 9:50:20 AM - System Checkpoint
RP1413: 6/2/2010 2:12:01 PM - System Checkpoint
RP1414: 6/3/2010 7:08:02 PM - System Checkpoint
RP1415: 6/5/2010 8:28:52 AM - Software Distribution Service 3.0
RP1416: 6/6/2010 12:48:22 PM - System Checkpoint
RP1417: 6/7/2010 1:08:26 PM - System Checkpoint
RP1418: 6/9/2010 7:01:03 AM - Software Distribution Service 3.0
RP1419: 6/12/2010 9:26:33 AM - System Checkpoint
RP1420: 6/13/2010 12:00:44 PM - System Checkpoint
RP1421: 6/14/2010 4:43:41 PM - System Checkpoint
RP1422: 6/15/2010 6:28:17 PM - System Checkpoint
RP1423: 6/17/2010 12:26:18 PM - System Checkpoint
RP1424: 6/18/2010 1:15:25 PM - System Checkpoint
RP1425: 6/19/2010 1:40:12 PM - System Checkpoint
RP1426: 6/20/2010 8:52:23 PM - System Checkpoint
RP1427: 6/21/2010 11:14:52 AM - Avg Update
RP1428: 6/21/2010 11:20:30 AM - Avg Update
RP1429: 6/22/2010 12:40:08 PM - System Checkpoint
RP1430: 6/23/2010 1:53:24 PM - System Checkpoint
RP1431: 6/23/2010 2:41:50 PM - Software Distribution Service 3.0
RP1432: 6/24/2010 3:14:32 PM - System Checkpoint
RP1433: 6/25/2010 3:40:19 PM - System Checkpoint
RP1434: 6/26/2010 3:48:21 PM - System Checkpoint
RP1435: 6/27/2010 8:01:07 PM - System Checkpoint
RP1436: 6/28/2010 10:16:00 AM - Avg Update
RP1437: 6/28/2010 10:17:06 AM - Avg Update
RP1438: 6/29/2010 11:49:47 AM - System Checkpoint
RP1439: 6/30/2010 3:59:06 PM - System Checkpoint
RP1440: 7/1/2010 8:34:30 PM - System Checkpoint
RP1441: 7/2/2010 9:30:31 PM - System Checkpoint
RP1442: 7/4/2010 12:28:37 PM - System Checkpoint
RP1443: 7/5/2010 3:07:26 PM - System Checkpoint
RP1444: 7/7/2010 2:16:52 PM - System Checkpoint
RP1445: 7/13/2010 1:34:59 PM - System Checkpoint
RP1446: 7/13/2010 5:09:07 PM - Software Distribution Service 3.0
RP1447: 7/16/2010 1:22:58 PM - System Checkpoint
RP1448: 7/17/2010 2:14:31 PM - System Checkpoint
RP1449: 7/18/2010 11:28:04 PM - System Checkpoint
RP1450: 7/20/2010 9:12:23 AM - System Checkpoint
RP1451: 7/21/2010 8:45:50 AM - Avg Update
RP1452: 7/22/2010 2:47:11 PM - System Checkpoint
RP1453: 7/23/2010 5:34:44 PM - System Checkpoint
RP1454: 7/27/2010 2:11:11 PM - System Checkpoint
RP1455: 7/28/2010 3:14:40 PM - System Checkpoint
RP1456: 7/29/2010 9:38:34 PM - System Checkpoint
RP1457: 7/31/2010 11:46:51 AM - System Checkpoint
RP1458: 8/1/2010 1:18:21 PM - System Checkpoint
RP1459: 8/2/2010 8:40:35 PM - Software Distribution Service 3.0
RP1460: 8/4/2010 2:10:52 PM - System Checkpoint
RP1461: 8/5/2010 8:24:53 PM - Removed Bonjour
RP1462: 8/5/2010 8:25:58 PM - Removed Microsoft Silverlight
RP1463: 8/7/2010 11:54:27 AM - System Checkpoint
RP1464: 8/9/2010 9:19:54 AM - System Checkpoint
RP1465: 8/10/2010 12:40:31 PM - System Checkpoint
RP1466: 8/11/2010 2:31:35 PM - System Checkpoint
RP1467: 8/12/2010 6:28:57 PM - System Checkpoint
RP1468: 8/13/2010 9:21:47 PM - System Checkpoint
RP1469: 8/16/2010 10:23:47 PM - System Checkpoint
RP1470: 8/16/2010 11:32:01 PM - Avg Update
RP1471: 8/17/2010 11:40:56 PM - System Checkpoint
RP1472: 8/19/2010 1:40:48 AM - System Checkpoint
RP1473: 8/21/2010 6:53:38 PM - Installed HiJackThis
RP1474: 8/21/2010 11:20:29 PM - Removed OBD2 DTC Lookup Tool

==== Installed Programs ======================

4300
4300_Help
4300Trb
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 7.1.0
Adobe Shockwave Player 11
AiO_Scan_CDA
AiOSoftwareNPI
Apple Mobile Device Support
Apple Software Update
aspi
ATI Display Driver
AVG 9.0
Bing Maps 3D
BufferChm
Citrix Presentation Server Web Client for Win32
CP_Package_Variety1
CP_Package_Variety2
CP_Package_Variety3
Critical Update for Windows Media Player 11 (KB959772)
dBpowerAMP Music Converter
Destinations
DeviceManagementQFolder
dMC Power Pack
DocProc
DVD Player
Easy CD Creator 5 Basic
EPSON Printer Software
ESSAdpt
ESSANUP
ESSBrwr
ESSCAM
ESSCDBK
ESScore
ESSCT
ESSgui
ESShelp
ESSini
ESSPCD
ESSTUTOR
ESSvpaht
ESSvpot
eSupportQFolder
Fax_CDA
Firebird SQL Server - MAGIX Edition 2.0.0.1 (US)
GdiplusUpgrade
Google Earth
Google Toolbar for Internet Explorer
HiJackThis
HLPCCTR
HLPIndex
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
HP Imaging Device Functions 6.1
HP Photosmart Essential
HP PrecisionScan LTX
HP PSC & OfficeJet 6.1.A
HP Solution Center and Imaging Support Tools 6.1
HP Update
HPProductAssistant
Image Web Server IE Plugins 2,0,0,104
iTunes
J2SE Runtime Environment 5.0 Update 10
J2SE Runtime Environment 5.0 Update 5
J2SE Runtime Environment 5.0 Update 9
Java(TM) 6 Update 17
Java(TM) 6 Update 3
Java(TM) 6 Update 5
Java(TM) 6 Update 7
KaraFun 1.18
Kodak EasyShare software
LimeWire 5.5.9
MAGIX Goya burnR 1.3.1.2 (US)
MAGIX Movie Edit Pro 12 6.5.4.0 (US)
Malwarebytes' Anti-Malware
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Image Composer 1.0
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Excel MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Standard 2007
Microsoft Office Standard 2007 Trial
Microsoft Office Word MUI (English) 2007
Microsoft Software Update for Web Folders (English) 12
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft VC9 runtime libraries
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Web Publishing Wizard 1.52
Microsoft Word 2002
Microsoft Works 2002 Setup Launcher
Microsoft Works 6.0
Microsoft XML Parser
Microsoft XML Parser and SDK
Mozilla Firefox (3.6.4)
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
NewCopy_CDA
Notifier
OTtBP
PCDLNCH
ProductContextNPI
Quicken 2004
QuickTime
Readme
RealPlayer
RealUpgrade 1.0
Samsung Master
Samsung USB Driver
Scan
ScannerCopy
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB976321)
Security Update for 2007 Microsoft Office System (KB982312)
Security Update for 2007 Microsoft Office System (KB982331)
Security Update for Microsoft Office Excel 2007 (KB982308)
Security Update for Microsoft Office InfoPath 2007 (KB979441)
Security Update for Microsoft Office Outlook 2007 (KB980376)
Security Update for Microsoft Office PowerPoint 2007 (KB982158)
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB969613)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Security Update for Microsoft Office Word 2007 (KB982135)
Security Update for Windows Internet Explorer 7 (KB928090)
Security Update for Windows Internet Explorer 7 (KB929969)
Security Update for Windows Internet Explorer 7 (KB931768)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 7 (KB969897)
Security Update for Windows Internet Explorer 8 (KB969897)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB972260)
Security Update for Windows Internet Explorer 8 (KB974455)
Security Update for Windows Internet Explorer 8 (KB976325)
Security Update for Windows Internet Explorer 8 (KB978207)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 10 (KB936782)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB917734)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
SFR
SFR2
SolutionCenter
Sound Blaster Live! Value
Spybot - Search & Destroy
Status
Toolbox
TrayApp
Unload
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Outlook 2007 Junk Email Filter (kb2202131)
Update for Windows Internet Explorer 8 (KB971930)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows Internet Explorer 8 (KB976749)
Update for Windows Internet Explorer 8 (KB980182)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
VCAMCEN
WebFldrs XP
WebReg
Windows Backup Utility
Windows Genuine Advantage Notifications (KB905474)
Windows Imaging Component
Windows Internet Explorer 7
Windows Internet Explorer 8
Windows Media Format 11 runtime
Windows Media Player 11
Windows XP Service Pack 3
WinZip
Works Suite OS Pack
Works Synchronization
Yahoo! Install Manager
Yahoo! Internet Mail
Yahoo! Messenger
Yahoo! Search Protection
Yahoo! Software Update

==== Event Viewer Messages From Past Week ========

8/21/2010 11:20:35 PM, error: Service Control Manager [7023] - The Application Management service terminated with the following error: The specified module could not be found.
8/21/2010 10:12:04 AM, error: Dhcp [1002] - The IP address lease 192.168.1.33 for the Network Card with network address 000347B3D8C9 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).
8/20/2010 1:18:57 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the stisvc service.
8/18/2010 5:12:09 AM, error: Service Control Manager [7034] - The DNS Client service terminated unexpectedly. It has done this 1 time(s).
8/18/2010 5:11:50 AM, error: Service Control Manager [7031] - The Remote Procedure Call (RPC) service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Reboot the machine.
8/18/2010 5:11:46 AM, error: Service Control Manager [7034] - The WebClient service terminated unexpectedly. It has done this 1 time(s).
8/18/2010 5:11:39 AM, error: Service Control Manager [7034] - The TCP/IP NetBIOS Helper service terminated unexpectedly. It has done this 1 time(s).
8/18/2010 5:11:39 AM, error: Service Control Manager [7034] - The SSDP Discovery Service service terminated unexpectedly. It has done this 1 time(s).
8/17/2010 4:33:13 PM, error: Service Control Manager [7034] - The Viewpoint Manager Service service terminated unexpectedly. It has done this 1 time(s).
8/17/2010 11:11:34 AM, error: Service Control Manager [7023] - The Network Security service terminated with the following error: The specified module could not be found.
8/17/2010 11:11:34 AM, error: Service Control Manager [7000] - The AOL Connectivity Service service failed to start due to the following error: The system cannot find the path specified.
8/17/2010 11:10:21 AM, error: Ftdisk [49] - Configuring the Page file for crash dump failed. Make sure there is a page file on the boot partition and that is large enough to contain all physical memory.
8/17/2010 11:10:21 AM, error: Ftdisk [45] - The system could not sucessfully load the crash dump driver.

==== End Of File ===========================

DDS (Ver_10-03-17.01) - NTFSx86
Run by Adam and Jessica at 23:25:23.07 on Sat 08/21/2010
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_17
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1279.465 [GMT -5:00]

AV: AVG Internet Security *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: AVG Firewall *enabled* {8decf618-9569-4340-b34a-d78d28969b66}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AVG\AVG9\Identity Protection\Agent\Bin\AVGIDSAgent.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\atiptaxx.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\AVG\AVG9\avgfws9.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\Program Files\AVG\AVG9\Identity Protection\agent\bin\avgidsmonitor.exe
C:\Program Files\AVG\AVG9\avgam.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
svchost.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\SYSTEM32\taskmgr.exe
C:\Documents and Settings\Adam and Jessica\Local Settings\Temporary Internet Files\Content.IE5\QFT8ZVC8\dds[1].scr

============== Pseudo HJT Report ===============

uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mSearch Page =
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyServer = http=127.0.0.1:5555
uInternet Settings,ProxyOverride = <local>
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
mSearchAssistant = hxxp://www.google.com/ie
mURLSearchHooks: H - No File
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
TB: {4982D40A-C53B-4615-B15B-B5B5E98D167C} - No File
TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File
TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar2.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [cdloader] "c:\documents and settings\adam and jessica\application data\mjusbsp\cdloader2.exe" MAGICJACK
uRun: [Search Protection] c:\program files\yahoo!\search protection\SearchProtection.exe
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRunOnce: [Shockwave Updater] c:\windows\system32\adobe\shockw~1\SWHELP~1.EXE -Update -1100465 -"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" -"http://woz.commtechlab.msu.edu/courses/447sp04/oregontrail/play.htm"
mRun: [WorksFUD] c:\program files\microsoft works\wkfud.exe
mRun: [Microsoft Works Portfolio] c:\program files\microsoft works\WksSb.exe /AllUsers
mRun: [Microsoft Works Update Detection] c:\program files\common files\microsoft shared\works shared\WkUFind.exe
mRun: [AudioHQ] c:\program files\creative\sblive\audiohq\AHQTB.EXE
mRun: [UpdReg] c:\windows\Updreg.exe
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [AtiPTA] atiptaxx.exe
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [YSearchProtection] "c:\program files\yahoo!\search protection\SearchProtection.exe"
mRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exe
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\kodake~1.lnk - c:\program files\kodak\kodak easyshare software\bin\EasyShare.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~2.lnk - c:\program files\microsoft office\office10\OSA.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\common files\microsoft shared\works shared\wkcalrem.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\quicke~1.lnk - c:\program files\quicken\bagent.exe
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - c:\program files\yahoo!\messenger\YahooMessenger.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
DPF: {0DB074F0-617E-4EE9-912C-2965CF2AA5A4} - hxxp://download.microsoft.com/download/a/f/b/afba1967-2025-49da-8356-bc4132038945/VirtualEarth3D.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} - hxxps://secure.netlinksolution.com/includes/icaweb.cab
DPF: {3BB1D69B-A780-4BE1-876E-F3D488877135} - hxxp://download.microsoft.com/download/3/B/E/3BE57995-8452-41F1-8297-DD75EF049853/VirtualEarth3D.cab
DPF: {48DD0448-9209-4F81-9F6D-D83562940134} - hxxp://lads.myspace.com/upload/MySpaceUploader1006.cab
DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} - hxxp://upload.facebook.com/controls/FacebookPhotoUploader.cab
DPF: {7160FB1B-3DE0-4C42-81F0-41B4269990B0} - hxxp://fdl.msn.com/public/investor/v12/ticker.cab
DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_05-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: SHHooks Class: {8af37f72-e87e-471c-b5be-15f07e6d61b9} - c:\progra~1\common~1\aolshare\coach\AolHook.dll
Hosts: 127.0.0.1 www.spywareinfo.com

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\adaman~1\applic~1\mozilla\firefox\profiles\3hiaok0j.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?fr=ffsp1&p=
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=ffds1&p=
FF - component: c:\program files\avg\avg9\firefox\components\avgssff.dll
FF - plugin: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\mozillaplugins\nprphtml5videoshim.dll
FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll
FF - plugin: c:\program files\virtual earth 3d\npVE3D.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - truec:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 10);
c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R0 AVGIDSErHrxpx;AVG9IDSErHr;c:\windows\system32\drivers\AVGIDSxx.sys [2010-1-20 25168]
R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2010-1-20 52872]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2010-1-20 216400]
R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2010-1-20 29584]
R1 AvgTdiX;AVG Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2010-1-20 243024]
R2 ACEDRV08;ACEDRV08;c:\windows\system32\drivers\ACEDRV08.sys [2007-12-21 108768]
R2 avg9wd;AVG WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2010-6-21 308136]
R2 avgfws9;AVG Firewall;c:\program files\avg\avg9\avgfws9.exe [2010-6-21 2331032]
R2 AVGIDSAgent;AVG9IDSAgent;c:\program files\avg\avg9\identity protection\agent\bin\AVGIDSAgent.exe [2010-6-21 5897808]
R3 Avgfwdx;Avgfwdx;c:\windows\system32\drivers\avgfwdx.sys [2010-1-20 30104]
R3 AVGIDSDriverxpx;AVG9IDSDriver;c:\program files\avg\avg9\identity protection\agent\driver\platform_xp\AVGIDSDriver.sys [2010-1-20 122448]
R3 AVGIDSFilterxpx;AVG9IDSFilter;c:\program files\avg\avg9\identity protection\agent\driver\platform_xp\AVGIDSFilter.sys [2010-1-20 30288]
R3 AVGIDSShimxpx;AVG9IDSShim;c:\program files\avg\avg9\identity protection\agent\driver\platform_xp\AVGIDSShim.sys [2010-1-20 26192]
R3 ES1370;Creative AudioPCI (ES1370), SB PCI 64/128 (WDM);c:\windows\system32\drivers\es1370mp.sys [2006-10-24 37120]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2010-8-21 38224]
S3 Avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwdx.sys [2010-1-20 30104]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\magix\common\database\bin\fbserver.exe [2007-12-21 1527900]
S3 iscFlash;iscFlash;\??\c:\windows\system32\drivers\iscflash.sys --> c:\windows\system32\drivers\iscflash.sys [?]
S3 mgau;mgau;c:\windows\system32\drivers\mgaum.sys [2009-2-19 320384]
S3 UPnPService;UPnPService;c:\program files\common files\magix shared\upnpservice\UPnPService.exe [2007-12-21 544768]

=============== Created Last 30 ================

2010-08-21 23:53:40 0 d-----w- c:\program files\Trend Micro
2010-08-21 23:07:15 0 d-----w- c:\docume~1\adaman~1\applic~1\Malwarebytes
2010-08-21 23:06:41 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-08-21 23:06:39 0 d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
2010-08-21 23:06:35 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-08-21 23:06:35 0 d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-08-17 23:27:11 511 ----a-w- c:\windows\wininit.ini
2010-08-17 21:42:36 0 d-----w- c:\program files\Spybot - Search & Destroy
2010-08-17 21:42:36 0 d-----w- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
2010-08-11 00:58:38 0 d-----w- c:\windows\pss
2010-08-11 00:37:07 0 d-----w- c:\docume~1\adaman~1\applic~1\FC2856569707B55FB110594C5EF5A957
2010-08-07 17:21:47 0 d-----w- c:\windows\system32\color

==================== Find3M ====================

2010-06-21 16:18:34 12536 ----a-w- c:\windows\system32\avgrsstx.dll
2008-02-03 06:06:46 16 ---ha-w- c:\program files\mxfilerelatedcache.mxc2
2008-11-07 01:01:05 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008110620081107\index.dat

============= FINISH: 23:29:21.39 ===============

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit quick scan 2010-08-21 23:36:47
Windows 5.1.2600 Service Pack 3
Running: 3xq4v5t9.exe; Driver: C:\DOCUME~1\ADAMAN~1\LOCALS~1\Temp\awldapow.sys

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs AVGIDSFilter.sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat AVGIDSFilter.sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )
AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

Device -> \Driver\atapi \Device\Harddisk0\DR0 8A194EC5

---- Files - GMER 1.0.15 ----

File C:\WINDOWS\system32\drivers\atapi.sys suspicious modification

---- EOF - GMER 1.0.15 ----

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-08-22 11:47:55
Windows 5.1.2600 Service Pack 3
Running: 3xq4v5t9.exe; Driver: C:\DOCUME~1\ADAMAN~1\LOCALS~1\Temp\awldapow.sys

---- System - GMER 1.0.15 ----

SSDT \??\C:\Program Files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSShim.sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwOpenProcess [0xB96A2670]
SSDT \??\C:\Program Files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSShim.sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwTerminateProcess [0xB96A2720]
SSDT \??\C:\Program Files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSShim.sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwTerminateThread [0xB96A27C0]
SSDT \??\C:\Program Files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSShim.sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwWriteVirtualMemory [0xB96A2860]

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs AVGIDSFilter.sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )
AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat AVGIDSFilter.sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )

Device -> \Driver\atapi \Device\Harddisk0\DR0 8A194EC5

---- Registry - GMER 1.0.15 ----

Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\BITS@StateIndex 0
Reg HKLM\SOFTWARE\Classes\CLSID\{B5607D2B-B46E-B3F4-9048AFCC28FF5FA4}\{C05554A6-FBA2-C228-B971EB90057D401E}\{5FF68CF8-794F-D6E5-5439F075104F0A49}
Reg HKLM\SOFTWARE\Classes\CLSID\{B5607D2B-B46E-B3F4-9048AFCC28FF5FA4}\{C05554A6-FBA2-C228-B971EB90057D401E}\{5FF68CF8-794F-D6E5-5439F075104F0A49}@WHRUBFTNUT3JMXQXKMKSXOBADA1 0x01 0x00 0x01 0x00 ...

---- Files - GMER 1.0.15 ----

File C:\WINDOWS\system32\drivers\atapi.sys suspicious modification

---- EOF - GMER 1.0.15 ----

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4460

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

8/22/2010 11:58:13 AM
mbam-log-2010-08-22 (11-58-13).txt

Scan type: Full scan (C:\|)
Objects scanned: 228101
Time elapsed: 1 hour(s), 29 minute(s), 13 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\System Volume Information\_restore{D296143C-1E0D-4768-97F5-97E08A2F16CC}\RP1470\A0251616.DLL (PUP.FunWebProducts) -> Quarantined and deleted successfully.

adam444 0 Newbie Poster · Answer 2 · 2010-08-24T03:24:06+00:00

sorry i guess it was in one of the DDS logs that said "UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT" so that threw me off a little.

