Explorer corrupt? - Free Antivirus Forum

Free Antivirus Forum - Learn about antivirus, firewalls and personal security

Explorer corrupt?

BullGuard Antivirus Forum > Virus Removal > Removal Help > Explorer corrupt?

Forum Quick Jump

[ << Previous Thread | Next Thread >> ]

Garyh3
New Member

Date Joined May 2006
Total Posts : 30

Posted 4/6/2009 4:50 PM (GMT +3)

Hi Touch

This pans from the same incident last time. It really never went away. My Windows explorer works fine for about 4 hrs and then starts to act funny. New explorer windows wont open I cannot open up pages in explorer or internet mail + Task manager will not open and then sometime it does and when it does it kinda looks like its blinking every second. Once I reboot its fine again. AVG does not throup up errors. Anyhow Would really appreciate a quick look at the HJ file and combofix txt

Garyh3

ogfile of HijackThis v1.99.1
Scan saved at 14:42, on 2009-04-06
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Vodafone-vpn\cvpnd.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Pure Digital Technologies\FlipShare\FlipShareService.exe
C:\Program Files\Windows Live\Family Safety\fsssvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\iPass\iPassConnect\iPCAgent.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Mil Incorporated\Mil Shield\ShieldService.exe
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\Utimaco\SafeGuard Easy\SgeClient.exe
C:\Program Files\Utimaco\SafeGuard Easy\SgeCtl.exe
C:\WINDOWS\system32\SgLogPlayer.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\TpKmpSVC.exe
C:\Program Files\IBM\Director\bin\twgipcsv.exe
C:\Program Files\IBM\Director\bin\twgipc.exe
C:\WINDOWS\system32\vnxserv.exe
C:\Program Files\IBM\Director\bin\twgescli.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\IBM\Director\bin\twgmonit.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
C:\Program Files\ThinkPad\UltraNav Wizard\UNavTray.EXE
C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Lenovo\PkgMgr\HOTKEY\TPONSCR.exe
C:\Program Files\Lenovo\PkgMgr\HOTKEY_1\TpScrex.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\TpScrLk.exe
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe
C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe
C:\Program Files\Utimaco\SafeGuard Easy\Ecview.exe
C:\Program Files\iPass\iPassConnect\downloader\ipccheck.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Utimaco\SafeGuard Easy\WKSCFGSRV.EXE
C:\Program Files\Windows Live\Family Safety\fsui.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Mil Incorporated\Mil Shield\ShieldWorker.exe
C:\Documents and Settings\eloy04260\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\IBM\Director\cimom\bin\tier1slp.exe
C:\Program Files\IBM\Director\bin\IBMSA.exe
C:\Program Files\IBM\Director\bin\slp_srvreg.exe
C:\Program Files\IBM\Director\cimom\bin\cimlistener.exe
C:\Program Files\IBM\Director\cimom\bin\wmicimserver.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Documents and Settings\eloy04260\Local Settings\Apps\2.0\BO8MRCNE.RBW\H6Q1W016.E4H\moni..tion_ead9156a56b0f665_0001.0000_50417c0338be37d1\MonitoringAlertDesktopClient.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\eloy04260\Local Settings\temp\wz28c9\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 10.162.66.55:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://sblprdiweb2;http://umatter.eloyaltyco.com
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Windows Live Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Google Gears Helper - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.4.2\gears.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [PWRMGRTR] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL,PwrMgrBkGndMonitor
O4 - HKLM\..\Run: [BLOG] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog
O4 - HKLM\..\Run: [TPKBDLED] C:\WINDOWS\system32\TpScrLk.exe
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [ACTray] C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe
O4 - HKLM\..\Run: [ACWLIcon] C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe
O4 - HKLM\..\Run: [SgeEcView] C:\Program Files\Utimaco\SafeGuard Easy\Ecview.exe
O4 - HKLM\..\Run: [EdWizard] C:\Program Files\Utimaco\SafeGuard Easy\EdWizard.exe as
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [fssui] "C:\Program Files\Windows Live\Family Safety\fsui.exe" -autorun
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MilShieldSlave] "C:\Program Files\Mil Incorporated\Mil Shield\ShieldWorker.exe" -logon
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\eloy04260\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - Global Startup: Vodafone Ireland Vodafonie.ie VPN Client.lnk = C:\Program Files\Vodafone-vpn\ipsecdialer.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: (no name) - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.4.2\gears.dll
O9 - Extra 'Tools' menuitem: &Gears Settings - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.4.2\gears.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://intranet.vodafone.com/ie
O15 - Trusted Zone: *.eloyalty.com
O15 - Trusted Zone: *.eloyaltyco.com
O15 - Trusted Zone: *.imageshack.us
O16 - DPF: {00B28243-126B-4FFF-B346-6C3176E8296B} (Siebel Calendar) - http://sblprdiweb2/callcenter_enu/19221/applets/SiebelAx_Calendar.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-24-0.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1229591201781
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1229591183406
O16 - DPF: {9b935470-ad4a-11d5-b63e-00c04faedb18} (Oracle JInitiator 1.1.8.16) -
O16 - DPF: {DE2C7216-C882-400E-BB47-EBB90237CAD1} (Siebel High Interactivity Framework) - http://sblprdiweb2/callcenter_enu/19221/applets/SiebelAx_HI_Client.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://eloyalty.webex.com/client/T26L/webex/ieatgpc.cab
O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} (JuniperSetupControlXP Class) - https://remoteaccess.wyndhamworldwide.com/dana-cached/setup/JuniperSetupSP1.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,2,0,5480/mcfscan.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = eloyaltyco.com
O17 - HKLM\Software\..\Telephony: DomainName = eloyaltyco.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = eloyaltyco.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = eloyaltyco.com
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = eloyaltyco.com
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll
O20 - Winlogon Notify: ACNotify - ACNotify.dll (file missing)
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O20 - Winlogon Notify: NotLog - C:\WINDOWS\SYSTEM32\SGLogEx.dll
O20 - Winlogon Notify: SGLogNotification - C:\WINDOWS\SYSTEM32\SGLogNotification.dll
O20 - Winlogon Notify: tpfnf2 - C:\WINDOWS\SYSTEM32\notifyf2.dll
O20 - Winlogon Notify: tphotkey - C:\WINDOWS\SYSTEM32\tphklock.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ac Profile Manager Service (AcPrfMgrSvc) - Unknown owner - C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: IBM Director CIM Listener (cimlistener) - OpenSource Pegasus - C:\Program Files\IBM\Director\cimom\bin\cimlistener.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Vodafone-vpn\cvpnd.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: FlipShare Service - Unknown owner - C:\Program Files\Pure Digital Technologies\FlipShare\FlipShareService.exe
O23 - Service: Google Update Service (gupdate1c966cbfc29245e) (gupdate1c966cbfc29245e) - Unknown owner - C:\Program Files\Google\Update\GoogleUpdate.exe" /svc (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ThinkPad PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: IBM SLP SA (ibmsa) - IBM Corporation - C:\Program Files\IBM\Director\bin\IBMSA.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPassConnectEngine - iPass - C:\Program Files\iPass\iPassConnect\iPassConnectEngine.exe
O23 - Service: iPCAgent - iPass, Inc. - C:\Program Files\iPass\iPassConnect\iPCAgent.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf (file missing)
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Unknown owner - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe" /ServiceStart (file missing)
O23 - Service: MilShieldCleaner - Unknown owner - C:\Program Files\Mil Incorporated\Mil Shield\ShieldService.exe
O23 - Service: MSSQL$MICROSOFTSMLBIZ - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe" -sMICROSOFTSMLBIZ (file missing)
O23 - Service: OracleOra81ClientCache - Unknown owner - C:\oracle\ora81\BIN\ONRSD.EXE
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: SafeGuard Easy Client (SgeClient) - Unknown owner - C:\Program Files\Utimaco\SafeGuard Easy\SgeClient.exe
O23 - Service: SafeGuard Easy Control (SgeCtl) - Utimaco Safeware AG - C:\Program Files\Utimaco\SafeGuard Easy\SgeCtl.exe
O23 - Service: SafeGuard SGLOG Player (SgLogPlayer) - Utimaco Safeware AG - C:\WINDOWS\system32\SgLogPlayer.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: SQLAgent$MICROSOFTSMLBIZ - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlagent.EXE" -i MICROSOFTSMLBIZ (file missing)
O23 - Service: IBM Director Agent SLP Attributes (tier1slp) - IBM Corporation - C:\Program Files\IBM\Director\cimom\bin\tier1slp.exe
O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe
O23 - Service: IBM Director Support Program (TWGIPC) - IBM Corporation - C:\Program Files\IBM\Director\bin\twgipcsv.exe
O23 - Service: Vsclient Service (VnxService) - Unknown owner - C:\WINDOWS\system32\vnxserv.exe
O23 - Service: IBM Director Agent WMI CIM Server (wmicimserver) - IBM Corporation - C:\Program Files\IBM\Director\cimom\bin\wmicimserver.exe

Combofix.txt

ComboFix 09-04-04.01 - eloy04260 2009-04-06 14:18:26.8 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1534.836 [GMT 1:00]
Running from: c:\temp\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated)
AV: Lavasoft Ad-Watch Live! Anti-Virus *On-access scanning enabled* (Updated)
.

((((((((((((((((((((((((( Files Created from 2009-03-06 to 2009-04-06 )))))))))))))))))))))))))))))))
.

2009-04-06 14:16 . 2006-03-03 00:42 73,728 --a------ C:\pv.exe
2009-04-05 17:57 . 2009-04-05 17:57 3,067,803 -ra------ c:\temp\ComboFix.exe
2009-04-04 11:17 . 2009-04-04 11:17 <DIR> d-------- c:\program files\MUSICMATCH
2009-04-04 11:15 . 2009-04-04 11:15 18,301,032 --a------ c:\temp\musicmatch82.exe
2009-04-03 10:10 . 2009-04-06 13:49 512 --a------ c:\windows\randseed.rnd
2009-03-30 19:02 . 2009-04-05 21:34 24 --a------ c:\windows\sysc_drv.ini
2009-03-27 12:59 . 2009-01-09 20:19 1,089,593 --------- c:\windows\system32\dllcache\ntprint.cat
2009-03-20 11:53 . 2009-03-28 10:52 108,552 --a------ c:\windows\system32\drivers\avgtdix.sys
2009-03-16 14:26 . 2009-03-16 13:47 15,688 --a------ c:\windows\system32\lsdelete.exe
2009-03-16 13:47 . 2009-03-16 13:47 64,160 --a------ c:\windows\system32\drivers\Lbd.sys
2009-03-16 13:44 . 2009-03-16 13:44 <DIR> d--h-c--- c:\documents and settings\All Users\Application Data\{2BAE6915-8510-4B9F-B498-02DA86258AA0}
2009-03-16 13:43 . 2009-03-16 13:43 <DIR> d-------- c:\program files\Lavasoft
2009-03-16 13:42 . 2009-03-16 13:42 34,542,776 --a------ c:\temp\Ad-AwareAE_66.exe
2009-03-16 13:07 . 2009-03-16 19:33 <DIR> d-------- c:\program files\NoAdware
2009-03-15 14:03 . 2009-03-15 14:03 73,728 --a------ c:\windows\system32\javacpl.cpl

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-04 10:17 --------- d--h--w c:\program files\InstallShield Installation Information
2009-04-02 10:09 --------- d-----w c:\program files\Password Safe
2009-03-30 14:35 --------- d-----w c:\documents and settings\eloy04260\Application Data\Skype
2009-03-30 14:00 --------- d-----w c:\documents and settings\eloy04260\Application Data\skypePM
2009-03-29 16:53 --------- d-----w c:\program files\Microsoft Silverlight
2009-03-23 08:46 --------- d-----w c:\documents and settings\eloy04260\Application Data\uTorrent
2009-03-20 10:53 325,640 ----a-w c:\windows\system32\drivers\avgldx86.sys
2009-03-20 10:53 10,520 ----a-w c:\windows\system32\avgrsstx.dll
2009-03-20 10:51 --------- d-----w c:\documents and settings\All Users\Application Data\avg8
2009-03-16 12:05 --------- d-----w c:\program files\SUPERAntiSpyware
2009-03-16 12:05 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-03-16 12:05 --------- d-----w c:\documents and settings\eloy04260\Application Data\SUPERAntiSpyware.com
2009-03-16 11:09 --------- d-----w c:\program files\Java
2009-03-15 13:03 410,984 ----a-w c:\windows\system32\deploytk.dll
2009-03-04 11:27 --------- d-----w c:\program files\vsclient
2009-02-26 17:17 --------- d-----w c:\program files\Reference Assemblies
2009-02-26 17:17 --------- d-----w c:\program files\MSBuild
2009-02-23 19:41 --------- d-----w c:\documents and settings\All Users\Application Data\VMware
2009-02-23 19:35 --------- d-----w c:\documents and settings\eloy04260\Application Data\VMware
2009-02-23 17:21 --------- d-----w c:\program files\VMware
2009-02-23 15:39 --------- d-----w c:\documents and settings\eloy04260\Application Data\Juniper Networks
2009-02-23 15:15 --------- d-----w c:\documents and settings\All Users\Application Data\Juniper Networks
2009-02-23 09:14 --------- d-----w c:\program files\Windows Live
2009-02-17 16:00 --------- d-----w c:\documents and settings\eloy04260\Application Data\CoreFTP
2009-02-13 19:30 --------- d-----w c:\program files\Google
2009-02-12 11:41 --------- d-----w c:\program files\Windows Installer Clean Up
2009-02-12 11:41 --------- d-----w c:\program files\MSECACHE
2009-02-09 11:13 1,846,784 ----a-w c:\windows\system32\win32k.sys
2009-02-09 11:13 1,846,784 ------w c:\windows\system32\dllcache\win32k.sys
2009-02-06 19:03 307,576 ----a-w c:\windows\WLXPGSS.SCR
2009-02-06 18:52 49,504 ----a-w c:\windows\system32\sirenacm.dll
2009-01-16 21:35 3,594,752 ------w c:\windows\system32\dllcache\mshtml.dll
2003-12-18 16:17 4,416,692 ----a-w c:\program files\eLoyalty VPN.zip
2008-12-18 10:35 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008121820081219\index.dat
.

((((((((((((((((((((((((((((( snapshot@2009-04-03_16.08.32.28 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-04-05 20:30:35 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_12c.dat
+ 2009-04-05 20:30:34 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_464.dat
+ 2009-04-05 20:30:42 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_ff4.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-02-06 3885408]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-22 68856]
"MilShieldSlave"="c:\program files\Mil Incorporated\Mil Shield\ShieldWorker.exe" [2008-03-16 741376]
"Google Update"="c:\documents and settings\eloy04260\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-02-04 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2006-02-14 110592]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-02-14 512000]
"TPKMAPHELPER"="c:\program files\ThinkPad\Utilities\TpKmapAp.exe" [2005-10-29 864256]
"TPHOTKEY"="c:\progra~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe" [2006-05-10 94208]
"EZEJMNAP"="c:\progra~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe" [2006-02-24 237568]
"SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 1388544]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2006-01-22 344064]
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2005-03-07 122939]
"PWRMGRTR"="c:\progra~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL" [2006-03-23 151552]
"BLOG"="c:\progra~1\ThinkPad\UTILIT~1\BatLogEx.DLL" [2006-03-23 208896]
"TPKBDLED"="c:\windows\system32\TpScrLk.exe" [2002-10-09 40960]
"McAfeeUpdaterUI"="c:\program files\Network Associates\Common Framework\UpdaterUI.exe" [2005-09-27 139320]
"ACTray"="c:\program files\ThinkPad\ConnectUtilities\ACTray.exe" [2006-04-17 409600]
"ACWLIcon"="c:\program files\ThinkPad\ConnectUtilities\ACWLIcon.exe" [2006-04-17 98304]
"SgeEcView"="c:\program files\Utimaco\SafeGuard Easy\Ecview.exe" [2004-09-20 20480]
"EdWizard"="c:\program files\Utimaco\SafeGuard Easy\EdWizard.exe" [2004-09-20 245760]
"NeroCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-03-20 1932568]
"fssui"="c:\program files\Windows Live\Family Safety\fsui.exe" [2009-02-06 454000]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-15 148888]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-03-16 515416]
"mmtask"="c:\program files\MusicMatch\MusicMatch Jukebox\mmtask.exe" [2003-12-12 53248]
"MMTray"="c:\program files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe" [2003-12-12 118784]
"TP4EX"="tp4ex.exe" [2005-10-17 c:\windows\system32\TP4EX.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Vodafone Ireland Vodafonie.ie VPN Client.lnk - c:\program files\Vodafone-vpn\ipsecdialer.exe [2006-07-28 1216588]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceStartMenuLogOff"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ACNotify]
2006-04-17 19:01 32768 c:\program files\ThinkPad\ConnectUtilities\ACNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-03-20 11:53 10520 c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\NotLog]
2002-01-22 21:28 110592 c:\windows\system32\SGLogEx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\SGLogNotification]
2004-08-26 20:18 69632 c:\windows\system32\SGLogNotification.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpfnf2]
2005-07-06 05:45 28672 c:\windows\system32\notifyf2.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey]
2005-12-01 02:16 24576 c:\windows\system32\tphklock.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.3IV2"= 3ivxVfWCodec.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Network Associates\\Common Framework\\FrameworkService.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Documents and Settings\\eloy04260\\GaryStuff\\GarysStuff\\FTP\\WS_FTP95.exe"=
"c:\\WINDOWS\\system32\\ftp.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\IBM\\SMA\\smabat.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R0 AES-256;AES-256;c:\windows\system32\drivers\AES256.sys [2004-09-20 18016]
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-03-16 64160]
R0 SgeFlt;SgeFlt;c:\windows\system32\drivers\SGEFLT.sys [2004-09-20 54944]
R0 TPDiskPM;TPDiskPM;c:\windows\system32\drivers\TPDiskPM.sys [2006-03-17 14848]
R1 ANC;ANC;c:\windows\system32\drivers\ANC.sys [2006-05-28 11520]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-01-08 325640]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-03-20 108552]
R1 IBMTPCHK;IBMTPCHK;c:\windows\system32\drivers\IBMBLDID.sys [2006-05-28 6016]
R1 TPPWRIF;TPPWRIF;c:\windows\system32\drivers\TPPWRIF.SYS [2006-03-17 4442]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-01-29 298264]
R2 cimlistener;IBM Director CIM Listener;c:\program files\IBM\Director\cimom\bin\cimlistener.exe [2005-10-13 36864]
R2 CVPNDRV;Vodafone Ireland IPsec Driver;c:\windows\system32\drivers\CVPNDrv.sys [2006-07-28 160327]
R2 FlipShare Service;FlipShare Service;c:\program files\Pure Digital Technologies\FlipShare\FlipShareService.exe [2008-11-13 439616]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [2009-01-12 55136]
R2 fsssvc;Windows Live Family Safety;c:\program files\Windows Live\Family Safety\fsssvc.exe [2009-02-06 533360]
R2 ibmsa;IBM SLP SA;c:\program files\IBM\Director\bin\IBMSA.exe [2005-10-13 20480]
R2 iPCAgent;iPCAgent;c:\program files\iPass\iPassConnect\iPCAgent.exe [2006-05-15 90112]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-01-19 951632]
R2 SeaPort;SeaPort;c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2009-01-14 226656]
R2 tier1slp;IBM Director Agent SLP Attributes;c:\program files\IBM\Director\cimom\bin\tier1slp.exe [2005-10-13 28672]
R2 TWGIPC;IBM Director Support Program;c:\program files\IBM\Director\bin\twgipcsv.exe [2005-10-19 53328]
R2 VnxTcp;VnxTcp;c:\windows\system32\drivers\vnxtcp.sys [2006-05-15 148240]
R2 wmicimserver;IBM Director Agent WMI CIM Server;c:\program files\IBM\Director\cimom\bin\wmicimserver.exe [2005-10-13 536576]
R3 TPInput;TPInput;c:\windows\system32\drivers\TPInput.sys [2006-03-17 6784]
R3 TPM11;NSC Integrated Trusted Platform Module 1.1;c:\windows\system32\drivers\nsctpm11.sys [1980-01-01 14336]
S2 drujguxqsz;drujguxqsz;\??\c:\windows\system32\drivers\failotwfczv.sys --> c:\windows\system32\drivers\failotwfczv.sys [?]
S2 gupdate1c966cbfc29245e;Google Update Service (gupdate1c966cbfc29245e);c:\program files\Google\Update\GoogleUpdate.exe [2008-12-25 133104]
S3 dxI2C;dxI2C;c:\program files\IBM\Director\cimom\bin\i2c32.sys [2005-09-16 23936]
S3 dxPMem;dxPMem;c:\program files\IBM\Director\cimom\bin\pmemnt.sys [2005-09-16 4480]
S3 OracleOra81ClientCache;OracleOra81ClientCache;c:\oracle\ora81\bin\ONRSD.EXE [2000-10-19 411244]
S3 SDTHOOK;SDTHOOK;c:\windows\system32\drivers\SDTHOOK.SYS [2008-02-19 44928]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - E:\Setup_FlipShare.exe
\Shell\Setup FlipShare\command - E:\Setup_FlipShare.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{241d123e-f22c-11da-aa05-00166f1b7757}]
\Shell\AutoRun\command - E:\ClearPath_Demo.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{56902c3b-b949-11dc-a941-00166f1b5cde}]
\Shell\AutoRun\command - e:\system\viewer\FlipVideoforPC.exe
\Shell\Flip Video for PC\command - e:\system\viewer\FlipVideoforPC.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{56902c43-b949-11dc-a941-00166f1b5cde}]
\Shell\AutoRun\command - E:\Setup_FlipShare.exe
\Shell\Setup FlipShare\command - E:\Setup_FlipShare.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c5b1d234-f1a7-11da-827a-00166f1b7757}]
\Shell\AutoRun\command - E:\ClearPath_Demo.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d82dea2a-f0d6-11da-a065-00166f2b82ff}]
\Shell\AutoRun\command - E:\ClearPath_Demo.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f95c3632-5e8d-11db-a8b8-00166f1b5cde}]
\Shell\AutoRun\command - E:\Launch.exe
.
Contents of the 'Scheduled Tasks' folder

2009-04-06 c:\windows\Tasks\Ad-Aware Update (Daily).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-16 13:46]
.
.
------- Supplementary Scan -------
.
uLocal Page = \blank.htm
uStart Page = hxxp://www.google.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyServer = 10.162.66.55:8080
uInternet Settings,ProxyOverride = hxxp://sblprdiweb2;http://umatter.eloyaltyco.com
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Trusted Zone: eloyalty.com
Trusted Zone: eloyaltyco.com
Trusted Zone: imageshack.us
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {00B28243-126B-4FFF-B346-6C3176E8296B} - hxxp://sblprdiweb2/callcenter_enu/19221/applets/SiebelAx_Calendar.cab
DPF: {DE2C7216-C882-400E-BB47-EBB90237CAD1} - hxxp://sblprdiweb2/callcenter_enu/19221/applets/SiebelAx_HI_Client.cab
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-06 14:23:19
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1316)
c:\windows\system32\SGGINA.DLL
c:\program files\Utimaco\SafeGuard Easy\SGEGINA.DLL
c:\program files\Utimaco\SafeGuard Easy\CMessage.dll
c:\program files\Utimaco\SafeGuard Easy\SgWin32.dll
c:\program files\Utimaco\SafeGuard Easy\CmfcApi.dll
c:\program files\Utimaco\SafeGuard Easy\EcView.dll
c:\program files\Utimaco\SafeGuard Easy\SgeUtil.dll
c:\program files\Utimaco\SafeGuard Easy\SgUicl.dll
c:\program files\Utimaco\SafeGuard Easy\FLTAPI.dll
c:\program files\Utimaco\SafeGuard Easy\SGUICLRES.DLL
c:\program files\Utimaco\SafeGuard Easy\SGUICL.MSG
c:\program files\Utimaco\SafeGuard Easy\SGE_ERR0409.DLL
c:\program files\Utimaco\SafeGuard Easy\SGE_MSG0409.DLL
c:\program files\Utimaco\SafeGuard Easy\encviewer.ocx
c:\program files\Utimaco\SafeGuard Easy\sgea40.dll
c:\program files\Utimaco\SafeGuard Easy\CfgApi.dll
c:\program files\Utimaco\SafeGuard Easy\SGEDRV.dll
c:\program files\Utimaco\SafeGuard Easy\SGE_INFO0409.DLL
c:\program files\Utimaco\SafeGuard Easy\SgHtmHlp.dll
c:\program files\Utimaco\SafeGuard Easy\SGHTMHLP0409.dll
c:\program files\ThinkPad\ConnectUtilities\ACNotify.dll
c:\program files\ThinkPad\ConnectUtilities\AcSvcStub.dll
c:\program files\ThinkPad\ConnectUtilities\AcLocSettings.dll
c:\program files\ThinkPad\ConnectUtilities\ACHelper.dll
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\tphklock.dll
c:\program files\Utimaco\SafeGuard Easy\DComSec.dll
c:\windows\system32\GetUserSid.dll
c:\windows\system32\LogMsgApp.Dll
c:\windows\system32\LogData.dll
c:\program files\Utimaco\SafeGuard Easy\SecClassFactoryPS.dll
c:\program files\Utimaco\SafeGuard Easy\wkscfgsrvps.dll
c:\windows\system32\SGLogEx.dll
c:\windows\system32\SGLogNotification.dll
c:\windows\system32\notifyf2.dll
.
Completion time: 2009-04-06 14:26:39
ComboFix-quarantined-files.txt 2009-04-06 13:25:52
ComboFix2.txt 2009-04-05 17:08:47
ComboFix3.txt 2009-04-03 15:10:58

Pre-Run: 11,720,404,992 bytes free
Post-Run: 11,744,460,800 bytes free

266

Regards

Garyh3

Touch
Forum Moderator

Date Joined Jun 2004
Total Posts : 12862

Posted 4/8/2009 5:01 AM (GMT +3)

Hello Garyh3 cool

It looks like you have 2 antivirus programs running - AVG8 and SafeGuard Easy ? If you have, uninstall one of them.

Reboot.

I´ll look to your combolog asap.

Do NOT post your problem in someone elses thread.

Member of - Alliance of Security Analysis Professionals

A non-profit, volunteer network.

Touch
Forum Moderator

Date Joined Jun 2004
Total Posts : 12862

Posted 4/8/2009 12:33 PM (GMT +3)

Open notepad and copy/paste the text in bold in below into it:

-------------------------------------------------------------------------------

Killall:

Snapshot::

File::

c:\windows\system32\drivers\failotwfczv.sys

Driver::

Drujguxqsz

--------------------------------------------------------------------------------------

Save this as:
CFScript

http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif

Refering to the picture above, drag CFScript into ComboFix.exe

Then post fresh combofix log.

Do NOT post your problem in someone elses thread.

Member of - Alliance of Security Analysis Professionals

A non-profit, volunteer network.

Garyh3
New Member

Date Joined May 2006
Total Posts : 30

Posted 4/9/2009 3:19 PM (GMT +3)

Hi Touch sorry I didnt get an email notification to respond hmmmm!

so the SafeGuard is pc encription program and not a virus scan software.

Ok here is the new Combo log

ComboFix 09-04-04.01 - eloy04260 2009-04-09 12:48:04.9 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1534.860 [GMT 1:00]
Running from: c:\temp\ComboFix.exe
Command switches used :: c:\temp\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated)
AV: Lavasoft Ad-Watch Live! Anti-Virus *On-access scanning disabled* (Updated)
* Created a new restore point

FILE ::
c:\windows\system32\drivers\failotwfczv.sys
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_drujguxqsz

((((((((((((((((((((((((( Files Created from 2009-03-09 to 2009-04-09 )))))))))))))))))))))))))))))))
.

2009-04-08 16:13 . 2009-04-08 16:13 22,016 --a------ C:\[u]0[/u]xf9.exe
2009-04-05 17:57 . 2009-04-05 17:57 3,067,803 -ra------ c:\temp\ComboFix.exe
2009-04-04 11:17 . 2009-04-04 11:17 <DIR> d-------- c:\program files\MUSICMATCH
2009-03-30 19:02 . 2009-04-09 13:07 24 --a------ c:\windows\sysc_drv.ini
2009-03-27 12:59 . 2009-01-09 20:19 1,089,593 --------- c:\windows\system32\dllcache\ntprint.cat
2009-03-20 11:53 . 2009-03-28 10:52 108,552 --a------ c:\windows\system32\drivers\avgtdix.sys
2009-03-16 14:26 . 2009-03-16 13:47 15,688 --a------ c:\windows\system32\lsdelete.exe
2009-03-16 13:47 . 2009-03-16 13:47 64,160 --a------ c:\windows\system32\drivers\Lbd.sys
2009-03-16 13:44 . 2009-03-16 13:44 <DIR> d--h-c--- c:\documents and settings\All Users\Application Data\{2BAE6915-8510-4B9F-B498-02DA86258AA0}
2009-03-16 13:43 . 2009-03-16 13:43 <DIR> d-------- c:\program files\Lavasoft
2009-03-16 13:42 . 2009-03-16 13:42 34,542,776 --a------ c:\temp\Ad-AwareAE_66.exe
2009-03-16 13:07 . 2009-03-16 19:33 <DIR> d-------- c:\program files\NoAdware
2009-03-15 14:03 . 2009-03-15 14:03 73,728 --a------ c:\windows\system32\javacpl.cpl

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-07 11:53 --------- d-----w c:\program files\Password Safe
2009-04-07 08:04 --------- d-----w c:\documents and settings\eloy04260\Application Data\Skype
2009-04-06 13:53 --------- d-----w c:\documents and settings\eloy04260\Application Data\skypePM
2009-04-04 10:17 --------- d--h--w c:\program files\InstallShield Installation Information
2009-03-29 16:53 --------- d-----w c:\program files\Microsoft Silverlight
2009-03-23 08:46 --------- d-----w c:\documents and settings\eloy04260\Application Data\uTorrent
2009-03-20 10:53 325,640 ----a-w c:\windows\system32\drivers\avgldx86.sys
2009-03-20 10:51 --------- d-----w c:\documents and settings\All Users\Application Data\avg8
2009-03-16 12:05 --------- d-----w c:\program files\SUPERAntiSpyware
2009-03-16 12:05 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-03-16 12:05 --------- d-----w c:\documents and settings\eloy04260\Application Data\SUPERAntiSpyware.com
2009-03-16 11:09 --------- d-----w c:\program files\Java
2009-03-04 11:27 --------- d-----w c:\program files\vsclient
2009-02-26 17:17 --------- d-----w c:\program files\Reference Assemblies
2009-02-26 17:17 --------- d-----w c:\program files\MSBuild
2009-02-23 19:41 --------- d-----w c:\documents and settings\All Users\Application Data\VMware
2009-02-23 19:35 --------- d-----w c:\documents and settings\eloy04260\Application Data\VMware
2009-02-23 17:21 --------- d-----w c:\program files\VMware
2009-02-23 15:39 --------- d-----w c:\documents and settings\eloy04260\Application Data\Juniper Networks
2009-02-23 15:15 --------- d-----w c:\documents and settings\All Users\Application Data\Juniper Networks
2009-02-23 09:14 --------- d-----w c:\program files\Windows Live
2009-02-17 16:00 --------- d-----w c:\documents and settings\eloy04260\Application Data\CoreFTP
2009-02-13 19:30 --------- d-----w c:\program files\Google
2009-02-12 11:41 --------- d-----w c:\program files\Windows Installer Clean Up
2009-02-12 11:41 --------- d-----w c:\program files\MSECACHE
2009-02-06 19:03 307,576 ----a-w c:\windows\WLXPGSS.SCR
2003-12-18 16:17 4,416,692 ----a-w c:\program files\eLoyalty VPN.zip
2008-12-18 10:35 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008121820081219\index.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4