[Resolved] out of ideas & really bogged down computer

Home Forums Contact

Welcome! Register for a free account (or login) > How does it work?

Quickly register. It will only take 60 seconds.
Start a new topic. Ask your question. Wait for an email reply.
Is your system infected? Begin reading the malware removal guide.

register button

What the Tech > Spyware / Malware / Virus Removal > Infections Removal

2 Pages

1 2 >

Closed Topic

Start new topic

[Resolved] out of ideas & really bogged down computer, combo fix og posting

ma3572 View Member Profile	Jan 24 2009, 03:00 PM Post #1
Authentic Member Group: Authentic Member Posts: 66 Joined: 21-March 06 Member No.: 52,152 Operating System: xp	My thread topic was closed due to inactivity caused by my travelling. I am now back and posting a combo fix log as requested by Rorschach112. ComboFix 09-01-21.04 - Owner 2009-01-24 15:16:56.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.510.236 [GMT -5:00] Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe AV: Symantec AntiVirus Corporate Edition On-access scanning disabled (Updated) * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\All Users\Application Data\Microsoft\Internet Explorer\DLLs\c.cgm c:\documents and settings\Owner\Local Settings\Temporary Internet Files\fbk.sts c:\program files\GamesBar\oberontb.dll c:\windows\system32\404Fix.exe c:\windows\system32\Agent.OMZ.Fix.exe c:\windows\system32\cpjsehhp.ini c:\windows\system32\dumphive.exe c:\windows\system32\IEDFix.C.exe c:\windows\system32\IEDFix.exe c:\windows\system32\o4Patch.exe c:\windows\system32\Process.exe c:\windows\system32\roemvjlm.ini c:\windows\system32\SrchSTS.exe c:\windows\system32\tmp.reg c:\windows\system32\VACFix.exe c:\windows\system32\VCCLSID.exe c:\windows\system32\WS2Fix.exe c:\windows\wiaserviv.log . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_TDSSSERV.SYS -------\Service_TDSSserv.sys ((((((((((((((((((((((((( Files Created from 2008-12-24 to 2009-01-24 ))))))))))))))))))))))))))))))) . 2009-01-14 10:41 . 2009-01-14 10:41 <DIR> d-------- c:\documents and settings\Owner\Application Data\CyberLink 2009-01-13 17:37 . 2009-01-13 19:55 <DIR> d-------- C:\SDFix 2009-01-11 18:16 . 2009-01-11 18:16 <DIR> d-------- c:\program files\Trend Micro 2009-01-11 16:27 . 2009-01-11 16:27 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware 2009-01-11 16:27 . 2009-01-04 18:39 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys 2009-01-11 16:27 . 2009-01-04 18:39 15,504 --a------ c:\windows\system32\drivers\mbam.sys 2009-01-11 11:30 . 2009-01-11 11:30 <DIR> d-------- c:\windows\system32\config\systemprofile\Application Data\GetModule 2009-01-10 13:02 . 2002-03-18 06:00 147,512 --a------ c:\windows\system32\hpzlnt05.dll 2009-01-09 18:52 . 2009-01-09 18:52 <DIR> d-------- c:\program files\Hp 2009-01-09 18:22 . 2008-10-16 15:38 6,066,176 -----c--- c:\windows\system32\dllcache\ieframe.dll 2009-01-09 18:22 . 2007-04-17 04:32 2,455,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dat 2009-01-09 18:22 . 2007-03-08 00:10 991,232 -----c--- c:\windows\system32\dllcache\ieframe.dll.mui 2009-01-09 18:22 . 2008-10-16 15:38 459,264 -----c--- c:\windows\system32\dllcache\msfeeds.dll 2009-01-09 18:22 . 2008-10-16 15:38 383,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dll 2009-01-09 18:22 . 2008-10-16 15:38 267,776 -----c--- c:\windows\system32\dllcache\iertutil.dll 2009-01-09 18:22 . 2008-10-16 15:38 63,488 -----c--- c:\windows\system32\dllcache\icardie.dll 2009-01-09 18:22 . 2008-10-16 15:38 52,224 -----c--- c:\windows\system32\dllcache\msfeedsbs.dll 2009-01-09 18:22 . 2008-10-16 08:11 13,824 -----c--- c:\windows\system32\dllcache\ieudinit.exe 2009-01-09 17:18 . 2009-01-09 17:18 0 --a------ c:\windows\vpc32.INI 2009-01-09 17:04 . 2009-01-24 14:58 <DIR> d-------- c:\program files\Symantec AntiVirus 2009-01-09 09:48 . 2009-01-09 09:48 <DIR> d-------- c:\documents and settings\Owner\Application Data\Malwarebytes 2009-01-08 20:23 . 2009-01-08 20:23 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Malwarebytes 2009-01-08 20:22 . 2009-01-08 20:22 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes 2009-01-08 19:03 . 2009-01-08 19:03 <DIR> d-------- c:\windows\ERUNT 2009-01-08 18:11 . 2009-01-08 18:11 1,529,241 --a------ c:\program files\SDFix.exe 2009-01-08 17:47 . 2009-01-11 17:08 <DIR> d-------- c:\program files\SmitfraudFix 2009-01-08 16:56 . 2009-01-08 16:57 2,697,344 --a------ c:\program files\mbam-setup.exe 2009-01-07 09:40 . 2009-01-07 09:40 43,008 --a------ c:\windows\system32\aj32.dll 2009-01-07 09:40 . 2009-01-07 09:40 1,264 --a------ c:\windows\system32\lp 2009-01-06 17:45 . 2009-01-11 17:52 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Yahoo! 2009-01-06 17:35 . 2009-01-06 17:35 <DIR> d-------- c:\documents and settings\Administrator 2009-01-05 08:12 . 2009-01-05 08:12 <DIR> d-------- c:\windows\qozw 2009-01-05 08:12 . 2009-01-07 18:06 <DIR> d-------- c:\program files\Common Files\qozw 2009-01-04 22:54 . 2009-01-09 09:40 <DIR> d-------- c:\documents and settings\Owner\Application Data\Twain 2009-01-04 15:43 . 2009-01-09 19:51 <DIR> d-------- c:\program files\Auslogics 2009-01-04 15:43 . 2009-01-09 19:52 <DIR> d-------- c:\documents and settings\Owner\Application Data\Auslogics 2009-01-04 15:42 . 2009-01-04 15:42 1,651,248 --a------ c:\program files\disk-defrag-setup.exe 2009-01-04 15:32 . 2009-01-04 15:32 <DIR> d-------- c:\documents and settings\Owner\Application Data\GlarySoft 2009-01-04 15:17 . 2009-01-06 08:06 <DIR> d-------- c:\program files\AskBarDis 2009-01-04 15:16 . 2009-01-04 15:25 <DIR> d-------- c:\program files\Glary Utilities 2009-01-04 15:15 . 2009-01-04 15:15 5,632,896 --a------ c:\program files\gusetupnew.exe 2009-01-04 15:09 . 2009-01-04 15:09 50,688 --a------ c:\program files\ATF-Cleaner.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-01-24 20:17 --------- d-----w c:\program files\GamesBar 2009-01-24 19:56 --------- d-----w c:\program files\Symantec 2009-01-24 19:56 --------- d-----w c:\program files\Common Files\Symantec Shared 2009-01-24 19:56 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec 2009-01-11 11:15 6,656 ----a-w c:\windows\system32\drivers\aeaudio.sys 2009-01-10 18:15 --------- d-----w c:\program files\Google 2009-01-10 18:03 --------- d-----w c:\program files\hp deskjet 5550 series 2009-01-09 15:19 --------- d-----w c:\documents and settings\Owner\Application Data\Intuit 2009-01-07 23:30 --------- d-----w c:\program files\Viewpoint 2009-01-07 23:30 --------- d-----w c:\documents and settings\All Users\Application Data\Viewpoint 2009-01-06 21:40 --------- d-----w c:\program files\Verizon Online 2009-01-06 21:37 --------- d--h--w c:\program files\InstallShield Installation Information 2009-01-06 21:37 --------- d-----w c:\program files\Infogrames Interactive 2009-01-06 21:35 --------- d-----w c:\program files\Common Files\Oberon Media 2009-01-04 12:24 --------- d-----w c:\documents and settings\All Users\Application Data\GamesBar 2008-12-08 19:20 63,488 ----a-w c:\windows\xobglu16.dll 2008-12-08 19:20 23,552 ----a-w c:\windows\xobglu32.dll 2008-12-08 16:32 --------- d-----w c:\program files\Picasa2 2008-04-01 18:13 69,400 ----a-w c:\documents and settings\Owner\Application Data\GDIPFONTCACHEV1.DAT 2006-07-04 21:24 774,144 ----a-w c:\program files\RngInterstitial.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-07-17 279944] [HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}] [HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-07-17 279944] [HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}] [HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] "Yahoo! Pager"="c:\progra~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" [2006-10-30 4662776] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ymetray"="c:\program files\Yahoo!\Yahoo! Music Engine\ymetray.exe" [2006-10-03 54776] "YOP"="c:\progra~1\Yahoo!\YOP\yop.exe" [2005-06-16 401408] "Motive SmartBridge"="c:\progra~1\Verizon\SMARTB~1\MotiveSB.exe" [2006-06-23 438359] "YBrowser"="c:\progra~1\Yahoo!\browser\ybrwicon.exe" [2006-07-21 129536] "Verizon_McciTrayApp"="c:\program files\Verizon\McciTrayApp.exe" [2007-03-11 936960] "HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb05.exe" [2002-03-18 188416] c:\documents and settings\Owner\Start Menu\Programs\Startup\ HotSync Manager.lnk - c:\program files\Palm\HOTSYNC.EXE [2003-09-25 299008] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Dataviz Messenger.lnk - c:\windows\DvzCommon\DvzMsgr.exe [2003-07-01 24576] Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=fjhjek.dll lzpsfe.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Windows.hta] backup=c:\windows\pss\Microsoft Windows.htaCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ymetray.lnk] backup=c:\windows\pss\ymetray.lnkCommon Startup HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdaptecDirectCD] --a------ 2004-12-19 10:58 684032 c:\program files\Roxio\Easy CD Creator 5\DirectCD\Directcd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader] --a------ 2005-06-06 23:46 57344 c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds] --a------ 2005-10-19 07:59 126976 c:\windows\system32\hkcmd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray] --a------ 2005-10-19 07:59 155648 c:\windows\system32\igfxtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Picasa Media Detector] --a------ 2006-09-14 14:38 249927 c:\program files\Picasa2\PicasaMediaDetector.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2004-12-27 10:33 98304 c:\program files\QuickTime\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray] --a------ 2004-12-27 10:33 26112 c:\program files\Real\RealPlayer\realplay.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCMSMMSG] --a------ 2003-08-29 04:59 122880 c:\windows\BCMSMMSG.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Palm\\HOTSYNC.EXE"= "c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"= "c:\\PROGRA~1\\Yahoo!\\MESSEN~1\\Yserver.exe"= c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe "c:\\Program Files\\Yahoo!\\Yahoo! Music Engine\\YahooMusicEngine.exe"= "c:\\Program Files\\Yahoo!\\browser\\ybrowser.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\OuterBound Games\\Demolition Derby & Figure 8\\Game\\DemoDerby\\DemoDerby.exe"= R0 PQV2i;PQV2i;c:\windows\system32\drivers\PQV2i.sys [2004-02-17 138118] R1 PQIMount;PQIMount;c:\windows\system32\drivers\PQIMount.sys [2004-02-17 46773] . Contents of the 'Scheduled Tasks' folder 2009-01-24 c:\windows\Tasks\GlaryInitialize.job - c:\program files\Glary Utilities\initialize.exe [2008-12-01 09:38] 2009-01-24 c:\windows\Tasks\irhebylm.job - c:\windows\system32\qoMffdDt.dll [] 2007-02-22 c:\windows\Tasks\MP Scheduled Quick Scan.job - c:\program files\Microsoft Windows OneCare Live\Antivirus\MpCmdRun.exe [] . . ------- Supplementary Scan ------- . uInternet Settings,ProxyOverride = 127.0.0.1 IE: &AIM Search - c:\program files\AIM Toolbar\AIMBar.dll/aimsearch.htm IE: &AOL Toolbar search - c:\program files\AOL Toolbar\toolbar.dll/SEARCH.HTML IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000 Trusted Zone: symantec.com Trusted Zone: symantec.com\liveupdate Trusted Zone: turbotax.com DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab . ************************************************************************ catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-24 15:20:45 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ********************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(784) c:\windows\system32\COMRes.dll . ------------------------ Other Running Processes ------------------------ . c:\windows\system32\gearsec.exe c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe c:\windows\system32\wdfmgr.exe c:\program files\PowerQuest\V2i Protector 2.0\Agent\PQV2iSvc.exe c:\progra~1\Yahoo!\browser\ycommon.exe c:\windows\system32\wscntfy.exe c:\progra~1\Yahoo!\MESSEN~1\Ymsgr_tray.exe . ************************************************************************ . Completion time: 2009-01-24 15:27:45 - machine was rebooted ComboFix-quarantined-files.txt 2009-01-24 20:27:09 Pre-Run: 47,957,733,376 bytes free Post-Run: 48,004,976,640 bytes free WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect 226 --- E O F --- 2009-01-11 16:11:15