Also you will probably notice that I have limewire. I rarely keep it running, but if you would rather I uninstall it and redo all my scans I can. but not sure that it will make much of a difference regarding my current problem. but i understand how that can invite problems. thank you.

adam444 0 Newbie Poster · Answer 3 · 2010-08-24T09:11:45+00:00

ComboFix 10-08-23.02 - Adam and Jessica 08/23/2010 21:25:17.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1279.812 [GMT -5:00]
-dds.scr is on my desktop. and/or in my desktop folder. It has always been there. Do you see it in a different folder?

here is the log.

Running from: c:\documents and settings\Adam and Jessica\Desktop\ComboFix.exe
AV: AVG Internet Security *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: AVG Firewall *disabled* {8decf618-9569-4340-b34a-d78d28969b66}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Adam and Jessica\Application Data\FC2856569707B55FB110594C5EF5A957
c:\documents and settings\Adam and Jessica\Application Data\FC2856569707B55FB110594C5EF5A957\secureapp70700.exe
c:\documents and settings\Adam and Jessica\Favorites\mxfilerelatedcache.mxc2
c:\documents and settings\Adam and Jessica\Favorites\Thumbs.db
c:\documents and settings\Adam and Jessica\g2mdlhlpx.exe
c:\documents and settings\Adam and Jessica\Recent\mxfilerelatedcache.mxc2
c:\documents and settings\Adam and Jessica\Recent\Thumbs.db
c:\documents and settings\Adam and Jessica\usmon.exe
c:\windows\system32\atriprxx.ara
c:\windows\system32\atriprxx.chs
c:\windows\system32\atriprxx.cht
c:\windows\system32\atriprxx.csy
c:\windows\system32\atriprxx.dan
c:\windows\system32\atriprxx.deu
c:\windows\system32\atriprxx.ell
c:\windows\system32\atriprxx.enu
c:\windows\system32\atriprxx.esp
c:\windows\system32\atriprxx.fin
c:\windows\system32\atriprxx.fra
c:\windows\system32\atriprxx.heb
c:\windows\system32\atriprxx.hun
c:\windows\system32\atriprxx.ita
c:\windows\system32\atriprxx.jpn
c:\windows\system32\atriprxx.kor
c:\windows\system32\atriprxx.nld
c:\windows\system32\atriprxx.nor
c:\windows\system32\atriprxx.plk
c:\windows\system32\atriprxx.ptb
c:\windows\system32\atriprxx.rus
c:\windows\system32\atriprxx.sve
c:\windows\system32\atriprxx.tha
c:\windows\system32\atriprxx.trk
c:\windows\system32\config\systemprofile\zeuete.exe
c:\windows\system32\Thumbs.db

Infected copy of c:\windows\system32\drivers\agp440.sys was found and disinfected
Restored copy from - Kitty had a snack :p
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_6TO4
-------\Service_6to4

((((((((((((((((((((((((( Files Created from 2010-07-24 to 2010-08-24 )))))))))))))))))))))))))))))))
.

2010-08-23 13:26 . 2010-08-23 13:26 -------- d-----w- c:\documents and settings\All Users\Application Data\magicJack
2010-08-22 04:51 . 2010-08-22 04:51 -------- d-----w- c:\documents and settings\LocalService\Application Data\AdobeUM
2010-08-22 04:50 . 2010-08-22 04:51 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Adobe
2010-08-21 23:53 . 2010-08-21 23:53 -------- d-----w- c:\program files\Trend Micro
2010-08-21 23:07 . 2010-08-21 23:07 -------- d-----w- c:\documents and settings\Adam and Jessica\Application Data\Malwarebytes
2010-08-21 23:06 . 2010-04-29 20:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-08-21 23:06 . 2010-08-21 23:06 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-08-21 23:06 . 2010-08-21 23:06 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-08-21 23:06 . 2010-04-29 20:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-08-17 21:42 . 2010-08-18 10:15 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-08-17 21:42 . 2010-08-17 23:27 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-08-11 19:41 . 2010-08-11 19:41 -------- d-----w- c:\documents and settings\NetworkService\Application Data\AdobeUM
2010-08-11 19:40 . 2010-08-11 19:40 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2010-08-11 00:54 . 2010-08-11 00:54 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2010-08-07 17:21 . 2010-08-07 17:21 -------- d-----w- c:\windows\system32\color

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-23 22:12 . 2009-05-13 20:29 -------- d-----w- c:\documents and settings\Adam and Jessica\Application Data\mjusbsp
2010-08-23 21:27 . 2005-10-06 02:20 -------- d-----w- c:\program files\Quicken
2010-08-23 20:28 . 2009-03-02 03:19 1324 ----a-w- c:\windows\system32\d3d9caps.dat
2010-08-22 04:22 . 2007-02-26 01:36 -------- d-----w- c:\program files\MySpace
2010-08-22 04:21 . 2006-10-04 08:50 -------- d-----w- c:\program files\Google
2010-08-22 04:19 . 2005-10-06 06:55 -------- d-----w- c:\documents and settings\All Users\Application Data\Viewpoint
2010-08-21 23:53 . 2010-08-21 23:53 388096 ----a-r- c:\documents and settings\Adam and Jessica\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-08-18 17:27 . 2007-09-04 17:44 -------- d-----w- c:\documents and settings\Adam and Jessica\Application Data\LimeWire
2010-08-18 16:56 . 2010-08-02 23:05 27591840 ----a-w- c:\documents and settings\All Users\Application Data\yahoo!\YUpdater\msgup1000_1270_us_u2.exe
2010-08-17 23:27 . 2005-10-18 21:51 -------- d-----w- c:\program files\BearShare
2010-08-15 13:46 . 2010-08-15 13:46 170904 ----a-w- c:\documents and settings\Adam and Jessica\Application Data\mjusbsp\ug00000\magicJack.dll
2010-08-15 13:45 . 2010-08-23 22:11 11045880 ---ha-w- c:\documents and settings\Adam and Jessica\Application Data\mjusbsp\in00000\setup.exe
2010-08-15 13:45 . 2010-08-23 13:25 11045880 ---ha-w- c:\documents and settings\Adam and Jessica\Application Data\mjusbsp\Upgrade\setup1.exe
2010-08-15 13:45 . 2010-08-15 13:45 11045880 ----a-w- c:\documents and settings\Adam and Jessica\Application Data\mjusbsp\ug00000\setup.exe
2010-08-15 13:45 . 2010-08-15 13:45 838488 ----a-w- c:\documents and settings\Adam and Jessica\Application Data\mjusbsp\magicJackLoader.exe
2010-08-15 13:45 . 2010-08-15 13:45 83352 ----a-w- c:\documents and settings\Adam and Jessica\Application Data\mjusbsp\octvqem_apiw.dll
2010-08-15 13:45 . 2010-08-15 13:45 206232 ----a-w- c:\documents and settings\Adam and Jessica\Application Data\mjusbsp\AECOctasic4.dll
2010-08-15 13:45 . 2010-08-15 13:45 734616 ----a-w- c:\documents and settings\Adam and Jessica\Application Data\mjusbsp\AECOctasic2.dll
2010-08-15 13:45 . 2010-08-15 13:45 202136 ----a-w- c:\documents and settings\Adam and Jessica\Application Data\mjusbsp\AECOctasic1.dll
2010-08-15 13:45 . 2010-08-15 13:45 480680 ----a-w- c:\documents and settings\Adam and Jessica\Application Data\mjusbsp\octvqe1_apiw.dll
2010-08-15 13:45 . 2010-08-15 13:45 214432 ----a-w- c:\documents and settings\Adam and Jessica\Application Data\mjusbsp\TjVista.dll
2010-08-15 13:45 . 2010-08-15 13:45 325024 ----a-w- c:\documents and settings\Adam and Jessica\Application Data\mjusbsp\TjIpSys.dll
2010-08-15 13:45 . 2010-08-15 13:45 632240 ----a-w- c:\documents and settings\Adam and Jessica\Application Data\mjusbsp\SJHandsetMagicJack.dll
2010-08-15 13:44 . 2010-08-15 13:44 170904 ----a-w- c:\documents and settings\Adam and Jessica\Application Data\mjusbsp\st00000\magicJack.dll
2010-08-15 13:44 . 2010-08-15 13:44 170904 ----a-w- c:\documents and settings\Adam and Jessica\Application Data\mjusbsp\magicJack.dll
2010-08-15 13:40 . 2010-08-15 13:40 170904 ----a-w- c:\documents and settings\Adam and Jessica\Application Data\mjusbsp\lr00000\magicJack.dll
2010-08-15 13:39 . 2010-08-15 13:39 22533520 ----a-w- c:\documents and settings\Adam and Jessica\Application Data\mjusbsp\magicJack.exe
2010-08-15 13:39 . 2010-08-15 13:39 50592 ----a-w- c:\documents and settings\Adam and Jessica\Application Data\mjusbsp\cdloader2.exe
2010-08-15 13:39 . 2010-08-23 22:11 838472 ---ha-w- c:\documents and settings\Adam and Jessica\Application Data\mjusbsp\ar00000\install.exe
2010-08-15 13:39 . 2010-08-23 13:24 838472 ---ha-w- c:\documents and settings\Adam and Jessica\Application Data\mjusbsp\Upgrade\install1.exe
2010-08-15 13:39 . 2010-08-15 13:39 838472 ----a-w- c:\documents and settings\Adam and Jessica\Application Data\mjusbsp\ug00000\install.exe
2010-08-15 13:38 . 2010-08-15 13:38 170904 ----a-w- c:\documents and settings\Adam and Jessica\Application Data\mjusbsp\in00000\magicJack.dll
2010-08-15 13:37 . 2010-08-15 13:37 103840 ----a-w- c:\documents and settings\Adam and Jessica\Application Data\mjusbsp\st00000\mjsetup.exe
2010-08-15 13:37 . 2010-08-15 13:37 103840 ----a-w- c:\documents and settings\Adam and Jessica\Application Data\mjusbsp\in00000\mjsetup.exe
2010-08-15 13:37 . 2010-08-15 13:37 442800 ----a-w- c:\documents and settings\Adam and Jessica\Application Data\mjusbsp\ug00000\magicJackSplash.exe
2010-08-15 13:37 . 2010-08-15 13:37 442800 ----a-w- c:\documents and settings\Adam and Jessica\Application Data\mjusbsp\st00000\magicJackSplash.exe
2010-08-15 13:37 . 2010-08-15 13:37 442800 ----a-w- c:\documents and settings\Adam and Jessica\Application Data\mjusbsp\magicJackSplash.exe
2010-08-15 13:37 . 2010-08-15 13:37 442800 ----a-w- c:\documents and settings\Adam and Jessica\Application Data\mjusbsp\in00000\magicJackSplash.exe
2010-08-11 00:40 . 2010-01-21 03:29 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9
2010-08-07 17:21 . 2005-10-06 22:15 -------- d-----w- c:\program files\Kodak
2010-08-06 18:23 . 2010-08-06 18:23 94208 ----a-w- c:\documents and settings\All Users\Application Data\Kodak\EasyShareSetup\$SETUP_3d001c_3a9e755\EasyShrx.Dll
2010-08-06 18:23 . 2005-10-06 22:15 -------- d-----w- c:\documents and settings\All Users\Application Data\Kodak
2010-08-06 01:25 . 2008-11-21 00:29 -------- d-----w- c:\program files\Coupons
2010-07-15 03:07 . 2006-08-16 02:19 -------- d--h--r- c:\documents and settings\Adam and Jessica\Application Data\yahoo!
2010-07-15 03:07 . 2006-08-15 21:13 -------- d-----w- c:\documents and settings\All Users\Application Data\yahoo!
2010-07-15 03:04 . 2005-10-06 06:23 -------- d-----w- c:\program files\Common Files\AOL
2010-07-15 03:04 . 2005-10-06 06:54 -------- d-----w- c:\documents and settings\All Users\Application Data\AOL
2010-07-15 03:01 . 2007-06-05 04:42 -------- d-----w- c:\program files\FaceMorpher Multi
2010-07-13 22:10 . 2008-03-06 18:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-07-02 00:54 . 2006-07-25 05:59 -------- d-----w- c:\documents and settings\Adam and Jessica\Application Data\Image Zone Express
2010-07-02 00:48 . 2010-05-13 02:26 1080 ----a-w- c:\windows\AUTOLNCH.REG
2010-06-21 16:19 . 2010-01-21 03:30 243024 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2010-06-21 16:18 . 2010-06-21 16:18 12536 ----a-w- c:\windows\system32\avgrsstx.dll
2010-06-21 16:17 . 2010-01-21 03:29 25168 ----a-w- c:\windows\system32\drivers\AVGIDSxx.sys
2010-06-21 16:17 . 2010-01-21 03:30 216400 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2010-06-14 14:31 . 2005-10-05 05:52 744448 ----a-w- c:\windows\PCHEALTH\HELPCTR\Binaries\helpsvc.exe
2010-05-31 14:39 . 2010-01-21 03:30 29584 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2008-02-03 06:06 . 2008-02-03 06:06 16 ---ha-w- c:\program files\mxfilerelatedcache.mxc2
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"cdloader"="c:\documents and settings\Adam and Jessica\Application Data\mjusbsp\cdloader2.exe" [2010-08-15 50592]
"Search Protection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2009-02-23 111856]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WorksFUD"="c:\program files\Microsoft Works\wkfud.exe" [2001-10-06 24576]
"Microsoft Works Portfolio"="c:\program files\Microsoft Works\WksSb.exe" [2001-08-23 331830]
"Microsoft Works Update Detection"="c:\program files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2001-08-17 28738]
"AudioHQ"="c:\program files\Creative\SBLive\AudioHQ\AHQTB.EXE" [2001-08-17 180224]
"UpdReg"="c:\windows\Updreg.exe" [1999-11-12 86016]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"AtiPTA"="atiptaxx.exe" [2002-06-27 286720]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2009-02-23 111856]
"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2010-06-21 2065760]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-04-15 202256]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-4-23 29696]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-12-15 282624]
Kodak EasyShare software.lnk - c:\program files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2003-12-13 630915]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
Microsoft Works Calendar Reminders.lnk - c:\program files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe [2001-8-7 24633]
Quicken Scheduled Updates.lnk - c:\program files\Quicken\bagent.exe [2003-10-2 57344]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{8af37f72-e87e-471c-b5be-15f07e6d61b9}"= "c:\progra~1\COMMON~1\aolshare\Coach\AolHook.dll" [2001-08-22 77824]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgam.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=
"c:\\Documents and Settings\\Adam and Jessica\\Application Data\\mjusbsp\\magicJack.exe"=

R0 AVGIDSErHrxpx;AVG9IDSErHr;c:\windows\system32\drivers\AVGIDSxx.sys [1/20/2010 10:29 PM 25168]
R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [1/20/2010 10:30 PM 52872]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [1/20/2010 10:30 PM 216400]
R1 AvgTdiX;AVG Network Redirector;c:\windows\system32\drivers\avgtdix.sys [1/20/2010 10:30 PM 243024]
R2 ACEDRV08;ACEDRV08;c:\windows\system32\drivers\ACEDRV08.sys [12/21/2007 6:48 PM 108768]
R3 Avgfwdx;Avgfwdx;c:\windows\system32\drivers\avgfwdx.sys [1/20/2010 10:29 PM 30104]
R3 AVGIDSDriverxpx;AVG9IDSDriver;c:\program files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSDriver.sys [1/20/2010 10:29 PM 122448]
R3 AVGIDSFilterxpx;AVG9IDSFilter;c:\program files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSFilter.sys [1/20/2010 10:29 PM 30288]
R3 AVGIDSShimxpx;AVG9IDSShim;c:\program files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSShim.sys [1/20/2010 10:29 PM 26192]
R3 ES1370;Creative AudioPCI (ES1370), SB PCI 64/128 (WDM);c:\windows\system32\drivers\es1370mp.sys [10/24/2006 11:34 AM 37120]
S3 Avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwdx.sys [1/20/2010 10:29 PM 30104]
S3 iscFlash;iscFlash;\??\c:\windows\SYSTEM32\DRIVERS\iscflash.sys --> c:\windows\SYSTEM32\DRIVERS\iscflash.sys [?]
S3 mgau;mgau;c:\windows\system32\drivers\mgaum.sys [2/19/2009 11:21 PM 320384]
.
Contents of the 'Scheduled Tasks' folder

2010-08-24 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1547161642-1606980848-682003330-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 03:09]

2010-08-19 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1547161642-1606980848-682003330-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 03:09]
.
.
------- Supplementary Scan -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyServer = http=127.0.0.1:5555
uInternet Settings,ProxyOverride = <local>
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
FF - ProfilePath - c:\documents and settings\Adam and Jessica\Application Data\Mozilla\Firefox\Profiles\3hiaok0j.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?fr=ffsp1&p=
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=ffds1&p=
FF - component: c:\program files\AVG\AVG9\Firefox\components\avgssff.dll
FF - plugin: c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
FF - plugin: c:\program files\Virtual Earth 3D\npVE3D.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - truec:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 10);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - ORPHANS REMOVED - - - -

Toolbar-Locked - (no file)

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-23 21:43
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B5607D2B-B46E-B3F4-9048AFCC28FF5FA4}\{C05554A6-FBA2-C228-B971EB90057D401E}\{5FF68CF8-794F-D6E5-5439F075104F0A49}*]
"WHRUBFTNUT3JMXQXKMKSXOBADA1"=hex:01,00,01,00,00,00,00,00,7d,86,67,30,10,5d,1c,
b8,35,81,92,71,e8,29,5a,84,14,35,16,70,d8,6e,ff,61

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(2408)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\AVG\AVG9\Identity Protection\Agent\Bin\AVGIDSAgent.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\AVG\AVG9\avgwdsvc.exe
c:\program files\AVG\AVG9\avgfws9.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\program files\AVG\AVG9\avgam.exe
c:\program files\AVG\AVG9\avgnsx.exe
c:\program files\AVG\AVG9\avgchsvx.exe
c:\program files\AVG\AVG9\avgrsx.exe
c:\program files\AVG\AVG9\avgcsrvx.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\atiptaxx.exe
c:\program files\AVG\AVG9\Identity Protection\agent\bin\avgidsmonitor.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2010-08-23 21:57:36 - machine was rebooted
ComboFix-quarantined-files.txt 2010-08-24 02:57

Pre-Run: 45,013,073,920 bytes free
Post-Run: 45,006,356,480 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

- - End Of File - - E89F2375F2323ECFAC3D2C5F9CD9B282

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 4 · 2010-08-24T10:03:16+00:00

1. Please open Notepad

Click Start , then Run
Type notepad.exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

DDS::
uInternet Settings,ProxyServer = http=127.0.0.1:5555
mURLSearchHooks: H - No File
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
TB: {4982D40A-C53B-4615-B15B-B5B5E98D167C} - No File
TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Save the above as CFScript.txt

4. Physically disconnect from the internet.

5. Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.

6. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

[IMG]http://i5.photobucket.com/albums/y153/crunchie1/CFScript.gif[/IMG]

7. After reboot, (in case it asks to reboot), please post the following reports/logs into your next replyafter you re-enable all the programs that were disabled during the running of ComboFix:

Combofix.txt

Please take note:

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

=========

Let me know how the PC is now.

adam444 0 Newbie Poster · Answer 5 · 2010-08-25T03:29:18+00:00

my computer seemed to be totally fixed after the first combofix run. i no longer saw the yellow sheild at the bottom saying downloading updates 0%. instead a new one came up saying windows security updates are avail, so i did those. also i am not getting redirected when clicking search links. Everything still seems great after this second run too. If we are done now, Thank you for your help! If not, let me know.

ComboFix 10-08-23.02 - Adam and Jessica 08/24/2010 15:50:20.2.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1279.689 [GMT -5:00]
Running from: c:\documents and settings\Adam and Jessica\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Adam and Jessica\Desktop\CFScript.txt
AV: AVG Internet Security *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: AVG Firewall *enabled* {8decf618-9569-4340-b34a-d78d28969b66}
.

((((((((((((((((((((((((( Files Created from 2010-07-24 to 2010-08-24 )))))))))))))))))))))))))))))))
.

2010-08-24 19:18 . 2010-08-15 13:45 11045880 ---ha-w- c:\documents and settings\Adam and Jessica\Application Data\mjusbsp\in00000\setup.exe
2010-08-23 22:11 . 2010-08-15 13:39 838472 ---ha-w- c:\documents and settings\Adam and Jessica\Application Data\mjusbsp\ar00000\install.exe
2010-08-23 13:26 . 2010-08-23 13:26 -------- d-----w- c:\documents and settings\All Users\Application Data\magicJack
2010-08-23 13:25 . 2010-08-15 13:45 11045880 ---ha-w- c:\documents and settings\Adam and Jessica\Application Data\mjusbsp\Upgrade\setup1.exe
2010-08-23 13:24 . 2010-08-15 13:39 838472 ---ha-w- c:\documents and settings\Adam and Jessica\Application Data\mjusbsp\Upgrade\install1.exe
2010-08-22 04:51 . 2010-08-22 04:51 -------- d-----w- c:\documents and settings\LocalService\Application Data\AdobeUM
2010-08-22 04:50 . 2010-08-22 04:51 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Adobe
2010-08-21 23:53 . 2010-08-21 23:53 388096 ----a-r- c:\documents and settings\Adam and Jessica\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-08-21 23:53 . 2010-08-21 23:53 -------- d-----w- c:\program files\Trend Micro
2010-08-21 23:07 . 2010-08-21 23:07 -------- d-----w- c:\documents and settings\Adam and Jessica\Application Data\Malwarebytes
2010-08-21 23:06 . 2010-04-29 20:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-08-21 23:06 . 2010-08-21 23:06 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-08-21 23:06 . 2010-08-21 23:06 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-08-21 23:06 . 2010-04-29 20:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-08-17 21:42 . 2010-08-18 10:15 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-08-17 21:42 . 2010-08-17 23:27 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-08-15 13:46 . 2010-08-15 13:46 170904 ----a-w- c:\documents and settings\Adam and Jessica\Application Data\mjusbsp\ug00000\magicJack.dll
2010-08-15 13:45 . 2010-08-15 13:45 11045880 ----a-w- c:\documents and settings\Adam and Jessica\Application Data\mjusbsp\ug00000\setup.exe
2010-08-15 13:45 . 2010-08-15 13:45 838488 ----a-w- c:\documents and settings\Adam and Jessica\Application Data\mjusbsp\magicJackLoader.exe
2010-08-15 13:45 . 2010-08-15 13:45 83352 ----a-w- c:\documents and settings\Adam and Jessica\Application Data\mjusbsp\octvqem_apiw.dll
2010-08-15 13:45 . 2010-08-15 13:45 206232 ----a-w- c:\documents and settings\Adam and Jessica\Application Data\mjusbsp\AECOctasic4.dll
2010-08-15 13:45 . 2010-08-15 13:45 734616 ----a-w- c:\documents and settings\Adam and Jessica\Application Data\mjusbsp\AECOctasic2.dll
2010-08-15 13:45 . 2010-08-15 13:45 202136 ----a-w- c:\documents and settings\Adam and Jessica\Application Data\mjusbsp\AECOctasic1.dll
2010-08-15 13:45 . 2010-08-15 13:45 480680 ----a-w- c:\documents and settings\Adam and Jessica\Application Data\mjusbsp\octvqe1_apiw.dll
2010-08-15 13:45 . 2010-08-15 13:45 214432 ----a-w- c:\documents and settings\Adam and Jessica\Application Data\mjusbsp\TjVista.dll
2010-08-15 13:45 . 2010-08-15 13:45 325024 ----a-w- c:\documents and settings\Adam and Jessica\Application Data\mjusbsp\TjIpSys.dll
2010-08-15 13:45 . 2010-08-15 13:45 632240 ----a-w- c:\documents and settings\Adam and Jessica\Application Data\mjusbsp\SJHandsetMagicJack.dll
2010-08-15 13:44 . 2010-08-15 13:44 170904 ----a-w- c:\documents and settings\Adam and Jessica\Application Data\mjusbsp\st00000\magicJack.dll
2010-08-15 13:44 . 2010-08-15 13:44 170904 ----a-w- c:\documents and settings\Adam and Jessica\Application Data\mjusbsp\magicJack.dll
2010-08-15 13:40 . 2010-08-15 13:40 170904 ----a-w- c:\documents and settings\Adam and Jessica\Application Data\mjusbsp\lr00000\magicJack.dll
2010-08-15 13:39 . 2010-08-15 13:39 22533520 ----a-w- c:\documents and settings\Adam and Jessica\Application Data\mjusbsp\magicJack.exe
2010-08-15 13:39 . 2010-08-15 13:39 50592 ----a-w- c:\documents and settings\Adam and Jessica\Application Data\mjusbsp\cdloader2.exe
2010-08-15 13:39 . 2010-08-15 13:39 838472 ----a-w- c:\documents and settings\Adam and Jessica\Application Data\mjusbsp\ug00000\install.exe
2010-08-15 13:38 . 2010-08-15 13:38 170904 ----a-w- c:\documents and settings\Adam and Jessica\Application Data\mjusbsp\in00000\magicJack.dll
2010-08-15 13:37 . 2010-08-15 13:37 103840 ----a-w- c:\documents and settings\Adam and Jessica\Application Data\mjusbsp\st00000\mjsetup.exe
2010-08-15 13:37 . 2010-08-15 13:37 103840 ----a-w- c:\documents and settings\Adam and Jessica\Application Data\mjusbsp\in00000\mjsetup.exe
2010-08-15 13:37 . 2010-08-15 13:37 442800 ----a-w- c:\documents and settings\Adam and Jessica\Application Data\mjusbsp\ug00000\magicJackSplash.exe
2010-08-15 13:37 . 2010-08-15 13:37 442800 ----a-w- c:\documents and settings\Adam and Jessica\Application Data\mjusbsp\st00000\magicJackSplash.exe
2010-08-15 13:37 . 2010-08-15 13:37 442800 ----a-w- c:\documents and settings\Adam and Jessica\Application Data\mjusbsp\magicJackSplash.exe
2010-08-15 13:37 . 2010-08-15 13:37 442800 ----a-w- c:\documents and settings\Adam and Jessica\Application Data\mjusbsp\in00000\magicJackSplash.exe
2010-08-11 19:41 . 2010-08-11 19:41 -------- d-----w- c:\documents and settings\NetworkService\Application Data\AdobeUM
2010-08-11 19:40 . 2010-08-11 19:40 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2010-08-11 00:54 . 2010-08-11 00:54 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2010-08-07 17:21 . 2010-08-07 17:21 -------- d-----w- c:\windows\system32\color
2010-08-06 18:23 . 2010-08-06 18:23 94208 ----a-w- c:\documents and settings\All Users\Application Data\Kodak\EasyShareSetup\$SETUP_3d001c_3a9e755\EasyShrx.Dll
2010-08-06 18:23 . 2003-12-04 21:15 884736 ----a-r- c:\documents and settings\All Users\Application Data\Kodak\EasyShareSetup\$SETUP_3d001c_3a9e755\Setup.exe
2010-08-02 23:05 . 2010-08-18 16:56 27591840 ----a-w- c:\documents and settings\All Users\Application Data\yahoo!\YUpdater\msgup1000_1270_us_u2.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-24 20:44 . 2005-10-06 02:20 -------- d-----w- c:\program files\Quicken
2010-08-24 19:19 . 2009-05-13 20:29 -------- d-----w- c:\documents and settings\Adam and Jessica\Application Data\mjusbsp
2010-08-24 03:37 . 2008-03-06 18:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-08-23 20:28 . 2009-03-02 03:19 1324 ----a-w- c:\windows\system32\d3d9caps.dat
2010-08-22 04:22 . 2007-02-26 01:36 -------- d-----w- c:\program files\MySpace
2010-08-22 04:21 . 2006-10-04 08:50 -------- d-----w- c:\program files\Google
2010-08-22 04:19 . 2005-10-06 06:55 -------- d-----w- c:\documents and settings\All Users\Application Data\Viewpoint
2010-08-18 17:27 . 2007-09-04 17:44 -------- d-----w- c:\documents and settings\Adam and Jessica\Application Data\LimeWire
2010-08-17 23:27 . 2005-10-18 21:51 -------- d-----w- c:\program files\BearShare
2010-08-11 00:40 . 2010-01-21 03:29 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9
2010-08-07 17:21 . 2005-10-06 22:15 -------- d-----w- c:\program files\Kodak
2010-08-06 18:23 . 2005-10-06 22:15 -------- d-----w- c:\documents and settings\All Users\Application Data\Kodak
2010-08-06 01:25 . 2008-11-21 00:29 -------- d-----w- c:\program files\Coupons
2010-07-15 03:07 . 2006-08-16 02:19 -------- d--h--r- c:\documents and settings\Adam and Jessica\Application Data\yahoo!
2010-07-15 03:07 . 2006-08-15 21:13 -------- d-----w- c:\documents and settings\All Users\Application Data\yahoo!
2010-07-15 03:04 . 2005-10-06 06:23 -------- d-----w- c:\program files\Common Files\AOL
2010-07-15 03:04 . 2005-10-06 06:54 -------- d-----w- c:\documents and settings\All Users\Application Data\AOL
2010-07-15 03:01 . 2007-06-05 04:42 -------- d-----w- c:\program files\FaceMorpher Multi
2010-07-02 00:54 . 2006-07-25 05:59 -------- d-----w- c:\documents and settings\Adam and Jessica\Application Data\Image Zone Express
2010-07-02 00:48 . 2010-05-13 02:26 1080 ----a-w- c:\windows\AUTOLNCH.REG
2010-06-30 12:31 . 2001-08-30 10:30 149504 ----a-w- c:\windows\system32\schannel.dll
2010-06-24 12:22 . 2004-01-08 20:23 916480 ----a-w- c:\windows\system32\wininet.dll
2010-06-23 13:44 . 2001-08-30 10:30 1851904 ----a-w- c:\windows\system32\win32k.sys
2010-06-21 16:19 . 2010-01-21 03:30 243024 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2010-06-21 16:18 . 2010-06-21 16:18 12536 ----a-w- c:\windows\system32\avgrsstx.dll
2010-06-21 16:17 . 2010-01-21 03:29 25168 ----a-w- c:\windows\system32\drivers\AVGIDSxx.sys
2010-06-21 16:17 . 2010-01-21 03:30 216400 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2010-06-21 15:27 . 2001-08-30 10:30 354304 ----a-w- c:\windows\system32\drivers\srv.sys
2010-06-17 14:03 . 2001-08-30 10:30 80384 ----a-w- c:\windows\system32\iccvid.dll
2010-06-14 14:31 . 2005-10-05 05:52 744448 ----a-w- c:\windows\PCHEALTH\HELPCTR\Binaries\helpsvc.exe
2010-06-14 07:41 . 2001-08-30 10:30 1172480 ----a-w- c:\windows\system32\msxml3.dll
2010-05-31 14:39 . 2010-01-21 03:30 29584 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2008-02-03 06:06 . 2008-02-03 06:06 16 ---ha-w- c:\program files\mxfilerelatedcache.mxc2
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"cdloader"="c:\documents and settings\Adam and Jessica\Application Data\mjusbsp\cdloader2.exe" [2010-08-15 50592]
"Search Protection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2009-02-23 111856]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WorksFUD"="c:\program files\Microsoft Works\wkfud.exe" [2001-10-06 24576]
"Microsoft Works Portfolio"="c:\program files\Microsoft Works\WksSb.exe" [2001-08-23 331830]
"Microsoft Works Update Detection"="c:\program files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2001-08-17 28738]
"AudioHQ"="c:\program files\Creative\SBLive\AudioHQ\AHQTB.EXE" [2001-08-17 180224]
"UpdReg"="c:\windows\Updreg.exe" [1999-11-12 86016]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"AtiPTA"="atiptaxx.exe" [2002-06-27 286720]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2009-02-23 111856]
"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2010-06-21 2065760]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-04-15 202256]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-4-23 29696]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-12-15 282624]
Kodak EasyShare software.lnk - c:\program files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2003-12-13 630915]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
Microsoft Works Calendar Reminders.lnk - c:\program files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe [2001-8-7 24633]
Quicken Scheduled Updates.lnk - c:\program files\Quicken\bagent.exe [2003-10-2 57344]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{8af37f72-e87e-471c-b5be-15f07e6d61b9}"= "c:\progra~1\COMMON~1\aolshare\Coach\AolHook.dll" [2001-08-22 77824]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgam.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=
"c:\\Documents and Settings\\Adam and Jessica\\Application Data\\mjusbsp\\magicJack.exe"=

R0 AVGIDSErHrxpx;AVG9IDSErHr;c:\windows\system32\drivers\AVGIDSxx.sys [1/20/2010 10:29 PM 25168]
R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [1/20/2010 10:30 PM 52872]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [1/20/2010 10:30 PM 216400]
R1 AvgTdiX;AVG Network Redirector;c:\windows\system32\drivers\avgtdix.sys [1/20/2010 10:30 PM 243024]
R2 ACEDRV08;ACEDRV08;c:\windows\system32\drivers\ACEDRV08.sys [12/21/2007 6:48 PM 108768]
R2 avg9wd;AVG WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [6/21/2010 11:18 AM 308136]
R2 avgfws9;AVG Firewall;c:\program files\AVG\AVG9\avgfws9.exe [6/21/2010 11:17 AM 2331032]
R2 AVGIDSAgent;AVG9IDSAgent;c:\program files\AVG\AVG9\Identity Protection\Agent\Bin\AVGIDSAgent.exe [6/21/2010 11:17 AM 5897808]
R3 Avgfwdx;Avgfwdx;c:\windows\system32\drivers\avgfwdx.sys [1/20/2010 10:29 PM 30104]
R3 AVGIDSDriverxpx;AVG9IDSDriver;c:\program files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSDriver.sys [1/20/2010 10:29 PM 122448]
R3 AVGIDSFilterxpx;AVG9IDSFilter;c:\program files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSFilter.sys [1/20/2010 10:29 PM 30288]
R3 AVGIDSShimxpx;AVG9IDSShim;c:\program files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSShim.sys [1/20/2010 10:29 PM 26192]
R3 ES1370;Creative AudioPCI (ES1370), SB PCI 64/128 (WDM);c:\windows\system32\drivers\es1370mp.sys [10/24/2006 11:34 AM 37120]
S3 Avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwdx.sys [1/20/2010 10:29 PM 30104]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\MAGIX\Common\Database\bin\fbserver.exe [12/21/2007 6:37 PM 1527900]
S3 iscFlash;iscFlash;\??\c:\windows\SYSTEM32\DRIVERS\iscflash.sys --> c:\windows\SYSTEM32\DRIVERS\iscflash.sys [?]
S3 mgau;mgau;c:\windows\system32\drivers\mgaum.sys [2/19/2009 11:21 PM 320384]
S3 UPnPService;UPnPService;c:\program files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe [12/21/2007 6:39 PM 544768]
.
Contents of the 'Scheduled Tasks' folder

2010-08-24 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1547161642-1606980848-682003330-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 03:09]

2010-08-19 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1547161642-1606980848-682003330-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 03:09]
.
.
------- Supplementary Scan -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = <local>
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
FF - ProfilePath - c:\documents and settings\Adam and Jessica\Application Data\Mozilla\Firefox\Profiles\3hiaok0j.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?fr=ffsp1&p=
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=ffds1&p=
FF - component: c:\program files\AVG\AVG9\Firefox\components\avgssff.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - truec:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 10);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-24 16:06
Windows 5.1.2600 Service Pack 3 NTFS