What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Serious Rootkit/malware problem Prunnet.exe

15 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hello sorry for this being my first and only post but i am desperate i tried everything possible before i found this website.. and unfortunatly i ran a bunch of scans and have tons of log files i kind of wish i hadnt because you guys say not to but i have already run combofix,smitfraudfix vundofix,malware bytes, windows malicious software removal tool, etc and they have removed alot of virus/malware rootkit files but it seems to always come back mainly Prunnet.exe example
HKLM\..\Run: [prunnet] "C:\WINDOWS\system32\prunnet.exe"

It all started the other night when i was going to shut off my computer then all of a sudden a program called Virus Blaster started running a scan on my computer i was like "wait, i didnt download that" so i went to add/removed programs and removed it successfully (so i thought) and i shut my computer down…the next morning i wake up and reboot.. and all of a sudden explorer.exe constantly opens and closes over and over again with Verclsid.exe also opening everytime explorer.exe opens or closes i tried to go on the internet and search my problem but i had to close out of explorer.exe so it would stop opening and closing every 10 seconds and stop using up 100% of my cpu….i then proceeded to research my problem but then i started being redirected to spam sites every time i searched something in google…i had to copy and paste the url into the url bar to actually get to a website from google the virus was also causing my keyboard to type as if it were dyslexic typing words backwards and making spaces where i didnt hit space bar and just changing keys to type a different key then what was assigned needless to say this is ridiculous and have never come accross anything like this before and i have cleaned my computer out of many viruses over the years but this one…sheesh what to do…my system recovery cds no longer work because compaq replaced my motherboard with a hp motherboard (underwarrenty) now the cds are obsolete and they dont make them anymore and tech support said im pretty much screwed…so i tried to remove the virus by running many scans they all removed plenty of malicious files and registry entries and i have made some headway because explorer.exe is finally staying open on its own and i can access my computer and the like….but my keyboard is still getting messed up i am still being redirected to weird sites and sometimes if i try to search for something in google it will say in the bottom right hand corner of firefox that i am recieveing data from ADWARE.something i dont remember exactly what it said but Prunnet.exe has been removed numerous times and still keeps coming back…so sorry for my lack of puncuation but im extremely frustrated and this messages has taken me over an hour to type because the virus is messing with my keyboard so here is a bunch of puncuation ,./,;'[,.].'.;,./''/>?">'/.'/]'.}">????????.'./\.|"!!!!!! disperse as you please just dont give me carp** for it…..here is the Hijackthis log







Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:01:29, on 2/16/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
O2 - BHO: (no name) - AutorunsDisabled - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ATI DeviceDetect] "C:\Program Files\ATI Multimedia\main\ATIDtct.EXE"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [prunnet] "C:\WINDOWS\system32\prunnet.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingA7741] command.com /c del "C:\WINDOWS\wt\webdriver\4.1.1\sound.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC3556] cmd.exe /c del "C:\WINDOWS\wt\webdriver\4.1.1\sound.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA9751] command.com /c del "C:\WINDOWS\wt\webdriver\4.1.1\wdcaps.ded"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5107] cmd.exe /c del "C:\WINDOWS\wt\webdriver\4.1.1\wdcaps.ded"
O4 - HKLM\..\RunOnce: [SpybotDeletingA3497] command.com /c del "C:\WINDOWS\wt\webdriver\4.1.1\wdengine.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5572] cmd.exe /c del "C:\WINDOWS\wt\webdriver\4.1.1\wdengine.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA7698] command.com /c del "C:\WINDOWS\wt\webdriver\4.1.1\webdriver.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5531] cmd.exe /c del "C:\WINDOWS\wt\webdriver\4.1.1\webdriver.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA9518] command.com /c del "C:\WINDOWS\wt\webdriver\4.1.1\wthost.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingC4600] cmd.exe /c del "C:\WINDOWS\wt\webdriver\4.1.1\wthost.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingA3005] command.com /c del "C:\WINDOWS\wt\webdriver\4.1.1\wthostctl.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC4205] cmd.exe /c del "C:\WINDOWS\wt\webdriver\4.1.1\wthostctl.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA4407] command.com /c del "C:\WINDOWS\wt\webdriver\4.1.1\wtmulti.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC4606] cmd.exe /c del "C:\WINDOWS\wt\webdriver\4.1.1\wtmulti.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA9358] command.com /c del "C:\WINDOWS\wt\webdriver\4.1.1\wtmulti.jar"
O4 - HKLM\..\RunOnce: [SpybotDeletingC6273] cmd.exe /c del "C:\WINDOWS\wt\webdriver\4.1.1\wtmulti.jar"
O4 - HKLM\..\RunOnce: [SpybotDeletingA524] command.com /c del "C:\WINDOWS\wt\webdriver\4.1.1\wtwmplug.ax"
O4 - HKLM\..\RunOnce: [SpybotDeletingC8708] cmd.exe /c del "C:\WINDOWS\wt\webdriver\4.1.1\wtwmplug.ax"
O4 - HKLM\..\RunOnce: [SpybotDeletingA4239] command.com /c del "C:\WINDOWS\wt\webdriver\4.1.1\wtwmplug.ini"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5046] cmd.exe /c del "C:\WINDOWS\wt\webdriver\4.1.1\wtwmplug.ini"
O4 - HKLM\..\RunOnce: [SpybotDeletingA2075] command.com /c del "C:\WINDOWS\wt\wtupdates\DRM\3.2.0.19\files\DRM0302.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC7411] cmd.exe /c del "C:\WINDOWS\wt\wtupdates\DRM\3.2.0.19\files\DRM0302.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA4872] command.com /c del "C:\WINDOWS\wt\wtupdates\DRM\3.2.0.19\files\DRM0302Java.jar"
O4 - HKLM\..\RunOnce: [SpybotDeletingC8860] cmd.exe /c del "C:\WINDOWS\wt\wtupdates\DRM\3.2.0.19\files\DRM0302Java.jar"
O4 - HKLM\..\RunOnce: [Spybot - Search & Destroy] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKCU\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O9 - Extra button: (no name) - AutorunsDisabled - (no file)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=consumerfav&c=2c02&lc=0409
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: JSINMIS - Unknown owner - C:\DOCUME~1\jeremy\LOCALS~1\Temp\JSINMIS.exe (file missing)

–
End of file - 7836 bytes
Post #2
[external image: Posted Image]

DO NOT use any TOOLS such as Combofix, MBAM, SmitfraudFix, Vundofix, or HijackThis fixes without supervision.

Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.


Stay with this topic until I give you the all clean post.

You might want to print these instructions out.

I suggest you do this:

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Uncheck "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Uncheck "Hide protected operating system files."
Click Apply, and then click OK.


Please do not delete anything unless instructed to.

Download avz4.zip from here
  • Unzip it to your desktop to a folder named avz4
  • Double click on AVZ.exe to run it.
  • Run an update by clicking the Auto Update button on the Right of the Log window: [external image: Posted Image]
  • Click Start to begin the update
Note: If you recieve an error message, chose a different source, then click Start again
  • After the update, from the "File" menu, choose "Standard Scripts"
  • Put a check next to item 2: Advanced System Investigation
  • Click Execute selected scripts
  • At the next prompt, click the OK button
  • Let the scan run and click "OK" when the completion prompt pops up
  • Now Close out of the Standard Scripts window, and exit AVZ
  • Navigate to the avz4 folder and locate the folder LOG
  • Inside the LOG folder you will find virusinfo_syscheck.htm and virusinfo_syscheck.zip
  • Attach virusinfo_syscheck.htm to your next reply, along with a fresh HijackThis log
Post #5
Both Avz and hijack this scans successful here are the logs

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:30:09, on 2/16/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
c:\Program Files\Microsoft Money\System\urlmap.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
O2 - BHO: (no name) - AutorunsDisabled - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ATI DeviceDetect] "C:\Program Files\ATI Multimedia\main\ATIDtct.EXE"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [prunnet] "C:\WINDOWS\system32\prunnet.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingA7741] command.com /c del "C:\WINDOWS\wt\webdriver\4.1.1\sound.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC3556] cmd.exe /c del "C:\WINDOWS\wt\webdriver\4.1.1\sound.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA9751] command.com /c del "C:\WINDOWS\wt\webdriver\4.1.1\wdcaps.ded"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5107] cmd.exe /c del "C:\WINDOWS\wt\webdriver\4.1.1\wdcaps.ded"
O4 - HKLM\..\RunOnce: [SpybotDeletingA3497] command.com /c del "C:\WINDOWS\wt\webdriver\4.1.1\wdengine.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5572] cmd.exe /c del "C:\WINDOWS\wt\webdriver\4.1.1\wdengine.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA7698] command.com /c del "C:\WINDOWS\wt\webdriver\4.1.1\webdriver.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5531] cmd.exe /c del "C:\WINDOWS\wt\webdriver\4.1.1\webdriver.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA9518] command.com /c del "C:\WINDOWS\wt\webdriver\4.1.1\wthost.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingC4600] cmd.exe /c del "C:\WINDOWS\wt\webdriver\4.1.1\wthost.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingA3005] command.com /c del "C:\WINDOWS\wt\webdriver\4.1.1\wthostctl.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC4205] cmd.exe /c del "C:\WINDOWS\wt\webdriver\4.1.1\wthostctl.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA4407] command.com /c del "C:\WINDOWS\wt\webdriver\4.1.1\wtmulti.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC4606] cmd.exe /c del "C:\WINDOWS\wt\webdriver\4.1.1\wtmulti.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA9358] command.com /c del "C:\WINDOWS\wt\webdriver\4.1.1\wtmulti.jar"
O4 - HKLM\..\RunOnce: [SpybotDeletingC6273] cmd.exe /c del "C:\WINDOWS\wt\webdriver\4.1.1\wtmulti.jar"
O4 - HKLM\..\RunOnce: [SpybotDeletingA524] command.com /c del "C:\WINDOWS\wt\webdriver\4.1.1\wtwmplug.ax"
O4 - HKLM\..\RunOnce: [SpybotDeletingC8708] cmd.exe /c del "C:\WINDOWS\wt\webdriver\4.1.1\wtwmplug.ax"
O4 - HKLM\..\RunOnce: [SpybotDeletingA4239] command.com /c del "C:\WINDOWS\wt\webdriver\4.1.1\wtwmplug.ini"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5046] cmd.exe /c del "C:\WINDOWS\wt\webdriver\4.1.1\wtwmplug.ini"
O4 - HKLM\..\RunOnce: [SpybotDeletingA2075] command.com /c del "C:\WINDOWS\wt\wtupdates\DRM\3.2.0.19\files\DRM0302.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC7411] cmd.exe /c del "C:\WINDOWS\wt\wtupdates\DRM\3.2.0.19\files\DRM0302.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA4872] command.com /c del "C:\WINDOWS\wt\wtupdates\DRM\3.2.0.19\files\DRM0302Java.jar"
O4 - HKLM\..\RunOnce: [SpybotDeletingC8860] cmd.exe /c del "C:\WINDOWS\wt\wtupdates\DRM\3.2.0.19\files\DRM0302Java.jar"
O4 - HKLM\..\RunOnce: [Spybot - Search & Destroy] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKCU\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O9 - Extra button: (no name) - AutorunsDisabled - (no file)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=consumerfav&c=2c02&lc=0409
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: JSINMIS - Unknown owner - C:\DOCUME~1\jeremy\LOCALS~1\Temp\JSINMIS.exe (file missing)

–
End of file - 7934 bytes
Post #6
Navigate to the avz4 folder and locate the folder LOG
Inside the LOG folder you will find virusinfo_syscheck.htm and virusinfo_syscheck.zip
Attach virusinfo_syscheck.htm
Post #8
  • Close all windows then double click on AVZ.exe
  • Click File > Custom scripts
  • Copy & paste the contents of the following codebox in the box in the program

    begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 DeleteService('zqqcysuu');
 DeleteService('mlwchsjd');
 DeleteService('oqcsxypd');
 SetServiceStart('mlwchsjd', 4);
 StopService('JSINMIS');
 TerminateProcessByName('c:\program files\spybot - search & destroy\teatimer.exe');
 BC_DeleteFile('C:\DOCUME~1\jeremy\LOCALS~1\Temp\JSINMIS.exe');
 BC_DeleteFile('C:\WINDOWS\system32\drivers\ouwvgpkl.sys');
 BC_DeleteFile('C:\WINDOWS\system32\drivers\pvbsltru.sys');
 BC_DeleteFile('C:\WINDOWS\system32\drivers\fphgvlkj.sys');
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.

  • Note: When you run the script, your PC will be restarted
  • Click Run
  • Restart your PC if it doesn't do it automatically, and post back with a new HijackThis log.
Post #9
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:58:45, on 2/16/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
O2 - BHO: (no name) - AutorunsDisabled - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ATI DeviceDetect] "C:\Program Files\ATI Multimedia\main\ATIDtct.EXE"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [prunnet] "C:\WINDOWS\system32\prunnet.exe"
O4 - HKCU\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-21-4021508746-488748980-3615762775-501\..\Run: [Aim6] "C:\Program Files\Common Files\AOL\Launch\AOLLaunch.exe" /d locale=en-US ee://aol/imApp (User 'Guest')
O4 - HKUS\S-1-5-21-4021508746-488748980-3615762775-501\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime (User 'Guest')
O4 - HKUS\S-1-5-21-4021508746-488748980-3615762775-501\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe (User 'Guest')
O9 - Extra button: (no name) - AutorunsDisabled - (no file)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=consumerfav&c=2c02&lc=0409
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: JSINMIS - Unknown owner - C:\DOCUME~1\jeremy\LOCALS~1\Temp\JSINMIS.exe (file missing)

–
End of file - 5757 bytes
Post #10
Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»

Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.


(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time.

Next:

Download ComboFix from one of these locations:

Link 1
Link 2
Link 3


* IMPORTANT !!! Save ComboFix.exe to your Desktop


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs

  • Double click on ComboFix.exe & follow the prompts.

    Note: Combofix will run without the Recovery Console installed.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


[external image: Posted Image]



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
"copy/paste" a new HijackThis log file into this thread as well.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Give it atleast 20-30 minutes to finish if needed.

Please don't attach the scans / logs, use "copy/paste".

Also please describe how your computer behaves at the moment.
Post #11 last edited
OK combofix scan complete computer is running a wee bit faster now but not much and as soon as combofix was done and the log file opened spybot S&D picked up something trying to add a value to the registry when i clicked info it said it was malware/worm and i should delete it but didnt say what it was i naturally denied the change but that means theres still some traces in my pc if its trying to activate itself again or something anyway here is the combofix log



ComboFix 09-02-15.01 - jeremy 2009-02-16 19:14:46.9 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1023.633 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: avast! antivirus 4.8.1335 [VPS 090216-1] *On-access scanning disabled* (Updated)
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\Agent.OMZ.Fix.exe
c:\windows\system32\dumphive.exe
c:\windows\system32\IEDFix.exe
c:\windows\system32\Process.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32\tmp.reg
c:\windows\system32\VCCLSID.exe
c:\windows\system32\WS2Fix.exe

.
((((((((((((((((((((((((( Files Created from 2009-01-17 to 2009-02-17 )))))))))))))))))))))))))))))))
.

2009-02-16 17:52 . 2009-02-16 17:52 d——– c:\program files\Trend Micro
2009-02-16 12:59 . 2009-02-16 12:59 d——– c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-02-16 00:37 . 2009-02-16 03:07 d——– C:\4a79e3d5ec5d5f0f175609
2009-02-16 00:09 . 2009-02-16 00:09 d——– c:\windows\system32\XPSViewer
2009-02-16 00:08 . 2009-02-16 00:08 d——– c:\program files\Reference Assemblies
2009-02-16 00:08 . 2009-02-16 00:08 d——– c:\program files\MSBuild
2009-02-16 00:07 . 2008-07-06 07:06 117,760 ——— c:\windows\system32\prntvpt.dll
2009-02-16 00:07 . 2008-07-06 07:06 89,088 —–c— c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-02-16 00:06 . 2009-02-16 00:08 d——– C:\4848ae0ae9e08ae480
2009-02-16 00:06 . 2008-07-06 07:06 1,676,288 ——— c:\windows\system32\xpssvcs.dll
2009-02-16 00:06 . 2008-07-06 07:06 1,676,288 —–c— c:\windows\system32\dllcache\xpssvcs.dll
2009-02-16 00:06 . 2008-07-06 05:50 597,504 —–c— c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-02-16 00:06 . 2008-07-06 07:06 575,488 ——— c:\windows\system32\xpsshhdr.dll
2009-02-16 00:06 . 2008-07-06 07:06 575,488 —–c— c:\windows\system32\dllcache\xpsshhdr.dll
2009-02-16 00:04 . 2009-02-16 03:09 d——– c:\windows\SxsCaPendDel
2009-02-15 20:46 . 2009-02-15 20:46 d——– c:\program files\Alwil Software
2009-02-15 20:42 . 2009-02-15 21:51 2,204 –a—— c:\windows\zkvyrebe
2009-02-15 20:12 . 2009-02-15 20:12 d——– c:\program files\Network Associates
2009-02-15 19:23 . 2009-02-15 19:23 d——– c:\documents and settings\jeremy\Application Data\Malwarebytes
2009-02-15 19:22 . 2009-02-15 19:23 d——– c:\program files\Malwarebytes' Anti-Malware
2009-02-15 19:22 . 2009-02-15 19:22 d——– c:\documents and settings\All Users\Application Data\Malwarebytes
2009-02-15 19:22 . 2009-02-11 10:19 38,496 –a—— c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-15 19:22 . 2009-02-11 10:19 15,504 –a—— c:\windows\system32\drivers\mbam.sys
2009-02-15 18:07 . 2009-02-15 19:39 1,716 –a—— c:\windows\qeietljl
2009-02-15 14:21 . 2009-02-15 14:21 d——– c:\program files\Windows Live Safety Center
2009-02-15 11:09 . 2009-02-15 11:09 d——– c:\program files\Spybot - Search & Destroy
2009-02-15 11:09 . 2009-02-15 11:42 d——– c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-02-15 09:36 . 2009-02-15 09:37 250 –a—— c:\windows\gmer.ini
2009-02-15 08:21 . 2007-06-24 15:43 23,600 –a—— c:\windows\system32\drivers\TVICHW32.SYS
2009-02-15 00:13 . 2009-02-15 15:57 3,844 –a—— c:\windows\ecppolmr
2009-02-13 19:05 . 2009-02-13 19:05 d——– c:\documents and settings\All Users\Application Data\ATI
2009-02-13 19:00 . 2009-02-13 19:00 d——– c:\program files\Common Files\ATI Technologies
2009-02-13 18:59 . 2008-12-01 14:35 593,920 –a—— c:\windows\system32\ati2sgag.exe
2009-02-13 18:59 . 2009-01-05 09:20 93,184 -ra—— c:\windows\system32\drivers\AtiHdmi.sys
2009-02-13 18:58 . 2009-01-05 09:19 3,107,788 -ra—— c:\windows\system32\ativvaxx.dat
2009-02-13 18:58 . 2009-01-05 09:18 3,107,788 -ra—— c:\windows\system32\ativva5x.dat
2009-02-13 18:58 . 2009-01-05 09:18 887,724 -ra—— c:\windows\system32\ativva6x.dat
2009-02-13 18:58 . 2009-01-05 09:17 425,984 -ra—— c:\windows\system32\ATIDEMGX.dll
2009-02-13 18:58 . 2009-01-05 09:17 307,200 -ra—— c:\windows\system32\atiiiexx.dll
2009-02-13 18:58 . 2009-01-05 09:17 180,720 -ra—— c:\windows\system32\atiicdxx.dat
2009-02-13 18:58 . 2009-01-05 09:17 15,079 -ra—— c:\windows\atiogl.xml
2009-02-13 18:58 . 2009-01-05 09:17 7,167 -ra—— c:\windows\system32\atifglpf.xml
2009-02-13 18:58 . 2009-01-05 09:17 529 -ra—— c:\windows\system32\ATIODCLI.exe.manifest
2009-02-13 18:58 . 2009-01-05 09:17 527 -ra—— c:\windows\system32\ATIODE.exe.manifest
2009-02-12 19:41 . 2009-02-12 19:40 102,664 –a—— c:\windows\system32\drivers\tmcomm.sys
2009-02-12 18:57 . 2009-02-12 18:57 d——– c:\documents and settings\All Users\Application Data\PC Drivers HeadQuarters
2009-02-08 19:44 . 2009-02-08 19:44 682,280 –a—— c:\windows\system32\pbsvc.exe
2009-02-08 19:44 . 2009-02-08 19:44 22,328 –a—— c:\documents and settings\jeremy\Application Data\PnkBstrK.sys
2009-02-01 18:21 . 2009-02-01 18:21 d——– c:\documents and settings\All Users\Application Data\NVIDIA Corporation
2009-02-01 18:20 . 2005-06-13 16:28 671,744 –a—— c:\windows\system32\DolbyHph.dll
2009-02-01 18:20 . 2005-06-13 16:29 60,416 –a—— c:\windows\system32\DSETUP.dll
2009-02-01 18:20 . 2005-06-30 12:23 4,608 –a—— c:\windows\system32\drivers\nvport.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-16 22:11 ——— d—–w c:\program files\Google
2009-02-16 21:55 ——— d—–w c:\program files\QUICKENW
2009-02-16 21:45 ——— d—–w c:\documents and settings\All Users\Application Data\WildTangent
2009-02-16 21:36 ——— d—–w c:\program files\Common Files\Adobe
2009-02-16 20:21 ——— d—–w c:\documents and settings\All Users\Application Data\Symantec
2009-02-16 04:38 96,384 —-a-w c:\windows\system32\drivers\sptd5869.sys
2009-02-15 17:44 ——— d—–w c:\documents and settings\All Users\Application Data\Viewpoint
2009-02-15 13:23 ——— d—–w c:\documents and settings\All Users\Application Data\AOL
2009-02-15 13:19 ——— d—–w c:\program files\Creative
2009-02-15 13:18 ——— d–h–w c:\program files\InstallShield Installation Information
2009-02-15 13:16 ——— d—–w c:\program files\MAIET
2009-02-14 00:02 ——— d—–w c:\program files\ATI Technologies
2009-02-13 03:42 ——— d—–w c:\program files\World of Warcraft
2009-02-13 01:37 4,649 —-a-w c:\windows\compaq.reg
2009-02-09 00:47 202,352 -c–a-w c:\windows\system32\PnkBstrB.exe
2009-02-09 00:47 138,624 -c–a-w c:\windows\system32\drivers\PnkBstrK.sys
2009-02-09 00:44 66,872 -c–a-w c:\windows\system32\PnkBstrA.exe
2009-02-09 00:27 ——— d—–w c:\program files\America's Army
2009-02-08 23:32 ——— d—–w c:\program files\America's Army Deploy Client
2009-02-01 23:20 ——— d—–w c:\program files\NVIDIA Corporation
2009-02-01 23:11 ——— d—–w c:\documents and settings\jeremy\Application Data\LimeWire
2009-01-13 23:58 ——— d—–w c:\program files\DivX
2009-01-07 22:12 ——— d—–w c:\program files\ComcastToolbar
2009-01-07 22:10 ——— d—–w c:\documents and settings\jeremy\Application Data\Petroglyph
2009-01-07 19:06 ——— d—–w c:\documents and settings\jeremy\Application Data\ATI
2009-01-07 19:03 ——— d—–w c:\documents and settings\Guest\Application Data\ATI
2009-01-05 14:19 2,495,360 —-a-w c:\windows\system32\ativvaxx.dll
2009-01-05 14:19 147,456 —-a-w c:\windows\system32\Oemdspif.dll
2009-01-05 14:18 286,720 —-a-w c:\windows\system32\atiok3x2.dll
2009-01-05 14:18 24,064 —-a-w c:\windows\system32\ativcoxx.dll
2009-01-05 14:18 188,416 —-a-w c:\windows\system32\atipdlxx.dll
2009-01-05 14:18 17,408 —-a-w c:\windows\system32\atitvo32.dll
2009-01-05 14:18 11,304,960 —-a-w c:\windows\system32\atioglxx.dll
2009-01-05 14:17 81,920 —-a-w c:\windows\system32\ATIODE.exe
2009-01-05 14:17 45,056 —-a-w c:\windows\system32\ATIODCLI.exe
2009-01-05 14:17 401,408 —-a-w c:\windows\system32\atikvmag.dll
2009-01-05 14:16 86,016 —-a-w c:\windows\system32\atiadlxx.dll
2009-01-05 14:16 598,016 —-a-w c:\windows\system32\ati2evxx.exe
2009-01-05 14:16 53,248 —-a-w c:\windows\system32\ATIDDC.DLL
2009-01-05 14:16 4,120,384 —-a-w c:\windows\system32\ati3duag.dll
2009-01-05 14:16 3,452,928 —-a-w c:\windows\system32\drivers\ati2mtag.sys
2009-01-05 14:16 26,112 —-a-w c:\windows\system32\Ati2mdxx.exe
2009-01-05 14:16 118,784 —-a-w c:\windows\system32\atibrtmon.exe
2009-01-05 14:15 577,536 —-a-w c:\windows\system32\ati2cqag.dll
2009-01-05 14:15 53,248 —-a-w c:\windows\system32\drivers\ati2erec.dll
2009-01-05 14:15 48,640 —-a-w c:\windows\system32\amdpcom32.dll
2009-01-05 14:15 45,056 —-a-w c:\windows\system32\amdcalrt.dll
2009-01-05 14:15 45,056 —-a-w c:\windows\system32\amdcalcl.dll
2009-01-05 14:15 43,520 —-a-w c:\windows\system32\ati2edxx.dll
2009-01-05 14:15 318,464 —-a-w c:\windows\system32\ati2dvag.dll
2009-01-05 14:15 3,252,224 —-a-w c:\windows\system32\Amdcaldd.dll
2009-01-05 14:15 143,360 —-a-w c:\windows\system32\ati2evxx.dll
2008-12-27 22:30 ——— d—–w c:\documents and settings\jeremy\Application Data\Ventrilo
2008-12-27 22:26 ——— d—–w c:\program files\Ventrilo
2008-12-27 22:26 ——— d—–w c:\program files\Common Files\Wise Installation Wizard
2008-12-17 05:34 ——— d—–w c:\program files\TrackMania Nations ESWC
2008-12-11 00:33 86,016 —-a-w c:\windows\system32\dpl100.dll
2008-12-11 00:33 200,704 —-a-w c:\windows\system32\dtu100.dll
2008-12-09 02:28 593,920 —-a-w c:\windows\system32\dpuGUI11.dll
2008-12-09 02:28 57,344 —-a-w c:\windows\system32\dpv11.dll
2008-12-09 02:28 344,064 —-a-w c:\windows\system32\dpus11.dll
2008-12-09 02:28 294,912 —-a-w c:\windows\system32\dpu11.dll
2006-11-23 06:19 24,192 -c–a-w c:\documents and settings\jeremy\usbsermptxp.sys
2006-11-23 06:19 22,768 -c–a-w c:\documents and settings\jeremy\usbsermpt.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-05-27 413696]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 204288]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2006-05-17 180269]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-29 61440]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-05-27 413696]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2006-05-17 180269]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"GrpConv"="grpconv -o" [X]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="c:\windows\system32\logonuiX.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.SP54"= SP5X_32.DLL

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=c:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Belkin Wireless G USB Adapter Client Utility.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Belkin Wireless G USB Adapter Client Utility.lnk
backup=c:\windows\pss\Belkin Wireless G USB Adapter Client Utility.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^PI Monitor.lnk]

[HKLM\~\startupfolder\C:^Documents and Settings^jeremy^Start Menu^Programs^Startup^Adobe Gamma.lnk]

[HKLM\~\startupfolder\C:^Documents and Settings^jeremy^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
path=c:\documents and settings\jeremy\Start Menu\Programs\Startup\LimeWire On Startup.lnk
backup=c:\windows\pss\LimeWire On Startup.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^jeremy^Start Menu^Programs^Startup^Xfire.lnk]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
–a–c— 2008-07-03 01:23 116040 c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CPQEASYACC]
–a–c— 2001-12-15 00:01 32768 c:\program files\compaq\Easy Access Button Support\STARTEAK.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ddoctorv2]
–a—— 2008-04-24 12:25 202560 c:\program files\Comcast\Desktop Doctor\bin\sprtcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EA Core]
–a—— 2008-07-21 13:07 2752512 c:\program files\Electronic Arts\EADM\Core.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
–a–c— 2002-05-15 05:20 114688 c:\windows\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpsysdrv]
–a–c— 1998-05-07 18:04 52736 c:\windows\system\hpsysdrv.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
–a–c— 2002-05-15 05:29 155648 c:\windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
–a–c— 2008-07-09 12:30 289064 c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogonStudio]
–a–c— 2002-09-03 17:38 987187 c:\program files\WinCustomize\LogonStudio\LogonStudio.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MRT]
–a–c— 2009-02-11 20:56 21244872 c:\windows\system32\MRT.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
——— 2008-04-13 19:12 1695232 c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a–c— 2008-05-27 09:50 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Recguard]
–a–c— 2002-07-04 19:55 212992 c:\windows\SMINST\Recguard.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\srmclean]
–a–c— 2001-07-24 23:34 36864 c:\cpqs\scom\srmclean.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
–a—— 2008-08-29 17:11 61440 c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StorageGuard]
–a–c— 2002-05-09 10:01 155648 c:\program files\VERITAS Software\Update Manager\sgtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
–a–c— 2005-11-10 12:03 36975 c:\program files\Java\jre1.5.0_06\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
–a–c— 2006-05-17 18:42 180269 c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WCOLOREAL]
–a–c— 2002-02-20 21:40 143360 c:\program files\compaq\Coloreal\COLOREAL.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
—–c— 2006-10-18 20:05 204288 c:\program files\Windows Media Player\wmpnscfg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcxMonitor]
–a—— 2004-09-07 13:47 57344 c:\windows\ALCXMNTR.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\P17Helper]
–a–c— 2005-05-03 19:38 64512 c:\windows\system32\P17.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Bonjour Service"=2 (0x2)
"x10nets"=3 (0x3)
"WMPNetworkSvc"=2 (0x2)
"Viewpoint Manager Service"=2 (0x2)
"StarWindService"=2 (0x2)
"sprtsvc_ddoctorv2"=2 (0x2)
"PnkBstrB"=2 (0x2)
"PnkBstrA"=2 (0x2)
"msCMTSrvc"=3 (0x3)
"iPod Service"=3 (0x3)
"ImapiService"=3 (0x3)
"gusvc"=2 (0x2)
"GameConsoleService"=3 (0x3)
"Fax"=2 (0x2)
"Compaq_RBA"=2 (0x2)
"Apple Mobile Device"=2 (0x2)
"Adobe LM Service"=3 (0x3)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Westwood\\Renegade\\Game.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\America's Army\\System\\ArmyOps.exe"=
"c:\\Program Files\\TrackMania Nations ESWC\\TmNationsESWC.exe"=
"c:\\Program Files\\TrackMania Nations ESWC\\TrackManiaServer.exe"=
"c:\\Program Files\\America's Army\\System\\Server.exe"=
"c:\\Westwood\\Renegade\\Game2.exe"=
"c:\\Program Files\\Real\\RealOne Player\\realplay.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Sony\\Station\\LaunchPad\\LaunchPad.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Electronic Arts\\EADM\\Core.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\America's Army Deploy Client\\AADeployClient.exe"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\World of Warcraft\\Launcher.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724
"1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015
"1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016
"500:UDP"= 500:UDP:@xpsp2res.dll,-22017

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-02-15 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-02-15 20560]
R2 SVKP;SVKP;c:\windows\system32\SVKP.sys [2006-08-31 2368]
R3 AtiHdmiService;ATI Function Driver for HDMI Service;c:\windows\system32\drivers\AtiHdmi.sys [2009-02-13 93184]
S0 ecppolmr;ecppolmr;c:\windows\system32\drivers\kfznmkkv.sys –> c:\windows\system32\drivers\kfznmkkv.sys [?]
S0 ecxlkbix;ecxlkbix;c:\windows\system32\drivers\ydlgbhfd.sys –> c:\windows\system32\drivers\ydlgbhfd.sys [?]
S0 oqcsxypd;oqcsxypd;c:\windows\system32\drivers\pvbsltru.sys –> c:\windows\system32\drivers\pvbsltru.sys [?]
S0 zqqcysuu;zqqcysuu;c:\windows\system32\drivers\fphgvlkj.sys –> c:\windows\system32\drivers\fphgvlkj.sys [?]
S3 BELKIN;Belkin Wireless G USB Network Adapter;c:\windows\system32\drivers\BLKWGU.sys [2007-12-18 238848]
S3 JSINMIS;JSINMIS;c:\docume~1\jeremy\LOCALS~1\Temp\JSINMIS.exe –> c:\docume~1\jeremy\LOCALS~1\Temp\JSINMIS.exe [?]
S3 PBDOWNFORCE_SERVICE;PBDOWNFORCE_SERVICE;c:\documents and settings\jeremy\Desktop\gamefiles\PBDownForce.sys [2006-08-05 20480]
S3 PBDOWNFORCE_TEST_SERVICE;PBDOWNFORCE_TEST_SERVICE;\??\c:\documents and settings\jeremy\Desktop\gamefiles\Test.sys –> c:\documents and settings\jeremy\Desktop\gamefiles\Test.sys [?]
S4 mlwchsjd;mlwchsjd;c:\windows\system32\drivers\ouwvgpkl.sys –> c:\windows\system32\drivers\ouwvgpkl.sys [?]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J]
\Shell\AutoRun\command - J:\autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\K]
\Shell\AutoRun\command - K:\autorun.exe
.
Contents of the 'Scheduled Tasks' folder

2009-02-03 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:57]

2005-12-07 c:\windows\Tasks\Registration reminder 3.job
- c:\windows\System32\OOBE\oobebaln.exe [2008-04-13 19:12]

2007-06-24 c:\windows\Tasks\Uniblue SpeedUpMyPC.job
- c:\program files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe []
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-ATI DeviceDetect - c:\program files\ATI Multimedia\main\ATIDtct.EXE
HKLM-Run-prunnet - c:\windows\system32\prunnet.exe
HKLM-RunOnce- - (no file)
MSConfigStartUp-MsnMsgr - c:\program files\MSN Messenger\msnmsgr.exe
MSConfigStartUp-NAV Agent - c:\progra~1\NORTON~1\navapw32.exe


.
——- Supplementary Scan ——-
.
mWindow Title = Windows Internet Explorer provided by Comcast
uInternet Connection Wizard,ShellNext = iexplore
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\jeremy\Application Data\Mozilla\Firefox\Profiles\b5n4lzny.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.e30tech.com/forum/index.php
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava11.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava12.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava13.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava14.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava32.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJPI150_06.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPOJI610.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npagent.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nppl3260.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nprjplug.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nprpjplug.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-16 19:18:11
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-4021508746-488748980-3615762775-1006\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_USERS\S-1-5-21-4021508746-488748980-3615762775-1006\Software\SecuROM\License information*]
"datasecu"=hex:a9,30,38,3a,49,dd,3a,96,79,df,7d,08,47,ee,64,48,f7,5e,f5,7c,44,
5b,c3,54,ab,ba,3c,9f,27,e0,1d,cc,3d,75,2b,d1,ec,2e,97,4b,f6,51,3d,9e,8d,16,\
"rkeysecu"=hex:e2,26,6d,94,9c,ba,ad,1d,64,79,70,1b,d8,19,de,23
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(576)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2009-02-16 19:21:07
ComboFix-quarantined-files.txt 2009-02-17 00:20:31
ComboFix2.txt 2009-02-16 18:22:21

Pre-Run: 56,022,032,384 bytes free
Post-Run: 56,001,794,048 bytes free

Current=5 Default=5 Failed=4 LastKnownGood=6 Sets=1,2,3,4,5,6
348 — E O F — 2009-02-16 08:02:47
Post #12
You need To disable TeaTimer, it can stop our fix. The best way is to do both, Right click the system tray icon and shut down. This will reset TT's registry snapshot. Then, open spybot in advanced mode and turn it off. When cleaning is done, open Spybot in advanced mode to turn back on. Once fix is completed in the all clear post!! I'm getting ready to eat dinner. Will be back in about 30 mins.
Post #13
ok spybot has been disabled im not sure if i should restart my pc before we continue so we make sure it doesnt come back on but i made sure all the startup and automatic settings were turned off..btw thanks in advance for all your help enjoy your dinner take your time and im gonna run to the stor be back in 10 :)
Post #14
Copy/paste the text in the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text. 

File::
c:\windows\zkvyrebe
c:\windows\qeietljl
c:\windows\ecppolmr
c:\windows\system32\drivers\kfznmkkv.sys
c:\windows\system32\drivers\ydlgbhfd.sys
c:\windows\system32\drivers\pvbsltru.sys
c:\windows\system32\drivers\fphgvlkj.sys
c:\docume~1\jeremy\LOCALS~1\Temp\JSINMIS.exe
c:\windows\system32\drivers\ouwvgpkl.sys 

Driver::
ecppolmr
ecxlkbix
oqcsxypd
zqqcysuu
mlwchsjd

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\K]

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:
1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …


[external image: Posted Image]

Drag CFScript.txt into ComboFix.exe

Then post the results log and a new HijackThis log.


Also please describe how your computer behaves at the moment.
Post #15
i just removed spybot all together cause i dont really need it ijust downloaded it to try and help me but it didnt do much so ill just get rid of it

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI