PC is Infected

[eddie57]

can someone please review my HJT Log and see if there is something on my PC that needs to be removed?

Logfile of HijackThis v1.99.1
Scan saved at 7:53:42 PM, on 7/7/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Documents and Settings\Hp 1.8Ghz\winlogon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Hp 1.8Ghz\My Documents\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {40F8F156-13B1-4953-BCD4-D28633943378} - C:\WINDOWS\system32\awtqqqrp.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: (no name) - {85891CF5-118E-44AF-8682-A7B08D33A9E7} - C:\WINDOWS\system32\yayvTlkJ.dll
O2 - BHO: {8bb262fe-5903-8c48-aed4-43892951804e} - {e4081592-9834-4dea-84c8-3095ef262bb8} - C:\WINDOWS\system32\kvlxhw.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Windows Logon Applicationedc] C:\Documents and Settings\Hp 1.8Ghz\winlogon.exe
O4 - HKLM\..\RunOnce: [Spybot - Search & Destroy] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKLM\..\RunOnce: [SpybotDeletingA3997] command /c del "C:\WINDOWS\system32\awtqqqrp.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC7231] cmd /c del "C:\WINDOWS\system32\awtqqqrp.dll_old"
O4 - Global Startup: Microsoft Outlook.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe
O9 - Extra 'Tools' menuitem: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {1EF9F042-C2EB-4293-8213-474CAEEF531D} (TmHcmsX Control) - http://www.trendsecure.com/framework/control/en-US/activex/TmHcmsX.CAB
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} (MUCatalogWebControl Class) - http://test.catalog.update.microsof.../en/x86/MuCatalogWebControl.cab?1186105602187
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1127160897051
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1127160749801
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {C81B5180-AFD1-41A3-97E1-99E8D254DB98} - http://www.commandondemand.com/eval/cod/cabs/cssweb.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Register/Branding/olr3313/OCX/v1018/flashax.cab
O20 - Winlogon Notify: yayvTlkJ - C:\WINDOWS\SYSTEM32\yayvTlkJ.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe

 

[ceewi1]

Your logfile shows a number of infections.

Please visit this webpage for instructions for downloading and running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Post the log from ComboFix when you've accomplished that, along with a new HijackThis log.

 

[Punk]

It seems that you have already posted on another forum.

Please choose between this forum or the other, as taking two sets of instruction might be a problem.

http://www.spywareinfoforum.com/index.php?showtopic=117968

EDIT: alright, CEEWI1 will take care of you

 

[ceewi1]

Thanks Punk, I didn't see that thread. eddie57, as Punk has said, please choose only one forum to assist you and ask the other to close the thread.

 

[cohen]

Also for the eddie57, pls download the new hijackthis V 2.0.2

 

[eddie57]

Sorry about the double posting but never got anyone to reply to my post at the site where I had first posted the HJT Log. I thought I would try another site. I also cannot not open many websites and my microsoft updates is disabled and I cannot enabled it. Thanks again.

 

[cohen]

Sorry about the double posting but never got anyone to reply to my post at the site where I had first posted the HJT Log. I thought I would try another site. I also cannot not open many websites and my microsoft updates is disabled and I cannot enabled it. Thanks again.

well do the instructions above and we can help you.

 

[eddie57]

No Windows CD

I do not have the original windows CD so I think I have to reinstall windows from a new CD. My question is can I backup the working files from the infected PC and then save them to the PC after reinstalling Windows without any problems? thanks in advance

 

[cohen]

I do not have the original windows CD so I think I have to reinstall windows from a new CD. My question is can I backup the working files from the infected PC and then save them to the PC after reinstalling Windows without any problems? thanks in advance

as long as those files are not infected then yes you can.

 

[eddie57]

Files

Would scanning the Files for viruses and spyware before saving them to the PC be sufficient?

 

[cohen]

Would scanning the Files for viruses and spyware before saving them to the PC be sufficient?

Yes,

What virus protection do you have?

 

[eddie57]

Virus Protection

I use AVG, Ad Aware, spybot, spywareblaster and AVG antispyware. My pc got infected I believe with some stuff I downloaded from Limewire. It was a zip file. I have backed up all my data to a DVD. I will scan it for viruses and spyware before I save it to my PC after the reinstall of windows. Thanks

 

[cohen]

I use AVG, Ad Aware, spybot, spywareblaster and AVG antispyware. My pc got infected I believe with some stuff I downloaded from Limewire. It was a zip file. I have backed up all my data to a DVD. I will scan it for viruses and spyware before I save it to my PC after the reinstall of windows. Thanks

No problems, all i can say is don't download zip files from those sources they always lead to viruses.

Good Luck.

 

[G25r8cer]

Limewire is full of crap. Dont trust anything on there.