Spyware / Malware / Virus Removal

[Resolved] Can't get on the Internet

13 min read

Looking for the outcome? Ask AI

phesters Topic Starter

Post #1June 2, 2009, 11:56 AM UTC

I was unable to get on to the Internet yesterday usign either IE or Mozilla. I ran diagnostic checks on my modem and router, but the connection was fine. As I was working on my computer, my anti-virus software (Trend Micro Anti-Virus with Anti-Spyware) quarantined a KOOBFACE Trojan. I deleted it, and ran an anti-virus scan, but nothing else was found.

When I open IE, I get the message "Waiting for res:/ieframe.dll/dsnerror.htm" in the lower left hand corner.

I ran an HJT scan and got this log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:07:38 PM, on 6/1/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Trend Micro\BM\TMBMSRV.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
C:\Program Files\Trend Micro\Internet Security\UfNavi.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.comcast.net
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast High-Speed Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:7171
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;
O2 - BHO: (no name) - MRI_DISABLED - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: 729553 helper - {2267F93C-600C-420E-A229-3317AADD3951} - C:\WINDOWS\system32\sysloc\sysloc.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [UfSeAgnt.exe] "C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [sysldtray] C:\windows\ld08.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - S-1-5-18 Startup: AutoPlay.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: AutoPlay.exe (User 'Default user')
O4 - .DEFAULT User Startup: AutoPlay.exe (User 'Default user')
O4 - Startup: MRI_DISABLED
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.comcast.net
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1…toUploader5.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {5685BC20-FBE6-11D2-885F-00A0243C2C64} (iVantage Remote Data Control) - https://ivantage.thermo.com/ivantagetec/Com…SpectrumRDC.cab
O16 - DPF: {6F750203-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://targetphoto.kodakgallery.com/downlo…_2/axofupld.cab
O16 - DPF: {7823A620-9DD9-11CF-A662-00AA00C066D2} (PopupMenu Object) - https://ivantage.thermo.com/ivantagetec/Common/iemenu.cab
O16 - DPF: {A7A61128-0EAA-11D1-B22F-0000C08C00C4} (SSDBCombo Control 3.1 - A) - https://ivantage.thermo.com/ivantagetec/Common/Ssdw3b32.cab
O16 - DPF: {BEB82CC6-09F3-43EA-BEB1-97188E21035D} (FootPedalCtl Class) - http://sten-tel1.mttest.com/Shared/footpedal.cab
O16 - DPF: {C4847596-972C-11D0-9567-00A0C9273C2A} (Crystal Report Viewer Control) - https://ivantage.thermo.com/ivantagetec/Rep…veXViewer80.cab
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Trend Micro Central Control Component (SfCtlCom) - Unknown owner - C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
O23 - Service: Trend Micro Unauthorized Change Prevention Service (TMBMServer) - Unknown owner - C:\Program Files\Trend Micro\BM\TMBMSRV.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Unknown owner - C:\Program Files\Trend Micro\Internet Security\TmProxy.exe

–
End of file - 9005 bytes

Any idea what's going on?

If I have to download something from a website to fix this, you will have to tell me how to save the download to a disk, as I am still unable to get on to the Internet from home.

Thanks.

CatByte

Post #2June 2, 2009, 2:19 PM UTC

Hi,

Please do the following:

Open HijackThis.
Click Do a System Scan Only.
Put a checkmark in the box on the left side of these entries only:

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:7171
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;
O2 - BHO: 729553 helper - {2267F93C-600C-420E-A229-3317AADD3951} - C:\WINDOWS\system32\sysloc\sysloc.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
Close ALL windows and browsers except HijackThis and click "Fix checked"
Exit HijackThis

That should get you back on the internet.

NEXT

Please do the following:

Download OTS to your Desktop

Double-click on OTS to start the program. Make sure you close all other programs and don't use the PC while the scan runs.
Now click the Run Scan button on the toolbar. Make sure not to use the PC while the program is running or it will freeze.
When the scan is complete Notepad will open with the report file loaded in it.
Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.

Use the Add Reply button and post the information back here in an attachment. I will review it when it comes in. The last line is < End of Report >, so make sure that is the last line in the attached report.

Make sure you attach the report in your reply. If it is too big to upload, then zip the text file and upload it that way

phesters

Post #3June 2, 2009, 5:19 PM UTC

So far, so good. Attached is the OTS text file. Thanks.

Attachments:

📎OTS.Txt

CatByte

Post #4June 3, 2009, 12:05 AM UTC

Hi,

Please do the following

Start OTS Copy/Paste the information inside the quotebox below into the panel where it says "Paste fix here" and then click the Run Fix button.

[Kill Explorer]
[Unregister Dlls]
[Processes - Safe List]
YY -> ld08.exe -> C:\windows\ld08.exe
[Registry - Safe List]
< Internet Explorer Settings [HKEY_LOCAL_MACHINE\] > ->
YN -> HKEY_LOCAL_MACHINE\: "ProxyOverride" -> *.local;
< Internet Explorer ToolBars [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\
YN -> ShellBrowser\\"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.]
< Run [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
YY -> "sysldtray" -> C:\windows\ld08.exe [C:\windows\ld08.exe]
< Internet Explorer Extensions [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\
YN -> CmdMapping\\"{F4430FE8-2638-42e5-B849-800749B94EED}" [HKLM] -> [Reg Error: Key error.]
[Files/Folders - Created Within 30 Days]
NY -> 1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp
NY -> st_1243965027.exe -> C:\WINDOWS\st_1243965027.exe
NY -> st_1243946599.exe -> C:\WINDOWS\st_1243946599.exe
NY -> sonce122714.dat -> C:\WINDOWS\sonce122714.dat
NY -> st_1243915886.exe -> C:\WINDOWS\st_1243915886.exe
NY -> st_1243897458.exe -> C:\WINDOWS\st_1243897458.exe
NY -> sysloc -> C:\WINDOWS\System32\sysloc
NY -> st_1243880647.exe -> C:\WINDOWS\st_1243880647.exe
NY -> 487656.bat -> C:\487656.bat
NY -> ld08.exe -> C:\WINDOWS\ld08.exe
[Files/Folders - Modified Within 30 Days]
NY -> st_1243965027.exe -> C:\WINDOWS\st_1243965027.exe
NY -> st_1243946599.exe -> C:\WINDOWS\st_1243946599.exe
NY -> sonce122714.dat -> C:\WINDOWS\sonce122714.dat
NY -> sonce_1243910955.exe -> C:\Documents and Settings\Owner\Local Settings\Temp\sonce_1243910955.exe
NY -> st_1243915886.exe -> C:\WINDOWS\st_1243915886.exe
NY -> st_1243897458.exe -> C:\WINDOWS\st_1243897458.exe
NY -> st_1243880647.exe -> C:\WINDOWS\st_1243880647.exe
NY -> 487656.bat -> C:\487656.bat
NY -> ld08.exe -> C:\WINDOWS\ld08.exe
NY -> d.exe -> C:\Documents and Settings\Owner\Local Settings\Temp\d.exe
NY -> c.exe -> C:\Documents and Settings\Owner\Local Settings\Temp\c.exe
[Purity]
[Empty Temp Folders]
[Start Explorer]
[Reboot]

The fix should only take a very short time. When the fix is completed a message box will popup either telling you that it is finished, or that a reboot is needed to complete the fix. If the fix is complete, click the Ok button and Notepad will open with a log of actions taken during the fix. Post that log back here in your next reply.

If a reboot is required, click the "Yes" button to reboot the machine. After the reboot, OTS will finish moving any files that could not be moved during the fix and NotePad will open with the final results at that time. Post that log back here in your next reply.

