What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Fraud.sysguard and windows popping up

16 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I have tried some other sites and no one seems to want to help me on this issue. So I thought I would give y'all a shot here and see!

Recently I have been getting these pop-ups but they happen all at once. When I click on a link to go to another page a New Window appears with 6 tabs in it. The tabs say broken links and are in Chinese. I have to copy the link and place it in the browser to be able to go to that page. I use SpywareTerminator with ClamAV and it did not find anything. I also ran MBAM and it found nothing. So I installed Spybot S&D and it found "fraund.sysguard" and quarantined it but I still get the same problem and it found nothing else. I also have noticed that I have a lot of processes running but I have pretty much disabled everything form a clean start up and still have 40 process running. This is starting to get annoying and would love to have some help on this!

Here are the reports requested per this thread:

RootRepeal Log:

ROOTREPEAL © AD, 2007-2009
==================================================
Scan Start Time: 2009/12/08 07:44
Program Version: Version 1.3.5.0
Windows Version: Windows XP Media Center Edition SP2
==================================================

Drivers
——————-
Name: fgldipob.sys
Image Path: C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\fgldipob.sys
Address: 0xA7024000 Size: 92032 File Visible: No Signed: -
Status: -

Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0xA9BA0000 Size: 49152 File Visible: No Signed: -
Status: -

SSDT
——————-
#: 025 Function Name: NtClose
Status: Hooked by "C:\WINDOWS\system32\drivers\sp_rsdrv2.sys" at address 0xb2ff788e

#: 037 Function Name: NtCreateFile
Status: Hooked by "C:\WINDOWS\system32\drivers\sp_rsdrv2.sys" at address 0xb2ff70ec

#: 041 Function Name: NtCreateKey
Status: Hooked by "C:\WINDOWS\system32\drivers\sp_rsdrv2.sys" at address 0xb2ff6dce

#: 050 Function Name: NtCreateSection
Status: Hooked by "C:\WINDOWS\system32\drivers\sp_rsdrv2.sys" at address 0xb2ff8938

#: 063 Function Name: NtDeleteKey
Status: Hooked by "C:\WINDOWS\system32\drivers\sp_rsdrv2.sys" at address 0xb2ff6ed8

#: 065 Function Name: NtDeleteValueKey
Status: Hooked by "C:\WINDOWS\system32\drivers\sp_rsdrv2.sys" at address 0xb2ff6fc2

#: 097 Function Name: NtLoadDriver
Status: Hooked by "C:\WINDOWS\system32\drivers\sp_rsdrv2.sys" at address 0xb2ff7bbc

#: 116 Function Name: NtOpenFile
Status: Hooked by "C:\WINDOWS\system32\drivers\sp_rsdrv2.sys" at address 0xb2ff73f4

#: 224 Function Name: NtSetInformationFile
Status: Hooked by "C:\WINDOWS\system32\drivers\sp_rsdrv2.sys" at address 0xb2ff7526

#: 247 Function Name: NtSetValueKey
Status: Hooked by "C:\WINDOWS\system32\drivers\sp_rsdrv2.sys" at address 0xb2ff6bfc

#: 257 Function Name: NtTerminateProcess
Status: Hooked by "C:\WINDOWS\system32\drivers\sp_rsdrv2.sys" at address 0xb2ff7b04

#: 274 Function Name: NtWriteFile
Status: Hooked by "C:\WINDOWS\system32\drivers\sp_rsdrv2.sys" at address 0xb2ff770c

==EOF==

DDS.txt Log:


DDS (Ver_09-06-26.01) - NTFSx86
Run by [removed] at 7:41:45.68 on Tue 12/08/2009
Internet Explorer: 6.0.2900.2180
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2046.1420 [GMT -6:00]


============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\ehome\ehtray.exe
C:\HP\KBD\KBD.EXE
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\arservice.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Mozilla Firefox\firefox.exe
C:\PROGRA~1\Crawler\CToolbar.exe
C:\Documents and Settings\Compaq_Administrator\Desktop\dds.scr

============== Pseudo HJT Report ===============

BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: : {1cb20bf0-bbae-40a7-93f4-6435ff3d0411} - c:\progra~1\crawler\ctbr.dll
TB: &Crawler Toolbar: {4b3803ea-5230-4dc3-a7fc-33638f3d3542} - c:\progra~1\crawler\ctbr.dll
TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File
TB: {71AAABE5-1F0F-11D7-BD6F-004854603DCE} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [eyeBeam SIP Client]
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
mRun: [ehTray] c:\windows\ehome\ehtray.exe
mRun: [KBD] c:\hp\kbd\KBD.EXE
mRun: [ps2] c:\windows\system32\ps2.exe
mRun: [ATIPTA] "c:\program files\ati technologies\ati control panel\atiptaxx.exe"
mRun: [hpsysdrv] c:\windows\system\hpsysdrv.exe
mRun: [RECGUARD] c:\windows\sminst\RECGUARD.EXE
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
mRun: [SpywareTerminator] "c:\program files\spyware terminator\SpywareTerminatorShield.exe"
IE: Crawler Search - tbr:iemenu
IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office11\EXCEL.EXE/3000
IE: {E2D4D26B-0180-43a4-B05F-462D6D54C789} - c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\iebutton\support.htm
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0015-0000-0005-ABCDEFFEDCBC} - c:\program files\java\jre1.5.0_05\bin\npjpi150_05.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office11\REFIEBAR.DLL
Trusted Zone: trymedia.com
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_05-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_05-windows-i586.cab
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\crawler\ctbr.dll
Notify: AtiExtEvent - Ati2evxx.dll

============= SERVICES / DRIVERS ===============

R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [2009-11-20 142592]
R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]
R3 SaiK0728;SaiK0728;c:\windows\system32\drivers\SaiK0728.sys [2009-11-11 104960]

=============== Created Last 30 ================

2009-12-08 06:57 –d—– c:\program files\Spybot - Search & Destroy
2009-11-30 13:33 41,872 a——- c:\windows\system32\xfcodec.dll
2009-11-28 17:44 161,792 a——- c:\windows\SWREG.exe
2009-11-28 17:44 98,816 a——- c:\windows\sed.exe
2009-11-28 17:44 77,312 a——- c:\windows\MBR.exe
2009-11-28 17:44 –ds—- C:\ComboFix
2009-11-27 00:01 –d—– c:\program files\MapRotation
2009-11-22 13:48 –d—– c:\program files\GIMP-2.0
2009-11-20 05:19 –d—– c:\docume~1\compaq~1\applic~1\Malwarebytes
2009-11-20 05:19 38,224 a——- c:\windows\system32\drivers\mbamswissarmy.sys
2009-11-20 05:19 19,160 a——- c:\windows\system32\drivers\mbam.sys
2009-11-20 05:19 –d—– c:\program files\Malwarebytes' Anti-Malware
2009-11-20 05:05 –d—– c:\program files\WinClamAVShield
2009-11-20 05:04 142,592 a——- c:\windows\system32\drivers\sp_rsdrv2.sys
2009-11-20 05:04 –d—– c:\docume~1\compaq~1\applic~1\Spyware Terminator
2009-11-20 05:04 –d—– c:\program files\Spyware Terminator
2009-11-20 05:04 –d—– c:\docume~1\alluse~1\applic~1\Spyware Terminator
2009-11-18 22:27 –d—– c:\program files\EditPlus 2
2009-11-17 00:26 –ds—- c:\documents and settings\compaq_administrator\UserData
2009-11-16 06:56 –d—– c:\program files\Trend Micro
2009-11-15 05:06 –d—– c:\program files\Crawler
2009-11-12 16:02 208 a——- c:\windows\system32\xpysys.dll
2009-11-12 16:02 –d—– c:\docume~1\compaq~1\applic~1\CoffeeCup Software
2009-11-12 16:02 –d—– c:\program files\CoffeeCup Software
2009-11-12 01:33 –d—– c:\documents and settings\compaq_administrator\.thumbnails
2009-11-12 01:31 –d—– c:\documents and settings\compaq_administrator\.gimp-2.6
2009-11-12 00:15 –d—– c:\documents and settings\compaq_administrator\.unlimitedftp
2009-11-11 17:09 14,080 a—-r– c:\windows\system32\drivers\SaiMini.sys
2009-11-11 17:07 35,456 a—-r– c:\windows\system32\drivers\SaiBus.sys
2009-11-11 17:07 –d—– c:\docume~1\alluse~1\applic~1\Saitek
2009-11-11 17:07 –d—– c:\program files\Saitek
2009-11-11 00:57 –d—– c:\docume~1\compaq~1\applic~1\Trellian
2009-11-11 00:56 512,000 a——- c:\windows\system32\Achroma2.dll
2009-11-11 00:56 –d—– c:\program files\Trellian
2009-11-10 23:08 94,208 a——- c:\windows\system32\QuickTimeVR.qtx
2009-11-10 23:08 69,632 a——- c:\windows\system32\QuickTime.qts
2009-11-10 15:53 –d—– C:\temp
2009-11-10 14:20 14,848 a——- c:\windows\system32\drivers\kbdhid.sys
2009-11-10 14:20 14,848 a——- c:\windows\system32\dllcache\kbdhid.sys

==================== Find3M ====================

2009-12-08 00:48 139,904 a——- c:\windows\system32\drivers\PnkBstrK.sys
2009-12-08 00:48 189,744 a——- c:\windows\system32\PnkBstrB.exe
2009-12-05 17:47 95,360 a——- c:\windows\system32\drivers\atapi.sys
2009-12-05 17:47 95,360 a——- c:\windows\system32\dllcache\atapi.sys
2009-11-27 00:00 73,216 a——- c:\windows\ST6UNST.EXE
2009-11-27 00:00 249,856 ——– c:\windows\Setup1.exe
2009-11-14 01:47 260,608 a——- c:\windows\PEV.exe
2009-11-11 17:06 0 a—h— c:\windows\system32\drivers\Msft_Kernel_SaiK0728_01005.Wdf
2009-11-11 17:06 0 a—h— c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2009-10-13 22:37 15,020 a——- c:\program files\readme.txt
2009-10-13 22:29 75,064 a——- c:\windows\system32\PnkBstrA.exe
2009-10-13 21:42 1,795 a–shr– c:\windows\system32\drivers\103C_HP_CPC_EL445AA-ABA SR1750NX NA650_YC_0Pres_QCNH551_E61NAemRED1_48_IAmberine M_SASUSTek Computer INC._V1.03_B3.13_T051115_WXP2_L409_M1023_J200_7AMD_8Athlon 64_92.19_#060211_N10EC8139_Z_G10DE0614.MRK
2009-09-27 20:52 57,344 a——- C:\clipstreamsa.dll
2009-05-26 14:33 502 ac—— c:\program files\EasyGen.ini
2009-05-26 14:31 354,816 a——- c:\program files\btnexgenipl32.dll
2009-05-26 14:31 228 a——- c:\program files\news.txt
2008-05-01 14:29 731,725 ac—— c:\program files\DownloadResource.pdf
2006-03-05 01:46 774,144 ac—— c:\program files\RngInterstitial.dll
2006-02-13 09:37 377,344 ac-sh— c:\program files\ehthumbs.db
2005-09-06 14:45 658,385,795 ac—r– c:\program files\data2.cab
2005-09-06 14:45 441 a—-r– c:\program files\layout.bin
2005-09-06 14:43 43,971 a—-r– c:\program files\data1.hdr
2005-09-06 14:43 835,353 a—-r– c:\program files\data1.cab
2005-09-06 14:43 149 ac—r– c:\program files\Setup.ini
2005-09-06 14:43 135,557 a—-r– c:\program files\setup.inx
2005-08-01 10:57 518,454 a—-r– c:\program files\setup.bmp
2002-07-26 00:07 346,602 a—-r– c:\program files\ikernel.ex_

============= FINISH: 7:42:34.43 ===============

And attached the Attach.txt


Thank you for any help in advance!!!

Attachments:

Post #2
My name is SweetTech. I would be glad to take a look at your log and help you with solving any malware problems. I'd be grateful if you would note the following:
  • Logs from malware removal programs (DDS is one of them) can take some time to analyze. I need you to be patient while I analyze any logs you post.
  • Please make sure to carefully read any instruction that I give you.
    Reading too lightly will cause you to miss important steps, which could have destructive effects.
  • If you're not sure, or if something unexpected happens, do NOT continue! Stop and ask!
  • These instructions have been specifically tailored to your computer and the issues you are experiencing with your computer. It's important to note that these instructions are not suitable for any other computer, even if the issues are fairly similar.
  • Do not do things I do not ask for, such as running a spyware scan on your computer. The one thing that you should always do, is to make sure sure that your anti-virus definitions are up-to-date!
  • If I instruct you to download a specific tool in which you already have, please delete the copy that you have and re-download the tool. The reason I ask you to do this is because these tools are updated fairly regularly.
  • I am going to stick with you until ALL malware is gone from your system. I would appreciate it if you would do the same. From this point, we're in this together ;)
    Because of this, you must reply within five days    . I will post a reminder should you seem to fail to do this, however, if you fail to reply within five days then,
    unless I have been notified of your absence in advance, the topic shall be closed!
  • Lastly, I am no magician. I will try very hard to fix your issues, but no promises can be made. Also be aware that some infections are so severe that you might need to resort to reformatting and reinstalling your operating system.
    Don't worry, this only happens in severe cases, but it sadly does happen. Be prepared to back up your data. Have means of backing up your data available.
Please be advised, as I am still in training, all my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advise.
This may cause a delay, but I will do my best to keep it as short as possible.

I am checking over your log, I will post back shortly with instructions.
Post #3
I see that you have a thread open at GeekstoGo. I am going to ask that the thread their be closed as you are receiving help here at WTT.

First and for all, for all those who are reading this, DO NOT RUN COMBOFIX UNLESS INSTRUCTED BY A TRAINED HELPER!!

Please note: ComboFix is an extremely powerful tool which should only be used when instructed to do so by someone who has been properly trained. ComboFix is intended by its creator to be "used under the guidance and supervision of an expert." It is NOT for unsupervised use. Please read Combofix's Disclaimer.

Using this tool incorrectly could lead to disastrous problems with your operating system such as preventing it from ever starting again.

Another note of caution, you attempted a fix that was not intended for your computer. This can do more harm than benefit! Such fixes are made for a certain user and should NOT be used unless you know what you are doing.

Locating ComboFix Log
  • Right click on START on the left end of your Windows toolbar (lower left corner of your screen)
  • Click on Explore
  • Click on Local Disk (C:) in the left-hand window pane
  • Look for ComboFix.txt in the right-hand window pane and right click on it
  • Put your cursor (arrow) on Open With
  • Move your cursor to the new menu that opens and click on Choose Program…
  • Click on Notepad

When file opens, Copy/Paste text here.

Uninstall Crawler Toolbar
We need to uninstall the Crawler Toolbar, please follow these steps:

1. Click on the "Crawler" button, select the "Help" and then the "Uninstall" option.
2. Click on the "Uninstall" button.
3. Click on the "Yes" button.
4. Click on the "Yes" button.

Please note: If you don't close all browser windows, you may need to restart your computer to finish the uninstallation.

Crawler Toolbar with Web Security Guard may be uninstalled also from the Start -> Programs menu, or Control Panel -> Add/Remove Programs.

SPYBOT TEATIMER
  • Launch Spybot S&D, go to the Mode menu and make sure "Advanced Mode" is selected.
  • On the left hand side, click on Tools, then click on the Resident Icon in the list.
  • Uncheck the "Resident "TeaTimer" (Protection of overall system settings) active." box.
  • Click on the "System Startup" icon in the List
  • Uncheck the "TeaTimer" box and "OK" any prompts.
  • If Teatimer gives you a warning that changes were made, click the "Allow Change" box when prompted.
  • Exit Spybot S&D when done.
  • (When we are done, you can re-enable Teatimer using the same steps but this time place a check next to "Resident TeaTimer" and check the "TeaTimer" box in System Startup.]
Please make sure you include the following items in your next post:
1. The contents of the ComboFix log.
Post #4
I looked for the ComboFix.txt but was unable to locate it. I don't remember much about the Combofix other than when I had my mobo replaced they had given me the ComboFix.exe and said that i needed to run it. I started to but stopped it because I didn't know much about it. I don't believe I have a copy of the ComboFix.txt that or I just cant find it. I did go ahead and remove the Crawler Toolbar and also disabled the TeaTimer. Question: Do you want me to go ahead and run the ComboFix and post the new ComboFix.txt Also thank you for your help!
Post #5

Question: Do you want me to go ahead and run the ComboFix and post the new ComboFix.txt

For the time being please hold off on running ComboFix until I post back instructions for you.

Thanks,
SweetTech.
Post #6
Running ComboFix

Please delete any versions of ComboFix that you may have on your computer before continuing with the steps below.
Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
  • Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

  • Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now
Post #7
Okay ran ComboFix and her is the log.txt:

ComboFix 09-12-09.02 - Compaq_Administrator 12/09/2009 14:07:51.3.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2046.1575 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2009-11-09 to 2009-12-09 )))))))))))))))))))))))))))))))
.

2009-11-28 22:50 . 2009-12-02 12:03 ——– d—–w- c:\documents and settings\Compaq_Administrator\Local Settings\Application Data\tagrba
2009-11-27 06:01 . 2009-11-27 06:01 ——– d—–w- c:\program files\MapRotation
2009-11-22 19:48 . 2009-11-22 19:48 ——– d—–w- c:\program files\GIMP-2.0
2009-11-20 11:19 . 2009-11-20 11:19 ——– d—–w- c:\documents and settings\Compaq_Administrator\Application Data\Malwarebytes
2009-11-20 11:19 . 2009-09-10 20:54 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-11-20 11:19 . 2009-11-28 23:15 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-11-20 11:19 . 2009-09-10 20:53 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-11-20 11:05 . 2009-11-20 11:06 ——– d—–w- c:\program files\WinClamAVShield
2009-11-20 11:04 . 2009-12-08 12:43 ——– d—–w- c:\documents and settings\Compaq_Administrator\Application Data\Spyware Terminator
2009-11-20 11:04 . 2009-11-20 11:04 6144 —-a-w- c:\documents and settings\All Users\Application Data\Spyware Terminator\sp_rsdel.exe
2009-11-20 11:04 . 2009-11-20 11:04 5632 —-a-w- c:\documents and settings\All Users\Application Data\Spyware Terminator\fileobjinfo.sys
2009-11-20 11:04 . 2009-11-20 11:04 142592 —-a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2009-11-20 11:04 . 2009-12-08 12:49 ——– d—–w- c:\documents and settings\All Users\Application Data\Spyware Terminator
2009-11-20 11:04 . 2009-12-06 05:28 ——– d—–w- c:\program files\Spyware Terminator
2009-11-19 04:27 . 2009-12-02 04:15 ——– d—–w- c:\program files\EditPlus 2
2009-11-17 07:57 . 2009-11-17 07:57 ——– d—–w- c:\documents and settings\Compaq_Administrator\Application Data\Apple Computer
2009-11-17 06:26 . 2009-11-17 06:26 ——– d-s—w- c:\documents and settings\Compaq_Administrator\UserData
2009-11-16 12:56 . 2009-11-16 12:56 ——– d—–w- c:\program files\Trend Micro
2009-11-15 11:06 . 2009-12-09 03:05 ——– d—–w- c:\program files\Crawler
2009-11-12 22:02 . 2009-11-12 22:03 ——– d—–w- c:\documents and settings\Compaq_Administrator\Application Data\CoffeeCup Software
2009-11-12 22:02 . 2009-11-12 22:02 ——– d—–w- c:\program files\CoffeeCup Software
2009-11-12 08:57 . 2009-11-12 08:57 ——– d—–w- c:\documents and settings\Compaq_Administrator\Application Data\SmartFTP
2009-11-12 08:56 . 2009-11-12 08:56 ——– d—–w- c:\documents and settings\Compaq_Administrator\Application Data\Notepad++
2009-11-12 08:56 . 2009-11-12 08:56 ——– d—–w- c:\program files\Notepad++
2009-11-12 07:33 . 2009-12-08 12:29 ——– d—–w- c:\documents and settings\Compaq_Administrator\Application Data\gtk-2.0
2009-11-12 07:33 . 2009-11-12 07:33 ——– d—–w- c:\documents and settings\Compaq_Administrator\.thumbnails
2009-11-12 07:31 . 2009-12-08 12:29 ——– d—–w- c:\documents and settings\Compaq_Administrator\.gimp-2.6
2009-11-12 06:15 . 2009-11-12 21:43 ——– d—–w- c:\documents and settings\Compaq_Administrator\.unlimitedftp
2009-11-11 23:09 . 2008-02-18 14:21 14080 —-a-r- c:\windows\system32\drivers\SaiMini.sys
2009-11-11 23:07 . 2008-02-18 14:21 35456 —-a-r- c:\windows\system32\drivers\SaiBus.sys
2009-11-11 23:07 . 2009-11-11 23:07 ——– d—–w- c:\documents and settings\All Users\Application Data\Saitek
2009-11-11 23:07 . 2009-11-11 23:07 ——– d—–w- c:\program files\Saitek
2009-11-11 23:06 . 2008-02-18 14:21 1419232 —-a-w- c:\windows\system32\WdfCoInstaller01005.dll
2009-11-11 23:06 . 2008-02-18 14:21 104960 —-a-r- c:\windows\system32\drivers\SaiK0728.sys
2009-11-11 06:57 . 2009-11-11 07:13 ——– d—–w- c:\documents and settings\Compaq_Administrator\Local Settings\Application Data\WebPage
2009-11-11 06:57 . 2009-11-11 07:13 ——– d—–w- c:\documents and settings\Compaq_Administrator\Application Data\Trellian
2009-11-11 06:56 . 2007-09-08 05:43 512000 —-a-w- c:\windows\system32\Achroma2.dll
2009-11-11 06:56 . 2009-11-20 10:40 ——– d—–w- c:\program files\Trellian
2009-11-10 21:53 . 2009-11-10 21:53 ——– d—–w- C:\temp
2009-11-10 20:20 . 2004-08-04 04:58 14848 —-a-w- c:\windows\system32\drivers\kbdhid.sys
2009-11-10 20:20 . 2004-08-04 04:58 14848 —-a-w- c:\windows\system32\dllcache\kbdhid.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-09 11:16 . 2009-10-14 04:22 ——– d—–w- c:\documents and settings\Compaq_Administrator\Application Data\Xfire
2009-12-09 07:25 . 2009-10-14 04:43 139904 —-a-w- c:\windows\system32\drivers\PnkBstrK.sys
2009-12-09 07:24 . 2009-10-14 04:29 189744 —-a-w- c:\windows\system32\PnkBstrB.exe
2009-12-09 00:44 . 2004-08-10 12:00 95360 ——w- c:\windows\system32\drivers\atapi.sys
2009-12-08 13:39 . 2009-12-08 13:39 ——– d—–w- c:\program files\ERUNT
2009-12-08 13:20 . 2006-05-21 18:16 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-12-08 12:59 . 2009-12-08 12:57 ——– d—–w- c:\program files\Spybot - Search & Destroy
2009-12-03 04:09 . 2008-03-12 18:40 ——– d—–w- c:\program files\Xfire
2009-11-30 19:33 . 2009-11-30 19:33 41872 —-a-w- c:\windows\system32\xfcodec.dll
2009-11-27 06:00 . 2008-07-01 21:20 73216 —-a-w- c:\windows\ST6UNST.EXE
2009-11-27 06:00 . 2008-07-01 21:20 249856 ——w- c:\windows\Setup1.exe
2009-11-20 21:18 . 2008-03-18 21:40 ——– d—–w- c:\program files\QuickTime
2009-11-17 07:57 . 2005-11-11 21:15 111560 -c–a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-11 23:06 . 2009-11-11 23:06 0 —ha-w- c:\windows\system32\drivers\Msft_Kernel_SaiK0728_01005.Wdf
2009-11-11 23:06 . 2009-11-11 23:06 0 —ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2009-10-30 19:12 . 2009-10-30 19:12 ——– d—–w- c:\documents and settings\Compaq_Administrator\Application Data\AdobeUM
2009-10-29 20:19 . 2009-10-29 20:19 ——– d—–w- c:\documents and settings\Compaq_Administrator\Application Data\HPQ
2009-10-17 09:10 . 2009-10-17 09:09 ——– d—–w- c:\program files\Diskeeper Home Edition
2009-10-14 04:37 . 2003-10-04 05:08 15020 —-a-w- c:\program files\readme.txt
2009-10-14 04:33 . 2008-03-10 22:58 ——– d—–w- c:\program files\TSO
2009-10-14 04:29 . 2009-10-14 04:29 75064 —-a-w- c:\windows\system32\PnkBstrA.exe
2009-10-14 04:23 . 2009-10-14 04:23 ——– d—–w- c:\documents and settings\Compaq_Administrator\Application Data\teamspeak2
2009-10-14 04:20 . 2009-02-22 07:33 ——– d—–w- c:\program files\Wolfenstein - Enemy Territory
2009-10-14 04:03 . 2005-11-11 21:44 ——– d—–w- c:\program files\Symantec
2009-10-14 03:57 . 2005-11-11 21:44 ——– d—–w- c:\program files\Common Files\Symantec Shared
2009-10-14 03:55 . 2005-11-11 21:44 ——– d—–w- c:\documents and settings\All Users\Application Data\Symantec
2009-10-14 03:44 . 2009-10-14 03:44 152576 —-a-w- c:\documents and settings\Compaq_Administrator\Application Data\Sun\Java\jre1.6.0_15\lzma.dll
2009-10-14 03:42 . 2009-10-14 03:42 1795 –sha-r- c:\windows\system32\drivers\103C_HP_CPC_EL445AA-ABA SR1750NX NA650_YC_0Pres_QCNH551_E61NAemRED1_48_IAmberine M_SASUSTek Computer INC._V1.03_B3.13_T051115_WXP2_L409_M1023_J200_7AMD_8Athlon 64_92.19_#060211_N10EC8139_Z_G10DE0614.MRK
2009-09-28 02:52 . 2009-09-28 02:45 57344 —-a-w- C:\clipstreamsa.dll
2009-09-21 22:09 . 2009-09-21 22:09 79144 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.1.8\SetupAdmin.exe
2009-05-26 20:33 . 2009-05-26 20:33 502 -c–a-w- c:\program files\EasyGen.ini
2009-05-26 20:31 . 2002-08-31 05:00 228 —-a-w- c:\program files\news.txt
2009-05-26 20:31 . 2002-02-17 21:56 354816 —-a-w- c:\program files\btnexgenipl32.dll
2008-05-01 20:29 . 2008-05-01 20:29 731725 -c–a-w- c:\program files\DownloadResource.pdf
2006-03-05 07:46 . 2006-03-05 07:46 774144 -c–a-w- c:\program files\RngInterstitial.dll
2006-02-13 15:37 . 2006-02-13 15:37 377344 -csha-w- c:\program files\ehthumbs.db
2005-09-06 20:45 . 2009-06-07 19:22 441 —-a-r- c:\program files\layout.bin
2005-09-06 20:45 . 2009-06-07 19:21 658385795 -c–a-r- c:\program files\data2.cab
2005-09-06 20:43 . 2009-06-07 19:21 43971 —-a-r- c:\program files\data1.hdr
2005-09-06 20:43 . 2009-06-07 19:21 835353 —-a-r- c:\program files\data1.cab
2005-09-06 20:43 . 2009-06-07 19:22 149 -c–a-r- c:\program files\Setup.ini
2005-09-06 20:43 . 2009-06-07 19:22 135557 —-a-r- c:\program files\setup.inx
2005-08-01 16:57 . 2009-06-07 19:22 518454 —-a-r- c:\program files\setup.bmp
2002-07-26 06:07 . 2009-06-07 19:22 346602 —-a-r- c:\program files\ikernel.ex_
.

((((((((((((((((((((((((((((( SnapShot@2009-12-09_02.56.37 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-10-14 04:09 . 2009-12-09 11:20 84661 c:\windows\system32\Macromed\Flash\uninstall_plugin.exe
+ 2009-10-28 03:40 . 2009-10-28 03:40 257440 c:\windows\system32\Macromed\Flash\NPSWF32_FlashUtil.exe
- 2009-07-18 03:21 . 2009-07-18 03:21 257440 c:\windows\system32\Macromed\Flash\NPSWF32_FlashUtil.exe
+ 2009-10-28 03:40 . 2009-10-28 03:40 3885984 c:\windows\system32\Macromed\Flash\NPSWF32.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe -atboottime" [X]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-06 64512]
"KBD"="c:\hp\KBD\KBD.EXE" [2005-02-02 61440]
"ps2"="c:\windows\system32\ps2.exe" [2004-10-25 90112]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-14 344064]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"RECGUARD"="c:\windows\SMINST\RECGUARD.EXE" [2005-07-23 237568]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-03-18 13680640]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Compaq Connections.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Compaq Connections.lnk
backup=c:\windows\pss\Compaq Connections.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
c:\program files\QuickTime\QTTask.exe -atboottime [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlwaysReady Power Message APP]
2005-08-03 07:19 77312 —-a-w- c:\windows\arpwrmsg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2004-08-10 12:00 15360 ——w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DISCover]
2005-09-27 07:43 1060864 —-a-w- c:\program files\DISC\DISCover.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DiscUpdateManager]
2005-09-27 07:42 61440 —-a-w- c:\program files\DISC\DISCUpdateMgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2005-02-17 14:11 49152 —-a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes Anti-Malware (reboot)]
2009-09-10 20:53 1312080 —-a-w- c:\program files\Malwarebytes' Anti-Malware\mbam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2009-03-18 20:56 86016 —-a-w- c:\windows\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2009-03-18 20:56 1657376 —-a-w- c:\windows\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ProfilerU]
2008-01-18 23:35 233472 —-a-w- c:\program files\Saitek\SD6\Software\ProfilerU.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SaiMfd]
2008-01-18 23:36 131072 —-a-w- c:\program files\Saitek\SD6\Software\SaiMfd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SaiVolume]
2008-01-18 23:37 126976 —-a-w- c:\program files\Saitek\CyborgKeyboard\SaiVolume.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpywareTerminator]
2009-11-20 11:04 2166784 —-a-w- c:\program files\Spyware Terminator\SpywareTerminatorShield.Exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpywareTerminatorUpdate]
2009-11-20 11:04 3055616 —-a-w- c:\program files\Spyware Terminator\SpywareTerminatorUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SpywareTerminator"="c:\program files\Spyware Terminator\SpywareTerminatorShield.exe"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\DISC\\DISCover.exe"=
"c:\\Program Files\\DISC\\DiscStreamHub.exe"=
"c:\\Program Files\\DISC\\myFTP.exe"=
"c:\\Program Files\\Compaq Connections\\5577497\\Program\\Compaq Connections.exe"=

R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [11/20/2009 5:04 AM 142592]
R3 SaiK0728;SaiK0728;c:\windows\system32\drivers\SaiK0728.sys [11/11/2009 5:06 PM 104960]
.
——- Supplementary Scan ——-
.
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
Trusted Zone: trymedia.com
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-09 14:09
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …


c:\docume~1\COMPAQ~1\LOCALS~1\Temp\catchme.dll 53248 bytes executable

scan completed successfully
hidden files: 1

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(584)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(248)
c:\windows\system32\msi.dll
.
Completion time: 2009-12-09 14:11:40
ComboFix-quarantined-files.txt 2009-12-09 20:11

Pre-Run: 159,265,820,672 bytes free
Post-Run: 159,256,489,984 bytes free

- - End Of File - - 8161F3C7074FED9230F8084041A232A9
Post #9
Download and Run ATFCleaner

Please download ATF Cleaner by Atribune. This program will clear out temporary files and settings. You will likely be logged out of the forum where you are recieving help.

This program is for Vista, XP and Windows 2000 only.
  • Double-click ATF-Cleaner.exe to run the program.
  • Under Main Select Files to Delete choose: Select All.
  • Click the Empty Selected button.
If you use Firefox browser also…
  • Click Firefox at the top and choose: Select All
  • Click the Empty Selected button.
    NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browser also…
  • Click Opera at the top and choose: Select All
  • Click the Empty Selected button.
    NOTE: If you would like to keep your saved passwords, please click No at the prompt.
DELDOMAINS

Download Deldomains.
  • Save it to your desktop.
  • Right-click DelDomains.inf and select: Install (no need to restart)
  • You may not see any noticeable changes or prompts; this is normal.
Note: The DelDomains.inf file will remove ALL entries in the Trusted, Restricted, and Enhanced Security Configuration Zones. Any entries that you had will need to be entered again. You will have to re-immunize with SpywareBlaster, and/or Spybot after doing this, and reinstall IESpyads if you use any of these programs.

Malwarebytes' Anti-Malware

I see that you have Malwarebytes' Anti-Malware installed on your computer could you please do a scan using these settings:

  • Open Malwarebytes' Anti-Malware
  • Select the Update tab
  • Click Check for Updates
  • After the update have been completed, Select the Scanner tab.
  • Select Perform quick scan, then click on Scan
  • Leave the default options as it is and click on Start Scan
  • When done, you will be prompted. Click OK, then click on Show Results
  • Checked (ticked) all items and click on Remove Selected
  • After it has removed the items, Notepad will open. Please post this log in your next reply. You can also find the log in the Logs tab. The bottom most log is the latest
Extra Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

VirusTotal File Scan
Please go to: VirusTotal
  • [external image: Posted Image]
  • Click the Browse button and search for the following file: c:\windows\Setup1.exe
  • Click Open
  • Then click Send File
  • Please be patient while the file is scanned.
  • Once the scan results appear, please provide them in your next reply.
If it says already scanned – click "reanalyze now"

Please post the results in your next reply

Please make sure you include the following items in your next post:
1. The log that was produced after running MBAM.
2. The results from the VirusTotal Scan.
3. An update on how your computer is currently running.

It would be helpful if you could answer each question in the order asked, as well as numbering your answers.
Post #10 last edited
1. MBAM Log:
Malwarebytes' Anti-Malware 1.42
Database version: 3289
Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

12/10/2009 2:45:11 AM
mbam-log-2009-12-10 (02-45-11).txt

Scan type: Quick Scan
Objects scanned: 113394
Time elapsed: 4 minute(s), 26 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)



2. Virus Total Information:

File has already been analysed:
MD5: b9917fc4c836776765e311fff84dd534
First received: 2006.07.28 16:48:14 UTC
Date: 2009.12.01 13:52:55 UTC [>8D]
Results: 0/41
Permalink: analisis/4c7ea1f0b856125a1316e7dd19a2702de959a048fc9f2556ec3de351067422b7-1259675575

Antivirus Version Last Update Result
a-squared 4.5.0.43 2009.12.01 -
AhnLab-V3 5.0.0.2 2009.12.01 -
AntiVir 7.9.1.88 2009.12.01 -
Antiy-AVL 2.0.3.7 2009.12.01 -
Authentium 5.2.0.5 2009.12.01 -
Avast 4.8.1351.0 2009.12.01 -
AVG 8.5.0.426 2009.12.01 -
BitDefender 7.2 2009.12.01 -
CAT-QuickHeal 10.00 2009.12.01 -
ClamAV 0.94.1 2009.12.01 -
Comodo 3102 2009.12.01 -
DrWeb 5.0.0.12182 2009.12.01 -
eSafe 7.0.17.0 2009.11.30 -
eTrust-Vet 35.1.7150 2009.12.01 -
F-Prot 4.5.1.85 2009.11.30 -
F-Secure 9.0.15370.0 2009.11.29 -
Fortinet 4.0.14.0 2009.12.01 -
GData 19 2009.12.01 -
Ikarus T3.1.1.74.0 2009.12.01 -
Jiangmin 11.0.800 2009.12.01 -
K7AntiVirus 7.10.906 2009.11.27 -
Kaspersky 7.0.0.125 2009.12.01 -
McAfee 5818 2009.11.30 -
McAfee+Artemis 5818 2009.11.30 -
McAfee-GW-Edition 6.8.5 2009.12.01 -
Microsoft 1.5302 2009.12.01 -
NOD32 4651 2009.12.01 -
Norman 6.03.02 2009.12.01 -
nProtect 2009.1.8.0 2009.11.28 -
Panda 10.0.2.2 2009.11.30 -
PCTools 7.0.3.5 2009.12.01 -
Prevx 3.0 2009.12.01 -
Rising 22.24.01.09 2009.12.01 -
Sophos 4.48.0 2009.12.01 -
Sunbelt 3.2.1858.2 2009.12.01 -
Symantec 1.4.4.12 2009.12.01 -
TheHacker 6.5.0.2.082 2009.11.30 -
TrendMicro 9.100.0.1001 2009.12.01 -
VBA32 3.12.12.0 2009.11.30 -
ViRobot 2009.12.1.2065 2009.12.01 -
VirusBuster 5.0.21.0 2009.11.30 -
Additional information
File size: 249856 bytes
MD5 : b9917fc4c836776765e311fff84dd534
SHA1 : 63cf6b3992f2058f6a5995293e1017627569f8b5
SHA256: 4c7ea1f0b856125a1316e7dd19a2702de959a048fc9f2556ec3de351067422b7
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x37E0
timedatestamp…..: 0x38CE7CD9 (Tue Mar 14 18:54:33 2000)
machinetype…….: 0x14C (Intel I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x350EC 0x36000 6.00 8d2f26c5a4fad502f9b2528300bacf8e
.data 0x37000 0x5390 0x1000 0.00 620f0b67a91f7f74151bc5be745b7110
.rsrc 0x3D000 0x4EDC 0x5000 3.56 b69c45010c4bdce013e31e3f092fc9c6

( 1 imports )

> msvbvm60.dll: __vbaVarTstGt, __vbaVarSub, __vbaStrI2, _CIcos, _adj_fptan, __vbaVarMove, __vbaStrI4, __vbaVarVargNofree, __vbaFreeVar, __vbaLineInputStr, __vbaLenBstr, -, __vbaStrVarMove, -, -, __vbaFreeVarList, _adj_fdiv_m64, __vbaFreeObjList, -, -, _adj_fprem1, __vbaRecAnsiToUni, -, __vbaCopyBytes, __vbaResume, __vbaStrCat, __vbaRecDestruct, __vbaSetSystemError, __vbaNameFile, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaAryDestruct, __vbaLateMemSt, -, __vbaForEachCollObj, __vbaBoolStr, __vbaExitProc, __vbaFileCloseAll, -, __vbaCyAdd, __vbaOnError, __vbaObjSet, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, -, __vbaBoolVar, __vbaForEachCollVar, -, __vbaBoolVarNull, _CIsin, -, -, __vbaErase, __vbaLateMemStAd, __vbaNextEachCollObj, -, __vbaVarZero, __vbaChkstk, __vbaFileClose, EVENT_SINK_AddRef, -, __vbaGenerateBoundsError, -, __vbaCyI2, __vbaStrCmp, __vbaVarTstEq, __vbaCyI4, __vbaNextEachCollVar, __vbaPrintObj, __vbaI2I4, DllFunctionCall, __vbaVarOr, __vbaVarLateMemSt, __vbaLbound, __vbaRedimPreserve, _adj_fpatan, __vbaR4Var, __vbaLateIdCallLd, __vbaRedim, __vbaRecUniToAnsi, EVENT_SINK_Release, __vbaNew, -, _CIsqrt, __vbaVarAnd, EVENT_SINK_QueryInterface, __vbaUI1I4, __vbaFpCmpCy, __vbaVarMul, __vbaExceptHandler, -, __vbaPrintFile, __vbaStrToUnicode, -, _adj_fprem, _adj_fdivr_m64, __vbaI2Str, __vbaVarDiv, -, __vbaFPException, __vbaInStrVar, -, -, __vbaUbound, __vbaStrVarVal, __vbaVarCat, -, __vbaDateVar, -, __vbaI2Var, -, -, -, _CIlog, -, __vbaErrorOverflow, __vbaFileOpen, -, __vbaInStr, __vbaNew2, -, __vbaCyMulI2, _adj_fdiv_m32i, -, _adj_fdivr_m32i, __vbaStrCopy, __vbaFreeStrList, -, __vbaDerefAry1, _adj_fdivr_m32, __vbaPowerR8, -, _adj_fdiv_r, -, -, -, -, __vbaI4Var, __vbaAryLock, __vbaVarAdd, __vbaVarDup, __vbaStrToAnsi, __vbaFpI2, __vbaFpI4, __vbaVarCopy, -, __vbaVarLateMemCallLd, __vbaR8IntI2, __vbaLateMemCallLd, _CIatan, -, __vbaStrMove, __vbaCastObj, __vbaStrVarCopy, -, _allmul, __vbaLenVarB, __vbaLateIdSt, _CItan, -, __vbaAryUnlock, _CIexp, __vbaMidStmtBstr, -, __vbaFreeStr, __vbaFreeObj, -

( 0 exports )
TrID : File type identification
Win32 Executable Microsoft Visual Basic 6 (71.5%)
Win32 Executable MS Visual C++ (generic) (21.3%)
Win32 Executable Generic (4.8%)
Generic Win/DOS Executable (1.1%)
DOS Executable Generic (1.1%)
ThreatExpert: http://www.threatexpert.com/report.aspx?md…5e311fff84dd534
ssdeep: 6144:AnIKlBmT0LNn3moSAj0UTp1bDQwZefWnwJsY:Anrdj0UTp1Xth
PEiD : -
RDS : NSRL Reference Data Set

( Addison-Wesley Publishing Company Inc. )

Honeypots - Tracking Hackers: SETUP1.EXE
( PC Utilities )

PC Utilities - 510 utilities: SETUP1.EXE
( TradeTouch.com inc. )

Audio ToolBox Pro: SETUP1.EXEDigital Camera Photography: SETUP1.EXEHard drive Tools 2003: SETUP1.EXEHealth and Weight Loss: SETUP1.EXEMobile Phone Tools 2003: SETUP1.EXENetwork Toolbox 2003: SETUP1.EXEPC Diagnostics & Repair Tools 2003: SETUP1.EXE, Setup1.exePC Hardware Tools 2003: SETUP1.EXEVideo and Flash Tools: SETUP1.EXEWinCE Tools 2003: SETUP1.EXE
( Topics Entertainment )

Instant Landscaping: SETUP1.EXEMortgage Master: SETUP1.EXE
( Avante International Technology, Inc. )

Optical Vote-Trakker: SETUP1.EXEVote-Trakker Software: SETUP1.EXE
( ZG Financial Corp )

Hard Drives & Subsystems: SETUP1.EXE
( Ideal )

The Locksmith: SETUP1.EXE
( Wingear )

Internet Utilities: SETUP1.EXEMP3 Studio Deluxe: Setup1.exePCHardDriveUtilities: SETUP1.EXE
( Southeast Cybercrime Summit )

SouthEast CyberCrime Summit - Conference Abstract & Presentations: SETUP1.EXE
( Cosmi Corporation )

225 Winning Educational Programs: SETUP1.EXE
( Microsoft )

Commerce Server Resource Kit: SETUP1.EXEContent Management Server SP1: SETUP1.EXEDeveloper Tools, Platforms, SDK/DDK, Applications: SETUP1.EXEDeveloper Tools, Servers: SETUP1.EXEExchange 2000 Enterprise Server: SETUP1.EXEExchange 2003 Server: SETUP1.EXEMobile Information Server Developer Edition: SETUP1.EXEMSDN BizTalk Server 2004 beta, BizTalk server 2002 dev. ed., MS content mgmt server, eMbedded visual C++ 4.0 with SP2, Exchange server 2000, SMS 2003: SETUP1.EXEMSDN Development Platform Disc1: SETUP1.EXEMSDN Development Platform Disc 1: SETUP1.EXEMSDN Development Platform Disc1: SETUP1.EXEMSDN Disc: SETUP1.EXEMSDN Disc 0022: SETUP1.EXEMSDN Disc 0773: SETUP1.EXEMSDN Disc 1780: SETUP1.EXEMSDN Disc 2432: SETUP1.EXEMSDN Disc 2432.11: SETUP1.EXEMSDN Disc 2432.12: SETUP1.EXEMSDN Disc 2432.2: SETUP1.EXEMSDN Disc 2432.4: SETUP1.EXEMSDN Disc 2432.7: SETUP1.EXEMSDN Disc 2432.9: SETUP1.EXEMSDN Disc 2435: SETUP1.EXEMSDN Disc 2435.1: SETUP1.EXEMSDN Disc 2435.2: SETUP1.EXEMSDN Disc 2436.20: SETUP1.EXEMSDN Disc 2436.22: SETUP1.EXEMSDN Disc 2436.5: SETUP1.EXEMSDN Disc 2436.6: SETUP1.EXEMSDN Disc 2436.7: SETUP1.EXEMSDN Disc 2436.8: SETUP1.EXEMSDN Disc MSDN Index Oct 2000 IE Versions Platform SDK July 2000 Edition: SETUP1.EXEMSDN Disc2436.3: SETUP1.EXEMSDN Disk 2436.22: SETUP1.EXEMSDN MS Application Center 2000, BizTalk Server 2002, BizTalk server 2004 beta, Content Management Server 2002, Identity Integration Server 2003: SETUP1.EXEMSDN MS Commerce Server 2002 Developer ed., Exchange Server 2003 Enterprise ed., Exchange Server 2003 Standard ed., Host Integration server 2000, SQL: SETUP1.EXEServers: SETUP1.EXEVisual C++: SETUP1.EXEVisual Studio: SETUP1.EXEVisual Studio 6.0: SETUP1.EXEVisual Studio 6.0: Setup1.exeVisual Studio 6.0 Service Pack 4 (x86) - Microsoft Internet Information Server Resource Kit: SETUP1.EXE
( Next Step Publishing )

Desktop Security: SETUP1.EXE, Setup1.exeNetwork Tools: SETUP1.EXE, Setup1.exeSystem Tools: SETUP1.EXESystem Tools 2003: SETUP1.EXE


3. How my computer is running?

It is running pretty good now. I don't get the redirecting to another link when I click on one but sometimes I still get the window that opens with 5 or 6 tabs in it that is in Chinese but I have not seen that since the last stuff that we did the ATF Cleaner and MBAM. So it may be fixed.

Sorry for the delays but I have been sick and my mind isn't in the right place. I also want to let you know that when I ran the ComboFix yesterday it popped up and said that a Malicious RootKit has been detected and the computer needs to restart. So I went ahead and restarted. I had to open ComboFix back up after the restart because it did not restart. It then ran and did not give me that message again and it generated the report that I posted. I don't know if that had anything to do with it my problem or not or if it is even pertinent.

Also I still have like 40 processes running still and don't understand why there are so many. Is this normal because I pretty much have everything on start-up turned off and still have all these processes running.

Again thank you for all your help!
Post #11

Also I still have like 40 processes running still and don't understand why there are so many. Is this normal because I pretty much have everything on start-up turned off and still have all these processes running.

That is perfectly normal to have that many processes running on your computer. Many of those processes are what help your computer function. Without them your computer would not be able to function probably.

Java Outdated
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version Java components and update.

  • Download the latest version of Java Runtime Environment (JRE) 6 and save it to your desktop.
  • Scroll down to where it says "Java SE Runtime Environment (JRE) 6 Update 17. The Java SE Runtime Environment (JRE) allows end-users to run Java applications."
  • Click the "Download" button to the right.
  • Select the Windows platform from the drop-down menu.
  • Read the License Agreement and then check the box that says: " I agree to the Java SE Runtime Environment 6 with JavaFX License Agreement". Click on Continue.The page will refresh.
  • Click on the link to download Windows Offline Installation and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Now go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java™ 6) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java version.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u17-windows-i586-p.exe to install the newest version.
  • After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
    • On the General tab, under Temporary Internet Files, click the Settings button.
    • Next, click on the Delete Files button
    • There are two options in the window to clear the cache - Leave BOTH CheckedApplications and AppletsTrace and Log Files
  • Click OK on Delete Temporary Files Window

    Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
  • Click OK to leave the Temporary Files Window
  • Click OK to leave the Java Control Panel.
Update Adobe Reader
Earlier versions of Adobe Reader have known security flaws so it is recommended that you update your copy
  • Go to Start > Control Panel > Add/Remove Programs
  • Remove ALL instances of Adobe Reader
  • Re-boot your computer as required.
  • Once ALL versions of Adobe Reader have been uninstalled, visit: <> and download the latest version of Adobe Reader
Alternative Option: after uninstalling Adobe Reader, you could try installing Foxit Reader from >here< Foxit Reader has fewer add-ons therefore loads more quickly.

ESET Online Scanner
I'd like us to scan your machine with ESET Online Scan

Note: It is recommended to disable on-board anti-virus program and anti-spyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your anti-virus along with your anti-spyware programs.


  • Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  • Click the [external image: Posted Image] button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the [external image: Posted Image] icon on your desktop.
  • Check [external image: Posted Image]
  • Click the [external image: Posted Image] button.
  • Accept any security warnings from your browser.
  • Check [external image: Posted Image]
  • Make sure that the option "Remove found threats" is Unchecked
  • Push the Start button.
  • ESET will then download updates for itself, install itself, and begin
    scanning your computer. Please be patient as this can take some time.
  • When the scan completes, push [external image: Posted Image]
  • Push [external image: Posted Image], and save the file to your desktop using a unique name, such as
    ESETScan. Include the contents of this report in your next reply.
  • Push the [external image: Posted Image] button.
  • Push [external image: Posted Image]
Please make sure you include the following items in your next post:
1. The log that was produced after running your computer.
2. Any outstanding issues that you may be experiencing with your computer (if any).

It would be helpful if you could answer each question in the order asked, as well as numbering your answers.
Post #12
Log from ESET Scan:

C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WildTangent23.zip Win32/Bagle.gen.zip worm
C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\atapi.sys.vir Win32/Olmarik.RF virus

The computer seems to be running fine. I have no window pop-ups or redirects at all.
Post #13
Time for some housekeeping
The following will implement some cleanup procedures as well as reset System Restore points:
[external image: Posted Image]
Click Start > Run and copy/paste the following bolded text into the Run box and click OK: ComboFix /Uninstall

Now to remove most of the tools that we have used in fixing your machine:
  • Make sure you have an Internet Connection.
  • Download OTC to your desktop and run it
  • A list of tool components used in the cleanup of malware will be downloaded.
  • If your Firewall or Real Time protection attempts to block OTC to reach the Internet, please allow the application to do so.
  • Click Yes to begin the cleanup process and remove these components, including this application.
  • You will be asked to reboot the machine to finish the cleanup process. If you are asked to reboot the machine choose Yes.
You can go ahead and get rid of any additional tools or logs that may be leftover on your desktop.

All Clean Speech

===> Make sure you've re-enabled any Security Programs that we may have disabled during the malware removal process. <===

Below I have included a number of recommendations for how to protect your computer against malware infections.
  • It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
    Strong passwords: How to create and use them     then consider a password keeper, to keep all your passwords safe.
  • Keep Windows updated by regularly checking their website at: http://windowsupdate.microsoft.com/
    This will ensure your computer has always the latest security updates available installed on your computer.
  • SpywareBlaster protects against bad ActiveX, it immunizes your PC against them.
  • SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program ( eg : TeaTimer, Windows Defender ) or there will be a conflict.
  • Make Internet Explorer more secure
    • Click Start > Run
    • Type Inetcpl.cpl & click OK
    • Click on the Security tab
    • Click Reset all zones to default level
    • Make sure the Internet Zone is selected & Click Custom level
    • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
    • Next Click OK, then Apply button and then OK to exit the Internet Properties page.
  • ATF Cleaner - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.
  • MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.
  • WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
    • Green to go
    • Yellow for caution
    • Red to stop
    WOT has an addon available for both Firefox and IE
  • Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more
    secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in pop up
    blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from Here
    • If you choose to use Firefox, I highly recommend this add-on to keep your PC even more secure.
      • NoScript - for blocking ads and other potential website attacks
  • Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
  • ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
  • In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles:
    Think Prevention.
    PC Safety and Security–What Do I Need?.
**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.

Thank you for your patience, and performing all of the procedures requested.

Please respond one last time so we can consider the thread resolved and close it, thank-you.
Post #14
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI