Hello gamerdad007 our security team will be with you as soon as possible,...thanks for your patience

Hi and welcome.
Please make sure you carry out all the instructions posted here.
http://www.pchelpforum.com/new-hijac...e-posting.html

Oops!! My apologies, Pancake. The instructions must have changed since the last time I posted. I won't have time tonight, however I will download all needed programs and run them tomorrow. Thank you

I have downloaded and ran all the required programs (*that I can) for prework. The only problem I ran into is the first step with RootRepeal. When I run that I get an instant bsod and system reset. The reset is so fast I don't have time to read 2 words on the bsod. I tried it twice and it did the same thing the second time.

Besides that I have everything else...........


DDS (Ver_09-09-29.01) - NTFSx86
Run by XXXX at 15:09:17.50 on Sun 10/11/2009
Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_11
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3070.2581 [GMT -4:00]

AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

============== Running Processes ===============

I:\WINDOWS\system32\nvsvc32.exe
I:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
I:\WINDOWS\System32\svchost.exe -k netsvcs
I:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
I:\WINDOWS\system32\spoolsv.exe
I:\Program Files\Avira\AntiVir Desktop\sched.exe
svchost.exe
I:\WINDOWS\Explorer.EXE
I:\WINDOWS\system32\rundll32.exe
I:\Program Files\Razer\Reclusa\razerhid.exe
I:\Program Files\CyberLink\PCM4Everio\EverioService.exe
I:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
I:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
I:\WINDOWS\system32\RUNDLL32.EXE
I:\Program Files\Avira\AntiVir Desktop\avgnt.exe
I:\Program Files\HP\HP Software Update\HPWuSchd2.exe
I:\Program Files\Common Files\Real\Update_OB\realsched.exe
I:\Program Files\Bigfoot Networks\Killer Driver\KillerTray.exe
I:\Program Files\Logitech\SetPoint\SetPoint.exe
I:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
I:\Program Files\Avira\AntiVir Desktop\avguard.exe
I:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
I:\Program Files\Bonjour\mDNSResponder.exe
I:\WINDOWS\system32\svchost.exe -k hpdevmgmt
I:\Program Files\Java\jre6\bin\jqs.exe
I:\Program Files\Bigfoot Networks\Killer Driver\PortManager.exe
I:\WINDOWS\System32\svchost.exe -k HPZ12
I:\Program Files\Mozilla Firefox\firefox.exe
I:\Program Files\Razer\Reclusa\razertra.exe
I:\WINDOWS\System32\svchost.exe -k HPZ12
I:\WINDOWS\system32\PnkBstrA.exe
I:\WINDOWS\system32\PnkBstrB.exe
I:\Program Files\Cyberlink\Shared Files\RichVideo.exe
I:\WINDOWS\system32\svchost.exe -k imgsvc
I:\WINDOWS\System32\StkASv2K.exe
I:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
I:\WINDOWS\system32\wuauclt.exe
I:\Documents and Settings\Sean\My Documents\Downloads\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.yahoo.com/
uInternet Settings,ProxyOverride = *.local
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - i:\program files\hp\smart web printing\hpswp_printenhancer.dll
BHO: HP Print Clips: {053f9267-dc04-4294-a72c-58f732d338c0} - i:\program files\hp\smart web printing\hpswp_framework.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - i:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - i:\program files\rpbrowserrecordplugin.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - i:\program files\java\jre6\bin\ssv.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - i:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - i:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - No File
mRun: [SPIRun] "i:\windows\system32\rundll32.exe" SPIRun.dll,RunDLLEntry
mRun: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
mRun: [Reclusa] "i:\program files\razer\reclusa\razerhid.exe"
mRun: [EverioService] "i:\program files\cyberlink\pcm4everio\EverioService.exe"
mRun: [Adobe Reader Speed Launcher] "i:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [RemoteControl] "i:\program files\cyberlink\powerdvd\PDVDServ.exe"
mRun: [NeroFilterCheck] i:\program files\common files\ahead\lib\NeroCheck.exe
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE i:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [NvCplDaemon] RUNDLL32.EXE i:\windows\system32\NvCpl.dll,NvStartup
mRun: [avgnt] "i:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [UVS10 Preload] i:\program files\ulead systems\ulead videostudio se dvd\uvPL.exe
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
mRun: [QuickTime Task] "i:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "i:\program files\itunes\iTunesHelper.exe"
mRun: [HP Software Update] i:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [TkBellExe] "i:\program files\common files\real\update_ob\realsched.exe" -osboot
StartupFolder: i:\docume~1\alluse~1\startm~1\programs\startup\kil ler~1.lnk - i:\program files\bigfoot networks\killer driver\KillerTray.exe
StartupFolder: i:\docume~1\alluse~1\startm~1\programs\startup\log ite~1.lnk - i:\program files\logitech\setpoint\SetPoint.exe
IE: E&xport to Microsoft Excel - i:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - i:\program files\messenger\msmsgs.exe
IE: {58ECB495-38F0-49cb-A538-10282ABF65E7} - {E763472E-A716-4CD9-89BD-DBDA6122F741} - i:\program files\hp\smart web printing\hpswp_extensions.dll
IE: {700259D7-1666-479a-93B1-3250410481E8} - {A93C41D8-01F8-4F8B-B14C-DE20B117E636} - i:\program files\hp\smart web printing\hpswp_extensions.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - i:\progra~1\micros~2\office11\REFIEBAR.DLL
LSP: %SYSTEMROOT%\system32\BfLLR.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -
Notify: AtiExtEvent - Ati2evxx.dll
Notify: LBTWlgn - i:\program files\common files\logitech\bluetooth\LBTWlgn.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - i:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - i:\docume~1\sean\applic~1\mozilla\firefox\profiles \t5kx8w1x.default\
FF - prefs.js: browser.startup.homepage - hxxp://by123w.bay123.mail.live.com/mail/TodayLight.aspx?wa=wsignin1.0&layout=TodayDefault& n=1730071098
FF - plugin: c:\program files\real\realplayer\netscape6\nppl3260.dll
FF - plugin: c:\program files\real\realplayer\netscape6\nprjplug.dll
FF - plugin: c:\program files\real\realplayer\netscape6\nprpjplug.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - i:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - i:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - i:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true
============= SERVICES / DRIVERS ===============

R0 nvrd32;NVIDIA nForce RAID Driver;i:\windows\system32\drivers\nvrd32.sys [2008-5-27 125440]
R1 avgio;avgio;i:\program files\avira\antivir desktop\avgio.sys [2009-5-16 11608]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;i:\program files\avira\antivir desktop\sched.exe [2009-5-16 108289]
R2 AntiVirService;Avira AntiVir Guard;i:\program files\avira\antivir desktop\avguard.exe [2009-5-16 185089]
R2 avgntflt;avgntflt;i:\windows\system32\drivers\avgn tflt.sys [2009-5-16 55640]
R2 Killer Port Manager;Killer Port Manager;i:\program files\bigfoot networks\killer driver\PortManager.exe [2009-2-13 236544]
R3 NetB834x;Killer NIC Gaming Adapter Service;i:\windows\system32\drivers\NetB834x.sys [2009-2-13 103072]
R3 NetbEdge;Killer NIC NDIS-Edge Service;i:\windows\system32\drivers\NetBEdge.sys [2009-2-13 22048]
R3 RecFltr;Reclusa Keyboard;i:\windows\system32\drivers\RecFltr.sys [2009-2-13 41984]
R3 t3;SB Xtreme Audio Notebook;i:\windows\system32\drivers\t3.sys [2008-10-17 735744]
R3 t3filt;t3filt;i:\windows\system32\drivers\t3filt.s ys [2007-8-20 1656960]
S3 AtiHdmiService;ATI Function Driver for HDMI Service;i:\windows\system32\drivers\AtiHdmi.sys [2007-7-20 84992]
S3 rootrepeal;rootrepeal;\??\i:\windows\system32\driv ers\rootrepeal.sys --> i:\windows\system32\drivers\rootrepeal.sys [?]

=============== Created Last 30 ================

2009-10-11 14:59 15 a------- i:\program files\settings.dat
2009-10-11 14:58 472,064 a------- i:\program files\RootRepeal.exe
2009-10-11 14:05 4,850 a------- i:\windows\system32\OEMLOGO.bmp
2009-10-09 02:57 <DIR> --d----- i:\program files\templates
2009-10-09 02:57 43,056 a------- i:\program files\rpshellsearch.dll
2009-10-09 02:57 <DIR> --d----- i:\program files\browserrecord
2009-10-09 02:57 <DIR> --d----- i:\program files\library
2009-10-09 02:57 <DIR> --d----- i:\program files\converter
2009-10-09 00:13 <DIR> --d----- i:\windows\Performance
2009-10-09 00:12 <DIR> --d----- i:\program files\Microsoft Windows 7 Upgrade Advisor
2009-09-27 21:59 116,839 a------- i:\windows\hpqins00.dat
2009-09-27 21:56 <DIR> --d----- i:\docume~1\sean\applic~1\HpUpdate
2009-09-27 21:55 <DIR> --d----- i:\windows\Hewlett-Packard
2009-09-26 19:45 <DIR> --d----- i:\docume~1\alluse~1\applic~1\WEBREG
2009-09-26 19:41 506,020 -------- i:\windows\hpoins15.dat.temp
2009-09-26 19:41 1,039 -------- i:\windows\hpomdl15.dat.temp
2009-09-26 19:39 <DIR> --d----- i:\program files\common files\HP
2009-09-26 19:39 <DIR> --d----- i:\program files\common files\Hewlett-Packard
2009-09-26 19:34 <DIR> --d----- i:\program files\HP
2009-09-26 19:31 139,826 a------- i:\windows\hpoins15.dat
2009-09-26 19:31 1,039 -------- i:\windows\hpomdl15.dat
2009-09-13 16:19 <DIR> --d----- i:\program files\iPod
2009-09-13 16:19 <DIR> --d----- i:\program files\iTunes
2009-09-13 16:19 <DIR> --d----- i:\docume~1\alluse~1\applic~1\{755AC846-7372-4AC8-8550-C52491DAA8BD}

==================== Find3M ====================

2009-10-09 02:56 222,728 a------- i:\program files\realplay.exe
2009-10-09 02:56 1,166 a------- i:\program files\realplay.exe.manifest
2009-10-09 02:56 716 a------- i:\program files\CinemasterVideo.4.3.manifest
2009-10-09 02:56 572 a------- i:\program files\CinemasterAudio.4.3.manifest
2009-10-09 02:56 17,846 a------- i:\program files\videotest.rm
2009-10-09 02:56 207 a------- i:\program files\subscription.rnx
2009-10-09 02:56 499,712 a------- i:\windows\system32\msvcp71.dll
2009-10-09 02:56 348,160 a------- i:\windows\system32\msvcr71.dll
2009-10-09 02:56 198,208 a------- i:\program files\RecordingManager.exe
2009-10-09 02:56 23,558 a------- i:\program files\freeoffers.ico
2009-10-09 02:56 685 a------- i:\program files\RecordingManager.exe.manifest
2009-10-08 21:11 8,034 a------- i:\program files\hijackthis.log
2009-08-05 05:01 204,800 a------- i:\windows\system32\mswebdvd.dll
2009-07-17 15:01 58,880 a------- i:\windows\system32\atl.dll
2009-07-13 23:43 286,208 a------- i:\windows\system32\wmpdxm.dll
2009-05-15 20:36 22,328 a------- i:\docume~1\sean\applic~1\PnkBstrK.sys
2009-04-23 12:15 6,305 a------- i:\program files\hijackthis4_23.log
2009-03-18 10:03 40,113,160 a------- i:\program files\SpySweeperRegSetup_EN.exe
2007-06-28 14:36 401,720 a------- i:\program files\HijackThis.exe

============= FINISH: 15:09:30.78 ===============


Attach.txt


Results of screen317's Security Check version 0.99.0
Windows XP Service Pack 3
``````````````````````````````
Antivirus/Firewall Check:
Avira AntiVir Personal - Free Antivirus
Antivirus up to date!
``````````````````````````````
Anti-malware/Other Utilities Check:
HijackThis 2.0.2
CCleaner (remove only)
Java(TM) 6 Update 11
Java(TM) 6 Update 3
Out of date Java installed!
Adobe Flash Player 10
Adobe Reader 9.1.3
``````````````````````````````
Process Check:
objlist.exe by Laurent
Avira Antivir avgnt.exe
Avira Antivir avguard.exe
``````````````````````````````
DNS Vulnerability Check:
[color]nslookup.exe missing![/color]
Unknown. This method cannot test your vulnerability to DNS cache poisoning.

`````````End of Log```````````

You will need to download ComboFix.exe. Download Combofix from any of the links below. You must rename it before saving it. Name it ComFx, and Save it to your desktop.


http://download.bleepingcomputer.com/sUBs/ComboFix.exe
http://www.forospyware.com/sUBs/ComboFix.exe


* IMPORTANT !!! Save ComboFix.exe to your Desktop
It is important that it is saved and renamed following this process directly to your desktop**


========================================
Please copy this page to *Notepad* and save to your desktop for reference as you will not have any browsers open while you are carrying out portions of these instructions.
It's IMPORTANT to carry out the instructions in the sequence listed below.
1. Close any open browsers.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
Open *notepad* and copy/paste the red text in the quotebox below into it:
Save this as CFScript.txt, in the same location as ComboFix.exe which is on the Desktop.


Refering to the picture above, drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt
Please copy and paste the ComboFix.txt in your next reply please.

*Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.Altering this script in any way could damage your computer*

ComboFix 09-10-11.01 - Sean 10/12/2009 2:02.1.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3070.2501 [GMT -4:00]
Running from: i:\documents and settings\Sean\Desktop\comfx.exe
Command switches used :: i:\documents and settings\Sean\Desktop\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

FILE ::
"i:\program files\hijackthis4_23.log"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

i:\program files\hijackthis4_23.log
i:\windows\system32\AutoRun.inf

.
((((((((((((((((((((((((( Files Created from 2009-09-12 to 2009-10-12 )))))))))))))))))))))))))))))))
.

2009-10-11 18:59 . 2009-10-11 19:04 15 ----a-w- i:\program files\settings.dat
2009-10-11 18:58 . 2009-08-13 15:14 472064 ----a-w- i:\program files\RootRepeal.exe
2009-10-09 06:57 . 2009-10-09 06:57 -------- d-----w- i:\program files\templates
2009-10-09 06:57 . 2009-10-09 06:57 43056 ----a-w- i:\program files\rpshellsearch.dll
2009-10-09 06:57 . 2009-10-09 06:57 -------- d-----w- i:\program files\browserrecord
2009-10-09 06:57 . 2009-10-09 06:57 -------- d-----w- i:\program files\library
2009-10-09 06:57 . 2009-10-09 06:57 -------- d-----w- i:\program files\converter
2009-10-09 06:56 . 2009-10-09 06:56 452104 ----a-w- i:\documents and settings\Sean\Application Data\Real\RealPlayer\setup\AU_setup9.exe
2009-10-09 04:13 . 2009-10-09 04:13 -------- d-----w- i:\windows\Performance
2009-10-09 04:12 . 2009-10-09 04:12 -------- d-----w- i:\documents and settings\Sean\Local Settings\Application Data\Microsoft Corporation
2009-09-26 23:40 . 2009-09-26 23:40 -------- d-----w- i:\documents and settings\All Users\Application Data\HP Product Assistant
2009-09-26 23:40 . 2009-09-26 23:44 -------- d-----w- i:\documents and settings\All Users\Application Data\HP
2009-09-26 23:39 . 2009-09-26 23:39 -------- d-----w- i:\program files\Common Files\HP
2009-09-26 23:39 . 2009-09-26 23:39 -------- d-----w- i:\program files\Hewlett-Packard
2009-09-26 23:39 . 2009-09-26 23:39 -------- d-----w- i:\program files\Common Files\Hewlett-Packard
2009-09-26 23:34 . 2009-09-26 23:45 -------- d-----w- i:\program files\HP
2009-09-26 23:31 . 2009-09-26 23:46 139826 ----a-w- i:\windows\hpoins15.dat
2009-09-26 23:31 . 2007-06-05 23:04 1039 ------w- i:\windows\hpomdl15.dat
2009-09-14 17:32 . 2009-09-14 17:32 1924440 ----a-w- i:\documents and settings\Sean\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe
2009-09-13 20:19 . 2009-09-13 20:19 -------- d-----w- i:\program files\iPod
2009-09-13 20:19 . 2009-09-13 20:19 -------- d-----w- i:\program files\iTunes
2009-09-13 20:19 . 2009-09-13 20:19 -------- d-----w- i:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2009-09-13 20:18 . 2009-09-13 20:19 -------- d-----w- i:\program files\QuickTime
2009-09-12 18:38 . 2009-09-12 18:38 -------- d-----w- i:\documents and settings\All Users\Application Data\McAfee

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
2009-10-09 20:23 . 2009-02-13 19:15 -------- d-----w- i:\program files\SpeedFan
2009-10-09 06:56 . 2009-07-05 05:21 716 ----a-w- i:\program files\CinemasterVideo.4.3.manifest
2009-10-09 06:56 . 2009-07-05 05:21 572 ----a-w- i:\program files\CinemasterAudio.4.3.manifest
2009-10-09 06:56 . 2009-07-05 05:21 222728 ----a-w- i:\program files\realplay.exe
2009-10-09 06:56 . 2009-07-05 05:21 1166 ----a-w- i:\program files\realplay.exe.manifest
2009-10-09 06:56 . 2009-07-05 05:21 207 ----a-w- i:\program files\subscription.rnx
2009-10-09 06:56 . 2009-07-05 05:21 17846 ----a-w- i:\program files\videotest.rm
2009-10-09 06:56 . 2009-07-05 05:21 685 ----a-w- i:\program files\RecordingManager.exe.manifest
2009-10-09 06:56 . 2009-07-05 05:21 198208 ----a-w- i:\program files\RecordingManager.exe
2009-10-09 06:56 . 2009-07-05 05:21 23558 ----a-w- i:\program files\freeoffers.ico
2009-10-09 06:56 . 2009-03-11 01:25 499712 ----a-w- i:\windows\system32\msvcp71.dll
2009-10-09 06:56 . 2003-02-21 03:42 348160 ----a-w- i:\windows\system32\msvcr71.dll
2009-10-09 04:12 . 2009-10-09 04:12 -------- d-----w- i:\program files\Microsoft Windows 7 Upgrade Advisor
2009-10-09 01:11 . 2009-02-20 16:47 8034 ----a-w- i:\program files\hijackthis.log
2009-10-07 18:17 . 2009-05-16 17:33 -------- d-----w- i:\program files\ASUS
2009-10-07 18:17 . 2009-02-13 17:20 -------- d--h--w- i:\program files\InstallShield Installation Information
2009-10-06 15:14 . 2009-08-04 17:10 -------- d-----w- i:\program files\Microsoft Silverlight
2009-10-06 03:14 . 2009-03-11 01:24 -------- d-----w- i:\program files\Cyberlink
2009-10-05 00:47 . 2009-09-28 01:56 -------- d-----w- i:\documents and settings\Sean\Application Data\HpUpdate
2009-09-28 16:12 . 2009-02-23 18:01 -------- d-----w- i:\documents and settings\Sean\Application Data\mjusbsp
2009-09-28 02:00 . 2009-09-28 01:59 116839 ----a-w- i:\windows\hpqins00.dat
2009-09-26 23:49 . 2009-09-26 23:49 -------- d-----w- i:\documents and settings\Sean\Application Data\HP
2009-09-26 23:45 . 2009-09-26 23:45 -------- d-----w- i:\documents and settings\All Users\Application Data\WEBREG
2009-09-26 23:45 . 2009-09-26 23:45 -------- d-----w- i:\documents and settings\Sean\Application Data\HPAppData
2009-09-21 01:39 . 2009-02-14 01:56 -------- d-----w- i:\documents and settings\Sean\Application Data\Apple Computer
2009-09-13 20:19 . 2009-02-14 01:55 -------- d-----w- i:\program files\Common Files\Apple
2009-09-11 13:10 . 2009-02-13 22:02 -------- d-----w- i:\documents and settings\All Users\Application Data\NOS
2009-09-10 18:38 . 2009-09-10 18:38 -------- d-----w- i:\documents and settings\All Users\Application Data\McAfee Security Scan
2009-08-29 21:32 . 2009-08-29 21:32 -------- d-----w- i:\documents and settings\All Users\Application Data\Hewlett-Packard
2009-08-19 22:54 . 2009-08-19 22:54 -------- d-----w- i:\documents and settings\All Users\Application Data\Blizzard Entertainment
2009-08-15 18:15 . 2009-06-20 16:33 -------- d-----w- i:\documents and settings\All Users\Application Data\WinZip
2009-08-06 23:24 . 2009-02-13 17:13 327896 ----a-w- i:\windows\system32\wucltui.dll
2009-08-06 23:24 . 2009-02-13 17:13 209632 ----a-w- i:\windows\system32\wuweb.dll
2009-08-06 23:24 . 2009-02-13 17:13 35552 ----a-w- i:\windows\system32\wups.dll
2009-08-06 23:24 . 2008-10-16 19:09 44768 ----a-w- i:\windows\system32\wups2.dll
2009-08-06 23:24 . 2009-02-13 17:13 53472 ----a-w- i:\windows\system32\wuauclt.exe
2009-08-06 23:24 . 2006-02-28 12:00 96480 ----a-w- i:\windows\system32\cdm.dll
2009-08-06 23:23 . 2009-02-13 17:13 575704 ----a-w- i:\windows\system32\wuapi.dll
2009-08-06 23:23 . 2009-02-13 17:13 1929952 ----a-w- i:\windows\system32\wuaueng.dll
2009-08-05 09:01 . 2006-02-28 12:00 204800 ----a-w- i:\windows\system32\mswebdvd.dll
2009-08-01 16:16 . 2009-08-01 16:16 95576 ----a-w- i:\documents and settings\Sean\Application Data\mjusbsp\ug00000\magicJack.dll
2009-08-01 16:16 . 2009-09-28 16:12 6256600 ---ha-w- i:\documents and settings\Sean\Application Data\mjusbsp\in00000\setup.exe
2009-08-01 16:16 . 2009-08-02 15:15 6256600 ---ha-w- i:\documents and settings\Sean\Application Data\mjusbsp\Upgrade\setup1.exe
2009-08-01 16:16 . 2009-08-01 16:16 6256600 ----a-w- i:\documents and settings\Sean\Application Data\mjusbsp\ug00000\setup.exe
2009-08-01 16:16 . 2009-08-01 16:16 413304 ----a-w- i:\documents and settings\Sean\Application Data\mjusbsp\magicJackLoader.exe
2009-08-01 16:16 . 2009-08-01 16:16 480608 ----a-w- i:\documents and settings\Sean\Application Data\mjusbsp\octvqe1_apiw.dll
2009-08-01 16:16 . 2009-08-01 16:16 214360 ----a-w- i:\documents and settings\Sean\Application Data\mjusbsp\TjVista.dll
2009-08-01 16:16 . 2009-08-01 16:16 325040 ----a-w- i:\documents and settings\Sean\Application Data\mjusbsp\TjIpSys.dll
2009-08-01 16:16 . 2009-08-01 16:16 570736 ----a-w- i:\documents and settings\Sean\Application Data\mjusbsp\SJHandsetMagicJack.dll
2009-08-01 16:15 . 2009-08-01 16:15 87384 ----a-w- i:\documents and settings\Sean\Application Data\mjusbsp\st00000\mjsetup.exe
2009-08-01 16:15 . 2009-08-01 16:15 95576 ----a-w- i:\documents and settings\Sean\Application Data\mjusbsp\st00000\magicJack.dll
2009-08-01 16:15 . 2009-08-01 16:15 95576 ----a-w- i:\documents and settings\Sean\Application Data\mjusbsp\magicJack.dll
2009-08-01 16:13 . 2009-08-01 16:13 12231512 ----a-w- i:\documents and settings\Sean\Application Data\mjusbsp\magicJack.exe
2009-08-01 16:12 . 2009-09-28 16:12 728600 ---ha-w- i:\documents and settings\Sean\Application Data\mjusbsp\ar00000\install.exe
2009-08-01 16:12 . 2009-08-02 15:15 728600 ---ha-w- i:\documents and settings\Sean\Application Data\mjusbsp\Upgrade\install1.exe
2009-08-01 16:12 . 2009-08-01 16:12 728600 ----a-w- i:\documents and settings\Sean\Application Data\mjusbsp\ug00000\install.exe
2009-08-01 16:12 . 2009-08-01 16:12 87384 ----a-w- i:\documents and settings\Sean\Application Data\mjusbsp\in00000\mjsetup.exe
2009-08-01 16:12 . 2009-08-01 16:12 95576 ----a-w- i:\documents and settings\Sean\Application Data\mjusbsp\in00000\magicJack.dll
2009-08-01 16:11 . 2009-08-01 16:11 441704 ----a-w- i:\documents and settings\Sean\Application Data\mjusbsp\ug00000\magicJackSplash.exe
2009-08-01 16:11 . 2009-08-01 16:11 441704 ----a-w- i:\documents and settings\Sean\Application Data\mjusbsp\st00000\magicJackSplash.exe
2009-08-01 16:11 . 2009-08-01 16:11 441704 ----a-w- i:\documents and settings\Sean\Application Data\mjusbsp\magicJackSplash.exe
2009-08-01 16:11 . 2009-08-01 16:11 441704 ----a-w- i:\documents and settings\Sean\Application Data\mjusbsp\in00000\magicJackSplash.exe
2009-08-01 16:11 . 2009-08-01 16:11 50520 ----a-w- i:\documents and settings\Sean\Application Data\mjusbsp\cdloader2.exe
2009-07-23 07:49 . 2009-02-13 17:19 33360 ----a-w- i:\documents and settings\Sean\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-07-17 19:01 . 2006-02-28 12:00 58880 ----a-w- i:\windows\system32\atl.dll
2009-07-17 02:43 . 2009-07-17 02:43 12862 ----a-r- i:\documents and settings\Sean\Application Data\Microsoft\Installer\{0E2B767B-EA6A-489B-BF83-8083FE1DB661}\_1EEFFF72773535163E4216.exe
2009-03-18 14:03 . 2009-03-18 14:01 40113160 ----a-w- i:\program files\SpySweeperRegSetup_EN.exe
2007-06-28 18:36 . 2007-06-28 18:36 401720 ----a-w- i:\program files\HijackThis.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"Reclusa"="i:\program files\Razer\Reclusa\razerhid.exe" [2007-03-07 167936]
"EverioService"="i:\program files\CyberLink\PCM4Everio\EverioService.exe" [2007-11-01 151552]
"Adobe Reader Speed Launcher"="i:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"RemoteControl"="i:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2007-03-15 71216]
"NeroFilterCheck"="i:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2008-02-27 570664]
"NvMediaCenter"="i:\windows\system32\NvMcTray. dll" [2009-05-01 86016]
"NvCplDaemon"="i:\windows\system32\NvCpl.dll" [2009-05-01 13750272]
"avgnt"="i:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"UVS10 Preload"="i:\program files\Ulead Systems\Ulead VideoStudio SE DVD\uvPL.exe" [2006-08-09 36864]
"QuickTime Task"="i:\program files\QuickTime\QTTask.exe" [2009-09-05 417792]
"iTunesHelper"="i:\program files\iTunes\iTunesHelper.exe" [2009-09-09 305440]
"HP Software Update"="i:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-12 49152]
"TkBellExe"="i:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-10-09 198160]
"SunJavaUpdateSched"="i:\program files\Java\jre6\bin\jusched.exe" [2009-02-20 136600]
"SPIRun"="SPIRun.dll" - i:\windows\system32\SPIRun.dll [2006-11-29 8704]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - i:\windows\KHALMNPR.Exe [2008-12-19 76304]
"nwiz"="nwiz.exe" - i:\windows\system32\nwiz.exe [2009-05-01 1657376]

i:\documents and settings\All Users\Start Menu\Programs\Startup\
Killer Tray Menu.lnk - i:\program files\Bigfoot Networks\Killer Driver\KillerTray.exe [2009-2-13 604672]
Logitech SetPoint.lnk - i:\program files\Logitech\SetPoint\SetPoint.exe [2009-5-20 809488]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2009-02-19 04:30 72208 ----a-w- i:\program files\Common Files\Logitech\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKLM\~\startupfolder\I:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=i:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=i:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"i:\\Documents and Settings\\Sean\\My Documents\\World of Warcraft\\WoW-3.0.2.9056-to-3.0.3.9183-enUS-downloader.exe"=
"i:\\Documents and Settings\\Sean\\My Documents\\World of Warcraft\\Launcher.exe"=
"i:\\Documents and Settings\\Sean\\My Documents\\World of Warcraft\\WoW-3.0.8.9506-to-3.0.9.9551-enUS-downloader.exe"=
"i:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
"i:\\Documents and Settings\\Sean\\My Documents\\WoW PTR\\World of Warcraft Public Test\\WoW-0.1.0-enUS-downloader.exe"=
"i:\\Documents and Settings\\Sean\\My Documents\\WoW PTR\\World of Warcraft Public Test\\Launcher.exe"=
"i:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"i:\\Documents and Settings\\Sean\\My Documents\\World of Warcraft\\WoW-3.0.3.9183-to-3.0.8.9464-enUS-downloader.exe"=
"i:\\WINDOWS\\system32\\sessmgr.exe"=
"i:\\Documents and Settings\\Sean\\My Documents\\World of Warcraft\\WoW-3.0.8.9464-to-3.0.8.9506-enUS-downloader.exe"=
"i:\\Documents and Settings\\Sean\\My Documents\\World of Warcraft\\WoW-3.0.1-to-3.0.2-enUS-Win-Update-downloader.exe"=
"i:\\Documents and Settings\\Sean\\My Documents\\World of Warcraft\\BackgroundDownloader.exe"=
"i:\\Program Files\\Curse\\CurseClient.exe"=
"i:\\Documents and Settings\\Sean\\My Documents\\WoW PTR\\World of Warcraft Public Test\\WoW-0.1.0.9637-to-0.1.0.9658-enUS-downloader.exe"=
"i:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"i:\\WINDOWS\\system32\\dpvsetup.exe"=
"i:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaWmp.exe"=
"i:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaW.exe"=
"i:\\WINDOWS\\system32\\PnkBstrA.exe"=
"i:\\WINDOWS\\system32\\PnkBstrB.exe"=
"i:\\Documents and Settings\\Sean\\My Documents\\World of Warcraft\\WoW-3.1.2.9901-to-3.1.3.9947-enUS-downloader.exe"=
"i:\\Documents and Settings\\Sean\\My Documents\\WoW PTR\\World of Warcraft Public Test\\WoW-0.2.0.10026-to-0.2.0.10048-enUS-downloader.exe"=
"i:\\Documents and Settings\\Sean\\My Documents\\WoW PTR\\World of Warcraft Public Test\\WoW-0.2.0.10048-to-0.2.0.10072-enUS-downloader.exe"=
"i:\\Documents and Settings\\Sean\\My Documents\\WoW PTR\\World of Warcraft Public Test\\WoW-0.2.0.10072-to-0.2.0.10083-enUS-downloader.exe"=
"i:\\Documents and Settings\\Sean\\My Documents\\WoW PTR\\World of Warcraft Public Test\\wow-0.2.0.10083-to-0.2.0.10116-enUS-downloader.exe"=
"i:\\Documents and Settings\\Sean\\My Documents\\WoW PTR\\World of Warcraft Public Test\\WoW-0.2.0.10116-to-0.2.0.10128-enUS-downloader.exe"=
"i:\\Documents and Settings\\Sean\\My Documents\\WoW PTR\\World of Warcraft Public Test\\WoW-0.2.0.10128-to-0.2.0.10147-enUS-downloader.exe"=
"i:\\Documents and Settings\\Sean\\My Documents\\World of Warcraft\\WoW-3.1.3.9947-to-3.2.0.10192-enUS-downloader.exe"=
"i:\\Program Files\\iTunes\\iTunes.exe"=
"i:\\Documents and Settings\\Sean\\Application Data\\mjusbsp\\magicJack.exe"=
"i:\\Program Files\\LimeWire\\LimeWire.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724
"6112:TCP"= 6112:TCP:Blizzard Downloader: 6112
"3389:TCP"= 3389:TCP:*isabled:@xpsp2res.dll,-22009
"6100:TCP"= 6100:TCP:ventrilo - 6100
"6100:UDP"= 6100:UDP:vent 6100b
"3784:TCP"= 3784:TCP:vent 3784
"8299:TCP"= 8299:TCP:vent 8299
"67:UDP"= 67:UDPHCP Discovery Service

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;i:\program files\Avira\AntiVir Desktop\sched.exe [5/16/2009 2:39 PM 108289]
R3 NetB834x;Killer NIC Gaming Adapter Service;i:\windows\system32\drivers\NetB834x.sys [2/13/2009 1:20 PM 103072]
R3 NetbEdge;Killer NIC NDIS-Edge Service;i:\windows\system32\drivers\NetBEdge.sys [2/13/2009 1:20 PM 22048]
R3 RecFltr;Reclusa Keyboard;i:\windows\system32\drivers\RecFltr.sys [2/13/2009 5:50 PM 41984]
R3 t3;SB Xtreme Audio Notebook;i:\windows\system32\drivers\t3.sys [10/17/2008 2:41 AM 735744]
R3 t3filt;t3filt;i:\windows\system32\drivers\t3filt.s ys [8/20/2007 6:35 AM 1656960]
S2 Killer Port Manager;Killer Port Manager;i:\program files\Bigfoot Networks\Killer Driver\PortManager.exe [2/13/2009 1:20 PM 236544]
S3 AtiHdmiService;ATI Function Driver for HDMI Service;i:\windows\system32\drivers\AtiHdmi.sys [7/20/2007 7:40 PM 84992]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - i:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
LSP: %SYSTEMROOT%\system32\BfLLR.dll
FF - ProfilePath - i:\documents and settings\Sean\Application Data\Mozilla\Firefox\Profiles\t5kx8w1x.default\
FF - prefs.js: browser.startup.homepage - hxxp://by123w.bay123.mail.live.com/mail/TodayLight.aspx?wa=wsignin1.0&layout=TodayDefault& n=1730071098
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - i:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true.

************************************************** ************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2009-10-12 02:04
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

************************************************** ************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(648)
i:\windows\system32\Ati2evxx.dll
i:\program files\common files\logitech\bluetooth\LBTWlgn.dll
i:\program files\common files\logitech\bluetooth\LBTServ.dll

- - - - - - - > 'lsass.exe'(704)
i:\windows\system32\BfLLR.dll
.
Completion time: 2009-10-12 2:05
ComboFix-quarantined-files.txt 2009-10-12 06:05

Pre-Run: 135,700,885,504 bytes free
Post-Run: 135,703,613,440 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOW S
[operating systems]
h:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Micro soft Windows XP Professional" /noexecute=optin /fastdetect

240 --- E O F --- 2009-09-09 21:21