NEXT

Please download Malwarebytes' Anti-Malware

Double Click mbam-setup.exe to install the application.
Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish, so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected. <– very important
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

NEXT

Run an on-line scan with Kaspersky

Please do a scan with Kaspersky Online Scanner. Please note: Kaspersky requires Java Runtime Environment (JRE) be installed before scanning for malware, as ActiveX is no longer being used.)

If you are using Windows Vista, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.

Open the Kaspersky WebScanner
page.
Click on the 🖼Click to load external image (Posted Image) button on the main page.
The program will launch and fill in the Information section on the left.
Read the "Requirements and Limitations" then press the 🖼Click to load external image (Posted Image) button.
The program will begin downloading the latest program and definition files. It may take a while so please be patient and let it finish.
Now under the Scan section on the left:
Select My Computer
The program will now start and scan your system. This will run for a while, be patient and let it finish.
Once the scan is complete, click on View scan report
Now, click on the Save Report as button.
Save the file to your desktop.
Copy and paste that information in your next post.

You can refer to this animation by sundavis.

In your next reply please include

OTS Log
MBAM Log
Kaspersky report

phesters

Post #5June 3, 2009, 2:17 PM UTC

Here is the OTS log:

Process Explorer.EXE killed successfully!
[Processes - Safe List]
Process ld08.exe killed successfully!
C:\windows\ld08.exe moved successfully.
[Registry - Safe List]
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\sysldtray deleted successfully.
File C:\windows\ld08.exe not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\\{F4430FE8-2638-42e5-B849-800749B94EED} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F4430FE8-2638-42e5-B849-800749B94EED}\ not found.
[Files/Folders - Created Within 30 Days]
C:\WINDOWS\st_1243965027.exe moved successfully.
C:\WINDOWS\st_1243946599.exe moved successfully.
C:\WINDOWS\sonce122714.dat moved successfully.
C:\WINDOWS\st_1243915886.exe moved successfully.
C:\WINDOWS\st_1243897458.exe moved successfully.
C:\WINDOWS\System32\sysloc folder moved successfully.
C:\WINDOWS\st_1243880647.exe moved successfully.
C:\487656.bat moved successfully.
File C:\WINDOWS\ld08.exe not found!
[Files/Folders - Modified Within 30 Days]
File C:\WINDOWS\st_1243965027.exe not found!
File C:\WINDOWS\st_1243946599.exe not found!
File C:\WINDOWS\sonce122714.dat not found!
C:\Documents and Settings\Owner\Local Settings\Temp\sonce_1243910955.exe moved successfully.
File C:\WINDOWS\st_1243915886.exe not found!
File C:\WINDOWS\st_1243897458.exe not found!
File C:\WINDOWS\st_1243880647.exe not found!
File C:\487656.bat not found!
File C:\WINDOWS\ld08.exe not found!
C:\Documents and Settings\Owner\Local Settings\Temp\d.exe moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\c.exe moved successfully.
[Purity]
Purity scan complete.
[Empty Temp Folders]
File delete failed. C:\Documents and Settings\Owner\Local Settings\Temp\hsperfdata_Owner\3628 scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Owner\Local Settings\Temp\jar_cache27214.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Internet Explorer cache folder emptied.
File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\V71X6X08\comcast_net[1].htm scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\V71X6X08\st[1] scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\49BR3JOD\_;ord=1243990328527180[1].htm scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat scheduled to be deleted on reboot.
User's Temporary Internet Files folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat scheduled to be deleted on reboot.
Local Service Temp folder emptied.
Local Service Temporary Internet Files folder emptied.
Network Service Temp folder emptied.
Network Service Temporary Internet Files folder emptied.
Windows Temp folder emptied.
Java cache emptied.
FireFox cache emptied.
RecycleBin -> emptied.
Explorer started successfully
< End of fix log >
OTS by OldTimer - Version 3.0.3.0 fix logfile created on 06022009_205300

Here is the MBAM log:

Malwarebytes' Anti-Malware 1.37
Database version: 2217
Windows 5.1.2600 Service Pack 3

6/2/2009 9:26:46 PM
mbam-log-2009-06-02 (21-26-46).txt

Scan type: Quick Scan
Objects scanned: 82430
Time elapsed: 11 minute(s), 51 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\Interface\{f7d09218-46d7-4d3d-9b7f-315204cd0836} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{e63648f7-3933-440e-b4f6-a8584dd7b7eb} (Trojan.BHO) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\WINDOWS\st_1243984805.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
c:\WINDOWS\st_1244003236.exe (Backdoor.Bot) -> Quarantined and deleted successfully.

Here is the Kaspersky log:

Wednesday, June 3, 2009
Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Program database last update: Wednesday, June 03, 2009 11:55:53
Records in database: 2301285

Scan settings
Scan using the following database extended
Scan archives yes
Scan mail databases yes

Scan area My Computer
A:\
C:\
D:\

Scan statistics
Files scanned 88034
Threat name 6
Infected objects 20
Suspicious objects 0
Duration of the scan 03:32:53

File name Threat name Threats count
C:\Documents and Settings\Default User\Start Menu\Programs\Startup\AutoPlay.exe Infected: Trojan.Win32.Genome.kxn 1

C:\hp\bin\AUTOPLAY.EXE Infected: Trojan.Win32.Genome.kxn 1

C:\Program Files\Trend Micro\HijackThis\backups\backup-20090602-110717-745.dll Infected: Trojan.Win32.BHO.tli 1

C:\Program Files\Trend Micro\Internet Security\Quarantine\6244[1].exe Infected: Trojan-Dropper.Win32.BHO.bv 1

C:\Program Files\Trend Micro\Internet Security\Quarantine\nfr[1].exe Infected: Trojan.Win32.Agent2.jyw 1

C:\Program Files\Trend Micro\Internet Security\Quarantine\st_1243973467.exe Infected: Trojan.Win32.Agent2.jyw 1

C:\Program Files\Trend Micro\Internet Security\Quarantine\SYSDLL.exe Infected: Trojan.Win32.Agent2.jyw 1

C:\Program Files\Trend Micro\Internet Security\Quarantine\SYSDLL_ca0.VIR Infected: Trojan.Win32.Agent2.jyw 1

C:\System Volume Information\_restore{593172EE-14D9-4262-8426-24BF2115D284}\RP1274\A0075513.EXE Infected: Trojan.Win32.Genome.kxn 1

C:\System Volume Information\_restore{593172EE-14D9-4262-8426-24BF2115D284}\RP1274\A0075514.exe Infected: Trojan.Win32.Genome.kxn 1

C:\System Volume Information\_restore{593172EE-14D9-4262-8426-24BF2115D284}\RP1278\A0075690.EXE Infected: Trojan.Win32.Genome.kxn 1

C:\System Volume Information\_restore{593172EE-14D9-4262-8426-24BF2115D284}\RP1311\A0077770.exe Infected: Trojan-Dropper.Win32.BHO.bv 1

C:\System Volume Information\_restore{593172EE-14D9-4262-8426-24BF2115D284}\RP1311\A0077771.exe Infected: Trojan.Win32.Agent2.jyw 1

C:\System Volume Information\_restore{593172EE-14D9-4262-8426-24BF2115D284}\RP1311\A0077772.exe Infected: Trojan.Win32.Agent2.jyw 1

C:\System Volume Information\_restore{593172EE-14D9-4262-8426-24BF2115D284}\RP1312\A0077798.dll Infected: Trojan.Win32.BHO.tli 1

C:\WINDOWS\SYSTEM32\wbem\proquota.exe Infected: Trojan.Win32.Agent.chjy 1

C:\_OTS\MovedFiles\06022009_205300\C_Documents and Settings\Owner\Local Settings\Temp\c.exe Infected: Net-Worm.Win32.Koobface.lr 1

C:\_OTS\MovedFiles\06022009_205300\C_windows\ld08.exe Infected: Net-Worm.Win32.Koobface.lr 1

C:\_OTS\MovedFiles\06022009_205300\C_windows\st_1243880647.exe Infected: Trojan-Dropper.Win32.BHO.bv 1

C:\_OTS\MovedFiles\06022009_205300\C_windows\System32\sysloc\sysloc.dll Infected: Trojan.Win32.BHO.tli 1

The selected area was scanned.

CatByte

Post #6June 3, 2009, 3:53 PM UTC last edited June 3, 2009, 4:03 PM UTC

Hi,

Note:
One or more of the infections on your machine has been identified as a backdoor bot, meaning it could have unauthorized access to your personal information.
As a precaution, from an uninfected machine, change all of your passwords for any financial institutions, other businesses and other sites, advise them your personal information may have been compromised. I cannot guarantee with 100 % certaintity that this machine can be trusted without a total reformat and reinstall. Advise in your next post what your intentions will be, for now I will continue cleaning:

Please do the following:

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

Double-click SystemLook.exe to run it.
Copy the content of the following codebox into the main textfield:
```
:FileFind
proquota.exe
```
Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

NEXT

Please download OTM by OldTimer.

Save it to your desktop.
Please double-click OTM to run it.
Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

(Do Not copy the word CODE note the fix starts with the colon in front of the word : Processes)
```
:Processes
explorer.exe

:Files
C:\Documents and Settings\Default User\Start Menu\Programs\Startup\AutoPlay.exe 
C:\hp\bin\AUTOPLAY.EXE 
C:\WINDOWS\SYSTEM32\wbem\proquota.exe 

:Commands
[Purity]
[emptytemp]
[start explorer]
[Reboot]
```
Return to OTM, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
Click the red Moveit! button.
Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
Close OTMoveIt3

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

*Make sure you allow OTM to reboot your computer when prompted.

The other items found were already in quarantine or in old system restore points which we will clean up shortly.

Please also post a fresh HJT log and advise how your computer is running now and if there are any outstanding issues.

phesters

Post #7June 3, 2009, 7:23 PM UTC

What is involved in a reformat and reinstall?

I know you said that you can't guarantee that the computer can be trusted, but what are the odds of exposure?

Is there anything I can do to prevent this in the future? I have Trend Micro Antivirus and Antispyware. Why didn't it pick this up? Is there anything I should be using with, or in place of, this?

Should I not use the computer at all?

The computer itself is running OK now.

Here is the SystemLook log:
SystemLook v1.0 by jpshortstuff (22.05.09)
Log created at 13:53 on 03/06/2009 by Owner (Administrator - Elevation successful)

========== FileFind ==========

Searching for "proquota.exe"
C:\WINDOWS\$NtServicePackUninstall$\proquota.exe —–c 50176 bytes [00:43 02/08/2008] [07:56 04/08/2004] 4D9D45A4370E0C2AD00C362B7118E2A4
C:\WINDOWS\ServicePackFiles\i386\proquota.exe —–c 50176 bytes [07:56 04/08/2004] [00:12 14/04/2008] F6465A2EEF75468988A4FCF124148FA8
C:\WINDOWS\SYSTEM32\wbem\proquota.exe –a— 43520 bytes [05:36 18/08/2001] [00:12 14/04/2008] 6111BA012A7704C32C030D7BE8A987CB

-=End Of File=-

Here is the OTS log:
========== PROCESSES ==========
Process explorer.exe killed successfully.
========== FILES ==========
C:\Documents and Settings\Default User\Start Menu\Programs\Startup\AutoPlay.exe moved successfully.
C:\hp\bin\AUTOPLAY.EXE moved successfully.
C:\WINDOWS\SYSTEM32\wbem\proquota.exe moved successfully.
========== COMMANDS ==========
User's Temp folder emptied.
User's Internet Explorer cache folder emptied.
File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\YYEUSJI4\a[7].htm scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\YYEUSJI4\Can_t_get_Internet_t103683[1].htm scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\YYEUSJI4\st[1] scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\YYEUSJI4\szcc_mc_cdv_upsell[1].htm scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\XGV8UXQ0\ads[6].htm scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\XGV8UXQ0\blue_btmbk[2].gif scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\XGV8UXQ0\blue_rightbtm[1].gif scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\XGV8UXQ0\blue_righttop[1].gif scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\XGV8UXQ0\blue_topbk[1].gif scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\XGV8UXQ0\icon_warning[1].gif scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\XGV8UXQ0\red_left[1].gif scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\XGV8UXQ0\st[1] scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\XGV8UXQ0\yellow_topleft[1].gif scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\VCVPMUTG\ads[7].htm scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\VCVPMUTG\a[5].htm scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\VCVPMUTG\blankHistory[2].htm scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\VCVPMUTG\blue_rightbk[1].gif scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\VCVPMUTG\blue_righttop[1].gif scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\VCVPMUTG\iframe[1].htm scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\VCVPMUTG\mail[1].htm scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\VCVPMUTG\red_right[1].gif scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\VCVPMUTG\red_topbk[2].gif scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\VCVPMUTG\yellow_leftbk[1].gif scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\VCVPMUTG\yellow_righttop[1].gif scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\VCVPMUTG\yellow_topleft[2].gif scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\3K673FKJ\8597E8BE-B1C3-11DD-8E46-2F8F1A66B302[1].htm scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\3K673FKJ\action_btn_bk[1].gif scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\3K673FKJ\ads[7].htm scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\3K673FKJ\blue_leftbk[1].gif scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\3K673FKJ\blue_rightbtm[1].gif scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\3K673FKJ\blue_topbk[1].gif scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\3K673FKJ\icon_close[1].gif scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\3K673FKJ\icon_close_hover[1].gif scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\3K673FKJ\icon_exe[1].gif scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\3K673FKJ\red_leftbk[1].gif scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\3K673FKJ\yellow_btmbk[2].gif scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\3K673FKJ\yellow_leftbtm[1].gif scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat scheduled to be deleted on reboot.
User's Temporary Internet Files folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat scheduled to be deleted on reboot.
Local Service Temp folder emptied.
Local Service Temporary Internet Files folder emptied.
Network Service Temp folder emptied.
Network Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_694.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully

OTM by OldTimer - Version 2.1.0.0 log created on 06032009_141110

Files moved on Reboot…
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\YYEUSJI4\a[7].htm moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\YYEUSJI4\Can_t_get_Internet_t103683[1].htm moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\YYEUSJI4\st[1] moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\YYEUSJI4\szcc_mc_cdv_upsell[1].htm moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\XGV8UXQ0\ads[6].htm moved successfully.
File C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\XGV8UXQ0\blue_btmbk[2].gif not found!
File C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\XGV8UXQ0\blue_rightbtm[1].gif not found!
File C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\XGV8UXQ0\blue_righttop[1].gif not found!
File C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\XGV8UXQ0\blue_topbk[1].gif not found!
File C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\XGV8UXQ0\icon_warning[1].gif not found!
File C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\XGV8UXQ0\red_left[1].gif not found!
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\XGV8UXQ0\st[1] moved successfully.
File C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\XGV8UXQ0\yellow_topleft[1].gif not found!
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\VCVPMUTG\ads[7].htm moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\VCVPMUTG\a[5].htm moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\VCVPMUTG\blankHistory[2].htm moved successfully.
File C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\VCVPMUTG\blue_rightbk[1].gif not found!
File C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\VCVPMUTG\blue_righttop[1].gif not found!
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\VCVPMUTG\iframe[1].htm moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\VCVPMUTG\mail[1].htm moved successfully.
File C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\VCVPMUTG\red_right[1].gif not found!
File C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\VCVPMUTG\red_topbk[2].gif not found!
File C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\VCVPMUTG\yellow_leftbk[1].gif not found!
File C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\VCVPMUTG\yellow_righttop[1].gif not found!
File C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\VCVPMUTG\yellow_topleft[2].gif not found!
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\3K673FKJ\8597E8BE-B1C3-11DD-8E46-2F8F1A66B302[1].htm moved successfully.
File C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\3K673FKJ\action_btn_bk[1].gif not found!
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\3K673FKJ\ads[7].htm moved successfully.
File C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\3K673FKJ\blue_leftbk[1].gif not found!
File C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\3K673FKJ\blue_rightbtm[1].gif not found!
File C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\3K673FKJ\blue_topbk[1].gif not found!
File C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\3K673FKJ\icon_close[1].gif not found!
File C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\3K673FKJ\icon_close_hover[1].gif not found!
File C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\3K673FKJ\icon_exe[1].gif not found!
File C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\3K673FKJ\red_leftbk[1].gif not found!
File C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\3K673FKJ\yellow_btmbk[2].gif not found!
File C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\3K673FKJ\yellow_leftbtm[1].gif not found!
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat moved successfully.
File C:\WINDOWS\temp\Perflib_Perfdata_694.dat not found!

Registry entries deleted on Reboot…

Here is the HJT log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:11:52 PM, on 6/3/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Trend Micro\BM\TMBMSRV.exe
C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.comcast.net
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast High-Speed Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:7171
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;
O2 - BHO: (no name) - MRI_DISABLED - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: 482168 helper - {465A0DF8-1673-49CB-B2B1-B2A500513DC8} - C:\WINDOWS\system32\sysloc\sysloc.dll (file missing)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [UfSeAgnt.exe] "C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Startup: MRI_DISABLED
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.comcast.net
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1…toUploader5.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {5685BC20-FBE6-11D2-885F-00A0243C2C64} (iVantage Remote Data Control) - https://ivantage.thermo.com/ivantagetec/Com…SpectrumRDC.cab
O16 - DPF: {6F750203-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://targetphoto.kodakgallery.com/downlo…_2/axofupld.cab
O16 - DPF: {7823A620-9DD9-11CF-A662-00AA00C066D2} (PopupMenu Object) - https://ivantage.thermo.com/ivantagetec/Common/iemenu.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-09.sun.com/s/ESD7/JSCDL/jdk…ows-i586-jc.cab
O16 - DPF: {A7A61128-0EAA-11D1-B22F-0000C08C00C4} (SSDBCombo Control 3.1 - A) - https://ivantage.thermo.com/ivantagetec/Common/Ssdw3b32.cab
O16 - DPF: {BEB82CC6-09F3-43EA-BEB1-97188E21035D} (FootPedalCtl Class) - http://sten-tel1.mttest.com/Shared/footpedal.cab
O16 - DPF: {C4847596-972C-11D0-9567-00A0C9273C2A} (Crystal Report Viewer Control) - https://ivantage.thermo.com/ivantagetec/Rep…veXViewer80.cab
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Trend Micro Central Control Component (SfCtlCom) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
O23 - Service: Trend Micro Unauthorized Change Prevention Service (TMBMServer) - Trend Micro Inc. - C:\Program Files\Trend Micro\BM\TMBMSRV.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\TmProxy.exe

–
End of file - 9207 bytes

CatByte

Post #8June 3, 2009, 8:35 PM UTC

Hi,

There is really no way of knowing how much you have been compromised, that's the problem. Only you know how much sensitive information you have on your computer. If you change all your passwords and take necessary precautions, then you will have done all you can do other than reformat.

Info on reformatting can be found HERE.

The worst of the infection has been eradicated, there are just a few things we still need to deal with.

Please do the following:

Download ComboFix from one of these locations:
Link 1
Link 2
Link 3

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

Double click on ComboFix.exe & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

phesters

Post #9June 3, 2009, 11:43 PM UTC

Here is the ComboFix log:

ComboFix 09-06-03.01 - Owner 06/03/2009 19:11.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.512.238 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Trend Micro AntiVirus *On-access scanning disabled* (Updated) {7D2296BC-32CC-4519-917E-52E652474AF5}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\recycler\NPROTECT\00003176.
c:\recycler\NPROTECT\00003177.
c:\recycler\NPROTECT\00003178.
c:\recycler\NPROTECT\00003181.
c:\recycler\NPROTECT\00003183.
c:\recycler\NPROTECT\00003184.
c:\recycler\NPROTECT\00003185.
c:\recycler\NPROTECT\00003186.
c:\recycler\NPROTECT\00003187.
c:\recycler\NPROTECT\00003188.
c:\recycler\NPROTECT\00003189.
c:\recycler\NPROTECT\00003191.
c:\recycler\NPROTECT\00003193.
c:\recycler\NPROTECT\00003194.
c:\recycler\NPROTECT\00003195.
c:\recycler\NPROTECT\00003196.
c:\recycler\NPROTECT\00003197.
c:\recycler\NPROTECT\00003198.
c:\recycler\NPROTECT\00003199.
c:\recycler\NPROTECT\00003200.
c:\recycler\NPROTECT\00003201.
c:\recycler\NPROTECT\00003202.
c:\recycler\NPROTECT\00003203.
c:\recycler\NPROTECT\00003204.
c:\recycler\NPROTECT\00003205.
c:\recycler\NPROTECT\00003206.
c:\recycler\NPROTECT\00003207.
c:\recycler\NPROTECT\00003209.
c:\recycler\NPROTECT\00003210.
c:\recycler\NPROTECT\00003211.
c:\recycler\NPROTECT\00003212.
c:\recycler\NPROTECT\00003213.
c:\recycler\NPROTECT\00003214.
c:\recycler\NPROTECT\00003215.
c:\recycler\NPROTECT\00003216.
c:\recycler\NPROTECT\00003217.
c:\recycler\NPROTECT\00003218.
c:\recycler\NPROTECT\00003219.
c:\recycler\NPROTECT\00003220.
c:\recycler\NPROTECT\00003221.
c:\recycler\NPROTECT\00003222.
c:\recycler\NPROTECT\00003223.
c:\recycler\NPROTECT\00003224.
c:\recycler\NPROTECT\00003225.
c:\recycler\NPROTECT\00003226.
c:\recycler\NPROTECT\00003227.
c:\recycler\NPROTECT\00003228.
c:\recycler\NPROTECT\00003229.
c:\recycler\NPROTECT\00003230.
c:\recycler\NPROTECT\00003231.
c:\recycler\NPROTECT\00003232.
c:\recycler\NPROTECT\00003233.
c:\recycler\NPROTECT\00003234.
c:\recycler\NPROTECT\00003235.
c:\recycler\NPROTECT\00003236.
c:\recycler\NPROTECT\00003237.
c:\recycler\NPROTECT\00003238.
c:\recycler\NPROTECT\00003239.
c:\recycler\NPROTECT\00003240.
c:\recycler\NPROTECT\00003241.
c:\recycler\NPROTECT\00003242.
c:\recycler\NPROTECT\00003243.
c:\recycler\NPROTECT\00003244.
c:\recycler\NPROTECT\00003245.
c:\recycler\NPROTECT\00003246.
c:\recycler\NPROTECT\00003247.
c:\recycler\NPROTECT\00003248.
c:\recycler\NPROTECT\00003249.
c:\recycler\NPROTECT\00003250.
c:\recycler\NPROTECT\00003251.
c:\recycler\NPROTECT\00003252.
c:\recycler\NPROTECT\00003253.
c:\recycler\NPROTECT\00003254.
c:\recycler\NPROTECT\00003255.
c:\recycler\NPROTECT\00003256.
c:\recycler\NPROTECT\00003257.
c:\recycler\NPROTECT\00003258.
c:\recycler\NPROTECT\00007796.
c:\windows\system\oeminfo.ini

c:\windows\system32\proquota.exe was missing
Restored copy from - c:\windows\ServicePackFiles\i386\proquota.exe

.
((((((((((((((((((((((((( Files Created from 2009-05-03 to 2009-06-03 )))))))))))))))))))))))))))))))
.

2009-06-03 23:15 . 2008-04-14 00:12 50176 —-a-w- c:\windows\system32\proquota.exe
2009-06-03 23:15 . 2008-04-14 00:12 50176 —-a-w- c:\windows\system32\dllcache\proquota.exe
2009-06-03 18:11 . 2009-06-03 18:11 ——– d—–w- C:\_OTM
2009-06-03 10:08 . 2009-06-03 10:08 410984 —-a-w- c:\windows\system32\deploytk.dll
2009-06-03 10:06 . 2009-06-03 10:06 152576 —-a-w- c:\documents and settings\Owner\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-06-03 01:08 . 2009-05-26 17:20 40160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-03 01:08 . 2009-05-26 17:19 19096 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-06-03 01:08 . 2009-06-03 01:08 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-06-03 00:53 . 2009-06-03 00:53 ——– d—–w- C:\_OTS
2009-05-29 18:44 . 2009-05-29 18:44 ——– d—–w- c:\documents and settings\Owner\Application Data\Windows Live Writer
2009-05-22 14:32 . 2009-05-22 14:46 ——– d—–w- c:\documents and settings\Owner\Application Data\ZoomBrowser EX
2009-05-22 14:20 . 2009-05-22 14:33 ——– d—–w- c:\documents and settings\Owner\Application Data\CameraWindowDC
2009-05-22 14:20 . 2009-05-22 14:20 ——– d—–w- c:\documents and settings\Owner\Application Data\CANON INC
2009-05-22 14:16 . 2001-08-18 02:36 5632 —-a-w- c:\windows\system32\ptpusb.dll
2009-05-22 14:16 . 2008-04-13 18:45 15104 —-a-w- c:\windows\system32\drivers\usbscan.sys
2009-05-22 14:16 . 2008-04-13 18:45 15104 —-a-w- c:\windows\system32\dllcache\usbscan.sys
2009-05-22 14:16 . 2008-04-14 00:12 159232 —-a-w- c:\windows\system32\ptpusd.dll
2009-05-22 13:52 . 2009-05-22 13:52 ——– d—–w- c:\documents and settings\All Users\Application Data\ZoomBrowser
2009-05-22 13:51 . 2009-05-22 14:06 ——– d—–w- c:\program files\Canon
2009-05-22 13:50 . 2009-05-22 13:50 ——– d—–w- c:\program files\Common Files\Canon

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-03 10:12 . 2008-12-30 20:48 1744 —-a-w- c:\windows\system32\d3d9caps.dat
2009-06-03 10:08 . 2007-11-05 00:44 ——– d—–w- c:\program files\Java
2009-05-30 22:44 . 2001-09-19 15:27 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-05-05 00:56 . 2007-08-18 20:12 ——– d—–w- c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com
2009-05-04 19:38 . 2005-07-13 01:19 ——– d—–w- c:\documents and settings\Owner\Application Data\ArcSoft
2009-05-04 00:30 . 2009-05-04 00:30 ——– d—–w- c:\documents and settings\Owner\Application Data\Malwarebytes
2009-05-04 00:30 . 2009-05-04 00:30 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-05-03 20:30 . 2004-03-08 00:03 ——– d—–w- c:\program files\Google
2009-04-07 23:59 . 2009-04-07 23:57 ——– d—–w- c:\program files\iTunes
2009-04-07 23:59 . 2009-04-07 23:57 ——– d—–w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-04-07 23:58 . 2009-04-07 23:58 ——– d—–w- c:\program files\iPod
2009-04-07 23:58 . 2008-12-29 19:19 ——– d—–w- c:\program files\Common Files\Apple
2009-04-07 23:48 . 2009-04-07 23:48 75048 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.1.1.10\SetupAdmin.exe
2009-04-02 20:00 . 2008-01-05 16:23 52752 —-a-w- c:\windows\system32\drivers\tmactmon.sys
2009-04-02 20:00 . 2008-01-05 16:23 52624 —-a-w- c:\windows\system32\drivers\tmevtmgr.sys
2009-04-02 20:00 . 2008-01-05 16:23 142864 —-a-w- c:\windows\system32\drivers\tmcomm.sys
2009-03-22 21:14 . 2002-01-27 17:11 1632 —-a-w- c:\windows\system32\d3d8caps.dat
2009-03-19 20:32 . 2009-03-19 20:32 23400 —-a-w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}\x86\x86\GEARAspiWDM.sys
2009-03-19 20:32 . 2008-12-29 19:25 23400 —-a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-03-06 14:22 . 2004-02-28 19:01 284160 —-a-w- c:\windows\system32\pdh.dll
2009-03-06 03:59 . 2009-03-18 23:33 1900544 —-a-w- c:\windows\system32\usbaaplrc.dll
2009-03-06 03:59 . 2008-12-29 19:20 36864 —-a-w- c:\windows\system32\drivers\usbaapl.sys
2008-10-18 00:21 . 2007-10-10 22:52 67696 —-a-w- c:\program files\mozilla firefox\components\jar50.dll
2008-10-18 00:21 . 2007-10-10 22:52 54376 -c–a-w- c:\program files\mozilla firefox\components\jsd3250.dll
2008-10-18 00:21 . 2007-10-10 22:52 34952 —-a-w- c:\program files\mozilla firefox\components\myspell.dll
2008-10-18 00:21 . 2007-10-10 22:52 46720 —-a-w- c:\program files\mozilla firefox\components\spellchk.dll
2008-10-18 00:21 . 2007-10-10 22:52 172144 -c–a-w- c:\program files\mozilla firefox\components\xpinstal.dll
2008-06-19 09:16 . 2008-06-19 09:16 118784 —-a-w- c:\program files\mozilla firefox\plugins\MyCamera.dll
2001-07-22 02:45 . 2001-07-22 02:45 94784 -csh–w- c:\windows\twain.dll
2008-04-14 00:12 . 2001-08-18 05:36 50688 -csh–w- c:\windows\twain_32.dll
2008-04-14 00:12 . 2004-02-28 19:01 413696 –sha-w- c:\windows\SYSTEM32\msvcp60.dll
2008-04-14 00:12 . 2001-08-18 05:36 11776 –sh–w- c:\windows\SYSTEM32\regsvr32.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-18 68856]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UfSeAgnt.exe"="c:\program files\Trend Micro\Internet Security\UfSeAgnt.exe" [2008-07-29 1398024]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-06-03 148888]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" - c:\windows\SYSTEM32\narrator.exe [2008-04-14 53760]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ \0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Image Transfer.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Image Transfer.lnk
backup=c:\windows\pss\Image Transfer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^Greetings Workshop Reminders.lnk]
path=c:\documents and settings\Owner\Start Menu\Programs\Startup\Greetings Workshop Reminders.lnk
backup=c:\windows\pss\Greetings Workshop Reminders.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"WLSetupSvc"=3 (0x3)
"WinDefend"=2 (0x2)
"usnjsvc"=3 (0x3)
"SNDSrvc"=3 (0x3)
"gusvc"=3 (0x3)
"AVG Anti-Spyware Guard"=2 (0x2)
"aawservice"=2 (0x2)
"tmproxy"=2 (0x2)
"TmPfw"=2 (0x2)
"Tmntsrv"=2 (0x2)
"PcScnSrv"=3 (0x3)
"PcCtlCom"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Hasbro Interactive\\Scrabble v2.0\\Scrabble v2.0.exe"=
"c:\\Program Files\\AIM\\aim.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\SYSTEM32\\dplaysvr.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R2 tmpreflt;tmpreflt;c:\windows\SYSTEM32\drivers\tmpreflt.sys [9/17/2007 12:09 PM 36368]
R3 DLKRTS;D-Link DFE-530TX+ PCI Adapter;c:\windows\SYSTEM32\drivers\DLKRTS.SYS [6/12/2004 4:30 PM 45568]
R3 P0630VID;Creative WebCam Live!;c:\windows\SYSTEM32\drivers\P0630Vid.sys [6/12/2005 12:11 PM 91797]
S2 tmevtmgr;tmevtmgr;c:\windows\SYSTEM32\drivers\tmevtmgr.sys [1/5/2008 12:23 PM 52624]
S3 tmproxy;Trend Micro Proxy Service;c:\program files\Trend Micro\Internet Security\TmProxy.exe [1/5/2008 12:23 PM 648456]
S4 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592]
.
Contents of the 'Scheduled Tasks' folder

2009-05-30 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2009-06-03 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 16:20]

2001-12-04 c:\windows\Tasks\ISP signup reminder 2.job
- c:\windows\System32\OOBE\oobebaln.exe [2004-02-28 00:12]

2008-12-08 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 23:20]
.
- - - - ORPHANS REMOVED - - - -

BHO-{465A0DF8-1673-49CB-B2B1-B2A500513DC8} - c:\windows\system32\sysloc\sysloc.dll
SafeBoot-procexp90.Sys

.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.comcast.net/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyServer = http=localhost:7171
uInternet Settings,ProxyOverride = *.local;
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
Trusted Zone: microsoft.com\*.update
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {5685BC20-FBE6-11D2-885F-00A0243C2C64} - hxxps://ivantage.thermo.com/ivantagetec/Common/SpectrumRDC.cab
DPF: {7823A620-9DD9-11CF-A662-00AA00C066D2} - hxxps://ivantage.thermo.com/ivantagetec/Common/iemenu.cab
DPF: {A7A61128-0EAA-11D1-B22F-0000C08C00C4} - hxxps://ivantage.thermo.com/ivantagetec/Common/Ssdw3b32.cab
DPF: {BEB82CC6-09F3-43EA-BEB1-97188E21035D} - hxxp://sten-tel1.mttest.com/Shared/footpedal.cab
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\8w316dsj.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.comcast.net/
FF - prefs.js: network.proxy.http - localhost
FF - prefs.js: network.proxy.http_port - 7171
FF - prefs.js: network.proxy.type - 1
FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-03 19:16
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-06-03 19:22
ComboFix-quarantined-files.txt 2009-06-03 23:22

Pre-Run: 3,667,849,216 bytes free
Post-Run: 3,664,842,752 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows Whistler Personal" /fastdetect /NoExecute=OptIn

272 — E O F — 2009-05-21 19:24

CatByte

Post #10June 4, 2009, 1:08 AM UTC

Hi,

Please do the following:

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".

Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

DDS::
uInternet Settings,ProxyServer = http=localhost:7171
uInternet Settings,ProxyOverride = *.local;

FireFox::
FF - prefs.js: network.proxy.http - localhost
FF - prefs.js: network.proxy.http_port - 7171
FF - prefs.js: network.proxy.type - 1

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you.
Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

NEXT

In I.E.

Check internet options settings.
Tools > Internet Options > Connections
LAN settings
Choose "automatically detect settings"
uncheck both proxy settings boxes

In FireFox

Click on Advanced -> Network -> Setttings…
the No Proxy option should be selected

NEXT

Go to Start > Run > type: cmd
Press OK or Hit Enter.
At the command prompt, type or copy/paste: ipconfig /flushdns (note the space between “..g /f…” it needs to be there)
Hit Enter.
You will get a confirmation that the flush was successful.
Close the command box.

Please describe how your computer is running now and if there are any outstanding issues

phesters

Post #11June 4, 2009, 10:56 AM UTC

I could not find the "No Proxy" setting for Firefow, so I checked the "Direct connection to the Internet" option.

Here is the ComboFix log:

ComboFix 09-06-03.04 - Owner 06/04/2009 6:31.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.512.244 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt
AV: Trend Micro AntiVirus *On-access scanning disabled* (Updated) {7D2296BC-32CC-4519-917E-52E652474AF5}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\recycler\NPROTECT\00003176.
c:\recycler\NPROTECT\00003177.
c:\recycler\NPROTECT\00003178.
c:\recycler\NPROTECT\00003181.
c:\recycler\NPROTECT\00003183.
c:\recycler\NPROTECT\00003184.
c:\recycler\NPROTECT\00003185.
c:\recycler\NPROTECT\00003186.
c:\recycler\NPROTECT\00003187.
c:\recycler\NPROTECT\00003188.
c:\recycler\NPROTECT\00003189.
c:\recycler\NPROTECT\00003191.
c:\recycler\NPROTECT\00003193.
c:\recycler\NPROTECT\00003194.
c:\recycler\NPROTECT\00003195.
c:\recycler\NPROTECT\00003196.
c:\recycler\NPROTECT\00003197.
c:\recycler\NPROTECT\00003198.
c:\recycler\NPROTECT\00003199.
c:\recycler\NPROTECT\00003200.
c:\recycler\NPROTECT\00003201.
c:\recycler\NPROTECT\00003202.
c:\recycler\NPROTECT\00003203.
c:\recycler\NPROTECT\00003204.
c:\recycler\NPROTECT\00003205.
c:\recycler\NPROTECT\00003206.
c:\recycler\NPROTECT\00003207.
c:\recycler\NPROTECT\00003209.
c:\recycler\NPROTECT\00003210.
c:\recycler\NPROTECT\00003211.
c:\recycler\NPROTECT\00003212.
c:\recycler\NPROTECT\00003213.
c:\recycler\NPROTECT\00003214.
c:\recycler\NPROTECT\00003215.
c:\recycler\NPROTECT\00003216.
c:\recycler\NPROTECT\00003217.
c:\recycler\NPROTECT\00003218.
c:\recycler\NPROTECT\00003219.
c:\recycler\NPROTECT\00003220.
c:\recycler\NPROTECT\00003221.
c:\recycler\NPROTECT\00003222.
c:\recycler\NPROTECT\00003223.
c:\recycler\NPROTECT\00003224.
c:\recycler\NPROTECT\00003225.
c:\recycler\NPROTECT\00003226.
c:\recycler\NPROTECT\00003227.
c:\recycler\NPROTECT\00003228.
c:\recycler\NPROTECT\00003229.
c:\recycler\NPROTECT\00003230.
c:\recycler\NPROTECT\00003231.
c:\recycler\NPROTECT\00003232.
c:\recycler\NPROTECT\00003233.
c:\recycler\NPROTECT\00003234.
c:\recycler\NPROTECT\00003235.
c:\recycler\NPROTECT\00003236.
c:\recycler\NPROTECT\00003237.
c:\recycler\NPROTECT\00003238.
c:\recycler\NPROTECT\00003239.
c:\recycler\NPROTECT\00003240.
c:\recycler\NPROTECT\00003241.
c:\recycler\NPROTECT\00003242.
c:\recycler\NPROTECT\00003243.
c:\recycler\NPROTECT\00003244.
c:\recycler\NPROTECT\00003245.
c:\recycler\NPROTECT\00003246.
c:\recycler\NPROTECT\00003247.
c:\recycler\NPROTECT\00003248.
c:\recycler\NPROTECT\00003249.
c:\recycler\NPROTECT\00003250.
c:\recycler\NPROTECT\00003251.
c:\recycler\NPROTECT\00003252.
c:\recycler\NPROTECT\00003253.
c:\recycler\NPROTECT\00003254.
c:\recycler\NPROTECT\00003255.
c:\recycler\NPROTECT\00003256.
c:\recycler\NPROTECT\00003257.
c:\recycler\NPROTECT\00003258.
c:\recycler\NPROTECT\00007796.

.
((((((((((((((((((((((((( Files Created from 2009-05-04 to 2009-06-04 )))))))))))))))))))))))))))))))
.

2009-06-03 23:15 . 2008-04-14 00:12 50176 —-a-w- c:\windows\system32\proquota.exe
2009-06-03 23:15 . 2008-04-14 00:12 50176 —-a-w- c:\windows\system32\dllcache\proquota.exe
2009-06-03 18:11 . 2009-06-03 18:11 ——– d—–w- C:\_OTM
2009-06-03 10:08 . 2009-06-03 10:08 410984 —-a-w- c:\windows\system32\deploytk.dll
2009-06-03 10:06 . 2009-06-03 10:06 152576 —-a-w- c:\documents and settings\Owner\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-06-03 01:08 . 2009-05-26 17:20 40160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-03 01:08 . 2009-05-26 17:19 19096 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-06-03 01:08 . 2009-06-03 01:08 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-06-03 00:53 . 2009-06-03 00:53 ——– d—–w- C:\_OTS
2009-05-29 18:44 . 2009-05-29 18:44 ——– d—–w- c:\documents and settings\Owner\Application Data\Windows Live Writer
2009-05-22 14:32 . 2009-05-22 14:46 ——– d—–w- c:\documents and settings\Owner\Application Data\ZoomBrowser EX
2009-05-22 14:20 . 2009-05-22 14:33 ——– d—–w- c:\documents and settings\Owner\Application Data\CameraWindowDC
2009-05-22 14:20 . 2009-05-22 14:20 ——– d—–w- c:\documents and settings\Owner\Application Data\CANON INC
2009-05-22 14:16 . 2001-08-18 02:36 5632 —-a-w- c:\windows\system32\ptpusb.dll
2009-05-22 14:16 . 2008-04-13 18:45 15104 —-a-w- c:\windows\system32\drivers\usbscan.sys
2009-05-22 14:16 . 2008-04-13 18:45 15104 —-a-w- c:\windows\system32\dllcache\usbscan.sys
2009-05-22 14:16 . 2008-04-14 00:12 159232 —-a-w- c:\windows\system32\ptpusd.dll
2009-05-22 13:52 . 2009-05-22 13:52 ——– d—–w- c:\documents and settings\All Users\Application Data\ZoomBrowser
2009-05-22 13:51 . 2009-05-22 14:06 ——– d—–w- c:\program files\Canon
2009-05-22 13:50 . 2009-05-22 13:50 ——– d—–w- c:\program files\Common Files\Canon

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-04 00:28 . 2008-12-30 20:48 1744 —-a-w- c:\windows\system32\d3d9caps.dat
2009-06-03 10:08 . 2007-11-05 00:44 ——– d—–w- c:\program files\Java
2009-05-30 22:44 . 2001-09-19 15:27 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-05-05 00:56 . 2007-08-18 20:12 ——– d—–w- c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com
2009-05-04 19:38 . 2005-07-13 01:19 ——– d—–w- c:\documents and settings\Owner\Application Data\ArcSoft
2009-05-04 00:30 . 2009-05-04 00:30 ——– d—–w- c:\documents and settings\Owner\Application Data\Malwarebytes
2009-05-04 00:30 . 2009-05-04 00:30 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-05-03 20:30 . 2004-03-08 00:03 ——– d—–w- c:\program files\Google
2009-04-07 23:59 . 2009-04-07 23:57 ——– d—–w- c:\program files\iTunes
2009-04-07 23:59 . 2009-04-07 23:57 ——– d—–w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-04-07 23:58 . 2009-04-07 23:58 ——– d—–w- c:\program files\iPod
2009-04-07 23:58 . 2008-12-29 19:19 ——– d—–w- c:\program files\Common Files\Apple
2009-04-07 23:48 . 2009-04-07 23:48 75048 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.1.1.10\SetupAdmin.exe
2009-04-02 20:00 . 2008-01-05 16:23 52752 —-a-w- c:\windows\system32\drivers\tmactmon.sys
2009-04-02 20:00 . 2008-01-05 16:23 52624 —-a-w- c:\windows\system32\drivers\tmevtmgr.sys
2009-04-02 20:00 . 2008-01-05 16:23 142864 —-a-w- c:\windows\system32\drivers\tmcomm.sys
2009-03-22 21:14 . 2002-01-27 17:11 1632 —-a-w- c:\windows\system32\d3d8caps.dat
2009-03-19 20:32 . 2009-03-19 20:32 23400 —-a-w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}\x86\x86\GEARAspiWDM.sys
2009-03-19 20:32 . 2008-12-29 19:25 23400 —-a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-03-06 14:22 . 2004-02-28 19:01 284160 —-a-w- c:\windows\system32\pdh.dll
2008-10-18 00:21 . 2007-10-10 22:52 67696 —-a-w- c:\program files\mozilla firefox\components\jar50.dll
2008-10-18 00:21 . 2007-10-10 22:52 54376 -c–a-w- c:\program files\mozilla firefox\components\jsd3250.dll
2008-10-18 00:21 . 2007-10-10 22:52 34952 —-a-w- c:\program files\mozilla firefox\components\myspell.dll
2008-10-18 00:21 . 2007-10-10 22:52 46720 —-a-w- c:\program files\mozilla firefox\components\spellchk.dll
2008-10-18 00:21 . 2007-10-10 22:52 172144 -c–a-w- c:\program files\mozilla firefox\components\xpinstal.dll
2008-06-19 09:16 . 2008-06-19 09:16 118784 —-a-w- c:\program files\mozilla firefox\plugins\MyCamera.dll
2001-07-22 02:45 . 2001-07-22 02:45 94784 -csh–w- c:\windows\twain.dll
2008-04-14 00:12 . 2001-08-18 05:36 50688 -csh–w- c:\windows\twain_32.dll
2008-04-14 00:12 . 2004-02-28 19:01 413696 –sha-w- c:\windows\SYSTEM32\msvcp60.dll
2008-04-14 00:12 . 2001-08-18 05:36 11776 –sh–w- c:\windows\SYSTEM32\regsvr32.exe
.

((((((((((((((((((((((((((((( SnapShot@2009-06-03_23.18.14 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-06-04 10:19 . 2009-06-04 10:19 16384 c:\windows\Temp\Perflib_Perfdata_394.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-18 68856]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UfSeAgnt.exe"="c:\program files\Trend Micro\Internet Security\UfSeAgnt.exe" [2008-07-29 1398024]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-06-03 148888]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" - c:\windows\SYSTEM32\narrator.exe [2008-04-14 53760]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ \0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Image Transfer.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Image Transfer.lnk
backup=c:\windows\pss\Image Transfer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^Greetings Workshop Reminders.lnk]
path=c:\documents and settings\Owner\Start Menu\Programs\Startup\Greetings Workshop Reminders.lnk
backup=c:\windows\pss\Greetings Workshop Reminders.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"WLSetupSvc"=3 (0x3)
"WinDefend"=2 (0x2)
"usnjsvc"=3 (0x3)
"SNDSrvc"=3 (0x3)
"gusvc"=3 (0x3)
"AVG Anti-Spyware Guard"=2 (0x2)
"aawservice"=2 (0x2)
"tmproxy"=2 (0x2)
"TmPfw"=2 (0x2)
"Tmntsrv"=2 (0x2)
"PcScnSrv"=3 (0x3)
"PcCtlCom"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Hasbro Interactive\\Scrabble v2.0\\Scrabble v2.0.exe"=
"c:\\Program Files\\AIM\\aim.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\SYSTEM32\\dplaysvr.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R2 tmpreflt;tmpreflt;c:\windows\SYSTEM32\drivers\tmpreflt.sys [9/17/2007 12:09 PM 36368]
R3 DLKRTS;D-Link DFE-530TX+ PCI Adapter;c:\windows\SYSTEM32\drivers\DLKRTS.SYS [6/12/2004 4:30 PM 45568]
R3 P0630VID;Creative WebCam Live!;c:\windows\SYSTEM32\drivers\P0630Vid.sys [6/12/2005 12:11 PM 91797]
S2 tmevtmgr;tmevtmgr;c:\windows\SYSTEM32\drivers\tmevtmgr.sys [1/5/2008 12:23 PM 52624]
S3 tmproxy;Trend Micro Proxy Service;c:\program files\Trend Micro\Internet Security\TmProxy.exe [1/5/2008 12:23 PM 648456]
S4 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592]
.
Contents of the 'Scheduled Tasks' folder

2009-05-30 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2009-06-04 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 16:20]

2001-12-04 c:\windows\Tasks\ISP signup reminder 2.job
- c:\windows\System32\OOBE\oobebaln.exe [2004-02-28 00:12]

2008-12-08 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 23:20]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.comcast.net/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = iexplore
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
Trusted Zone: microsoft.com\*.update
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {5685BC20-FBE6-11D2-885F-00A0243C2C64} - hxxps://ivantage.thermo.com/ivantagetec/Common/SpectrumRDC.cab
DPF: {7823A620-9DD9-11CF-A662-00AA00C066D2} - hxxps://ivantage.thermo.com/ivantagetec/Common/iemenu.cab
DPF: {A7A61128-0EAA-11D1-B22F-0000C08C00C4} - hxxps://ivantage.thermo.com/ivantagetec/Common/Ssdw3b32.cab
DPF: {BEB82CC6-09F3-43EA-BEB1-97188E21035D} - hxxp://sten-tel1.mttest.com/Shared/footpedal.cab
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\8w316dsj.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.comcast.net/
FF - prefs.js: network.proxy.http - localhost
FF - prefs.js: network.proxy.http_port - 7171
FF - prefs.js: network.proxy.type - 1
FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-04 06:38
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-06-04 6:44
ComboFix-quarantined-files.txt 2009-06-04 10:44
ComboFix2.txt 2009-06-03 23:22

Pre-Run: 3,652,448,256 bytes free
Post-Run: 3,654,918,144 bytes free

262 — E O F — 2009-05-21 19:24

CatByte

Post #12June 4, 2009, 12:23 PM UTC

Hi, Can you advise how your computer is running and if there are any outstanding issues. Please post a fresh HJT Log

phesters

Post #13June 4, 2009, 1:03 PM UTC

Seems to be running OK now.

Here is the HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:42:55 AM, on 6/4/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe
C:\Program Files\Trend Micro\BM\TMBMSRV.exe
C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: (no name) - MRI_DISABLED - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [UfSeAgnt.exe] "C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Startup: MRI_DISABLED
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.comcast.net
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1…toUploader5.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {5685BC20-FBE6-11D2-885F-00A0243C2C64} (iVantage Remote Data Control) - https://ivantage.thermo.com/ivantagetec/Com…SpectrumRDC.cab
O16 - DPF: {6F750203-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://targetphoto.kodakgallery.com/downlo…_2/axofupld.cab
O16 - DPF: {7823A620-9DD9-11CF-A662-00AA00C066D2} (PopupMenu Object) - https://ivantage.thermo.com/ivantagetec/Common/iemenu.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-09.sun.com/s/ESD7/JSCDL/jdk…ows-i586-jc.cab
O16 - DPF: {A7A61128-0EAA-11D1-B22F-0000C08C00C4} (SSDBCombo Control 3.1 - A) - https://ivantage.thermo.com/ivantagetec/Common/Ssdw3b32.cab
O16 - DPF: {BEB82CC6-09F3-43EA-BEB1-97188E21035D} (FootPedalCtl Class) - http://sten-tel1.mttest.com/Shared/footpedal.cab
O16 - DPF: {C4847596-972C-11D0-9567-00A0C9273C2A} (Crystal Report Viewer Control) - https://ivantage.thermo.com/ivantagetec/Rep…veXViewer80.cab
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Trend Micro Central Control Component (SfCtlCom) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
O23 - Service: Trend Micro Unauthorized Change Prevention Service (TMBMServer) - Trend Micro Inc. - C:\Program Files\Trend Micro\BM\TMBMSRV.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\TmProxy.exe

–
End of file - 8522 bytes

CatByte

Post #14June 4, 2009, 1:12 PM UTC

Hi,

Your log is clean.

We just have a little housekeeping to do.

please do the following

Visit ADOBE and download the latest version of Reader for your system. (9.1)

NEXT

Follow these steps to uninstall Combofix

Click START then RUN
Now type Combofix /u in the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.

[external image: Posted Image]

Next

Download ToolsCleaner2 to your desktop and run it ( by de A.Rothstein & Dj Quiou )

Click the Pt. Restauration button and press OK to the prompts.
Click the Corbeille button and press OK to the prompt.
Click the Fichiers temp button and press OK to the prompt.
Click the Recherche button and let it run ( it may look like it freezes but let it continue )
Once it is done click the Suppression button and let it remove anything it finds.
Close the program

Next

Below I have included a number of recommendations for how to protect your computer against malware infections.

Keep Windows updated by regularly checking their website at :
http://windowsupdate.microsoft.com/
This will ensure your computer has always the latest security updates available installed on your computer.
SpywareBlaster protects against bad ActiveX, it immunizes your PC against them.
SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program ( eg : TeaTimer, Windows Defender ) or there will be a conflict.
Make Internet Explorer more secure
- Click Start > Run
- Type Inetcpl.cpl & click OK
- Click on the Security tab
- Click Reset all zones to default level
- Make sure the Internet Zone is selected & Click Custom level
- In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
- Next Click OK, then Apply button and then OK to exit the Internet Properties page.
ATF Cleaner - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.
MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.
For Firefox, I highly recommend these add-ons to keep your PC even more secure.
- NoScript - for blocking ads and other potential website attacks
- McAfee SiteAdvisor - this tells you whether the sites you are about to visit are safe or not. A must if you do a lot of Googling
Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
Recovery Console - Recent trends appear to indicate that future infections will include attacks to the boot sector of the computer. The installation of the Recovery Console in the computer will be our only defense against this threat. For more information and steps to install the Recovery Console see This Article. Should you need assistance in installing the Recovery Console, please do not hesitate to ask.
Please read the guide by Rorschach112on how to prevent malware and about safe computing here

Thank you for your patience, and performing all of the procedures requested.

phesters

Post #15June 4, 2009, 6:49 PM UTC

Thanks. Everything seems to be running OK now.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] Can't get on the Internet

✨ Ask AI

Ask AI