Sluggish webpage access, random multiple window popup, constant page refreshing.

Printable View

November 20th, 2009, 02:38 PM
MJames

Sluggish webpage access, random multiple window popup, constant page refreshing.

Sluggish webpage access, random multiple window popup, constant random webpage refreshing , cannot run spybot without it freezing.
Running win2k
Your assistance is appreciated. :)
---------------------------------------
hijackthis.log file:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:32:57 AM, on 11/20/2009
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\crypserv.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\WINNT\System32\svchost.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe
C:\WINNT\System32\tcpsvcs.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\MsPMSPSv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\WINNT\system32\atiptaxx.exe
C:\WINNT\system32\desk95.exe
C:\WINNT\system32\CTHELPER.EXE
C:\WINNT\system32\NVATray.exe
C:\Program Files\USBToolbox\Res.EXE
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Hewlett-Packard\hp psc 700 series\bin\hpodev07.exe
C:\PROGRA~1\HEWLET~1\HPPSC7~1\bin\hpoevm07.exe
C:\WINNT\system32\hpoipm07.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\Program Files\TrueCrypt\TrueCrypt.exe
C:\Program Files\Hewlett-Packard\hp psc 700 series\bin\HPOSTS07.exe
H:\McAf\SpamKill\SpamKiller.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://toolbar.ask.com/toolbarv/askR...3&gct=&gc=1&q=
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://toolbar.ask.com/toolbarv/askR...3&gct=&gc=1&q=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://toolbar.ask.com/toolbarv/askR...gct=&gc=1&q=%s
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - URLSearchHook: DefaultSearchHook Class - {C94E154B-1459-4A47-966B-4B843BEFC7DB} - C:\Program Files\AskSearch\bin\DefaultSearch.dll
O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 7\SnagItBHO.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 7\SnagItIEAddin.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [HydarVisionDesktopManager] desk95.exe
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINNT\Updreg.exe
O4 - HKLM\..\Run: [Jet Detection] C:\Program Files\Creative\SBAudigy\PROGRAM\ADGJDet.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [NVIDIA nForce APU1 Utilities] NVATray.exe
O4 - HKLM\..\Run: [USB Storage Toolbox] C:\Program Files\USBToolbox\Res.EXE
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HPAIO_PrintFolderMgr] C:\WINNT\system32\spool\DRIVERS\W32X86\hpoopm07.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: HPAiODevice.lnk = C:\Program Files\Hewlett-Packard\hp psc 700 series\bin\hpodev07.exe
O4 - Global Startup: ZoneAlarm Pro.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Toolbars\Restrictions present
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Send Image to Photo Library - file://C:\Documents and Settings\Administrator\Application Data\MGI\PhotoSuite4\Temp\MGI00000.html
O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\Program Files\ATI Multimedia\TV\EXPLBAR.DLL
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O15 - Trusted Zone: http://www.msi.com.tw
O16 - DPF: {0C954B1E-3F7E-4038-BB2C-6FC13536AF15} (HaruSetup Class) - http://www.withlink.com/activex/HaruSetup.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - http://download.bitdefender.com/reso...an8/oscan8.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://go.divx.com/plugin/DivXBrowserPlugin.cab
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} - http://h20270.www2.hp.com/ediags/gmn...tDetection.cab
O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} (WebSDev Control) - http://liveupdate.msi.com.tw/autobio...ne/install.cab
O16 - DPF: {B95B384C-BC15-42BE-80A2-DD28BC805908} (AtlCtrl Class) - http://www.westsidestory.co.kr/downl..._weblaunch.cab
O16 - DPF: {CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1_01) -
O16 - DPF: {CB50428B-657F-47DF-9B32-671F82AA73F7} (Photodex Presenter AX control) - http://www.photodex.com/pxplay.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe...bat/nos/gp.cab
O16 - DPF: {D4328549-2B43-40D5-BBF8-77D6EEA60412} (StorefrontUpload.BulkImageUpload1) - http://www.ldphotostation.com/images...ntUpload19.CAB
O16 - DPF: {F127B9BA-89EA-4B04-9C67-2074A9DF61FD} (Photo Upload Plugin Class) - http://blacks.pnimedia.com/upload/ac...pv2.0.0.9.cab?
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINNT\SYSTEM32\crypserv.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: getPlus(R) Helper - Unknown owner - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: ScsiAccess - Unknown owner - C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe
O23 - Service: SolidWorks Licensing Service - SolidWorks - C:\Program Files\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINNT\system32\ZoneLabs\vsmon.exe

--
End of file - 11224 bytes
November 20th, 2009, 03:00 PM
Train

Follow the instructions here
http://discussions.virtualdr.com/sho...d.php?t=197917
And post the logs here.
November 20th, 2009, 09:27 PM
MJames

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 11/20/2009 at 02:27 PM

Application Version : 4.30.1004

Core Rules Database Version : 3313
Trace Rules Database Version: 1978

Scan type : Complete Scan
Total Scan Time : 01:26:26

Memory items scanned : 196
Memory threats detected : 0
Registry items scanned : 5468
Registry threats detected : 0
File items scanned : 75434
File threats detected : 120

-------------------------------------------

Malwarebytes' Anti-Malware 1.41
Database version: 3204
Windows 5.0.2195 Service Pack 4

11/20/2009 5:10:08 PM
mbam-log-2009-11-20 (17-10-08).txt

Scan type: Full Scan (C:\|)
Objects scanned: 175708
Time elapsed: 40 minute(s), 4 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 5
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 12

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\minibugtransporter.minibugtransporterx (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\minibugtransporter.minibugtransporterx.1 (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{04a38f6b-006f-4247-ba4c-02a139d5531c} (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{2b96d5cc-c5b5-49a5-a69d-cc0a30f9028c} (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{3c2d2a1e-031f-4397-9614-87c932a848e0} (Adware.Minibug) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINNT\system32\wgp.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Program Files\Adobe\Adobe Photoshop CS2\Plug-Ins\Enhancer.8bf (Malware.Packer) -> Quarantined and deleted successfully.
C:\Program Files\Adobe\Photoshop CS\Plug-Ins\Enhancer.8bf (Malware.Packer) -> Quarantined and deleted successfully.
C:\Program Files\AKVIS\Enhancer\Enhancer.8bf (Malware.Packer) -> Quarantined and deleted successfully.
C:\Program Files\cdfw800.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Program Files\cdmw800.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Program Files\cfw803.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Program Files\ciw803.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Program Files\cmw800.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Program Files\jpegconva.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\WINNT\system32\ClickToFindandFixErrors_Intl.ico (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINNT\system32\wgp.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINNT\toolbar.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
-----------------------------------------------
Cheers.
November 20th, 2009, 09:56 PM
MJames

Quote:

Originally Posted by Train

Follow the instructions here
http://discussions.virtualdr.com/sho...d.php?t=197917
And post the logs here.

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 11/20/2009 at 02:27 PM

Application Version : 4.30.1004

Core Rules Database Version : 3313
Trace Rules Database Version: 1978

Scan type : Complete Scan
Total Scan Time : 01:26:26

Memory items scanned : 196
Memory threats detected : 0
Registry items scanned : 5468
Registry threats detected : 0
File items scanned : 75434
File threats detected : 120
------------------------------------------------

Malwarebytes' Anti-Malware 1.41
Database version: 3204
Windows 5.0.2195 Service Pack 4

11/20/2009 5:10:08 PM
mbam-log-2009-11-20 (17-10-08).txt

Scan type: Full Scan (C:\|)
Objects scanned: 175708
Time elapsed: 40 minute(s), 4 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 5
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 12

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\minibugtransporter.minibugtransporterx (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\minibugtransporter.minibugtransporterx.1 (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{04a38f6b-006f-4247-ba4c-02a139d5531c} (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{2b96d5cc-c5b5-49a5-a69d-cc0a30f9028c} (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{3c2d2a1e-031f-4397-9614-87c932a848e0} (Adware.Minibug) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINNT\system32\wgp.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Program Files\Adobe\Adobe Photoshop CS2\Plug-Ins\Enhancer.8bf (Malware.Packer) -> Quarantined and deleted successfully.
C:\Program Files\Adobe\Photoshop CS\Plug-Ins\Enhancer.8bf (Malware.Packer) -> Quarantined and deleted successfully.
C:\Program Files\AKVIS\Enhancer\Enhancer.8bf (Malware.Packer) -> Quarantined and deleted successfully.
C:\Program Files\cdfw800.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Program Files\cdmw800.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Program Files\cfw803.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Program Files\ciw803.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Program Files\cmw800.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Program Files\jpegconva.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\WINNT\system32\ClickToFindandFixErrors_Intl.ico (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINNT\system32\wgp.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINNT\toolbar.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
--------------------------------------------
November 21st, 2009, 01:55 AM
Broni

Why there is no antivirus program present?
November 21st, 2009, 02:15 AM
MJames

Quote:

Originally Posted by Broni

Why there is no antivirus program present?

?? I have one running on my system - Eset NOD32 2.7.
November 21st, 2009, 02:18 AM
Broni
Ooops, getting late, I guess...sorry for that :)

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
1. Please, never rename Combofix unless instructed.
2. Close any open browsers.
3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  - Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  - Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
  NOTE. If Combofix asks you to install Recovery Console, please allow it.
  - Close any open browsers.
  - WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
  - Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
  - If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
4. Double click on combofix.exe & follow the prompts.
5. When finished, it will produce a report for you.
6. Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.
**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

Make sure, you re-enable your security programs, when you're done with Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
November 21st, 2009, 05:53 AM
MJames

ComboFix 09-11-20.02 - Privateone 11/21/2009 1:17.3.1 - x86
Microsoft Windows 2000 Professional 5.0.2195.4.1252.1.1033.18.511.257 [GMT -8:00]
Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe
* Resident AV is active

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Administrator\Application Data\inst.exe
c:\program files\AskSearch\bin\DefaultSearch.dll
c:\recycler\NPROTECT
c:\winnt\SNMPAPI.DLL
c:\winnt\system32\drivers\pciide.sys
c:\winnt\system32\images
c:\winnt\system32\images\accessinghvnoprop.jpg
c:\winnt\system32\images\accessingmdesk.jpg
c:\winnt\system32\images\ati_logo.jpg
c:\winnt\system32\images\hvdm.jpg
c:\winnt\system32\images\hvhotkeys.jpg
c:\winnt\system32\images\hvsystray.jpg
c:\winnt\system32\images\hvsystray2.jpg
c:\winnt\system32\setup.ini
c:\winnt\Web\default.htt

c:\winnt\system32\comres.dll . . . is infected!!

.
((((((((((((((((((((((((( Files Created from 2009-10-21 to 2009-11-21 )))))))))))))))))))))))))))))))
.

2009-11-21 09:38 . 2009-11-21 09:38 16384 ----atw- c:\winnt\system32\Perflib_Perfdata_478.dat
2009-11-21 09:37 . 2009-11-21 09:37 16384 ----atw- c:\winnt\system32\Perflib_Perfdata_244.dat
2009-11-20 23:41 . 2009-11-20 23:41 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-11-20 23:41 . 2009-09-10 22:54 38224 ----a-w- c:\winnt\system32\drivers\mbamswissarmy.sys
2009-11-20 23:41 . 2009-11-20 23:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-11-20 23:41 . 2009-09-10 22:53 18520 ----a-w- c:\winnt\system32\drivers\mbam.sys
2009-11-20 23:41 . 2009-11-20 23:41 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-11-20 20:42 . 2009-11-20 20:42 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-11-20 20:42 . 2009-11-20 20:42 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-21 09:36 . 2003-09-12 06:16 24 ----a-w- c:\winnt\system32\DVCStateBkp-{00000001-00000000-00000002-00001102-00000004-00531102}.dat
2009-11-21 09:36 . 2003-09-12 06:16 24 ----a-w- c:\winnt\system32\DVCState-{00000001-00000000-00000002-00001102-00000004-00531102}.dat
2009-11-11 01:26 . 2009-11-11 01:33 21504 ----a-w- c:\winnt\Internet Logs\xDB1E0.tmp
2009-11-11 01:26 . 2009-11-11 01:33 5115904 ----a-w- c:\winnt\Internet Logs\xDB1DF.tmp
2009-11-09 18:36 . 2009-11-09 19:52 19456 ----a-w- c:\winnt\Internet Logs\xDB1DE.tmp
2009-11-09 16:07 . 2009-11-09 19:52 5106176 ----a-w- c:\winnt\Internet Logs\xDB1DD.tmp
2009-11-08 23:00 . 2009-11-09 04:23 42496 ----a-w- c:\winnt\Internet Logs\xDB1DC.tmp
2009-11-08 16:33 . 2009-11-09 04:23 5106176 ----a-w- c:\winnt\Internet Logs\xDB1DB.tmp
2009-10-31 16:50 . 2009-08-19 05:51 -------- d-----w- c:\documents and settings\Administrator\Application Data\TrueCrypt
2009-10-28 16:13 . 2009-10-28 16:18 24064 ----a-w- c:\winnt\Internet Logs\xDB1DA.tmp
2009-10-28 15:59 . 2009-10-28 16:18 5099520 ----a-w- c:\winnt\Internet Logs\xDB1D9.tmp
2009-10-24 16:41 . 2009-07-22 06:24 -------- d---a-w- c:\documents and settings\All Users\Application Data\FLEXnet
2009-10-22 02:40 . 2009-10-22 04:02 1105 ----a-w- c:\documents and settings\Administrator\Application Data\Genie-Soft\GBMPro8\Jobs\FjungPP\00000000\maindata.sys
2009-10-17 03:30 . 2003-09-26 17:38 -------- d-----w- c:\program files\FlashGet
2009-10-14 05:02 . 2004-01-08 02:28 -------- d-----w- c:\program files\AIDA32 - Enterprise System Information
2009-10-01 05:34 . 2009-10-01 14:58 16384 ----a-w- c:\winnt\Internet Logs\xDB1D8.tmp
2009-10-01 05:15 . 2009-10-01 14:58 5086720 ----a-w- c:\winnt\Internet Logs\xDB1D7.tmp
2009-09-30 22:46 . 2009-09-30 22:50 19456 ----a-w- c:\winnt\Internet Logs\xDB1D6.tmp
2009-09-30 22:46 . 2009-09-30 22:50 5086720 ----a-w- c:\winnt\Internet Logs\xDB1D5.tmp
2009-09-30 22:40 . 2003-09-11 19:07 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-09-30 07:01 . 2009-09-30 14:41 22528 ----a-w- c:\winnt\Internet Logs\xDB1D4.tmp
2009-09-28 23:18 . 2009-09-28 23:24 30720 ----a-w- c:\winnt\Internet Logs\xDB1D3.tmp
2009-09-28 23:07 . 2009-09-28 23:24 5086720 ----a-w- c:\winnt\Internet Logs\xDB1D2.tmp
2009-09-14 04:02 . 2009-09-14 04:02 66232 ---ha-w- c:\winnt\system32\mlfcache.dat
2009-09-11 19:13 . 2009-09-11 21:32 1105 ----a-w- c:\documents and settings\Administrator\Application Data\Genie-Soft\GBMPro8\Jobs\FjungPPF\00000000\maindata.sys
2009-09-10 02:14 . 2009-09-10 02:18 18432 ----a-w- c:\winnt\Internet Logs\xDB1D1.tmp
2009-09-10 02:02 . 2009-09-10 02:18 5033984 ----a-w- c:\winnt\Internet Logs\xDB1D0.tmp
2009-09-08 06:00 . 2009-09-08 06:00 16384 ----atw- c:\winnt\system32\Perflib_Perfdata_204.dat
2009-09-08 04:48 . 2009-09-08 06:00 17920 ----a-w- c:\winnt\Internet Logs\xDB1CF.tmp
2009-09-08 04:43 . 2009-09-08 06:00 5032448 ----a-w- c:\winnt\Internet Logs\xDB1CE.tmp
2009-09-08 04:22 . 2009-09-08 04:22 16384 ----atw- c:\winnt\system32\Perflib_Perfdata_294.dat
2009-09-08 01:30 . 2009-09-08 04:22 28160 ----a-w- c:\winnt\Internet Logs\xDB1CD.tmp
2009-09-07 19:29 . 2009-09-08 04:22 5032448 ----a-w- c:\winnt\Internet Logs\xDB1CC.tmp
2009-09-05 06:36 . 1999-12-07 04:00 55056 ----a-w- c:\winnt\system32\msasn1.dll
2009-09-03 21:23 . 2009-09-03 21:31 21504 ----a-w- c:\winnt\Internet Logs\xDB1CB.tmp
2009-09-03 19:56 . 2009-09-03 21:31 5032448 ----a-w- c:\winnt\Internet Logs\xDB1CA.tmp
2009-08-29 01:09 . 2009-08-29 01:09 152576 ----a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\jre1.6.0_15\lzma.dll
2009-08-27 22:51 . 2009-08-27 22:51 576512 ----a-w- c:\winnt\system32\WININET.DLL
2009-08-24 00:35 . 2009-08-24 00:37 36352 ----a-w- c:\winnt\Internet Logs\xDB1C9.tmp
2009-08-23 23:46 . 2009-08-24 00:37 5012992 ----a-w- c:\winnt\Internet Logs\xDB1C8.tmp
2009-08-23 19:46 . 2009-08-23 23:45 5012992 ----a-w- c:\winnt\Internet Logs\xDB1C5.tmp
2009-08-23 19:46 . 2009-08-23 23:45 17408 ----a-w- c:\winnt\Internet Logs\xDB1C7.tmp
2009-08-23 17:16 . 2009-08-23 17:53 14848 ----a-w- c:\winnt\Internet Logs\xDB1C4.tmp
2009-08-23 17:05 . 2009-08-23 17:53 5012992 ----a-w- c:\winnt\Internet Logs\xDB1C3.tmp
2009-08-23 16:27 . 2009-08-23 17:05 14336 ----a-w- c:\winnt\Internet Logs\xDB1C6.tmp
2009-08-23 16:22 . 2009-08-23 17:05 5012992 ----a-w- c:\winnt\Internet Logs\xDB1C2.tmp
2009-08-23 15:22 . 2009-08-23 16:21 18432 ----a-w- c:\winnt\Internet Logs\xDB1C1.tmp
2009-08-23 15:02 . 2009-08-23 16:21 5012992 ----a-w- c:\winnt\Internet Logs\xDB1C0.tmp
2003-09-10 06:59 . 2003-09-10 06:59 21952 ---ha-w- c:\program files\folder.htt
2006-06-02 17:43 . 2006-05-26 22:49 2828 --sha-w- c:\winnt\system32\KGyGaAvL.sys
.

------- Sigcheck -------

[-] 2002-11-27 02:03 . 36678803A8030EE9A771935CFC1848BD . 52224 . . [9.0.1.56] . . c:\winnt\system32\mspmsnsv.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"EM_EXEC"="c:\progra~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE" [2001-04-10 34816]
"UpdReg"="c:\winnt\Updreg.exe" [2000-05-11 90112]
"Jet Detection"="c:\program files\Creative\SBAudigy\PROGRAM\ADGJDet.exe" [2001-04-20 28672]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2005-08-11 249856]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 81920]
"USB Storage Toolbox"="c:\program files\USBToolbox\Res.EXE" [2002-01-15 118784]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2008-01-12 623992]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-05-30 413696]
"AtiPTA"="atiptaxx.exe" - c:\winnt\system32\atiptaxx.exe [2002-04-12 282624]
"HydarVisionDesktopManager"="desk95.exe" - c:\winnt\system32\Desk95.exe [2001-08-21 663552]
"WINDVDPatch"="CTHELPER.EXE" - c:\winnt\system32\CTHELPER.EXE [2002-07-03 24576]
"NVIDIA nForce APU1 Utilities"="NVATray.exe" - c:\winnt\system32\NVATray.exe [2002-01-19 45056]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HPAiODevice.lnk - c:\program files\Hewlett-Packard\hp psc 700 series\bin\hpodev07.exe [2009-9-9 278528]
ZoneAlarm Pro.lnk.disabled [2004-8-17 580]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"HideShutdownScripts"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoWelcomeScreen"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoChangeAnimation"= 0 (0x0)
"RestrictCpl"= 0 (0x0)
"DisallowCpl"= 0 (0x0)
"RestrictRun"= 0 (0x0)
"NoCustomizeWebView"= 0 (0x0)
"NoFileAssociate"= 0 (0x0)
"NoDFSTab"= 0 (0x0)
"NoWebView"= 0 (0x0)
"DontShowSuperHidden"= 0 (0x0)
"NoSMConfigurePrograms"= 0 (0x0)
"NoSMMyPictures"= 0 (0x0)
"NoStartMenuMyMusic"= 0 (0x0)
"NoHelp"= 0 (0x0)
"NoCommonGroups"= 0 (0x0)
"NoStartMenuSubFolders"= 0 (0x0)
"NoDisconnect"= 0 (0x0)
"NoNtSecurity"= 0 (0x0)
"GreyMSIAds"= 0 (0x0)
"ForceMaxRecentDocs"= 0 (0x0)
"NoFileUrl"= 0 (0x0)
"NoExpandedNewMenu"= 0 (0x0)
"SpecifyDefaultButtons"= 0 (0x0)
"NoRecentDocsNetHood"= 0 (0x0)
"PromptRunasInstallNetPath"= 1 (0x1)
"NoResolveTrack"= 0 (0x0)
"NoDevMgrUpdate"= 0 (0x0)
"ForceCopyAclwithFile"= 0 (0x0)
"StartRunNoHOMEPATH"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"wave"=audpci40.dll
"midi1"=audpci40.dll
"mixer"=audpci40.dll
"aux"=audpci40.dll

[HKLM\~\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=c:\documents and settings\Administrator\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=c:\winnt\pss\Adobe Gamma.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^OpenOffice.org 3.0.lnk]
path=c:\documents and settings\Administrator\Start Menu\Programs\Startup\OpenOffice.org 3.0.lnk
backup=c:\winnt\pss\OpenOffice.org 3.0.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^WinRescue.lnk]
path=c:\documents and settings\Administrator\Start Menu\Programs\Startup\WinRescue.lnk
backup=c:\winnt\pss\WinRescue.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Acrobat Assistant.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk
backup=c:\winnt\pss\Acrobat Assistant.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^InterVideo WinCinema Manager.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\InterVideo WinCinema Manager.lnk
backup=c:\winnt\pss\InterVideo WinCinema Manager.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\winnt\pss\Microsoft Office.lnkCommon Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"TlntSvr"=3 (0x3)
"TapiSrv"=3 (0x3)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
"nod32kui"="c:\program files\Eset\nod32kui.exe" /WAITSERVICE

R0 cc_4g;cc_4g;c:\winnt\system32\drivers\cc_4g.sys [9/14/2007 1:31 PM 189856]
R0 phylock;phylock;c:\winnt\system32\drivers\phylock.sys [9/22/2007 9:06 PM 12032]
R1 nod32drv;nod32drv;c:\winnt\system32\drivers\nod32drv.sys [9/29/2007 12:01 PM 15424]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [11/11/2009 10:44 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [11/11/2009 10:44 AM 74480]
R2 cc_firewall;cc_firewall;c:\winnt\system32\drivers\cc_firewall.sys [9/14/2007 1:31 PM 7680]
R3 emu10kx;Creative EMU10K1/EMU10K2 Audio Driver (WDM);c:\winnt\system32\drivers\e10kx2k.sys [9/10/2003 9:20 AM 1745168]
R3 hpoid407;IEEE-1284.4 Driver hpoid407;c:\winnt\system32\drivers\hpoid407.sys [9/9/2009 6:11 PM 50448]
R3 hpoius07;USB to IEEE-1284.4 Translation Driver hpoius07;c:\winnt\system32\drivers\hpoius07.sys [9/9/2009 6:11 PM 17904]
R3 openhci;Microsoft USB Open Host Controller Driver;c:\winnt\system32\drivers\openhci.sys [12/6/1999 8:00 PM 24784]
R3 usbhub20;USB Hub Support;c:\winnt\system32\drivers\usbhub20.sys [9/10/2003 8:17 AM 49776]
S3 BFUSBFLT;BAFO 1394/USB-ATA/ATAPI Filter Driver;c:\winnt\system32\drivers\BFUSBFLT.SYS [5/27/2008 6:57 AM 12297]
S3 DCamUSBSTK017;STK017 Camera;c:\winnt\system32\DRIVERS\STK017W2.sys --> c:\winnt\system32\DRIVERS\STK017W2.sys [?]
S3 EUSBMMC;eUSB Driver for MultiMediaCard;c:\winnt\system32\drivers\EUSBMMC.SYS [9/10/2003 1:54 PM 54211]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [11/11/2009 10:44 AM 7408]
S3 TJUSBDEV;TJUSBDEV.Sys TjgerJet USB Device Driver;c:\winnt\system32\Drivers\TJUSBDEV.sys --> c:\winnt\system32\Drivers\TJUSBDEV.sys [?]
S3 USBSTOR2K;USB Mass Storage Driver for 2k;c:\winnt\system32\DRIVERS\UMSTOR2K.SYS --> c:\winnt\system32\DRIVERS\UMSTOR2K.SYS [?]
.
Contents of the 'Scheduled Tasks' folder

2007-10-07 c:\winnt\Tasks\GBM - fjungNP-Full.job
- c:\program files\Genie-Soft\GBMPro8\GBM8.exe [2007-09-16 16:59]

2009-11-21 c:\winnt\Tasks\Genie Backup Manager Pro 8.job
- c:\progra~1\GENIE-~1\GBMPro8\GBM8.exe [2007-09-16 16:59]

2009-11-19 c:\winnt\Tasks\WinRescue 2000.job
- c:\progra~1\WINRES~1\Rescue2K.exe [2003-10-14 13:05]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.ca/
uInternet Settings,ProxyOverride = 127.0.0.1
uSearchURL,(Default) = hxxp://toolbar.ask.com/toolbarv/askRedirect?o=101703&gct=&gc=1&q=%s
IE: &Download All with FlashGet - c:\program files\FlashGet\jc_all.htm
IE: &Download with FlashGet - c:\program files\FlashGet\jc_link.htm
IE: Append to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Send Image to Photo Library - file://c:\documents and settings\Administrator\Application Data\MGI\PhotoSuite4\Temp\MGI00000.html
LSP: c:\winnt\system32\imon.dll
LSP: %SystemRoot%\system32\msafd.dll
Trusted Zone: com.tw\www.msi
Trusted Zone: google.com\www
Trusted Zone: microsoft.com\update
DPF: DirectAnimation Java Classes - file://c:\winnt\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\winnt\Java\classes\xmldso.cab
DPF: {0C954B1E-3F7E-4038-BB2C-6FC13536AF15} - hxxp://www.withlink.com/activex/HaruSetup.cab
DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} - hxxp://liveupdate.msi.com.tw/autobios/LOnline/install.cab
DPF: {B95B384C-BC15-42BE-80A2-DD28BC805908} - hxxp://www.westsidestory.co.kr/download/westsidestory_weblaunch.cab
DPF: {D4328549-2B43-40D5-BBF8-77D6EEA60412} - hxxp://www.ldphotostation.com/images/global/activex/StorefrontUpload19.CAB
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)
HKLM-Run-HPAIO_PrintFolderMgr - c:\winnt\system32\spool\DRIVERS\W32X86\hpoopm07.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-21 01:40
Windows 5.0.2195 Service Pack 4 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Iomega Activity Disk2]
"ImagePath"="\"\""
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(200)
c:\winnt\system32\ensres32.dll
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\winnt\system32\wzcdlg.dll
c:\winnt\system32\WZCSAPI.DLL

- - - - - - - > 'lsass.exe'(240)
c:\winnt\system32\imon.dll

- - - - - - - > 'explorer.exe'(1192)
c:\winnt\AppPatch\AcLayers.DLL
c:\winnt\system32\Hook95.dll
c:\winnt\system32\SHDOCVW.DLL
c:\winnt\system32\ctagent.dll
c:\winnt\system32\ensres32.dll
c:\progra~1\Logitech\MOUSEW~1\SYSTEM\LgMousHk.dll
.
------------------------ Other Running Processes ------------------------
.
c:\winnt\system32\crypserv.exe
c:\program files\Diskeeper Corporation\Diskeeper\DkService.exe
c:\progra~1\Iomega\System32\AppServices.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Eset\nod32krn.exe
c:\winnt\system32\regsvc.exe
c:\winnt\system32\MSTask.exe
c:\winnt\System32\tcpsvcs.exe
c:\winnt\system32\stisvc.exe
c:\winnt\system32\ZoneLabs\vsmon.exe
c:\winnt\System32\WBEM\WinMgmt.exe
c:\winnt\system32\MsPMSPSv.exe
c:\progra~1\HEWLET~1\HPPSC7~1\bin\hpoevm07.exe
c:\winnt\system32\hpoipm07.exe
c:\program files\Hewlett-Packard\hp psc 700 series\bin\HPOSTS07.exe
c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
.
**************************************************************************
.
Completion time: 2009-11-21 01:46 - machine was rebooted
ComboFix-quarantined-files.txt 2009-11-21 09:46

Pre-Run: 6,349,971,456 bytes free
Post-Run: 6,613,340,160 bytes free

- - End Of File - - D5BBCA8CB30654D3F578727221CA1C31
November 21st, 2009, 05:54 AM
MJames

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:50:01 AM, on 11/21/2009
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\crypserv.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\WINNT\System32\svchost.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\tcpsvcs.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\MsPMSPSv.exe
C:\WINNT\system32\svchost.exe
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\WINNT\system32\atiptaxx.exe
C:\WINNT\system32\desk95.exe
C:\WINNT\system32\CTHELPER.EXE
C:\WINNT\system32\NVATray.exe
C:\Program Files\USBToolbox\Res.EXE
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Hewlett-Packard\hp psc 700 series\bin\hpodev07.exe
C:\PROGRA~1\HEWLET~1\HPPSC7~1\bin\hpoevm07.exe
C:\WINNT\system32\hpoipm07.exe
C:\Program Files\Hewlett-Packard\hp psc 700 series\bin\HPOSTS07.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\WINNT\explorer.exe
C:\WINNT\system32\notepad.exe
C:\WINNT\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://toolbar.ask.com/toolbarv/askR...3&gct=&gc=1&q=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://toolbar.ask.com/toolbarv/askR...gct=&gc=1&q=%s
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 7\SnagItBHO.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 7\SnagItIEAddin.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [HydarVisionDesktopManager] desk95.exe
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINNT\Updreg.exe
O4 - HKLM\..\Run: [Jet Detection] C:\Program Files\Creative\SBAudigy\PROGRAM\ADGJDet.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [NVIDIA nForce APU1 Utilities] NVATray.exe
O4 - HKLM\..\Run: [USB Storage Toolbox] C:\Program Files\USBToolbox\Res.EXE
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HPAIO_PrintFolderMgr] C:\WINNT\system32\spool\DRIVERS\W32X86\hpoopm07.exe
O4 - Global Startup: HPAiODevice.lnk = C:\Program Files\Hewlett-Packard\hp psc 700 series\bin\hpodev07.exe
O4 - Global Startup: ZoneAlarm Pro.lnk.disabled
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Toolbars\Restrictions present
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Send Image to Photo Library - file://C:\Documents and Settings\Administrator\Application Data\MGI\PhotoSuite4\Temp\MGI00000.html
O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\Program Files\ATI Multimedia\TV\EXPLBAR.DLL
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O15 - Trusted Zone: http://www.msi.com.tw
O16 - DPF: {0C954B1E-3F7E-4038-BB2C-6FC13536AF15} (HaruSetup Class) - http://www.withlink.com/activex/HaruSetup.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - http://download.bitdefender.com/reso...an8/oscan8.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://go.divx.com/plugin/DivXBrowserPlugin.cab
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} - http://h20270.www2.hp.com/ediags/gmn...tDetection.cab
O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} (WebSDev Control) - http://liveupdate.msi.com.tw/autobio...ne/install.cab
O16 - DPF: {B95B384C-BC15-42BE-80A2-DD28BC805908} (AtlCtrl Class) - http://www.westsidestory.co.kr/downl..._weblaunch.cab
O16 - DPF: {CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1_01) -
O16 - DPF: {CB50428B-657F-47DF-9B32-671F82AA73F7} (Photodex Presenter AX control) - http://www.photodex.com/pxplay.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe...bat/nos/gp.cab
O16 - DPF: {D4328549-2B43-40D5-BBF8-77D6EEA60412} (StorefrontUpload.BulkImageUpload1) - http://www.ldphotostation.com/images...ntUpload19.CAB
O16 - DPF: {F127B9BA-89EA-4B04-9C67-2074A9DF61FD} (Photo Upload Plugin Class) - http://blacks.pnimedia.com/upload/ac...pv2.0.0.9.cab?
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINNT\SYSTEM32\crypserv.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: getPlus(R) Helper - Unknown owner - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: ScsiAccess - Unknown owner - C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe
O23 - Service: SolidWorks Licensing Service - SolidWorks - C:\Program Files\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINNT\system32\ZoneLabs\vsmon.exe

--
End of file - 10549 bytes
November 21st, 2009, 06:15 AM
MJames

Ran into problem when I rebooted my system.
Blue screen -
stop 0x0000007B (0XEB82784C, 0XC0000034, 0X000000000, 0X000000000)
inaccessible_boot_drive

I tried rebooting 3 times - same blue screen above.
Also, tried rebooting in safe mode - no luck.- same blue screen.
:(
November 21st, 2009, 09:32 PM
Broni

This is not good.
Possible bad drive, but it too much of coincidence, it happened right after running Combofix.

More likely, system files messed up, or mbr messed up.

Do you have Win 2K CD?
November 21st, 2009, 11:03 PM
MJames

Quote:

Originally Posted by Broni

This is not good.
Possible bad drive, but it too much of coincidence, it happened right after running Combofix.

More likely, system files messed up, or mbr messed up.

Do you have Win 2K CD?

yes i do.
November 21st, 2009, 11:08 PM
Broni

Boot to it, access Recovery Console, run chkdsk and fixmbr.
Details: http://support.microsoft.com/kb/229716
November 21st, 2009, 11:31 PM
MJames

booted using the cd.
it says win98 has detected that c drive does not contain a valid fat or fat32 partition...several possible causes..

drive may need to be partitioned - create a partition on the drive, run fdisk from msdos command prompt.

you may be using 3rd party disk partitioning software. if you are using this, remove emerg boot disk and restart your computer, then follow on-screen instructions to start your computer from floppy disk.

some viruses cause drive c not to register. you can use virus scanning program to check your computer for viruses.

Diagnostic tools were successfully loaded to drive c.

It's at the command prompt.

I should point out that I pulled the HD out and hooked it up to my laptop to see if I could see the HD. I have 2 partitions: C (o/s & programs) & D ( data) drive both are visible.

----------------------------
EDIT:

NM the above - just used the win2k boot floppy I have.
the following message came up:
Win2k could not start up - following file is missing or corrupt:
windows 2000 root>\system32\ntoskrnl.exe
please re-install a copy of the above file

now what...
November 21st, 2009, 11:47 PM
Broni

I think, we have to stop here and I'll ask you to post your issue under "Windows 2000" section.
HJT forum has very limited access and it's mainly used for dealing with infections.
You'll get more attention at Windows section.

When your computer is bootable again, please, return back here.
November 22nd, 2009, 12:03 AM
MJames

Quote:

Originally Posted by Broni

I think, we have to stop here and I'll ask you to post your issue under "Windows 2000" section.
HJT forum has very limited access and it's mainly used for dealing with infections.
You'll get more attention at Windows section.

When your computer is bootable again, please, return back here.

will do.
Cheers.
November 22nd, 2009, 12:49 AM
Broni

OK :)
November 22nd, 2009, 03:15 AM
Broni

I have a possible fix for you.

Boot to Recovery Console again...

once at the command prompt, type carefully

copy c:\windows\system32\dllcache\pciide.sys c:\windows\system32\drivers\pciide.sys

then press Enter

then type Exit at the command prompt, press enter and that will exit the Recovery Console and attempt to restart your machine

if it can not find the file at c:\windows\system32\dllcache\pciide.sys then type

copy c:\i386\pciide.sys c:\windows\system32\drivers\pciide.sys