i think i have malware avg updates are "forbidden"

bustbibs · Joined: May 13, 2009 Posts: 5

i also get some redirects from google and safari and firefox crash quite often. "cmd" and "regedit" do nothing. also malware bytes update also doesnt work. any help would be great. reading through oder posts there seems to be a lot of people in similar positions but i dont know enough about computers to know if ican copy what they did with out damaging my computer further. thanks in advance for any help. adam
(sorry about double post posted in wrong section first)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:34:09, on 13/05/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Belkin\Belkin Wireless Network Utility\WLanCfgG.exe
C:\WINDOWS\System32\GEARSec.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Kontiki\KService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\vsnpstd3.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.co.uk/ig/dell?hl=en&client=dell-usuk&channel=uk&amp...p...d=1
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.wanadoo.co.uk
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www1.euro.dell.com/content/default.aspx?c=uk&l=en&s=gen
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.co.uk/ig/dell?hl=en&client=dell-usuk&channel=uk&amp...p...d=1
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.google.co.uk/ig/dell?hl=en&client=dell-usuk&channel...&ib
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Wanadoo
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - (no file)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [tsnpstd3] C:\WINDOWS\tsnpstd3.exe
O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Search with Wanadoo - res://C:\PROGRA~1\Wanadoo\WSBar\WSBar.dll/VSearch.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.wanadoo.co.uk
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Belkin Wireless USB Network Adapter (Belkin Wireless USB Network Adapter Service) - Unknown owner - C:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe
O23 - Service: McAfee Real-time Scanner (McShield) - Unknown owner - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe (file missing)
O23 - Service: McAfee SystemGuards (McSysmon) - Unknown owner - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe (file missing)
O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Norton Ghost\Agent\VProSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

--
End of file - 11495 bytes

greyknight17 · Joined: Feb 03, 2003 Posts: 5674 Location: Brooklyn, NY

Try not to follow the instructions for another user as they will most likely be a little different. Let's get this started Very Happy

Download GooredFix and save it to your Desktop. Double-click Goored.exe to run it. Select 1. Find Goored (no fix) by typing 1 and pressing Enter. A log will open, please post the contents of that log in your next reply (it can also be found on your desktop, called Goored.txt). Note: Do not run Option #2 yet.

Go to http://www.bleepingcomputer.com/combofix/how-to-use-combofix and follow the instructions on how to install the Recovery Console and run ComboFix. Go through all the steps until posting the log part. Post the combofix log here. If it gives you problems running it, delete it and download it again. But this time, before you even save it, rename it to bustbibs.com instead and on the file type drop down, change it to All files. Save it to your desktop and try running it again.

bustbibs · Joined: May 13, 2009 Posts: 5

thanks for the quick reply Very Happy

however, something very starnge has happened. Although ive restarted the pc many times today trying to solve this (to no prevail) when i tried to run combofix my whole computer crashed and i had to turn it off at the power button. when i turned it back on all the things that wernt working before have started working. Avg updated so did malware bytes, the browers are not crashing and sites are not redirected. and cmd etc work. no idea what is happening Confused

any way i did what you said incase im still infected if i ever was thanks again

GooredFix v1.92 by jpshortstuff
Log created at 17:24 on 13/05/2009 running Option #1 (Adam Bibbings)
Firefox version 3.0.10 (en-GB)

=====Suspect Goored Entries=====

=====Dumping Registry Values=====

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.10\extensions]
"Plugins"="C:\Program Files\Mozilla Firefox\plugins"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.10\extensions]
"Components"="C:\Program Files\Mozilla Firefox\components"

ComboFix 09-05-12.06 - Adam Bibbings 13/05/2009 17:51:06.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3326.2751 [GMT 1:00]
Running from: C:\Documents and Settings\Adam Bibbings\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)
.

((((((((((((((((((((((((( Files Created from 2009-04-13 to 2009-05-13 )))))))))))))))))))))))))))))))
.

2009-05-13 11:00:05 . 2009-05-13 11:00:05 0 d-----w C:\Program Files\Trend Micro
2009-05-12 21:58:21 . 2009-05-12 22:04:04 0 d-----w C:\AVGTemp
2009-05-12 21:47:23 . 2009-05-12 21:47:23 11952 ----a-w C:\WINDOWS\system32\avgrsstx.dll
2009-05-12 21:47:23 . 2009-05-12 21:47:23 108552 ----a-w C:\WINDOWS\system32\drivers\avgtdix.sys
2009-05-12 21:47:18 . 2009-05-12 21:47:18 325896 ----a-w C:\WINDOWS\system32\drivers\avgldx86.sys
2009-05-12 21:47:09 . 2009-05-13 16:36:02 0 d-----w C:\WINDOWS\system32\drivers\Avg
2009-05-12 21:47:01 . 2009-05-12 21:47:03 0 d-----w C:\Documents and Settings\All Users\Application Data\avg8
2009-04-17 12:10:34 . 2009-03-06 14:22:18 284160 ------w C:\WINDOWS\system32\dllcache\pdh.dll
2009-04-17 12:10:34 . 2009-02-06 10:39:08 35328 ------w C:\WINDOWS\system32\dllcache\sc.exe
2009-04-17 12:10:34 . 2009-02-09 12:10:48 401408 ------w C:\WINDOWS\system32\dllcache\rpcss.dll
2009-04-17 12:10:34 . 2009-02-06 11:11:05 110592 ------w C:\WINDOWS\system32\dllcache\services.exe
2009-04-17 12:10:34 . 2009-02-09 12:10:48 473600 ------w C:\WINDOWS\system32\dllcache\fastprox.dll
2009-04-17 12:10:34 . 2009-02-06 10:10:02 227840 ------w C:\WINDOWS\system32\dllcache\wmiprvse.exe
2009-04-17 12:10:34 . 2009-02-09 12:10:48 453120 ------w C:\WINDOWS\system32\dllcache\wmiprvsd.dll
2009-04-17 12:10:33 . 2009-02-09 12:10:49 729088 ------w C:\WINDOWS\system32\dllcache\lsasrv.dll
2009-04-17 12:10:33 . 2009-02-09 12:10:48 617472 ------w C:\WINDOWS\system32\dllcache\advapi32.dll
2009-04-17 12:10:33 . 2009-02-09 12:10:48 714752 ------w C:\WINDOWS\system32\dllcache\ntdll.dll
2009-04-17 12:09:27 . 2008-05-03 11:55:36 2560 ------w C:\WINDOWS\system32\xpsp4res.dll
2009-04-17 12:09:27 . 2008-04-21 12:08:15 215552 ------w C:\WINDOWS\system32\dllcache\wordpad.exe
2009-04-15 19:18:44 . 2009-04-15 19:20:05 0 d-----w C:\ToolBar SD
2009-04-14 23:20:23 . 2008-06-19 15:24:30 28544 ----a-w C:\WINDOWS\system32\drivers\pavboot.sys
2009-04-14 23:18:31 . 2009-04-14 23:18:31 0 d-----w C:\Program Files\Panda Security

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-13 16:39:13 . 2009-04-02 11:37:17 0 d-----w C:\Program Files\Malwarebytes' Anti-Malware
2009-05-06 14:56:12 . 2008-05-11 18:14:19 49536 ----a-w C:\Documents and Settings\Adam Bibbings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-14 23:03:01 . 2007-07-15 13:41:41 0 d-----w C:\Program Files\Java
2009-04-13 09:58:46 . 2008-03-29 15:46:08 0 d-----w C:\Program Files\Safari
2009-04-10 10:38:32 . 2009-04-10 10:38:12 0 d-----w C:\Program Files\iTunes
2009-04-10 10:38:17 . 2009-04-10 10:38:17 0 d-----w C:\Program Files\iPod
2009-04-10 10:38:08 . 2007-07-23 11:21:37 0 d-----w C:\Program Files\Common Files\Apple
2009-04-09 17:24:53 . 2009-04-09 17:24:53 664 ----a-w C:\WINDOWS\system32\d3d9caps.dat
2009-04-06 14:32:54 . 2009-04-02 11:37:18 38496 ----a-w C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2009-04-06 14:32:46 . 2009-04-02 11:37:21 15504 ----a-w C:\WINDOWS\system32\drivers\mbam.sys
2009-04-02 16:34:51 . 2009-04-02 16:10:42 0 d-----w C:\Program Files\Spybot - Search & Destroy
2009-03-28 18:26:43 . 2008-03-30 00:00:06 39420 ---ha-w C:\WINDOWS\system32\mlfcache.dat
2009-03-25 15:34:53 . 2009-03-23 20:10:16 0 d-----w C:\Program Files\Microsoft Silverlight
2009-03-23 20:47:16 . 2009-03-23 20:47:13 0 d-----w C:\Program Files\Messenger Plus! Live
2009-03-23 20:18:57 . 2007-07-18 09:48:27 49536 ----a-w C:\Documents and Settings\Adam Bibbings\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-03-23 20:10:08 . 2009-03-23 20:06:13 0 d-----w C:\Program Files\Microsoft
2009-03-23 20:09:55 . 2008-03-02 23:58:12 0 d-----w C:\Program Files\Windows Live
2009-03-23 20:09:24 . 2009-03-23 20:09:24 0 d-----w C:\Program Files\Microsoft Sync Framework
2009-03-23 20:08:32 . 2009-03-23 20:08:32 0 d-----w C:\Program Files\Microsoft SQL Server Compact Edition
2009-03-23 20:06:00 . 2009-03-23 20:06:00 0 d-----w C:\Program Files\Windows Live SkyDrive
2009-03-23 19:51:15 . 2009-03-23 19:51:15 0 d-----w C:\Program Files\Common Files\Windows Live
2009-03-19 15:32:48 . 2008-01-29 11:01:28 23400 ----a-w C:\WINDOWS\system32\drivers\GEARAspiWDM.sys
2009-03-17 16:38:05 . 2008-11-23 14:58:06 0 d-----w C:\Program Files\QuickTime
2009-03-09 04:19:08 . 2008-12-19 14:39:21 410984 ----a-w C:\WINDOWS\system32\deploytk.dll
2009-03-06 14:22:18 . 2004-08-10 11:51:19 284160 ----a-w C:\WINDOWS\system32\pdh.dll
2009-03-05 23:59:00 . 2009-03-17 16:34:52 1900544 ----a-w C:\WINDOWS\system32\usbaaplrc.dll
2009-03-05 23:59:00 . 2007-11-10 15:52:31 36864 ----a-w C:\WINDOWS\system32\drivers\usbaapl.sys
2009-02-20 08:10:59 . 2004-08-10 11:51:29 666112 ----a-w C:\WINDOWS\system32\wininet.dll
2009-02-20 08:10:57 . 2004-08-10 11:51:09 81920 ----a-w C:\WINDOWS\system32\ieencode.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 15:07:20 2260480]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 18:51:28 3885408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-06-28 16:43:00 8466432]
"DMXLauncher"="C:\Program Files\Dell\Media Experience\DMXLauncher.exe" [2005-10-05 02:12:00 94208]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2006-10-03 10:35:42 221184]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2006-10-03 10:37:04 81920]
"RoxWatchTray"="C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2006-11-05 10:22:16 221184]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2004-12-13 14:30:00 58992]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-07-26 11:07:16 185784]
"tsnpstd3"="C:\WINDOWS\tsnpstd3.exe" [2006-11-29 15:28:54 262144]
"snpstd3"="C:\WINDOWS\vsnpstd3.exe" [2006-09-18 13:12:12 843776]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-06-28 16:43:00 81920]
"AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-02-06 16:27:40 177472]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2009-01-05 16:18:48 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2009-04-02 15:11:02 342312]
"SunJavaUpdateSched"="C:\Program Files\Java\jre6\bin\jusched.exe" [2009-03-09 04:19:17 148888]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2009-05-12 21:47:06 1947928]
"nwiz"="nwiz.exe" - C:\WINDOWS\system32\nwiz.exe [2007-06-28 16:43:00 1626112]
"SigmatelSysTrayApp"="stsystra.exe" - C:\WINDOWS\stsystra.exe [2006-08-15 01:38:14 282624]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 00:12:16 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" - C:\WINDOWS\system32\narrator.exe [2008-04-14 00:12:29 53760]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-4-23 29696]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-05-12 21:47:23 11952 ----a-w C:\WINDOWS\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]
@=""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"4oD"="C:\Program Files\Kontiki\KHost.exe" -all
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
"Norton Ghost 10.0"="C:\Program Files\Norton Ghost\Agent\GhostTray.exe"
"TalkAndWrite"=C:\Documents and Settings\All Users\Application Data\Skype\Plugins\Plugins\1163D2B46CC742E5A3CC9E4157887751\TalkAndWrite.exe /run
"PCSuiteTrayApplication"=C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
"RoxioDragToDisc"="C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\EA GAMES\\Battlefield 2\\bf2_w32ded.exe"=
"C:\\Program Files\\Xfire\\xfire.exe"=
"C:\\Program Files\\Common Files\\Roxio Shared\\9.0\\SharedCOM\\RoxWatchTray9.exe"=
"C:\\Program Files\\Kontiki\\KService.exe"=
"C:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"=
"C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
"C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"C:\\Program Files\\GameSpy\\Comrade\\Comrade.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"C:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Safari\\Safari.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

R0 pavboot;pavboot;C:\WINDOWS\system32\drivers\pavboot.sys [15/04/2009 00:20:23 28544]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;C:\WINDOWS\system32\drivers\avgldx86.sys [12/05/2009 22:47:18 325896]
R1 AvgTdiX;AVG Free8 Network Redirector;C:\WINDOWS\system32\drivers\avgtdix.sys [12/05/2009 22:47:23 108552]
R2 avg8emc;AVG Free8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [12/05/2009 22:47:05 908568]
R2 avg8wd;AVG Free8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [12/05/2009 22:47:03 298776]
R2 fssfltr;FssFltr;C:\WINDOWS\system32\drivers\fssfltr_tdi.sys [23/03/2009 21:09:57 55152]
R2 SeaPort;SeaPort;C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [14/01/2009 18:53:02 226656]
S3 fsssvc;Windows Live Family Safety;C:\Program Files\Windows Live\Family Safety\fsssvc.exe [06/02/2009 19:08:58 533360]
S3 PciCon;PciCon;\??\E:\PciCon.sys --> E:\PciCon.sys [?]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c4c421e4-2205-11de-a2e9-00173faf1bf4}]
\Shell\AutoRun\command - WDSetup.exe
.
Contents of the 'Scheduled Tasks' folder

2009-05-12 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:57:18 . 2008-07-30 11:34:12]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.co.uk/
mStart Page = hxxp://www1.euro.dell.com/content/default.aspx?c=uk&l=en&s=gen
uInternet Connection Wizard,ShellNext = hxxp://www.google.co.uk/ig/dell?hl=en&client=dell-usuk&channel...&ib
uInternet Settings,ProxyOverride = <local>;*.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Search with Wanadoo - C:\PROGRA~1\Wanadoo\WSBar\WSBar.dll/VSearch.htm
FF - ProfilePath - C:\Documents and Settings\Adam Bibbings\Application Data\Mozilla\Firefox\Profiles\eze3fffr.default\
FF - component: C:\Documents and Settings\Adam Bibbings\Application Data\Mozilla\Firefox\Profiles\eze3fffr.default\extensions\piclens@cooliris.com\components\coolirisstub.dll
FF - plugin: C:\Documents and Settings\Adam Bibbings\Application Data\Mozilla\Firefox\Profiles\eze3fffr.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp07074039.dll
FF - plugin: C:\Program Files\Microsoft\Office Live\npOLW.dll
FF - plugin: C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: C:\Program Files\Mozilla Firefox\plugins\npBBCPlugin.dll
FF - plugin: C:\Program Files\Veoh Networks\Veoh\Plugins\noreg\NPVeohVersion.dll
FF - plugin: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll

---- FIREFOX POLICIES ----
FF - user.js: dom.disable_open_during_load - true // Popupblocker control handled by McAfee Privacy Service
.

greyknight17 · Joined: Feb 03, 2003 Posts: 5674 Location: Brooklyn, NY

Open up the ComboFix log file at C:\ComboFix\ComboFix.txt. Your post was cutoff near the bottom. Just post the remaining portions after that.

Nothing seems to be removed by either tools. If everything is still working properly, just check everything for updates (Windows and all your security programs). You may run a few different scans to see if they pick up anything.

bustbibs · Joined: May 13, 2009 Posts: 5

ComboFix 09-05-12.06 - Adam Bibbings 13/05/2009 17:51:06.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3326.2751 [GMT 1:00]
Running from: C:\Documents and Settings\Adam Bibbings\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)
.

((((((((((((((((((((((((( Files Created from 2009-04-13 to 2009-05-13 )))))))))))))))))))))))))))))))
.

2009-05-13 11:00:05 . 2009-05-13 11:00:05 0 d-----w C:\Program Files\Trend Micro
2009-05-12 21:58:21 . 2009-05-12 22:04:04 0 d-----w C:\AVGTemp
2009-05-12 21:47:23 . 2009-05-12 21:47:23 11952 ----a-w C:\WINDOWS\system32\avgrsstx.dll
2009-05-12 21:47:23 . 2009-05-12 21:47:23 108552 ----a-w C:\WINDOWS\system32\drivers\avgtdix.sys
2009-05-12 21:47:18 . 2009-05-12 21:47:18 325896 ----a-w C:\WINDOWS\system32\drivers\avgldx86.sys
2009-05-12 21:47:09 . 2009-05-13 16:36:02 0 d-----w C:\WINDOWS\system32\drivers\Avg
2009-05-12 21:47:01 . 2009-05-12 21:47:03 0 d-----w C:\Documents and Settings\All Users\Application Data\avg8
2009-04-17 12:10:34 . 2009-03-06 14:22:18 284160 ------w C:\WINDOWS\system32\dllcache\pdh.dll
2009-04-17 12:10:34 . 2009-02-06 10:39:08 35328 ------w C:\WINDOWS\system32\dllcache\sc.exe
2009-04-17 12:10:34 . 2009-02-09 12:10:48 401408 ------w C:\WINDOWS\system32\dllcache\rpcss.dll
2009-04-17 12:10:34 . 2009-02-06 11:11:05 110592 ------w C:\WINDOWS\system32\dllcache\services.exe
2009-04-17 12:10:34 . 2009-02-09 12:10:48 473600 ------w C:\WINDOWS\system32\dllcache\fastprox.dll
2009-04-17 12:10:34 . 2009-02-06 10:10:02 227840 ------w C:\WINDOWS\system32\dllcache\wmiprvse.exe
2009-04-17 12:10:34 . 2009-02-09 12:10:48 453120 ------w C:\WINDOWS\system32\dllcache\wmiprvsd.dll
2009-04-17 12:10:33 . 2009-02-09 12:10:49 729088 ------w C:\WINDOWS\system32\dllcache\lsasrv.dll
2009-04-17 12:10:33 . 2009-02-09 12:10:48 617472 ------w C:\WINDOWS\system32\dllcache\advapi32.dll
2009-04-17 12:10:33 . 2009-02-09 12:10:48 714752 ------w C:\WINDOWS\system32\dllcache\ntdll.dll
2009-04-17 12:09:27 . 2008-05-03 11:55:36 2560 ------w C:\WINDOWS\system32\xpsp4res.dll
2009-04-17 12:09:27 . 2008-04-21 12:08:15 215552 ------w C:\WINDOWS\system32\dllcache\wordpad.exe
2009-04-15 19:18:44 . 2009-04-15 19:20:05 0 d-----w C:\ToolBar SD
2009-04-14 23:20:23 . 2008-06-19 15:24:30 28544 ----a-w C:\WINDOWS\system32\drivers\pavboot.sys
2009-04-14 23:18:31 . 2009-04-14 23:18:31 0 d-----w C:\Program Files\Panda Security

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-13 16:39:13 . 2009-04-02 11:37:17 0 d-----w C:\Program Files\Malwarebytes' Anti-Malware
2009-05-06 14:56:12 . 2008-05-11 18:14:19 49536 ----a-w C:\Documents and Settings\Adam Bibbings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-14 23:03:01 . 2007-07-15 13:41:41 0 d-----w C:\Program Files\Java
2009-04-13 09:58:46 . 2008-03-29 15:46:08 0 d-----w C:\Program Files\Safari
2009-04-10 10:38:32 . 2009-04-10 10:38:12 0 d-----w C:\Program Files\iTunes
2009-04-10 10:38:17 . 2009-04-10 10:38:17 0 d-----w C:\Program Files\iPod
2009-04-10 10:38:08 . 2007-07-23 11:21:37 0 d-----w C:\Program Files\Common Files\Apple
2009-04-09 17:24:53 . 2009-04-09 17:24:53 664 ----a-w C:\WINDOWS\system32\d3d9caps.dat
2009-04-06 14:32:54 . 2009-04-02 11:37:18 38496 ----a-w C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2009-04-06 14:32:46 . 2009-04-02 11:37:21 15504 ----a-w C:\WINDOWS\system32\drivers\mbam.sys
2009-04-02 16:34:51 . 2009-04-02 16:10:42 0 d-----w C:\Program Files\Spybot - Search & Destroy
2009-03-28 18:26:43 . 2008-03-30 00:00:06 39420 ---ha-w C:\WINDOWS\system32\mlfcache.dat
2009-03-25 15:34:53 . 2009-03-23 20:10:16 0 d-----w C:\Program Files\Microsoft Silverlight
2009-03-23 20:47:16 . 2009-03-23 20:47:13 0 d-----w C:\Program Files\Messenger Plus! Live
2009-03-23 20:18:57 . 2007-07-18 09:48:27 49536 ----a-w C:\Documents and Settings\Adam Bibbings\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-03-23 20:10:08 . 2009-03-23 20:06:13 0 d-----w C:\Program Files\Microsoft
2009-03-23 20:09:55 . 2008-03-02 23:58:12 0 d-----w C:\Program Files\Windows Live
2009-03-23 20:09:24 . 2009-03-23 20:09:24 0 d-----w C:\Program Files\Microsoft Sync Framework
2009-03-23 20:08:32 . 2009-03-23 20:08:32 0 d-----w C:\Program Files\Microsoft SQL Server Compact Edition
2009-03-23 20:06:00 . 2009-03-23 20:06:00 0 d-----w C:\Program Files\Windows Live SkyDrive
2009-03-23 19:51:15 . 2009-03-23 19:51:15 0 d-----w C:\Program Files\Common Files\Windows Live
2009-03-19 15:32:48 . 2008-01-29 11:01:28 23400 ----a-w C:\WINDOWS\system32\drivers\GEARAspiWDM.sys
2009-03-17 16:38:05 . 2008-11-23 14:58:06 0 d-----w C:\Program Files\QuickTime
2009-03-09 04:19:08 . 2008-12-19 14:39:21 410984 ----a-w C:\WINDOWS\system32\deploytk.dll
2009-03-06 14:22:18 . 2004-08-10 11:51:19 284160 ----a-w C:\WINDOWS\system32\pdh.dll
2009-03-05 23:59:00 . 2009-03-17 16:34:52 1900544 ----a-w C:\WINDOWS\system32\usbaaplrc.dll
2009-03-05 23:59:00 . 2007-11-10 15:52:31 36864 ----a-w C:\WINDOWS\system32\drivers\usbaapl.sys
2009-02-20 08:10:59 . 2004-08-10 11:51:29 666112 ----a-w C:\WINDOWS\system32\wininet.dll
2009-02-20 08:10:57 . 2004-08-10 11:51:09 81920 ----a-w C:\WINDOWS\system32\ieencode.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 15:07:20 2260480]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 18:51:28 3885408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-06-28 16:43:00 8466432]
"DMXLauncher"="C:\Program Files\Dell\Media Experience\DMXLauncher.exe" [2005-10-05 02:12:00 94208]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2006-10-03 10:35:42 221184]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2006-10-03 10:37:04 81920]
"RoxWatchTray"="C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2006-11-05 10:22:16 221184]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2004-12-13 14:30:00 58992]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-07-26 11:07:16 185784]
"tsnpstd3"="C:\WINDOWS\tsnpstd3.exe" [2006-11-29 15:28:54 262144]
"snpstd3"="C:\WINDOWS\vsnpstd3.exe" [2006-09-18 13:12:12 843776]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-06-28 16:43:00 81920]
"AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-02-06 16:27:40 177472]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2009-01-05 16:18:48 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2009-04-02 15:11:02 342312]
"SunJavaUpdateSched"="C:\Program Files\Java\jre6\bin\jusched.exe" [2009-03-09 04:19:17 148888]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2009-05-12 21:47:06 1947928]
"nwiz"="nwiz.exe" - C:\WINDOWS\system32\nwiz.exe [2007-06-28 16:43:00 1626112]
"SigmatelSysTrayApp"="stsystra.exe" - C:\WINDOWS\stsystra.exe [2006-08-15 01:38:14 282624]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 00:12:16 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" - C:\WINDOWS\system32\narrator.exe [2008-04-14 00:12:29 53760]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-4-23 29696]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-05-12 21:47:23 11952 ----a-w C:\WINDOWS\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]
@=""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"4oD"="C:\Program Files\Kontiki\KHost.exe" -all
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
"Norton Ghost 10.0"="C:\Program Files\Norton Ghost\Agent\GhostTray.exe"
"TalkAndWrite"=C:\Documents and Settings\All Users\Application Data\Skype\Plugins\Plugins\1163D2B46CC742E5A3CC9E4157887751\TalkAndWrite.exe /run
"PCSuiteTrayApplication"=C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
"RoxioDragToDisc"="C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\EA GAMES\\Battlefield 2\\bf2_w32ded.exe"=
"C:\\Program Files\\Xfire\\xfire.exe"=
"C:\\Program Files\\Common Files\\Roxio Shared\\9.0\\SharedCOM\\RoxWatchTray9.exe"=
"C:\\Program Files\\Kontiki\\KService.exe"=
"C:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"=
"C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
"C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"C:\\Program Files\\GameSpy\\Comrade\\Comrade.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"C:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Safari\\Safari.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

R0 pavboot;pavboot;C:\WINDOWS\system32\drivers\pavboot.sys [15/04/2009 00:20:23 28544]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;C:\WINDOWS\system32\drivers\avgldx86.sys [12/05/2009 22:47:18 325896]
R1 AvgTdiX;AVG Free8 Network Redirector;C:\WINDOWS\system32\drivers\avgtdix.sys [12/05/2009 22:47:23 108552]
R2 avg8emc;AVG Free8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [12/05/2009 22:47:05 908568]
R2 avg8wd;AVG Free8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [12/05/2009 22:47:03 298776]
R2 fssfltr;FssFltr;C:\WINDOWS\system32\drivers\fssfltr_tdi.sys [23/03/2009 21:09:57 55152]
R2 SeaPort;SeaPort;C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [14/01/2009 18:53:02 226656]
S3 fsssvc;Windows Live Family Safety;C:\Program Files\Windows Live\Family Safety\fsssvc.exe [06/02/2009 19:08:58 533360]
S3 PciCon;PciCon;\??\E:\PciCon.sys --> E:\PciCon.sys [?]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c4c421e4-2205-11de-a2e9-00173faf1bf4}]
\Shell\AutoRun\command - WDSetup.exe
.
Contents of the 'Scheduled Tasks' folder

2009-05-12 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:57:18 . 2008-07-30 11:34:12]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.co.uk/
mStart Page = hxxp://www1.euro.dell.com/content/default.aspx?c=uk&l=en&s=gen
uInternet Connection Wizard,ShellNext = hxxp://www.google.co.uk/ig/dell?hl=en&client=dell-usuk&channel...&ib
uInternet Settings,ProxyOverride = <local>;*.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Search with Wanadoo - C:\PROGRA~1\Wanadoo\WSBar\WSBar.dll/VSearch.htm
FF - ProfilePath - C:\Documents and Settings\Adam Bibbings\Application Data\Mozilla\Firefox\Profiles\eze3fffr.default\
FF - component: C:\Documents and Settings\Adam Bibbings\Application Data\Mozilla\Firefox\Profiles\eze3fffr.default\extensions\piclens@cooliris.com\components\coolirisstub.dll
FF - plugin: C:\Documents and Settings\Adam Bibbings\Application Data\Mozilla\Firefox\Profiles\eze3fffr.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp07074039.dll
FF - plugin: C:\Program Files\Microsoft\Office Live\npOLW.dll
FF - plugin: C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: C:\Program Files\Mozilla Firefox\plugins\npBBCPlugin.dll
FF - plugin: C:\Program Files\Veoh Networks\Veoh\Plugins\noreg\NPVeohVersion.dll
FF - plugin: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll

---- FIREFOX POLICIES ----
FF - user.js: dom.disable_open_during_load - true // Popupblocker control handled by McAfee Privacy Service
.
well evry thing seems fine evrythings now updated as you said and scans have picked up nothing. thanks for the help. and that is all the log. thnak again but i think its magically sorted its self. cheers adam

greyknight17 · Joined: Feb 03, 2003 Posts: 5674 Location: Brooklyn, NY

OK, no problem.

To help prevent future spyware infections, read the Anti-Spyware Tutorial and use the tools provided.

Go to Start->Run, copy/paste in combofix /u and hit OK to remove it.

Topic will be locked since issue is resolved.