Spyware / Malware / Virus Removal

[Resolved] [Closed] Being redirected to random webistes (cow

14 min read

Looking for the outcome? Ask AI

Fenrir Topic Starter

Post #1April 12, 2009, 10:10 PM UTC last edited April 12, 2009, 10:28 PM UTC

Hi everyone, not sure if this is the right section, but it won't let me start a topic in the other one, so I suppose it must be.

My computer is randomly being redirected to various websites such as the cow survey website, and just random carp** is happening. My windows security updates keep failing- not sure if this is related, but it's still annoying, and I can't really surf the web because of the redirection problems. What kind of scan or log file do I need to post so you guys can look at it and tell me what's wrong?
Thanks ahead of time.

Oh- read help section, here's my hijack this thingy-
Also- I've scanned with Spybot SnD and F Prot Antivirus and neither picked up nething.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:23:44 PM, on 4/12/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\arservice.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\FRISK Software\F-PROT Antivirus for Windows\FPAVServer.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\ARPWRMSG.EXE
C:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/?fr=fp-yie8
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo!
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE
O4 - HKLM\..\Run: [DMAScheduler] "c:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe"
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
O4 - HKLM\..\Run: [QUICKCARE] C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe /P QUICKCARE
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [F-PROT Antivirus Tray application] C:\Program Files\FRISK Software\F-PROT Antivirus for Windows\FProtTray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Carbonite Backup] C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [ALCMTR] ALCMTR.EXE
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Intelinet] C:\Program Files\Intelinet\Intelinet.exe
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - Global Startup: WinCinema Manager.lnk = C:\Program Files\Sandisk\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: PackageCab - http://ak.imgag.com/imgag/cp/install/AxCtp2.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eB…l_v1-0-3-48.cab
O16 - DPF: {54BE6B6F-3056-470B-97E1-BB92E051B6C4} (DeviceEnum Class) - http://h20264.www2.hp.com/ediags/dd/instal…nosticsxp2k.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {A8683C98-5341-421B-B23C-8514C05354F1} (FujifilmUploader Class) - http://www.samsphotoclub.com/upload/FujifilmUploadClient.cab
O16 - DPF: {BB383206-6DA1-4E80-B62A-3DF950FCC697} (Create & Print ActiveX Plug-in) - http://ak.imgag.com/imgag/cp/install/AxCtp2.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flas…ent/swflash.cab
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: F-PROT Antivirus for Windows system (FPAVServer) - FRISK Software International - C:\Program Files\FRISK Software\F-PROT Antivirus for Windows\FPAVServer.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: IntelinetSecure - Unknown owner - C:\Program Files\Intelinet\intelin2.exe (file missing)
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE

–
End of file - 9784 bytes

jpshortstuff

Post #2April 14, 2009, 11:59 AM UTC

Hi,

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.

Please download Malwarebytes' Anti-Malware to your desktop.

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform full scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. Please save it to a convenient location.
The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt
Post that log back here.

Please download DDS and save it to your desktop.

Disable any script blocking protection
Double click dds.scr to run the tool.
When done two logs should open:
DDS.txt
Attach.txt

Save both reports to your desktop.

—————————————————

Post the contents of the DDS.txt report in your next reply
Attach the Attach.txt report to your post by scrolling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and then click UPLOAD.

Thanks.

Fenrir

Post #3April 15, 2009, 2:10 AM UTC

First off, it won't let me onto the bleepingcomputer.com website so I downloaded the dds.scr thing from three separate sites and after every download, upon double clicking file, it would briefly flash and then nothing would happen. So… not sure what I should do, or what I'm supposed to expect when I click on the file. Oh, and that malwarbytes thing removed quite a bit, but it's still randomly redirecting websites- it seems like it's not quite as bad as before but that could just be my optimism shining through

Anyways thx for the help. Anyways, here's my mbam-log Malwarebytes' Anti-Malware 1.36 Database version: 1945 Windows 5.1.2600 Service Pack 2 4/14/2009 6:39:28 PM mbam-log-2009-04-14 (18-39-28).txt Scan type: Full Scan (C:\|D:\|) Objects scanned: 205407 Time elapsed: 1 hour(s), 9 minute(s), 5 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 4 Registry Values Infected: 2 Registry Data Items Infected: 0 Folders Infected: 3 Files Infected: 103 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b64f4a7c-97c9-11da-8bde-f66bad1e3f3a} (Rogue.WinAntivirus) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{2d2bee6e-3c9a-4d58-b9ec-458edb28d0f6} (Rogue.DriveCleaner) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IntelinetSecure (Rogue.Intelinet) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Intelinet (Rogue.Intelinet) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{cc3596cb-d6c1-eca1-ae51-deea63f6c21c} (Spyware.OnLineGames) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Intelinet (Rogue.Intelinet) -> Quarantined and deleted successfully. Registry Data Items Infected: (No malicious items detected) Folders Infected: C:\Program Files\Intelinet (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Backup (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs (Rogue.Intelinet) -> Quarantined and deleted successfully. Files Infected: C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP1017\A0452541.exe (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Backup\{00C9DFFC-289C-44FE-8AD6-73C3BDB5B894}.rbk (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Backup\{04C1ED41-AD83-4D6A-92A6-C5F8F329FB4E}.rbk (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Backup\{1953BF2B-68A1-4CDA-B6FD-9DBAD2549C49}.rbk (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Backup\{255AA25E-1EFA-4948-BF0F-03DB072D01DA}.rbk (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Backup\{4ED18504-F358-4EC3-8325-2EBC035379EA}.rbk (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Backup\{6181138B-119E-4CD2-8F01-DA5DBC077D1D}.rbk (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Backup\{94826C99-289C-40B2-A16D-5308CF283BA0}.rbk (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Backup\{B82C3F88-8D9D-4706-B2DA-F3DAE67E7302}.rbk (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2008_12_27.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2008_12_28.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2008_12_29.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2008_12_30.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2008_12_31.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_01_01.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_01_02.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_01_03.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_01_04.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_01_05.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_01_06.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_01_07.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_01_08.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_01_09.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_01_10.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_01_11.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_01_12.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_01_13.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_01_14.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_01_15.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_01_16.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_01_17.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_01_18.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_01_19.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_01_22.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_01_23.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_01_25.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_01_28.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_01_30.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_02_01.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_02_02.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_02_03.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_02_04.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_02_06.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_02_07.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_02_08.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_02_09.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_02_11.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_02_12.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_02_13.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_02_14.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_02_15.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_02_16.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_02_17.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_02_18.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_02_19.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_02_20.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_02_21.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_02_22.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_02_23.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_02_24.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_02_25.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_02_26.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_02_27.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_02_28.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_03_01.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_03_02.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_03_06.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_03_07.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_03_08.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_03_09.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_03_10.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_03_11.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_03_12.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_03_13.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_03_14.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_03_15.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_03_16.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_03_17.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_03_18.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_03_19.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_03_20.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_03_22.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_03_23.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_03_24.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_03_25.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_03_26.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_03_27.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_03_28.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_03_29.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_03_30.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_03_31.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_04_01.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_04_02.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_04_03.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_04_04.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_04_05.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_04_06.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_04_07.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_04_08.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_04_09.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_04_10.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Program Files\Intelinet\Logs\2009_04_11.log (Rogue.Intelinet) -> Quarantined and deleted successfully. C:\Documents and Settings\HP_Administrator\Desktop\Intelinet_Internet_Security_Suite_complete_registry_spyware_adware_solution .exe (Rogue.Intelinet) -> Quarantined and deleted successfully.

jpshortstuff

Post #4April 15, 2009, 9:19 AM UTC

Hi,

Please download DaonolFix from the link below and save it to your Desktop
Download Mirror #1

Double-click DaonolFix.exe to run it.
Select 1. Find Daonol (no fix) by typing 1 and pressing Enter.
You will see a lot of files being listed - don't worry, they are just being scanned.
A log will open, please post the contents of that log in your next reply (it can also be found on your desktop, called DaonolFix.txt).

Download ComboFix by sUBs from here or here

Note: If you already have a copy of ComboFix on your system it is essential that you delete it before downloading this copy.

**Save it to your desktop**

We need to disable one or more of your security programs so that they do not interfere with ComboFix.

You need to disable TeaTimer, so that it doesn't interfere with our fix.

This is a two step process.
First step:

Right-click the Spybot Icon in the System Tray (looks like a blue/white calendar with a padlock symbol)
If you have the new version 1.5, click once on Resident Protection, then right-click the Spybot icon again and make sure Resident Protection is now Unchecked. The Spybot icon in the System tray should now be now colorless.
If you have Version 1.4, Click on Exit Spybot S&D Resident

Second step, For both versions :

Open Spybot S&D
Click Mode, choose Advanced Mode
Go to the bottom of the vertical panel on the left, click Tools
Then, also in left panel, click Resident shows a red/white shield.
If your firewall raises a question, say OK
In the Resident protection status frame, Uncheck the box labeled Resident "Tea-Timer"(Protection of over-all system settings) active
OK any prompts.
Use File, Exit to terminate Spybot
Reboot your machine for the changes to take effect.

Double click on ComboFix.exe & follow the prompts. If you are prompted to install the Recovery Console I recommend you go ahead and hit yes.
When finished, it shall produce a log for you. Please save that log to post in your next reply along with a fresh HJT log

Notes:

Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you - please let me know.
ComboFix disconnects your machine from the internet when it runs. This connection should be automatically restored when ComboFix completes its run. If ComboFix runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Fenrir

Post #5April 16, 2009, 3:12 AM UTC

Here's Daonol Fix log: thx for all the help by the way. regardless of whether my computer gets fixed, i still appreciate the effort DaonolFix (15.04.09) by jpshortstuff Log created at 21:07 on 15/04/2009 by HP_Administrator Running from C:\Documents and Settings\[removed]\Desktop\DaonolFix.exe =====Find Daonol===== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32] "aux"="wdmaud.drv" "aux1"="wdmaud.drv" "aux2"="C:\WINDOWS\system32\..\usjkf.cel" "midi"="wdmaud.drv" "midi1"="wdmaud.drv" "midimapper"="midimap.dll" "mixer"="wdmaud.drv" "mixer1"="wdmaud.drv" "msacm.iac2"="C:\WINDOWS\system32\iac25_32.ax" "msacm.imaadpcm"="imaadp32.acm" "msacm.l3acm"="C:\WINDOWS\system32\l3codeca.acm" "msacm.msadpcm"="msadp32.acm" "msacm.msaudio1"="msaud32.acm" "msacm.msg711"="msg711.acm" "msacm.msg723"="msg723.acm" "msacm.msgsm610"="msgsm32.acm" "msacm.sl_anet"="sl_anet.acm" "msacm.trspch"="tssoft32.acm" "vidc.cvid"="iccvid.dll" "vidc.I420"="msh263.drv" "vidc.iv31"="ir32_32.dll" "vidc.iv32"="ir32_32.dll" "vidc.iv41"="ir41_32.ax" "vidc.iv50"="ir50_32.dll" "vidc.iyuv"="iyuv_32.dll" "vidc.LEAD"="LCODCCMP.DLL" "vidc.M261"="msh261.drv" "vidc.M263"="msh263.drv" "vidc.mrle"="msrle32.dll" "vidc.msvc"="msvidc32.dll" "vidc.uyvy"="msyuv.dll" "vidc.yuy2"="msyuv.dll" "vidc.yvu9"="tsbyuv.dll" "vidc.yvyu"="msyuv.dll" "wave"="wdmaud.drv" "wave1"="wdmaud.drv" "wavemapper"="msacm32.drv" -=Daonol Files=- (none found) -=End Of File=-

Fenrir

Post #6April 16, 2009, 3:48 AM UTC

ComboFix 09-04-15.08 - HP_Administrator 04/15/2009 21:22.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.959.555 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: F-PROT Antivirus for Windows *On-access scanning disabled* (Updated)
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\IE4 Error Log.txt
D:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2009-03-16 to 2009-04-16 )))))))))))))))))))))))))))))))
.

2009-04-14 22:48 . 2009-04-14 22:48 ——– d—–w c:\documents and settings\HP_Administrator\Application Data\Malwarebytes
2009-04-14 22:48 . 2009-04-06 21:32 15504 —-a-w c:\windows\system32\drivers\mbam.sys
2009-04-14 22:48 . 2009-04-06 21:32 38496 —-a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-14 22:48 . 2009-04-14 22:48 ——– d—–w c:\program files\Malwarebytes' Anti-Malware
2009-04-14 22:48 . 2009-04-14 22:48 ——– d—–w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-04-12 22:22 . 2009-04-12 22:22 ——– d—–w c:\program files\Trend Micro
2009-04-05 20:29 . 2009-04-05 20:29 ——– d—–w c:\program files\Common Files\AnswerWorks 5.0
2009-04-05 20:29 . 2008-12-08 04:14 1848608 —-a-w c:\windows\system32\acXMLParser.dll
2009-04-05 20:29 . 2008-12-08 04:14 3523872 —-a-w c:\windows\system32\cdintf300.dll
2009-04-01 18:33 . 2009-04-01 18:33 ——– d-sh–w c:\documents and settings\HP_Administrator\IECompatCache
2009-03-28 16:06 . 2009-03-28 16:06 ——– d-sh–w c:\documents and settings\HP_Administrator\PrivacIE
2009-03-28 16:02 . 2009-03-28 16:02 ——– d-sh–w c:\documents and settings\LocalService\IETldCache
2009-03-28 16:01 . 2009-03-28 16:01 ——– d-sh–w c:\documents and settings\HP_Administrator\IETldCache
2009-03-28 15:55 . 2009-03-28 15:55 ——– d—–w c:\windows\ie8updates
2009-03-28 15:53 . 2009-04-12 18:50 ——– d—–w c:\documents and settings\All Users\Application Data\Yahoo!
2009-03-28 15:53 . 2009-03-28 15:53 ——– d—–w c:\documents and settings\HP_Administrator\Application Data\Yahoo!
2009-03-28 15:49 . 2009-03-28 15:52 ——– dc-h–w c:\windows\ie8
2009-03-28 15:49 . 2009-03-28 15:57 ——– d–h–w c:\windows\msdownld.tmp
2009-03-28 15:46 . 2009-02-28 04:55 105984 ——w c:\windows\system32\dllcache\iecompat.dll
2009-03-25 23:52 . 2009-03-25 23:52 ——– d—–w c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2009-03-25 15:09 . 2009-03-25 15:09 ——– d—–w c:\documents and settings\HP_Administrator\Local Settings\Application Data\Real
2009-03-25 15:08 . 2009-03-25 15:08 ——– d—–w c:\program files\Common Files\xing shared
2009-03-25 15:05 . 2009-03-25 15:05 ——– d—–w c:\documents and settings\LocalService\Local Settings\Application Data\Google
2009-03-25 01:31 . 2009-03-30 13:50 ——– d—–w C:\business

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-16 02:56 . 2006-06-21 14:00 94208 —-a-w c:\windows\DUMP4863.tmp
2009-04-16 01:49 . 2007-03-25 14:45 ——– d—–w c:\program files\Microsoft Publisher
2009-04-14 02:21 . 2007-04-09 22:18 ——– d—–w c:\program files\QUICKENW
2009-04-12 19:22 . 2006-10-11 02:07 ——– d—–w c:\program files\Spybot - Search & Destroy
2009-04-12 19:22 . 2006-10-11 02:07 ——– d—–w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-04-12 19:16 . 2008-11-12 23:54 ——– d—–w c:\program files\TeaTimer (Spybot - Search & Destroy)
2009-04-12 19:12 . 2006-06-21 15:19 ——– d—–w c:\program files\Google
2009-04-12 19:10 . 2006-10-10 22:57 ——– d—–w c:\program files\Linksys Wireless-G USB Wireless Network Monitor
2009-04-12 19:07 . 2007-06-07 06:15 ——– d—–w c:\documents and settings\All Users\Application Data\Viewpoint
2009-04-12 19:02 . 2008-02-29 05:43 ——– d—–w c:\documents and settings\HP_Administrator\Application Data\Move Networks
2009-04-12 18:59 . 2006-06-21 14:58 ——– d—–w c:\program files\Hewlett-Packard
2009-04-12 18:57 . 2007-10-09 14:07 ——– d—–w c:\program files\DivX
2009-04-12 18:55 . 2006-06-21 14:13 ——– d—–w c:\program files\Java
2009-04-12 18:51 . 2007-01-02 05:43 ——– d—–w c:\program files\IrfanView
2009-04-12 18:50 . 2006-12-28 20:13 ——– d—–w c:\program files\Yahoo!
2009-04-12 18:49 . 2006-06-21 14:30 ——– d–h–w c:\program files\InstallShield Installation Information
2009-04-12 18:49 . 2006-06-21 15:05 ——– d—–w c:\program files\Common Files\muvee Technologies
2009-04-12 18:48 . 2006-06-21 15:05 ——– d—–w c:\program files\muvee Technologies
2009-04-12 18:41 . 2007-06-07 06:16 ——– d—–w c:\documents and settings\All Users\Application Data\AOL
2009-04-12 18:40 . 2006-06-21 14:51 ——– d—–w c:\program files\Sonic
2009-04-12 18:37 . 2006-06-21 14:08 ——– d—–w c:\program files\GemMaster
2009-04-11 13:40 . 2008-12-27 19:57 0 —-a-w C:\proc.id
2009-04-11 13:40 . 2008-12-27 19:57 0 —-a-w C:\asdasd.asdasd
2009-04-05 20:48 . 2006-06-21 15:07 ——– d—–w c:\program files\Quicken
2009-03-25 15:08 . 2006-06-21 14:49 ——– d—–w c:\program files\Common Files\Real
2009-03-09 18:46 . 2006-10-09 06:34 45608 —-a-w c:\documents and settings\HP_Administrator\Application Data\wklnhst.dat
2009-03-09 11:19 . 2008-12-17 01:34 410984 —-a-w c:\windows\system32\deploytk.dll
2009-03-08 20:09 . 2004-08-09 21:00 638816 —-a-w c:\windows\system32\dllcache\iexplore.exe
2009-03-08 20:09 . 2004-08-09 21:00 391536 —-a-w c:\windows\system32\dllcache\iedkcs32.dll
2009-03-08 10:41 . 2004-08-09 21:00 5937152 —-a-w c:\windows\system32\dllcache\mshtml.dll
2009-03-08 10:39 . 2007-05-09 12:51 11063808 —-a-w c:\windows\system32\dllcache\ieframe.dll
2009-03-08 10:34 . 2004-08-09 21:00 914944 —-a-w c:\windows\system32\wininet.dll
2009-03-08 10:34 . 2004-08-09 21:00 914944 —-a-w c:\windows\system32\dllcache\wininet.dll
2009-03-08 10:34 . 2004-08-09 21:00 1206784 —-a-w c:\windows\system32\dllcache\urlmon.dll
2009-03-08 10:34 . 2004-08-09 21:00 236544 —-a-w c:\windows\system32\dllcache\webcheck.dll
2009-03-08 10:34 . 2004-08-09 21:00 43008 —-a-w c:\windows\system32\licmgr10.dll
2009-03-08 10:34 . 2004-08-09 21:00 43008 —-a-w c:\windows\system32\dllcache\licmgr10.dll
2009-03-08 10:34 . 2004-08-09 21:00 105984 —-a-w c:\windows\system32\dllcache\url.dll
2009-03-08 10:34 . 2004-08-09 21:00 193536 —-a-w c:\windows\system32\dllcache\msrating.dll
2009-03-08 10:34 . 2004-08-09 21:00 109568 —-a-w c:\windows\system32\dllcache\occache.dll
2009-03-08 10:33 . 2004-08-09 21:00 759296 —-a-w c:\windows\system32\dllcache\VGX.dll
2009-03-08 10:33 . 2009-03-08 10:33 18944 ——w c:\windows\system32\dllcache\corpol.dll
2009-03-08 10:33 . 2004-08-09 21:00 18944 —-a-w c:\windows\system32\corpol.dll
2009-03-08 10:33 . 2004-08-09 21:00 25600 —-a-w c:\windows\system32\dllcache\jsproxy.dll
2009-03-08 10:33 . 2009-03-08 10:33 726528 ——w c:\windows\system32\dllcache\jscript.dll
2009-03-08 10:33 . 2004-08-09 21:00 229376 —-a-w c:\windows\system32\dllcache\ieaksie.dll
2009-03-08 10:33 . 2009-03-08 10:33 420352 ——w c:\windows\system32\dllcache\vbscript.dll
2009-03-08 10:33 . 2004-08-09 21:00 420352 —-a-w c:\windows\system32\vbscript.dll
2009-03-08 10:33 . 2004-08-09 21:00 125952 —-a-w c:\windows\system32\dllcache\ieakeng.dll
2009-03-08 10:32 . 2004-08-09 21:00 72704 —-a-w c:\windows\system32\dllcache\admparse.dll
2009-03-08 10:32 . 2004-08-09 21:00 72704 —-a-w c:\windows\system32\admparse.dll
2009-03-08 10:32 . 2004-08-09 21:00 173056 —-a-w c:\windows\system32\dllcache\ie4uinit.exe
2009-03-08 10:32 . 2004-08-09 21:00 163840 —-a-w c:\windows\system32\dllcache\ieakui.dll
2009-03-08 10:32 . 2004-08-09 21:00 71680 —-a-w c:\windows\system32\iesetup.dll
2009-03-08 10:32 . 2004-08-09 21:00 71680 —-a-w c:\windows\system32\dllcache\iesetup.dll
2009-03-08 10:32 . 2004-08-09 21:00 55808 —-a-w c:\windows\system32\dllcache\iernonce.dll
2009-03-08 10:32 . 2004-08-09 21:00 128512 —-a-w c:\windows\system32\dllcache\advpack.dll
2009-03-08 10:32 . 2004-08-09 21:00 94720 —-a-w c:\windows\system32\dllcache\inseng.dll
2009-03-08 10:32 . 2007-05-09 12:51 594432 —-a-w c:\windows\system32\dllcache\msfeeds.dll
2009-03-08 10:32 . 2007-05-09 12:51 1985024 —-a-w c:\windows\system32\dllcache\iertutil.dll
2009-03-08 10:32 . 2004-08-09 21:00 611840 —-a-w c:\windows\system32\dllcache\mstime.dll
2009-03-08 10:24 . 2004-08-09 21:00 68608 —-a-w c:\windows\system32\dllcache\hmmapi.dll
2009-03-08 10:22 . 2004-08-09 21:00 156160 —-a-w c:\windows\system32\msls31.dll
2009-03-08 10:22 . 2004-08-09 21:00 156160 —-a-w c:\windows\system32\dllcache\msls31.dll
2009-03-08 10:11 . 2007-05-09 12:51 445952 —-a-w c:\windows\system32\dllcache\ieapfltr.dll
2009-03-06 20:33 . 2006-06-21 14:49 87704 —-a-w c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-02-07 03:07 . 2007-05-09 12:51 3698584 —-a-w c:\windows\system32\dllcache\ieapfltr.dat
2006-10-10 02:03 . 2006-10-09 04:17 139 —-a-w c:\documents and settings\HP_Administrator\Local Settings\Application Data\fusioncache.dat
2006-06-21 15:09 . 2006-10-09 04:17 51976 —-a-w c:\documents and settings\HP_Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2006-06-21 14:08 . 2006-06-21 14:08 136 —-a-w c:\documents and settings\Administrator\Local Settings\Application Data\fusioncache.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UserFaultCheck"="c:\windows\system32\dumprep 0 -u" [X]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-29 67584]
"DMAScheduler"="c:\program files\HP DigitalMedia Archive\DMAScheduler.exe" [2006-03-20 90112]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2005-07-22 237568]
"Reminder"="c:\windows\Creator\Remind_XP.exe" [2004-12-14 663552]
"HP Software Update"="c:\program files\HP\HP Software Update\HPwuSchd2.exe" [2007-05-08 54840]
"QUICKCARE"="c:\program files\Qwest\QuickCare\bin\sprtcmd.exe" [2006-11-08 192512]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-02-04 267048]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-02-01 385024]
"F-PROT Antivirus Tray application"="c:\program files\FRISK Software\F-PROT Antivirus for Windows\FProtTray.exe" [2008-04-21 1597832]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-03-25 198160]
"KBD"="c:\hp\KBD\KBD.EXE" [2005-02-02 61440]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2006-02-08 344064]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2006-03-08 16010240]
"AlwaysReady Power Message APP"="ARPWRMSG.EXE" - c:\windows\arpwrmsg.exe [2005-08-02 77312]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
WinCinema Manager.lnk - c:\program files\Sandisk\Common\Bin\WinCinemaMgr.exe [2008-2-13 303104]
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-4-23 29696]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-11 282624]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\FPAVServer]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Updates from HP\\9972322\\Program\\Updates from HP.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\Rosetta Stone\\Rosetta Stone Version 3\\support\\bin\\win\\RosettaStoneLtdServices.exe"=
"c:\\Program Files\\Rosetta Stone\\Rosetta Stone Version 3\\RosettaStoneVersion3.exe"=

S0 FPAV_RTP;FPAV_RTP;c:\windows\system32\drivers\FStopW.sys [2008-03-28 592224]
S2 FPAVServer;F-PROT Antivirus for Windows system;c:\program files\FRISK Software\F-PROT Antivirus for Windows\FPAVServer.exe [2008-04-22 45960]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
c:\windows\system32\rundll32.exe c:\windows\system32\advpack.dll,LaunchINFSectionEx c:\program files\Internet Explorer\clrtour.inf,DefaultInstall.ResetTour,,12
.
Contents of the 'Scheduled Tasks' folder

2009-04-11 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 23:57]
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-Carbonite Backup - c:\program files\Carbonite\Carbonite Backup\CarboniteUI.exe
HKLM-Run-SunJavaUpdateSched - c:\program files\Java\jre1.5.0_05\bin\jusched.exe

.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=63&bd=PAVILION&pf=desktop
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=63&bd=PAVILION&pf=desktop
uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=63&bd=PAVILION&pf=desktop
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
Trusted Zone: aol.com\aimexpress
Trusted Zone: ebay.com\signin
Trusted Zone: microsoft.com\support
DPF: PackageCab - hxxp://ak.imgag.com/imgag/cp/install/AxCtp2.cab
FF - ProfilePath -
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-15 21:27
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(620)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(3152)
c:\windows\system32\ieframe.dll
c:\windows\system32\OneX.DLL
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\windows\arservice.exe
c:\windows\ehome\ehrecvr.exe
c:\windows\ehome\ehSched.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\spool\drivers\w32x86\3\HPZIPM12.EXE
c:\windows\ehome\mcrdsvc.exe
c:\windows\system32\dllhost.exe
c:\windows\system32\wscntfy.exe
c:\windows\ehome\ehmsas.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\HP\Digital Imaging\bin\hpqste08.exe
.
**************************************************************************
.
Completion time: 2009-04-16 21:31 - machine was rebooted
ComboFix-quarantined-files.txt 2009-04-16 03:31

Pre-Run: 166,942,093,312 bytes free
Post-Run: 166,857,154,560 bytes free

237 — E O F — 2009-04-14 18:13

HJT-
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:46:36 PM, on 4/15/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\arservice.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\FRISK Software\F-PROT Antivirus for Windows\FPAVServer.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\ARPWRMSG.EXE
C:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\FRISK Software\F-PROT Antivirus for Windows\FProtTray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Sandisk\Common\Bin\WinCinemaMgr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE
O4 - HKLM\..\Run: [DMAScheduler] "c:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe"
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
O4 - HKLM\..\Run: [QUICKCARE] C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe /P QUICKCARE
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [F-PROT Antivirus Tray application] C:\Program Files\FRISK Software\F-PROT Antivirus for Windows\FProtTray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - Global Startup: WinCinema Manager.lnk = C:\Program Files\Sandisk\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: PackageCab - http://ak.imgag.com/imgag/cp/install/AxCtp2.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eB…l_v1-0-3-48.cab
O16 - DPF: {54BE6B6F-3056-470B-97E1-BB92E051B6C4} (DeviceEnum Class) - http://h20264.www2.hp.com/ediags/dd/instal…nosticsxp2k.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {A8683C98-5341-421B-B23C-8514C05354F1} (FujifilmUploader Class) - http://www.samsphotoclub.com/upload/FujifilmUploadClient.cab
O16 - DPF: {BB383206-6DA1-4E80-B62A-3DF950FCC697} (Create & Print ActiveX Plug-in) - http://ak.imgag.com/imgag/cp/install/AxCtp2.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flas…ent/swflash.cab
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: F-PROT Antivirus for Windows system (FPAVServer) - FRISK Software International - C:\Program Files\FRISK Software\F-PROT Antivirus for Windows\FPAVServer.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE

–
End of file - 9219 bytes

jpshortstuff

Post #7April 16, 2009, 8:39 AM UTC

Hi,

1. Please open Notepad

Click Start , then Run
Type notepad.exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

File::
C:\WINDOWS\usjkf.cel

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"aux2"=-
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)

3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

[external image: Posted Image]

5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

Combofix.txt
A new HijackThis log.

Please go to Kaspersky website and perform an online antivirus scan.

Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
- Spyware, Adware, Dialers, and other potentially dangerous programs
  Archives
  Mail databases
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As….
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
Please post this log in your next reply.

Let me know how things are running now.

Fenrir

Post #8April 19, 2009, 10:25 PM UTC

Hello- the code you asked that I put into my ComboFix thing ended up crashing the computer at stage 30 something. I waited for about half an hour for the computer to snap out of it because the computer was still powered on but it wasn't doing anything and the screen wasn't receiving a signal so I restarted it. I wasn't sure if I was supposed to re-input the code or not.

Here's a new HJT log and the Kaspersky report. Just let me know what to do about the combo fix glitch.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:44:38 PM, on 4/19/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\arservice.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\FRISK Software\F-PROT Antivirus for Windows\FPAVServer.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\ARPWRMSG.EXE
C:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\FRISK Software\F-PROT Antivirus for Windows\FProtTray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE
C:\Program Files\Sandisk\Common\Bin\WinCinemaMgr.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE
O4 - HKLM\..\Run: [DMAScheduler] "c:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe"
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
O4 - HKLM\..\Run: [QUICKCARE] C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe /P QUICKCARE
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [F-PROT Antivirus Tray application] C:\Program Files\FRISK Software\F-PROT Antivirus for Windows\FProtTray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - Global Startup: WinCinema Manager.lnk = C:\Program Files\Sandisk\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: PackageCab - http://ak.imgag.com/imgag/cp/install/AxCtp2.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eB…l_v1-0-3-48.cab
O16 - DPF: {54BE6B6F-3056-470B-97E1-BB92E051B6C4} (DeviceEnum Class) - http://h20264.www2.hp.com/ediags/dd/instal…nosticsxp2k.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {A8683C98-5341-421B-B23C-8514C05354F1} (FujifilmUploader Class) - http://www.samsphotoclub.com/upload/FujifilmUploadClient.cab
O16 - DPF: {BB383206-6DA1-4E80-B62A-3DF950FCC697} (Create & Print ActiveX Plug-in) - http://ak.imgag.com/imgag/cp/install/AxCtp2.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flas…ent/swflash.cab
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: F-PROT Antivirus for Windows system (FPAVServer) - FRISK Software International - C:\Program Files\FRISK Software\F-PROT Antivirus for Windows\FPAVServer.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE

–
End of file - 9053 bytes

And the Kaspersky-

——————————————————————————–
KASPERSKY ONLINE SCANNER 7.0 REPORT
Sunday, April 19, 2009
Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Program database last update: Sunday, April 19, 2009 20:00:48
Records in database: 2060951
——————————————————————————–

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\
G:\
H:\
I:\
J:\
K:\

Scan statistics:
Files scanned: 112192
Threat name: 2
Infected objects: 4
Suspicious objects: 0
Duration of the scan: 02:33:36

File name / Threat name / Threats count
C:\Documents and Settings\HP_Administrator\Local Settings\temp\Av-test.txt Infected: EICAR-Test-File 1
C:\Documents and Settings\HP_Administrator\My Documents\LimeWire\Saved\chopin opus 55.mp3 Infected: Trojan-Downloader.WMA.GetCodec.c 1
C:\Documents and Settings\HP_Administrator\My Documents\LimeWire\Saved\lovely day.mp3 Infected: Trojan-Downloader.WMA.GetCodec.c 1
C:\Documents and Settings\HP_Administrator\My Documents\LimeWire\Saved\opus 55 chopin.mp3 Infected: Trojan-Downloader.WMA.GetCodec.c 1

The selected area was scanned.

jpshortstuff

Post #9April 19, 2009, 10:55 PM UTC

Hi,

That's strange, there's nothing that should have caused a crash. Can you now try and run DDS and see if that works?

Also, Kaspersky identified a few songs from Limewire that contain some infections. As you can see, Limewire is good at bringing in the bad stuff. I recommend you remove at least those songs, if not Limewire altogether.

You need to upgrade to Windows XP Service Pack 3. Keeping your Windows up-to-date is crucial to your computer's security. Please go to the Windows Update Site (using Internet Explorer) and download and install Windows XP - Service Pack 3.

How's the computer running generally?

jpshortstuff

Post #10April 24, 2009, 9:24 AM UTC

Due to inactivity this topic will be closed. If you need help please start a new thread and post a new HJT log

jpshortstuff

Post #11April 27, 2009, 6:05 AM UTC

This topic has been reopened by request of the starter of this topic. Or it has been moved to the correct forum

jpshortstuff

Post #12April 27, 2009, 6:08 AM UTC

Hi,

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

Double-click SystemLook.exe to run it.

Copy the content of the following codebox into the main textfield:

:reg
HKLM\software\microsoft\windows nt\currentversion\drivers32

Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

Please run MalwareBytes' AntiMalware again, update it and run a Quick Scan. Post the log it gives (if it finds anything), and please post a fresh DDS log as well.

Thanks.

Fenrir

Post #13April 29, 2009, 4:22 AM UTC last edited April 29, 2009, 4:44 AM UTC

SystemLook v1.0 by jpshortstuff (24.04.09) Log created at 22:21 on 28/04/2009 by HP_Administrator (Administrator - Elevation successful) ========== reg ========== [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux"="wdmaud.drv" "aux1"="wdmaud.drv" "midi"="wdmaud.drv" "midi1"="wdmaud.drv" "midimapper"="midimap.dll" "mixer"="wdmaud.drv" "mixer1"="wdmaud.drv" "msacm.iac2"="C:\WINDOWS\system32\iac25_32.ax" "msacm.imaadpcm"="imaadp32.acm" "msacm.l3acm"="C:\WINDOWS\system32\l3codeca.acm" "msacm.msadpcm"="msadp32.acm" "msacm.msaudio1"="msaud32.acm" "msacm.msg711"="msg711.acm" "msacm.msg723"="msg723.acm" "msacm.msgsm610"="msgsm32.acm" "msacm.sl_anet"="sl_anet.acm" "msacm.trspch"="tssoft32.acm" "vidc.cvid"="iccvid.dll" "vidc.I420"="msh263.drv" "vidc.iv31"="ir32_32.dll" "vidc.iv32"="ir32_32.dll" "vidc.iv41"="ir41_32.ax" "vidc.iv50"="ir50_32.dll" "vidc.iyuv"="iyuv_32.dll" "vidc.LEAD"="LCODCCMP.DLL" "vidc.M261"="msh261.drv" "vidc.M263"="msh263.drv" "vidc.mrle"="msrle32.dll" "vidc.msvc"="msvidc32.dll" "vidc.uyvy"="msyuv.dll" "vidc.yuy2"="msyuv.dll" "vidc.yvu9"="tsbyuv.dll" "vidc.yvyu"="msyuv.dll" "wave"="wdmaud.drv" "wave1"="wdmaud.drv" "wavemapper"="msacm32.drv" [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32\Terminal Server] -=End Of File=- DDS (Ver_09-03-16.01) - NTFSx86 Run by [removed] at 22:35:31.76 on Tue 04/28/2009 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_13 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.959.381 [GMT -6:00] AV: F-PROT Antivirus for Windows *On-access scanning enabled* (Updated) ============== Running Processes =============== C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup svchost.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE svchost.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\WINDOWS\arservice.exe C:\Program Files\FRISK Software\F-PROT Antivirus for Windows\FPAVServer.exe C:\WINDOWS\ehome\ehtray.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\ARPWRMSG.EXE C:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\HP\HP Software Update\HPwuSchd2.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\FRISK Software\F-PROT Antivirus for Windows\FProtTray.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\windows\system\hpsysdrv.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE C:\Program Files\Sandisk\Common\Bin\WinCinemaMgr.exe svchost.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\HP_Administrator\Desktop\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://www.google.com/ uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=63&bd=PAVILION&pf=desktop mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=63&bd=PAVILION&pf=desktop uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=63&bd=PAVILION&pf=desktop BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe mRun: [ehTray] c:\windows\ehome\ehtray.exe mRun: [RTHDCPL] RTHDCPL.EXE mRun: [AlwaysReady Power Message APP] ARPWRMSG.EXE mRun: [DMAScheduler] "c:\program files\hp digitalmedia archive\DMAScheduler.exe" mRun: [Recguard] c:\windows\sminst\RECGUARD.EXE mRun: [Reminder] "c:\windows\creator\Remind_XP.exe" mRun: [HP Software Update] c:\program files\hp\hp software update\HPwuSchd2.exe mRun: [QUICKCARE] c:\program files\qwest\quickcare\bin\sprtcmd.exe /P QUICKCARE mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u mRun: [F-PROT Antivirus Tray application] c:\program files\frisk software\f-prot antivirus for windows\FProtTray.exe mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot mRun: [KBD] c:\hp\kbd\KBD.EXE mRun: [ATIPTA] "c:\program files\ati technologies\ati control panel\atiptaxx.exe" mRun: [hpsysdrv] c:\windows\system\hpsysdrv.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\wincin~1.lnk - c:\program files\sandisk\common\bin\WinCinemaMgr.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office11\EXCEL.EXE/3000 IE: {E2D4D26B-0180-43a4-B05F-462D6D54C789} - c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\iebutton\support.htm IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBC} - c:\program files\java\jre6\bin\jp2iexp.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office11\REFIEBAR.DLL IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll Trusted Zone: aol.com\aimexpress Trusted Zone: ebay.com\signin Trusted Zone: microsoft.com\support DPF: PackageCab - hxxp://ak.imgag.com/imgag/cp/install/AxCtp2.cab DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} - hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-3-48.cab DPF: {54BE6B6F-3056-470B-97E1-BB92E051B6C4} - hxxp://h20264.www2.hp.com/ediags/dd/install/HPDriverDiagnosticsxp2k.cab DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - hxxp://download.divx.com/player/DivXBrowserPlugin.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab DPF: {A8683C98-5341-421B-B23C-8514C05354F1} - hxxp://www.samsphotoclub.com/upload/FujifilmUploadClient.cab DPF: {BB383206-6DA1-4E80-B62A-3DF950FCC697} - hxxp://ak.imgag.com/imgag/cp/install/AxCtp2.cab DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab Notify: AtiExtEvent - Ati2evxx.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll LSA: Notification Packages = ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\hp_adm~1\applic~1\mozilla\firefox\profiles\9q6t62m7.default\ FF - component: c:\program files\real\realplayer\browserrecord\components\nprpbrowserrecordplugin.dll ============= SERVICES / DRIVERS =============== R0 FPAV_RTP;FPAV_RTP;c:\windows\system32\drivers\FStopW.sys [2008-1-5 592224] R2 FPAVServer;F-PROT Antivirus for Windows system;c:\program files\frisk software\f-prot antivirus for windows\FPAVServer.exe [2008-4-21 45960] R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328] =============== Created Last 30 ================ 2009-04-19 12:38 0 a——- c:\windows\system32\fpuext.sys 2009-04-19 12:35 389,120 a——- c:\windows\system32\CF30895.exe 2009-04-19 12:35 –d—– C:\ComboFix 2009-04-19 12:34 389,120 a——- c:\windows\system32\CF30751.exe 2009-04-15 21:28 54,156 a—h— c:\windows\QTFont.qfn 2009-04-15 21:28 1,409 a——- c:\windows\QTFont.for 2009-04-15 21:21 161,792 a——- c:\windows\SWREG.exe 2009-04-15 21:21 98,816 a——- c:\windows\sed.exe 2009-04-14 16:48 –d—– c:\docume~1\hp_adm~1\applic~1\Malwarebytes 2009-04-14 16:48 15,504 a——- c:\windows\system32\drivers\mbam.sys 2009-04-14 16:48 38,496 a——- c:\windows\system32\drivers\mbamswissarmy.sys 2009-04-14 16:48 –d—– c:\program files\Malwarebytes' Anti-Malware 2009-04-14 16:48 –d—– c:\docume~1\alluse~1\applic~1\Malwarebytes 2009-04-12 16:22 –d—– c:\program files\Trend Micro 2009-04-05 14:29 –d—– c:\program files\common files\AnswerWorks 5.0 2009-04-05 14:29 1,848,608 a——- c:\windows\system32\acXMLParser.dll 2009-04-05 14:29 3,523,872 a——- c:\windows\system32\cdintf300.dll 2009-04-01 12:33 –dsh— c:\documents and settings\hp_administrator\IECompatCache ==================== Find3M ==================== 2009-04-15 20:56 94,208 a——- c:\windows\DUMP4863.tmp 2009-03-09 12:46 45,608 a——- c:\docume~1\hp_adm~1\applic~1\wklnhst.dat 2009-03-09 05:19 410,984 a——- c:\windows\system32\deploytk.dll 2009-03-08 14:09 638,816 a——- c:\windows\system32\dllcache\iexplore.exe 2009-03-08 14:09 391,536 a——- c:\windows\system32\dllcache\iedkcs32.dll 2009-03-08 04:41 5,937,152 a——- c:\windows\system32\dllcache\mshtml.dll 2009-03-08 04:39 11,063,808 a——- c:\windows\system32\dllcache\ieframe.dll 2009-03-08 04:34 914,944 a——- c:\windows\system32\wininet.dll 2009-03-08 04:34 914,944 a——- c:\windows\system32\dllcache\wininet.dll 2009-03-08 04:34 1,206,784 a——- c:\windows\system32\dllcache\urlmon.dll 2009-03-08 04:34 236,544 a——- c:\windows\system32\dllcache\webcheck.dll 2009-03-08 04:34 43,008 a——- c:\windows\system32\licmgr10.dll 2009-03-08 04:34 43,008 a——- c:\windows\system32\dllcache\licmgr10.dll 2009-03-08 04:34 105,984 a——- c:\windows\system32\dllcache\url.dll 2009-03-08 04:34 193,536 a——- c:\windows\system32\dllcache\msrating.dll 2009-03-08 04:34 109,568 a——- c:\windows\system32\dllcache\occache.dll 2009-03-08 04:33 759,296 a——- c:\windows\system32\dllcache\VGX.dll 2009-03-08 04:33 18,944 a——- c:\windows\system32\corpol.dll 2009-03-08 04:33 18,944 ——– c:\windows\system32\dllcache\corpol.dll 2009-03-08 04:33 25,600 a——- c:\windows\system32\dllcache\jsproxy.dll 2009-03-08 04:33 726,528 ——– c:\windows\system32\dllcache\jscript.dll 2009-03-08 04:33 229,376 a——- c:\windows\system32\dllcache\ieaksie.dll 2009-03-08 04:33 420,352 a——- c:\windows\system32\vbscript.dll 2009-03-08 04:33 420,352 ——– c:\windows\system32\dllcache\vbscript.dll 2009-03-08 04:33 125,952 a——- c:\windows\system32\dllcache\ieakeng.dll 2009-03-08 04:32 72,704 a——- c:\windows\system32\dllcache\admparse.dll 2009-03-08 04:32 72,704 a——- c:\windows\system32\admparse.dll 2009-03-08 04:32 173,056 a——- c:\windows\system32\dllcache\ie4uinit.exe 2009-03-08 04:32 163,840 a——- c:\windows\system32\dllcache\ieakui.dll 2009-03-08 04:32 71,680 a——- c:\windows\system32\iesetup.dll 2009-03-08 04:32 71,680 a——- c:\windows\system32\dllcache\iesetup.dll 2009-03-08 04:32 55,808 a——- c:\windows\system32\dllcache\iernonce.dll 2009-03-08 04:32 128,512 a——- c:\windows\system32\dllcache\advpack.dll 2009-03-08 04:32 94,720 a——- c:\windows\system32\dllcache\inseng.dll 2009-03-08 04:32 594,432 a——- c:\windows\system32\dllcache\msfeeds.dll 2009-03-08 04:32 1,985,024 a——- c:\windows\system32\dllcache\iertutil.dll 2009-03-08 04:32 611,840 a——- c:\windows\system32\dllcache\mstime.dll 2009-03-08 04:24 68,608 a——- c:\windows\system32\dllcache\hmmapi.dll 2009-03-08 04:22 156,160 a——- c:\windows\system32\msls31.dll 2009-03-08 04:22 156,160 a——- c:\windows\system32\dllcache\msls31.dll 2009-03-08 04:11 445,952 a——- c:\windows\system32\dllcache\ieapfltr.dll 2009-03-06 08:44 283,648 a——- c:\windows\system32\dllcache\pdh.dll 2009-02-27 22:55 105,984 ——– c:\windows\system32\dllcache\iecompat.dll 2009-02-09 04:20 723,456 a——- c:\windows\system32\dllcache\lsasrv.dll 2009-02-09 04:20 399,360 a——- c:\windows\system32\dllcache\rpcss.dll 2009-02-09 04:20 714,752 a——- c:\windows\system32\dllcache\ntdll.dll 2009-02-09 04:20 616,960 a——- c:\windows\system32\dllcache\advapi32.dll 2009-02-09 04:20 473,088 a——- c:\windows\system32\dllcache\fastprox.dll 2009-02-09 04:20 453,120 a——- c:\windows\system32\dllcache\wmiprvsd.dll 2009-02-06 21:07 3,698,584 a——- c:\windows\system32\dllcache\ieapfltr.dat 2009-02-06 11:24 2,180,480 a——- c:\windows\system32\dllcache\ntoskrnl.exe 2009-02-06 11:22 2,136,064 a——- c:\windows\system32\dllcache\ntkrnlmp.exe 2009-02-06 11:14 110,592 a——- c:\windows\system32\dllcache\services.exe 2009-02-06 10:54 35,328 ——– c:\windows\system32\sc.exe 2009-02-06 10:54 35,328 ——– c:\windows\system32\dllcache\sc.exe 2009-02-06 10:49 2,057,728 a——- c:\windows\system32\dllcache\ntkrnlpa.exe 2009-02-06 10:49 2,015,744 a——- c:\windows\system32\dllcache\ntkrpamp.exe 2009-02-06 10:39 227,840 a——- c:\windows\system32\dllcache\wmiprvse.exe ============= FINISH: 22:36:18.43 =============== Also, Malbytes didn't find anything. However, while I was scanning, my F-Prot antivirus said it deleted something called "Av-test.txt" and it gave the pathway of the file : C:\Documents and Settings\HP_Administrator\Local Settings\Temp… Not sure if that means anything. Lastly- I still can't download those stupid security updates from windows. It just says [failed] on all three.

jpshortstuff

Post #14April 29, 2009, 1:10 PM UTC

Hi,

OK, please delete your existing copy of ComboFix, and then download the latest from here:
http://subs.geekstogo.com/ComboFix.exe

1. Please open Notepad

Click Start , then Run
Type notepad.exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

File::
c:\windows\system32\fpuext.sys

Registry::
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Notification Packages"=hex(7):73,63,65,63,6c,69,00,00

Combofix.txt
A new HijackThis log.

Let me know if things run any better after that.

Fenrir

Post #15May 1, 2009, 12:48 AM UTC

HJT-
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:46:46 PM, on 4/30/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\arservice.exe
C:\Program Files\FRISK Software\F-PROT Antivirus for Windows\FPAVServer.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\ARPWRMSG.EXE
C:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\Sandisk\Common\Bin\WinCinemaMgr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE
O4 - HKLM\..\Run: [DMAScheduler] "c:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe"
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
O4 - HKLM\..\Run: [QUICKCARE] C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe /P QUICKCARE
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [F-PROT Antivirus Tray application] C:\Program Files\FRISK Software\F-PROT Antivirus for Windows\FProtTray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - Global Startup: WinCinema Manager.lnk = C:\Program Files\Sandisk\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: PackageCab - http://ak.imgag.com/imgag/cp/install/AxCtp2.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eB…l_v1-0-3-48.cab
O16 - DPF: {54BE6B6F-3056-470B-97E1-BB92E051B6C4} (DeviceEnum Class) - http://h20264.www2.hp.com/ediags/dd/instal…nosticsxp2k.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {A8683C98-5341-421B-B23C-8514C05354F1} (FujifilmUploader Class) - http://www.samsphotoclub.com/upload/FujifilmUploadClient.cab
O16 - DPF: {BB383206-6DA1-4E80-B62A-3DF950FCC697} (Create & Print ActiveX Plug-in) - http://ak.imgag.com/imgag/cp/install/AxCtp2.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flas…ent/swflash.cab
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: F-PROT Antivirus for Windows system (FPAVServer) - FRISK Software International - C:\Program Files\FRISK Software\F-PROT Antivirus for Windows\FPAVServer.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE

–
End of file - 8723 bytes

Combofix log-
ComboFix 09-04-30.05 - HP_Administrator 04/30/2009 18:41.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.959.441 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\HP_Administrator\Desktop\CFScript.txt
AV: F-PROT Antivirus for Windows *On-access scanning disabled* (Updated)

FILE ::
c:\windows\system32\fpuext.sys
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\fpuext.sys
.
—- Previous Run ——-
.
c:\windows\usjkf.cel

.
((((((((((((((((((((((((( Files Created from 2009-04-01 to 2009-05-01 )))))))))))))))))))))))))))))))
.

2009-04-14 22:48 . 2009-04-14 22:48 ——– d—–w c:\documents and settings\HP_Administrator\Application Data\Malwarebytes
2009-04-14 22:48 . 2009-04-06 21:32 15504 —-a-w c:\windows\system32\drivers\mbam.sys
2009-04-14 22:48 . 2009-04-06 21:32 38496 —-a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-14 22:48 . 2009-04-14 22:48 ——– d—–w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-04-14 22:48 . 2009-04-14 22:48 ——– d—–w c:\program files\Malwarebytes' Anti-Malware
2009-04-12 22:22 . 2009-04-12 22:22 ——– d—–w c:\program files\Trend Micro
2009-04-05 20:29 . 2009-04-05 20:29 ——– d—–w c:\program files\Common Files\AnswerWorks 5.0
2009-04-05 20:29 . 2008-12-08 04:14 1848608 —-a-w c:\windows\system32\acXMLParser.dll
2009-04-05 20:29 . 2008-12-08 04:14 3523872 —-a-w c:\windows\system32\cdintf300.dll
2009-04-01 18:33 . 2009-04-01 18:33 ——– d-sh–w c:\documents and settings\HP_Administrator\IECompatCache

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-19 14:42 . 2007-04-09 22:18 ——– d—–w c:\program files\QUICKENW
2009-04-16 02:56 . 2006-06-21 14:00 94208 —-a-w c:\windows\DUMP4863.tmp
2009-04-16 01:49 . 2007-03-25 14:45 ——– d—–w c:\program files\Microsoft Publisher
2009-04-12 19:22 . 2006-10-11 02:07 ——– d—–w c:\program files\Spybot - Search & Destroy
2009-04-12 19:16 . 2008-11-12 23:54 ——– d—–w c:\program files\TeaTimer (Spybot - Search & Destroy)
2009-04-12 19:12 . 2006-06-21 15:19 ——– d—–w c:\program files\Google
2009-04-12 19:10 . 2006-10-10 22:57 ——– d—–w c:\program files\Linksys Wireless-G USB Wireless Network Monitor
2009-04-12 18:59 . 2006-06-21 14:58 ——– d—–w c:\program files\Hewlett-Packard
2009-04-12 18:57 . 2007-10-09 14:07 ——– d—–w c:\program files\DivX
2009-04-12 18:55 . 2006-06-21 14:13 ——– d—–w c:\program files\Java
2009-04-12 18:51 . 2007-01-02 05:43 ——– d—–w c:\program files\IrfanView
2009-04-12 18:50 . 2006-12-28 20:13 ——– d—–w c:\program files\Yahoo!
2009-04-12 18:49 . 2006-06-21 14:30 ——– d–h–w c:\program files\InstallShield Installation Information
2009-04-12 18:49 . 2006-06-21 15:05 ——– d—–w c:\program files\Common Files\muvee Technologies
2009-04-12 18:48 . 2006-06-21 15:05 ——– d—–w c:\program files\muvee Technologies
2009-04-12 18:40 . 2006-06-21 14:51 ——– d—–w c:\program files\Sonic
2009-04-12 18:37 . 2006-06-21 14:08 ——– d—–w c:\program files\GemMaster
2009-04-05 20:48 . 2006-06-21 15:07 ——– d—–w c:\program files\Quicken
2009-03-25 15:08 . 2009-03-25 15:08 ——– d—–w c:\program files\Common Files\xing shared
2009-03-25 15:08 . 2006-06-21 14:49 ——– d—–w c:\program files\Common Files\Real
2009-03-09 18:46 . 2006-10-09 06:34 45608 —-a-w c:\documents and settings\HP_Administrator\Application Data\wklnhst.dat
2009-03-09 11:19 . 2008-12-17 01:34 410984 —-a-w c:\windows\system32\deploytk.dll
2009-03-08 10:34 . 2004-08-09 21:00 914944 —-a-w c:\windows\system32\wininet.dll
2009-03-08 10:34 . 2004-08-09 21:00 43008 —-a-w c:\windows\system32\licmgr10.dll
2009-03-08 10:33 . 2004-08-09 21:00 18944 —-a-w c:\windows\system32\corpol.dll
2009-03-08 10:33 . 2004-08-09 21:00 420352 —-a-w c:\windows\system32\vbscript.dll
2009-03-08 10:32 . 2004-08-09 21:00 72704 —-a-w c:\windows\system32\admparse.dll
2009-03-08 10:32 . 2004-08-09 21:00 71680 —-a-w c:\windows\system32\iesetup.dll
2009-03-08 10:31 . 2004-08-09 21:00 34816 —-a-w c:\windows\system32\imgutil.dll
2009-03-08 10:31 . 2004-08-09 21:00 48128 —-a-w c:\windows\system32\mshtmler.dll
2009-03-08 10:31 . 2004-08-09 21:00 45568 —-a-w c:\windows\system32\mshta.exe
2009-03-08 10:22 . 2004-08-09 21:00 156160 —-a-w c:\windows\system32\msls31.dll
2009-03-06 20:33 . 2006-06-21 14:49 87704 —-a-w c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-02-06 16:54 . 2004-08-09 21:00 35328 ——w c:\windows\system32\sc.exe
.

((((((((((((((((((((((((((((( SnapShot@2009-04-16_03.27.53 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-05-01 00:23 . 2009-05-01 00:23 16384 c:\windows\Temp\Perflib_Perfdata_7c0.dat
- 2009-01-31 03:44 . 2008-04-13 18:31 36352 c:\windows\system32\ReinstallBackups\0004\DriverFiles\i386\intelppm.sys
+ 2009-04-24 23:00 . 2008-04-13 18:31 36352 c:\windows\system32\ReinstallBackups\0004\DriverFiles\i386\intelppm.sys
+ 2009-04-24 23:00 . 2008-04-13 18:31 36352 c:\windows\system32\ReinstallBackups\0003\DriverFiles\i386\intelppm.sys
+ 2004-08-10 04:00 . 2004-08-10 04:00 19429 c:\windows\system32\MsDtc\Trace\msdtcvtr.bat
+ 2004-08-09 21:00 . 2009-02-06 16:54 35328 c:\windows\system32\dllcache\sc.exe
+ 2009-04-24 22:58 . 2005-07-26 04:39 60416 c:\windows\system32\dllcache\colbact.dll
+ 2008-07-20 13:47 . 2009-04-26 14:47 25214 c:\windows\Installer\{AC76BA86-7AD7-1033-7B44-A71000000002}\SC_Reader.exe
- 2008-07-20 13:47 . 2008-07-20 13:47 25214 c:\windows\Installer\{AC76BA86-7AD7-1033-7B44-A71000000002}\SC_Reader.exe
+ 2006-06-21 15:10 . 2006-02-16 16:37 9188 c:\windows\system32\pcintro\FirstBoot.bat
+ 2008-09-07 05:10 . 2008-01-18 15:13 2247 c:\windows\ServicePackFiles\i386\tscdsbl.bat
+ 2008-09-07 05:10 . 2008-01-18 15:13 2247 c:\windows\Installer\tsclientmsitrans\tscdsbl.bat
+ 2004-08-09 21:00 . 2004-08-09 21:00 2589 c:\windows\I386\RUNW32.BAT
+ 2009-04-24 23:00 . 2008-04-13 16:36 144384 c:\windows\system32\ReinstallBackups\0006\DriverFiles\hdaudbus.sys
+ 2009-04-24 22:58 . 2009-02-06 16:39 227840 c:\windows\system32\dllcache\wmiprvse.exe
+ 2009-04-24 22:58 . 2009-02-09 10:20 453120 c:\windows\system32\dllcache\wmiprvsd.dll
- 2009-01-08 00:20 . 2009-01-08 00:20 474112 c:\windows\system32\dllcache\shlwapi.dll
+ 2009-04-24 22:58 . 2009-01-08 00:20 474112 c:\windows\system32\dllcache\shlwapi.dll
+ 2009-04-24 22:58 . 2009-02-06 17:14 110592 c:\windows\system32\dllcache\services.exe
+ 2009-04-24 22:58 . 2009-02-09 10:20 399360 c:\windows\system32\dllcache\rpcss.dll
+ 2009-04-24 22:58 . 2009-03-06 14:44 283648 c:\windows\system32\dllcache\pdh.dll
+ 2009-04-24 22:58 . 2009-02-09 10:20 714752 c:\windows\system32\dllcache\ntdll.dll
+ 2009-04-24 22:58 . 2009-02-09 10:20 723456 c:\windows\system32\dllcache\lsasrv.dll
+ 2009-04-24 22:58 . 2009-02-09 10:20 473088 c:\windows\system32\dllcache\fastprox.dll
+ 2009-04-24 22:58 . 2009-02-09 10:20 616960 c:\windows\system32\dllcache\advapi32.dll
+ 2009-04-24 22:58 . 2008-07-03 13:16 8454656 c:\windows\system32\dllcache\shell32.dll
- 2008-07-03 13:16 . 2008-07-03 13:16 8454656 c:\windows\system32\dllcache\shell32.dll
- 2009-01-08 00:20 . 2009-01-08 00:20 1497088 c:\windows\system32\dllcache\shdocvw.dll
+ 2009-04-24 22:58 . 2009-01-08 00:20 1497088 c:\windows\system32\dllcache\shdocvw.dll
+ 2009-04-24 22:58 . 2009-02-06 17:24 2180480 c:\windows\system32\dllcache\ntoskrnl.exe
+ 2009-04-24 22:58 . 2009-02-06 16:49 2015744 c:\windows\system32\dllcache\ntkrpamp.exe
+ 2009-04-24 22:58 . 2009-02-06 16:49 2057728 c:\windows\system32\dllcache\ntkrnlpa.exe
+ 2009-04-24 22:58 . 2009-02-06 17:22 2136064 c:\windows\system32\dllcache\ntkrnlmp.exe
+ 2009-04-24 22:58 . 2009-01-08 00:20 1022976 c:\windows\system32\dllcache\browseui.dll
- 2009-01-08 00:20 . 2009-01-08 00:20 1022976 c:\windows\system32\dllcache\browseui.dll
+ 2009-04-24 22:58 . 2009-02-06 17:24 2180480 c:\windows\Driver Cache\i386\ntoskrnl.exe
+ 2009-04-24 22:58 . 2009-02-06 16:49 2015744 c:\windows\Driver Cache\i386\ntkrpamp.exe
+ 2009-04-24 22:58 . 2009-02-06 16:49 2057728 c:\windows\Driver Cache\i386\ntkrnlpa.exe
+ 2009-04-24 22:58 . 2009-02-06 17:22 2136064 c:\windows\Driver Cache\i386\ntkrnlmp.exe
+ 2006-10-13 23:18 . 2009-04-06 14:57 24921544 c:\windows\system32\MRT.exe
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UserFaultCheck"="c:\windows\system32\dumprep 0 -u" [X]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-29 67584]
"DMAScheduler"="c:\program files\HP DigitalMedia Archive\DMAScheduler.exe" [2006-03-20 90112]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2005-07-22 237568]
"Reminder"="c:\windows\Creator\Remind_XP.exe" [2004-12-14 663552]
"HP Software Update"="c:\program files\HP\HP Software Update\HPwuSchd2.exe" [2007-05-08 54840]
"QUICKCARE"="c:\program files\Qwest\QuickCare\bin\sprtcmd.exe" [2006-11-08 192512]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-02-04 267048]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-02-01 385024]
"F-PROT Antivirus Tray application"="c:\program files\FRISK Software\F-PROT Antivirus for Windows\FProtTray.exe" [2008-04-21 1597832]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-03-25 198160]
"KBD"="c:\hp\KBD\KBD.EXE" [2005-02-02 61440]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2006-02-08 344064]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2006-03-08 16010240]
"AlwaysReady Power Message APP"="ARPWRMSG.EXE" - c:\windows\arpwrmsg.exe [2005-08-02 77312]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
WinCinema Manager.lnk - c:\program files\Sandisk\Common\Bin\WinCinemaMgr.exe [2008-2-13 303104]
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-4-23 29696]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-11 282624]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\FPAVServer]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Updates from HP\\9972322\\Program\\Updates from HP.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\Rosetta Stone\\Rosetta Stone Version 3\\support\\bin\\win\\RosettaStoneLtdServices.exe"=
"c:\\Program Files\\Rosetta Stone\\Rosetta Stone Version 3\\RosettaStoneVersion3.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6037:TCP"= 6037:TCP:dg
"6037:UDP"= 6037:UDP:dg2
"6100:TCP"= 6100:TCP:dg3
"6100:UDP"= 6100:UDP:dg4
"6200:TCP"= 6200:TCP:dg5
"6200:UDP"= 6200:UDP:dg6

S0 FPAV_RTP;FPAV_RTP;c:\windows\system32\drivers\FStopW.sys [2008-03-28 592224]
S2 FPAVServer;F-PROT Antivirus for Windows system;c:\program files\FRISK Software\F-PROT Antivirus for Windows\FPAVServer.exe [2008-04-22 45960]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
c:\windows\system32\rundll32.exe c:\windows\system32\advpack.dll,LaunchINFSectionEx c:\program files\Internet Explorer\clrtour.inf,DefaultInstall.ResetTour,,12
.
Contents of the 'Scheduled Tasks' folder

2009-04-11 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 23:57]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=63&bd=PAVILION&pf=desktop
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=63&bd=PAVILION&pf=desktop
uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=63&bd=PAVILION&pf=desktop
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
Trusted Zone: aol.com\aimexpress
Trusted Zone: ebay.com\signin
Trusted Zone: microsoft.com\support
DPF: PackageCab - hxxp://ak.imgag.com/imgag/cp/install/AxCtp2.cab
FF - ProfilePath - c:\documents and settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\9q6t62m7.default\
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-30 18:43
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(616)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2009-05-01 18:44
ComboFix-quarantined-files.txt 2009-05-01 00:44
ComboFix2.txt 2009-04-16 03:31

Pre-Run: 166,891,761,664 bytes free
Post-Run: 166,963,638,272 bytes free

214 — E O F — 2009-04-30 14:48

Yes- it seems to be running much better now. Let me know if I'm finally done (yay) or whatever else I should do. Thx so much for the help by the way. Nice to be able to get nice, precise, expert advice without any of the gimmicks or charges or anything.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] [Closed] Being redirected to random webistes (cow

✨ Ask AI

Ask AI