Rorschach112 View Member Profile	Jan 26 2009, 11:45 AM Post #2
SuperMember Group: Authentic Member Posts: 3,651 Joined: 29-September 07 Member No.: 73,164 Operating System: Windows XP	hi 1. Close any open browsers. 2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. 3. Open notepad and copy/paste the text in the quotebox below into it: QUOTE folder:: c:\windows\qozw c:\program files\Common Files\qozw c:\documents and settings\Owner\Application Data\Twain file:: c:\windows\system32\aj32.dll c:\windows\system32\lp c:\windows\Tasks\irhebylm.job Registry:: Driver:: Save this as CFScript.txt, in the same location as ComboFix.exe Refering to the picture above, drag CFScript into ComboFix.exe When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

ma3572 View Member Profile	Jan 27 2009, 04:26 PM Post #3
Authentic Member Group: Authentic Member Posts: 66 Joined: 21-March 06 Member No.: 52,152 Operating System: xp	QUOTE (Rorschach112 @ Jan 26 2009, 12:45 PM) hi 1. Close any open browsers. 2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. 3. Open notepad and copy/paste the text in the quotebox below into it: QUOTE folder:: c:\windows\qozw c:\program files\Common Files\qozw c:\documents and settings\Owner\Application Data\Twain file:: c:\windows\system32\aj32.dll c:\windows\system32\lp c:\windows\Tasks\irhebylm.job Registry:: Driver:: Save this as CFScript.txt, in the same location as ComboFix.exe Refering to the picture above, drag CFScript into ComboFix.exe When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

ma3572 View Member Profile	Jan 27 2009, 04:28 PM Post #4
Authentic Member Group: Authentic Member Posts: 66 Joined: 21-March 06 Member No.: 52,152 Operating System: xp	QUOTE (Rorschach112 @ Jan 26 2009, 12:45 PM) hi 1. Close any open browsers. 2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. 3. Open notepad and copy/paste the text in the quotebox below into it: QUOTE folder:: c:\windows\qozw c:\program files\Common Files\qozw c:\documents and settings\Owner\Application Data\Twain file:: c:\windows\system32\aj32.dll c:\windows\system32\lp c:\windows\Tasks\irhebylm.job Registry:: Driver:: Save this as CFScript.txt, in the same location as ComboFix.exe Refering to the picture above, drag CFScript into ComboFix.exe When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply. ComboFix 09-01-21.04 - Owner 2009-01-27 17:11:47.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.510.125 [GMT -5:00] Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt AV: PC Tools AntiVirus 5.0.1.1 On-access scanning disabled (Updated) AV: Symantec AntiVirus Corporate Edition On-access scanning disabled (Updated) * Created a new restore point FILE :: c:\windows\system32\aj32.dll c:\windows\system32\lp c:\windows\Tasks\irhebylm.job . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\Owner\Application Data\Twain c:\program files\Common Files\qozw c:\program files\Common Files\qozw\qozwa.lck c:\program files\Common Files\qozw\qozwd\class-barrel c:\program files\Common Files\qozw\qozwd\vocabulary c:\program files\Common Files\qozw\qozwh c:\program files\Common Files\qozw\qozwl.lck c:\program files\Common Files\qozw\qozwm.lck c:\windows\qozw c:\windows\qozw\qozw.dat c:\windows\qozw\wu c:\windows\system32\aj32.dll c:\windows\system32\lp c:\windows\Tasks\irhebylm.job . ((((((((((((((((((((((((( Files Created from 2008-12-27 to 2009-01-27 ))))))))))))))))))))))))))))))) . 2009-01-24 16:49 . 2009-01-24 16:49 <DIR> d-------- c:\program files\Common Files\PC Tools 2009-01-24 16:49 . 2009-01-24 16:49 <DIR> d-------- c:\documents and settings\Owner\Application Data\PC Tools 2009-01-24 16:49 . 2007-12-06 16:51 28,568 --a------ c:\windows\system32\drivers\AVHook.sys 2009-01-24 16:49 . 2007-12-06 16:51 21,912 --a------ c:\windows\system32\drivers\AVRec.sys 2009-01-24 16:49 . 2008-02-12 11:44 21,904 --a------ c:\windows\system32\drivers\AVFilter.sys 2009-01-24 16:48 . 2009-01-27 17:03 <DIR> d-------- c:\program files\PC Tools AntiVirus 2009-01-24 16:48 . 2009-01-24 16:49 <DIR> d-------- c:\documents and settings\All Users\Application Data\PC Tools 2009-01-24 16:47 . 2009-01-24 16:47 23,275,856 --a------ c:\program files\avinstall.exe 2009-01-14 10:41 . 2009-01-14 10:41 <DIR> d-------- c:\documents and settings\Owner\Application Data\CyberLink 2009-01-13 17:37 . 2009-01-13 19:55 <DIR> d-------- C:\SDFix 2009-01-11 18:16 . 2009-01-11 18:16 <DIR> d-------- c:\program files\Trend Micro 2009-01-11 16:27 . 2009-01-11 16:27 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware 2009-01-11 16:27 . 2009-01-04 18:39 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys 2009-01-11 16:27 . 2009-01-04 18:39 15,504 --a------ c:\windows\system32\drivers\mbam.sys 2009-01-11 11:30 . 2009-01-11 11:30 <DIR> d-------- c:\windows\system32\config\systemprofile\Application Data\GetModule 2009-01-10 13:02 . 2002-03-18 06:00 147,512 --a------ c:\windows\system32\hpzlnt05.dll 2009-01-09 18:52 . 2009-01-09 18:52 <DIR> d-------- c:\program files\Hp 2009-01-09 18:22 . 2008-10-16 15:38 6,066,176 -----c--- c:\windows\system32\dllcache\ieframe.dll 2009-01-09 18:22 . 2007-04-17 04:32 2,455,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dat 2009-01-09 18:22 . 2007-03-08 00:10 991,232 -----c--- c:\windows\system32\dllcache\ieframe.dll.mui 2009-01-09 18:22 . 2008-10-16 15:38 459,264 -----c--- c:\windows\system32\dllcache\msfeeds.dll 2009-01-09 18:22 . 2008-10-16 15:38 383,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dll 2009-01-09 18:22 . 2008-10-16 15:38 267,776 -----c--- c:\windows\system32\dllcache\iertutil.dll 2009-01-09 18:22 . 2008-10-16 15:38 63,488 -----c--- c:\windows\system32\dllcache\icardie.dll 2009-01-09 18:22 . 2008-10-16 15:38 52,224 -----c--- c:\windows\system32\dllcache\msfeedsbs.dll 2009-01-09 18:22 . 2008-10-16 08:11 13,824 -----c--- c:\windows\system32\dllcache\ieudinit.exe 2009-01-09 17:18 . 2009-01-09 17:18 0 --a------ c:\windows\vpc32.INI 2009-01-09 17:04 . 2009-01-24 14:58 <DIR> d-------- c:\program files\Symantec AntiVirus 2009-01-09 09:48 . 2009-01-09 09:48 <DIR> d-------- c:\documents and settings\Owner\Application Data\Malwarebytes 2009-01-08 20:23 . 2009-01-08 20:23 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Malwarebytes 2009-01-08 20:22 . 2009-01-08 20:22 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes 2009-01-08 19:03 . 2009-01-08 19:03 <DIR> d-------- c:\windows\ERUNT 2009-01-08 18:11 . 2009-01-08 18:11 1,529,241 --a------ c:\program files\SDFix.exe 2009-01-08 17:47 . 2009-01-11 17:08 <DIR> d-------- c:\program files\SmitfraudFix 2009-01-08 16:56 . 2009-01-08 16:57 2,697,344 --a------ c:\program files\mbam-setup.exe 2009-01-06 17:45 . 2009-01-11 17:52 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Yahoo! 2009-01-06 17:35 . 2009-01-06 17:35 <DIR> d-------- c:\documents and settings\Administrator 2009-01-04 15:43 . 2009-01-09 19:51 <DIR> d-------- c:\program files\Auslogics 2009-01-04 15:43 . 2009-01-09 19:52 <DIR> d-------- c:\documents and settings\Owner\Application Data\Auslogics 2009-01-04 15:42 . 2009-01-04 15:42 1,651,248 --a------ c:\program files\disk-defrag-setup.exe 2009-01-04 15:32 . 2009-01-04 15:32 <DIR> d-------- c:\documents and settings\Owner\Application Data\GlarySoft 2009-01-04 15:17 . 2009-01-06 08:06 <DIR> d-------- c:\program files\AskBarDis 2009-01-04 15:16 . 2009-01-24 16:39 <DIR> d-------- c:\program files\Glary Utilities 2009-01-04 15:15 . 2009-01-04 15:15 5,632,896 --a------ c:\program files\gusetupnew.exe 2009-01-04 15:09 . 2009-01-04 15:09 50,688 --a------ c:\program files\ATF-Cleaner.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-01-27 22:10 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP 2009-01-24 20:48 --------- d-----w c:\program files\Google 2009-01-24 20:17 --------- d-----w c:\program files\GamesBar 2009-01-24 19:56 --------- d-----w c:\program files\Symantec 2009-01-24 19:56 --------- d-----w c:\program files\Common Files\Symantec Shared 2009-01-24 19:56 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec 2009-01-11 11:15 6,656 ----a-w c:\windows\system32\drivers\aeaudio.sys 2009-01-10 18:03 --------- d-----w c:\program files\hp deskjet 5550 series 2009-01-09 15:19 --------- d-----w c:\documents and settings\Owner\Application Data\Intuit 2009-01-07 23:30 --------- d-----w c:\program files\Viewpoint 2009-01-07 23:30 --------- d-----w c:\documents and settings\All Users\Application Data\Viewpoint 2009-01-06 21:40 --------- d-----w c:\program files\Verizon Online 2009-01-06 21:37 --------- d--h--w c:\program files\InstallShield Installation Information 2009-01-06 21:37 --------- d-----w c:\program files\Infogrames Interactive 2009-01-06 21:35 --------- d-----w c:\program files\Common Files\Oberon Media 2009-01-04 12:24 --------- d-----w c:\documents and settings\All Users\Application Data\GamesBar 2008-12-11 11:57 333,184 ----a-w c:\windows\system32\drivers\srv.sys 2008-12-08 19:20 63,488 ----a-w c:\windows\xobglu16.dll 2008-12-08 19:20 23,552 ----a-w c:\windows\xobglu32.dll 2008-12-08 16:32 --------- d-----w c:\program files\Picasa2 2008-04-01 18:13 69,400 ----a-w c:\documents and settings\Owner\Application Data\GDIPFONTCACHEV1.DAT 2006-07-04 21:24 774,144 ----a-w c:\program files\RngInterstitial.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-07-17 279944] [HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}] [HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-07-17 279944] [HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}] [HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] "Yahoo! Pager"="c:\progra~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" [2006-10-30 4662776] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-24 39408] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ymetray"="c:\program files\Yahoo!\Yahoo! Music Engine\ymetray.exe" [2006-10-03 54776] "YOP"="c:\progra~1\Yahoo!\YOP\yop.exe" [2005-06-16 401408] "Motive SmartBridge"="c:\progra~1\Verizon\SMARTB~1\MotiveSB.exe" [2006-06-23 438359] "YBrowser"="c:\progra~1\Yahoo!\browser\ybrwicon.exe" [2006-07-21 129536] "Verizon_McciTrayApp"="c:\program files\Verizon\McciTrayApp.exe" [2007-03-11 936960] "HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb05.exe" [2002-03-18 188416] "PCTAVApp"="c:\program files\PC Tools AntiVirus\PCTAV.exe" [2008-12-04 1370000] c:\documents and settings\Owner\Start Menu\Programs\Startup\ HotSync Manager.lnk - c:\program files\Palm\HOTSYNC.EXE [2003-09-25 299008] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Dataviz Messenger.lnk - c:\windows\DvzCommon\DvzMsgr.exe [2003-07-01 24576] Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=fjhjek.dll lzpsfe.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Windows.hta] backup=c:\windows\pss\Microsoft Windows.htaCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ymetray.lnk] backup=c:\windows\pss\ymetray.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdaptecDirectCD] --a------ 2004-12-19 10:58 684032 c:\program files\Roxio\Easy CD Creator 5\DirectCD\Directcd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader] --a------ 2005-06-06 23:46 57344 c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds] --a------ 2005-10-19 07:59 126976 c:\windows\system32\hkcmd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray] --a------ 2005-10-19 07:59 155648 c:\windows\system32\igfxtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Picasa Media Detector] --a------ 2006-09-14 14:38 249927 c:\program files\Picasa2\PicasaMediaDetector.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2004-12-27 10:33 98304 c:\program files\QuickTime\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray] --a------ 2004-12-27 10:33 26112 c:\program files\Real\RealPlayer\realplay.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCMSMMSG] --a------ 2003-08-29 04:59 122880 c:\windows\BCMSMMSG.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Palm\\HOTSYNC.EXE"= "c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"= "c:\\PROGRA~1\\Yahoo!\\MESSEN~1\\Yserver.exe"= c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe "c:\\Program Files\\Yahoo!\\Yahoo! Music Engine\\YahooMusicEngine.exe"= "c:\\Program Files\\Yahoo!\\browser\\ybrowser.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\OuterBound Games\\Demolition Derby & Figure 8\\Game\\DemoDerby\\DemoDerby.exe"= R0 PQV2i;PQV2i;c:\windows\system32\drivers\PQV2i.sys [2004-02-17 138118] R1 PQIMount;PQIMount;c:\windows\system32\drivers\PQIMount.sys [2004-02-17 46773] --- Other Services/Drivers In Memory --- Deregistered - mchInjDrv . Contents of the 'Scheduled Tasks' folder 2009-01-25 c:\windows\Tasks\GlaryInitialize.job - c:\program files\Glary Utilities\initialize.exe [2009-01-10 17:02] 2007-02-22 c:\windows\Tasks\MP Scheduled Quick Scan.job - c:\program files\Microsoft Windows OneCare Live\Antivirus\MpCmdRun.exe [] . . ------- Supplementary Scan ------- . uInternet Settings,ProxyOverride = 127.0.0.1 IE: &AIM Search - c:\program files\AIM Toolbar\AIMBar.dll/aimsearch.htm IE: &AOL Toolbar search - c:\program files\AOL Toolbar\toolbar.dll/SEARCH.HTML IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000 LSP: c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll Trusted Zone: symantec.com Trusted Zone: symantec.com\liveupdate Trusted Zone: turbotax.com DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab . ************************************************************************ catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-27 17:15:31 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************ . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'lsass.exe'(844) c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll . Completion time: 2009-01-27 17:19:28 ComboFix-quarantined-files.txt 2009-01-27 22:18:10 ComboFix2.txt 2009-01-24 20:27:46 Pre-Run: 48,066,519,040 bytes free Post-Run: 48,125,186,048 bytes free 212 --- E O F --- 2009-01-25 00:17:59

Rorschach112 View Member Profile	Jan 27 2009, 04:29 PM Post #5
SuperMember Group: Authentic Member Posts: 3,651 Joined: 29-September 07 Member No.: 73,164 Operating System: Windows XP	hello Please download ATF Cleaner by Atribune. Double-click ATF-Cleaner.exe to run the program. Under Main choose: Select All Click the Empty Selected button. If you use Firefox browser Click Firefox at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click No at the prompt. If you use Opera browser Click Opera at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click No at the prompt. Click Exit on the Main menu to close the program. Please download Malwarebytes' Anti-Malware from Here or Here Double Click mbam-setup.exe to install the application. Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish. If an update is found, it will download and install the latest version. Once the program has loaded, select "Perform Quick Scan", then click Scan. The scan may take some time to finish,so please be patient. When the scan is complete, click OK, then Show Results to view the results. Make sure that everything is checked, and click Remove Selected. When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note) The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM. Copy&Paste the entire report in your next reply. Extra Note: If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly. Go to Kaspersky website and perform an online antivirus scan. Read through the requirements and privacy statement and click on Accept button. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run. When the downloads have finished, click on Settings. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button: Spyware, Adware, Dialers, and other potentially dangerous programs Archives Mail databases Click on My Computer under Scan. Once the scan is complete, it will display the results. Click on View Scan Report. You will see a list of infected items there. Click on Save Report As.... Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Then post it here.

ma3572 View Member Profile	Jan 28 2009, 06:10 AM Post #6
Authentic Member Group: Authentic Member Posts: 66 Joined: 21-March 06 Member No.: 52,152 Operating System: xp	QUOTE (Rorschach112 @ Jan 27 2009, 05:29 PM) hello Please download ATF Cleaner by Atribune. Double-click ATF-Cleaner.exe to run the program. Under Main choose: Select All Click the Empty Selected button. If you use Firefox browser Click Firefox at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click No at the prompt. If you use Opera browser Click Opera at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click No at the prompt. Click Exit on the Main menu to close the program. -------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER 7 REPORT Wednesday, January 28, 2009 Operating System: Microsoft Windows XP Home Edition Service Pack 2 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Tuesday, January 27, 2009 19:28:31 Records in database: 1711107 -------------------------------------------------------------------------------- Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: A:\ C:\ E:\ Scan statistics: Files scanned: 62583 Threat name: 21 Infected objects: 25 Suspicious objects: 0 Duration of the scan: 01:29:03 File name / Threat name / Threats count C:\Documents and Settings\Administrator\Desktop\catchme.zip Infected: Backdoor.Win32.TDSS.blh 1 C:\Documents and Settings\Administrator\Desktop\catchme.zip Infected: Backdoor.Win32.TDSS.asz 1 C:\Documents and Settings\Administrator\Desktop\catchme.zip Infected: Backdoor.Win32.TDSS.atb 1 C:\Documents and Settings\Administrator\Desktop\catchme.zip Infected: Rootkit.Win32.TDSS.dbg 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\aj32.dll.vir Infected: Trojan-Downloader.Win32.BHO.alk 1 C:\SDFix\backups\backups.zip Infected: Trojan.Win32.Agent2.no 1 C:\SDFix\backups\backups.zip Infected: Trojan.Win32.Monder.amwy 1 C:\SDFix\backups\backups.zip Infected: Trojan-Dropper.Win32.Small.cjl 1 C:\System Volume Information\_restore{821436EE-5C2E-4248-9345-8D14D0066A02}\RP17\A0002906.dll Infected: Trojan-Downloader.Win32.BHO.alk 1 C:\WINDOWS\pss\Microsoft Windows.htaCommon Startup Infected: Trojan-Dropper.VBS.Inor.cj 1 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\8XQ7OEOI\135[1].exe Infected: Backdoor.Win32.TDSS.xz 1 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\8XQ7OEOI\135_av[1].exe Infected: Packed.Win32.Tdss.a 1 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\FLQNDKZR\patch2[1].exe Infected: Trojan-Dropper.Win32.Small.cji 1 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\FLQNDKZR\patch[2].exe Infected: Trojan-Dropper.Win32.Small.cjp 1 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\FLQNDKZR\update[1].exe Infected: Trojan-Dropper.Win32.Small.ciu 1 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HH5F70UP\load[1].exe Infected: Trojan-Dropper.Win32.Agent.aekv 1 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HH5F70UP\patch[3].exe Infected: Trojan-Dropper.Win32.Small.cjf 1 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HH5F70UP\patch[4].exe Infected: Trojan-Dropper.Win32.Small.cjl 1 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HH5F70UP\patch[5].exe Infected: Trojan-Dropper.Win32.Small.cjw 1 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HH5F70UP\patch[6].exe Infected: Trojan-Dropper.Win32.Small.cmm 1 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HH5F70UP\refresh[1].exe Infected: Trojan-Dropper.Win32.Small.cim 1 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HW3GAULK\135[1].exe Infected: Packed.Win32.Tdss.a 1 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HW3GAULK\135[2].exe Infected: Backdoor.Win32.TDSS.bav 1 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HW3GAULK\135_av[1].exe Infected: Packed.Win32.Tdss.a 1 C:\WINDOWS\system32\drivers\aeaudio.sys Infected: Trojan-Mailfinder.Win32.Agent.wd 1 The selected area was scanned. Please download Malwarebytes' Anti-Malware from Here or Here Double Click mbam-setup.exe to install the application. Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish. If an update is found, it will download and install the latest version. Once the program has loaded, select "Perform Quick Scan", then click Scan. The scan may take some time to finish,so please be patient. When the scan is complete, click OK, then Show Results to view the results. Make sure that everything is checked, and click Remove Selected. When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note) The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM. Copy&Paste the entire report in your next reply. Extra Note: If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly. Go to Kaspersky website and perform an online antivirus scan. Read through the requirements and privacy statement and click on Accept button. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run. When the downloads have finished, click on Settings. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button: Spyware, Adware, Dialers, and other potentially dangerous programs Archives Mail databases Click on My Computer under Scan. Once the scan is complete, it will display the results. Click on View Scan Report. You will see a list of infected items there. Click on Save Report As.... Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Then post it here.

ma3572 View Member Profile	Jan 28 2009, 06:11 AM Post #7
Authentic Member Group: Authentic Member Posts: 66 Joined: 21-March 06 Member No.: 52,152 Operating System: xp	QUOTE (ma3572 @ Jan 28 2009, 07:10 AM) QUOTE (Rorschach112 @ Jan 27 2009, 05:29 PM) hello Please download ATF Cleaner by Atribune. Double-click ATF-Cleaner.exe to run the program. Under Main choose: Select All Click the Empty Selected button. If you use Firefox browser Click Firefox at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click No at the prompt. If you use Opera browser Click Opera at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click No at the prompt. Click Exit on the Main menu to close the program. -------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER 7 REPORT Wednesday, January 28, 2009 Operating System: Microsoft Windows XP Home Edition Service Pack 2 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Tuesday, January 27, 2009 19:28:31 Records in database: 1711107 -------------------------------------------------------------------------------- Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: A:\ C:\ E:\ Scan statistics: Files scanned: 62583 Threat name: 21 Infected objects: 25 Suspicious objects: 0 Duration of the scan: 01:29:03 File name / Threat name / Threats count C:\Documents and Settings\Administrator\Desktop\catchme.zip Infected: Backdoor.Win32.TDSS.blh 1 C:\Documents and Settings\Administrator\Desktop\catchme.zip Infected: Backdoor.Win32.TDSS.asz 1 C:\Documents and Settings\Administrator\Desktop\catchme.zip Infected: Backdoor.Win32.TDSS.atb 1 C:\Documents and Settings\Administrator\Desktop\catchme.zip Infected: Rootkit.Win32.TDSS.dbg 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\aj32.dll.vir Infected: Trojan-Downloader.Win32.BHO.alk 1 C:\SDFix\backups\backups.zip Infected: Trojan.Win32.Agent2.no 1 C:\SDFix\backups\backups.zip Infected: Trojan.Win32.Monder.amwy 1 C:\SDFix\backups\backups.zip Infected: Trojan-Dropper.Win32.Small.cjl 1 C:\System Volume Information\_restore{821436EE-5C2E-4248-9345-8D14D0066A02}\RP17\A0002906.dll Infected: Trojan-Downloader.Win32.BHO.alk 1 C:\WINDOWS\pss\Microsoft Windows.htaCommon Startup Infected: Trojan-Dropper.VBS.Inor.cj 1 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\8XQ7OEOI\135[1].exe Infected: Backdoor.Win32.TDSS.xz 1 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\8XQ7OEOI\135_av[1].exe Infected: Packed.Win32.Tdss.a 1 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\FLQNDKZR\patch2[1].exe Infected: Trojan-Dropper.Win32.Small.cji 1 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\FLQNDKZR\patch[2].exe Infected: Trojan-Dropper.Win32.Small.cjp 1 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\FLQNDKZR\update[1].exe Infected: Trojan-Dropper.Win32.Small.ciu 1 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HH5F70UP\load[1].exe Infected: Trojan-Dropper.Win32.Agent.aekv 1 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HH5F70UP\patch[3].exe Infected: Trojan-Dropper.Win32.Small.cjf 1 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HH5F70UP\patch[4].exe Infected: Trojan-Dropper.Win32.Small.cjl 1 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HH5F70UP\patch[5].exe Infected: Trojan-Dropper.Win32.Small.cjw 1 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HH5F70UP\patch[6].exe Infected: Trojan-Dropper.Win32.Small.cmm 1 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HH5F70UP\refresh[1].exe Infected: Trojan-Dropper.Win32.Small.cim 1 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HW3GAULK\135[1].exe Infected: Packed.Win32.Tdss.a 1 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HW3GAULK\135[2].exe Infected: Backdoor.Win32.TDSS.bav 1 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HW3GAULK\135_av[1].exe Infected: Packed.Win32.Tdss.a 1 C:\WINDOWS\system32\drivers\aeaudio.sys Infected: Trojan-Mailfinder.Win32.Agent.wd 1 The selected area was scanned. Please download Malwarebytes' Anti-Malware from Here or Here Double Click mbam-setup.exe to install the application. Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish. If an update is found, it will download and install the latest version. Once the program has loaded, select "Perform Quick Scan", then click Scan. The scan may take some time to finish,so please be patient. When the scan is complete, click OK, then Show Results to view the results. Make sure that everything is checked, and click Remove Selected. When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note) The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM. Copy&Paste the entire report in your next reply. Extra Note: If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly. Go to Kaspersky website and perform an online antivirus scan. Read through the requirements and privacy statement and click on Accept button. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run. When the downloads have finished, click on Settings. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button: Spyware, Adware, Dialers, and other potentially dangerous programs Archives Mail databases Click on My Computer under Scan. Once the scan is complete, it will display the results. Click on View Scan Report. You will see a list of infected items there. Click on Save Report As.... Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Then post it here. -------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER 7 REPORT Wednesday, January 28, 2009 Operating System: Microsoft Windows XP Home Edition Service Pack 2 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Tuesday, January 27, 2009 19:28:31 Records in database: 1711107 -------------------------------------------------------------------------------- Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: A:\ C:\ E:\ Scan statistics: Files scanned: 62583 Threat name: 21 Infected objects: 25 Suspicious objects: 0 Duration of the scan: 01:29:03 File name / Threat name / Threats count C:\Documents and Settings\Administrator\Desktop\catchme.zip Infected: Backdoor.Win32.TDSS.blh 1 C:\Documents and Settings\Administrator\Desktop\catchme.zip Infected: Backdoor.Win32.TDSS.asz 1 C:\Documents and Settings\Administrator\Desktop\catchme.zip Infected: Backdoor.Win32.TDSS.atb 1 C:\Documents and Settings\Administrator\Desktop\catchme.zip Infected: Rootkit.Win32.TDSS.dbg 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\aj32.dll.vir Infected: Trojan-Downloader.Win32.BHO.alk 1 C:\SDFix\backups\backups.zip Infected: Trojan.Win32.Agent2.no 1 C:\SDFix\backups\backups.zip Infected: Trojan.Win32.Monder.amwy 1 C:\SDFix\backups\backups.zip Infected: Trojan-Dropper.Win32.Small.cjl 1 C:\System Volume Information\_restore{821436EE-5C2E-4248-9345-8D14D0066A02}\RP17\A0002906.dll Infected: Trojan-Downloader.Win32.BHO.alk 1 C:\WINDOWS\pss\Microsoft Windows.htaCommon Startup Infected: Trojan-Dropper.VBS.Inor.cj 1 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\8XQ7OEOI\135[1].exe Infected: Backdoor.Win32.TDSS.xz 1 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\8XQ7OEOI\135_av[1].exe Infected: Packed.Win32.Tdss.a 1 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\FLQNDKZR\patch2[1].exe Infected: Trojan-Dropper.Win32.Small.cji 1 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\FLQNDKZR\patch[2].exe Infected: Trojan-Dropper.Win32.Small.cjp 1 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\FLQNDKZR\update[1].exe Infected: Trojan-Dropper.Win32.Small.ciu 1 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HH5F70UP\load[1].exe Infected: Trojan-Dropper.Win32.Agent.aekv 1 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HH5F70UP\patch[3].exe Infected: Trojan-Dropper.Win32.Small.cjf 1 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HH5F70UP\patch[4].exe Infected: Trojan-Dropper.Win32.Small.cjl 1 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HH5F70UP\patch[5].exe Infected: Trojan-Dropper.Win32.Small.cjw 1 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HH5F70UP\patch[6].exe Infected: Trojan-Dropper.Win32.Small.cmm 1 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HH5F70UP\refresh[1].exe Infected: Trojan-Dropper.Win32.Small.cim 1 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HW3GAULK\135[1].exe Infected: Packed.Win32.Tdss.a 1 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HW3GAULK\135[2].exe Infected: Backdoor.Win32.TDSS.bav 1 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HW3GAULK\135_av[1].exe Infected: Packed.Win32.Tdss.a 1 C:\WINDOWS\system32\drivers\aeaudio.sys Infected: Trojan-Mailfinder.Win32.Agent.wd 1 The selected area was scanned.

Rorschach112 View Member Profile	Jan 28 2009, 08:01 AM Post #8
SuperMember Group: Authentic Member Posts: 3,651 Joined: 29-September 07 Member No.: 73,164 Operating System: Windows XP	can you post the MBAM log Please download the OTMoveIt3 by OldTimer Save it to your desktop. Please double-click OTMoveIt3.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator). Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy): CODE :Processes explorer.exe :Services :Reg :Files C:\WINDOWS\pss\Microsoft Windows.htaCommon Startup C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\8XQ7OEOI\135[1].exe C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\8XQ7OEOI\135_av[1].exe C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\FLQNDKZR\patch2[1].exe C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\FLQNDKZR\patch[2].exe C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\FLQNDKZR\update[1].exe C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HH5F70UP\load[1].exe C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HH5F70UP\patch[3].exe C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HH5F70UP\patch[4].exe C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HH5F70UP\patch[5].exe C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HH5F70UP\patch[6].exe C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HH5F70UP\refresh[1].exe C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HW3GAULK\135[1].exe C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HW3GAULK\135[2].exe C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HW3GAULK\135_av[1].exe C:\WINDOWS\system32\drivers\aeaudio.sys :Commands [purity] [zipfiles] [emptytemp] [start explorer] [Reboot] Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste. Click the red Moveit! button. Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply. Close OTMoveIt3 Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter .log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles* folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post. This will create a zip file in the folder C:\_OTMoveIt\MovedFiles\series of numbers.zip I need you to upload that here We need to upload a Suspicious file to Malwarebytes Anti-Malware* Please go to Malwarebytes' UploadNET Under File 1: browse for *C:\_OTMoveIt\MovedFiles\series of numbers.zip** Note: If you are asked to upload more files, please repeat these steps for each of the File* boxes. Once you have selected all the files you want to upload, click on the Upload Button Please visit this site and follow the instructions for uploading the *C:\_OTMoveIt\MovedFiles\series of numbers.zip**.

ma3572 View Member Profile	Jan 28 2009, 04:18 PM Post #9
Authentic Member Group: Authentic Member Posts: 66 Joined: 21-March 06 Member No.: 52,152 Operating System: xp	QUOTE (Rorschach112 @ Jan 28 2009, 09:01 AM) can you post the MBAM log Please download the OTMoveIt3 by OldTimer Save it to your desktop. Please double-click OTMoveIt3.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator). Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy): CODE :Processes explorer.exe :Services :Reg Malwarebytes' Anti-Malware 1.33 Database version: 1699 Windows 5.1.2600 Service Pack 2 1/27/2009 5:56:19 PM mbam-log-2009-01-27 (17-56-19).txt Scan type: Quick Scan Objects scanned: 54321 Time elapsed: 4 minute(s), 31 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) :Files C:\WINDOWS\pss\Microsoft Windows.htaCommon Startup C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\8XQ7OEOI\135[1].exe C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\8XQ7OEOI\135_av[1].exe C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\FLQNDKZR\patch2[1].exe C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\FLQNDKZR\patch[2].exe C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\FLQNDKZR\update[1].exe C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HH5F70UP\load[1].exe C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HH5F70UP\patch[3].exe C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HH5F70UP\patch[4].exe C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HH5F70UP\patch[5].exe C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HH5F70UP\patch[6].exe C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HH5F70UP\refresh[1].exe C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HW3GAULK\135[1].exe C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HW3GAULK\135[2].exe C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HW3GAULK\135_av[1].exe C:\WINDOWS\system32\drivers\aeaudio.sys :Commands [purity] [zipfiles] [emptytemp] [start explorer] [Reboot] Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste. Click the red Moveit! button. Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply. Close OTMoveIt3 Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter .log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles* folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post. This will create a zip file in the folder C:\_OTMoveIt\MovedFiles\series of numbers.zip I need you to upload that here We need to upload a Suspicious file to Malwarebytes Anti-Malware* Please go to Malwarebytes' UploadNET Under File 1: browse for *C:\_OTMoveIt\MovedFiles\series of numbers.zip** Note: If you are asked to upload more files, please repeat these steps for each of the File* boxes. Once you have selected all the files you want to upload, click on the Upload Button Please visit this site and follow the instructions for uploading the *C:\_OTMoveIt\MovedFiles\series of numbers.zip**.

ma3572 View Member Profile	Jan 28 2009, 04:32 PM Post #10
Authentic Member Group: Authentic Member Posts: 66 Joined: 21-March 06 Member No.: 52,152 Operating System: xp	QUOTE (ma3572 @ Jan 28 2009, 05:18 PM) QUOTE (Rorschach112 @ Jan 28 2009, 09:01 AM) can you post the MBAM log Please download the OTMoveIt3 by OldTimer Save it to your desktop. Please double-click OTMoveIt3.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator). Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy): CODE :Processes explorer.exe :Services :Reg Malwarebytes' Anti-Malware 1.33 Database version: 1699 Windows 5.1.2600 Service Pack 2 1/27/2009 5:56:19 PM mbam-log-2009-01-27 (17-56-19).txt Scan type: Quick Scan Objects scanned: 54321 Time elapsed: 4 minute(s), 31 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) :Files C:\WINDOWS\pss\Microsoft Windows.htaCommon Startup C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\8XQ7OEOI\135[1].exe C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\8XQ7OEOI\135_av[1].exe C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\FLQNDKZR\patch2[1].exe C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\FLQNDKZR\patch[2].exe C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\FLQNDKZR\update[1].exe C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HH5F70UP\load[1].exe C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HH5F70UP\patch[3].exe C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HH5F70UP\patch[4].exe C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HH5F70UP\patch[5].exe C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HH5F70UP\patch[6].exe C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HH5F70UP\refresh[1].exe C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HW3GAULK\135[1].exe C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HW3GAULK\135[2].exe C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HW3GAULK\135_av[1].exe C:\WINDOWS\system32\drivers\aeaudio.sys :Commands [purity] [zipfiles] [emptytemp] [start explorer] [Reboot] Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste. Click the red Moveit! button. Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply. Close OTMoveIt3 Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter .log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles* folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post. This will create a zip file in the folder C:\_OTMoveIt\MovedFiles\series of numbers.zip I need you to upload that here We need to upload a Suspicious file to Malwarebytes Anti-Malware* Please go to Malwarebytes' UploadNET Under File 1: browse for *C:\_OTMoveIt\MovedFiles\series of numbers.zip** Note: If you are asked to upload more files, please repeat these steps for each of the File* boxes. Once you have selected all the files you want to upload, click on the Upload Button Please visit this site and follow the instructions for uploading the *C:\_OTMoveIt\MovedFiles\series of numbers.zip**. ========== PROCESSES ========== Process explorer.exe killed successfully. ========== SERVICES/DRIVERS ========== ========== REGISTRY ========== ========== FILES ========== C:\WINDOWS\pss\Microsoft Windows.htaCommon Startup moved successfully. C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\8XQ7OEOI\135[1].exe moved successfully. C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\8XQ7OEOI\135_av[1].exe moved successfully. C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\FLQNDKZR\patch2[1].exe moved successfully. C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\FLQNDKZR\patch[2].exe moved successfully. C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\FLQNDKZR\update[1].exe moved successfully. C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HH5F70UP\load[1].exe moved successfully. C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HH5F70UP\patch[3].exe moved successfully. C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HH5F70UP\patch[4].exe moved successfully. C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HH5F70UP\patch[5].exe moved successfully. C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HH5F70UP\patch[6].exe moved successfully. C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HH5F70UP\refresh[1].exe moved successfully. C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HW3GAULK\135[1].exe moved successfully. C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HW3GAULK\135[2].exe moved successfully. C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HW3GAULK\135_av[1].exe moved successfully. C:\WINDOWS\system32\drivers\aeaudio.sys moved successfully. ========== COMMANDS ========== User's Temp folder emptied. User's Temporary Internet Files folder emptied. User's Internet Explorer cache folder emptied. Local Service Temp folder emptied. File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. Local Service Temporary Internet Files folder emptied. File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_754.dat scheduled to be deleted on reboot. Windows Temp folder emptied. Java cache emptied. Temp folders emptied. Explorer started successfully OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 01282009_173100

ma3572 View Member Profile	Jan 28 2009, 04:48 PM Post #11
Authentic Member Group: Authentic Member Posts: 66 Joined: 21-March 06 Member No.: 52,152 Operating System: xp	QUOTE (ma3572 @ Jan 28 2009, 05:32 PM) QUOTE (ma3572 @ Jan 28 2009, 05:18 PM) QUOTE (Rorschach112 @ Jan 28 2009, 09:01 AM) can you post the MBAM log Please download the OTMoveIt3 by OldTimer Save it to your desktop. Please double-click OTMoveIt3.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator). Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy): CODE :Processes explorer.exe :Services :Reg Malwarebytes' Anti-Malware 1.33 Database version: 1699 Windows 5.1.2600 Service Pack 2 1/27/2009 5:56:19 PM mbam-log-2009-01-27 (17-56-19).txt Scan type: Quick Scan Objects scanned: 54321 Time elapsed: 4 minute(s), 31 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) :Files C:\WINDOWS\pss\Microsoft Windows.htaCommon Startup C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\8XQ7OEOI\135[1].exe C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\8XQ7OEOI\135_av[1].exe C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\FLQNDKZR\patch2[1].exe C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\FLQNDKZR\patch[2].exe C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\FLQNDKZR\update[1].exe C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HH5F70UP\load[1].exe C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HH5F70UP\patch[3].exe C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HH5F70UP\patch[4].exe C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HH5F70UP\patch[5].exe C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HH5F70UP\patch[6].exe C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HH5F70UP\refresh[1].exe C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HW3GAULK\135[1].exe C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HW3GAULK\135[2].exe C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HW3GAULK\135_av[1].exe C:\WINDOWS\system32\drivers\aeaudio.sys :Commands [purity] [zipfiles] [emptytemp] [start explorer] [Reboot] Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste. Click the red Moveit! button. Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply. Close OTMoveIt3 Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter .log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles* folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post. This will create a zip file in the folder C:\_OTMoveIt\MovedFiles\series of numbers.zip I need you to upload that here We need to upload a Suspicious file to Malwarebytes Anti-Malware* Please go to Malwarebytes' UploadNET Under File 1: browse for *C:\_OTMoveIt\MovedFiles\series of numbers.zip** Note: If you are asked to upload more files, please repeat these steps for each of the File* boxes. Once you have selected all the files you want to upload, click on the Upload Button Please visit this site and follow the instructions for uploading the *C:\_OTMoveIt\MovedFiles\series of numbers.zip*. ========== PROCESSES ========== Process explorer.exe killed successfully. ========== SERVICES/DRIVERS ========== ========== REGISTRY ========== ========== FILES ========== C:\WINDOWS\pss\Microsoft Windows.htaCommon Startup moved successfully. C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\8XQ7OEOI\135[1].exe moved successfully. C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\8XQ7OEOI\135_av[1].exe moved successfully. C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\FLQNDKZR\patch2[1].exe moved successfully. C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\FLQNDKZR\patch[2].exe moved successfully. C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\FLQNDKZR\update[1].exe moved successfully. C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HH5F70UP\load[1].exe moved successfully. C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HH5F70UP\patch[3].exe moved successfully. C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HH5F70UP\patch[4].exe moved successfully. C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HH5F70UP\patch[5].exe moved successfully. C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HH5F70UP\patch[6].exe moved successfully. C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HH5F70UP\refresh[1].exe moved successfully. C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HW3GAULK\135[1].exe moved successfully. C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HW3GAULK\135[2].exe moved successfully. C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\HW3GAULK\135_av[1].exe moved successfully. C:\WINDOWS\system32\drivers\aeaudio.sys moved successfully. ========== COMMANDS ========== User's Temp folder emptied. User's Temporary Internet Files folder emptied. User's Internet Explorer cache folder emptied. Local Service Temp folder emptied. File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. Local Service Temporary Internet Files folder emptied. File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_754.dat scheduled to be deleted on reboot. Windows Temp folder emptied. Java cache emptied. Temp folders emptied. Explorer started successfully OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 01282009_173100 I uploaded the series of numbers.zip file as you requested. Not here, but to bleeping computer.com Is that OK?

Rorschach112 View Member Profile	Jan 28 2009, 07:27 PM Post #12
SuperMember Group: Authentic Member Posts: 3,651 Joined: 29-September 07 Member No.: 73,164 Operating System: Windows XP	Please don't quote my posts Post a new HJT log

ma3572 View Member Profile	Jan 29 2009, 06:01 AM Post #13
Authentic Member Group: Authentic Member Posts: 66 Joined: 21-March 06 Member No.: 52,152 Operating System: xp	QUOTE (Rorschach112 @ Jan 28 2009, 08:27 PM) Please don't quote my posts Post a new HJT log Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 07:00:56, on 1/29/2009 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16762) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\GEARSec.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe C:\Program Files\PowerQuest\V2i Protector 2.0\Agent\PQV2iSvc.exe C:\Program Files\Yahoo!\Yahoo! Music Engine\ymetray.exe C:\PROGRA~1\Yahoo!\YOP\yop.exe C:\PROGRA~1\Verizon\SMARTB~1\MotiveSB.exe C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe C:\Program Files\Verizon\McciTrayApp.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe C:\Program Files\PC Tools AntiVirus\PCTAV.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\DvzCommon\DvzMsgr.exe C:\PROGRA~1\Yahoo!\browser\ycommon.exe C:\Program Files\Palm\HOTSYNC.EXE C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wuauclt.exe C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE C:\Program Files\Yahoo!\browser\ybrowser.exe C:\Program Files\Hijackthis\HijackThis.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1 R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar1.dll O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.0988.2\msneshellx.dll O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.0988.2\msneshellx.dll O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar1.dll O4 - HKLM\..\Run: [ymetray] "C:\Program Files\Yahoo!\Yahoo! Music Engine\ymetray.exe" O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\Verizon\SMARTB~1\MotiveSB.exe O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe O4 - HKLM\..\Run: [Verizon_McciTrayApp] C:\Program Files\Verizon\McciTrayApp.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe O4 - HKLM\..\Run: [PCTAVApp] "C:\Program Files\PC Tools AntiVirus\PCTAV.exe" /MONITORSCAN O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE O4 - Global Startup: Dataviz Messenger.lnk = C:\WINDOWS\DvzCommon\DvzMsgr.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: Verizon Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU) O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://activatemyfios.verizon.net/sdcCommo...IOS/tgctlcm.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co...b?1103428233423 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1123936100765 O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://atv.disney.go.com/global/download/otoy/OTOYAX29b.cab O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD5/JSCDL/jre...ows-i586-jc.cab O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://a.download.toontown.com/sv1.0.21.13/ttinst.cab O16 - DPF: {C606BA60-AB76-48B6-96A7-2C4D5C386F70} (PreQualifier Class) - http://www.verizon.net/checkmypc/includes/MotivePreQual.cab O16 - DPF: {CC32D4D8-2A0B-4CEB-B105-C9B968379105} (CGameManagerCtrl Object) - https://disney.go.com/games/downloads/gamem...GameManager.cab O20 - AppInit_DLLs: fjhjek.dll lzpsfe.dll O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: PC Tools AntiVirus Engine (PCTAVSvc) - PC Tools Research Pty Ltd - C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe O23 - Service: V2i Protector - PowerQuest Corporation - C:\Program Files\PowerQuest\V2i Protector 2.0\Agent\PQV2iSvc.exe -- End of file - 9167 bytes

Rorschach112 View Member Profile	Jan 29 2009, 12:50 PM Post #14
SuperMember Group: Authentic Member Posts: 3,651 Joined: 29-September 07 Member No.: 73,164 Operating System: Windows XP	fix this with HJT O20 - AppInit_DLLs: fjhjek.dll lzpsfe.dll Reboot and post a new HJT log

ma3572 View Member Profile	Jan 29 2009, 03:57 PM Post #15
Authentic Member Group: Authentic Member Posts: 66 Joined: 21-March 06 Member No.: 52,152 Operating System: xp	QUOTE (Rorschach112 @ Jan 29 2009, 01:50 PM) fix this with HJT O20 - AppInit_DLLs: fjhjek.dll lzpsfe.dll Reboot and post a new HJT log Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:53:19, on 1/29/2009 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16762) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\GEARSec.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe C:\Program Files\PowerQuest\V2i Protector 2.0\Agent\PQV2iSvc.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Yahoo!\Yahoo! Music Engine\ymetray.exe C:\PROGRA~1\Yahoo!\YOP\yop.exe C:\PROGRA~1\Verizon\SMARTB~1\MotiveSB.exe C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe C:\Program Files\Verizon\McciTrayApp.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe C:\Program Files\PC Tools AntiVirus\PCTAV.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\ctfmon.exe C:\PROGRA~1\Yahoo!\browser\ycommon.exe C:\WINDOWS\DvzCommon\DvzMsgr.exe C:\Program Files\Palm\HOTSYNC.EXE C:\WINDOWS\system32\wscntfy.exe C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1 R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar1.dll O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.0988.2\msneshellx.dll O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.0988.2\msneshellx.dll O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar1.dll O4 - HKLM\..\Run: [ymetray] "C:\Program Files\Yahoo!\Yahoo! Music Engine\ymetray.exe" O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\Verizon\SMARTB~1\MotiveSB.exe O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe O4 - HKLM\..\Run: [Verizon_McciTrayApp] C:\Program Files\Verizon\McciTrayApp.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe O4 - HKLM\..\Run: [PCTAVApp] "C:\Program Files\PC Tools AntiVirus\PCTAV.exe" /MONITORSCAN O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE O4 - Global Startup: Dataviz Messenger.lnk = C:\WINDOWS\DvzCommon\DvzMsgr.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: Verizon Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU) O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://activatemyfios.verizon.net/sdcCommo...IOS/tgctlcm.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co...b?1103428233423 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1123936100765 O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://atv.disney.go.com/global/download/otoy/OTOYAX29b.cab O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD5/JSCDL/jre...ows-i586-jc.cab O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://a.download.toontown.com/sv1.0.21.13/ttinst.cab O16 - DPF: {C606BA60-AB76-48B6-96A7-2C4D5C386F70} (PreQualifier Class) - http://www.verizon.net/checkmypc/includes/MotivePreQual.cab O16 - DPF: {CC32D4D8-2A0B-4CEB-B105-C9B968379105} (CGameManagerCtrl Object) - https://disney.go.com/games/downloads/gamem...GameManager.cab O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: PC Tools AntiVirus Engine (PCTAVSvc) - PC Tools Research Pty Ltd - C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe O23 - Service: V2i Protector - PowerQuest Corporation - C:\Program Files\PowerQuest\V2i Protector 2.0\Agent\PQV2iSvc.exe -- End of file - 9036 bytes I deleted 020 in hijack this. Do I have Kaspersky AV on my computer now? Since you asked me to scan the computer with it.

« Next Oldest · Infections Removal · Next Newest »

2 Pages

1 2 >

Closed Topic

Start new topic

Similar Topics

Similar Topics

Similar Topics

		Topic Title	Replies	Topic Starter	Views	Last Action
		Infections Removal Computer Acting rather fishy.... Hmm.., Possible Infection Removal [Co	5	Mordimier	75	Today, 09:54 PM Last post by: CatByte
		Infections Removal [Resolved] IE8 web browser keeps redirecting me	14	Marm	184	Today, 09:29 PM Last post by: CatByte
		Infections Removal [Resolved] XP Antivirus Pro 2010 infection 12	29	Stormicats	1,205	Today, 03:58 PM Last post by: extremeboy
		Infections Removal [Resolved] Perfect Keylogger.	9	lin0056	126	Today, 02:34 PM Last post by: LDTate

Display Mode: Standard · Switch to: Linear+ · Switch to: Outline

Track this topic · Email this topic · Print this topic · Subscribe to this forum

Time is now: 17th March 2010 - 11:07 PM

Advertisements do not imply our endorsement of that product or service. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk.
Member site: Alliance of Security Analysis Professionals | UNITE Against Malware
Memory Forums | Auto Repair Forum
© Geeks to Go, Inc. | All Rights Reserved | Privacy Policy

Powered By IP.Board © 2010 IPS, Inc.