What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Virus is Back

22 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16 last edited
Yea, I definately need some help. :blush: First off the OTM report gave me the same log as before (the one you didnt say was right) but it came with an error which states: "Error: Invalid time flag! [C:\windows\system32\kzqasjl.dll] must be numerical" So i have no idea what that means… :wacko: and the kaspersky program seems like a waste of time. I mean heres the start and finish time of the program when i was running it. Start time - 5/30/2009 9:26:55 PM Finish time - 5/31/2009 4:44:30 AM all it had was 1 Torjan error in the time that I let it run, and I saved that logfile so I can post it tomarrow (I'm on a different computer right now and its saved to the Infected one) But if you want, I CAN let it run for 6 or 7 hours that it needs and give the report to you, although Id like to find another way to go about it : / . Thank you so much for staying with me by the way and I hope we can get rid of this thing. For all its worth though, the computer is running much smoother now and doesnt have anything noticable so far but id like to see if we can purge the virus for good so it doesnt pop up like last time.
Post #17
Hi

Lets make sure those files get deleted as I'm not convinced OTM worked properly, so please do the following:

Please Open Notepad
Click Start >Run type notepad into the run box click OK
Click Format and make certain that Word Wrap is NOT checked.

Copy all the text inside of the code box, put your mouse cursor at the very beginning of the text and then hold down the left button and drag your mouse so that all of the text is highlighted. Press Ctrl+C (or right click on the highlighted section and choose 'copy')

@echo off
attrib -s -h -r C:\WINDOWS\system32\kzqqsjli.dll
del /f /q C:\WINDOWS\system32\kzqqsjli.dll
attrib -s -h -r "C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\SI5NZ2UE\maqf32[1].exe"
del /f /q "C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\SI5NZ2UE\maqf32[1].exe"
attrib -s -h -r "C:\Documents and Settings\Me\Application Data\Google\ptnfwl32.dll"
del /f /q "C:\Documents and Settings\Me\Application Data\Google\ptnfwl32.dll"
del %0

Now paste the copied text into the open notepad. To do this click in the blank page so that your cursor is flashing there and press CTRL+V (or right click and choose 'paste')

Now go to File > and click Save As,
From the drop down menu at the top of the box choose Desktop as the location to save this file.
Go down to the File Name box and type in runme.bat as the file name, then choose All Files as the save as file type.
Then click the save button.

Once you have clicked the save button, close Notepad.

You will now have a file on your desktop that looks like this

[external image: Posted Image]

Locate runme.bat on your Desktop and double-click it

A black window will flash up and disappear again, and runme.bat will be deleted.

This is normal.


NEXT

Please download DDS and save it to your desktop.
  • Disable any script blocking protection
  • Double click dds.pif to run the tool.
  • When done, two DDS.txt's will open.
  • Save both reports to your desktop.
—————————————————
Please include the contents of the following in your next reply:

DDS.txt
Attach.txt.
Post #18
Wow, I must be stupid. I kept checking back on this forum and never clicked the second page not realizing that there was one… :smack:
Well, I did what you said if it's still worth anything. Yea im really smart.

Attach.txt


UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-05-14.01)

Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume2
Install Date: 7/27/2007 2:44:48 AM
System Uptime: 6/7/2009 4:11:55 PM (2 hours ago)

Motherboard: | | C19/MCP51
Processor: Intel® Pentium® D CPU 3.20GHz | Socket 775 | 3200/200mhz
Processor: Intel® Pentium® D CPU 3.20GHz | Socket 775 | 3200/200mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 298 GiB total, 55.535 GiB free.
D: is CDROM (CDFS)
E: is FIXED (NTFS) - 190 GiB total, 80.134 GiB free.

==== Disabled Device Manager Items =============

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: 1394 Net Adapter
Device ID: V1394\NIC1394\A469B6301800
Manufacturer: Microsoft
Name: 1394 Net Adapter
PNP Device ID: V1394\NIC1394\A469B6301800
Service: NIC1394

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: Hamachi Network Interface
Device ID: ROOT\NET\0000
Manufacturer: LogMeIn, Inc.
Name: Hamachi Network Interface
PNP Device ID: ROOT\NET\0000
Service: hamachi

==== System Restore Points ===================

RP1: 5/4/2009 1:43:00 PM - System Checkpoint
RP2: 5/4/2009 1:57:37 PM - ComboFix created restore point
RP3: 5/13/2009 9:10:05 PM - Software Distribution Service 3.0
RP4: 5/15/2009 7:31:20 PM - System Checkpoint
RP5: 5/15/2009 7:58:48 PM - Software Distribution Service 3.0
RP6: 5/16/2009 8:04:09 PM - System Checkpoint
RP7: 5/18/2009 3:59:57 PM - System Checkpoint
RP8: 5/21/2009 4:03:16 PM - System Checkpoint
RP9: 5/22/2009 4:31:11 PM - System Checkpoint
RP10: 5/28/2009 6:36:24 PM - System Checkpoint
RP11: 5/30/2009 5:19:59 PM - System Checkpoint
RP12: 6/4/2009 7:27:47 PM - System Checkpoint
RP13: 6/6/2009 7:20:41 PM - System Checkpoint

==== Installed Programs ======================

7-Zip 4.57
Ad-Aware SE Personal
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 8.1.2
Age of Mythology
Age of Mythology - The Titans Expansion
AiO_Scan
AIOMinimal
AiOSoftware
Audacity 1.2.6
Audiosurf Demo
AutoUpdate
AVG 7.5
Battlefield 2™
BrainBread v1.2
Call of Duty® 4 - Modern Warfare™ 1.6 Patch
Call of Duty® 4 - Modern Warfare™ 1.7 Patch
Celtx (2.0)
Copy
Counter-Strike
Counter-Strike: Source
CreativeProjects
Critical Update for Windows Media Player 11 (KB959772)
Dawn of War - Dark Crusade
Dawn Of War - Winter Assault
DawnOfWar
Day of Defeat
Day of Defeat: Source
Dedicated Server
Director
DiscAPI (Studio 10)
DivX
DocProc
Fable - The Lost Chapters
Fax
Fraps
Game Cam Lite v1.4
GoldWave v5.23
Half-Life 2
Half-Life 2: Deathmatch
Hamachi 1.0.3.0
High Definition Audio Driver Package - KB888111
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft Visual C# 2008 Express Edition with SP1 - ENU (KB945282)
Hotfix for Microsoft Visual C# 2008 Express Edition with SP1 - ENU (KB946040)
Hotfix for Microsoft Visual C# 2008 Express Edition with SP1 - ENU (KB946308)
Hotfix for Microsoft Visual C# 2008 Express Edition with SP1 - ENU (KB947540)
Hotfix for Microsoft Visual C# 2008 Express Edition with SP1 - ENU (KB947789)
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB914440)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB926239)
Hotfix for Windows XP (KB932716-v2)
Hotfix for Windows XP (KB935448)
Hotfix for Windows XP (KB942288-v3)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
HP Image Zone 3.5
HP PSC & OfficeJet 3.5
HP Software Update
hpmdtab
HPSystemDiagnostics
InstantShare
Java™ 6 Update 11
LADSPA_plugins-win-0.4.15
LG USB Modem driver
LimeWire 5.0.11
Malwarebytes' Anti-Malware
Memories Disc Creator 2.0
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
Microsoft National Language Support Downlevel APIs
Microsoft SQL Server 2008
Microsoft SQL Server 2008 Browser
Microsoft SQL Server 2008 Common Files
Microsoft SQL Server 2008 Database Engine Services
Microsoft SQL Server 2008 Database Engine Shared
Microsoft SQL Server 2008 Management Objects
Microsoft SQL Server 2008 Native Client
Microsoft SQL Server 2008 RsFx Driver
Microsoft SQL Server 2008 Setup Support Files (English)
Microsoft SQL Server Compact 3.5 SP1 Design Tools English
Microsoft SQL Server Compact 3.5 SP1 English
Microsoft SQL Server VSS Writer
Microsoft Text-to-Speech Engine 4.0 (English)
Microsoft User-Mode Driver Framework Feature Pack 1.7
Microsoft Visual C# 2008 Express Edition with SP1 - ENU
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
Microsoft Windows SDK for Visual Studio 2008 SP1 Express Tools for .NET Framework - enu
Microsoft Windows SDK for Visual Studio 2008 SP1 Express Tools for Win32
Microsoft WinUsb 1.0
Microsoft XNA Framework Redistributable 3.0 (Beta)
Microsoft XNA Game Studio 3.0 (Beta)
Microsoft XNA Game Studio 3.0 (Beta) (ARP entry)
Microsoft XNA Game Studio 3.0 (Beta) (shared components)
Microsoft XNA Game Studio 3.0 (Beta) (vcsexpress)
Microsoft XNA Game Studio 3.0 (Beta) Documentation
Microsoft XNA Game Studio 3.0 (CTP) (Redists)
Microsoft XNA Game Studio 3.0 (CTP) (xnaliveproxy)
Microsoft XNA Game Studio Platform Tools (Beta)
Moviestorm Early Access
Mozilla Firefox (3.0.9)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 6 Service Pack 2 (KB954459)
MSXML4 Parser
NewBlue Cartoonr for Vegas
NVIDIA Drivers
NVIDIA PhysX v8.09.04
Overland
PhotoGallery
Pinnacle Instant DVD Recorder
Prince of Persia Warrior Within
PrintScreen
proDAD Heroglyph 2.5
QuickProjects
QuickTime
RAPID (Studio 10)
Readme
Realtek High Definition Audio Driver
Recover Data for FAT & NTFS
Recover My Files
Registry Mechanic 8.0
Scan
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB936782)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912812)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933729)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB938127)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB938829)
Security Update for Windows XP (KB939653)
Security Update for Windows XP (KB941202)
Security Update for Windows XP (KB941568)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB941644)
Security Update for Windows XP (KB941693)
Security Update for Windows XP (KB942615)
Security Update for Windows XP (KB943055)
Security Update for Windows XP (KB943460)
Security Update for Windows XP (KB943485)
Security Update for Windows XP (KB944653)
Security Update for Windows XP (KB945553)
Security Update for Windows XP (KB946026)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB948590)
Security Update for Windows XP (KB948881)
Security Update for Windows XP (KB950749)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB961373)
SkinsHP1
SkinsHP2
Skype™ 3.8
SmartSound Quicktracks Plugin
Sony DVD Architect Studio 4.5
Sony Vegas Movie Studio Platinum 8.0
Sound Effects
Source Dedicated Server
Source SDK
Source SDK Base
Spelling Dictionaries Support For Adobe Reader 8
SPORE™ Creature Creator Trial Edition
Sql Server Customer Experience Improvement Program
SQL Server System CLR Types
Steam
Studio 10
Studio 10 Bonus DVD
System Requirements Lab
TeamSpeak 2 RC2
The Sims 2
Titan Quest
Titan Quest Immortal Throne
TQ Defiler
TrayApp
Ulead PhotoImpact 12
Undelete Plus 2.97
Unload
Update for Windows XP (KB894391)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB904942)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB925720)
Update for Windows XP (KB927891)
Update for Windows XP (KB930916)
Update for Windows XP (KB932823-v3)
Update for Windows XP (KB933360)
Update for Windows XP (KB936357)
Update for Windows XP (KB938828)
Update for Windows XP (KB942763)
Update for Windows XP (KB942840)
Update for Windows XP (KB946627)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Ventrilo Client
VST Bridge 1.1
WD Diagnostics
WebFldrs XP
WebReg
Windows Imaging Component
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Media Format 11 runtime
Windows Media Player 11
Windows XP Hotfix - KB839210
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB885884
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
WinFast® Display Driver
WinZip 11.1
World of Warcraft
Xfire (remove only)
XML Paper Specification Shared Components Pack 1.0
Yahoo! Install Manager
Yahoo! Toolbar
Zune
Zune Language Pack (ES)
Zune Language Pack (FR)

==== Event Viewer Messages From Past Week ========

6/2/2009 8:39:03 PM, error: ZuneNetworkSvc [14365] - Proximity detection failed due to unknown error '0x80004004'. The best proximity time detected was -1 milliseconds.
6/1/2009 3:13:05 PM, error: Service Control Manager [7000] - The PnkBstrA service failed to start due to the following error: The system cannot find the file specified.
6/1/2009 3:13:04 PM, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751)
6/1/2009 3:12:59 PM, error: Dhcp [1002] - The IP address lease 192.168.1.102 for the Network Card with network address 003018A7956F has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).
5/31/2009 3:17:49 PM, error: Dhcp [1002] - The IP address lease 192.168.1.101 for the Network Card with network address 003018A7956F has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).

==== End Of File ===========================

DDS.txt


DDS (Ver_09-05-14.01) - NTFSx86
Run by [removed] at 18:45:59.68 on Sun 06/07/2009
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.2559.1958 [GMT -4:00]

AV: AVG 7.5.524 *On-access scanning enabled* (Outdated) {41564737-3200-1071-989B-0000E87B4FB1}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
c:\WINDOWS\system32\ZuneBusEnum.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe
C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Zune\ZuneLauncher.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\AIM\aim.exe
C:\program files\steam\steam.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Registry Mechanic\RegMech.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Documents and Settings\Me\Desktop\Xfire\xfire.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Audacity\audacity.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Me\Local Settings\Temporary Internet Files\Content.IE5\RPXWGHGD\dds[1].pif

============== Pseudo HJT Report ===============

uStart Page = www.google.com/
BHO: {02478d38-c3f9-4efb-9b51-7695eca05670} - Yahoo! Toolbar Helper
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
uRun: [AIM] c:\program files\aim\aim.exe -cnetwait.odl
uRun: [Steam] "c:\program files\steam\steam.exe" -silent
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [RegistryMechanic] c:\program files\registry mechanic\RegMech.exe /H
mRun: [AVG7_CC] c:\progra~1\grisoft\avg7\avgcc.exe /STARTUP
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [PinnacleDriverCheck] c:\windows\system32\PSDrvCheck.exe -CheckReg
mRun: [HP Software Update] "c:\program files\hp\hp software update\HPWuSchd.exe"
mRun: [HP Component Manager] "c:\program files\hp\hpcoretech\hpcmpmgr.exe"
mRun: [Ulead AutoDetector v2] c:\program files\common files\ulead systems\autodetector\monitor.exe
mRun: [USB2Check] RUNDLL32.EXE "c:\windows\system32\PCLECoInst.dll",CheckUSBController
mRun: [USBToolTip] "c:\program files\pinnacle\shared files\\programs\usbtip\USBTip.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [Zune Launcher] "c:\program files\zune\ZuneLauncher.exe"
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
dRun: [AVG7_Run] c:\progra~1\grisoft\avg7\avgw.exe /RUNONCE
StartupFolder: c:\docume~1\me\startm~1\programs\startup\hamachi.lnk - c:\program files\hamachi\hamachi.exe
StartupFolder: c:\docume~1\me\startm~1\programs\startup\xfire.lnk - c:\documents and settings\me\desktop\xfire\xfire.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
IE: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - c:\program files\aim\aim.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} - hxxp://www.srtest.com/srl_bin/sysreqlab3.cab
DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab}
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1192098404078
DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} - hxxp://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1192098236312
DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} - hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - c:\program files\hp\hpcoretech\comp\hpuiprot.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath -

============= SERVICES / DRIVERS ===============

R1 Avg7Core;AVG7 Kernel;c:\windows\system32\drivers\avg7core.sys [2007-7-26 821856]
R1 Avg7RsW;AVG7 Wrap Driver;c:\windows\system32\drivers\avg7rsw.sys [2007-7-26 4224]
R1 Avg7RsXP;AVG7 Resident Driver XP;c:\windows\system32\drivers\avg7rsxp.sys [2007-7-26 27776]
R1 AvgClean;AVG7 Clean Driver;c:\windows\system32\drivers\avgclean.sys [2007-7-26 10760]
R2 Avg7Alrt;AVG7 Alert Manager Server;c:\progra~1\grisoft\avg7\avgamsvr.exe [2007-7-26 418816]
R2 Avg7UpdSvc;AVG7 Update Service;c:\progra~1\grisoft\avg7\avgupsvc.exe [2007-7-26 49664]
R2 AVGEMS;AVG E-mail Scanner;c:\progra~1\grisoft\avg7\avgemc.exe [2007-7-26 406528]
R2 AvgTdi;AVG Network Redirector;c:\windows\system32\drivers\avgtdi.sys [2007-7-26 4960]
S3 icsak;icsak;c:\windows\system32\drivers\icsak.sys [2009-3-25 20472]
S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\microsoft sql server\100\shared\sqladhlp.exe [2008-7-10 47128]
S4 RsFx0102;RsFx0102 Driver;c:\windows\system32\drivers\RsFx0102.sys [2008-7-10 242712]
S4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\microsoft sql server\mssql10.sqlexpress\mssql\binn\SQLAGENT.EXE [2008-7-10 369688]

=============== Created Last 30 ================

2009-05-25 14:47 –d—– C:\_OTM
2009-05-24 14:13 –d—– c:\documents and settings\me\Moviestorm
2009-05-24 14:12 –d—– c:\program files\Moviestorm Release
2009-05-22 22:37 130,048 a——- c:\windows\PEV.exe
2009-05-22 22:37 –ds—- C:\ComboFix

==================== Find3M ====================

2009-05-04 14:01 577,536 a——- c:\windows\system32\user32.dll
2009-05-01 15:47 14,336 a——- c:\windows\system32\svchost.exe
2009-04-29 17:19 41,808 a——- c:\windows\system32\xfcodec.dll
2008-07-02 14:56 22,328 a——- c:\docume~1\me\applic~1\PnkBstrK.sys
2002-07-26 17:02 153,088 a——- c:\program files\UNWISE.EXE

============= FINISH: 18:46:45.25 ===============

thank you so much for being so patient. Hopefully there wont be any more stupid mistakes done by me.
Post #19
Hi, can you please run that AVP tool, my post from the previous page: Also, can you please advise how your computer is running now and if there are any outstanding issues?
Post #20
Hey there, I ran Registry Mechanic a couple of times and AVG here and there and thus far, it hasnt detected anything that's out of place. I havent either to be honest. im running AVP tool as we speak, i had some problem with it earlier concerning not opening the DL link because it kept getting blocked from my internet browser, but its working now and the Scan should be finished around 12 AM tonight and Ill post it as soon as it does. Like i said earlier it takes like 5 hours for it to scan "My Computer". -Thanks you!
Post #22
my AVP tool's time prediction is severaly underjudged. Apparently it was going to finish at 5 am… :wacko: anyways it only detected 3 things in the time that I ran it and i saved the log to it so here it is: Scan —- Scanned: 367341 Detected: 3 Untreated: 3 Start time: 6/13/2009 8:15:42 PM Duration: 03:19:46 Finish time: 6/13/2009 11:35:28 PM Detected ——– Status Object —— —— detected: Trojan program Packed.Win32.Krap.f File: C:\Program Files\Trend Micro\HijackThis\backups\backup-20081229-110421-319.dll detected: Trojan program Trojan.Win32.Monderd.gen File: C:\Program Files\Trend Micro\HijackThis\backups\backup-20081229-110421-526.dll detected: adware not-a-virus:AdWare.Win32.SuperJuan.gxi File: C:\Program Files\Trend Micro\HijackThis\backups\backup-20081229-110421-912.dll Events —— Time Name Status Reason —- —- —— —— 6/13/2009 8:15:51 PM Running module: smss.exe\smss.exe ok scanned 6/13/2009 8:15:51 PM File: C:\WINDOWS\System32\smss.exe ok scanned 6/13/2009 8:15:51 PM Running module: smss.exe\ntdll.dll ok scanned 6/13/2009 8:15:51 PM File: C:\WINDOWS\system32\ntdll.dll ok scanned 6/13/2009 8:15:51 PM Running module: csrss.exe\csrss.exe ok scanned 6/13/2009 8:15:51 PM File: C:\WINDOWS\system32\csrss.exe ok scanned 6/13/2009 8:15:51 PM Running module: csrss.exe\ntdll.dll ok scanned 6/13/2009 8:15:51 PM File: C:\WINDOWS\system32\ntdll.dll ok scanned 6/13/2009 8:15:51 PM Running module: csrss.exe\CSRSRV.dll ok scanned 6/13/2009 8:15:51 PM File: C:\WINDOWS\system32\CSRSRV.dll ok scanned 6/13/2009 8:15:51 PM Running module: csrss.exe\basesrv.dll ok scanned 6/13/2009 8:15:51 PM File: C:\WINDOWS\system32\basesrv.dll ok scanned 6/13/2009 8:15:51 PM Running module: csrss.exe\winsrv.dll ok scanned 6/13/2009 8:15:51 PM File: C:\WINDOWS\system32\winsrv.dll ok scanned 6/13/2009 8:15:51 PM Running module: csrss.exe\GDI32.dll ok scanned 6/13/2009 8:15:51 PM File: C:\WINDOWS\system32\GDI32.dll ok scanned 6/13/2009 8:15:51 PM Running module: csrss.exe\KERNEL32.dll ok scanned 6/13/2009 8:15:52 PM File: C:\WINDOWS\system32\KERNEL32.dll ok scanned 6/13/2009 8:15:52 PM Running module: csrss.exe\USER32.dll ok scanned Statistics ———- Object Scanned Detected Untreated Deleted Moved to Quarantine Archives Packed files Password protected Corrupted —— ——- ——– ——— ——- ——————- ——– ———— —————— ——— Settings ——– Parameter Value ——— —– Security Level Recommended Action Prompt for action when the scan is complete Run mode Manually File types Scan all files Scan only new and changed files No Scan archives All Scan embedded OLE objects All Skip if object is larger than No Skip if scan takes longer than No Parse email formats No Scan password-protected archives No Enable iChecker technology No Enable iSwift technology No Show detected threats on "Detected" tab Yes Rootkits search Yes Deep rootkits search No Use heuristic analyzer Yes Quarantine ———- Status Object Size Added —— —— —- —– Backup —— Status Object Size —— —— —-
Post #23
Hi,

Those items found are in HJT's back ups - which is quarantined and would only be of concern if restored.

So your computer is clean of malware.

some housekeeping to do now to clean up the tools used.

Please do the following:

You have some old Java on your system:
Go to Start > Control Panel >Add/Remove Programs and remove:
Java™ 6 Update 11

(leave 6 update 14 - it is the current version )


NEXT

Visit ADOBEand download the latest version of Acrobat Reader (version 9.1)
Having the latest updates ensures there are no security vulnerabilities in your system.


NEXT

Follow these steps to uninstall Combofix

  • Click START then RUN
  • Now type Combofix /u in the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.

[external image: Posted Image]


NEXT

Now to remove the rest of the tools that we have used in fixing your machine:
  • Make sure you have an Internet Connection.
  • Download OTC to your desktop and run it
  • A list of tool components used in the Cleanup of malware will be downloaded.
  • If your Firewall or Real Time protection attempts to block OTC to reach the Internet, please allow the application to do so.
  • Click Yes to begin the Cleanup process and remove these components, including this application.
  • You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.


NEXT


Below I have included a number of recommendations for how to protect your computer against malware infections.

  • Keep Windows updated by regularly checking their website at :
    http://windowsupdate.microsoft.com/
    This will ensure your computer has always the latest security updates available installed on your computer.

  • SpywareBlaster protects against bad ActiveX, it immunizes your PC against them.

  • SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program ( eg : TeaTimer, Windows Defender ) or there will be a conflict.

  • Make Internet Explorer more secure
    • Click Start > Run
    • Type Inetcpl.cpl & click OK
    • Click on the Security tab
    • Click Reset all zones to default level
    • Make sure the Internet Zone is selected & Click Custom level
    • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
    • Next Click OK, then Apply button and then OK to exit the Internet Properties page.
  • ATF Cleaner - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.

    WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
    • Green to go
    • Yellow for caution
    • Red to stop
    WOT has an addon available for both Firefox and IE

  • For Firefox, I highly recommend this add-on to keep your PC even more secure.
    • NoScript - for blocking ads and other potential website attacks
  • Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
  • ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
  • In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles:
    Think Prevention.
    PC Safety and Security–What Do I Need?.


**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.


Thank you for your patience, and performing all of the procedures requested.

Please respond one last time so we can consider the thread resolved and close it, thank-you.
Post #24
yep ill get on all this today, thank you so much! I was considering getting a new computer or bringing it down for wipeout. The thing is running so much better than it was before and I couldn't have done it without your help! :thumbup: I'll make sure to recommend you and this site to my friends. -Thanks again :wavey:
Post #26
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI