What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Infected computer

10 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hello, Tech Team! :notworthy:
This PC was filling up with so many pop-ups that it was useless to my friend Maggie, so she asked if I could help. I updated and ran a full mbam scan from a cd and got two Koobface worms. I also ran ATF and StartUpLite. She has Kaspersky Anti-Virus so I updated that and ran a full scan. I have an HJT log. After mbam, there were no pop-ups, but I noticed that weird little things were happening such as having to retype things because I was getting bumped off of typing fields*, when I accessed the Task Manager, sometimes it would fill up with multiple entries on the applications tab and the D drive (CD) was not appearing on the My Computer screen (it's back, now). The computer is slow; it is a Pentium, 4 CPU 2.80GHz, 256 MB of RAM. The system is Windows XP Professional, version 2002, service pack 2.
She has Webroot Spy Sweeper which is expired. It was sending annoying pop-ups, so I disabled it, I thought, but tada! the pop-ups won't stop. I'd love to just uninstall it. * Ah! Every time the Spy Sweeper pops up, it knocks me off the field where I'm typing.

Here is the mbam log which found the two worms:
Malwarebytes' Anti-Malware 1.39
Database version: 2425
Windows 5.1.2600 Service Pack 2

7/14/2009 8:01:02 AM
mbam-log-2009-07-14 (08-01-02).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 161195
Time elapsed: 1 hour(s), 12 minute(s), 25 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\documents and settings\ann\local settings\Temp\~TM13C7.tmp (Worm.KoobFace) -> Quarantined and deleted successfully.
c:\documents and settings\ann\local settings\Temp\~TM81EC3F.TMP (Worm.KoobFace) -> Quarantined and deleted successfully.

Here's the Kaspersky AV scan log:
Full Scan: completed 7/14/2009 10:38:33 AM (events: 18, objects: 102557, time: 00:59:26)
Full Scan: completed 7/14/2009 10:38:33 AM (events: 18, objects: 102557, time: 00:59:26)
Full Scan: completed 7/14/2009 10:38:33 AM (events: 18, objects: 102557, time: 00:59:26)
Full Scan: completed 7/14/2009 10:38:33 AM (events: 18, objects: 102557, time: 00:59:26)
7/14/2009 9:39:07 AM Task started
7/14/2009 9:44:41 AM Detected: http://www.viruslist.com/en/advisories/29320 c:\program files\microsoft office\office11\outlook.exe
7/14/2009 9:45:02 AM Detected: http://www.viruslist.com/en/advisories/35091 c:\program files\quicktime\quicktimeplayer.exe
7/14/2009 9:45:02 AM Detected: http://www.viruslist.com/en/advisories/35364 c:\program files\microsoft office\office11\excel.exe
7/14/2009 9:45:20 AM Detected: http://www.viruslist.com/en/advisories/34572 c:\program files\microsoft office\office11\powerpnt.exe
7/14/2009 9:45:49 AM Detected: http://www.viruslist.com/en/advisories/35377 c:\program files\microsoft office\office11\winword.exe
7/14/2009 9:47:16 AM Detected: http://www.viruslist.com/en/advisories/30150 c:\program files\microsoft office\office11\mspub.exe
7/14/2009 9:47:20 AM Detected: http://www.viruslist.com/en/advisories/35314 c:\program files\itunes\itunes.exe
7/14/2009 10:16:50 AM Detected: http://www.viruslist.com/en/advisories/34580 c:\program files\Adobe\Reader 8.0\Reader\plug_ins\Annots.api
7/14/2009 10:26:34 AM Detected: http://www.viruslist.com/en/advisories/31744 c:\program files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL
7/14/2009 10:27:20 AM Detected: http://www.viruslist.com/en/advisories/29320 c:\program files\microsoft office\office11\outlook.exe
7/14/2009 10:27:30 AM Detected: http://www.viruslist.com/en/advisories/30150 c:\program files\microsoft office\office11\mspub.exe
7/14/2009 10:27:31 AM Detected: http://www.viruslist.com/en/advisories/34572 c:\program files\microsoft office\office11\powerpnt.exe
7/14/2009 10:27:33 AM Detected: http://www.viruslist.com/en/advisories/35364 c:\program files\microsoft office\office11\excel.exe
7/14/2009 10:27:36 AM Detected: http://www.viruslist.com/en/advisories/35377 c:\program files\microsoft office\office11\winword.exe
7/14/2009 10:34:44 AM Detected: http://www.viruslist.com/en/advisories/26027 c:\WINDOWS\SoftwareDistribution\Download\e9500597a78495f397efb821e37bf356\flash.ocx
7/14/2009 10:34:55 AM Detected: http://www.viruslist.com/en/advisories/23655 c:\WINDOWS\SoftwareDistribution\Download\e9500597a78495f397efb821e37bf356\msxml6.dll
7/14/2009 10:38:40 AM Task completed
( I can't tell if it removed anything.)

and here's the HJT log:
443Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:10:08 PM, on 7/14/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://my.screenname.aol.com/_cqr/login/lo…n&locale=US
R3 - URLSearchHook: AOLSearchHook Class - {54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22} - C:\Program Files\AIM Search\AOLSearch.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AOL Search Enhancement - {54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22} - C:\Program Files\AIM Search\AOLSearch.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [SoundMAXPnP] "C:\Program Files\Analog Devices\Core\smax4pnp.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [CanonSolutionMenu] "C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe" /logon
O4 - HKLM\..\Run: [CanonMyPrinter] "C:\Program Files\Canon\MyPrinter\BJMyPrt.exe" /logon
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

–
End of file - 5399 bytes
Thank you very much!
:wavey: Kathy
Post #2
Hello Kathy

Welcome to the Whatthetech Malware Removal Forum,

All advice given by anyone volunteering here, is taken at your own risk.
While best efforts are made to assist in removing infections safely, unexpected stuff can happen.


Sorry about the delay, but the amount of people posting with infected computers is through the roof and sometimes we can't get to logs as fast as we would like to.


Download TFC to your desktop
  • Close any open windows.
  • Double click the TFC icon to run the program
  • TFC will close all open programs itself in order to run,
  • Click the Start button to begin the process.
  • Allow TFC to run uninterrupted.
  • The program should not take long to finish it's job
  • Once its finished it should automatically reboot your machine,
  • if it doesn't, manually reboot to ensure a complete clean






Download ComboFix from one of these locations:

Link 1
Link 2
Link 3

* IMPORTANT !!! Save ComboFix.exe to your Desktop


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
  • See this Link for programs that need to be disabled and instruction on how to disable them.
  • Remember to re-enable them when we're done.

  • Double click on ComboFix.exe & follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


[external image: Posted Image]



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply along with a New Hijackthis log.

*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.
Post #3
:D Hello, Ken!!! [external image: Posted Image]
Thank you for helping me!
I ran the TFC.

Here is the ComboFix log:
ComboFix 09-07-19.02 - Admin 07/19/2009 17:07.1.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.254.92 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Kaspersky Anti-Virus *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
AV: Spy Sweeper with AntiVirus *On-access scanning disabled* (Updated) {B3891867-7230-459B-9987-E7CCFA7A7D1D}
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2009-06-19 to 2009-07-19 )))))))))))))))))))))))))))))))
.

2009-07-14 17:09 . 2009-07-14 17:09 ——– d—–w- c:\program files\Trend Micro
2009-07-14 17:03 . 2009-07-14 17:04 ——– d—–w- c:\documents and settings\Admin\Local Settings\Application Data\Adobe
2009-07-14 11:09 . 2009-07-14 11:09 43016 —-a-w- c:\documents and settings\Admin\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-07-14 10:37 . 2009-07-14 10:37 ——– d—–w- c:\documents and settings\Admin\Application Data\Malwarebytes
2009-07-14 10:37 . 2009-07-13 17:36 38160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-14 10:37 . 2009-07-14 10:37 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-07-14 10:36 . 2009-07-13 17:36 19096 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-07-14 10:36 . 2009-07-14 10:37 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-07-04 12:18 . 2009-07-04 14:30 ——– d—–w- c:\documents and settings\ann\Local Settings\Application Data\Google
2009-07-04 03:54 . 2009-07-04 03:55 ——– d-s—w- c:\documents and settings\Admin\UserData
2009-07-04 01:57 . 2009-07-14 15:16 ——– d—–w- c:\documents and settings\Admin\Local Settings\Application Data\Google
2009-07-04 01:54 . 2009-07-04 12:37 ——– d—–w- c:\program files\Google
2009-07-04 01:11 . 2009-05-19 05:36 97072 ——w- c:\documents and settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4426.0.4\bsetutil.exe
2009-07-04 01:11 . 2007-08-17 13:34 107872 ——w- c:\documents and settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4426.0.4\aolsetup.exe
2009-07-04 01:11 . 2009-05-19 05:36 111920 ——w- c:\documents and settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4426.0.4\AOLSearch.dll
2009-07-04 01:11 . 2009-05-19 05:35 95792 ——w- c:\documents and settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4426.0.4\AOLFirewallMgr.dll
2009-07-04 01:11 . 2009-05-19 05:35 120368 ——w- c:\documents and settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4426.0.4\aoldlmgr.exe
2009-07-04 01:11 . 2009-05-19 05:35 69104 ——w- c:\documents and settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4426.0.4\amos.exe
2009-07-04 01:11 . 2009-05-19 05:35 37888 ——w- c:\documents and settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4426.0.4\amoinst.exe
2009-07-04 01:06 . 2009-05-19 05:36 142040 ——w- c:\documents and settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4426.0.4\alsetup.exe
2009-07-04 01:06 . 2009-05-19 05:35 550024 ——w- c:\documents and settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4426.0.4\AIMLang.exe
2009-07-04 01:04 . 2009-05-19 05:35 2402104 ——w- c:\documents and settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4426.0.4\AIMinst.exe
2009-07-04 00:24 . 2009-07-04 00:24 ——– d—–w- c:\documents and settings\Admin\Application Data\acccore
2009-07-04 00:24 . 2009-07-04 00:24 ——– d—–w- c:\documents and settings\Admin\Local Settings\Application Data\AOL OCP
2009-07-04 00:24 . 2009-07-04 00:24 ——– d—–w- c:\documents and settings\Admin\Local Settings\Application Data\AOL

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-19 21:18 . 2008-09-12 15:42 ——– d—–w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-07-19 21:16 . 2008-09-12 15:42 598048 –sha-w- c:\windows\system32\drivers\fidbox2.dat
2009-07-19 21:16 . 2008-09-12 15:42 42800 –sha-w- c:\windows\system32\drivers\fidbox.idx
2009-07-19 21:16 . 2008-09-12 15:42 3124 –sha-w- c:\windows\system32\drivers\fidbox2.idx
2009-07-19 21:16 . 2008-09-12 15:42 5340192 –sha-w- c:\windows\system32\drivers\fidbox.dat
2009-06-19 11:04 . 2009-05-11 18:59 664 —-a-w- c:\documents and settings\ann\Local Settings\Application Data\d3d9caps.dat
2009-06-16 14:55 . 2004-08-04 12:00 82432 —-a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:55 . 2004-08-04 12:00 119808 —-a-w- c:\windows\system32\t2embed.dll
2009-06-03 19:27 . 2004-08-04 12:00 1290752 —-a-w- c:\windows\system32\quartz.dll
2009-05-28 04:09 . 2009-04-10 18:34 ——– d—–w- c:\documents and settings\ann\Application Data\Canon
2009-05-28 00:49 . 2008-10-27 18:06 43016 —-a-w- c:\documents and settings\ann\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-20 19:28 . 2008-09-12 15:43 105395 —-a-w- c:\windows\system32\drivers\klin.dat
2009-05-20 19:28 . 2008-09-12 15:43 94643 —-a-w- c:\windows\system32\drivers\klick.dat
2009-05-19 05:36 . 2009-07-04 01:12 2884832 ——w- c:\documents and settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4426.0.4\vwpt.exe
2009-05-19 05:36 . 2009-07-04 01:12 28 ——w- c:\documents and settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4426.0.4\unregister.bat
2009-05-19 05:36 . 2009-07-04 01:12 1484856 ——w- c:\documents and settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4426.0.4\toolbar.exe
2009-05-19 05:36 . 2009-07-04 01:12 25 ——w- c:\documents and settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4426.0.4\register.bat
2009-05-19 05:36 . 2009-07-04 01:12 30512 ——w- c:\documents and settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4426.0.4\Uninstaller.exe
2009-05-07 15:44 . 2004-08-04 12:00 344064 —-a-w- c:\windows\system32\localspl.dll
2009-05-01 19:16 . 2009-05-01 19:16 34062 —-a-w- c:\documents and settings\ann\Application Data\Move Networks\ie_bin\Uninst.exe
2009-04-29 04:52 . 2004-08-04 12:00 659456 —-a-w- c:\windows\system32\wininet.dll
2009-04-29 04:52 . 2004-08-04 12:00 81920 —-a-w- c:\windows\system32\ieencode.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 1404928]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2008-03-11 689488]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2008-03-18 1848648]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-04 413696]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [2009-02-05 206088]
"SpySweeper"="c:\program files\Webroot\Spy Sweeper\SpySweeperUI.exe" [2007-01-26 4865600]

c:\documents and settings\ann\Start Menu\Programs\Startup\
PowerReg Scheduler V3.exe [2008-12-27 225280]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 40048]
Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 734872]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WebrootSpySweeperService]
@="Service"
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [1/29/2008 6:29 PM 33808]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [9/13/2008 8:56 PM 24652]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [4/30/2008 6:06 PM 24592]
.
Contents of the 'Scheduled Tasks' folder

2009-06-24 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2009-07-19 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-05-06 02:18]
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-Aim6 - (no file)


.
——- Supplementary Scan ——-
.
uInternet Connection Wizard,ShellNext = https://my.screenname.aol.com/_cqr/login/lo…n&locale;=US
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-19 17:18
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(1004)
c:\windows\system32\WRLogonNTF.dll
.
———————— Other Running Processes ————————
.
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Webroot\Spy Sweeper\SpySweeper.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\imapi.exe
.
**************************************************************************
.
Completion time: 2009-07-19 17:27 - machine was rebooted
ComboFix-quarantined-files.txt 2009-07-19 21:27

Pre-Run: 25,850,634,240 bytes free
Post-Run: 25,963,851,776 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

147 — E O F — 2009-07-15 23:25

and here is the HijackThis log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:31:29 PM, on 7/19/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://my.screenname.aol.com/_cqr/login/lo…n&locale;=US
R3 - URLSearchHook: AOLSearchHook Class - {54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22} - C:\Program Files\AIM Search\AOLSearch.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AOL Search Enhancement - {54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22} - C:\Program Files\AIM Search\AOLSearch.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [SoundMAXPnP] "C:\Program Files\Analog Devices\Core\smax4pnp.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [CanonSolutionMenu] "C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe" /logon
O4 - HKLM\..\Run: [CanonMyPrinter] "C:\Program Files\Canon\MyPrinter\BJMyPrt.exe" /logon
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe"
O4 - HKLM\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe /startintray
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

–
End of file - 5500 bytes
:wavey: Kathy
Post #4 last edited
Hello Kathy,

Go to your Add Remove Programs in the Control Panel and uninstall Viewpoint, it installs without your knowledge or consent, is considered Adware, uses system resources and is not needed for anything.

Even though Combofix did not remove anything and your HJT log looks fine, there where entries on your HJT log for a rootkit infection, I won't be sure its present until you run these scans.

Lets try this one first

Download gmer.zip and save to your desktop.
alternate download site
  • Unzip/extract the file to its own folder. (Click here for information on how to do this if not sure. Win 2000 users click here.
  • When you have done this, disconnect from the Internet and close all running programs.
    There is a small chance this application may crash your computer so save any work you have open.
  • Double-click on Gmer.exe to start the program.
  • Allow the gmer.sys driver to load if asked.
  • If it gives you a warning at program start about rootkit activity and asks if you want to run a scan…click NO.
  • Run Gmer again and click on the Rootkit tab.
  • Look at the right hand side (under Files) and uncheck all drives with the exception of your C drive.
  • Make sure all other boxes on the right of the screen are checked, EXCEPT for "Show All".
  • Click on the "Scan" and wait for the scan to finish.
    Note: Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while this scan completes. Also do not use your computer during the scan.
  • When completed, click on the Copy button and right-click on your Desktop, choose "New" > Text document. Once the file is created, open it and right-click again and choose Paste or Ctrl+V. Save the file as gmer.txt and copy the information in your next reply.
  • Note: If you have any problems, try running GMER in SAFE MODE"
Important! Please do not select the "Show all" checkbox during the scan..
Post #5 last edited
Hello, Ken! :D I removed Viewpoint. I ran GMER, but could not retrieve the log. It did not want to scan in safe mode. The first time I ran it, it was taking a while, so I walked away from the console. When I returned, the open GMER window was gone, so I ran it again. This time, I was able to hit the COPY button. It copied to clipboard but then gave me a 'not enough resources' error when I tried to open a text document. Shall I try again or do something else? :wavey: Kathy
Post #6
Try this one

Rooter Rootkit Detector - Please Download from here to your Desktop:
  • Doubleclick it to start the tool.
  • A Notepad file containing the report will open, also found at %systemdrive% (usually C:)\Rooter.txt.
Post #7
Hello, Ken! :) Wow! That was fast! Here's the log: Rooter.exe (v1.0.2) by Eric_71 . SeDebugPrivilege granted successfully … . Windows XP . (5.1.2600) Service Pack 2 [32_bits] - x86 Family 15 Model 3 Stepping 4, GenuineIntel . [wscsvc] (Security Center) RUNNING (state:4) [SharedAccess] RUNNING (state:4) . Internet Explorer 6.0.2900.2180 . C:\ [Fixed-NTFS] .. ( Total:37 Go - Free:24 Go ) D:\ [CD_Rom] . Scan : 13:31.19 Path : C:\Documents and Settings\Admin\Desktop\Rooter.exe User : Admin ( Administrator -> YES ) . ———————-\\ Processes . Locked [System Process] (0) ______ System (4) ______ \SystemRoot\System32\smss.exe (924) ______ \??\C:\WINDOWS\system32\csrss.exe (980) ______ \??\C:\WINDOWS\system32\winlogon.exe (1004) ______ C:\WINDOWS\system32\services.exe (1048) ______ C:\WINDOWS\system32\lsass.exe (1060) ______ C:\WINDOWS\system32\svchost.exe (1220) ______ C:\WINDOWS\system32\svchost.exe (1316) ______ C:\WINDOWS\System32\svchost.exe (1440) ______ C:\WINDOWS\system32\svchost.exe (1604) ______ C:\WINDOWS\system32\spoolsv.exe (1832) ______ C:\WINDOWS\Explorer.EXE (272) ______ C:\WINDOWS\system32\svchost.exe (444) ______ C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (476) Locked avp.exe (488) ______ C:\Program Files\Bonjour\mDNSResponder.exe (508) ______ C:\WINDOWS\system32\svchost.exe (744) ______ C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe (916) ______ C:\WINDOWS\System32\alg.exe (976) ______ C:\Program Files\Analog Devices\Core\smax4pnp.exe (260) ______ C:\Program Files\iTunes\iTunesHelper.exe (908) ______ C:\WINDOWS\system32\hkcmd.exe (1356) ______ C:\WINDOWS\system32\igfxpers.exe (1616) ______ C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (1736) Locked avp.exe (1904) ______ C:\Program Files\iPod\bin\iPodService.exe (2448) ______ C:\Program Files\internet explorer\iexplore.exe (2912) ______ C:\WINDOWS\system32\wuauclt.exe (3248) ______ C:\Documents and Settings\Admin\Desktop\Rooter.exe (1560) . ———————-\\ Device\Harddisk0\ . \Device\Harddisk0 [Sectors : 63 x 512 Bytes] . \Device\Harddisk0\Partition1 –[ MBR ]– (Start_Offset:32256 | Length:39991279104) . ———————-\\ Scheduled Tasks . C:\WINDOWS\Tasks\AppleSoftwareUpdate.job C:\WINDOWS\Tasks\desktop.ini C:\WINDOWS\Tasks\SA.DAT C:\WINDOWS\Tasks\WGASetup.job . ———————-\\ Registry . . ———————-\\ Files & Folders . ———————-\\ Scan completed at 13:31.21 . C:\Rooter$\Rooter_1.txt - (20/07/2009 | 13:31.21) :wavey: Kathy
Post #9
Hello, Ken! ^_^ It is slow, but nothing weird right now. Should I get rid of the Kaspersky and install a free av? Did the Kaspersky actually remove anything?What do you think about the Webroot Spy Sweeper? It's expired and I think it's a pain. Wouldn't a good av do the job? I'm going to install McAfee Site Advisor. :wavey: Kathy
Post #10
Hello Kathy,

Webroot Spy Sweeper <– a very good program, but I installed it on one of my systems last year and it really clogged it up,uninstalled it and things where back to normal, on the other hand we have it on 90+ computers where I work and no problems. So this is your call to keep it or not.

Kaspersky <– This is also a good program, yours to keep or remove and install something else.

Lets run this program, it wont fix anything but I need to see the report.

Download DDS by sUBs from one of the following links. Save it to your desktop.
  • DDS.scr
  • DDS.pif
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explaination about the tool. No input is needed, the scan is running.
  • Notepad will open with the results, click no to the Optional_Scan
  • Follow the instructions that pop up for posting the results.
  • Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.
Post #11 last edited
Hello, Ken! ^_^
Here's the DDS.txt:

DDS (Ver_09-06-26.01) - NTFSx86
Run by [removed] at 7:33:03.33 on Tue 07/21/2009
Internet Explorer: 6.0.2900.2180
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.254.102 [GMT -4:00]

AV: Spy Sweeper with AntiVirus *On-access scanning disabled* (Updated) {B3891867-7230-459B-9987-E7CCFA7A7D1D}
AV: Kaspersky Anti-Virus *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Documents and Settings\Admin\Desktop\dds.scr

============== Pseudo HJT Report ===============

uInternet Connection Wizard,ShellNext =

https://my.screenname.aol.com/_cqr/login/lo…MI%2FqxhzMtzmwQ

AAA%3D%3D⟨=en&locale;=US
uURLSearchHooks: AOLSearchHook Class: {54eb34ea-e6be-4cfd-9f4f-c4a0c2eafa22} - c:\program files\aim search\AOLSearch.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common

files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: AOLSearchHook Class: {54eb34ea-e6be-4cfd-9f4f-c4a0c2eafa22} - c:\program files\aim search\AOLSearch.dll
BHO: IEVkbdBHO Class: {59273ab4-e7d3-40f9-a1a8-6fa9cca1862c} - c:\program files\kaspersky lab\kaspersky anti-virus

2009\ievkbd.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google

toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program

files\google\googletoolbarnotifier\5.2.4204.1700\swg.dll
BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google

toolbar\component\fastsearch_B7C5AC242193BB3E.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
mRun: [SoundMAXPnP] "c:\program files\analog devices\core\smax4pnp.exe"
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe
mRun: [igfxpers] c:\windows\system32\igfxpers.exe
mRun: [CanonSolutionMenu] "c:\program files\canon\solutionmenu\CNSLMAIN.exe" /logon
mRun: [CanonMyPrinter] "c:\program files\canon\myprinter\BJMyPrt.exe" /logon
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [AVP] "c:\program files\kaspersky lab\kaspersky anti-virus 2009\avp.exe"
mRun: [SpySweeper] c:\program files\webroot\spy sweeper\SpySweeperUI.exe /startintray
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\reader

8.0\reader\reader_sl.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~2.lnk - c:\program files\adobe\reader

8.0\reader\AdobeCollabSync.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - {85E0B171-04FA-11D1-B7DA-00A0C90348D6} - c:\program files\kaspersky

lab\kaspersky anti-virus 2009\SCIEPlgn.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} -

c:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: {48DD0448-9209-4F81-9F6D-D83562940134} - hxxp://lads.myspace.com/upload/MySpaceUploader1006.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} -

hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
Notify: igfxcui - igfxdev.dll
Notify: klogon - c:\windows\system32\klogon.dll
Notify: WRNotifier - WRLogonNTF.dll

============= SERVICES / DRIVERS ===============

R0 kl1;Kl1;c:\windows\system32\drivers\kl1.sys [2008-7-21 121872]
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-1-29 33808]
R1 KLIF;Kaspersky Lab Driver;c:\windows\system32\drivers\klif.sys [2008-9-12 213520]
R2 AVP;Kaspersky Anti-Virus;c:\program files\kaspersky lab\kaspersky anti-virus 2009\avp.exe [2008-7-29 208616]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\mcafee\siteadvisor\McSACore.exe [2009-7-20 210216]
R2 WebrootSpySweeperService;Webroot Spy Sweeper Engine;c:\program files\webroot\spy sweeper\SpySweeper.exe [2008-9-10

3376704]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2008-4-30 24592]

=============== Created Last 30 ================

2009-07-20 17:31 –d—– c:\program files\common files\McAfee
2009-07-20 17:30 –d—– c:\program files\McAfee
2009-07-20 13:31 –d—– C:\Rooter$
2009-07-19 17:26 -cd—– c:\windows\system32\dllcache\cache
2009-07-19 17:05 a-dshr– C:\cmdcons
2009-07-19 17:02 219,648 a——- c:\windows\PEV.exe
2009-07-19 17:02 161,792 a——- c:\windows\SWREG.exe
2009-07-19 17:02 98,816 a——- c:\windows\sed.exe
2009-07-14 13:09 –d—– c:\program files\Trend Micro
2009-07-14 06:37 –d—– c:\docume~1\admin\applic~1\Malwarebytes
2009-07-14 06:37 38,160 a——- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-14 06:37 –d—– c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-07-14 06:36 19,096 a——- c:\windows\system32\drivers\mbam.sys
2009-07-14 06:36 –d—– c:\program files\Malwarebytes' Anti-Malware
2009-07-03 23:54 –ds—- c:\documents and settings\admin\UserData

==================== Find3M ====================

2009-07-21 02:00 598,048 a–sh— c:\windows\system32\drivers\fidbox2.dat
2009-07-21 02:00 3,124 a–sh— c:\windows\system32\drivers\fidbox2.idx
2009-07-21 02:00 5,340,192 a–sh— c:\windows\system32\drivers\fidbox.dat
2009-07-21 02:00 42,800 a–sh— c:\windows\system32\drivers\fidbox.idx
2009-06-16 10:55 119,808 a——- c:\windows\system32\t2embed.dll
2009-06-16 10:55 82,432 a——- c:\windows\system32\fontsub.dll
2009-06-03 15:27 1,290,752 a——- c:\windows\system32\quartz.dll
2009-05-07 11:44 344,064 a——- c:\windows\system32\localspl.dll
2009-04-29 00:52 659,456 a——- c:\windows\system32\wininet.dll
2009-04-29 00:52 81,920 a——- c:\windows\system32\ieencode.dll

============= FINISH: 7:33:40.80 ===============
and I've attached Attach.txt, zipped.
Can you tell if Kaspersky removed anything? :o I'm going to run that scan again.
:wavey: Kathy

Here's the Kaspersky av's log:

Full Scan: completed 7/21/2009 8:33:10 AM (events: 18, objects: 98692, time: 00:41:21)
7/21/2009 7:51:49 AM Task started
7/21/2009 7:54:04 AM Detected: http://www.viruslist.com/en/advisories/29320 c:\program files\microsoft office\office11\outlook.exe
7/21/2009 7:54:16 AM Detected: http://www.viruslist.com/en/advisories/35091 c:\program files\quicktime\quicktimeplayer.exe
7/21/2009 7:54:20 AM Detected: http://www.viruslist.com/en/advisories/34572 c:\program files\microsoft office\office11\powerpnt.exe
7/21/2009 7:54:24 AM Detected: http://www.viruslist.com/en/advisories/35364 c:\program files\microsoft office\office11\excel.exe
7/21/2009 7:54:44 AM Detected: http://www.viruslist.com/en/advisories/35377 c:\program files\microsoft office\office11\winword.exe
7/21/2009 7:55:22 AM Detected: http://www.viruslist.com/en/advisories/30150 c:\program files\microsoft office\office11\mspub.exe
7/21/2009 7:55:25 AM Detected: http://www.viruslist.com/en/advisories/35314 c:\program files\itunes\itunes.exe
7/21/2009 8:15:30 AM Detected: http://www.viruslist.com/en/advisories/34580 c:\program files\Adobe\Reader 8.0\Reader\plug_ins\Annots.api
7/21/2009 8:23:19 AM Detected: http://www.viruslist.com/en/advisories/31744 c:\program files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL
7/21/2009 8:24:17 AM Detected: http://www.viruslist.com/en/advisories/29320 c:\program files\microsoft office\office11\outlook.exe
7/21/2009 8:24:24 AM Detected: http://www.viruslist.com/en/advisories/30150 c:\program files\microsoft office\office11\mspub.exe
7/21/2009 8:24:25 AM Detected: http://www.viruslist.com/en/advisories/34572 c:\program files\microsoft office\office11\powerpnt.exe
7/21/2009 8:24:26 AM Detected: http://www.viruslist.com/en/advisories/35364 c:\program files\microsoft office\office11\excel.exe
7/21/2009 8:24:30 AM Detected: http://www.viruslist.com/en/advisories/35377 c:\program files\microsoft office\office11\winword.exe
7/21/2009 8:31:05 AM Detected: http://www.viruslist.com/en/advisories/26027 c:\WINDOWS\SoftwareDistribution\Download\e9500597a78495f397efb821e37bf356\flash.ocx
7/21/2009 8:31:12 AM Detected: http://www.viruslist.com/en/advisories/23655 c:\WINDOWS\SoftwareDistribution\Download\e9500597a78495f397efb821e37bf356\msxml6.dll
7/21/2009 8:33:13 AM Task completed

What does it mean? Is it detecting malware but not removing it? :huh:

Attachments:

Post #12
It looks like its trying to tell you to run an update for Microsoft Office. Those files are vulnerable but not infected Your logs look fine.
Post #13
Thank you, Ken! :D So, should I run the updates then run the scan again? I put "How did I get infected in the first place" on the desktop for Maggie. I gave her the link to follow this thread. I deleted Combofix, the Rooter, GMER, DDS…I left ATF, MBAM and StartUpLite in a folder on the Administrator's desktop. Perhaps Maggie will try posting if she thinks she's infected in the future. I have to start a thread on a computer which my mother gave me. I can't get on the internet with it. My PC has to go back to my computer guy tomorrow morning, so I won't be able to go on-line. If I can get my mom's to work, I'll have a back-up pc. I can't stand being cut off from the internet! :wavey: Kathy
Post #14
I think just running the updates will be fine.

Just start a new topic for the other computer.

Looks like you got rid of most of them anyway.

Malwarebytes <– Yours to keep also, check for updates and run a scan now and then.

Combofix <—Is not a general cleaning tool, just run it with supervision or you can bork your system

  • Click START then RUN
  • Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.


    • [external image: Posted Image]

  • When shown the disclaimer, Select "2"

The above procedure will:
  • Delete the following:
    • ComboFix and its associated files and folders.
    • VundoFix backups, if present
    • The C:\Deckard folder, if present
    • The C:_OtMoveIt folder, if present
  • Reset the clock settings.
  • Hide file extensions, if required.
  • Hide System/Hidden files, if required.
  • Reset System Restore.


  • How did I get infected in the first place ?
    Read these links and find out how to prevent getting infected again.
  • Tutorial for System Restore <– Do this first to prevent yourself from being reinfected.
  • WhattheTech
  • Grinler BleepingComputer
  • GeeksTo Go
  • Dslreports



Keep in mind if you install some of these programs. Only ONE Anti Virus and only ONE Firewall is recommended, more is overkill and can cause you problems. You can install all the Spyware programs I have listed without any problems. If you install Spyware Blaster and Spyware Guard, they will conflict with the TeaTimer in Spybot , you can still install Spybot Search and Destroy but do not enable the TeaTimer .



Here are some free programs to install, all free and highly regarded by the fine people in the Malware Removal Community
  • Spybot Search and Destroy 1.6
    Check for Updates/ Immunize and run a Full System Scan on a regular basis. If you install Spyware Blaster ( Recommended ) then do not enable the TeaTimer in Spybot Search and Destroy.
  • Spyware Blaster It will prevent most spyware from ever being installed. No scan to run, just update about once a week and enable all protection.
  • Spyware Guard It offers realtime protection from spyware installation attempts, again, no scan to run, just install it and let it do its thing.
  • IE-Spyad
    IE-Spyad places over 6000 web sites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (cookies etc) from the sites listed, although you will still be able to connect to the sites.
  • Firefox 3 It has more features and is a lot more secure than IE. It is a very easy and painless download and install, it will no way interfere with IE, you can use them both.


Safe Surfn
Ken
Post #15
:notworthy: Ken, Thank you so much for helping me to help Maggie! I'm passing along a big thank you from her as well. :woot: I just called her. She's very excited about getting her computer back, clean. (I ran the updates.) :unsure: I'll be bringing my PC back to my guy tomorrow, so I might not be back on-line until Thursday, depending on what happens with my PC. :wavey: Kathy

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI