Help Needed...I dont know what else to do

Status
Not open for further replies.
-------\Service_SENEKA


((((((((((((((((((((((((( Files Created from 2008-12-12 to 2009-01-12 )))))))))))))))))))))))))))))))
.

2009-01-12 12:35 . 2009-01-12 12:35 129,024 --a------ c:\windows\system32\_ykejfmli.dll_.vir
2009-01-12 12:35 . 2009-01-12 12:35 129,024 --a------ c:\windows\system32\_taoeta.dll_.vir
2009-01-12 12:35 . 2009-01-12 12:35 73,216 --a------ c:\windows\system32\_ffkuz.dll_.vir
2009-01-12 11:52 . 2009-01-12 12:45 1,507,104 --ahs---- c:\windows\system32\drivers\fidbox.dat
2009-01-12 11:52 . 2009-01-12 12:41 17,156 --ahs---- c:\windows\system32\drivers\fidbox.idx
2009-01-09 23:16 . 2009-01-09 23:16 <DIR> d-------- c:\program files\JoWood
2009-01-08 19:24 . 2009-01-08 19:24 <DIR> d-------- c:\program files\Microsoft Silverlight
2009-01-08 02:35 . 2009-01-08 02:35 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Leadertech
2009-01-07 09:04 . 2009-01-12 12:36 73,216 --a------ c:\windows\system32\ffkuz.dll
2009-01-06 20:24 . 2009-01-12 11:03 <DIR> d-------- C:\HTJ
2009-01-06 20:23 . 2009-01-06 20:23 <DIR> d-------- c:\program files\Trend Micro
2009-01-06 20:16 . 2009-01-06 20:16 <DIR> d-------- c:\program files\MSConfig CleanUp
2009-01-06 19:34 . 2009-01-06 19:34 <DIR> d-------- c:\program files\Lavasoft
2009-01-06 19:34 . 2009-01-06 19:35 <DIR> d-------- c:\documents and settings\All Users\Application Data\Lavasoft
2009-01-06 10:49 . 2009-01-12 06:29 180 --a------ C:\rollback.ini
2009-01-06 10:22 . 2009-01-06 10:22 <DIR> d-------- c:\documents and settings\Administrator\Application Data\MailFrontier
2009-01-06 10:14 . 2009-01-06 10:29 <DIR> d-------- c:\documents and settings\All Users\Application Data\MailFrontier
2009-01-06 10:14 . 2008-08-21 20:41 72,592 --a------ c:\windows\zllsputility.exe
2009-01-06 10:14 . 2009-01-06 10:16 4,212 --ah----- c:\windows\system32\zllictbl.dat
2009-01-06 10:13 . 2009-01-10 19:43 <DIR> d-------- c:\windows\system32\ZoneLabs
2009-01-06 10:13 . 2009-01-06 10:13 <DIR> d-------- c:\program files\Zone Labs
2009-01-06 10:13 . 2008-08-21 20:41 1,221,008 --a------ c:\windows\system32\zpeng25.dll
2009-01-06 10:13 . 2009-01-12 12:42 349,222 --a------ c:\windows\system32\vsconfig.xml
2009-01-06 10:12 . 2009-01-12 12:44 <DIR> d-------- c:\windows\Internet Logs
2009-01-06 00:18 . 2009-01-06 12:30 <DIR> d-------- c:\program files\Alwil Software
2009-01-06 00:18 . 2003-03-18 13:20 1,060,864 --a------ c:\windows\system32\MFC71.dll
2009-01-05 23:02 . 2009-01-12 10:26 31,232 --a------ c:\windows\system32\pcload.exe
2009-01-05 12:08 . 2009-01-12 11:33 <DIR> d-a------ c:\documents and settings\All Users\Application Data\TEMP
2009-01-05 12:07 . 2009-01-05 12:07 <DIR> d-------- c:\program files\Common Files\PC Tools
2009-01-04 19:58 . 2009-01-12 12:36 129,024 --a------ c:\windows\system32\ykejfmli.dll
2009-01-04 19:58 . 2009-01-12 12:36 129,024 --a------ c:\windows\system32\taoeta.dll
2009-01-03 20:23 . 2009-01-03 20:23 <DIR> d-------- c:\windows\system32\config\systemprofile\Application Data\s_4610_fHx8fHx8fDEyNDM2Nzk0Njh8_
2009-01-03 20:23 . 2009-01-03 20:23 <DIR> d-------- c:\windows\system32\config\systemprofile\Application Data\Rapid Antivirus
2009-01-03 19:50 . 2009-01-05 12:02 <DIR> d--h----- C:\$AVG8.VAULT$
2008-12-25 01:32 . 2008-12-25 01:32 <DIR> d-------- c:\program files\Photo Viewer
2008-12-24 12:08 . 2008-12-24 12:08 <DIR> d-------- c:\program files\DivX
2008-12-22 10:22 . 2008-12-22 10:22 102 --ahs---- C:\ftp.cpt
2008-12-22 10:22 . 2008-12-22 10:22 48 --ahs---- C:\ftp.bat
2008-12-22 10:22 . 2008-12-22 10:22 29 --ahs---- C:\win3220992.62.cpt
2008-12-19 23:42 . 2009-01-12 12:45 <DIR> d-------- c:\program files\PeerGuardian2
2008-12-19 23:36 . 2008-12-19 23:36 <DIR> d-------- c:\program files\AskSearch
2008-12-19 23:36 . 2008-12-19 23:36 <DIR> d-------- c:\program files\AskBarDis
2008-12-19 23:36 . 2008-12-19 23:36 <DIR> d-------- c:\documents and settings\All Users\Application Data\Azureus
2008-12-19 23:36 . 2009-01-12 10:52 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Azureus
2008-12-19 23:35 . 2008-12-19 23:36 <DIR> d-------- c:\program files\Vuze
2008-12-19 23:35 . 2008-12-19 23:35 <DIR> d-------- c:\program files\Common Files\i4j_jres
2008-12-19 23:34 . 2008-12-19 23:34 <DIR> d-------- c:\documents and settings\Administrator\Application Data\vlc
2008-12-19 23:32 . 2008-12-19 23:32 <DIR> d-------- c:\program files\VideoLAN
2008-12-17 12:16 . 2008-04-14 00:15 26,368 --a--c--- c:\windows\system32\dllcache\usbstor.sys
2008-12-17 11:39 . 2008-04-14 05:42 159,232 --a------ c:\windows\system32\ptpusd.dll
2008-12-17 11:39 . 2008-04-14 00:15 15,104 --a------ c:\windows\system32\drivers\usbscan.sys
2008-12-17 11:39 . 2008-04-14 00:15 15,104 --a--c--- c:\windows\system32\dllcache\usbscan.sys
2008-12-17 11:39 . 2001-08-17 22:36 5,632 --a------ c:\windows\system32\ptpusb.dll
2008-12-16 23:03 . 2008-12-16 23:03 <DIR> d-------- c:\program files\AVG
2008-12-16 23:03 . 2009-01-05 12:42 <DIR> d-------- c:\documents and settings\All Users\Application Data\avg8
2008-12-16 13:45 . 2009-01-12 12:45 <DIR> d-------- c:\program files\Steam
2008-12-16 13:18 . 2008-01-03 06:10 105,856 -ra------ c:\windows\system32\drivers\Rtenicxp.sys
2008-12-16 13:15 . 2008-12-16 13:15 <DIR> d-------- c:\documents and settings\All Users\Application Data\nView_Profiles
2008-12-16 13:15 . 2008-12-16 13:15 8 --a------ c:\windows\system32\nvModes.dat
2008-12-16 13:14 . 2008-12-16 13:14 <DIR> d-------- c:\windows\system32\AGEIA
2008-12-16 13:14 . 2009-01-06 19:33 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard
2008-12-16 13:14 . 2008-12-16 13:14 <DIR> d-------- c:\program files\AGEIA Technologies
2008-12-16 13:13 . 2008-12-16 13:13 <DIR> d-------- c:\windows\nview
2008-12-16 13:13 . 2008-12-16 13:13 940,794 --a------ c:\windows\system32\LoopyMusic.wav
2008-12-16 13:13 . 2008-11-12 14:54 453,152 --a------ c:\windows\system32\nvudisp.exe
2008-12-16 13:13 . 2009-01-12 12:45 203,188 --a------ c:\windows\system32\nvapps.xml
2008-12-16 13:13 . 2008-12-16 13:13 146,650 --a------ c:\windows\system32\BuzzingBee.wav
2008-12-16 13:13 . 2008-11-12 14:54 18,537 --a------ c:\windows\system32\nvdisp.nvu
2008-12-16 13:09 . 2008-12-16 13:09 <DIR> d-------- c:\windows\system32\RTCOM
2008-12-16 13:09 . 2008-02-12 22:31 16,857,600 -ra------ c:\windows\RTHDCPL.EXE
2008-12-16 13:09 . 2007-03-23 03:19 9,715,200 -ra------ c:\windows\RTLCPL.EXE
2008-12-16 13:09 . 2008-02-14 01:04 4,676,096 -ra------ c:\windows\system32\drivers\RtkHDAud.sys
2008-12-16 13:09 . 2006-05-04 00:26 2,808,832 -ra------ c:\windows\ALCWZRD.EXE
2008-12-16 13:09 . 2007-06-28 00:44 2,165,760 -ra------ c:\windows\MicCal.exe
2008-12-16 13:09 . 2007-11-20 02:15 1,826,816 -ra------ c:\windows\SkyTel.exe
2008-12-16 13:09 . 2007-11-07 01:31 1,191,936 -ra------ c:\windows\RtlUpd.exe
2008-12-16 13:09 . 2005-09-20 18:25 299,008 -ra------ c:\windows\system32\ALSNDMGR.CPL
2008-12-16 13:09 . 2006-08-17 14:58 282,624 -ra------ c:\windows\system32\RTSndMgr.CPL
2008-12-16 13:09 . 2006-07-21 00:14 86,016 -ra------ c:\windows\SOUNDMAN.EXE
2008-12-16 13:09 . 2005-05-03 02:43 69,632 -ra------ c:\windows\ALCMTR.EXE
2008-12-12 12:16 . 2008-12-12 12:16 0 --a------ c:\windows\nsreg.dat
2008-12-12 12:04 . 2008-12-12 12:04 <DIR> d-------- c:\documents and settings\All Users\Application Data\LogiShrd
2008-12-12 12:04 . 2008-12-12 12:04 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Logitech
2008-12-12 12:04 . 2008-09-26 09:52 10,384 --a------ c:\windows\system32\drivers\LBeepKE.sys
2008-12-12 12:04 . 2008-12-12 12:04 0 --ah----- c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-12-12 12:04 . 2008-12-12 12:04 0 --ah----- c:\windows\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
2008-12-12 12:04 . 2008-12-12 12:04 0 --ah----- c:\windows\system32\drivers\Msft_Kernel_LHidFilt_01005.Wdf
2008-12-12 12:03 . 2009-01-08 02:34 <DIR> d-------- c:\program files\Logitech
2008-12-12 12:03 . 2008-12-12 12:04 <DIR> d-------- c:\program files\Common Files\Logishrd
2008-12-12 12:03 . 2008-12-12 12:03 <DIR> d-------- c:\documents and settings\All Users\Application Data\Logitech
2008-12-12 12:03 . 2008-11-07 16:37 301,656 --a------ c:\windows\system32\BtCoreIf.dll
2008-12-12 12:03 . 2008-11-07 16:38 170,512 --a------ c:\windows\system32\kemutb.dll
2008-12-12 12:03 . 2008-11-07 16:38 145,936 --a------ c:\windows\system32\KemUtil.dll
2008-12-12 12:03 . 2008-11-07 16:38 117,264 --a------ c:\windows\system32\KemWnd.dll
2008-12-12 12:03 . 2008-11-07 16:38 84,496 --a------ c:\windows\system32\KemXML.dll
2008-12-12 11:33 . 2008-08-14 02:11 2,189,184 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe
2008-12-12 11:33 . 2008-08-14 02:09 2,145,280 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe
2008-12-12 11:33 . 2008-08-14 01:33 2,066,048 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe
2008-12-12 11:33 . 2008-08-14 01:33 2,023,936 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe
2008-12-12 11:33 . 2008-10-24 03:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys
2008-12-12 11:30 . 2008-06-13 03:05 272,128 --------- c:\windows\system32\drivers\bthport.sys
2008-12-12 11:30 . 2008-06-13 03:05 272,128 -----c--- c:\windows\system32\dllcache\bthport.sys
2008-12-12 11:26 . 2008-12-17 11:40 <DIR> d--h----- c:\windows\$hf_mig$
2008-12-12 11:26 . 2006-10-08 21:51 23,856 --a------ c:\windows\system32\spupdsvc.exe
2008-12-12 11:20 . 2008-10-16 14:09 43,544 --a------ c:\windows\system32\wups2.dll
2008-12-12 11:20 . 2008-10-16 14:09 31,768 --a------ c:\windows\system32\wucltui.dll.mui
2008-12-12 11:20 . 2008-10-16 14:07 23,576 --a------ c:\windows\system32\wuaucpl.cpl.mui
2008-12-12 11:20 . 2008-10-16 14:07 23,576 --a------ c:\windows\system32\wuapi.dll.mui
2008-12-12 11:20 . 2008-10-16 14:07 18,456 --a------ c:\windows\system32\wuaueng.dll.mui
2008-12-12 11:17 . 2008-12-12 11:17 <DIR> d---s---- c:\documents and settings\Administrator\UserData
2008-12-12 10:29 . 2001-10-24 16:16 36,224 -ra------ c:\windows\system32\drivers\lne100v5.sys
2008-12-12 10:25 . 2008-04-13 22:05 36,224 --a------ c:\windows\system32\drivers\an983.sys
2008-12-12 10:25 . 2008-04-13 22:05 36,224 --a--c--- c:\windows\system32\dllcache\an983.sys
2008-12-12 08:40 . 2008-12-12 08:40 <DIR> d-------- c:\program files\Atheros Communications Inc
2008-12-12 06:59 . 2008-12-12 06:59 <DIR> d-------- c:\program files\Common Files\Adobe
2008-12-12 06:58 . 2002-01-01 01:11 <DIR> d-------- c:\program files\ASUS
2008-12-12 06:58 . 2006-01-10 00:50 24,576 -ra------ c:\windows\system32\AsIO.dll
2008-12-12 06:58 . 2007-12-17 01:14 12,400 -ra------ c:\windows\system32\drivers\AsIO.sys
2008-12-12 06:58 . 2008-01-04 13:34 11,832 --a------ c:\windows\system32\drivers\AsInsHelp64.sys
2008-12-12 06:58 . 2008-01-04 13:34 10,216 --a------ c:\windows\system32\drivers\AsInsHelp32.sys
2008-12-12 06:58 . 2008-12-12 06:58 670 --a------ c:\windows\setup.iss
2008-12-12 05:46 . 2008-12-12 05:46 <DIR> dr------- c:\windows\AsDmiHtm
2008-12-12 05:26 . 2002-01-01 01:11 <DIR> d--h----- c:\program files\InstallShield Installation Information
2008-12-12 05:25 . 2008-12-12 06:55 <DIR> d-------- c:\program files\VIA
2008-12-12 05:25 . 2008-12-12 12:05 <DIR> d-------- c:\program files\Common Files\InstallShield

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-12 19:55 3,608,064 ----a-w c:\windows\Internet Logs\xDB4.tmp
2009-01-12 02:10 1,933,312 ----a-w c:\windows\Internet Logs\xDB3.tmp
2009-01-06 20:29 1,872,896 ----a-w c:\windows\Internet Logs\xDB2.tmp
2009-01-06 18:27 93,696 ----a-w c:\windows\Internet Logs\xDB1.tmp
2008-12-12 12:34 --------- d-----w c:\program files\microsoft frontpage
2008-11-21 21:46 200,704 ----a-w c:\windows\system32\ssldivx.dll
2008-11-21 21:46 1,044,480 ----a-w c:\windows\system32\libdivx.dll
2008-11-12 21:45 453,152 ----a-w c:\windows\system32\NVUNINST.EXE
2008-10-23 12:36 286,720 ----a-w c:\windows\system32\gdi32.dll
2008-10-16 22:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 22:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 22:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 22:12 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 22:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 22:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 22:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 22:07 208,744 ----a-w c:\windows\system32\muweb.dll
2008-10-16 01:00 666,112 ----a-w c:\windows\system32\wininet.dll
2008-10-13 17:56 70,936 ----a-w c:\windows\system32\PhysXLoader.dll
2002-01-02 04:48 32,768 ----a-w c:\windows\inf\UpdateUSB.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-12-09 333192]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"Steam"="c:\program files\steam\steam.exe" [2008-12-16 1410296]
"PeerGuardian"="c:\program files\PeerGuardian2\pg2.exe" [2007-01-30 1432064]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HDAudDeck"="c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe" [2008-04-09 29757440]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 39792]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-03-20 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-03-20 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-03-20 137752]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-11-12 13672448]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-11-12 86016]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-08-21 981904]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-10-10 c:\windows\KHALMNPR.Exe]
"RTHDCPL"="RTHDCPL.EXE" [2008-02-12 c:\windows\RTHDCPL.EXE]
"nwiz"="nwiz.exe" [2008-11-12 c:\windows\system32\nwiz.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2008-12-12 809488]
Z Cinema.lnk - c:\windows\Installer\{EE885042-228A-446F-A30D-64ECBDC93859}\StartupShortcut_EE885042228A446FA30D64ECBDC93859.exe [2009-01-08 172032]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSetActiveDesktop"= 1 (0x1)
"NoActiveDesktopChanges"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2008-11-07 16:41 72208 c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 c:\windows\system32\nnnnKbBq

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Steam\\steamapps\\thestone86\\counter-strike source\\hl2.exe"=
"c:\\Program Files\\Vuze\\Azureus.exe"=

R3 LNE100;Linksys LNE100TX(v5) Fast Ethernet Adapter;c:\windows\system32\drivers\lne100v5.sys [2008-12-12 36224]
R4 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [2008-12-12 10384]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2008-12-12 222976]
S4 ASKService;ASKService;c:\program files\AskBarDis\bar\bin\AskService.exe [2008-12-19 464264]
S4 ASKUpgrade;ASKUpgrade;c:\program files\AskBarDis\bar\bin\ASKUpgrade.exe [2008-12-19 234888]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a440d0af-c7ea-11dd-8095-806d6172696f}]
\Shell\AutoRun\command - D:\autorun.bat
.
- - - - ORPHANS REMOVED - - - -

BHO-{444793C4-4138-4ED6-BE14-1248E48F1E84} - c:\windows\system32\nnnnKbBq.dll
BHO-{c19df430-5675-4f2c-8281-930656de52e1} - c:\windows\system32\gekyeq.dll
Notify-xxyvsPff - xxyvsPff.dll


.
------- Supplementary Scan -------
.
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\gcfj3guq.default\
FF - prefs.js: browser.search.selectedEngine - Ask
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-12 12:46:07
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HDAudDeck = c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe 1????????????????????????????????????????????????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(816)
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
c:\program files\common files\logishrd\bluetooth\LBTServ.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\rundll32.exe
c:\program files\Common Files\Logishrd\KHAL2\KHALMNPR.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-01-12 12:47:10 - machine was rebooted [Administrator]
ComboFix-quarantined-files.txt 2009-01-12 20:47:07

Pre-Run: 98,170,171,392 bytes free
Post-Run: 98,565,345,280 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

330 --- E O F --- 2008-12-17 19:40:53
 
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:12:49 PM, on 1/12/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\HTJ\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Live Search
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Live Search
O4 - HKLM\..\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe 1
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Z Cinema.lnk = ?
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} (asusTek_sysctrl Class) - http://support.asus.com/common/asusTek_sys_ctrl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1229109443421
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1229111055687
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 4053 bytes
 
Status
Not open for further replies.

Similar threads

Captain Xarzu
How do I ensure I properly get text alerts on my Android phone?
Replies
2
Views
873
Joe C
Joe C
P
ComboFix Replacement
Replies
5
Views
516
PC_Cone
P
B
i keep getting an alert from AVG every minute or so. super annoying!
2
Replies
18
Views
2K
alyssa.robert235
A
R
people who switch computers alot what is your tricks to save time?
2
Replies
10
Views
2K
mikee
M
O
hello & mostly clueless & would appreciate mac security help after trojan attack!
Replies
0
Views
930
once2023
O
Back
Top Bottom