What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Nasty Virus has taken over my computer

11 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Dearest TechMaster,

A nasty virus has taken over my computer and nothing I do seems to get rid of it. The virus takes over from startup and puts multiple pop-ups on the screen such as "your computer is infected and needs . . . . " and names various "anti-virus programs such as ANTIVIRUS PRO 2010 as the solution. I did not install any of this on the computer. I think I closed a pop-up while surfing and that started this mess. It has also gotten into the windows security center and has made it impossible to run some programs or to get online. Windows DEP(?) wouldn't let me get online in normal mode, I had to use safe mode with networking to get online and that's acting pretty hinky- It- the supposed antivirus program opened a tab by itself while I'm here at What the Tech. The virus has also changed my desktop theme and disabled system restore. The computer when started normally also has multiple (dozens) of what looks like an MS DOS prompts that open and close too quickly to see what is going on. It seems to have gotten into quite a few things.

I tried to fix it by running scans (in safe mode) with Windows Defender, Avira AntiVir, and Spybot Search and Destroy. I would run a scan (all 3), it would find a bunch of stuff, say its fixed, tell me to reboot, and then back to square one (virus damaged computer). Repeat until you start to pull hair out. I then went to some of the locations the antivirus programs (the real ones) had mentioned in their reports and manually deleted any file with the time and date of first infection. I also did this in the windows prefetch folder. I used ATF cleaner by atribune and cleaned everything besides the Java cache, prefetch, and the recycle bin. The files that I manually removed I placed in the recycle bin but I did not empty the recycle bin just in case as many of the files were .dll or .exe . . . . .
I also msconfigged startup and disabled anything that was not there the last time I looked. The things I did helped enough to get rid of the pop-ups after startup but that's about it.

Please help! Here are all of the logs you have requested. I ran them in safe mode though. I'm afraid to turn on the computer normally because of how easily the virus seems to replicate. I hope this is OK. I thank you for your time and expertise in advance because this is not the first time you've saved my butt ! ! ! !

Thankfully ! ! ! !
Hopefully ! ! ! ! !

Shubert Schlackeye

ROOTREPEAL © AD, 2007-2009
==================================================
Scan Start Time: 2009/09/27 16:17
Program Version: Version 1.3.5.0
Windows Version: Windows XP Media Center Edition SP3
==================================================

Drivers
——————-
Name: dump_atapi.sys
Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys
Address: 0xF6DB9000 Size: 98304 File Visible: No Signed: -
Status: -

Name: dump_WMILIB.SYS
Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS
Address: 0xF79B9000 Size: 8192 File Visible: No Signed: -
Status: -

Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0xF635F000 Size: 49152 File Visible: No Signed: -
Status: -

Hidden/Locked Files
——————-
Path: C:\WINDOWS\system32\gasfkygodovtvk.dat
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\gasfkyoeshlhhb.dll
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\gasfkypmukxmyr.dat
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\gasfkyqlruccbg.dll
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\gasfkyvcqguyab.dll
Status: Invisible to the Windows API!

Path: C:\WINDOWS\Temp\gasfkykfenejrrxi.tmp
Status: Invisible to the Windows API!

Path: C:\WINDOWS\Temp\gasfkypckehxnmqv.tmp
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\drivers\gasfkyviqjyhja.sys
Status: Invisible to the Windows API!

Path: c:\documents and settings\hunter sims\local settings\temp\~dfa051.tmp
Status: Allocation size mismatch (API: 16384, Raw: 0)

Hidden Services
——————-
Service Name: gasfkybxmmodev
Image Path: C:\WINDOWS\system32\drivers\gasfkyviqjyhja.sys

==EOF==


DDS (Ver_09-09-24.01) - NTFSx86 NETWORK
Run by [removed] at 16:12:20.76 on Sun 09/27/2009
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.958.670 [GMT -4:00]

AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\system32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Documents and Settings\Hunter Sims\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://insightbb.com/
uSearch Page = hxxp://www.google.com
uDefault_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=0070119
uSearch Bar = hxxp://www.google.com/ie
uInternet Connection Wizard,ShellNext = hxxp://www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=0070119
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
mWinlogon: Userinit=c:\windows\system32\userinit.exe,c:\windows\system32\drivers\smss.exe
BHO: c:\windows\system32\y2kf4kxb.dll: {a249bc15-23f2-42ad-f4e4-00aac39c0004} - c:\windows\system32\y2kf4kxb.dll
TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar2.dll
TB: {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No File
TB: {C4069E3A-68F1-403E-B40E-20066696354B} - No File
EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [mserv] c:\documents and settings\hunter sims\application data\svcst.exe
uRun: [Yjafosi8kdf98winmdkmnkmfnwe] c:\docume~1\hunter~1\locals~1\temp\csrss.exe
mRun: [DLA] c:\windows\system32\dla\DLACTRLW.EXE
mRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe -startup
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [SPAMfighter Agent] "c:\program files\spamfighter\SFAgent.exe" update delay 60
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe
uPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
uPolicies-explorer: ForceClassicControlPanel = 1 (0x1)
mPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
IE: {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program files\partygaming\partypoker\RunApp.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - c:\program files\bodog poker\BPGame.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - {552781AF-37E4-4FEE-920A-CED9E648EADD} - c:\program files\common files\microsoft shared\encarta search bar\ENCSBAR.DLL
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/C/0/C/C0CBBA88-A6F2-48D9-9B0E-1719D1177202/LegitCheckControl.cab
DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} - hxxp://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1253491739836
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
Notify: __c00F69A - c:\windows\system32\__c00F69A.dat
AppInit_DLLs: c:\progra~1\google\google~1\GOEC62~1.DLL,lekojeta.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
STS: c:\windows\system32\y2kf4kxb.dll: {a249bc15-23f2-42ad-f4e4-00aac39c0004} - c:\windows\system32\y2kf4kxb.dll
SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\wifd1f~1\MpShHook.dll
LSA: Notification Packages = scecli lekojeta.dll pezetifu.dll

============= SERVICES / DRIVERS ===============

R2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592]
S1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2009-9-20 11608]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2009-9-20 108289]
S2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2009-9-20 185089]
S2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-9-20 55656]
S2 ColdFusion MX ODBC Agent;ColdFusion MX ODBC Agent;c:\program files\macromedia\db\slserver52\bin\swagent.exe "coldfusion mx odbc agent" –> c:\program files\macromedia\db\slserver52\bin\swagent.exe ColdFusion MX ODBC Agent [?]
S2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]
S2 SPAMfighter Update Service;SPAMfighter Update Service;c:\program files\spamfighter\sfus.exe [2009-8-27 189064]
S2 Symantec Core LC;Symantec Core LC;c:\program files\common files\symantec shared\ccpd-lc\symlcsvc.exe [2007-1-19 1174152]

=============== Created Last 30 ================

2009-09-27 12:13 –dsh— c:\documents and settings\hunter sims\IECompatCache
2009-09-27 11:24 48,640 a——- c:\windows\system32\drivers\smss.exe_
2009-09-27 09:16 2,713 —sh— c:\windows\system32\neniweja.exe
2009-09-27 05:18 17,167 a——- c:\docume~1\hunter~1\applic~1\iweqycacur.pif
2009-09-27 05:18 13,804 a——- c:\windows\iduge.pif
2009-09-27 05:18 11,507 a——- c:\windows\system32\ezelokaxu._dl
2009-09-27 05:18 11,406 a——- c:\docume~1\hunter~1\applic~1\bufegun.sys
2009-09-27 05:18 11,363 a——- c:\docume~1\alluse~1\applic~1\oruhafyson.com
2009-09-27 05:18 10,673 a——- c:\windows\system32\yvepitacyz.inf
2009-09-27 05:09 13,818 a——- c:\docume~1\hunter~1\applic~1\jewigaj.dll
2009-09-27 05:09 13,334 a——- c:\docume~1\alluse~1\applic~1\genohu.exe
2009-09-27 05:09 12,488 a——- c:\docume~1\alluse~1\applic~1\yfyf.reg
2009-09-27 05:09 12,102 a——- c:\windows\system32\rolyd.bat
2009-09-27 05:05 18,645 a——- c:\windows\system32\imapyjut.dll
2009-09-27 05:05 18,041 a——- c:\docume~1\alluse~1\applic~1\esura.bin
2009-09-27 05:05 12,594 a——- c:\docume~1\hunter~1\applic~1\inanecory.scr
2009-09-27 05:05 19,162 a——- c:\windows\system32\usecupy.com
2009-09-27 05:05 18,251 a——- c:\windows\system32\yhew.exe
2009-09-27 05:05 16,416 a——- c:\windows\system32\kohuwydoji.ban
2009-09-27 05:05 13,156 a——- c:\windows\system32\codep.dll
2009-09-27 05:05 12,090 a——- c:\docume~1\alluse~1\applic~1\xymediwe.bat
2009-09-27 05:05 0 a——- c:\windows\system32\AVR09.exe
2009-09-27 03:50 664 a——- c:\windows\system32\d3d9caps.dat
2009-09-27 03:25 110 a——- C:\xcrashdump.dat
2009-09-27 03:25 19,166 a——- c:\windows\system32\mizedoco.dl
2009-09-27 03:25 19,021 a——- c:\docume~1\hunter~1\applic~1\kiwo.pif
2009-09-27 03:25 18,510 a——- c:\docume~1\hunter~1\applic~1\biny.scr
2009-09-27 03:25 18,319 a——- c:\windows\system32\cenoxi.scr
2009-09-27 03:25 14,226 a——- c:\docume~1\hunter~1\applic~1\timebadesa.bin
2009-09-27 03:25 11,572 a——- c:\windows\system32\hyfihuvu.vbs
2009-09-27 03:25 11,304 a——- c:\docume~1\hunter~1\applic~1\zywypuvate.dat
2009-09-27 03:25 11,080 a——- c:\windows\system32\obibyzepo.reg
2009-09-27 03:25 10,318 a——- c:\windows\system32\mabixaq.exe
2009-09-27 03:10 0 a——- c:\windows\system32\41.exe
2009-09-27 03:10 167,424 a——- c:\windows\system32\_scui.cpl
2009-09-27 03:10 230,000 a——- c:\docume~1\hunter~1\applic~1\lizkavd.exe
2009-09-27 03:07 48,640 a——- c:\windows\system32\drivers\smss.exe
2009-09-27 03:07 264,192 a——- c:\docume~1\hunter~1\applic~1\seres.exe
2009-09-24 16:05 –d—– c:\program files\Agent
2009-09-22 06:53 –d—– C:\Folder
2009-09-21 14:35 –d—– C:\Incomplete
2009-09-21 14:34 –d—– C:\Limewire
2009-09-21 12:42 –d—– c:\program files\SDHelper (Spybot - Search & Destroy)
2009-09-21 12:42 –d—– c:\program files\Misc. Support Library (Spybot - Search & Destroy)
2009-09-21 12:42 –d—– c:\program files\File Scanner Library (Spybot - Search & Destroy)
2009-09-21 07:06 –d—– c:\documents and settings\hunter sims\.housecall6.6
2009-09-21 02:44 36 a——- c:\windows\system32\sysnet.dat
2009-09-20 22:56 –d—– C:\SHUBERT
2009-09-20 22:18 –d—– c:\program files\common files\Application
2009-09-20 22:18 –d—– c:\program files\SPAMfighter
2009-09-20 22:17 –d—– c:\docume~1\hunter~1\applic~1\SPAMfighter
2009-09-20 22:12 55,656 a——- c:\windows\system32\drivers\avgntflt.sys
2009-09-20 22:12 –d—– c:\program files\Avira
2009-09-20 22:12 –d—– c:\docume~1\alluse~1\applic~1\Avira
2009-09-20 21:56 –d—– c:\program files\VistaCodecPack
2009-09-20 21:55 –d—– c:\docume~1\alluse~1\applic~1\VistaCodecs
2009-09-20 21:44 411,368 a——- c:\windows\system32\deploytk.dll
2009-09-20 21:44 73,728 a——- c:\windows\system32\javacpl.cpl
2009-09-20 21:33 –dsh— c:\documents and settings\hunter sims\PrivacIE
2009-09-20 21:31 –dsh— c:\documents and settings\hunter sims\IETldCache
2009-09-20 21:27 100,352 ——– c:\windows\system32\dllcache\iecompat.dll
2009-09-20 21:27 –d—– c:\windows\ie8updates
2009-09-20 21:27 11,067,392 ——– c:\windows\system32\dllcache\ieframe.dll
2009-09-20 21:27 1,985,536 ——– c:\windows\system32\dllcache\iertutil.dll
2009-09-20 21:27 594,432 ——– c:\windows\system32\dllcache\msfeeds.dll
2009-09-20 21:27 246,272 ——– c:\windows\system32\dllcache\ieproxy.dll
2009-09-20 21:27 55,296 ——– c:\windows\system32\dllcache\msfeedsbs.dll
2009-09-20 21:27 12,800 ——– c:\windows\system32\dllcache\xpshims.dll
2009-09-20 21:26 -cd-h— c:\windows\ie8
2009-09-20 20:57 272,128 ——– c:\windows\system32\dllcache\bthport.sys
2009-09-20 20:55 203,136 ——– c:\windows\system32\dllcache\rmcast.sys
2009-09-20 20:55 691,712 ——– c:\windows\system32\dllcache\inetcomm.dll
2009-09-20 20:55 331,776 ——– c:\windows\system32\dllcache\msadce.dll
2009-09-20 20:55 333,952 ——– c:\windows\system32\dllcache\srv.sys
2009-09-20 20:55 455,296 ——– c:\windows\system32\dllcache\mrxsmb.sys
2009-09-20 20:55 1,315,328 ——– c:\windows\system32\dllcache\msoe.dll
2009-09-20 20:54 337,408 ——– c:\windows\system32\dllcache\netapi32.dll
2009-09-20 20:54 1,106,944 ——– c:\windows\system32\dllcache\msxml3.dll
2009-09-20 20:54 2,560 ——– c:\windows\system32\xpsp4res.dll
2009-09-20 20:54 1,203,922 ——– c:\windows\system32\dllcache\sysmain.sdb
2009-09-20 20:54 215,552 ——– c:\windows\system32\dllcache\wordpad.exe
2009-09-20 20:45 –d—– c:\windows\system32\scripting
2009-09-20 20:45 –d—– c:\windows\system32\en
2009-09-20 20:45 –d—– c:\windows\l2schemas
2009-09-20 20:45 –d—– c:\windows\system32\bits
2009-09-20 20:43 –d—– c:\windows\ServicePackFiles
2009-09-20 20:41 –d—– c:\windows\network diagnostic
2009-09-20 20:19 104,960 ——– c:\windows\system32\drivers\atinrvxx.sys
2009-09-20 20:09 31,768 a——- c:\windows\system32\wucltui.dll.mui
2009-09-20 20:09 23,576 a——- c:\windows\system32\wuaucpl.cpl.mui
2009-09-20 20:09 18,456 a——- c:\windows\system32\wuaueng.dll.mui
2009-09-20 20:09 23,576 a——- c:\windows\system32\wuapi.dll.mui

==================== Find3M ====================

2009-09-27 14:49 21 a——- C:\qpmd8376.bin
2009-09-20 20:48 88,263 a——- c:\windows\pchealth\helpctr\offlinecache\index.dat
2009-08-05 05:01 204,800 a——- c:\windows\system32\mswebdvd.dll
2009-08-05 05:01 204,800 ——– c:\windows\system32\dllcache\mswebdvd.dll
2009-08-04 15:11 160,564 a——- c:\windows\Sqirlz Water Reflections Uninstaller.exe
2009-08-03 18:24 16,530 a——- c:\docume~1\hunter~1\applic~1\wklnhst.dat
2009-08-03 17:29 2,516 a–sh— c:\windows\system32\KGyGaAvL.sys
2009-07-29 00:37 119,808 a——- c:\windows\system32\t2embed.dll
2009-07-29 00:37 81,920 a——- c:\windows\system32\fontsub.dll
2009-07-29 00:37 119,808 ——– c:\windows\system32\dllcache\t2embed.dll
2009-07-29 00:37 81,920 ——– c:\windows\system32\dllcache\fontsub.dll
2009-07-19 09:18 5,937,152 ——– c:\windows\system32\dllcache\mshtml.dll
2009-07-18 12:05 1,509,888 ——– c:\windows\system32\dllcache\shdocvw.dll
2009-07-17 15:01 58,880 a——- c:\windows\system32\atl.dll
2009-07-17 15:01 58,880 ——– c:\windows\system32\dllcache\atl.dll
2009-07-13 23:43 10,841,088 a——- c:\windows\system32\dllcache\wmp.dll
2009-07-13 23:43 286,208 a——- c:\windows\system32\wmpdxm.dll
2009-07-13 23:43 286,208 ——– c:\windows\system32\dllcache\wmpdxm.dll
2009-07-03 13:09 915,456 a——- c:\windows\system32\wininet.dll
2009-07-03 13:09 915,456 ——– c:\windows\system32\dllcache\wininet.dll
2009-07-03 13:09 1,208,832 ——– c:\windows\system32\dllcache\urlmon.dll
2009-07-03 13:09 206,848 ——– c:\windows\system32\dllcache\occache.dll
2009-07-03 13:09 25,600 ——– c:\windows\system32\dllcache\jsproxy.dll
2009-07-03 13:09 184,320 ——– c:\windows\system32\dllcache\iepeers.dll
2009-07-03 13:09 386,048 ——– c:\windows\system32\dllcache\iedkcs32.dll
2009-07-03 07:01 173,056 ——– c:\windows\system32\dllcache\ie4uinit.exe
2009-06-27 03:07 0 a–sh— c:\windows\system32\wepetobe.dll

============= FINISH: 16:13:45.04 ===============

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:57:01 PM, on 9/27/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\drivers\smss.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Hunter Sims\My Documents\Software\HIJACKTHIS\HIJACKTHIS V2.0.2.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=0070119
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://insightbb.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=0070119
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\drivers\smss.exe
O2 - BHO: C:\WINDOWS\system32\y2kf4kxb.dll - {A249BC15-23F2-42AD-F4E4-00AAC39C0004} - C:\WINDOWS\system32\y2kf4kxb.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [SPAMfighter Agent] "C:\Program Files\SPAMfighter\SFAgent.exe" update delay 60
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [mserv] C:\Documents and Settings\Hunter Sims\Application Data\svcst.exe
O4 - HKCU\..\Run: [Yjafosi8kdf98winmdkmnkmfnwe] C:\DOCUME~1\HUNTER~1\LOCALS~1\Temp\csrss.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\BPGame.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1253491739836
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL,lekojeta.dll
O20 - Winlogon Notify: __c00F69A - C:\WINDOWS\system32\__c00F69A.dat (file missing)
O22 - SharedTaskScheduler: iukjsf8w3jirojs9f8u3jruhsf78s3jijdif - {A249BC15-23F2-42AD-F4E4-00AAC39C0004} - C:\WINDOWS\system32\y2kf4kxb.dll (file missing)
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: ColdFusion MX Application Server - Macromedia Inc. - C:\Program Files\Macromedia\runtime\bin\jrunsvc.exe
O23 - Service: ColdFusion MX ODBC Agent - Unknown owner - C:\Program Files\Macromedia\db\slserver52\bin\swagent.exe
O23 - Service: ColdFusion MX ODBC Server - Unknown owner - C:\Program Files\Macromedia\db\slserver52\bin\swstrtr.exe
O23 - Service: Flash Communication Server (FlashCom) - Macromedia, Inc. - C:\Program Files\Macromedia\Flash Communication Server MX\FlashCom.exe
O23 - Service: Flash Communication Admin Service (FlashComAdmin) - Macromedia, Inc. - C:\Program Files\Macromedia\Flash Communication Server MX\FlashComAdmin.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SPAMfighter Update Service - SPAMfighter ApS - C:\Program Files\SPAMfighter\sfus.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

–
End of file - 7095 bytes

Attachments:

Post #2
Please do the following:


Download Combofix from either of the links below. You must rename it to combo-fix.exe before saving it.
Save it to your desktop.

**Note: In the event you already have Combofix, delete it, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**

  • If you are using Firefox, make sure that your download settings are as follows:
  • Tools->Options->Main tab
  • Set to "Always ask me where to Save the files".



Link 1
Link 2


———————————————————–


  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.


    ———————————————————–


  • NOTE: If ComboFix asks to install the Recovery Console, please ALLOW it to do so.


    ———————————————————–

  • Double click on the renamed ComboFix.exe & follow the prompts. When finished, it will produce a report for you.
  • Please post the C:\ComboFix.txt so we can continue cleaning the system.

———————————————————–

Post #3
Thank you for responding so quickly! :notworthy: I have done as you requested. Here is the report:

ComboFix 09-09-28.01 - Hunter Sims 09/29/2009 16:23.1.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.958.561 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\combo-fix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\esura.bin
c:\documents and settings\All Users\Application Data\genohu.exe
c:\documents and settings\All Users\Application Data\hyhepy.ban
c:\documents and settings\All Users\Application Data\igyl._sy
c:\documents and settings\All Users\Application Data\iqiqucepef._dl
c:\documents and settings\All Users\Application Data\lupywoxi.inf
c:\documents and settings\All Users\Application Data\oruhafyson.com
c:\documents and settings\All Users\Application Data\pibinyxahe.dl
c:\documents and settings\All Users\Application Data\tutawahyba.ban
c:\documents and settings\All Users\Application Data\ufafomalo.lib
c:\documents and settings\All Users\Application Data\xymediwe.bat
c:\documents and settings\All Users\Application Data\ycenu.ban
c:\documents and settings\All Users\Application Data\yfyf.reg
c:\documents and settings\Hunter Sims\Application Data\avucip.dl
c:\documents and settings\Hunter Sims\Application Data\biny.scr
c:\documents and settings\Hunter Sims\Application Data\bufegun.sys
c:\documents and settings\Hunter Sims\Application Data\himu.dl
c:\documents and settings\Hunter Sims\Application Data\inanecory.scr
c:\documents and settings\Hunter Sims\Application Data\iweqycacur.pif
c:\documents and settings\Hunter Sims\Application Data\jewigaj.dll
c:\documents and settings\Hunter Sims\Application Data\kiwo.pif
c:\documents and settings\Hunter Sims\Application Data\lizkavd.exe
c:\documents and settings\Hunter Sims\Application Data\qolihaguk.inf
c:\documents and settings\Hunter Sims\Application Data\seres.exe
c:\documents and settings\Hunter Sims\Application Data\timebadesa.bin
c:\documents and settings\Hunter Sims\Application Data\vimevihow._dl
c:\documents and settings\Hunter Sims\Application Data\ygexure.inf
c:\documents and settings\Hunter Sims\Local Settings\Application Data\aqicidurez.bat
c:\documents and settings\Hunter Sims\Local Settings\Application Data\asedilu.sys
c:\documents and settings\Hunter Sims\Local Settings\Application Data\boroqoqari.ban
c:\documents and settings\Hunter Sims\Local Settings\Application Data\edotisyx.pif
c:\documents and settings\Hunter Sims\Local Settings\Application Data\nepagug.ban
c:\documents and settings\Hunter Sims\Local Settings\Application Data\ohocudyci.bat
c:\documents and settings\Hunter Sims\Local Settings\Application Data\opytohecij.com
c:\documents and settings\Hunter Sims\Local Settings\Application Data\qipyf.dl
c:\documents and settings\Hunter Sims\Local Settings\Application Data\setituz.vbs
c:\documents and settings\Hunter Sims\Local Settings\Application Data\takepu.bin
c:\documents and settings\Hunter Sims\Local Settings\Application Data\zylijujem.dll
c:\documents and settings\Hunter Sims\Local Settings\Temporary Internet Files\diwihyjo.sys
c:\documents and settings\Hunter Sims\Local Settings\Temporary Internet Files\doxafecyri.inf
c:\documents and settings\Hunter Sims\Local Settings\Temporary Internet Files\epoxunewu.ban
c:\documents and settings\Hunter Sims\Local Settings\Temporary Internet Files\iwobogyno.vbs
c:\documents and settings\Hunter Sims\Local Settings\Temporary Internet Files\jecagu.vbs
c:\documents and settings\Hunter Sims\Local Settings\Temporary Internet Files\kofydaj.inf
c:\documents and settings\Hunter Sims\Local Settings\Temporary Internet Files\lafa.dl
c:\documents and settings\Hunter Sims\Local Settings\Temporary Internet Files\mofepyju.db
c:\documents and settings\Hunter Sims\Local Settings\Temporary Internet Files\onesetiq.db
c:\documents and settings\Hunter Sims\Local Settings\Temporary Internet Files\pesiru.dl
c:\documents and settings\Hunter Sims\Local Settings\Temporary Internet Files\racy.bin
c:\documents and settings\Hunter Sims\Local Settings\Temporary Internet Files\ufefo.dl
c:\documents and settings\Hunter Sims\Local Settings\Temporary Internet Files\vegujewel.bat
c:\documents and settings\Hunter Sims\Local Settings\Temporary Internet Files\vejolyhu._dl
c:\documents and settings\Hunter Sims\Local Settings\Temporary Internet Files\wizanego.dat
c:\windows\iduge.pif
c:\windows\kb913800.exe
c:\windows\system32\_000008_.tmp.dll
c:\windows\system32\_000009_.tmp.dll
c:\windows\system32\_000010_.tmp.dll
c:\windows\system32\_scui.cpl
c:\windows\system32\41.exe
c:\windows\system32\AVR09.exe
c:\windows\system32\cenoxi.scr
c:\windows\system32\codep.dll
c:\windows\system32\drivers\gasfkyviqjyhja.sys
c:\windows\system32\drivers\smss.exe
c:\windows\system32\ezelokaxu._dl
c:\windows\system32\gasfkygodovtvk.dat
c:\windows\system32\gasfkyoeshlhhb.dll
c:\windows\system32\gasfkypmukxmyr.dat
c:\windows\system32\gasfkyqlruccbg.dll
c:\windows\system32\gasfkyvcqguyab.dll
c:\windows\system32\hyfihuvu.vbs
c:\windows\system32\imapyjut.dll
c:\windows\system32\kohuwydoji.ban
c:\windows\system32\mabixaq.exe
c:\windows\system32\mizedoco.dl
c:\windows\system32\neniweja.exe
c:\windows\system32\obibyzepo.reg
c:\windows\system32\rolyd.bat
c:\windows\system32\sysnet.dat
c:\windows\system32\wepetobe.dll
c:\windows\system32\yhew.exe
c:\windows\system32\yvepitacyz.inf
C:\xcrashdump.dat

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_gasfkybxmmodev
——-\Legacy_gasfkybxmmodev


((((((((((((((((((((((((( Files Created from 2009-08-28 to 2009-09-29 )))))))))))))))))))))))))))))))
.

2009-09-27 20:01 . 2009-09-27 20:02 ——– d—–w- c:\program files\ERUNT
2009-09-27 16:13 . 2009-09-27 16:13 ——– d-sh–w- c:\documents and settings\Hunter Sims\IECompatCache
2009-09-27 09:09 . 2009-09-27 09:09 13302 —-a-w- c:\documents and settings\Hunter Sims\Local Settings\Application Data\oluja.dat
2009-09-27 09:05 . 2009-09-27 09:05 19162 —-a-w- c:\windows\system32\usecupy.com
2009-09-27 07:50 . 2009-09-29 03:13 664 —-a-w- c:\windows\system32\d3d9caps.dat
2009-09-24 20:05 . 2009-09-24 20:05 ——– d—–w- c:\program files\Agent
2009-09-22 10:53 . 2009-09-27 06:46 ——– d—–w- C:\Folder
2009-09-21 18:35 . 2009-09-27 06:28 ——– d—–w- C:\Incomplete
2009-09-21 18:34 . 2009-09-27 06:44 ——– d—–w- C:\Limewire
2009-09-21 16:42 . 2009-09-21 16:42 ——– d—–w- c:\program files\Misc. Support Library (Spybot - Search & Destroy)
2009-09-21 16:42 . 2009-09-21 16:42 ——– d—–w- c:\program files\SDHelper (Spybot - Search & Destroy)
2009-09-21 16:42 . 2009-09-21 16:42 ——– d—–w- c:\program files\File Scanner Library (Spybot - Search & Destroy)
2009-09-21 11:06 . 2009-09-21 11:13 ——– d—–w- c:\documents and settings\Hunter Sims\.housecall6.6
2009-09-21 06:58 . 2009-09-21 06:58 ——– d-sh–w- c:\documents and settings\Administrator\IETldCache
2009-09-21 06:38 . 2009-09-21 06:38 ——– d-sh–w- c:\windows\system32\config\systemprofile\IETldCache
2009-09-21 06:33 . 2009-09-21 06:33 ——– d-sh–w- c:\documents and settings\LocalService\IETldCache
2009-09-21 02:56 . 2009-09-21 02:57 ——– d—–w- C:\SHUBERT
2009-09-21 02:18 . 2009-09-21 02:18 ——– d—–w- c:\program files\Common Files\Application
2009-09-21 02:18 . 2009-09-29 20:31 ——– d—–w- c:\program files\SPAMfighter
2009-09-21 02:17 . 2009-09-21 02:17 ——– d—–w- c:\documents and settings\Hunter Sims\Application Data\SPAMfighter
2009-09-21 02:12 . 2009-07-28 20:33 55656 —-a-w- c:\windows\system32\drivers\avgntflt.sys
2009-09-21 02:12 . 2009-03-30 14:33 96104 —-a-w- c:\windows\system32\drivers\avipbb.sys
2009-09-21 02:12 . 2009-02-13 16:29 22360 —-a-w- c:\windows\system32\drivers\avgntmgr.sys
2009-09-21 02:12 . 2009-02-13 16:17 45416 —-a-w- c:\windows\system32\drivers\avgntdd.sys
2009-09-21 02:12 . 2009-09-21 02:12 ——– d—–w- c:\program files\Avira
2009-09-21 02:12 . 2009-09-21 02:12 ——– d—–w- c:\documents and settings\All Users\Application Data\Avira
2009-09-21 01:56 . 2009-09-21 01:56 ——– d—–w- c:\program files\VistaCodecPack
2009-09-21 01:55 . 2009-09-21 01:55 ——– d—–w- c:\documents and settings\All Users\Application Data\VistaCodecs
2009-09-21 01:44 . 2009-09-21 01:44 411368 —-a-w- c:\windows\system32\deploytk.dll
2009-09-21 01:41 . 2009-09-21 01:41 ——– d—–w- c:\program files\Windows Defender
2009-09-21 01:33 . 2009-09-21 01:33 ——– d-sh–w- c:\documents and settings\Hunter Sims\PrivacIE
2009-09-21 01:31 . 2009-09-21 01:31 ——– d-sh–w- c:\documents and settings\Hunter Sims\IETldCache
2009-09-21 01:27 . 2009-08-07 08:48 100352 ——w- c:\windows\system32\dllcache\iecompat.dll
2009-09-21 01:27 . 2009-09-21 01:27 ——– d—–w- c:\windows\ie8updates
2009-09-21 01:27 . 2009-07-19 22:48 11067392 ——w- c:\windows\system32\dllcache\ieframe.dll
2009-09-21 01:27 . 2009-07-03 17:09 12800 ——w- c:\windows\system32\dllcache\xpshims.dll
2009-09-21 01:27 . 2009-07-03 17:09 594432 ——w- c:\windows\system32\dllcache\msfeeds.dll
2009-09-21 01:27 . 2009-07-03 17:09 55296 ——w- c:\windows\system32\dllcache\msfeedsbs.dll
2009-09-21 01:27 . 2009-07-03 17:09 1985536 ——w- c:\windows\system32\dllcache\iertutil.dll
2009-09-21 01:27 . 2009-07-03 17:09 246272 ——w- c:\windows\system32\dllcache\ieproxy.dll
2009-09-21 01:26 . 2009-09-21 01:27 ——– dc-h–w- c:\windows\ie8
2009-09-21 00:57 . 2008-06-13 11:05 272128 ——w- c:\windows\system32\dllcache\bthport.sys
2009-09-21 00:55 . 2008-05-08 14:02 203136 ——w- c:\windows\system32\dllcache\rmcast.sys
2009-09-21 00:55 . 2008-04-11 19:04 691712 ——w- c:\windows\system32\dllcache\inetcomm.dll
2009-09-21 00:55 . 2008-05-01 14:33 331776 ——w- c:\windows\system32\dllcache\msadce.dll
2009-09-21 00:55 . 2008-12-11 10:57 333952 ——w- c:\windows\system32\dllcache\srv.sys
2009-09-21 00:55 . 2008-10-24 11:21 455296 ——w- c:\windows\system32\dllcache\mrxsmb.sys
2009-09-21 00:55 . 2009-07-10 13:27 1315328 ——w- c:\windows\system32\dllcache\msoe.dll
2009-09-21 00:54 . 2008-10-15 16:34 337408 ——w- c:\windows\system32\dllcache\netapi32.dll
2009-09-21 00:54 . 2008-09-04 17:15 1106944 ——w- c:\windows\system32\dllcache\msxml3.dll
2009-09-21 00:54 . 2008-05-03 11:55 2560 ——w- c:\windows\system32\xpsp4res.dll
2009-09-21 00:54 . 2008-04-21 12:08 215552 ——w- c:\windows\system32\dllcache\wordpad.exe
2009-09-21 00:45 . 2009-09-21 00:45 ——– d—–w- c:\windows\system32\scripting
2009-09-21 00:45 . 2009-09-21 00:45 ——– d—–w- c:\windows\l2schemas
2009-09-21 00:45 . 2009-09-21 00:45 ——– d—–w- c:\windows\system32\en
2009-09-21 00:45 . 2009-09-21 00:45 ——– d—–w- c:\windows\system32\bits
2009-09-21 00:43 . 2009-09-21 00:43 ——– d—–w- c:\windows\ServicePackFiles
2009-09-21 00:19 . 2004-08-04 02:29 73216 ——w- c:\windows\system32\drivers\atintuxx.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-29 20:30 . 2009-08-04 23:38 21 —-a-w- C:\qpmd8376.bin
2009-09-27 13:32 . 2009-08-04 01:21 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-09-27 07:25 . 2009-09-27 07:25 11304 —-a-w- c:\documents and settings\Hunter Sims\Application Data\zywypuvate.dat
2009-09-27 07:07 . 2009-09-27 15:24 48640 —-a-w- c:\windows\system32\drivers\smss.exe_
2009-09-27 07:07 . 2009-08-04 18:41 ——– d—–w- c:\documents and settings\Hunter Sims\Application Data\LimeWire
2009-09-23 18:13 . 2007-01-19 14:43 ——– d—–w- c:\documents and settings\All Users\Application Data\QuickTime
2009-09-22 14:55 . 2009-08-04 19:19 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-09-22 14:54 . 2009-08-04 19:14 ——– d—–w- c:\program files\Any Video Converter Professional
2009-09-21 18:31 . 2009-08-04 22:40 ——– d—–w- c:\program files\Macromedia
2009-09-21 18:28 . 2009-08-04 18:41 ——– d—–w- c:\program files\LimeWire
2009-09-21 16:55 . 2009-08-04 01:21 ——– d—–w- c:\program files\Spybot - Search & Destroy
2009-09-21 14:21 . 2009-08-04 19:25 ——– d—–w- c:\program files\UltraGet Video Downloader
2009-09-21 10:54 . 2009-08-03 22:18 ——– d—–w- c:\documents and settings\Hunter Sims\Application Data\Vso
2009-09-21 01:44 . 2007-01-19 14:36 ——– d—–w- c:\program files\Java
2009-09-21 01:41 . 2007-01-19 14:56 60336 —-a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-21 01:13 . 2007-01-19 14:45 ——– d—–w- c:\program files\Common Files\Symantec Shared
2009-09-21 01:08 . 2007-01-19 14:46 ——– d—–w- c:\documents and settings\All Users\Application Data\Symantec
2009-08-05 09:01 . 2005-08-16 10:18 204800 —-a-w- c:\windows\system32\mswebdvd.dll
2009-08-04 23:30 . 2007-01-19 14:39 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-08-04 23:25 . 2009-08-04 23:25 ——– d–h–w- c:\program files\Zero G Registry
2009-08-04 23:12 . 2009-08-04 23:12 0 —-a-w- c:\windows\system32\_r_a_p_.tmp
2009-08-04 22:59 . 2009-08-04 22:40 ——– d—–w- c:\program files\Common Files\Macromedia
2009-08-04 22:49 . 2009-08-04 22:45 ——– d—–w- c:\program files\Common Files\Macromedia Shared
2009-08-04 22:45 . 2009-08-04 22:45 ——– d—–w- c:\documents and settings\All Users\Application Data\Macrovision
2009-08-04 22:26 . 2007-02-03 21:12 ——– d—–w- c:\program files\Common Files\Adobe
2009-08-04 22:12 . 2009-08-04 22:11 ——– d—–w- c:\documents and settings\Hunter Sims\Application Data\ACD Systems
2009-08-04 22:10 . 2009-08-04 22:10 ——– d—–w- c:\program files\Common Files\ACD Systems
2009-08-04 22:10 . 2009-08-04 22:10 ——– d—–w- c:\program files\ACD Systems
2009-08-04 22:10 . 2009-08-04 22:10 ——– d—–w- c:\documents and settings\All Users\Application Data\ACD Systems
2009-08-04 19:26 . 2009-08-04 19:26 ——– d—–w- c:\documents and settings\Hunter Sims\Application Data\Sonic
2009-08-04 19:26 . 2009-08-04 19:26 ——– d—–w- c:\documents and settings\Hunter Sims\Application Data\Leadertech
2009-08-04 19:25 . 2009-08-04 19:24 ——– d—–w- c:\documents and settings\Hunter Sims\Application Data\zbusoft
2009-08-04 19:16 . 2009-08-04 19:16 ——– d—–w- c:\documents and settings\Hunter Sims\Application Data\vlc
2009-08-04 19:15 . 2009-08-04 19:15 ——– d—–w- c:\program files\VideoLAN
2009-08-04 19:11 . 2009-08-04 19:11 160564 —-a-w- c:\windows\Sqirlz Water Reflections Uninstaller.exe
2009-08-04 19:11 . 2009-08-04 19:11 ——– d—–w- c:\program files\Sqirlz Water Reflections
2009-08-04 19:09 . 2009-08-04 19:09 ——– d—–w- c:\program files\AnfyTeam
2009-08-04 18:59 . 2009-08-04 18:59 ——– d—–w- c:\program files\Wisdom-soft ScreenHunter 5 Free
2009-08-04 18:11 . 2009-08-04 18:11 ——– d—–w- c:\documents and settings\Hunter Sims\Application Data\COWON
2009-08-04 18:10 . 2009-08-04 18:10 ——– d—–w- c:\program files\Common Files\COWON
2009-08-04 18:10 . 2009-08-04 18:10 ——– d—–w- c:\program files\JetAudio
2009-08-03 22:24 . 2007-01-24 20:54 16530 —-a-w- c:\documents and settings\Hunter Sims\Application Data\wklnhst.dat
2009-08-03 22:18 . 2009-08-03 22:18 ——– d—–w- c:\program files\DVDFab Platinum 4
2009-08-03 21:31 . 2009-04-08 05:15 ——– d—–w- c:\documents and settings\Hunter Sims\Application Data\Corel
2009-08-03 21:29 . 2009-04-08 05:16 2516 –sha-w- c:\windows\system32\KGyGaAvL.sys
2009-08-03 21:29 . 2009-04-08 05:16 88 –sh–r- c:\windows\system32\BAF6B4705F.sys
2009-08-03 21:23 . 2007-02-09 02:31 ——– d—–w- c:\program files\Windows Media Connect 2
2009-08-03 21:17 . 2005-08-17 02:58 ——– d—–w- c:\program files\RGB
2009-08-03 21:14 . 2007-01-19 14:50 ——– d—–w- c:\documents and settings\All Users\Application Data\YAHOO
2009-08-03 20:54 . 2009-08-03 20:54 ——– d—–w- c:\documents and settings\All Users\Application Data\nView_Profiles
2009-08-03 19:18 . 2007-01-19 14:42 ——– d—–w- c:\documents and settings\All Users\Application Data\AOL
2009-08-03 19:18 . 2007-01-19 14:42 ——– d—–w- c:\program files\Common Files\AOL
2009-08-02 21:12 . 2007-01-19 14:39 ——– d—–w- c:\program files\Modem Diagnostic Tool
2009-07-29 04:37 . 2005-08-16 10:18 119808 —-a-w- c:\windows\system32\t2embed.dll
2009-07-29 04:37 . 2005-08-16 10:18 81920 —-a-w- c:\windows\system32\fontsub.dll
2009-07-17 19:01 . 2005-08-16 10:18 58880 —-a-w- c:\windows\system32\atl.dll
2009-07-14 03:43 . 2005-08-16 10:19 286208 —-a-w- c:\windows\system32\wmpdxm.dll
2009-07-03 17:09 . 2005-08-16 10:18 915456 —-a-w- c:\windows\system32\wininet.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-08-09 81920]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-08-23 7630848]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-11-03 866584]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-09-21 149280]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"SPAMfighter Agent"="c:\program files\SPAMfighter\SFAgent.exe" [2009-08-27 336520]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-8-4 113664]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2007-1-19 24576]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8097:TCP"= 8097:TCP:EarthLink UHP Modem Support

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [9/20/2009 10:12 PM 108289]
R2 ColdFusion MX ODBC Agent;ColdFusion MX ODBC Agent;c:\program files\Macromedia\db\slserver52\bin\swagent.exe "ColdFusion MX ODBC Agent" –> c:\program files\Macromedia\db\slserver52\bin\swagent.exe ColdFusion MX ODBC Agent [?]
R2 SPAMfighter Update Service;SPAMfighter Update Service;c:\program files\SPAMfighter\sfus.exe [8/27/2009 9:24 AM 189064]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-09-29 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 23:20]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://insightbb.com/
uInternet Connection Wizard,ShellNext = hxxp://www.google.com/ig/dell?hl=en&client;=dell-usuk-rel&channel;=us&ibd;=0070119
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
.
- - - - ORPHANS REMOVED - - - -

BHO-{A249BC15-23F2-42AD-F4E4-00AAC39C0004} - c:\windows\system32\y2kf4kxb.dll
HKCU-Run-mserv - c:\documents and settings\Hunter Sims\Application Data\svcst.exe
SharedTaskScheduler-{A249BC15-23F2-42AD-F4E4-00AAC39C0004} - c:\windows\system32\y2kf4kxb.dll
Notify-__c00F69A - c:\windows\system32\__c00F69A.dat
AddRemove-HijackThis - c:\documents and settings\Hunter Sims\My Documents\Software\HIJACKTHIS\HijackThis.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-29 16:30
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(640)
c:\windows\system32\msacm32.drv

- - - - - - - > 'explorer.exe'(3376)
c:\windows\system32\WININET.dll
c:\windows\system32\IEFRAME.dll
c:\windows\system32\mshtml.dll
c:\windows\system32\msls31.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Macromedia\runtime\bin\jrunsvc.exe
c:\program files\Macromedia\db\slserver52\bin\swagent.exe
c:\program files\Macromedia\db\slserver52\bin\swstrtr.exe
c:\program files\Macromedia\runtime\bin\jrun.exe
c:\program files\Macromedia\db\slserver52\bin\swsoc.exe
c:\windows\ehome\ehrecvr.exe
c:\windows\ehome\ehSched.exe
c:\program files\Macromedia\Flash Communication Server MX\FlashComAdmin.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
c:\program files\Macromedia\Flash Communication Server MX\FlashCom.exe
c:\windows\ehome\mcrdsvc.exe
c:\windows\system32\msiexec.exe
c:\windows\system32\dllhost.exe
.
**************************************************************************
.
Completion time: 2009-09-29 16:34 - machine was rebooted
ComboFix-quarantined-files.txt 2009-09-29 20:34

Pre-Run: 76,765,704,192 bytes free
Post-Run: 76,668,403,712 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect

360 — E O F — 2009-09-29 20:34


:thumbup:
Post #4
Hi,

Please do the following:

  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
  • They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

http://forums.whatthetech.com/Nasty_Virus_has_taken_over_my_computer_t107235.html&view=findpost&p=599685#entry599685

Collect::
c:\documents and settings\Hunter Sims\Local Settings\Application Data\oluja.dat
c:\windows\system32\usecupy.com
c:\documents and settings\Hunter Sims\Application Data\zywypuvate.dat
c:\windows\system32\drivers\smss.exe_

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you.
  • Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.


**Note**
When CF finishes running, the ComboFix log will open along with a message box–do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.
  • Ensure you are connected to the internet and click OK on the message box.


NEXT

Please download Malwarebytes' Anti-Malware
  • Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish, so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected. <– very important
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.



NEXT


Run an on-line scan with Kaspersky

Using Internet Explorer or Firefox, visit Kaspersky On-line Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.
2. To optimize scanning time and produce a more sensible report for review:
  • Close any open programs
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
3. Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.
  • Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Click View scan report at the bottom.

    [external image: Posted Image]
  • Click the Save as Text button to save the file to your desktop so that you may post it in your next reply


In your next reply please include
  • ComboFix Log
  • MBAM Log
  • Kaspersky report
Post #5
Thanks again! Here are the new reports you requested:

ComboFix 09-09-29.01 - Hunter Sims 09/29/2009 23:07.2.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.958.450 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\combo-fix.exe
Command switches used :: c:\documents and settings\Hunter Sims\Desktop\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}

file zipped: c:\documents and settings\Hunter Sims\Application Data\zywypuvate.dat
file zipped: c:\documents and settings\Hunter Sims\Local Settings\Application Data\oluja.dat
file zipped: c:\windows\system32\drivers\smss.exe_
file zipped: c:\windows\system32\usecupy.com
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Hunter Sims\Application Data\zywypuvate.dat
c:\documents and settings\Hunter Sims\Local Settings\Application Data\oluja.dat
c:\windows\system32\drivers\smss.exe_
c:\windows\system32\usecupy.com

.
((((((((((((((((((((((((( Files Created from 2009-08-28 to 2009-09-30 )))))))))))))))))))))))))))))))
.

2009-09-29 20:08 . 2009-09-29 20:35 ——– d—–w- C:\combo-fix
2009-09-27 20:01 . 2009-09-27 20:02 ——– d—–w- c:\program files\ERUNT
2009-09-27 16:13 . 2009-09-27 16:13 ——– d-sh–w- c:\documents and settings\Hunter Sims\IECompatCache
2009-09-27 07:50 . 2009-09-29 03:13 664 —-a-w- c:\windows\system32\d3d9caps.dat
2009-09-24 20:05 . 2009-09-24 20:05 ——– d—–w- c:\program files\Agent
2009-09-22 10:53 . 2009-09-27 06:46 ——– d—–w- C:\Folder
2009-09-21 18:35 . 2009-09-27 06:28 ——– d—–w- C:\Incomplete
2009-09-21 18:34 . 2009-09-27 06:44 ——– d—–w- C:\Limewire
2009-09-21 16:42 . 2009-09-21 16:42 ——– d—–w- c:\program files\Misc. Support Library (Spybot - Search & Destroy)
2009-09-21 16:42 . 2009-09-21 16:42 ——– d—–w- c:\program files\SDHelper (Spybot - Search & Destroy)
2009-09-21 16:42 . 2009-09-21 16:42 ——– d—–w- c:\program files\File Scanner Library (Spybot - Search & Destroy)
2009-09-21 11:06 . 2009-09-21 11:13 ——– d—–w- c:\documents and settings\Hunter Sims\.housecall6.6
2009-09-21 06:58 . 2009-09-21 06:58 ——– d-sh–w- c:\documents and settings\Administrator\IETldCache
2009-09-21 06:38 . 2009-09-21 06:38 ——– d-sh–w- c:\windows\system32\config\systemprofile\IETldCache
2009-09-21 06:33 . 2009-09-21 06:33 ——– d-sh–w- c:\documents and settings\LocalService\IETldCache
2009-09-21 02:56 . 2009-09-21 02:57 ——– d—–w- C:\SHUBERT
2009-09-21 02:18 . 2009-09-21 02:18 ——– d—–w- c:\program files\Common Files\Application
2009-09-21 02:18 . 2009-09-29 20:32 ——– d—–w- c:\program files\SPAMfighter
2009-09-21 02:17 . 2009-09-21 02:17 ——– d—–w- c:\documents and settings\Hunter Sims\Application Data\SPAMfighter
2009-09-21 02:12 . 2009-07-28 20:33 55656 —-a-w- c:\windows\system32\drivers\avgntflt.sys
2009-09-21 02:12 . 2009-03-30 14:33 96104 —-a-w- c:\windows\system32\drivers\avipbb.sys
2009-09-21 02:12 . 2009-02-13 16:29 22360 —-a-w- c:\windows\system32\drivers\avgntmgr.sys
2009-09-21 02:12 . 2009-02-13 16:17 45416 —-a-w- c:\windows\system32\drivers\avgntdd.sys
2009-09-21 02:12 . 2009-09-21 02:12 ——– d—–w- c:\program files\Avira
2009-09-21 02:12 . 2009-09-21 02:12 ——– d—–w- c:\documents and settings\All Users\Application Data\Avira
2009-09-21 01:56 . 2009-09-21 01:56 ——– d—–w- c:\program files\VistaCodecPack
2009-09-21 01:55 . 2009-09-21 01:55 ——– d—–w- c:\documents and settings\All Users\Application Data\VistaCodecs
2009-09-21 01:44 . 2009-09-21 01:44 411368 —-a-w- c:\windows\system32\deploytk.dll
2009-09-21 01:41 . 2009-09-21 01:41 ——– d—–w- c:\program files\Windows Defender
2009-09-21 01:33 . 2009-09-21 01:33 ——– d-sh–w- c:\documents and settings\Hunter Sims\PrivacIE
2009-09-21 01:31 . 2009-09-21 01:31 ——– d-sh–w- c:\documents and settings\Hunter Sims\IETldCache
2009-09-21 01:27 . 2009-08-07 08:48 100352 ——w- c:\windows\system32\dllcache\iecompat.dll
2009-09-21 01:27 . 2009-09-21 01:27 ——– d—–w- c:\windows\ie8updates
2009-09-21 01:27 . 2009-07-19 22:48 11067392 ——w- c:\windows\system32\dllcache\ieframe.dll
2009-09-21 01:27 . 2009-07-03 17:09 12800 ——w- c:\windows\system32\dllcache\xpshims.dll
2009-09-21 01:27 . 2009-07-03 17:09 594432 ——w- c:\windows\system32\dllcache\msfeeds.dll
2009-09-21 01:27 . 2009-07-03 17:09 55296 ——w- c:\windows\system32\dllcache\msfeedsbs.dll
2009-09-21 01:27 . 2009-07-03 17:09 1985536 ——w- c:\windows\system32\dllcache\iertutil.dll
2009-09-21 01:27 . 2009-07-03 17:09 246272 ——w- c:\windows\system32\dllcache\ieproxy.dll
2009-09-21 01:26 . 2009-09-21 01:27 ——– dc-h–w- c:\windows\ie8
2009-09-21 00:57 . 2008-06-13 11:05 272128 ——w- c:\windows\system32\dllcache\bthport.sys
2009-09-21 00:55 . 2008-05-08 14:02 203136 ——w- c:\windows\system32\dllcache\rmcast.sys
2009-09-21 00:55 . 2008-04-11 19:04 691712 ——w- c:\windows\system32\dllcache\inetcomm.dll
2009-09-21 00:55 . 2008-05-01 14:33 331776 ——w- c:\windows\system32\dllcache\msadce.dll
2009-09-21 00:55 . 2008-12-11 10:57 333952 ——w- c:\windows\system32\dllcache\srv.sys
2009-09-21 00:55 . 2008-10-24 11:21 455296 ——w- c:\windows\system32\dllcache\mrxsmb.sys
2009-09-21 00:55 . 2009-07-10 13:27 1315328 ——w- c:\windows\system32\dllcache\msoe.dll
2009-09-21 00:54 . 2008-10-15 16:34 337408 ——w- c:\windows\system32\dllcache\netapi32.dll
2009-09-21 00:54 . 2008-09-04 17:15 1106944 ——w- c:\windows\system32\dllcache\msxml3.dll
2009-09-21 00:54 . 2008-05-03 11:55 2560 ——w- c:\windows\system32\xpsp4res.dll
2009-09-21 00:54 . 2008-04-21 12:08 215552 ——w- c:\windows\system32\dllcache\wordpad.exe
2009-09-21 00:45 . 2009-09-21 00:45 ——– d—–w- c:\windows\system32\scripting
2009-09-21 00:45 . 2009-09-21 00:45 ——– d—–w- c:\windows\l2schemas
2009-09-21 00:45 . 2009-09-21 00:45 ——– d—–w- c:\windows\system32\en
2009-09-21 00:45 . 2009-09-21 00:45 ——– d—–w- c:\windows\system32\bits
2009-09-21 00:43 . 2009-09-21 00:43 ——– d—–w- c:\windows\ServicePackFiles
2009-09-21 00:19 . 2004-08-04 02:29 73216 ——w- c:\windows\system32\drivers\atintuxx.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-29 20:30 . 2009-08-04 23:38 21 —-a-w- C:\qpmd8376.bin
2009-09-27 13:32 . 2009-08-04 01:21 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-09-27 07:07 . 2009-08-04 18:41 ——– d—–w- c:\documents and settings\Hunter Sims\Application Data\LimeWire
2009-09-23 18:13 . 2007-01-19 14:43 ——– d—–w- c:\documents and settings\All Users\Application Data\QuickTime
2009-09-22 14:55 . 2009-08-04 19:19 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-09-22 14:54 . 2009-08-04 19:14 ——– d—–w- c:\program files\Any Video Converter Professional
2009-09-21 18:31 . 2009-08-04 22:40 ——– d—–w- c:\program files\Macromedia
2009-09-21 18:28 . 2009-08-04 18:41 ——– d—–w- c:\program files\LimeWire
2009-09-21 16:55 . 2009-08-04 01:21 ——– d—–w- c:\program files\Spybot - Search & Destroy
2009-09-21 14:21 . 2009-08-04 19:25 ——– d—–w- c:\program files\UltraGet Video Downloader
2009-09-21 10:54 . 2009-08-03 22:18 ——– d—–w- c:\documents and settings\Hunter Sims\Application Data\Vso
2009-09-21 01:44 . 2007-01-19 14:36 ——– d—–w- c:\program files\Java
2009-09-21 01:41 . 2007-01-19 14:56 60336 —-a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-21 01:13 . 2007-01-19 14:45 ——– d—–w- c:\program files\Common Files\Symantec Shared
2009-09-21 01:08 . 2007-01-19 14:46 ——– d—–w- c:\documents and settings\All Users\Application Data\Symantec
2009-08-05 09:01 . 2005-08-16 10:18 204800 —-a-w- c:\windows\system32\mswebdvd.dll
2009-08-04 23:30 . 2007-01-19 14:39 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-08-04 23:25 . 2009-08-04 23:25 ——– d–h–w- c:\program files\Zero G Registry
2009-08-04 23:12 . 2009-08-04 23:12 0 —-a-w- c:\windows\system32\_r_a_p_.tmp
2009-08-04 22:59 . 2009-08-04 22:40 ——– d—–w- c:\program files\Common Files\Macromedia
2009-08-04 22:49 . 2009-08-04 22:45 ——– d—–w- c:\program files\Common Files\Macromedia Shared
2009-08-04 22:45 . 2009-08-04 22:45 ——– d—–w- c:\documents and settings\All Users\Application Data\Macrovision
2009-08-04 22:26 . 2007-02-03 21:12 ——– d—–w- c:\program files\Common Files\Adobe
2009-08-04 22:12 . 2009-08-04 22:11 ——– d—–w- c:\documents and settings\Hunter Sims\Application Data\ACD Systems
2009-08-04 22:10 . 2009-08-04 22:10 ——– d—–w- c:\program files\Common Files\ACD Systems
2009-08-04 22:10 . 2009-08-04 22:10 ——– d—–w- c:\program files\ACD Systems
2009-08-04 22:10 . 2009-08-04 22:10 ——– d—–w- c:\documents and settings\All Users\Application Data\ACD Systems
2009-08-04 19:26 . 2009-08-04 19:26 ——– d—–w- c:\documents and settings\Hunter Sims\Application Data\Sonic
2009-08-04 19:26 . 2009-08-04 19:26 ——– d—–w- c:\documents and settings\Hunter Sims\Application Data\Leadertech
2009-08-04 19:25 . 2009-08-04 19:24 ——– d—–w- c:\documents and settings\Hunter Sims\Application Data\zbusoft
2009-08-04 19:16 . 2009-08-04 19:16 ——– d—–w- c:\documents and settings\Hunter Sims\Application Data\vlc
2009-08-04 19:15 . 2009-08-04 19:15 ——– d—–w- c:\program files\VideoLAN
2009-08-04 19:11 . 2009-08-04 19:11 160564 —-a-w- c:\windows\Sqirlz Water Reflections Uninstaller.exe
2009-08-04 19:11 . 2009-08-04 19:11 ——– d—–w- c:\program files\Sqirlz Water Reflections
2009-08-04 19:09 . 2009-08-04 19:09 ——– d—–w- c:\program files\AnfyTeam
2009-08-04 18:59 . 2009-08-04 18:59 ——– d—–w- c:\program files\Wisdom-soft ScreenHunter 5 Free
2009-08-04 18:11 . 2009-08-04 18:11 ——– d—–w- c:\documents and settings\Hunter Sims\Application Data\COWON
2009-08-04 18:10 . 2009-08-04 18:10 ——– d—–w- c:\program files\Common Files\COWON
2009-08-04 18:10 . 2009-08-04 18:10 ——– d—–w- c:\program files\JetAudio
2009-08-03 22:24 . 2007-01-24 20:54 16530 —-a-w- c:\documents and settings\Hunter Sims\Application Data\wklnhst.dat
2009-08-03 22:18 . 2009-08-03 22:18 ——– d—–w- c:\program files\DVDFab Platinum 4
2009-08-03 21:31 . 2009-04-08 05:15 ——– d—–w- c:\documents and settings\Hunter Sims\Application Data\Corel
2009-08-03 21:29 . 2009-04-08 05:16 2516 –sha-w- c:\windows\system32\KGyGaAvL.sys
2009-08-03 21:29 . 2009-04-08 05:16 88 –sh–r- c:\windows\system32\BAF6B4705F.sys
2009-08-03 21:23 . 2007-02-09 02:31 ——– d—–w- c:\program files\Windows Media Connect 2
2009-08-03 21:17 . 2005-08-17 02:58 ——– d—–w- c:\program files\RGB
2009-08-03 21:14 . 2007-01-19 14:50 ——– d—–w- c:\documents and settings\All Users\Application Data\YAHOO
2009-08-03 20:54 . 2009-08-03 20:54 ——– d—–w- c:\documents and settings\All Users\Application Data\nView_Profiles
2009-08-03 19:18 . 2007-01-19 14:42 ——– d—–w- c:\documents and settings\All Users\Application Data\AOL
2009-08-03 19:18 . 2007-01-19 14:42 ——– d—–w- c:\program files\Common Files\AOL
2009-08-02 21:12 . 2007-01-19 14:39 ——– d—–w- c:\program files\Modem Diagnostic Tool
2009-07-29 04:37 . 2005-08-16 10:18 119808 —-a-w- c:\windows\system32\t2embed.dll
2009-07-29 04:37 . 2005-08-16 10:18 81920 —-a-w- c:\windows\system32\fontsub.dll
2009-07-17 19:01 . 2005-08-16 10:18 58880 —-a-w- c:\windows\system32\atl.dll
2009-07-14 03:43 . 2005-08-16 10:19 286208 —-a-w- c:\windows\system32\wmpdxm.dll
2009-07-03 17:09 . 2005-08-16 10:18 915456 ——w- c:\windows\system32\wininet.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-09-29_20.31.44 )))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-08-09 81920]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-08-23 7630848]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-11-03 866584]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-09-21 149280]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"SPAMfighter Agent"="c:\program files\SPAMfighter\SFAgent.exe" [2009-08-27 336520]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-8-4 113664]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2007-1-19 24576]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8097:TCP"= 8097:TCP:EarthLink UHP Modem Support

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [9/20/2009 10:12 PM 108289]
R2 ColdFusion MX ODBC Agent;ColdFusion MX ODBC Agent;c:\program files\Macromedia\db\slserver52\bin\swagent.exe "ColdFusion MX ODBC Agent" –> c:\program files\Macromedia\db\slserver52\bin\swagent.exe ColdFusion MX ODBC Agent [?]
R2 SPAMfighter Update Service;SPAMfighter Update Service;c:\program files\SPAMfighter\sfus.exe [8/27/2009 9:24 AM 189064]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-09-29 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 23:20]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://insightbb.com/
uInternet Connection Wizard,ShellNext = hxxp://www.google.com/ig/dell?hl=en&client;=dell-usuk-rel&channel;=us&ibd;=0070119
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-29 23:12
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(640)
c:\windows\system32\msacm32.drv
.
Completion time: 2009-09-30 23:13
ComboFix-quarantined-files.txt 2009-09-30 03:13
ComboFix2.txt 2009-09-29 20:34

Pre-Run: 76,658,819,072 bytes free
Post-Run: 76,635,705,344 bytes free

238 — E O F — 2009-09-29 20:34
Upload was successful

Malwarebytes' Anti-Malware 1.41
Database version: 2874
Windows 5.1.2600 Service Pack 3

9/29/2009 11:25:53 PM
mbam-log-2009-09-29 (23-25-53).txt

Scan type: Quick Scan
Objects scanned: 101339
Time elapsed: 3 minute(s), 35 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ForceClassicControlPanel (Hijack.ControlPanelStyle) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

——————————————————————————–
KASPERSKY ONLINE SCANNER 7.0: scan report
Wednesday, September 30, 2009
Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Wednesday, September 30, 2009 04:42:45
Records in database: 2935734
——————————————————————————–

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
C:\
D:\

Scan statistics:
Objects scanned: 107134
Threats found: 3
Infected objects found: 12
Suspicious objects found: 0
Scan duration: 01:58:51


File name / Threat / Threats count
C:\Documents and Settings\Hunter Sims\My Documents\Software\HJT\backups\backup-20060413-122051-317.dll Infected: not-a-virus:AdWare.Win32.MyWay.v 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\gasfkyviqjyhja.sys.vir Infected: Packed.Win32.TDSS.z 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\smss.exe.vir Infected: Trojan-Spy.Win32.Agent.bafw 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\gasfkyoeshlhhb.dll.vir Infected: Packed.Win32.TDSS.z 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\gasfkyqlruccbg.dll.vir Infected: Packed.Win32.TDSS.z 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\gasfkyvcqguyab.dll.vir Infected: Packed.Win32.TDSS.z 1
C:\Qoobox\Quarantine\[4]-Submit_2009-09-29_23.07.49.zip Infected: Trojan-Spy.Win32.Agent.bafw 1
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP0\A0000001.sys Infected: Packed.Win32.TDSS.z 1
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP0\A0000002.dll Infected: Packed.Win32.TDSS.z 1
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP0\A0000003.dll Infected: Packed.Win32.TDSS.z 1
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP0\A0000004.dll Infected: Packed.Win32.TDSS.z 1
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP1\A0000064.exe Infected: Trojan-Spy.Win32.Agent.bafw 1

Selected area has been scanned.

Thanks! :thumbup:
Post #6
Hi, The items found are in quarantine or system restore points which we will be cleaning up shortly. Please run a fresh DDS Log and Attach.txt and advise how your computer is running now and if there are any outstanding issues.
Post #7
Thank YOU again! Here are the logs you requested:


DDS (Ver_09-09-24.01) - NTFSx86
Run by [removed] at 7:14:29.51 on Wed 09/30/2009
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.958.522 [GMT -4:00]

AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\Explorer.EXE
svchost.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\SPAMfighter\SFAgent.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Macromedia\runtime\bin\jrunsvc.exe
C:\Program Files\Macromedia\db\slserver52\bin\swagent.exe
C:\Program Files\Macromedia\runtime\bin\jrun.exe
C:\Program Files\Macromedia\db\slserver52\bin\swstrtr.exe
C:\Program Files\Macromedia\db\slserver52\bin\swsoc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Macromedia\Flash Communication Server MX\FlashComAdmin.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\SPAMfighter\sfus.exe
svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Macromedia\Flash Communication Server MX\FlashCom.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Hunter Sims\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://insightbb.com/
uInternet Connection Wizard,ShellNext = hxxp://www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=0070119
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar2.dll
TB: {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No File
TB: {C4069E3A-68F1-403E-B40E-20066696354B} - No File
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [DLA] c:\windows\system32\dla\DLACTRLW.EXE
mRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe -startup
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [SPAMfighter Agent] "c:\program files\spamfighter\SFAgent.exe" update delay 60
mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe
IE: {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program files\partygaming\partypoker\RunApp.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - c:\program files\bodog poker\BPGame.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - {552781AF-37E4-4FEE-920A-CED9E648EADD} - c:\program files\common files\microsoft shared\encarta search bar\ENCSBAR.DLL
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/C/0/C/C0CBBA88-A6F2-48D9-9B0E-1719D1177202/LegitCheckControl.cab
DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} - hxxp://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1253491739836
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\wifd1f~1\MpShHook.dll

============= SERVICES / DRIVERS ===============

R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2009-9-20 11608]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2009-9-20 108289]
R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2009-9-20 185089]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-9-20 55656]
R2 ColdFusion MX ODBC Agent;ColdFusion MX ODBC Agent;c:\program files\macromedia\db\slserver52\bin\swagent.exe "coldfusion mx odbc agent" –> c:\program files\macromedia\db\slserver52\bin\swagent.exe ColdFusion MX ODBC Agent [?]
R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]
R2 SPAMfighter Update Service;SPAMfighter Update Service;c:\program files\spamfighter\sfus.exe [2009-8-27 189064]
R2 Symantec Core LC;Symantec Core LC;c:\program files\common files\symantec shared\ccpd-lc\symlcsvc.exe [2007-1-19 1174152]
R2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592]

=============== Created Last 30 ================

2009-09-29 23:19 –d—– c:\docume~1\hunter~1\applic~1\Malwarebytes
2009-09-29 23:19 38,224 a——- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-29 23:19 19,160 a——- c:\windows\system32\drivers\mbam.sys
2009-09-29 23:19 –d—– c:\program files\Malwarebytes' Anti-Malware
2009-09-29 23:19 –d—– c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-09-29 16:12 a-dshr– C:\cmdcons
2009-09-29 16:08 229,888 a——- c:\windows\PEV.exe
2009-09-29 16:08 161,792 a——- c:\windows\SWREG.exe
2009-09-29 16:08 98,816 a——- c:\windows\sed.exe
2009-09-29 16:08 –d—– C:\combo-fix
2009-09-28 08:40 1,409 a——- c:\windows\QTFont.for
2009-09-28 08:40 54,156 a—h— c:\windows\QTFont.qfn
2009-09-27 12:13 –dsh— c:\documents and settings\hunter sims\IECompatCache
2009-09-27 03:50 664 a——- c:\windows\system32\d3d9caps.dat
2009-09-24 16:05 –d—– c:\program files\Agent
2009-09-22 06:53 –d—– C:\Folder
2009-09-21 14:35 –d—– C:\Incomplete
2009-09-21 14:34 –d—– C:\Limewire
2009-09-21 12:42 –d—– c:\program files\SDHelper (Spybot - Search & Destroy)
2009-09-21 12:42 –d—– c:\program files\Misc. Support Library (Spybot - Search & Destroy)
2009-09-21 12:42 –d—– c:\program files\File Scanner Library (Spybot - Search & Destroy)
2009-09-21 07:06 –d—– c:\documents and settings\hunter sims\.housecall6.6
2009-09-20 22:56 –d—– C:\SHUBERT
2009-09-20 22:18 –d—– c:\program files\common files\Application
2009-09-20 22:18 –d—– c:\program files\SPAMfighter
2009-09-20 22:17 –d—– c:\docume~1\hunter~1\applic~1\SPAMfighter
2009-09-20 22:12 55,656 a——- c:\windows\system32\drivers\avgntflt.sys
2009-09-20 22:12 –d—– c:\program files\Avira
2009-09-20 22:12 –d—– c:\docume~1\alluse~1\applic~1\Avira
2009-09-20 21:56 –d—– c:\program files\VistaCodecPack
2009-09-20 21:55 –d—– c:\docume~1\alluse~1\applic~1\VistaCodecs
2009-09-20 21:44 411,368 a——- c:\windows\system32\deploytk.dll
2009-09-20 21:44 73,728 a——- c:\windows\system32\javacpl.cpl
2009-09-20 21:33 –dsh— c:\documents and settings\hunter sims\PrivacIE
2009-09-20 21:31 –dsh— c:\documents and settings\hunter sims\IETldCache
2009-09-20 21:27 100,352 ——– c:\windows\system32\dllcache\iecompat.dll
2009-09-20 21:27 –d—– c:\windows\ie8updates
2009-09-20 21:27 11,067,392 ——– c:\windows\system32\dllcache\ieframe.dll
2009-09-20 21:27 1,985,536 ——– c:\windows\system32\dllcache\iertutil.dll
2009-09-20 21:27 594,432 ——– c:\windows\system32\dllcache\msfeeds.dll
2009-09-20 21:27 246,272 ——– c:\windows\system32\dllcache\ieproxy.dll
2009-09-20 21:27 55,296 ——– c:\windows\system32\dllcache\msfeedsbs.dll
2009-09-20 21:27 12,800 ——– c:\windows\system32\dllcache\xpshims.dll
2009-09-20 21:26 -cd-h— c:\windows\ie8
2009-09-20 20:57 272,128 ——– c:\windows\system32\dllcache\bthport.sys
2009-09-20 20:55 203,136 ——– c:\windows\system32\dllcache\rmcast.sys
2009-09-20 20:55 691,712 ——– c:\windows\system32\dllcache\inetcomm.dll
2009-09-20 20:55 331,776 ——– c:\windows\system32\dllcache\msadce.dll
2009-09-20 20:55 333,952 ——– c:\windows\system32\dllcache\srv.sys
2009-09-20 20:55 455,296 ——– c:\windows\system32\dllcache\mrxsmb.sys
2009-09-20 20:55 1,315,328 ——– c:\windows\system32\dllcache\msoe.dll
2009-09-20 20:54 337,408 ——– c:\windows\system32\dllcache\netapi32.dll
2009-09-20 20:54 1,106,944 ——– c:\windows\system32\dllcache\msxml3.dll
2009-09-20 20:54 2,560 ——– c:\windows\system32\xpsp4res.dll
2009-09-20 20:54 1,203,922 ——– c:\windows\system32\dllcache\sysmain.sdb
2009-09-20 20:54 215,552 ——– c:\windows\system32\dllcache\wordpad.exe
2009-09-20 20:45 –d—– c:\windows\system32\scripting
2009-09-20 20:45 –d—– c:\windows\system32\en
2009-09-20 20:45 –d—– c:\windows\l2schemas
2009-09-20 20:45 –d—– c:\windows\system32\bits
2009-09-20 20:43 –d—– c:\windows\ServicePackFiles
2009-09-20 20:41 –d—– c:\windows\network diagnostic
2009-09-20 20:19 104,960 ——– c:\windows\system32\drivers\atinrvxx.sys
2009-09-20 20:09 31,768 a——- c:\windows\system32\wucltui.dll.mui
2009-09-20 20:09 23,576 a——- c:\windows\system32\wuaucpl.cpl.mui
2009-09-20 20:09 18,456 a——- c:\windows\system32\wuaueng.dll.mui
2009-09-20 20:09 23,576 a——- c:\windows\system32\wuapi.dll.mui

==================== Find3M ====================

2009-09-30 07:02 21 a——- C:\qpmd8376.bin
2009-09-20 20:48 88,263 a——- c:\windows\pchealth\helpctr\offlinecache\index.dat
2009-08-05 05:01 204,800 a——- c:\windows\system32\mswebdvd.dll
2009-08-05 05:01 204,800 ——– c:\windows\system32\dllcache\mswebdvd.dll
2009-08-04 15:11 160,564 a——- c:\windows\Sqirlz Water Reflections Uninstaller.exe
2009-08-03 18:24 16,530 a——- c:\docume~1\hunter~1\applic~1\wklnhst.dat
2009-08-03 17:29 2,516 a–sh— c:\windows\system32\KGyGaAvL.sys
2009-07-29 00:37 119,808 a——- c:\windows\system32\t2embed.dll
2009-07-29 00:37 81,920 a——- c:\windows\system32\fontsub.dll
2009-07-29 00:37 119,808 ——– c:\windows\system32\dllcache\t2embed.dll
2009-07-29 00:37 81,920 ——– c:\windows\system32\dllcache\fontsub.dll
2009-07-19 09:18 5,937,152 ——– c:\windows\system32\dllcache\mshtml.dll
2009-07-18 12:05 1,509,888 ——– c:\windows\system32\dllcache\shdocvw.dll
2009-07-17 15:01 58,880 a——- c:\windows\system32\atl.dll
2009-07-17 15:01 58,880 ——– c:\windows\system32\dllcache\atl.dll
2009-07-13 23:43 10,841,088 a——- c:\windows\system32\dllcache\wmp.dll
2009-07-13 23:43 286,208 a——- c:\windows\system32\wmpdxm.dll
2009-07-13 23:43 286,208 ——– c:\windows\system32\dllcache\wmpdxm.dll
2009-07-03 13:09 915,456 ——– c:\windows\system32\wininet.dll
2009-07-03 13:09 915,456 ——– c:\windows\system32\dllcache\wininet.dll
2009-07-03 13:09 1,208,832 ——– c:\windows\system32\dllcache\urlmon.dll
2009-07-03 13:09 206,848 ——– c:\windows\system32\dllcache\occache.dll
2009-07-03 13:09 25,600 ——– c:\windows\system32\dllcache\jsproxy.dll
2009-07-03 13:09 184,320 ——– c:\windows\system32\dllcache\iepeers.dll
2009-07-03 13:09 386,048 ——– c:\windows\system32\dllcache\iedkcs32.dll
2009-07-03 07:01 173,056 ——– c:\windows\system32\dllcache\ie4uinit.exe

============= FINISH: 7:14:37.60 ===============

There doesn't seem to be any outstanding issues. Computer seems to be running normally. This happened because I read an article in Consu
DDS (Ver_09-09-24.01) - NTFSx86
Run by [removed] at 7:14:29.51 on Wed 09/30/2009
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.958.522 [GMT -4:00]

AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\Explorer.EXE
svchost.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\SPAMfighter\SFAgent.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Macromedia\runtime\bin\jrunsvc.exe
C:\Program Files\Macromedia\db\slserver52\bin\swagent.exe
C:\Program Files\Macromedia\runtime\bin\jrun.exe
C:\Program Files\Macromedia\db\slserver52\bin\swstrtr.exe
C:\Program Files\Macromedia\db\slserver52\bin\swsoc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Macromedia\Flash Communication Server MX\FlashComAdmin.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\SPAMfighter\sfus.exe
svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Macromedia\Flash Communication Server MX\FlashCom.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Hunter Sims\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://insightbb.com/
uInternet Connection Wizard,ShellNext = hxxp://www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=0070119
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar2.dll
TB: {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No File
TB: {C4069E3A-68F1-403E-B40E-20066696354B} - No File
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [DLA] c:\windows\system32\dla\DLACTRLW.EXE
mRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe -startup
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [SPAMfighter Agent] "c:\program files\spamfighter\SFAgent.exe" update delay 60
mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe
IE: {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program files\partygaming\partypoker\RunApp.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - c:\program files\bodog poker\BPGame.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - {552781AF-37E4-4FEE-920A-CED9E648EADD} - c:\program files\common files\microsoft shared\encarta search bar\ENCSBAR.DLL
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/C/0/C/C0CBBA88-A6F2-48D9-9B0E-1719D1177202/LegitCheckControl.cab
DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} - hxxp://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1253491739836
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\wifd1f~1\MpShHook.dll

============= SERVICES / DRIVERS ===============

R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2009-9-20 11608]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2009-9-20 108289]
R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2009-9-20 185089]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-9-20 55656]
R2 ColdFusion MX ODBC Agent;ColdFusion MX ODBC Agent;c:\program files\macromedia\db\slserver52\bin\swagent.exe "coldfusion mx odbc agent" –> c:\program files\macromedia\db\slserver52\bin\swagent.exe ColdFusion MX ODBC Agent [?]
R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]
R2 SPAMfighter Update Service;SPAMfighter Update Service;c:\program files\spamfighter\sfus.exe [2009-8-27 189064]
R2 Symantec Core LC;Symantec Core LC;c:\program files\common files\symantec shared\ccpd-lc\symlcsvc.exe [2007-1-19 1174152]
R2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592]

=============== Created Last 30 ================

2009-09-29 23:19 –d—– c:\docume~1\hunter~1\applic~1\Malwarebytes
2009-09-29 23:19 38,224 a——- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-29 23:19 19,160 a——- c:\windows\system32\drivers\mbam.sys
2009-09-29 23:19 –d—– c:\program files\Malwarebytes' Anti-Malware
2009-09-29 23:19 –d—– c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-09-29 16:12 a-dshr– C:\cmdcons
2009-09-29 16:08 229,888 a——- c:\windows\PEV.exe
2009-09-29 16:08 161,792 a——- c:\windows\SWREG.exe
2009-09-29 16:08 98,816 a——- c:\windows\sed.exe
2009-09-29 16:08 –d—– C:\combo-fix
2009-09-28 08:40 1,409 a——- c:\windows\QTFont.for
2009-09-28 08:40 54,156 a—h— c:\windows\QTFont.qfn
2009-09-27 12:13 –dsh— c:\documents and settings\hunter sims\IECompatCache
2009-09-27 03:50 664 a——- c:\windows\system32\d3d9caps.dat
2009-09-24 16:05 –d—– c:\program files\Agent
2009-09-22 06:53 –d—– C:\Folder
2009-09-21 14:35 –d—– C:\Incomplete
2009-09-21 14:34 –d—– C:\Limewire
2009-09-21 12:42 –d—– c:\program files\SDHelper (Spybot - Search & Destroy)
2009-09-21 12:42 –d—– c:\program files\Misc. Support Library (Spybot - Search & Destroy)
2009-09-21 12:42 –d—– c:\program files\File Scanner Library (Spybot - Search & Destroy)
2009-09-21 07:06 –d—– c:\documents and settings\hunter sims\.housecall6.6
2009-09-20 22:56 –d—– C:\SHUBERT
2009-09-20 22:18 –d—– c:\program files\common files\Application
2009-09-20 22:18 –d—– c:\program files\SPAMfighter
2009-09-20 22:17 –d—– c:\docume~1\hunter~1\applic~1\SPAMfighter
2009-09-20 22:12 55,656 a——- c:\windows\system32\drivers\avgntflt.sys
2009-09-20 22:12 –d—– c:\program files\Avira
2009-09-20 22:12 –d—– c:\docume~1\alluse~1\applic~1\Avira
2009-09-20 21:56 –d—– c:\program files\VistaCodecPack
2009-09-20 21:55 –d—– c:\docume~1\alluse~1\applic~1\VistaCodecs
2009-09-20 21:44 411,368 a——- c:\windows\system32\deploytk.dll
2009-09-20 21:44 73,728 a——- c:\windows\system32\javacpl.cpl
2009-09-20 21:33 –dsh— c:\documents and settings\hunter sims\PrivacIE
2009-09-20 21:31 –dsh— c:\documents and settings\hunter sims\IETldCache
2009-09-20 21:27 100,352 ——– c:\windows\system32\dllcache\iecompat.dll
2009-09-20 21:27 –d—– c:\windows\ie8updates
2009-09-20 21:27 11,067,392 ——– c:\windows\system32\dllcache\ieframe.dll
2009-09-20 21:27 1,985,536 ——– c:\windows\system32\dllcache\iertutil.dll
2009-09-20 21:27 594,432 ——– c:\windows\system32\dllcache\msfeeds.dll
2009-09-20 21:27 246,272 ——– c:\windows\system32\dllcache\ieproxy.dll
2009-09-20 21:27 55,296 ——– c:\windows\system32\dllcache\msfeedsbs.dll
2009-09-20 21:27 12,800 ——– c:\windows\system32\dllcache\xpshims.dll
2009-09-20 21:26 -cd-h— c:\windows\ie8
2009-09-20 20:57 272,128 ——– c:\windows\system32\dllcache\bthport.sys
2009-09-20 20:55 203,136 ——– c:\windows\system32\dllcache\rmcast.sys
2009-09-20 20:55 691,712 ——– c:\windows\system32\dllcache\inetcomm.dll
2009-09-20 20:55 331,776 ——– c:\windows\system32\dllcache\msadce.dll
2009-09-20 20:55 333,952 ——– c:\windows\system32\dllcache\srv.sys
2009-09-20 20:55 455,296 ——– c:\windows\system32\dllcache\mrxsmb.sys
2009-09-20 20:55 1,315,328 ——– c:\windows\system32\dllcache\msoe.dll
2009-09-20 20:54 337,408 ——– c:\windows\system32\dllcache\netapi32.dll
2009-09-20 20:54 1,106,944 ——– c:\windows\system32\dllcache\msxml3.dll
2009-09-20 20:54 2,560 ——– c:\windows\system32\xpsp4res.dll
2009-09-20 20:54 1,203,922 ——– c:\windows\system32\dllcache\sysmain.sdb
2009-09-20 20:54 215,552 ——– c:\windows\system32\dllcache\wordpad.exe
2009-09-20 20:45 –d—– c:\windows\system32\scripting
2009-09-20 20:45 –d—– c:\windows\system32\en
2009-09-20 20:45 –d—– c:\windows\l2schemas
2009-09-20 20:45 –d—– c:\windows\system32\bits
2009-09-20 20:43 –d—– c:\windows\ServicePackFiles
2009-09-20 20:41 –d—– c:\windows\network diagnostic
2009-09-20 20:19 104,960 ——– c:\windows\system32\drivers\atinrvxx.sys
2009-09-20 20:09 31,768 a——- c:\windows\system32\wucltui.dll.mui
2009-09-20 20:09 23,576 a——- c:\windows\system32\wuaucpl.cpl.mui
2009-09-20 20:09 18,456 a——- c:\windows\system32\wuaueng.dll.mui
2009-09-20 20:09 23,576 a——- c:\windows\system32\wuapi.dll.mui

==================== Find3M ====================

2009-09-30 07:02 21 a——- C:\qpmd8376.bin
2009-09-20 20:48 88,263 a——- c:\windows\pchealth\helpctr\offlinecache\index.dat
2009-08-05 05:01 204,800 a——- c:\windows\system32\mswebdvd.dll
2009-08-05 05:01 204,800 ——– c:\windows\system32\dllcache\mswebdvd.dll
2009-08-04 15:11 160,564 a——- c:\windows\Sqirlz Water Reflections Uninstaller.exe
2009-08-03 18:24 16,530 a——- c:\docume~1\hunter~1\applic~1\wklnhst.dat
2009-08-03 17:29 2,516 a–sh— c:\windows\system32\KGyGaAvL.sys
2009-07-29 00:37 119,808 a——- c:\windows\system32\t2embed.dll
2009-07-29 00:37 81,920 a——- c:\windows\system32\fontsub.dll
2009-07-29 00:37 119,808 ——– c:\windows\system32\dllcache\t2embed.dll
2009-07-29 00:37 81,920 ——– c:\windows\system32\dllcache\fontsub.dll
2009-07-19 09:18 5,937,152 ——– c:\windows\system32\dllcache\mshtml.dll
2009-07-18 12:05 1,509,888 ——– c:\windows\system32\dllcache\shdocvw.dll
2009-07-17 15:01 58,880 a——- c:\windows\system32\atl.dll
2009-07-17 15:01 58,880 ——– c:\windows\system32\dllcache\atl.dll
2009-07-13 23:43 10,841,088 a——- c:\windows\system32\dllcache\wmp.dll
2009-07-13 23:43 286,208 a——- c:\windows\system32\wmpdxm.dll
2009-07-13 23:43 286,208 ——– c:\windows\system32\dllcache\wmpdxm.dll
2009-07-03 13:09 915,456 ——– c:\windows\system32\wininet.dll
2009-07-03 13:09 915,456 ——– c:\windows\system32\dllcache\wininet.dll
2009-07-03 13:09 1,208,832 ——– c:\windows\system32\dllcache\urlmon.dll
2009-07-03 13:09 206,848 ——– c:\windows\system32\dllcache\occache.dll
2009-07-03 13:09 25,600 ——– c:\windows\system32\dllcache\jsproxy.dll
2009-07-03 13:09 184,320 ——– c:\windows\system32\dllcache\iepeers.dll
2009-07-03 13:09 386,048 ——– c:\windows\system32\dllcache\iedkcs32.dll
2009-07-03 07:01 173,056 ——– c:\windows\system32\dllcache\ie4uinit.exe

============= FINISH: 7:14:37.60 =============

There doesn't seem to be any outstanding issues, computer seems to be running normally. But I just noticed while typing this post that the typing seems delayed and that the curosor turns into any hourglass for a split second everytime I type a letter- I had not noticed this before. Yes, something is definitely hinky. Please advise.

This viral attack happened because I read an article in Consumer Reports Magazine that said the free security suites Windows Defender and Avira AntiVir protect as good as the pay suites . . . . . . . Obviously not. Can you reccomend either McAfee or Norton pay suites? I have used both in the past and I am wondering which might be good this year.

Thank You, Please advise.

Attachments:

Post #8
Hi,

You are clean,

just some house keeping to take care of now.

Not sure about the reason for the delayed typing. A couple of reboots and a defrag may take care of that issue.
Try the defrag utility from Auslogics, it does a really good job:

http://www.auslogics.com/en/software/disk-defrag/download

I think Windows defender and Avira are very good programs, I will recommend a couple more in my final recommendations as well. No AntiVirus product can stop everything. If you read some of the threads you will notice some serious infections on systems with every brand of antivirus installed.

Safer computing habits is the best way. Don't use peer to peer programs, that is a sure way to get infected. Implement the Web of Trust - it warns when a web site is potentially dangerous before you visit it.

You have Limewire installed. You would be doing yourself a favour to remove it via Add/Remove programs.

While you are there remove the old Java program J2SE Runtime Environment 5.0 Update 6 - you have the most up todate Jave version 6 update 16, so leave that one alone.

NEXT

Please do the following:

Visit ADOBEand download the latest version of Acrobat Reader (version 9.1)
Having the latest updates ensures there are no security vulnerabilities in your system.


NEXT


Follow these steps to uninstall Combofix

  • Click START then RUN
  • Now type Combofix /u in the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.

[external image: Posted Image]


NEXT

Now to remove the rest of the tools that we have used in fixing your machine:
  • Make sure you have an Internet Connection.
  • Download OTC to your desktop and run it
  • A list of tool components used in the Cleanup of malware will be downloaded.
  • If your Firewall or Real Time protection attempts to block OTC to reach the Internet, please allow the application to do so.
  • Click Yes to begin the Cleanup process and remove these components, including this application.
  • You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.

If any logs remain after using this tool > right click and delete them.

NEXT

Below I have included a number of recommendations for how to protect your computer against malware infections.


  • It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
    Strong passwords: How to create and use them
    Then consider a password keeper, to keep all your passwords safe.
  • Keep Windows updated by regularly checking their website at :
    http://windowsupdate.microsoft.com/
    This will ensure your computer has always the latest security updates available installed on your computer.

  • SpywareBlaster protects against bad ActiveX, it immunizes your PC against them.

  • SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program ( eg : TeaTimer, Windows Defender ) or there will be a conflict.

  • Make Internet Explorer more secure
    • Click Start > Run
    • Type Inetcpl.cpl & click OK
    • Click on the Security tab
    • Click Reset all zones to default level
    • Make sure the Internet Zone is selected & Click Custom level
    • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
    • Next Click OK, then Apply button and then OK to exit the Internet Properties page.
  • ATF Cleaner - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.

  • MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.

    WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
    • Green to go
    • Yellow for caution
    • Red to stop
    WOT has an addon available for both Firefox and IE

  • Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more
    secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in pop up
    blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from
    Here


    If you choose to use Firefox, I highly recommend this add-on to keep your PC even more secure.
    • NoScript - for blocking ads and other potential website attacks
  • Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
  • ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
  • In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles:
    Think Prevention.
    PC Safety and Security–What Do I Need?.


**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.


Thank you for your patience, and performing all of the procedures requested.

Please respond one last time so we can consider the thread resolved and close it, thank-you.
Post #9
Thanks for all of your help ! ! ! ! You What The Tech guys are all so Great and Cool ! ! ! ! ! :notworthy: I have implemented all of your suggestions and the typing now seems OK. All seems to be in order now. The only thing I didn't do is install Spyware Guard because your directions said not to run it with Windows Defender. Which is better? What should I do. Is Spybot Search and Destroy still a good program? I don't use the TeaTimer but I use it for scans and removal. Should I still be doing this? Right now I am running all of the reccomended protections: Windows Defender, Avira AntiVir, Spyware Blaster, MVPS Hosts, WOT, Erunt . . . . . . Do I Still need more protection? PAY Protection: Norton, McAfee? Or am I now as good as it gets? Regarding Limewire- I use it mostly to download old Doctor Who episodes, not applications or ZIPped files. This is not safe?!?! You can't get some of the old episodes anywhere else to my knowledge- Please Advise. Thank You once again for Your Time and Expertise! We are lucky to have such Dedicated Professionals on the Front Lines Protecting Us ! ! ! ! ! :woot: Thankfully, Shubert Schlackeye
Post #10 last edited
Hi, Between Spyware Guard and Windows Defender, it really comes down to personal preference and what works best with your systems configuration. Give one a try for a few months, then try the other. They are easily uninstalled and reinstalled. Same with the AV's, try one for a while, then uninstall and try another. The free ones are excellent, they just lack some features of the paid for versions. Personally I prefer MalwareBytes over Spybot, but it's not a bad program. There really isn't a need for tea timer with your other programs in place. The security you have in place should be fine if you are careful about where you visit and what you download. The problem with the peer 2 peer, is you cannot trust the source, a few episodes of Dr. Who may be just fine, then the next one may have all sorts of malicious code in it that isn't detectable till it's run, so I would be very careful of this. stay safe :wavey: ~CB
Post #11
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI