bloodhound.exploit.196 help!

[liam]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:39:37 PM, on 4/18/2009
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16830)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\Dwm.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Cisco Systems\Clean Access Agent\CCAAgent.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
D:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE
C:\Program Files\iTunes\iTunes.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Symantec AntiVirus\DWHWIZRD.EXE
D:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\Microsoft Office\Office12\WINWORD.EXE
C:\Program Files\Symantec AntiVirus\SavUI.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://eduportal1
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Live Search
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://eduportal1
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://eduportal1
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Live Search
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Live Search
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by United States Coast Guard
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (file missing)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe C:\Windows\system32\nvHotkey.dll,Start
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Clean Access Agent.lnk = C:\Program Files\Cisco Systems\Clean Access Agent\CCAAgent.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech SetPoint.lnk = D:\Program Files\Logitech\SetPoint\SetPoint.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = exmail.uscga.edu
O17 - HKLM\Software\..\Telephony: DomainName = exmail.uscga.edu
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = exmail.uscga.edu
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = exmail.uscga.edu
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Update Service (gupdate1c9be13a79f0a9e) (gupdate1c9be13a79f0a9e) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

--
End of file - 9672 bytes

 

[Osiris]

Waht program is giving you this message?
Can you rub Malwarebytes and post its log?

 

[liam]

Symantec Antivirus keeps popping up with it as quartantined, but they keep popping up sometimes by the hundreds. they are usually .tmp files.

Malwarebytes' Anti-Malware 1.36
Database version: 2002
Windows 6.0.6000

4/18/2009 9:35:27 PM
mbam-log-2009-04-18 (21-35-27).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 291881
Time elapsed: 4 hour(s), 59 minute(s), 50 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Internet Explorer\Control Panel\Homepage (Hijack.Homepage) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

 

[Osiris]

Download Cleanup! and CCleaner, install, and run them both.

 

[liam]

I ran them both and it seemed to clean it up. Nothing popped up about it, but just now they started coming back.

 

[Osiris]

Make sure system restore is disabled as well.

Now run combofix and malwarebytes and post both their logs

 

[liam]

ComboFix 09-04-23.A3 - PWilliams1 04/23/2009 19:57.1 - NTFSx86
Microsoft® Windows Vista™ Business 6.0.6000.0.1252.1.1033.18.2046.894 [GMT -4:00]
Running from: c:\users\pwilliams1\Downloads\ComboFix.exe
AV: Symantec AntiVirus *On-access scanning enabled* (Updated)
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\admingor\AppData\Roaming\Microsoft\SystemCertificates\Request
c:\users\pwilliams1\AppData\Roaming\Microsoft\SystemCertificates\Request

.
((((((((((((((((((((((((( Files Created from 2009-05-23 to 2009-4-23 )))))))))))))))))))))))))))))))
.

2009-04-18 20:06 . 2009-04-18 20:06 -------- d-----w c:\users\pwilliams1\AppData\Roaming\Malwarebytes
2009-04-18 20:06 . 2009-04-06 19:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-04-18 20:06 . 2009-04-06 19:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-18 20:06 . 2009-04-18 20:06 -------- d-----w c:\users\All Users\Malwarebytes
2009-04-18 20:06 . 2009-04-18 20:06 -------- d-----w c:\programdata\Malwarebytes
2009-04-16 02:21 . 2009-04-22 18:57 83144 ----a-w c:\users\pwilliams1\AppData\Roaming\nvModes.dat
2009-04-16 02:11 . 2009-04-20 16:52 -------- d-----w c:\users\All Users\NVIDIA
2009-04-16 02:11 . 2009-04-20 16:52 -------- d-----w c:\programdata\NVIDIA
2009-04-15 22:13 . 2007-10-05 01:24 1073152 ----a-w c:\windows\system32\nvcpluir.dll
2009-04-15 22:13 . 2007-10-05 01:24 753664 ----a-w c:\windows\system32\nvcplui.exe
2009-04-15 22:13 . 2007-10-05 01:24 413696 ----a-w c:\windows\system32\nvcpl.cpl
2009-04-15 22:13 . 2007-10-05 01:24 307200 ----a-w c:\windows\system32\nvexpbar.dll
2009-04-15 21:46 . 2009-04-15 21:46 -------- d-----w c:\windows\system32\config\systemprofile\AppData\Local\Google
2009-04-15 17:00 . 2008-12-08 04:34 376832 ----a-w c:\windows\system32\winhttp.dll
2009-04-15 17:00 . 2008-06-05 04:50 30208 ----a-w c:\windows\system32\xolehlp.dll
2009-04-15 17:00 . 2008-06-05 04:50 500736 ----a-w c:\windows\system32\msdtcprx.dll
2009-04-09 12:03 . 2009-04-09 12:03 -------- d-----w c:\windows\system32\config\systemprofile\AppData\Local\Adobe
2009-04-09 11:54 . 2009-04-09 11:54 -------- d-----w c:\windows\system32\config\systemprofile\AppData\Local\Mozilla
2009-04-09 11:52 . 2009-04-22 16:37 -------- d-----w c:\windows\system32\config\systemprofile\AppData\Local\Temp
2009-04-09 11:49 . 2009-04-09 11:49 -------- d-----w c:\windows\system32\config\systemprofile\AppData\Roaming\Apple Computer
2009-04-09 11:49 . 2009-04-09 11:49 -------- d-----w c:\windows\system32\config\systemprofile\AppData\Roaming\HP
2009-04-09 11:48 . 2009-04-09 11:48 -------- d-----w c:\windows\system32\config\systemprofile\AppData\Roaming\Logitech
2009-04-09 11:48 . 2009-04-09 11:48 -------- d-----w c:\windows\system32\config\systemprofile\AppData\Local\PowerDVD DX
2009-04-09 11:48 . 2009-04-09 11:48 -------- d-----w C:\CiscoCAA
2009-04-09 11:47 . 2009-04-09 11:49 -------- d-----w c:\windows\system32\config\systemprofile\AppData\Local\Apple Computer
2009-04-09 11:47 . 2009-04-09 11:47 -------- d-----w c:\windows\system32\config\systemprofile\AppData\Local\Symantec
2009-04-09 11:47 . 2009-04-09 11:47 -------- d-----r c:\windows\system32\config\systemprofile\Downloads
2009-04-09 11:47 . 2009-04-09 11:49 -------- d-----r c:\windows\system32\config\systemprofile\Music
2009-04-09 11:47 . 2009-04-09 11:47 -------- d-----r c:\windows\system32\config\systemprofile\Videos
2009-04-09 11:47 . 2009-04-09 11:47 -------- d-----r c:\windows\system32\config\systemprofile\Pictures
2009-04-09 11:46 . 2009-04-09 11:46 -------- d-----r c:\windows\system32\config\systemprofile\Documents
2009-03-30 19:56 . 2009-03-30 19:56 -------- d-----w c:\users\pwilliams1\AppData\Roaming\SUPERAntiSpyware.com

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-23 11:48 . 2008-11-06 17:00 -------- d-----w c:\programdata\Google Updater
2009-04-22 19:17 . 2008-11-04 22:27 130834 ----a-w c:\windows\hpoins18.dat
2009-04-21 21:33 . 2009-02-01 00:14 410984 ----a-w c:\windows\System32\deploytk.dll
2009-04-21 21:33 . 2009-04-21 21:33 -------- d-----w c:\program files\Java
2009-04-19 03:52 . 2009-04-19 03:52 -------- d-----w c:\program files\CleanUp!
2009-04-18 20:06 . 2009-04-18 20:06 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-04-18 16:48 . 2009-04-18 16:48 -------- d-----w c:\program files\Trend Micro
2009-04-18 16:47 . 2009-04-18 16:47 4738 ----a-w C:\CybDefInstallInfo.log
2009-04-17 01:22 . 2008-08-12 10:18 -------- d-----w c:\programdata\Microsoft Help
2009-04-15 22:11 . 2006-11-02 10:25 86016 ----a-w c:\windows\Inf\infstrng.dat
2009-04-15 22:11 . 2006-11-02 10:25 51200 ----a-w c:\windows\Inf\infpub.dat
2009-04-15 22:11 . 2006-11-02 10:25 86016 ----a-w c:\windows\Inf\infstor.dat
2009-04-15 21:47 . 2008-08-12 18:11 -------- d-----w c:\program files\Google
2009-04-15 21:35 . 2008-08-12 18:15 -------- d-----w c:\program files\SUPERAntiSpyware
2009-04-15 19:13 . 2006-11-02 11:18 -------- d-----w c:\program files\Windows Mail
2009-04-13 01:13 . 2009-01-16 07:02 680 ----a-w c:\users\pwilliams1\AppData\Local\d3d9caps.dat
2009-04-10 15:51 . 2008-11-17 23:14 -------- d-----w c:\users\pwilliams1\AppData\Roaming\Image Zone Express
2009-04-09 12:24 . 2008-11-04 19:30 106184 ----a-w c:\users\pwilliams1\AppData\Local\GDIPFONTCACHEV1.DAT
2009-04-09 11:48 . 2006-11-02 13:02 1356 ----a-w c:\windows\system32\config\systemprofile\AppData\Local\d3d9caps.dat
2009-04-09 11:48 . 2008-08-12 08:40 106184 ----a-w c:\windows\system32\config\systemprofile\AppData\Local\GDIPFONTCACHEV1.DAT
2009-03-25 17:27 . 2008-08-12 18:12 -------- d-----w c:\program files\Common Files\Adobe
2009-03-20 15:12 . 2009-03-20 15:12 -------- d-----w c:\users\pwilliams1\AppData\Roaming\Logitech
2009-03-20 15:08 . 2009-03-20 15:08 -------- d-----w c:\programdata\LogiShrd
2009-03-20 15:07 . 2009-03-20 15:06 -------- d-----w c:\program files\Common Files\Logishrd
2009-03-20 15:06 . 2009-03-20 15:06 -------- d-----w c:\programdata\Logitech
2009-03-20 15:06 . 2008-08-12 09:58 -------- d--h--w c:\program files\InstallShield Installation Information
2009-03-17 03:16 . 2009-04-15 16:59 40960 ----a-w c:\windows\AppPatch\apihex86.dll
2009-03-17 03:16 . 2009-04-15 16:59 14848 ----a-w c:\windows\System32\apilogen.dll
2009-03-17 03:16 . 2009-04-15 16:59 25600 ----a-w c:\windows\System32\amxread.dll
2009-03-03 04:24 . 2009-04-15 16:59 3503584 ----a-w c:\windows\System32\ntkrnlpa.exe
2009-03-03 04:24 . 2009-04-15 16:59 3469280 ----a-w c:\windows\System32\ntoskrnl.exe
2009-03-03 04:20 . 2009-04-15 16:59 826368 ----a-w c:\windows\System32\wininet.dll
2009-03-03 04:19 . 2009-04-15 16:59 158720 ----a-w c:\windows\System32\sdohlp.dll
2009-03-03 04:19 . 2009-04-15 16:59 549888 ----a-w c:\windows\System32\rpcss.dll
2009-03-03 04:19 . 2009-04-15 16:59 24576 ----a-w c:\windows\System32\printfilterpipelineprxy.dll
2009-03-03 04:16 . 2009-04-15 16:59 56320 ----a-w c:\windows\System32\iesetup.dll
2009-03-03 04:16 . 2009-04-15 16:59 97280 ----a-w c:\windows\System32\iasrecst.dll
2009-03-03 04:16 . 2009-04-15 16:59 53248 ----a-w c:\windows\System32\iasads.dll
2009-03-03 04:16 . 2009-04-15 16:59 37888 ----a-w c:\windows\System32\iasdatastore.dll
2009-03-03 04:16 . 2009-04-15 16:59 78336 ----a-w c:\windows\System32\ieencode.dll
2009-03-03 04:16 . 2009-04-15 16:59 52736 ----a-w c:\windows\AppPatch\iebrshim.dll
2009-03-03 04:15 . 2009-04-15 16:59 72704 ----a-w c:\windows\System32\admparse.dll
2009-03-03 02:40 . 2009-04-15 16:59 654336 ----a-w c:\windows\System32\printfilterpipelinesvc.exe
2009-03-03 02:08 . 2009-04-15 16:59 26624 ----a-w c:\windows\System32\ieUnatt.exe
2009-03-03 00:44 . 2009-04-15 16:59 48128 ----a-w c:\windows\System32\mshtmler.dll
2009-03-02 18:08 . 2008-08-12 11:09 -------- d-----w c:\program files\STELLA2
2009-02-19 04:27 . 2009-03-20 15:07 84496 ----a-w c:\windows\System32\KemXML.dll
2009-02-19 04:27 . 2009-03-20 15:07 117264 ----a-w c:\windows\System32\KemWnd.dll
2009-02-19 04:27 . 2009-03-20 15:07 145936 ----a-w c:\windows\System32\KemUtil.dll
2009-02-19 04:27 . 2009-03-20 15:07 170512 ----a-w c:\windows\System32\kemutb.dll
2009-02-19 04:26 . 2009-03-20 15:07 301656 ----a-w c:\windows\System32\BtCoreIf.dll
2009-02-13 07:26 . 2009-04-15 16:59 72704 ----a-w c:\windows\System32\secur32.dll
2009-02-13 07:26 . 2009-04-15 16:59 1233408 ----a-w c:\windows\System32\lsasrv.dll
2009-02-13 07:26 . 2009-04-15 16:59 7680 ----a-w c:\windows\System32\lsass.exe
2009-02-09 01:59 . 2009-03-16 12:30 2028032 ----a-w c:\windows\System32\win32k.sys
2008-12-24 01:34 . 2006-11-02 12:50 174 --sha-w c:\program files\desktop.ini
2008-09-08 14:59 . 2008-09-08 14:59 106184 ----a-w c:\users\admingor\AppData\Local\GDIPFONTCACHEV1.DAT
2008-08-13 12:59 . 2008-08-13 12:59 106184 ----a-w c:\users\uscgadmin\AppData\Local\GDIPFONTCACHEV1.DAT
2007-02-21 19:48 . 2007-02-21 19:48 8192 --sha-w c:\windows\Users\Default\NTUSER.DAT
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-08-12 1232896]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-11-06 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2007-09-17 124200]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2006-11-22 107112]
"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2006-11-28 134808]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-11 49152]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-11-07 111936]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-10-05 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-10-05 8497696]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-10-05 81920]
"NVHotkey"="c:\windows\system32\nvHotkey.dll" [2007-10-05 86016]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-21 148888]

c:\users\pwilliams1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-7 101440]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Clean Access Agent.lnk - c:\program files\Cisco Systems\Clean Access Agent\CCAAgent.exe [2007-9-17 1593425]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-1-2 210520]
Logitech SetPoint.lnk - d:\program files\Logitech\SetPoint\SetPoint.exe [2009-3-20 809488]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"HideShutdownScripts"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"HideLogonScripts"= 0 (0x0)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"HideLogonScripts"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoMSAppLogo5ChannelNotify"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)
"ForceStartMenuLogOff"= 1 (0x1)
"DisallowCpl"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)
"ForceStartMenuLogOff"= 1 (0x1)
"DisallowCpl"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2009-04-15 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-04-15 21:35 356352 ----a-w c:\program files\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{F3034043-51C9-452C-8770-31B86669676E}"= c:\program files\CyberLink\PowerDVD DX\PowerDVD.exe:CyberLink PowerDVD DX
"{5D7E70F9-479C-495E-A3F2-ED9B36B1A59C}"= c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe:CyberLink PowerDVD DX Resident Program
"{F2A5333A-6522-4C29-BDF7-637FC51B828F}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{45468993-869B-4F30-BF12-E50244EE1E39}"= UDP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{23004AEE-6D61-4099-9450-45110454D0E9}"= TCP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{3794CA1F-E420-47C2-B166-2747073429AD}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{23493E91-4AA6-407F-B074-E15583A3A682}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{BA146686-6974-4BB1-97EC-C0B842652706}"= UDP:c:\program files\Symantec AntiVirus\Rtvscan.exe:Symantec Antivirus
"{622AC985-CF46-476E-BF00-4BD64CBB5D4F}"= TCP:c:\program files\Symantec AntiVirus\Rtvscan.exe:Symantec Antivirus
"{7326AA02-F3B5-4270-968F-9F043D3BC204}"= UDP:c:\program files\Common Files\Symantec Shared\ccApp.exe:Symantec Email
"{0892DF34-13A4-4F12-870B-A57BC28791D7}"= TCP:c:\program files\Common Files\Symantec Shared\ccApp.exe:Symantec Email
"TCP Query User{741DB7FA-0A84-4FAF-B8DB-254B121B93D7}c:\\program files\\microsoft office\\office12\\outlook.exe"= UDP:c:\program files\microsoft office\office12\outlook.exe:Microsoft Office Outlook
"UDP Query User{E31C027D-FE78-431B-8280-54007D3847C6}c:\\program files\\microsoft office\\office12\\outlook.exe"= TCP:c:\program files\microsoft office\office12\outlook.exe:Microsoft Office Outlook
"{E214ADFC-CD28-4DB9-960A-1877532F579B}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{35203826-A4BE-4A14-93DE-8D23250709D9}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"TCP Query User{BBAC1C55-B594-416D-8435-C6ADEB62B977}c:\\program files\\internet explorer\\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{95158387-3AF5-4BF9-8C7C-7C3A2BB50112}c:\\program files\\internet explorer\\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"{AB496E8E-0E50-4850-978A-34BEEC5CAE35}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{C209E12A-2826-4CC3-8212-16F201C0F5E4}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"{D87CBDD0-774B-4C5E-8E2D-7B316AE7D52D}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{96FD7798-8F6D-4ECA-B246-03448C310293}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{D201B36C-9D1D-40A5-B684-60F8F5558A9E}"= UDP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{0F022999-6ED1-4B6A-A726-DA1A94B81F97}"= TCP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{EEF471D0-0C36-4604-9F5B-5BBDB1B43C1E}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{61EEFA1E-CE3C-4E8B-A5E8-ABD3795C4E7A}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

R2 gupdate1c9be13a79f0a9e;Google Update Service (gupdate1c9be13a79f0a9e);c:\program files\Google\Update\GoogleUpdate.exe [2009-04-15 133104]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2006-02-16 4096]
R3 SavRoam;SavRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [2006-11-28 122008]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2009-04-15 9968]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.sys [2009-04-15 55024]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\b57nd60x.sys [2006-11-02 167936]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2009-02-27 101936]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\I]
\shell\AutoRun\command - I:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0c99ebe5-bce6-11dd-a2b8-0019b979e363}]
\shell\AutoRun\command - I:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{15c94039-e39c-11dd-909e-0019b979e363}]
\shell\AutoRun\command - I:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9b800c47-12c2-11de-b848-0019b979e363}]
\shell\AutoRun\command - I:\LaunchU3.exe -a
.
Contents of the 'Scheduled Tasks' folder

2009-04-23 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-08-12 16:00]

2009-04-23 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-15 21:46]

2009-04-23 c:\windows\Tasks\User_Feed_Synchronization-{8B9DE45F-9A93-466F-95EB-D1B7119820C8}.job
- c:\windows\system32\msfeedssync.exe [2006-11-02 09:45]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://eduportal1
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\pwilliams1\AppData\Roaming\Mozilla\Firefox\Profiles\q2sl82ru.default\
FF - prefs.js: browser.startup.homepage - hxxp://eduportal1/
FF - prefs.js: keyword.URL - about:neterror?e=query&u=
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.141.5\npGoogleOneClick7.dll
FF - plugin: d:\program files\Mozilla Firefox\plugins\np-mswmp.dll

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-23 20:03
Windows 6.0.6000 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

 

[liam]

.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\System\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'Explorer.exe'(3564)
c:\program files\Roxio\Drag-to-Disc\Shellex.dll
c:\program files\Common Files\Roxio Shared\9.0\DLLShared\DLAAPI_W.DLL
c:\program files\Roxio\Drag-to-Disc\ShellRes.dll
.
Completion time: 2009-04-24 20:05
ComboFix-quarantined-files.txt 2009-04-24 00:05

Pre-Run: The system cannot find message text for message number 0x2379 in the message file for Application.
Post-Run: 8,973,713,408 bytes free

261 --- E O F --- 2009-04-21 14:14







Malwarebytes' Anti-Malware 1.36
Database version: 2002
Windows 6.0.6000

4/24/2009 12:05:31 AM
mbam-log-2009-04-24 (00-05-31).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 282244
Time elapsed: 2 hour(s), 21 minute(s), 47 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Internet Explorer\Control Panel\Homepage (Hijack.Homepage) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

 

[Osiris]

Are things any better?

Post a new hijackthis log as well