Thanks for your help so far - has it been a difficult case? are we nearly done and what was it infected with?
Here are the logs requested.
ComboFix 09-05-23.01 - hayley 24/05/2009 13:37.3 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.44.1033.18.1013.265 [GMT 1:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\hayley\Desktop\CFScript.txt
SP: Windows Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
FILE ::
c:\users\hayley\AppData\Local\aeiawmg.bat
c:\users\hayley\AppData\Local\ccmyscc_nav.dat.vir
c:\users\hayley\AppData\Local\kcmgu.bat
c:\users\hayley\AppData\Local\yiqmciu.bat
c:\users\hayley\AppData\Local\ymoye.exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\users\hayley\AppData\Local\aeiawmg.bat
c:\users\hayley\AppData\Local\ccmyscc_nav.dat.vir
c:\users\hayley\AppData\Local\kcmgu.bat
c:\users\hayley\AppData\Local\yiqmciu.bat
c:\users\hayley\AppData\Local\ymoye.exe
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_yjdb7uyoyxea19
((((((((((((((((((((((((( Files Created from 2009-04-24 to 2009-05-24 )))))))))))))))))))))))))))))))
.
2009-05-24 12:41 . 2009-05-24 12:41 -------- d-----w c:\users\mark\AppData\Local\temp
2009-05-24 12:41 . 2009-05-24 12:41 -------- d-----w c:\users\jenna\AppData\Local\temp
2009-05-23 18:43 . 2009-05-06 18:06 4784464 ----a-w c:\programdata\Microsoft\Windows Defender\Definition Updates\{65426D79-999D-49E0-9EFA-C1AA4E424C1B}\mpengine.dll
2009-05-23 18:39 . 2009-05-23 18:40 -------- d-----w C:\rsit
2009-05-20 20:25 . 2009-05-18 16:51 325640 ----a-w c:\programdata\avg8\update\backup\avgldx86.sys
2009-05-20 20:25 . 2009-05-18 16:51 107912 ----a-w c:\programdata\avg8\update\backup\avgtdix.sys
2009-05-20 20:25 . 2009-05-18 16:51 10520 ----a-w c:\programdata\avg8\update\backup\avgrsstx.dll
2009-05-20 20:25 . 2009-05-18 16:51 27656 ----a-w c:\programdata\avg8\update\backup\avgmfx86.sys
2009-05-20 20:25 . 2009-05-18 16:51 485144 ----a-w c:\programdata\avg8\update\backup\avgrsx.exe
2009-05-20 20:20 . 2009-05-20 20:20 -------- d-----w c:\program files\Microsoft Silverlight
2009-05-20 20:19 . 2009-05-20 20:19 -------- d-----w c:\users\hayley\AppData\Roaming\Intel
2009-05-20 20:19 . 2009-05-20 20:19 -------- d-----w c:\users\Public\Roaming
2009-05-20 20:19 . 2009-05-20 20:19 -------- d-----w c:\programdata\Roaming
2009-05-20 20:16 . 2009-05-20 20:16 -------- d-----w c:\program files\Cisco
2009-05-20 20:16 . 2009-05-20 20:16 -------- d-----w c:\program files\Common Files\Intel
2009-05-20 20:16 . 2009-05-20 20:16 -------- d-----w c:\programdata\Intel
2009-05-20 17:02 . 2009-05-18 16:51 1057048 ----a-w c:\programdata\avg8\update\backup\avgupd.exe
2009-05-20 17:02 . 2009-05-18 16:51 746264 ----a-w c:\programdata\avg8\update\backup\avginet.dll
2009-05-20 17:02 . 2009-05-18 16:51 582936 ----a-w c:\programdata\avg8\update\backup\avgiproxy.exe
2009-05-20 17:02 . 2009-05-18 16:51 1423640 ----a-w c:\programdata\avg8\update\backup\avgupd.dll
2009-05-20 15:37 . 2008-06-20 01:14 97800 ----a-w c:\windows\system32\infocardapi.dll
2009-05-20 15:37 . 2008-06-20 01:14 105016 ----a-w c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2009-05-20 15:36 . 2008-06-20 01:14 43544 ----a-w c:\windows\system32\PresentationHostProxy.dll
2009-05-20 15:36 . 2008-06-20 01:14 11264 ----a-w c:\windows\system32\icardres.dll
2009-05-20 15:36 . 2008-06-20 01:14 622080 ----a-w c:\windows\system32\icardagt.exe
2009-05-20 15:36 . 2008-06-20 01:14 781344 ----a-w c:\windows\system32\PresentationNative_v0300.dll
2009-05-20 15:36 . 2008-06-20 01:14 326160 ----a-w c:\windows\system32\PresentationHost.exe
2009-05-20 15:27 . 2008-07-27 18:03 96760 ----a-w c:\windows\system32\dfshim.dll
2009-05-20 15:27 . 2008-07-27 18:03 282112 ----a-w c:\windows\system32\mscoree.dll
2009-05-20 15:27 . 2008-07-27 18:03 41984 ----a-w c:\windows\system32\netfxperf.dll
2009-05-20 15:26 . 2008-07-27 18:03 158720 ----a-w c:\windows\system32\mscorier.dll
2009-05-20 15:26 . 2008-07-27 18:03 83968 ----a-w c:\windows\system32\mscories.dll
2009-05-20 10:48 . 2009-05-20 10:48 -------- d-----w c:\users\hayley\AppData\Roaming\Malwarebytes
2009-05-20 08:38 . 2006-06-19 12:01 69632 ----a-w c:\windows\system32\ztvcabinet.dll
2009-05-20 08:38 . 2006-05-25 14:52 162304 ----a-w c:\windows\system32\ztvunrar36.dll
2009-05-20 08:38 . 2005-08-26 00:50 77312 ----a-w c:\windows\system32\ztvunace26.dll
2009-05-20 08:38 . 2003-02-02 19:06 153088 ----a-w c:\windows\system32\UNRAR3.dll
2009-05-20 08:38 . 2002-03-06 00:00 75264 ----a-w c:\windows\system32\unacev2.dll
2009-05-20 08:38 . 2009-05-20 08:38 -------- d-----w c:\users\hayley\AppData\Roaming\Simply Super Software
2009-05-20 08:38 . 2009-05-20 08:38 -------- d-----w c:\programdata\Simply Super Software
2009-05-20 06:09 . 2009-04-06 14:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-05-20 06:09 . 2009-04-06 14:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-20 06:09 . 2009-05-20 06:09 -------- d-----w c:\programdata\Malwarebytes
2009-05-19 18:44 . 2009-05-20 11:57 -------- d--h--w C:\$AVG8.VAULT$
2009-05-19 14:51 . 2007-12-11 13:47 101504 ----a-r c:\windows\system32\drivers\ewusbmdm.sys
2009-05-19 14:51 . 2007-12-11 13:47 23424 ----a-r c:\windows\system32\drivers\ewdcsc.sys
2009-05-19 14:42 . 2009-05-20 08:56 18067488 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-05-19 10:13 . 2009-05-19 10:13 -------- d-----w c:\programdata\is-LMP4K
2009-05-18 21:21 . 2009-05-20 09:16 -------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-05-18 19:29 . 2009-05-18 19:29 -------- d--h--w c:\windows\msdownld.tmp
2009-05-18 18:58 . 2009-05-18 18:58 -------- d-----w c:\users\hayley\AppData\Local\Mozilla
2009-05-18 16:51 . 2009-05-20 20:24 11952 ----a-w c:\windows\system32\avgrsstx.dll
2009-05-18 16:51 . 2009-05-20 20:24 325896 ----a-w c:\windows\system32\drivers\avgldx86.sys
2009-05-18 16:51 . 2009-05-20 20:24 108552 ----a-w c:\windows\system32\drivers\avgtdix.sys
2009-05-18 16:51 . 2009-05-20 20:24 27784 ----a-w c:\windows\system32\drivers\avgmfx86.sys
2009-05-18 16:51 . 2009-05-20 15:06 -------- d-----w c:\windows\system32\drivers\Avg
2009-05-18 16:51 . 2009-05-18 16:51 -------- d-----w c:\programdata\avg8
2009-05-18 15:10 . 2009-05-18 15:10 -------- d-----w c:\windows\BDOSCAN8
2009-05-18 15:00 . 2009-05-18 15:00 -------- d-----w c:\users\hayley\AppData\Roaming\Yahoo!
2009-05-18 14:35 . 2009-05-18 14:35 -------- d-----w c:\program files\Belarc
2009-05-18 14:35 . 2005-04-07 15:18 3840 ----a-w c:\windows\system32\drivers\BANTExt.sys
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-20 20:38 . 2006-12-02 06:31 -------- d-----w c:\program files\Yahoo!
2009-05-20 20:38 . 2008-01-28 19:03 -------- d-----w c:\program files\IDIGICON Limited
2009-05-20 20:38 . 2006-12-02 06:05 -------- d--h--w c:\program files\InstallShield Installation Information
2009-05-20 20:34 . 2008-08-27 16:44 680 ----a-w c:\users\hayley\AppData\Local\d3d9caps.dat
2009-05-20 20:15 . 2006-12-02 06:01 -------- d-----w c:\program files\Intel
2009-05-20 08:56 . 2009-05-19 14:42 213848 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-05-19 14:38 . 2008-06-27 12:15 -------- d-----w c:\program files\Circle Developement
2009-05-18 21:08 . 2009-03-21 14:46 -------- d-----w c:\program files\Live-Player
2009-05-18 13:50 . 2007-07-30 17:39 -------- d-----w c:\program files\Google
2009-05-18 13:46 . 2007-05-21 17:25 -------- d-----w c:\program files\SUPERAntiSpyware
2009-05-18 13:36 . 2007-05-21 17:24 -------- d-----w c:\program files\a-squared Free
2009-05-18 12:45 . 2006-11-02 11:18 -------- d-----w c:\program files\Windows Mail
2009-04-07 17:28 . 2009-04-07 17:28 -------- d-----w c:\users\mark\AppData\Roaming\MySpace
2009-03-29 16:41 . 2009-03-29 16:41 -------- d-----w c:\users\abbie\AppData\Roaming\aAvgApi
2009-03-17 03:38 . 2009-04-16 16:48 13824 ----a-w c:\windows\system32\apilogen.dll
2009-03-17 03:38 . 2009-04-16 16:48 24064 ----a-w c:\windows\system32\amxread.dll
2009-03-13 18:32 . 2009-03-13 18:32 75048 ----a-w c:\programdata\Apple Computer\Installer Cache\iTunes 8.1.0.51\SetupAdmin.exe
2009-03-08 11:34 . 2009-05-20 15:55 914944 ----a-w c:\windows\system32\wininet.dll
2009-03-08 11:34 . 2009-05-20 15:55 43008 ----a-w c:\windows\system32\licmgr10.dll
2009-03-08 11:33 . 2009-05-20 15:55 18944 ----a-w c:\windows\system32\corpol.dll
2009-03-08 11:33 . 2009-05-20 15:55 109056 ----a-w c:\windows\system32\iesysprep.dll
2009-03-08 11:33 . 2009-05-20 15:55 109568 ----a-w c:\windows\system32\PDMSetup.exe
2009-03-08 11:33 . 2009-05-20 15:55 132608 ----a-w c:\windows\system32\ieUnatt.exe
2009-03-08 11:33 . 2009-05-20 15:55 107520 ----a-w c:\windows\system32\RegisterIEPKEYs.exe
2009-03-08 11:33 . 2009-05-20 15:55 107008 ----a-w c:\windows\system32\SetIEInstalledDate.exe
2009-03-08 11:33 . 2009-05-20 15:55 103936 ----a-w c:\windows\system32\SetDepNx.exe
2009-03-08 11:33 . 2009-05-20 15:55 420352 ----a-w c:\windows\system32\vbscript.dll
2009-03-08 11:32 . 2009-05-20 15:55 72704 ----a-w c:\windows\system32\admparse.dll
2009-03-08 11:32 . 2009-05-20 15:55 71680 ----a-w c:\windows\system32\iesetup.dll
2009-03-08 11:32 . 2009-05-20 15:55 66560 ----a-w c:\windows\system32\wextract.exe
2009-03-08 11:32 . 2009-05-20 15:55 169472 ----a-w c:\windows\system32\iexpress.exe
2009-03-08 11:31 . 2009-05-20 15:55 34816 ----a-w c:\windows\system32\imgutil.dll
2009-03-08 11:31 . 2009-05-20 15:55 48128 ----a-w c:\windows\system32\mshtmler.dll
2009-03-08 11:31 . 2009-05-20 15:55 45568 ----a-w c:\windows\system32\mshta.exe
2009-03-08 11:22 . 2009-05-20 15:55 156160 ----a-w c:\windows\system32\msls31.dll
2009-03-05 23:59 . 2009-03-05 23:59 36864 ----a-w c:\windows\system32\drivers\usbaapl.sys
2009-03-05 23:59 . 2009-03-05 23:59 1900544 ----a-w c:\windows\system32\usbaaplrc.dll
2009-03-03 04:46 . 2009-04-16 16:48 3599328 ----a-w c:\windows\system32\ntkrnlpa.exe
2009-03-03 04:46 . 2009-04-16 16:48 3547632 ----a-w c:\windows\system32\ntoskrnl.exe
2009-03-03 04:39 . 2009-04-16 16:48 183296 ----a-w c:\windows\system32\sdohlp.dll
2009-03-03 04:39 . 2009-04-16 16:48 551424 ----a-w c:\windows\system32\rpcss.dll
2009-03-03 04:39 . 2009-04-16 16:48 26112 ----a-w c:\windows\system32\printfilterpipelineprxy.dll
2009-03-03 04:37 . 2009-04-16 16:48 98304 ----a-w c:\windows\system32\iasrecst.dll
2009-03-03 04:37 . 2009-04-16 16:48 44032 ----a-w c:\windows\system32\iasdatastore.dll
2009-03-03 04:37 . 2009-04-16 16:48 54784 ----a-w c:\windows\system32\iasads.dll
2009-03-03 03:04 . 2009-04-16 16:48 666624 ----a-w c:\windows\system32\printfilterpipelinesvc.exe
2009-03-03 02:38 . 2009-04-16 16:48 17408 ----a-w c:\windows\system32\iashost.exe
.
((((((((((((((((((((((((((((( SnapShot@2009-05-23_20.07.52 )))))))))))))))))))))))))))))))))))))))))
.
+ 2006-12-02 06:06 . 2009-05-24 12:28 80852 c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2006-11-02 13:05 . 2009-05-24 12:28 76574 c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2007-05-20 14:52 . 2009-05-24 12:28 13600 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3959620234-4110721429-2390296128-1000_UserData.bin
- 2007-05-21 07:39 . 2009-05-23 18:23 32768 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2007-05-21 07:39 . 2009-05-24 12:43 32768 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2007-05-21 07:39 . 2009-05-24 12:43 65536 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2007-05-21 07:39 . 2009-05-23 18:23 65536 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2007-05-21 07:39 . 2009-05-23 18:23 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2007-05-21 07:39 . 2009-05-24 12:43 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2006-11-02 10:33 . 2009-05-23 20:02 601008 c:\windows\System32\perfh009.dat
+ 2006-11-02 10:33 . 2009-05-24 12:37 601008 c:\windows\System32\perfh009.dat
+ 2006-11-02 10:33 . 2009-05-24 12:37 106498 c:\windows\System32\perfc009.dat
- 2006-11-02 10:33 . 2009-05-23 20:02 106498 c:\windows\System32\perfc009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-02-06 3885408]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"Creative Live! Cam Manager"="c:\program files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe" [2006-05-31 143360]
"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2008-04-17 9117696]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2005-08-11 249856]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2006-11-22 90191]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-11-22 7757824]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-11-22 81920]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-10-23 815104]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2006-11-06 98304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2006-11-06 106496]
"WarReg_PopUp"="c:\acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 57344]
"AVFX Engine"="c:\program files\Creative\Creative Live! Cam\VideoFX\StartFX.exe" [2006-06-09 24576]
"AVG8_TRAY"="d:\progra~1\AVG\AVG8\avgtray.exe" [2009-05-20 1947928]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2006-12-01 4186112]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-03-27 1744896]
"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2008-04-17 9117696]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2008-8-4 67128]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "d:\program files\SUPERAntiSpyware\SASSEH.DLL" [2006-12-20 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2007-04-19 12:41 294912 ----a-w d:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\avgrsstx.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnk.CommonStartup
backupExtension=.CommonStartup
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Empowering Technology Launcher.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Empowering Technology Launcher.lnk
backup=c:\windows\pss\Empowering Technology Launcher.lnk.CommonStartup
backupExtension=.CommonStartup
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnk.CommonStartup
backupExtension=.CommonStartup
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{B60AD9F6-0E64-4C1B-AF7F-7C91069DC553}"= UDP:c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\MCE Deluxe Suite.exe:CyberLink MCE Deluxe Suite
"{AD05F1F6-49D1-4D1A-B380-342EA407FCAB}"= TCP:c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\MCE Deluxe Suite.exe:CyberLink MCE Deluxe Suite
"{84E6A621-3851-4922-A90C-F79FE85155F8}"= UDP:c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:Logitech Desktop Messenger
"{E980DB19-81B8-4F6D-A39F-910436607496}"= TCP:c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:Logitech Desktop Messenger
"{1A4DCEFD-4504-4A47-A259-ABF9AC8E55B4}"= UDP:c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:Logitech Desktop Messenger
"{4F120795-C430-4C8B-BE17-2857C34EF443}"= TCP:c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:Logitech Desktop Messenger
"{83E06127-8384-4C7C-AE7C-E162D4CE1C11}"= UDP:c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:Logitech Desktop Messenger
"{EC4C677A-8183-4541-9826-314FA5AAE135}"= TCP:c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:Logitech Desktop Messenger
"{9885DA15-476A-4CA9-94C7-9B5D680D1CE0}"= c:\program files\MySpace\IM\MySpaceIM.exe:MySpaceIM
"{40E2E66B-32C8-4B69-A10C-9F030440BCBD}"= c:\program files\Windows Live\Sync\WindowsLiveSync.exe:Windows Live Sync
"{F792C0FF-4A2C-4447-BAD9-79096257B830}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{148C8104-C151-4B8E-AFE1-0627C7A97789}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{CE9171C7-539C-4797-BF40-3123F5E5E174}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{4B2EBD9A-AC1F-4DAA-9E46-576C280590F6}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys [18/05/2009 17:51 325896]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\System32\drivers\avgtdix.sys [18/05/2009 17:51 108552]
R1 SASDIFSV;SASDIFSV;d:\program files\SUPERAntiSpyware\sasdifsv.sys [10/10/2006 13:53 5632]
R1 SASKUTIL;SASKUTIL;d:\program files\SUPERAntiSpyware\SASKUTIL.SYS [27/02/2007 12:39 32256]
R2 avg8wd;AVG Free8 WatchDog;d:\progra~1\AVG\AVG8\avgwdsvc.exe [18/05/2009 17:51 298776]
R2 fssfltr;FssFltr;c:\windows\System32\drivers\fssfltr.sys [17/02/2009 18:16 55280]
R2 fsssvc;Windows Live Family Safety;c:\program files\Windows Live\Family Safety\fsssvc.exe [06/02/2009 19:08 533360]
R3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\System32\drivers\NETw5v32.sys [17/11/2008 07:40 3668480]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\System32\drivers\b57nd60x.sys [02/11/2006 11:25 167936]
S3 SASENUM;SASENUM;d:\program files\SUPERAntiSpyware\SASENUM.SYS [16/02/2006 17:51 4096]
S3 SMSCIRDA;SMSC Infrared Device Driver;c:\windows\System32\drivers\smscirda.sys [02/12/2006 07:13 31232]
S3 V0250Dev;Live! Cam Notebook Pro;c:\windows\System32\drivers\V0250Dev.sys [18/09/2007 16:36 185504]
S3 V0250Vfx;V0250Vfx;c:\windows\System32\drivers\V0250Vfx.sys [18/09/2007 16:36 6272]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder
2009-05-24 c:\windows\Tasks\User_Feed_Synchronization-{7FB36892-C6C2-4B9F-9E55-ED00F3FF2E20}.job
- c:\windows\system32\msfeedssync.exe [2009-05-20 11:31]
.
.
------- Supplementary Scan -------
.
uStart Page =
hxxp://search.conduit.com?SearchSource= ... =CT2004933
uSearchMigratedDefaultURL =
hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mStart Page =
hxxp://en.uk.acer.yahoo.com
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) =
hxxp://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBR
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
FF - ProfilePath - c:\users\hayley\AppData\Roaming\Mozilla\Firefox\Profiles\28y6z0rd.default\
FF - prefs.js: browser.startup.homepage -
hxxp://www.yahoo.com/
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2009-05-24 13:45
Windows 6.0.6001 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
c:\users\hayley\AppData\Local\Temp\NEWC82E.tmp 7529 bytes
scan completed successfully
hidden files: 1
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\
0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\
0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\
0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\
0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'Explorer.exe'(10004)
c:\program files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll
c:\program files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll
c:\program files\Nokia\Nokia PC Suite 6\PCSCM.dll
c:\program files\Nokia\Nokia PC Suite 6\Lang\PhoneBrowser_eng.nlr
c:\program files\Nokia\Nokia PC Suite 6\Resource\PhoneBrowser_Nokia.ngr
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
c:\windows\System32\audiodg.exe
c:\windows\System32\wlanext.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\acer\Empowering Technology\eDataSecurity\eDSService.exe
c:\acer\Empowering Technology\eLock\Service\eLockServ.exe
c:\acer\Empowering Technology\eNet\eNet Service.exe
c:\program files\Intel\WiFi\bin\EvtEng.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
c:\acer\Mobility Center\MobilityService.exe
c:\program files\Common Files\Intel\WirelessCommon\RegSrvc.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\windows\System32\drivers\XAudio.exe
c:\acer\Empowering Technology\eRecovery\eRecoveryService.exe
c:\acer\Empowering Technology\eSettings\Service\capuserv.exe
d:\progra~1\AVG\AVG8\avgrsx.exe
d:\progra~1\AVG\AVG8\avgnsx.exe
c:\acer\Empowering Technology\ePower\ePowerSvc.exe
c:\windows\System32\wbem\unsecapp.exe
c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
d:\program files\AVG\AVG8\avgtray.exe
c:\windows\System32\rundll32.exe
c:\windows\ehome\ehmsas.exe
c:\users\hayley\AppData\Local\Temp\RtkBtMnt.exe
c:\windows\System32\wbem\unsecapp.exe
c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
.
**************************************************************************
.
Completion time: 2009-05-24 13:50 - machine was rebooted
ComboFix-quarantined-files.txt 2009-05-24 12:50
ComboFix2.txt 2009-05-23 20:22
ComboFix3.txt 2009-05-23 20:09
Pre-Run: 11,901,530,112 bytes free
Post-Run: 11,650,777,088 bytes free
341 --- E O F --- 2009-05-23 18:43
now the new hijack this log;
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:52:46, on 24/05/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe
D:\Program Files\AVG\AVG8\avgtray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe
C:\Program Files\MySpace\IM\MySpaceIM.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Windows\ehome\ehmsas.exe
C:\Users\hayley\AppData\Local\Temp\RtkBtMnt.exe
C:\Program Files\MySpace\IM\MySpaceIM.exe
C:\Windows\Explorer.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\notepad.exe
C:\Windows\system32\SearchFilterHost.exe
D:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource=10&ctid=CT2004933
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://en.uk.acer.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - D:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Windows Live Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [AVFX Engine] C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe
O4 - HKLM\..\Run: [AVG8_TRAY] D:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Creative Live! Cam Manager] "C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe"
O4 - HKCU\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe
O4 - HKCU\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O13 - Gopher Prefix:
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - D:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: C:\Windows\System32\avgrsstx.dll
O20 - Winlogon Notify: !SASWinLogon - D:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - D:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: eDataSecurity Service - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
--
End of file - 8796 bytes
