auut.com

[mattjampet]

Hi
I have been plagued by this browser hijacker auut.com for a week now and it is doing my knapper in !!!!
I have tried to follow the threads and remove this thing but nothing seems to work i have tried cwshredder, avg, adaware amongst a few.
Nothing seems to make a diff
I am not the good with computers but can follow instructions can anybody help me???? Please????

[PrntRhd]

Post a HJT log to begin with.

[mjc]

Follow the instructions here...

http://www.pcguide.com/vb/showthread.php?t=60009

[PrntRhd]

I was just getting that link, thanks mjc.
:)

[mattjampet]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:15:50, on 18/11/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\WTablet\Pen_TabletUser.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Lexmark 6500 Series\lxdfmon.exe
C:\Program Files\Lexmark 6500 Series\lxdfamon.exe
C:\Program Files\Lexmark 1200 Series\LXCZbmgr.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Kontiki\KHost.exe
C:\Program Files\Eraser\Eraser.exe
C:\Program Files\NETGEAR\WG111T\wlan111t.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Lexmark 1200 Series\lxczbmon.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
C:\Users\Matthew\Desktop\hjt\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_GB&c=73&bd=Pavilion&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_GB&c=73&bd=Pavilion&pf=laptop
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F3 - REG:win.ini: load=C:\Users\Matthew\AppData\Local\Temp\efedc.exe
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [NapsterShell] C:\Program Files\Napster\napster.exe /systray
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [lxdfmon.exe] "C:\Program Files\Lexmark 6500 Series\lxdfmon.exe"
O4 - HKLM\..\Run: [lxdfamon] "C:\Program Files\Lexmark 6500 Series\lxdfamon.exe"
O4 - HKLM\..\Run: [Lexmark 6500 Series Fax Server] "C:\Program Files\Lexmark 6500 Series\fm3032.exe" /s
O4 - HKLM\..\Run: [Utility] C:\Program Files\SMC\EZ Connect N Draft 11n Wireless USB2.0 Adapter\SMCWUSBS-N.exe -h
O4 - HKLM\..\Run: [lxczbmgr.exe] "C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [MS Juan] rundll32 "C:\Users\Matthew\AppData\Local\Temp\mlywvasw.dll",run
O4 - HKCU\..\Run: [7764965d] rundll32.exe "C:\Users\Matthew\AppData\Local\Temp\yukxtcko.dll",b
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe -all
O4 - HKCU\..\Run: [Eraser] C:\Program Files\Eraser\Eraser.exe -hide
O4 - Global Startup: NETGEAR WG111T Smart Wizard.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O13 - Gopher Prefix:
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - [url]http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab[/url]
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - [url]http://downloads.ewido.net/ewidoOnlineScan.cab[/url]
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - [url]http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab[/url]
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe
O23 - Service: EPSON V3 Service4(01) (EPSON_PM_RPCV4_01) - SEIKO EPSON CORPORATION - C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: lxcz_device - - C:\Windows\system32\lxczcoms.exe
O23 - Service: lxdf_device - - C:\Windows\system32\lxdfcoms.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: TabletServicePen - Wacom Technology, Corp. - C:\Windows\system32\Pen_Tablet.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 10001 bytes

[mattjampet]

please let me know if you can help.
thanx matt

[classicsoftware]

First:
How to run a scan with Malwarebytes' Anti-Malware

Download Malwarebytes' Anti-Malware from Here (http://www.besttechie.net/tools/mbam-setup.exe) or Here (http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html)

Double Click mbam-setup.exe to install the application.
Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.[/QUOTE]

Second:

Please do the following:


Download this file - combofix.exe (http://download.bleepingcomputer.com/sUBs/ComboFix.exe) to your Desktop (it needs to be run from the Desktop). Double click combofix.exe & follow the prompts.
When finished, it will produce a log for you.


Note:

Do not mouseclick Combofix's window while it is running. That may cause the program to stall...

Third:


Re-boot the system
Post the Combofix Log
Post the MBAM log
Post a new HJT log
Tell us how the system is running.

[mattjampet]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:51:49, on 19/11/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\system32\WTablet\Pen_TabletUser.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Lexmark 6500 Series\lxdfmon.exe
C:\Program Files\Lexmark 6500 Series\lxdfamon.exe
C:\Program Files\Lexmark 1200 Series\LXCZbmgr.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Kontiki\KHost.exe
C:\Program Files\Eraser\Eraser.exe
C:\Program Files\NETGEAR\WG111T\wlan111t.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Lexmark 1200 Series\lxczbmon.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
C:\Users\Matthew\Desktop\hjt\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_GB&c=73&bd=Pavilion&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_GB&c=73&bd=Pavilion&pf=laptop
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [NapsterShell] C:\Program Files\Napster\napster.exe /systray
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [lxdfmon.exe] "C:\Program Files\Lexmark 6500 Series\lxdfmon.exe"
O4 - HKLM\..\Run: [lxdfamon] "C:\Program Files\Lexmark 6500 Series\lxdfamon.exe"
O4 - HKLM\..\Run: [Lexmark 6500 Series Fax Server] "C:\Program Files\Lexmark 6500 Series\fm3032.exe" /s
O4 - HKLM\..\Run: [Utility] C:\Program Files\SMC\EZ Connect N Draft 11n Wireless USB2.0 Adapter\SMCWUSBS-N.exe -h
O4 - HKLM\..\Run: [lxczbmgr.exe] "C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe -all
O4 - HKCU\..\Run: [Eraser] C:\Program Files\Eraser\Eraser.exe -hide
O4 - Global Startup: NETGEAR WG111T Smart Wizard.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O13 - Gopher Prefix:
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - [url]http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab[/url]
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - [url]http://downloads.ewido.net/ewidoOnlineScan.cab[/url]
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - [url]http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab[/url]
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe
O23 - Service: EPSON V3 Service4(01) (EPSON_PM_RPCV4_01) - SEIKO EPSON CORPORATION - C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: lxcz_device - - C:\Windows\system32\lxczcoms.exe
O23 - Service: lxdf_device - - C:\Windows\system32\lxdfcoms.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: TabletServicePen - Wacom Technology, Corp. - C:\Windows\system32\Pen_Tablet.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 9476 bytes

[mattjampet]

Malwarebytes' Anti-Malware 1.30
Database version: 1410
Windows 6.0.6001 Service Pack 1

19/11/2008 20:22:41
mbam-log-2008-11-19 (20-21-28).txt

Scan type: Quick Scan
Objects scanned: 52622
Time elapsed: 9 minute(s), 31 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 3
Registry Values Infected: 3
Registry Data Items Infected: 6
Folders Infected: 1
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{db0b918e-a0a8-482b-8d75-a682816b0c7b} (Trojan.Downloader) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\affri (Malware.Trace) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\affltid (Malware.Trace) -> No action taken.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\ShellExecuteHooks\{db0b918e-a0a8-482b-8d75-a682816b0c7b} (Trojan.Downloader) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run\MS Juan (Trojan.Agent) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run\7764965d (Trojan.Vundo) -> No action taken.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\Tcpip\Parameters\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.147 85.255.112.166 -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\Tcpip\Parameters\Interfaces\{40b93fe1-2e3b-4fec-abf1-446dd4e7d3f8}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.147 85.255.112.166 -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\T cpip\Parameters\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.147 85.255.112.166 -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\T cpip\Parameters\Interfaces\{40b93fe1-2e3b-4fec-abf1-446dd4e7d3f8}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.147 85.255.112.166 -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\T cpip\Parameters\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.147 85.255.112.166 -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\T cpip\Parameters\Interfaces\{40b93fe1-2e3b-4fec-abf1-446dd4e7d3f8}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.147 85.255.112.166 -> No action taken.

Folders Infected:
C:\resycled (Trojan.DNSChanger) -> No action taken.

Files Infected:
(No malicious items detected)

[mattjampet]

ComboFix 08-11-18.02 - Matthew 2008-11-19 20:28:01.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.838 [GMT 0:00]
Running from: c:\users\Matthew\Downloads\ComboFix.exe
* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

D:\Autorun.inf
D:\resycled
d:\resycled\boot.com

.
((((((((((((((((((((((((( Files Created from 2008-10-19 to 2008-11-19 )))))))))))))))))))))))))))))))
.

2008-11-19 20:27 . 2008-11-19 20:27 61,440 --a------ c:\windows\System32\drivers\qmlmjw.sys
2008-11-19 20:10 . 2008-11-19 20:10 <DIR> d-------- c:\users\Matthew\AppData\Roaming\Malwarebytes
2008-11-19 20:10 . 2008-10-22 16:10 38,496 --a------ c:\windows\System32\drivers\mbamswissarmy.sys
2008-11-19 20:10 . 2008-10-22 16:10 15,504 --a------ c:\windows\System32\drivers\mbam.sys
2008-11-19 20:09 . 2008-11-19 20:09 <DIR> d-------- c:\users\All Users\Malwarebytes
2008-11-19 20:09 . 2008-11-19 20:09 <DIR> d-------- c:\programdata\Malwarebytes
2008-11-19 20:09 . 2008-11-19 20:10 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-11-09 19:07 . 2008-11-09 19:07 <DIR> d--h----- c:\users\All Users\{A25FEDC1-F6D7-440C-BCE2-B71F595F6646}
2008-11-09 19:07 . 2008-11-09 19:07 <DIR> d--h----- c:\programdata\{A25FEDC1-F6D7-440C-BCE2-B71F595F6646}
2008-11-09 19:06 . 2008-11-09 19:21 <DIR> d-------- c:\program files\Eraser
2008-11-08 23:39 . 2008-11-08 23:39 69,128 --a------ c:\windows\System32\drivers\avgwfpx.sys
2008-11-08 23:39 . 2008-11-08 23:39 10,520 --a------ c:\windows\System32\avgrsstx.dll
2008-11-08 23:38 . 2008-11-18 19:53 <DIR> d-------- c:\windows\System32\drivers\Avg
2008-11-08 23:38 . 2008-11-08 23:38 97,928 --a------ c:\windows\System32\drivers\avgldx86.sys
2008-11-08 23:33 . 2008-11-08 23:33 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard
2008-11-07 22:48 . 2008-11-07 22:48 <DIR> d-------- c:\program files\Lavasoft
2008-11-07 19:29 . 2008-11-19 20:28 <DIR> d--h----- C:\$AVG8.VAULT$
2008-11-06 21:50 . 2008-11-08 23:38 <DIR> d-------- c:\users\All Users\avg8
2008-11-06 21:50 . 2008-11-08 23:38 <DIR> d-------- c:\programdata\avg8
2008-11-06 21:50 . 2008-11-06 21:50 <DIR> d-------- c:\program files\AVG
2008-10-29 17:55 . 2008-08-12 03:39 443,392 --a------ c:\windows\System32\win32spl.dll
2008-10-27 17:38 . 2008-10-27 17:38 0 --ah----- c:\windows\System32\drivers\Msft_User_WpdFs_01_00_ 00.Wdf
2008-10-24 17:47 . 2008-09-18 02:16 2,032,640 --a------ c:\windows\System32\win32k.sys
2008-10-24 17:47 . 2008-04-26 08:26 891,448 --a------ c:\windows\System32\drivers\tcpip.sys
2008-10-24 17:47 . 2008-04-12 03:32 784,896 --a------ c:\windows\System32\rpcrt4.dll
2008-10-24 17:47 . 2008-04-05 01:21 72,192 --a------ c:\windows\System32\drivers\pacer.sys
2008-10-24 17:47 . 2008-04-05 03:34 15,360 --a------ c:\windows\System32\pacerprf.dll
2008-10-20 16:01 . 2008-10-20 16:01 0 --ah----- c:\windows\System32\drivers\Msft_User_WpdMtpDr_01_ 00_00.Wdf

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
2008-11-19 20:32 --------- d-----w c:\programdata\Kontiki
2008-11-19 18:40 --------- d-----w c:\users\Matthew\AppData\Roaming\WTablet
2008-11-09 06:48 --------- d-----w c:\program files\Windows Defender
2008-11-09 06:48 --------- d-----w c:\program files\QuickTime
2008-11-09 06:48 --------- d-----w c:\program files\Lexmark 6500 Series
2008-11-09 06:48 --------- d-----w c:\program files\Lexmark 1200 Series
2008-11-09 06:48 --------- d-----w c:\program files\Kontiki
2008-11-09 06:48 --------- d-----w c:\program files\iTunes
2008-11-09 06:48 --------- d-----w c:\program files\Common Files\LightScribe
2008-11-09 06:46 --------- d-----w c:\programdata\Apple Computer
2008-11-09 06:46 --------- d-----w c:\program files\Windows Sidebar
2008-11-09 06:46 --------- d-----w c:\program files\Windows Photo Gallery
2008-11-09 06:46 --------- d-----w c:\program files\Windows Mail
2008-11-09 06:46 --------- d-----w c:\program files\Windows Journal
2008-11-09 06:46 --------- d-----w c:\program files\Windows Collaboration
2008-11-09 06:46 --------- d-----w c:\program files\Windows Calendar
2008-11-09 06:46 --------- d-----w c:\program files\Reference Assemblies
2008-11-09 06:46 --------- d-----w c:\program files\MSBuild
2008-11-09 06:46 --------- d-----w c:\program files\Microsoft Games
2008-11-09 06:46 --------- d-----w c:\program files\Apple Software Update
2008-11-07 22:47 --------- d-----w c:\programdata\Lavasoft
2008-10-16 20:07 --------- d---a-w c:\programdata\TEMP
2008-10-16 19:59 174 --sha-w c:\program files\desktop.ini
2008-10-16 19:27 82,432 ----a-w c:\windows\System32\axaltocm.dll
2008-10-16 19:27 101,888 ----a-w c:\windows\System32\ifxcardm.dll
2008-10-02 03:49 827,392 ----a-w c:\windows\System32\wininet.dll
2008-09-23 16:46 245,408 ----a-w c:\windows\System32\unicows.dll
2008-09-18 05:09 3,601,464 ----a-w c:\windows\System32\ntkrnlpa.exe
2008-09-18 05:09 3,549,240 ----a-w c:\windows\System32\ntoskrnl.exe
2008-05-11 11:19 394 ----a-w c:\users\Caroline\AppData\Roaming\wklnhst.dat
2008-01-02 19:34 490 ----a-w c:\users\Matthew\AppData\Roaming\wklnhst.dat
.
<pre>
----a-w 49,152 2008-02-10 09:57:49 c:\program files\HP\HP Software Update\HPWuSchd2 .exe
</pre>

[mattjampet]

<pre>
----a-w 49,152 2008-02-10 09:57:49 c:\program files\HP\HP Software Update\HPWuSchd2 .exe
</pre>


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"msnmsgr"="c:\program files\MSN Messenger\msnmsgr.exe" [N/A]
"kdx"="c:\program files\Kontiki\KHost.exe" [2008-02-27 1032376]
"Eraser"="c:\program files\Eraser\Eraser.exe" [2007-12-22 916240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-01-13 827392]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2007-04-24 176128]
"NapsterShell"="c:\program files\Napster\napster.exe" [N/A]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-02-13 159744]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2007-03-12 50696]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-03-01 472776]
"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-10 317128]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-09-01 282624]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2006-09-12 229952]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"lxdfmon.exe"="c:\program files\Lexmark 6500 Series\lxdfmon.exe" [2007-06-12 455600]
"lxdfamon"="c:\program files\Lexmark 6500 Series\lxdfamon.exe" [2007-06-01 20480]
"Lexmark 6500 Series Fax Server"="c:\program files\Lexmark 6500 Series\fm3032.exe" [2007-06-12 308144]
"Utility"="c:\program files\SMC\EZ Connect N Draft 11n Wireless USB2.0 Adapter\SMCWUSBS-N.exe" [N/A]
"lxczbmgr.exe"="c:\program files\Lexmark 1200 Series\lxczbmgr.exe" [2007-04-19 74672]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-05-15 8429568]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-05-15 81920]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-11-08 1234712]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2008-10-22 1261200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2006-11-08 44128]

c:\users\Caroline\AppData\Roaming\Microsoft\Window s\Start Menu\Programs\Startup\
LimeWire On Startup.lnk - c:\program files\LimeWire\LimeWire.exe [2008-06-18 147456]
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-27 98632]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
NETGEAR WG111T Smart Wizard.lnk - c:\program files\NETGEAR\WG111T\wlan111t.exe [2008-02-23 884840]
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2008-02-08 394856]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\FirewallRules]
"{2291AE02-FC1C-4BEF-9F03-ED4F1305BBC2}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"{75D9C9A7-9657-4AAF-894C-6CEE616E4234}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{9B244027-920E-4E5F-BE0E-28E13748FF05}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{1FDEC61A-C3B3-45A8-9011-AAF74E9A2DC4}"= c:\program files\HP\QuickPlay\QP.exe:Quick Play
"{FDAF0F54-9494-4AC1-873F-F460B7F3AA11}"= c:\program files\HP\QuickPlay\QPService.exe:Quick Play Resident Program
"{00DC5C89-6C65-4D4A-AE1A-D1B397F42457}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{51932528-6E4A-42EA-B9DC-5BB61AFEDEBF}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"{A18E1F63-A7DA-4F7F-A4C5-EA7E46606222}"= UDP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"{4531B2E0-B867-45F2-B21C-FF74A26DBECC}"= TCP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"TCP Query User{F2DA7FFB-045D-42DB-BACA-57BFC1EECCDB}c:\\program files\\itunes\\itunes.exe"= UDP:c:\program files\itunes\itunes.exe:iTunes
"UDP Query User{7E49E199-CA92-452D-A0F3-4A1487A60B4A}c:\\program files\\itunes\\itunes.exe"= TCP:c:\program files\itunes\itunes.exe:iTunes
"TCP Query User{63FD1F74-7587-4147-9A60-EF1F465DE119}c:\\program files\\limewire\\limewire.exe"= UDP:c:\program files\limewire\limewire.exe:LimeWire
"UDP Query User{049C511B-C95C-401A-B1F8-C2BB457A4C4A}c:\\program files\\limewire\\limewire.exe"= TCP:c:\program files\limewire\limewire.exe:LimeWire
"{112069DA-6D0D-44DB-97A9-254FC6CAFA47}"= UDP:c:\program files\Kontiki\KService.exe:Delivery Manager Service
"{10359129-F549-4345-ADB6-8DC70FF8C025}"= TCP:c:\program files\Kontiki\KService.exe:Delivery Manager Service
"{01EE2F42-BEF7-4A98-ABF0-EB08B08DB21E}"= UDP:c:\program files\Kontiki\KService.exe:Delivery Manager Service
"{E2788B25-4A5F-498F-B80E-23AA4822CF33}"= TCP:c:\program files\Kontiki\KService.exe:Delivery Manager Service
"{0A21304C-C40E-4BE9-9477-597C7A5B7DD1}"= UDP:c:\windows\System32\lxdfcoms.exe:Lexmark Communications System
"{5BCDDA81-221A-48A4-A2F5-FA5A80AE7F99}"= TCP:c:\windows\System32\lxdfcoms.exe:Lexmark Communications System

[mattjampet]

"{9A861FF0-23AC-45C5-862C-51CE94DBBF95}"= UDP:c:\program files\Lexmark 6500 Series\lxdfamon.exe:Lexmark Device Monitor
"{C0C9FC2C-9429-4FD4-87A5-0C0E223835DE}"= TCP:c:\program files\Lexmark 6500 Series\lxdfamon.exe:Lexmark Device Monitor
"{A0B21515-B556-4BDC-B05A-226B802C2ADB}"= UDP:c:\program files\Lexmark 6500 Series\frun.exe:Lexmark Productivity Studio
"{906A2698-D33A-43C5-87FD-D033CCB10603}"= TCP:c:\program files\Lexmark 6500 Series\frun.exe:Lexmark Productivity Studio
"{FC4A9A71-B633-4ACE-BBC8-3FD808B53894}"= UDP:c:\program files\ABBYY FineReader 6.0 Sprint\Scan\ScanMan6.exe:ABBYY FineReader
"{75A70BAA-8384-4FD8-A1C7-EE6E04A56383}"= TCP:c:\program files\ABBYY FineReader 6.0 Sprint\Scan\ScanMan6.exe:ABBYY FineReader
"{586C13A6-EA44-4918-AA9C-1C2B425E2671}"= UDP:c:\program files\Lexmark 6500 Series\LXDFFax.exe:Fax software
"{67446524-1354-4A9D-B3C3-8A7A42C1FFB1}"= TCP:c:\program files\Lexmark 6500 Series\LXDFFax.exe:Fax software
"{FEF4764F-31B9-4ABE-A212-A1CE64611C87}"= UDP:c:\users\Matthew\AppData\Local\Temp\lxdf\wirel ess\ENGLISH\lxdfwpss.exe:
"{DACDAFCC-57B5-4F4A-A37A-E9675B9B5161}"= TCP:c:\users\Matthew\AppData\Local\Temp\lxdf\wirel ess\ENGLISH\lxdfwpss.exe:
"{6730DAF5-2F9C-42C0-A73D-99D4933181F1}"= UDP:c:\program files\Lexmark 6500 Series\Wireless\lxdfwpss.exe:
"{9D5F76C5-5353-4137-BBD3-0BBCED792AA6}"= TCP:c:\program files\Lexmark 6500 Series\Wireless\lxdfwpss.exe:
"{BE006FCC-EE3B-4191-9372-072FE83AE9F3}"= UDP:c:\program files\Lexmark 6500 Series\lxdfmon.exe:Printer Device Monitor
"{3D368C72-4698-47E1-8E7F-F35A711196B3}"= TCP:c:\program files\Lexmark 6500 Series\lxdfmon.exe:Printer Device Monitor
"TCP Query User{3511456D-327C-45A9-8814-99A275173764}c:\\windows\\system32\\spool\\drivers \\w32x86\\3\\lxdfpswx.exe"= UDP:c:\windows\system32\spool\drivers\w32x86\3\lxd fpswx.exe:Printer Status Window Interface
"UDP Query User{47018079-4F9C-4088-9197-A20A47653A0F}c:\\windows\\system32\\spool\\drivers \\w32x86\\3\\lxdfpswx.exe"= TCP:c:\windows\system32\spool\drivers\w32x86\3\lxd fpswx.exe:Printer Status Window Interface
"{C8B6E20F-5209-4E35-B50C-263E404D17A9}"= UDP:c:\windows\System32\lxdfcfg.exe:Printer Communication System
"{1C04448A-99EA-4060-A887-78C1D909289F}"= TCP:c:\windows\System32\lxdfcfg.exe:Printer Communication System
"TCP Query User{0347D57D-615D-425E-89FC-837D165C2157}c:\\program files\\internet explorer\\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{F1BA19C4-0A6C-4038-BEA8-15BAD0F4F40C}c:\\program files\\internet explorer\\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"TCP Query User{8C558912-8163-4BD9-84DE-F692B408D852}c:\\program files\\lexmark 6500 series\\lxdfmon.exe"= UDP:c:\program files\lexmark 6500 series\lxdfmon.exe:Printer Device Monitor
"UDP Query User{386FF4F5-FD55-4B96-AE6C-560B97239D91}c:\\program files\\lexmark 6500 series\\lxdfmon.exe"= TCP:c:\program files\lexmark 6500 series\lxdfmon.exe:Printer Device Monitor
"TCP Query User{59E1B080-DE0D-4401-93A9-3017E3B7A2EC}c:\\program files\\bitlord\\bitlord.exe"= UDP:c:\program files\bitlord\bitlord.exe:BitLord
"UDP Query User{0643FAA7-F0E5-4AFF-A1BB-E079E306301F}c:\\program files\\bitlord\\bitlord.exe"= TCP:c:\program files\bitlord\bitlord.exe:BitLord
"TCP Query User{50EB0AD5-2840-40CB-B414-5E1552FD19A8}c:\\program files\\lexmark 6500 series\\frun.exe"= UDP:c:\program files\lexmark 6500 series\frun.exe:Printing Application
"UDP Query User{EFC846CE-DAE6-413F-9E63-8B0D61B2A6D7}c:\\program files\\lexmark 6500 series\\frun.exe"= TCP:c:\program files\lexmark 6500 series\frun.exe:Printing Application
"{FE75E2DA-31C1-443E-B1E7-EE6D903F9223}"= UDP:c:\program files\Lexmark 6500 Series\app4r.exe:Lexmark Productivity Studio
"{2831F5F5-D70B-4AF9-A15D-455641ED4001}"= TCP:c:\program files\Lexmark 6500 Series\app4r.exe:Lexmark Productivity Studio
"{C7077EBF-D93B-4143-B134-509FEB52FF69}"= UDP:c:\windows\System32\lxczcoms.exe:Lexmark Communications System
"{0A1D686A-345D-467D-B94D-ACD4CC621BD2}"= TCP:c:\windows\System32\lxczcoms.exe:Lexmark Communications System
"{22809828-B80C-40EA-8816-3E39B99A881A}"= UDP:c:\windows\System32\lxczcoms.exe:Lexmark Communications System
"{573474B9-B65B-454A-9600-A4AF32D30833}"= TCP:c:\windows\System32\lxczcoms.exe:Lexmark Communications System
"{1D2558F8-7A41-4540-9271-1714A9E0984A}"= UDP:c:\windows\System32\spool\drivers\w32x86\3\lxc zpswx.exe:Printer Status Window
"{FB67D9F9-46C5-4CF8-8B81-9D27281D6A40}"= TCP:c:\windows\System32\spool\drivers\w32x86\3\lxc zpswx.exe:Printer Status Window
"{2975B9D4-9F88-4D1C-ADA8-E7CE0B41DF02}"= UDP:c:\program files\DNA\btdna.exe:DNA
"{CABA7BB6-3FFD-48EB-B78F-22F4C5A1349F}"= TCP:c:\program files\DNA\btdna.exe:DNA
"{87E8B53A-B4C1-4F2A-9158-DF52E999421B}"= UDP:c:\program files\BitTorrent\bittorrent.exe:BitTorrent
"{0A4CF44F-9447-41AB-BE09-D9F11DBFE43C}"= TCP:c:\program files\BitTorrent\bittorrent.exe:BitTorrent
"{165E3410-9225-4C8F-B5AD-1B07C1D0BD51}"= c:\program files\AVG\AVG8\avgemc.exe:avgemc.exe
"{79D83FCA-640E-409E-9DF9-AE98C6C1B5DB}"= c:\program files\AVG\AVG8\avgupd.exe:avgupd.exe

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\BitTorrent\\bittorrent.exe"= c:\program files\BitTorrent\bittorrent.exe:*:Enabled:BitTorre nt

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-11-08 97928]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-11-08 875288]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-11-08 231704]
R2 lxcz_device;lxcz_device;c:\windows\system32\lxczco ms.exe -service []
R2 lxdf_device;lxdf_device;c:\windows\system32\lxdfco ms.exe -service []
R2 TabletServicePen;TabletServicePen;c:\windows\syste m32\Pen_Tablet.exe [2008-05-01 1373480]
R3 AvgWfpX;AVG Free8 Firewall Driver x86;c:\windows\system32\Drivers\avgwfpx.sys [2008-11-08 69128]
R3 wacommousefilter;Wacom Mouse Filter Driver;c:\windows\system32\DRIVERS\wacommousefilte r.sys [2008-05-01 11312]
R3 wacomvhid;Wacom Virtual Hid Driver;c:\windows\system32\DRIVERS\wacomvhid.sys [2008-05-01 12848]
R3 WacomVKHid;Virtual Keyboard Driver;c:\windows\system32\DRIVERS\WacomVKHid.sys [2008-05-01 11440]
S3 AR5523;NETGEAR WG111T USB2.0 Wireless Card Service;c:\windows\system32\DRIVERS\WG11TND5.sys [2008-02-23 362944]
S3 netr28u;RT2870 USB Wireless LAN Card Driver for Vista;c:\windows\system32\DRIVERS\netr28u.sys [2008-05-02 552448]

[HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{be41e165-a5e1-11dd-a3cf-001b24676f9f}]
\shell\AutoRun\command - f:\wd_windows_tools\Setup.exe

*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
.
Contents of the 'Scheduled Tasks' folder

2008-09-11 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2006-08-29 13:21]

2008-11-19 c:\windows\Tasks\User_Feed_Synchronization-{9B6999FE-FB63-415B-B411-3E9DBD27F3F1}.job
- c:\windows\system32\msfeedssync.exe [2008-01-19 07:33]

2008-11-19 c:\windows\Tasks\User_Feed_Synchronization-{9EFF98C8-BCB9-459D-BA53-12B5A4EE9007}.job
- c:\windows\system32\msfeedssync.exe [2008-01-19 07:33]
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - c:\users\Matthew\AppData\Roaming\Mozilla\Firefox\P rofiles\aoh58a2z.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.thejewellersguild.co.uk
FF -: plugin - c:\program files\DNA\plugins\npbtdna.dll
.

************************************************** ************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-19 20:32:31
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

************************************************** ************************
.
Completion time: 2008-11-19 20:36:00
ComboFix-quarantined-files.txt 2008-11-19 20:35:54

Pre-Run: 48,033,460,224 bytes free
Post-Run: 47,983,132,672 bytes free

236 --- E O F --- 2008-11-01 22:03:27

[mattjampet]

Hi I have tried running these logs above but the browser still isnt working properly.
The google page comes up but it will only show a fake page No.1 and will divert you to the correct page once and then when trying to get there again you will end up with some random crap coming up.
Aside from this the computer is fine from what i gather.
It has never happened on either of my other computers why this one???
I am a computer novice but why do people do these things??? It is incredibly annoying and what benefit is there???
matt

[classicsoftware]

When you ran the MBAM, you did not select the option to fix the problems. You took no action. Please re-run..

[mattjampet]

Thanx Victor Frankl!!! Victor has some good crack and very true aswell. Any ideas what might be causing this incredibly irritating browser business???

[mattjampet]

Malwarebytes' Anti-Malware 1.30
Database version: 1410
Windows 6.0.6001 Service Pack 1

20/11/2008 22:28:08
mbam-log-2008-11-20 (22-28-08).txt

Scan type: Quick Scan
Objects scanned: 49890
Time elapsed: 6 minute(s), 32 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 6
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\Tcpip\Parameters\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.147 85.255.112.166 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\Tcpip\Parameters\Interfaces\{40b93fe1-2e3b-4fec-abf1-446dd4e7d3f8}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.147 85.255.112.166 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\T cpip\Parameters\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.147 85.255.112.166 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\T cpip\Parameters\Interfaces\{40b93fe1-2e3b-4fec-abf1-446dd4e7d3f8}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.147 85.255.112.166 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\T cpip\Parameters\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.147 85.255.112.166 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\T cpip\Parameters\Interfaces\{40b93fe1-2e3b-4fec-abf1-446dd4e7d3f8}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.147 85.255.112.166 -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

[mattjampet]

I hope this is ok I'm not sure if I have done it right. I checked they have been deleted. Please let me know if this is ok and what if anything to do next.

[classicsoftware]

So, how is the system running now????

[mattjampet]

it is still exactly the same the browser still wants to go on a wonder most of the time. Any ideas????

[classicsoftware]

Give me a fresh HJT log....

[mattjampet]

my apologies this last scan seems to have sorted it I hadnt rebooted it until this morning and that has done the trick. Thanks for your help I wouldnt have had a clue how to sort it. I will keep you posted if it reoccurs.

[classicsoftware]

Please post it anyway. It may be suppressed, but not killed.

[mattjampet]

you are right it is back again

[mattjampet]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:34:26, on 27/11/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\WTablet\Pen_TabletUser.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Lexmark 6500 Series\lxdfmon.exe
C:\Program Files\Lexmark 6500 Series\lxdfamon.exe
C:\Program Files\Lexmark 1200 Series\LXCZbmgr.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Kontiki\KHost.exe
C:\Program Files\Lexmark 1200 Series\lxczbmon.exe
C:\Program Files\Eraser\Eraser.exe
C:\Program Files\NETGEAR\WG111T\wlan111t.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\Matthew\Desktop\hjt\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_GB&c=73&bd=Pavilion&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_GB&c=73&bd=Pavilion&pf=laptop
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [NapsterShell] C:\Program Files\Napster\napster.exe /systray
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [lxdfmon.exe] "C:\Program Files\Lexmark 6500 Series\lxdfmon.exe"
O4 - HKLM\..\Run: [lxdfamon] "C:\Program Files\Lexmark 6500 Series\lxdfamon.exe"
O4 - HKLM\..\Run: [Lexmark 6500 Series Fax Server] "C:\Program Files\Lexmark 6500 Series\fm3032.exe" /s
O4 - HKLM\..\Run: [Utility] C:\Program Files\SMC\EZ Connect N Draft 11n Wireless USB2.0 Adapter\SMCWUSBS-N.exe -h
O4 - HKLM\..\Run: [lxczbmgr.exe] "C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe -all
O4 - HKCU\..\Run: [Eraser] C:\Program Files\Eraser\Eraser.exe -hide
O4 - Global Startup: NETGEAR WG111T Smart Wizard.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O13 - Gopher Prefix:
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - [url]http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab[/url]
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - [url]http://downloads.ewido.net/ewidoOnlineScan.cab[/url]
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - [url]http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab[/url]
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe
O23 - Service: EPSON V3 Service4(01) (EPSON_PM_RPCV4_01) - SEIKO EPSON CORPORATION - C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: lxcz_device - - C:\Windows\system32\lxczcoms.exe
O23 - Service: lxdf_device - - C:\Windows\system32\lxdfcoms.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: TabletServicePen - Wacom Technology, Corp. - C:\Windows\system32\Pen_Tablet.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 9476 bytes

[mattjampet]

Hi I was just wondering if someone might be able to help with this bloody browser hijacker thing as it is back again and i have no idea what to do next

[classicsoftware]

I have to take my daughter back to school tomorrow. I'll look at it when I get back. Sorry for the delay.

[mjc]

Either the tools used have not been removing all of it at one shot or somewhere you are regularly visiting is infecting you on every visit.

Post a new log and DO NOT use this machine for anything until it is confirmed clean. That means pull the network cable/wireless card/what ever it takes...download the needed tools on a known clean machine and burn them to a CD (yes, fresh copies of the tools are needed).

[mattjampet]

Hi sorry I havent replied I thought that you had forgotten about me!! you hadnt it just appears im to stupid to realise this goes onto page two!!
I have removed all the programs and have not visited anything but your site.
Before I deleted all the programs I was running Spybot search and destroy. The program found a Zlob dns changer and I havent found this before on any of the other programs. Does this sound like the blighter???