Spywar.ISpynow

This is common so u should be good at it. I keep on getting a window saying that Spywar.ISpynow has infected my computer so i came here.

My HJT :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:04:04 PM, on 12/3/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16757)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Zune\ZuneLauncher.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
C:\Program Files\Search Settings\SearchSettings.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Users\Chris\AppData\Roaming\Google\wincore.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Alwil Software\Avast4\ashSimpl.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb127\SearchSettings.dll
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb127\SearchSettings.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Zune Launcher] "c:\Program Files\Zune\ZuneLauncher.exe"
O4 - HKLM\..\Run: [USBToolTip] "C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe"
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\Windows\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [USB2Check] RUNDLL32.EXE "C:\Windows\system32\PCLECoInst.dll",CheckUSBController
O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\Search Settings\SearchSettings.exe
O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [HPAdvisor] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\Chris\AppData\Local\Temp\mlJCRlkI.dll,#1
O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\Chris\AppData\Local\Temp\khfGwTLf.dll,c
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [winhpdrv] "C:\Users\Chris\AppData\Roaming\Google\wincore.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: DesktopVideoPlayer.LNK = C:\Program Files\vghd\vghd.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll/206 (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - Unknown owner - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe (file missing)
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

Hello.
I notice that you have Spybot's TeaTimer running. While this is normally a wonderful tool to protect against hijackers, it can also interfere with HijackThis fixes. So please disable TeaTimer by doing the following:
1) Run Spybot-S&D
2) Go to the Mode menu, and make sure "Advanced Mode" is selected
3) On the left hand side, choose Tools -> Resident
4) Uncheck "Resident TeaTimer" and OK any prompts
You can reenable TeaTimer once your system is clean.

Please make sure Teatimer is disable before we do this, otherwise this fix will fail.

• Download combofix from here, use the top links - combofix.exe
  
• Double click on ComboFix.exe.
  
• Follow the prompts. NOTE:
  
• ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
  ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***
  
  **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will automatically proceed with its scan.
  
  
  
• The Recovery Console provides a recovery/repair mode should a problem occur during a Combofix run.
  
  
  
  
• Allow ComboFix to download the Recovery Console.
  
• Accept the End-User License Agreement.
  
• The Recovery Console will be installed.
  
• You will this next prompt that asks if you want to continue the malware scan, select yes
  
  
  
  
• Allow combofix to run
  
• Post C:\combofix.txt back here.
  
  Note:
  Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
  

okay here is the combofix log:

ComboFix 08-12-04.02 - Chris 2008-12-04 15:20:20.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1033.18.288 [GMT -5:00]
Running from: c:\users\Chris\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\AntiSpywareMaster
c:\program files\ShoppingReport

.
((((((((((((((((((((((((( Files Created from 2008-11-04 to 2008-12-04 )))))))))))))))))))))))))))))))
.

2008-12-03 23:15 . 2008-12-04 06:32
d-------- c:\users\Chris\AppData\Roaming\uTorrent
2008-12-03 23:15 . 2008-12-03 23:15
d-------- c:\program files\uTorrent
2008-12-03 22:59 . 2008-12-03 22:59
d-------- c:\program files\Trend Micro
2008-12-03 20:53 . 2008-12-03 20:53
d-------- c:\program files\Alwil Software
2008-12-03 20:53 . 2008-11-26 12:17 51,792 --a------ c:\windows\System32\drivers\aswMonFlt.sys
2008-12-02 13:53 . 2008-12-03 18:10
dr------- c:\users\Chris\AppData\Roaming\Brother
2008-11-21 22:30 . 2008-11-21 22:30
d-------- C:\Kevin Rudolf & Lil Wayne - Let It Rock mp3-2008
2008-11-18 22:07 . 2008-11-18 22:07
d-------- c:\users\All Users\FLEXnet
2008-11-18 22:07 . 2008-11-18 22:07
d-------- c:\programdata\FLEXnet
2008-11-18 22:06 . 2008-11-18 22:06
d-------- c:\program files\Common Files\Macrovision Shared
2008-11-18 22:04 . 2008-11-18 23:06
d-------- c:\users\All Users\Rosetta Stone
2008-11-18 22:04 . 2008-11-18 23:06
d-------- c:\programdata\Rosetta Stone
2008-11-18 22:04 . 2008-11-18 22:04
d-------- c:\program files\Rosetta Stone
2008-11-16 21:10 . 2008-10-16 16:13 1,809,944 --a------ c:\windows\System32\wuaueng.dll
2008-11-16 21:10 . 2008-10-16 15:56 1,524,736 --a------ c:\windows\System32\wucltux.dll
2008-11-16 21:10 . 2008-10-16 16:09 51,224 --a------ c:\windows\System32\wuauclt.exe
2008-11-16 21:10 . 2008-10-16 16:09 43,544 --a------ c:\windows\System32\wups2.dll
2008-11-16 21:09 . 2008-10-16 16:12 561,688 --a------ c:\windows\System32\wuapi.dll
2008-11-16 21:09 . 2008-10-16 14:08 162,064 --a------ c:\windows\System32\wuwebv.dll
2008-11-16 21:09 . 2008-10-16 15:55 83,456 --a------ c:\windows\System32\wudriver.dll
2008-11-16 21:09 . 2008-10-16 16:08 34,328 --a------ c:\windows\System32\wups.dll
2008-11-16 21:09 . 2008-10-16 13:56 31,232 --a------ c:\windows\System32\wuapp.exe
2008-11-11 20:00 . 2008-08-25 20:11 211,456 --a------ c:\windows\System32\drivers\mrxsmb10.sys
2008-11-11 19:59 . 2008-09-09 22:25 1,341,440 --a------ c:\windows\System32\msxml6.dll
2008-11-11 19:59 . 2008-09-04 23:48 1,194,496 --a------ c:\windows\System32\msxml3.dll
2008-11-11 19:59 . 2008-09-09 22:21 2,048 --a------ c:\windows\System32\msxml6r.dll
2008-11-11 19:59 . 2008-09-04 23:45 2,048 --a------ c:\windows\System32\msxml3r.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-04 04:16 --------- d-----w c:\program files\BitComet
2008-12-04 03:31 48,271 ----a-w c:\users\Chris\AppData\Roaming\nvModes.dat
2008-12-03 23:10 --------- d-----w c:\users\Chris\AppData\Roaming\DivX
2008-12-03 23:10 --------- d-----w c:\users\Chris\AppData\Roaming\DAEMON Tools
2008-12-03 23:10 --------- d-----w c:\users\Chris\AppData\Roaming\CyberLink
2008-12-03 23:10 --------- d-----w c:\users\Chris\AppData\Roaming\AVSMedia
2008-11-01 04:36 --------- d-----w c:\users\Chris\AppData\Roaming\Ventrilo
2008-11-01 04:32 --------- d-----w c:\program files\Ventrilo
2008-11-01 04:31 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2008-10-25 01:13 --------- d-----w c:\program files\Brother
2008-10-25 01:09 --------- d--h--w c:\program files\InstallShield Installation Information
2008-10-25 01:06 --------- d-----w c:\users\Chris\AppData\Roaming\InstallShield
2008-10-22 20:21 21,248 ----a-w c:\windows\Help\OEM\scripts\HPScript.exe
2008-10-22 20:05 --------- d-----w c:\program files\Hewlett-Packard
2008-10-22 19:54 --------- d-----w c:\programdata\RapidSolution
2008-10-21 19:33 0 ---ha-w c:\windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2008-10-21 19:33 --------- d-----w c:\programdata\Brother
2008-10-15 20:09 --------- d-----w c:\program files\World of Warcraft
2008-10-15 03:03 152,904 ----a-w c:\windows\System32\vghd.scr
2008-10-15 00:46 --------- d-----w c:\programdata\Pure Networks
2008-10-14 19:37 --------- d-----w c:\programdata\Blizzard
2008-10-14 02:38 410 ----a-w c:\users\Chris\AppData\Roaming\wklnhst.dat
2008-10-06 15:51 20,224 ----a-w c:\windows\Help\OEM\scripts\HC_checkMUI.dll
2008-10-02 03:49 826,368 ----a-w c:\windows\System32\wininet.dll
2008-10-02 03:49 56,320 ----a-w c:\windows\System32\iesetup.dll
2008-10-02 03:49 52,736 ----a-w c:\windows\AppPatch\iebrshim.dll
2008-10-02 03:48 26,624 ----a-w c:\windows\System32\ieUnatt.exe
2008-09-30 21:43 1,286,152 ----a-w c:\windows\System32\msxml4.dll
2008-09-18 04:35 3,505,208 ----a-w c:\windows\System32\ntkrnlpa.exe
2008-09-18 04:35 3,470,904 ----a-w c:\windows\System32\ntoskrnl.exe
2008-09-18 02:03 2,027,520 ----a-w c:\windows\System32\win32k.sys
2008-09-12 22:48 245,664 ----a-w c:\windows\System32\ZuneWlanCfgSvc.exe
2008-09-12 22:32 73,216 ----a-w c:\windows\System32\ZuneUsbTransport.dll
2008-09-12 22:32 57,344 ----a-w c:\windows\System32\ZuneRegUtil.dll
2008-09-12 22:32 310,272 ----a-w c:\windows\System32\ZuneNetProxy.dll
2008-09-12 22:32 18,944 ----a-w c:\windows\System32\ZuneTcp2Udp.dll
2008-09-12 22:32 145,920 ----a-w c:\windows\System32\ZuneMTPZ.dll
2008-09-12 22:32 12,800 ----a-w c:\windows\System32\ZunePTDNS.dll
2008-07-10 12:32 174 --sha-w c:\program files\desktop.ini
2008-06-06 02:36 2,725,048 ----a-w c:\program files\FLV PlayerFCSetup.exe
2008-06-06 02:33 411,248 ----a-w c:\program files\FLV PlayerRCSetup.exe
2002-07-26 21:02 153,088 ----a-w c:\program files\UNWISE.EXE
2008-04-19 03:00 16,384 --sha-w c:\windows\ServiceProfiles\NetworkService\AppData\Local\Temp\Cookies\index.dat
2008-04-19 03:00 16,384 --sha-w c:\windows\ServiceProfiles\NetworkService\AppData\Local\Temp\History\History.IE5\index.dat
2008-04-19 03:00 32,768 --sha-w c:\windows\ServiceProfiles\NetworkService\AppData\Local\Temp\Temporary Internet Files\Content.IE5\index.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-08 1232896]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-04-19 484904]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2006-11-02 125440]
"Yahoo! Pager"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 4670704]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 201728]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 2097488]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-08-08 490952]
"winhpdrv"="c:\users\Chris\AppData\Roaming\Google\wincore.exe" [2008-12-03 125440]
"WindowsWelcomeCenter"="oobefldr.dll" [2006-11-02 c:\windows\System32\oobefldr.dll]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-01-12 827392]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-02-13 159744]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2007-03-12 50696]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-07-08 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-07-08 8433664]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-07-08 81920]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-03-01 472776]
"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-10 317128]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-17 49152]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784]
"Zune Launcher"="c:\program files\Zune\ZuneLauncher.exe" [2008-09-12 160160]
"USBToolTip"="c:\program files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe" [2004-04-23 192512]
"PinnacleDriverCheck"="c:\windows\system32\PSDrvCheck.exe" [2004-03-10 406016]
"USB2Check"="c:\windows\system32\PCLECoInst.dll" [2006-11-06 81920]
"SearchSettings"="c:\program files\Search Settings\SearchSettings.exe" [2008-04-16 985440]
"BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2007-03-23 663552]
"ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2007-01-26 65536]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2006-11-07 44128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.I420"= emYUV.dll
"VIDC.MJPG"= Pvmjpg21.dll
"VIDC.PIM1"= pclepim1.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{3FB1FA38-88A1-41BD-A613-34B27BA2F67B}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{58EFD2FA-676C-4300-9CD9-6F0B7D6DD6DD}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{A9CDCA96-DB47-4AD5-BB4B-967DCB4EA8BE}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{2AC42B38-5369-45F4-B70E-6850DE31C68B}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{D0611259-2A55-4055-9213-09895B0E1A72}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{A2469DF8-AE24-45FA-9639-30697A747D16}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{E6A178EB-5789-4B0A-8692-FE3E7AFF2CBA}"= UDP:c:\program files\earthlink
totalaccess\TaskPanl.exe:taskpanl
"{C2708D1C-8E3F-4AC6-AB67-9CB79F39E144}"= TCP:c:\program files\earthlink 6

totalaccess\TaskPanl.exe:taskpanl
"{52503558-03D7-40C8-8725-D7BD50CF1F39}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{2FA26A80-8F8A-4C01-9FCF-5AF54E02F09E}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{CA0C7E82-E7BE-4031-A508-482A9A646966}"= UDP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{F5182FE5-6BCC-446F-8B60-9CAC5910B50E}"= TCP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"TCP Query User{7C16BAA7-457B-4F1D-B5CA-C7A1472588BE}c:\\program files\\veoh networks\\veoh\\veohclient.exe"= UDP:c:\program files\veoh networks\veoh\veohclient.exe:Veoh Client
"UDP Query User{C32D9610-D0AC-4940-BAD3-15A641693439}c:\\program files\\veoh networks\\veoh\\veohclient.exe"= TCP:c:\program files\veoh networks\veoh\veohclient.exe:Veoh Client
"TCP Query User{BE7FCB02-675E-4ECC-8FCD-66DACFF2DA95}c:\\program files\\bitcomet\\bitcomet.exe"= UDP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
"UDP Query User{8FBD790A-47B6-4E49-AC73-ADBFB002E3A0}c:\\program files\\bitcomet\\bitcomet.exe"= TCP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
"{9D81F669-09E7-4B51-AFD8-164E307214FB}"= UDP:3724:Blizzard Downloader
"{129CA917-E36F-4ED6-8EA7-77DED96B5ABF}"= Disabled:UDP:c:\program files\FrostWire\FrostWire.exe:LimeWire
"{D6BC5CD0-253F-48D8-BBD1-BF3EA0BBFD20}"= Disabled:TCP:c:\program files\FrostWire\FrostWire.exe:LimeWire
"TCP Query User{59934768-D80D-4248-9ADC-3D11D130A1C8}c:\\program files\\bitcomet\\bitcomet.exe"= UDP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
"UDP Query User{C9DE301E-A838-428C-B278-C092C3AB00A0}c:\\program files\\bitcomet\\bitcomet.exe"= TCP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
"{124C57A8-4BBD-4C0F-8BA6-984AAE9E5314}"= UDP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{2E6E9A43-E7D4-42B3-82FA-C2CE53CA6C1B}"= TCP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{D285F858-D93C-49A5-9D7B-E82D562BA9CB}"= UDP:c:\program files\AIM6\aim6.exe:AIM
"{184699E5-686E-460F-8C2F-4C6E781A8FDD}"= TCP:c:\program files\AIM6\aim6.exe:AIM
"{6E11CB76-6F0E-4117-B1F8-EC65E0113179}"= UDP:14120:BitComet 14120 TCP
"{A4E26752-71DB-4AE0-8027-6BF486F88D1F}"= TCP:14120:BitComet 14120 UDP
"TCP Query User{48C2CC11-C433-4230-8E2B-AC7A5AD76B36}c:\\program files\\aim6\\aim6.exe"= UDP:c:\program files\aim6\aim6.exe:AIM
"UDP Query User{60D346BC-F50F-4889-B564-AA1E4E2AA73A}c:\\program files\\aim6\\aim6.exe"= TCP:c:\program files\aim6\aim6.exe:AIM
"TCP Query User{645F35B0-D060-43D3-A4DD-99D2A4C9A080}c:\\users\\chris\\desktop\\wow-2.4.2.8278-to-0.4.3.8478-enus-downloader.exe"= UDP:c:\users\chris\desktop\wow-2.4.2.8278-to-0.4.3.8478-enus-downloader.exe:wow-2.4.2.8278-to-0.4.3.8478-enus-downloader.exe
"UDP Query User{22CFD0FA-CCFB-4FEE-A6BC-20F31F110C8E}c:\\users\\chris\\desktop\\wow-2.4.2.8278-to-0.4.3.8478-enus-downloader.exe"= TCP:c:\users\chris\desktop\wow-2.4.2.8278-to-0.4.3.8478-enus-downloader.exe:wow-2.4.2.8278-to-0.4.3.8478-enus-downloader.exe
"TCP Query User{97B3A0E9-AD6C-4D1F-A745-1142FD8A39A4}c:\\program files\\windows sidebar\\sidebar.exe"= UDP:c:\program files\windows sidebar\sidebar.exe:Windows Sidebar
"UDP Query User{5571CCD9-6F83-434D-A397-A4C80E0D4FD7}c:\\program files\\windows sidebar\\sidebar.exe"= TCP:c:\program files\windows sidebar\sidebar.exe:Windows Sidebar
"{4B7758BB-34A3-4506-B044-AEFB01813376}"= UDP:c:\programdata\NexonUS\NGM\NGM.exe:Nexon Game Manager
"{BDAD8414-C5EC-49EF-B302-FCFC3C7D9043}"= TCP:c:\programdata\NexonUS\NGM\NGM.exe:Nexon Game Manager
"{5EC69B09-5DAD-4C6F-93E5-E2C8CAE69CF3}"= UDP:c:\nexon\Combat Arms\NMService.exe:Nexon Messenger Core
"{4FB604E4-C62C-4D78-B142-EEE3DAA1E312}"= TCP:c:\nexon\Combat Arms\NMService.exe:Nexon Messenger Core
"TCP Query User{2AB3D4BD-E0C8-4C5C-80E6-7A668184BD32}c:\\program files\\world of warcraft\\backgrounddownloader.exe"= UDP:c:\program files\world of warcraft\backgrounddownloader.exe:Blizzard Downloader
"UDP Query User{DDB99222-3551-494F-BB1C-167D93EF64D1}c:\\program files\\world of warcraft\\backgrounddownloader.exe"= TCP:c:\program files\world of warcraft\backgrounddownloader.exe:Blizzard Downloader
"{061B7E54-FFD8-4C36-BBD8-F3362DBE6B77}"= UDP:3724:first
"{C56EEBE4-3495-44DC-9B46-6ED15CA11D10}"= UDP:6112:second
"{03C9464C-3D41-49D4-AFF6-82569A8CB6D7}"= c:\program files\Rosetta Stone\Rosetta Stone V3\RosettaStoneVersion3.exe:Rosetta Stone V3 Application
"{6AAC1D98-D7CB-49B2-9B99-B8C2279A1BF3}"= c:\program files\Rosetta Stone\Rosetta Stone V3\support\bin\win\RosettaStoneLtdServices.exe:Rosetta Stone Ltd Services
"{877AB94C-7014-4133-8B99-9E75A8EAEC86}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In)
"{30C4219D-23EE-4884-A911-E470EB7402E7}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\EarthLink TotalAccess\\TaskPanl.exe"= c:\program files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink
"c:\\Nexon\\Combat Arms\\CombatArms.exe"= c:\nexon\Combat Arms\CombatArms.exe:*Enabled:CombatArms.exe
"c:\\Nexon\\Combat Arms\\Engine.exe"= c:\nexon\Combat Arms\Engine.exe:*Enabled:Engine.exe

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-12-03 111184]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-12-03 20560]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\DRIVERS\aswMonFlt.sys [2008-12-03 51792]
R2 Viewpoint Manager Service;Viewpoint Manager Service;"c:\program files\Viewpoint\Common\ViewpointService.exe" [2008-06-22 24652]
R3 nskbfltr;nskbfltr;\??\c:\windows\system32\drivers\nskbfltr.sys [2008-01-10 20512]
S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;"c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE" [2008-07-10 47128]
S4 RsFx0102;RsFx0102 Driver;c:\windows\system32\DRIVERS\RsFx0102.sys [2008-07-10 242712]
S4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);"c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE" -i SQLEXPRESS [2008-07-10 369688]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0ea2ecee-1f27-11dd-a7be-001b24af5811}]
\shell\AutoRun\command - G:\LaunchU3.exe -a

*Newly Created Service* - ASWFSBLK
*Newly Created Service* - ASWMONFLT
*Newly Created Service* - ASWRDR
*Newly Created Service* - ASWSP
*Newly Created Service* - ASWTDI
*Newly Created Service* - PROCEXP90

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{B2C3BB6B-E005-4246-B8E5-DF0A4D073CDC}]
c:\program files\PixiePack Codec Pack\InstallerHelper.exe
.
Contents of the 'Scheduled Tasks' folder

2008-12-04 c:\windows\Tasks\User_Feed_Synchronization-{7E453D37-FA55-42B3-A504-FE9F17505948}.job
- c:\windows\system32\msfeedssync.exe [2006-11-02 04:45]
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-HPAdvisor - c:\program files\Hewlett-Packard\HP Advisor\HPAdvisor.exe
HKCU-Run-Aim6 - c:\program files\AIM6\aim6.exe
HKCU-Run-Veoh - c:\program files\Veoh Networks\Veoh\VeohClient.exe


.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
mStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
IE: &AIM Search
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
FireFox -: Profile - c:\users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\5my0zyjt.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://search.aol.com/aolcom/search?invocationType=tbff50ie7&query=
FireFox -: prefs.js - STARTUP.HOMEPAGE - www.charter.net
FF -: plugin - c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF -: plugin - c:\program files\Real\RhapsodyPlayerEngine\nprhapengine.dll
FF -: plugin - c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
FF -: plugin - c:\program files\Yahoo!\Shared\npYState.dll
FF -: plugin - c:\programdata\NexonUS\NGM\npNxGameUS.dll
FF -: plugin - c:\users\Chris\AppData\Roaming\Mozilla\plugins\npssn.dll
FF -: plugin - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-04 15:26:50
Windows 6.0.6000 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'Explorer.exe'(5472)
c:\users\Chris\AppData\Roaming\Google\fwlmsk.dll
.
Completion time: 2008-12-04 15:30:20
ComboFix-quarantined-files.txt 2008-12-04 20:30:09

Pre-Run: 61,466,095,616 bytes free
Post-Run: 61,658,861,568 bytes free

257 --- E O F --- 2008-12-04 19:54:4

Just a leftover to get.

Now open a new notepad file.
Input this into the notepad file:

File::
c:\users\Chris\AppData\Roaming\Google\wincore.exe

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"winhpdrv"=-

Save this as CFScript.txt, save it to your desktop also.
Then drag and drop CFScript.txt into combofix as seen below:


This will open combofix.exe again, agree to it's terms and allow it to run, it may want to reboot after it's done. Post the resulting log back here.

the log was this

SUMMARY: 0 of 0 files are OK (=-1.$%). Average FirstError (of defect files) is @0 (=0.0s)
SUMMARY: 0 of 0 files are OK (=-1.$%). Average FirstError (of defect files) is @0 (=0.0s)
SUMMARY: 0 of 0 files are OK (=-1.$%). Average FirstError (of defect files) is @0 (=0.0s)
SUMMARY: 0 of 0 files are OK (=-1.$%). Average FirstError (of defect files) is @0 (=0.0s)
SUMMARY: 0 of 0 files are OK (=-1.$%). Average FirstError (of defect files) is @0 (=0.0s)

Something went wrong.

• Now open a new notepad file.
  
• Input this into the notepad file:
  

  
  Windows Registry Editor Version 5.00
  
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "winhpdrv"=-
  
  

  
  
• Save this as fix.reg, save it to your desktop.
  
• Double click fix.reg to run it.
  
• Select yes to the registry merge prompt.
  

Delete this file:
c:\users\Chris\AppData\Roaming\Google\wincore.exe

Due to lack of feedback, this topic is closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter.