What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] malware detected, desktop wallpaper hijacked

16 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Last night I was surfing the web and out of nowhere a program called "Internet Security 2010" popped up and tried to start scanning my computer. Also my desktop wallpaper changed to a solid color with a box in the middle that says "Your system is infected! System has been stopped due to a serious malfunction. Spyware activity has been detected. It is recommended to use spyware removal tool to prevent data loss. Do not use the computer before all spyware is removed." After this happened I ran a scan using Malwarebytes and one using Spybot. Malwarebytes' Anti-Malware 1.30 Database version: 1319 Windows 5.1.2600 Service Pack 3 12/10/2009 1:33:04 AM mbam-log-2009-12-10 (01-33-04).txt Scan type: Quick Scan Objects scanned: 56151 Time elapsed: 11 minute(s), 49 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 2 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoChangingWallpaper (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) Spybot — Report generated: 2009-12-10 03:09 — Win32.Agent.chh: [SBI $EC4787FA] Settings (Registry value, fixed) HKEY_USERS\S-1-5-21-295320125-4248868747-4094414448-1003\Software\8636065b-fef0-4255-b14f-54639f7900a4 Win32.Agent.chh: [SBI $DC50EBD1] Executable (File, fixed) C:\Program Files\InternetSecurity2010\IS2010.exe Properties.size=0 Properties.md5=D41D8CD98F00B204E9800998ECF8427E Microsoft.Windows.Explorer: [SBI $1931FF4D] Settings (Registry change, fixed) HKEY_USERS\S-1-5-21-295320125-4248868747-4094414448-1003\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges Microsoft.WindowsSecurityCenter.AntiVirusOverride: [SBI $3604910C] Settings (Registry change, fixed) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusOverride Win32.Agent.wu: [SBI $F76387AF] Autorun settings (winupdate86.exe) (Registry value, fixed) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdate86.exe Win32.Agent.wu: [SBI $F76387AF] Program file (File, fixed) C:\WINDOWS\system32\winupdate86.exe Properties.size=0 Properties.md5=D41D8CD98F00B204E9800998ECF8427E Right Media: Tracking cookie (Internet Explorer: Owner) (Cookie, fixed) — Spybot - Search & Destroy version: 1.6.2 (build: 20090126) — 2009-01-26 blindman.exe (1.0.0.8) 2009-01-26 SDFiles.exe (1.6.1.7) 2009-01-26 SDMain.exe (1.0.0.6) 2009-01-26 SDUpdate.exe (1.6.0.12) 2008-07-07 SDWinSec.exe (1.0.0.12) 2009-01-26 SpybotSD.exe (1.6.2.46) 2009-03-05 TeaTimer.exe ([removed]) 2009-02-16 unins000.exe (51.49.0.0) 2009-01-26 Update.exe (1.6.0.7) 2009-11-04 advcheck.dll ([removed]) 2007-04-02 aports.dll (2.1.0.0) 2008-06-14 DelZip179.dll (1.79.11.1) 2009-01-26 SDHelper.dll (1.6.2.14) 2008-06-19 sqlite3.dll 2009-01-26 Tools.dll (2.1.6.10) 2009-01-16 UninsSrv.dll (1.0.0.0) 2009-10-08 Includes\Adware.sbi (*) 2009-12-08 Includes\AdwareC.sbi (*) 2009-01-22 Includes\Cookies.sbi (*) 2009-11-03 Includes\Dialer.sbi (*) 2009-12-08 Includes\DialerC.sbi (*) 2009-01-22 Includes\HeavyDuty.sbi (*) 2009-05-26 Includes\Hijackers.sbi (*) 2009-12-08 Includes\HijackersC.sbi (*) 2009-10-20 Includes\Keyloggers.sbi (*) 2009-12-08 Includes\KeyloggersC.sbi (*) 2004-11-29 Includes\LSP.sbi (*) 2009-12-08 Includes\Malware.sbi (*) 2009-12-08 Includes\MalwareC.sbi (*) 2009-03-25 Includes\PUPS.sbi (*) 2009-12-08 Includes\PUPSC.sbi (*) 2009-01-22 Includes\Revision.sbi (*) 2009-01-13 Includes\Security.sbi (*) 2009-12-08 Includes\SecurityC.sbi (*) 2008-06-03 Includes\Spybots.sbi (*) 2008-06-03 Includes\SpybotsC.sbi (*) 2009-11-03 Includes\Spyware.sbi (*) 2009-12-08 Includes\SpywareC.sbi (*) 2009-06-08 Includes\Tracks.uti 2009-12-08 Includes\Trojans.sbi (*) 2009-12-09 Includes\TrojansC.sbi (*) 2008-03-04 Plugins\Chai.dll 2008-03-05 Plugins\Fennel.dll 2008-02-26 Plugins\Mate.dll 2007-12-24 Plugins\TCPIPAddress.dll After the scans the Internet Security 2010 program was removed from my computer, but my desktop wallpaper is still displaying the same message as before. I also did a scan with AVG earlier. Scan "Scan whole computer" was finished. Infections;"3";"3";"0" Warnings;"157";"157";"0" Folders selected for scanning:;"Scan whole computer" Scan started:;"Thursday, December 10, 2009, 11:55:58 AM" Scan finished:;"Thursday, December 10, 2009, 3:10:04 PM (3 hour(s) 14 minute(s) 5 second(s))" Total object scanned:;"711377" User who launched the scan:;"Owner" Infections File;"Infection";"Result" C:\WINDOWS\system32\winlogon86.exe;"Trojan horse Generic15.CJRY";"Moved to Virus Vault" C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\K9HQBLRO\SetupIS2010[1].exe;"Trojan horse SHeur2.BXYN";"Moved to Virus Vault" C:\Documents and Settings\Owner\Local Settings\Temp\c.exe;"Trojan horse Generic15.CJRY";"Moved to Virus Vault" Warnings File;"Infection";"Result" C:\Documents and Settings\Owner\Cookies\owner@valueclick[1].txt:\valueclick.net.85648628;"Found Tracking cookie.Valueclick";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@valueclick[1].txt;"Found Tracking cookie.Valueclick";"Healed" C:\Documents and Settings\Owner\Cookies\owner@tribalfusion[2].txt:\tribalfusion.com.dcc03271;"Found Tracking cookie.Tribalfusion";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@tribalfusion[2].txt;"Found Tracking cookie.Tribalfusion";"Healed" C:\Documents and Settings\Owner\Cookies\owner@trafficmp[1].txt:\trafficmp.com.f3e5803e;"Found Tracking cookie.Trafficmp";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@trafficmp[1].txt:\trafficmp.com.e2e71e33;"Found Tracking cookie.Trafficmp";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@trafficmp[1].txt:\trafficmp.com.ae53b8b;"Found Tracking cookie.Trafficmp";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@trafficmp[1].txt:\trafficmp.com.a00e30b4;"Found Tracking cookie.Trafficmp";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@trafficmp[1].txt:\trafficmp.com.883dbaf5;"Found Tracking cookie.Trafficmp";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@trafficmp[1].txt:\trafficmp.com.3c1ab65a;"Found Tracking cookie.Trafficmp";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@trafficmp[1].txt:\trafficmp.com.37644bdb;"Found Tracking cookie.Trafficmp";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@trafficmp[1].txt;"Found Tracking cookie.Trafficmp";"Healed" C:\Documents and Settings\Owner\Cookies\owner@tacoda[6].txt:\tacoda.net.ed9c50d1;"Found Tracking cookie.Tacoda";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@tacoda[6].txt:\tacoda.net.cd7ce44f;"Found Tracking cookie.Tacoda";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@tacoda[6].txt:\tacoda.net.c4fe2ebb;"Found Tracking cookie.Tacoda";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@tacoda[6].txt:\tacoda.net.5935e89;"Found Tracking cookie.Tacoda";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@tacoda[6].txt:\tacoda.net.4366831a;"Found Tracking cookie.Tacoda";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@tacoda[6].txt:\tacoda.net.27341d57;"Found Tracking cookie.Tacoda";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@tacoda[6].txt;"Found Tracking cookie.Tacoda";"Healed" C:\Documents and Settings\Owner\Cookies\owner@tacoda[4].txt:\tacoda.net.ed9c50d1;"Found Tracking cookie.Tacoda";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@tacoda[4].txt:\tacoda.net.cd7ce44f;"Found Tracking cookie.Tacoda";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@tacoda[4].txt:\tacoda.net.c4fe2ebb;"Found Tracking cookie.Tacoda";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@tacoda[4].txt:\tacoda.net.5935e89;"Found Tracking cookie.Tacoda";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@tacoda[4].txt:\tacoda.net.4366831a;"Found Tracking cookie.Tacoda";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@tacoda[4].txt:\tacoda.net.27341d57;"Found Tracking cookie.Tacoda";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@tacoda[4].txt;"Found Tracking cookie.Tacoda";"Healed" C:\Documents and Settings\Owner\Cookies\owner@tacoda[3].txt:\tacoda.net.5935e89;"Found Tracking cookie.Tacoda";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@tacoda[3].txt:\tacoda.net.4366831a;"Found Tracking cookie.Tacoda";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@tacoda[3].txt:\tacoda.net.27341d57;"Found Tracking cookie.Tacoda";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@tacoda[3].txt;"Found Tracking cookie.Tacoda";"Healed" C:\Documents and Settings\Owner\Cookies\owner@tacoda[2].txt:\tacoda.net.ed9c50d1;"Found Tracking cookie.Tacoda";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@tacoda[2].txt:\tacoda.net.cd7ce44f;"Found Tracking cookie.Tacoda";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@tacoda[2].txt:\tacoda.net.5935e89;"Found Tracking cookie.Tacoda";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@tacoda[2].txt:\tacoda.net.4366831a;"Found Tracking cookie.Tacoda";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@tacoda[2].txt:\tacoda.net.27341d57;"Found Tracking cookie.Tacoda";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@tacoda[2].txt;"Found Tracking cookie.Tacoda";"Healed" C:\Documents and Settings\Owner\Cookies\owner@tacoda[1].txt:\tacoda.net.ed9c50d1;"Found Tracking cookie.Tacoda";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@tacoda[1].txt:\tacoda.net.c4fe2ebb;"Found Tracking cookie.Tacoda";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@tacoda[1].txt:\tacoda.net.5935e89;"Found Tracking cookie.Tacoda";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@tacoda[1].txt:\tacoda.net.4366831a;"Found Tracking cookie.Tacoda";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@tacoda[1].txt:\tacoda.net.27341d57;"Found Tracking cookie.Tacoda";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@tacoda[1].txt;"Found Tracking cookie.Tacoda";"Healed" C:\Documents and Settings\Owner\Cookies\owner@serving-sys[2].txt:\serving-sys.com.c9034af6;"Found Tracking cookie.Serving-sys";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@serving-sys[2].txt:\serving-sys.com.6a1cf9e8;"Found Tracking cookie.Serving-sys";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@serving-sys[2].txt:\serving-sys.com.606c3d3b;"Found Tracking cookie.Serving-sys";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@serving-sys[2].txt:\serving-sys.com.4b416ef8;"Found Tracking cookie.Serving-sys";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@serving-sys[2].txt:\serving-sys.com.400f83f;"Found Tracking cookie.Serving-sys";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@serving-sys[2].txt:\serving-sys.com.255d6f2f;"Found Tracking cookie.Serving-sys";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@serving-sys[2].txt;"Found Tracking cookie.Serving-sys";"Healed" C:\Documents and Settings\Owner\Cookies\owner@ru4[1].txt:\ru4.com.ae54769d;"Found Tracking cookie.Ru4";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@ru4[1].txt:\ru4.com.8b675d81;"Found Tracking cookie.Ru4";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@ru4[1].txt:\ru4.com.5a5e0633;"Found Tracking cookie.Ru4";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@ru4[1].txt;"Found Tracking cookie.Ru4";"Healed" C:\Documents and Settings\Owner\Cookies\owner@revsci[2].txt:\revsci.net.f7ac007f;"Found Tracking cookie.Revsci";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@revsci[2].txt:\revsci.net.f3475212;"Found Tracking cookie.Revsci";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@revsci[2].txt:\revsci.net.e9dbeb91;"Found Tracking cookie.Revsci";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@revsci[2].txt:\revsci.net.d7f89994;"Found Tracking cookie.Revsci";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@revsci[2].txt:\revsci.net.a64c3767;"Found Tracking cookie.Revsci";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@revsci[2].txt:\revsci.net.8642c85d;"Found Tracking cookie.Revsci";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@revsci[2].txt:\revsci.net.7362fcc3;"Found Tracking cookie.Revsci";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@revsci[2].txt:\revsci.net.6215368c;"Found Tracking cookie.Revsci";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@revsci[2].txt:\revsci.net.55564293;"Found Tracking cookie.Revsci";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@revsci[2].txt:\revsci.net.50e13b1b;"Found Tracking cookie.Revsci";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@revsci[2].txt:\revsci.net.4fdfee8f;"Found Tracking cookie.Revsci";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@revsci[2].txt:\revsci.net.44927ec;"Found Tracking cookie.Revsci";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@revsci[2].txt:\revsci.net.3ca1e936;"Found Tracking cookie.Revsci";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@revsci[2].txt:\revsci.net.2df99d79;"Found Tracking cookie.Revsci";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@revsci[2].txt;"Found Tracking cookie.Revsci";"Healed" C:\Documents and Settings\Owner\Cookies\owner@revsci[1].txt:\revsci.net.e9dbeb91;"Found Tracking cookie.Revsci";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@revsci[1].txt:\revsci.net.a5a8b88c;"Found Tracking cookie.Revsci";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@revsci[1].txt:\revsci.net.55564293;"Found Tracking cookie.Revsci";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@revsci[1].txt:\revsci.net.44927ec;"Found Tracking cookie.Revsci";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@revsci[1].txt:\revsci.net.2df99d79;"Found Tracking cookie.Revsci";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@revsci[1].txt;"Found Tracking cookie.Revsci";"Healed" C:\Documents and Settings\Owner\Cookies\owner@realmedia[2].txt:\realmedia.com.ef906bac;"Found Tracking cookie.Realmedia";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@realmedia[2].txt:\realmedia.com.e14be39e;"Found Tracking cookie.Realmedia";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@realmedia[2].txt:\realmedia.com.dc841856;"Found Tracking cookie.Realmedia";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@realmedia[2].txt:\realmedia.com.bf4a1fa7;"Found Tracking cookie.Realmedia";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@realmedia[2].txt:\realmedia.com.a2b49f1a;"Found Tracking cookie.Realmedia";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@realmedia[2].txt:\realmedia.com.9514c147;"Found Tracking cookie.Realmedia";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@realmedia[2].txt:\realmedia.com.855b46d;"Found Tracking cookie.Realmedia";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@realmedia[2].txt:\realmedia.com.6b2e2a72;"Found Tracking cookie.Realmedia";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@realmedia[2].txt:\realmedia.com.125a868c;"Found Tracking cookie.Realmedia";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@realmedia[2].txt;"Found Tracking cookie.Realmedia";"Healed" C:\Documents and Settings\Owner\Cookies\owner@questionmarket[2].txt:\questionmarket.com.767e4302;"Found Tracking cookie.Questionmarket";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@questionmarket[2].txt:\questionmarket.com.4dd5e426;"Found Tracking cookie.Questionmarket";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@questionmarket[2].txt:\questionmarket.com.3eb5a9f1;"Found Tracking cookie.Questionmarket";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@questionmarket[2].txt;"Found Tracking cookie.Questionmarket";"Healed" C:\Documents and Settings\Owner\Cookies\owner@questionmarket[1].txt:\questionmarket.com.4dd5e426;"Found Tracking cookie.Questionmarket";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@questionmarket[1].txt:\questionmarket.com.3eb5a9f1;"Found Tracking cookie.Questionmarket";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@questionmarket[1].txt;"Found Tracking cookie.Questionmarket";"Healed" C:\Documents and Settings\Owner\Cookies\owner@pro-market[1].txt:\pro-market.net.bbf67f2d;"Found Tracking cookie.Pro-market";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@pro-market[1].txt:\pro-market.net.b51604f4;"Found Tracking cookie.Pro-market";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@pro-market[1].txt:\pro-market.net.1d1ba569;"Found Tracking cookie.Pro-market";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@pro-market[1].txt;"Found Tracking cookie.Pro-market";"Healed" C:\Documents and Settings\Owner\Cookies\owner@pointroll[2].txt:\pointroll.com.f2d5a6f6;"Found Tracking cookie.Pointroll";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@pointroll[2].txt:\pointroll.com.72c0abc9;"Found Tracking cookie.Pointroll";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@pointroll[2].txt;"Found Tracking cookie.Pointroll";"Healed" C:\Documents and Settings\Owner\Cookies\owner@overture[2].txt:\overture.com.e626e6be;"Found Tracking cookie.Overture";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@overture[2].txt:\overture.com.52ca467a;"Found Tracking cookie.Overture";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@overture[2].txt;"Found Tracking cookie.Overture";"Healed" C:\Documents and Settings\Owner\Cookies\owner@msnportal.112.2o7[1].txt:\msnportal.112.2o7.net.7225be6f;"Found Tracking cookie.2o7";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@msnportal.112.2o7[1].txt;"Found Tracking cookie.2o7";"Healed" C:\Documents and Settings\Owner\Cookies\[removed][2].txt:\m.webtrends.com.b4ca7df0;"Found Tracking cookie.Webtrends";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\[removed][2].txt;"Found Tracking cookie.Webtrends";"Healed" C:\Documents and Settings\Owner\Cookies\owner@ivwbox[2].txt:\ivwbox.de.41d82fe2;"Found Tracking cookie.Ivwbox";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@ivwbox[2].txt;"Found Tracking cookie.Ivwbox";"Healed" C:\Documents and Settings\Owner\Cookies\owner@cqcounter[1].txt:\cqcounter.com.1bbf0979;"Found Tracking cookie.Cqcounter";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@cqcounter[1].txt;"Found Tracking cookie.Cqcounter";"Healed" C:\Documents and Settings\Owner\Cookies\[removed]-sys[1].txt:\bs.serving-sys.com.5bf1f00f;"Found Tracking cookie.Serving-sys";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\[removed]-sys[1].txt;"Found Tracking cookie.Serving-sys";"Healed" C:\Documents and Settings\Owner\Cookies\owner@adbrite[1].txt:\adbrite.com.d5e309c2;"Found Tracking cookie.Adbrite";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@adbrite[1].txt:\adbrite.com.775ee79c;"Found Tracking cookie.Adbrite";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@adbrite[1].txt:\adbrite.com.71beeff9;"Found Tracking cookie.Adbrite";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@adbrite[1].txt:\adbrite.com.557c9f74;"Found Tracking cookie.Adbrite";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@adbrite[1].txt:\adbrite.com.44f92a69;"Found Tracking cookie.Adbrite";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@adbrite[1].txt;"Found Tracking cookie.Adbrite";"Healed" C:\Documents and Settings\Owner\Cookies\[removed][8].txt:\ad.yieldmanager.com.557bf2b0;"Found Tracking cookie.Yieldmanager";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\[removed][8].txt:\ad.yieldmanager.com.539b0606;"Found Tracking cookie.Yieldmanager";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\[removed][8].txt;"Found Tracking cookie.Yieldmanager";"Healed" C:\Documents and Settings\Owner\Cookies\[removed][5].txt:\ad.yieldmanager.com.e626e6be;"Found Tracking cookie.Yieldmanager";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\[removed][5].txt:\ad.yieldmanager.com.b68f2b7b;"Found Tracking cookie.Yieldmanager";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\[removed][5].txt:\ad.yieldmanager.com.87a9ab5d;"Found Tracking cookie.Yieldmanager";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\[removed][5].txt:\ad.yieldmanager.com.830b6f08;"Found Tracking cookie.Yieldmanager";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\[removed][5].txt:\ad.yieldmanager.com.557bf2b0;"Found Tracking cookie.Yieldmanager";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\[removed][5].txt:\ad.yieldmanager.com.539b0606;"Found Tracking cookie.Yieldmanager";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\[removed][5].txt;"Found Tracking cookie.Yieldmanager";"Healed" C:\Documents and Settings\Owner\Cookies\owner@2o7[2].txt:\2o7.net.f323c089;"Found Tracking cookie.2o7";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@2o7[2].txt:\2o7.net.d942ae2f;"Found Tracking cookie.2o7";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@2o7[2].txt:\2o7.net.d4b64ade;"Found Tracking cookie.2o7";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@2o7[2].txt:\2o7.net.d2aa96c8;"Found Tracking cookie.2o7";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@2o7[2].txt:\2o7.net.ca30b7c8;"Found Tracking cookie.2o7";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@2o7[2].txt:\2o7.net.bf62af4f;"Found Tracking cookie.2o7";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@2o7[2].txt:\2o7.net.b271730a;"Found Tracking cookie.2o7";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@2o7[2].txt:\2o7.net.aa0e17b4;"Found Tracking cookie.2o7";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@2o7[2].txt:\2o7.net.a9ff4c77;"Found Tracking cookie.2o7";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@2o7[2].txt:\2o7.net.9464f2b7;"Found Tracking cookie.2o7";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@2o7[2].txt:\2o7.net.819df4c7;"Found Tracking cookie.2o7";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@2o7[2].txt:\2o7.net.7c6f0705;"Found Tracking cookie.2o7";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@2o7[2].txt:\2o7.net.75108650;"Found Tracking cookie.2o7";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@2o7[2].txt:\2o7.net.71053f32;"Found Tracking cookie.2o7";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@2o7[2].txt:\2o7.net.680f684a;"Found Tracking cookie.2o7";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@2o7[2].txt:\2o7.net.611411a0;"Found Tracking cookie.2o7";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@2o7[2].txt:\2o7.net.5791c929;"Found Tracking cookie.2o7";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@2o7[2].txt:\2o7.net.5553278;"Found Tracking cookie.2o7";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@2o7[2].txt:\2o7.net.542e30e8;"Found Tracking cookie.2o7";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@2o7[2].txt:\2o7.net.4544962;"Found Tracking cookie.2o7";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@2o7[2].txt:\2o7.net.29c43642;"Found Tracking cookie.2o7";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@2o7[2].txt:\2o7.net.1d3d5b1a;"Found Tracking cookie.2o7";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@2o7[2].txt:\2o7.net.16132136;"Found Tracking cookie.2o7";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@2o7[2].txt:\2o7.net.108e2a46;"Found Tracking cookie.2o7";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@2o7[2].txt;"Found Tracking cookie.2o7";"Healed" C:\Documents and Settings\Owner\Cookies\owner@247realmedia[1].txt:\247realmedia.com.964cd308;"Found Tracking cookie.247realmedia";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@247realmedia[1].txt:\247realmedia.com.855b46d;"Found Tracking cookie.247realmedia";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@247realmedia[1].txt:\247realmedia.com.22701b7f;"Found Tracking cookie.247realmedia";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@247realmedia[1].txt:\247realmedia.com.125a868c;"Found Tracking cookie.247realmedia";"Moved to Virus Vault" C:\Documents and Settings\Owner\Cookies\owner@247realmedia[1].txt;"Found Tracking cookie.247realmedia";"Healed" This didn't seem to help the fact that the message is still displayed on my desktop. My computer is not running slow and so far the only other problem I've noticed is that whatever is on here is blocking me from going to some websites. I read the welcome topic and here are the logs you guys requested: DDS (Ver_09-06-26.01) - NTFSx86 Run by [removed] at 16:04:26.64 on Thu 12/10/2009 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_13 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1022.481 [GMT -6:00] AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} ============== Running Processes =============== C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe C:\Program Files\AVG\AVG9\avgrsx.exe svchost.exe C:\Program Files\AVG\AVG9\avgcsrvx.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Google\Update\1.2.183.13\GoogleCrashHandler.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Digital Media Reader\shwicon2k.exe C:\Program Files\AIM\aim.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\AVG\AVG9\avgchsvx.exe C:\Program Files\AVG\AVG9\avgwdsvc.exe C:\Program Files\AVG\AVG9\avgemc.exe C:\Program Files\AVG\AVG9\avgcsrvx.exe C:\Program Files\AVG\AVG9\avgtray.exe C:\Program Files\Wise Registry Cleaner 3\WiseRegistryCleaner.exe C:\WINDOWS\system32\wscntfy.exe C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\K9HQBLRO\dds[1].scr ============== Pseudo HJT Report =============== uSearch Bar = hxxp://www.google.com/ie uStart Page = hxxp://www.yahoo.com/ uSearch Page = hxxp://www.google.com uInternet Connection Wizard,ShellNext = hxxp://www.gateway.com/ uInternet Settings,ProxyOverride = *.local uSearchURL,(Default) = hxxp://www.google.com/keyword/%s mSearchAssistant = hxxp://www.google.com/ie BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File BHO: {0eb5f347-be12-4b07-9616-1f4993e846a1} - c:\windows\system32\yaywVLBQ.dll BHO: {91d0dbe7-d7c9-40df-849d-bed5fa864a6a} - c:\windows\system32\qoMggGVo.dll BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.4.4525.1752\swg.dll BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_B7C5AC242193BB3E.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll uRun: [AIM] c:\program files\aim\aim.exe -cnetwait.odl uRun: [Yahoo! Pager] "c:\progra~1\yahoo!\messen~1\YAHOOM~1.EXE" -quiet uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe" uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [Internet Security 2010] c:\program files\internetsecurity2010\IS2010.exe mRun: [SynTPLpr] c:\program files\synaptics\syntp\SynTPLpr.exe mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe mRun: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE mRun: [SunKist] c:\program files\digital media reader\shwicon2k.exe mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exe uPolicies-explorer: NoSetActiveDesktop = 1 (0x1) mPolicies-explorer: NoSetActiveDesktop = 1 (0x1) mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1) IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000 IE: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - c:\program files\aim\aim.exe IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll LSP: c:\windows\system32\winhelper86.dll DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} - hxxps://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab DPF: {A4639D2F-774E-11D3-A490-00C04F6843FB} - hxxp://download.microsoft.com/download/PowerPoint2002/Install/10.0.2609/WIN98MeXP/EN-US/msorun.cab DPF: {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_02-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab DPF: {DB7BF79A-FC51-4B5A-92BC-A65731174380} - hxxp://www.instantaction.com/download/iaplayer.cab Filter: text/html - {7e2b6768-ea12-42fa-9eaa-5a695f00f020} - Handler: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - c:\program files\hp\hpcoretech\comp\hpuiprot.dll Notify: AtiExtEvent - Ati2evxx.dll Notify: avgrsstarter - avgrsstx.dll AppInit_DLLs: mttpkr.dll sfgeai.dll tjojza.dll ================= FIREFOX =================== FF - ProfilePath - FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} ============= SERVICES / DRIVERS =============== R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-12-10 333192] R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-12-10 28424] R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-12-10 360584] R2 avg9emc;AVG Free E-mail Scanner;c:\program files\avg\avg9\avgemc.exe [2009-12-10 906520] R2 avg9wd;AVG Free WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2009-12-10 285392] R2 Viewpoint Service;Viewpoint Service;c:\program files\viewpoint\common\ViewpointService.exe [2009-1-15 30152] R3 HSFHWATI;HSFHWATI;c:\windows\system32\drivers\HSFHWATI.sys [2008-8-9 200192] S2 gupdate1c9d821288668ec;Google Update Service (gupdate1c9d821288668ec);c:\program files\google\update\GoogleUpdate.exe [2009-5-18 133104] S2 mrtRate;mrtRate; [x] S3 AMDMSRIO;AMDMSRIO;\??\c:\docume~1\owner\locals~1\temp\safe to delete 3_0_4_8\amdmsrio.sys –> c:\docume~1\owner\locals~1\temp\safe to delete 3_0_4_8\AMDMSRIO.sys [?] S3 ICDUSB2;Sony IC Recorder (P);c:\windows\system32\drivers\IcdUsb2.sys [2008-10-20 39048] =============== Created Last 30 ================ 2009-12-10 11:52 –d-h— C:\$AVG 2009-12-10 11:51 12,464 a——- c:\windows\system32\avgrsstx.dll 2009-12-10 11:51 360,584 a——- c:\windows\system32\drivers\avgtdix.sys 2009-12-10 11:51 333,192 a——- c:\windows\system32\drivers\avgldx86.sys 2009-12-10 11:51 –d—– c:\windows\system32\drivers\Avg 2009-12-10 11:50 –d—– c:\docume~1\alluse~1\applic~1\avg9 2009-12-10 02:56 0 a——- c:\windows\system32\19169.exe 2009-12-10 02:36 0 a——- c:\windows\system32\26500.exe 2009-12-10 02:16 0 a——- c:\windows\system32\6334.exe 2009-12-10 01:56 0 a——- c:\windows\system32\18467.exe 2009-12-10 01:19 0 a——- c:\windows\system32\41.exe 2009-12-10 01:19 18,944 a——- c:\windows\system32\winhelper86.dll 2009-12-10 01:19 2,854 a——- c:\windows\system32\critical_warning.html 2009-11-22 00:04 487 a——- c:\windows\intuprof.ini 2009-11-12 10:54 –d—– c:\documents and settings\owner\.netbeans-derby 2009-11-12 10:52 –d—– c:\documents and settings\owner\.netbeans 2009-11-12 10:52 –d—– c:\documents and settings\owner\.netbeans-registration 2009-11-12 10:45 –d—– c:\program files\NetBeans 6.7.1 2009-11-12 10:43 –d—– c:\documents and settings\owner\.nbi ==================== Find3M ==================== 2009-10-29 01:45 916,480 a——- c:\windows\system32\wininet.dll 2009-10-20 23:38 75,776 a——- c:\windows\system32\strmfilt.dll 2009-10-20 23:38 25,088 a——- c:\windows\system32\httpapi.dll 2009-10-20 10:20 265,728 a——- c:\windows\system32\drivers\http.sys 2009-10-13 04:30 270,336 a——- c:\windows\system32\oakley.dll 2009-10-12 07:38 149,504 a——- c:\windows\system32\rastls.dll 2009-10-12 07:38 79,872 a——- c:\windows\system32\raschap.dll ============= FINISH: 16:05:36.95 =============== ROOTREPEAL © AD, 2007-2009 ================================================== Scan Start Time: 2009/12/10 16:07 Program Version: Version 1.3.5.0 Windows Version: Windows XP SP3 ================================================== Drivers ——————- Name: dump_atapi.sys Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys Address: 0xED4C7000 Size: 98304 File Visible: No Signed: - Status: - Name: dump_WMILIB.SYS Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS Address: 0xF7A2E000 Size: 8192 File Visible: No Signed: - Status: - Name: PCI_PNP3740 Image Path: \Driver\PCI_PNP3740 Address: 0x00000000 Size: 0 File Visible: No Signed: - Status: - Name: rootrepeal[1].sys Image Path: C:\WINDOWS\system32\drivers\rootrepeal[1].sys Address: 0xB8208000 Size: 49152 File Visible: No Signed: - Status: - Name: spqh.sys Image Path: spqh.sys Address: 0xF7311000 Size: 1048576 File Visible: No Signed: - Status: - Name: sptd Image Path: \Driver\sptd Address: 0x00000000 Size: 0 File Visible: No Signed: - Status: - SSDT ——————- #: 041 Function Name: NtCreateKey Status: Hooked by "spqh.sys" at address 0xf73120e0 #: 071 Function Name: NtEnumerateKey Status: Hooked by "spqh.sys" at address 0xf7330ca2 #: 073 Function Name: NtEnumerateValueKey Status: Hooked by "spqh.sys" at address 0xf7331030 #: 119 Function Name: NtOpenKey Status: Hooked by "spqh.sys" at address 0xf73120c0 #: 160 Function Name: NtQueryKey Status: Hooked by "spqh.sys" at address 0xf7331108 #: 177 Function Name: NtQueryValueKey Status: Hooked by "spqh.sys" at address 0xf7330f88 #: 247 Function Name: NtSetValueKey Status: Hooked by "spqh.sys" at address 0xf733119a ==EOF== Thanks in advance for your help.

Attachments:

Post #2
My name is SweetTech. I would be glad to take a look at your log and help you with solving any malware problems. I'd be grateful if you would note the following:
  • Logs from malware removal programs (DDS is one of them) can take some time to analyze. I need you to be patient while I analyze any logs you post.
  • Please make sure to carefully read any instruction that I give you.
    Reading too lightly will cause you to miss important steps, which could have destructive effects.
  • If you're not sure, or if something unexpected happens, do NOT continue! Stop and ask!
  • These instructions have been specifically tailored to your computer and the issues you are experiencing with your computer. It's important to note that these instructions are not suitable for any other computer, even if the issues are fairly similar.
  • Do not do things I do not ask for, such as running a spyware scan on your computer. The one thing that you should always do, is to make sure sure that your anti-virus definitions are up-to-date!
  • If I instruct you to download a specific tool in which you already have, please delete the copy that you have and re-download the tool. The reason I ask you to do this is because these tools are updated fairly regularly.
  • I am going to stick with you until ALL malware is gone from your system. I would appreciate it if you would do the same. From this point, we're in this together ;)
    Because of this, you must reply within five days    . I will post a reminder should you seem to fail to do this, however, if you fail to reply within five days then,
    unless I have been notified of your absence in advance, the topic shall be closed!
  • Lastly, I am no magician. I will try very hard to fix your issues, but no promises can be made. Also be aware that some infections are so severe that you might need to resort to reformatting and reinstalling your operating system.
    Don't worry, this only happens in severe cases, but it sadly does happen. Be prepared to back up your data. Have means of backing up your data available.
Please be advised, as I am still in training, all my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advise.
This may cause a delay, but I will do my best to keep it as short as possible.

I am checking over your log, I will post back shortly with instructions.
Post #3
Running ComboFix
Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
  • Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

  • Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.


Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

Please make sure you include the following items in your next post:
1. The log that was produced after running ComboFix.
2. An update on how your computer is currently running.

It would be helpful if you could answer each question in the order asked, as well as numbering your answers.
Post #4
Here is the ComboFix log:

ComboFix 09-12-09.04 - Owner 12/10/2009 17:46:28.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1022.629 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Owner\Application Data\GetModule
c:\documents and settings\Owner\Local Settings\Temporary Internet Files\fbk.sts
c:\program files\Common
c:\program files\Common\_helper.sig
c:\program files\Common\helper.sig
c:\recycler\S-1-5-21-718822288-990962878-2277209058-1003
c:\windows\system32\_000008_.tmp.dll
c:\windows\system32\18467.exe
c:\windows\system32\19169.exe
c:\windows\system32\26500.exe
c:\windows\system32\41.exe
c:\windows\system32\6334.exe
c:\windows\system32\critical_warning.html
c:\windows\system32\winhelper86.dll
c:\windows\wiaserviv.log
c:\windows\wiaservv.log
D:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2009-11-10 to 2009-12-10 )))))))))))))))))))))))))))))))
.

2009-12-10 21:58 . 2009-12-10 21:59 ——– d—–w- c:\program files\ERUNT
2009-12-10 17:52 . 2009-12-10 17:52 ——– d—–w- C:\$AVG
2009-12-10 17:51 . 2009-12-10 17:51 12464 —-a-w- c:\windows\system32\avgrsstx.dll
2009-12-10 17:51 . 2009-12-10 17:51 360584 —-a-w- c:\windows\system32\drivers\avgtdix.sys
2009-12-10 17:51 . 2009-12-10 17:51 333192 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2009-12-10 17:51 . 2009-12-10 17:51 28424 —-a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-12-10 17:51 . 2009-12-10 17:51 ——– d—–w- c:\windows\system32\drivers\Avg
2009-12-10 17:50 . 2009-12-10 17:51 ——– d—–w- c:\documents and settings\All Users\Application Data\avg9
2009-11-24 01:14 . 2009-11-24 01:14 ——– d—–w- c:\documents and settings\Owner\Application Data\Move Networks
2009-11-12 16:54 . 2009-11-12 16:54 ——– d—–w- c:\documents and settings\Owner\.netbeans-derby
2009-11-12 16:52 . 2009-11-12 16:53 ——– d—–w- c:\documents and settings\Owner\.netbeans
2009-11-12 16:52 . 2009-11-12 16:52 ——– d—–w- c:\documents and settings\Owner\.netbeans-registration
2009-11-12 16:45 . 2009-11-12 16:52 ——– d—–w- c:\program files\NetBeans 6.7.1
2009-11-12 16:43 . 2009-11-12 16:52 ——– d—–w- c:\documents and settings\Owner\.nbi

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-10 17:51 . 2009-02-09 17:00 ——– d—–w- c:\program files\AVG
2009-12-10 07:29 . 2008-11-14 00:57 ——– d—–w- c:\program files\Spybot - Search & Destroy
2009-12-09 01:06 . 2008-08-09 16:52 ——– d—–w- c:\program files\Google
2009-12-04 00:58 . 2008-08-10 18:20 ——– d—–w- c:\documents and settings\Owner\Application Data\U3
2009-11-23 03:04 . 2009-01-14 20:49 ——– d—–w- c:\program files\Quicken
2009-11-05 09:18 . 2008-09-06 05:21 ——– d—–w- c:\program files\Microsoft Silverlight
2009-10-29 07:45 . 2005-03-23 16:53 916480 —-a-w- c:\windows\system32\wininet.dll
2009-10-24 15:40 . 2009-10-23 18:12 ——– d—–w- c:\program files\a-squared Free
2009-10-22 22:25 . 2009-10-22 22:23 ——– d—–w- c:\documents and settings\All Users\Application Data\SecTaskMan
2009-10-22 22:23 . 2009-10-22 22:23 ——– d—–w- c:\program files\Security Task Manager
2009-10-21 05:38 . 2005-03-23 16:52 75776 —-a-w- c:\windows\system32\strmfilt.dll
2009-10-21 05:38 . 2005-03-23 16:52 25088 —-a-w- c:\windows\system32\httpapi.dll
2009-10-20 16:20 . 2004-08-04 06:00 265728 —-a-w- c:\windows\system32\drivers\http.sys
2009-10-13 10:30 . 2005-03-23 16:52 270336 —-a-w- c:\windows\system32\oakley.dll
2009-10-12 13:38 . 2005-03-23 16:52 149504 —-a-w- c:\windows\system32\rastls.dll
2009-10-12 13:38 . 2005-03-23 16:52 79872 —-a-w- c:\windows\system32\raschap.dll
.

——- Sigcheck ——-

[-] 2004-08-11 16:45 . A477391B7A8B0A0DAABADB17CF533A4B . 25088 . . [10.0.3790.3646] . . c:\windows\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}\MsPMSNSv.dll
[-] 2004-08-11 16:45 . A477391B7A8B0A0DAABADB17CF533A4B . 25088 . . [10.0.3790.3646] . . c:\windows\system32\MsPMSNSv.dll
[-] 2004-08-04 19:00 . C086483E3DBA8C1C0A687EC8D5B3D4C1 . 52224 . . [9.0.1.56] . . c:\windows\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}$BACKUP$\System\MsPMSNSv.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"="c:\progra~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE -quiet" [X]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-05-19 39408]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe -atboottime" [X]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2004-11-05 98394]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2004-11-05 688218]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-04-15 344064]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-14 212992]
"SunKist"="c:\program files\Digital Media Reader\shwicon2k.exe" [2004-05-27 139264]
"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2009-12-10 2020120]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-12-10 17:51 12464 —-a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^BigFix.lnk]
backup=c:\windows\pss\BigFix.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Quicken Scheduled Updates.lnk]
backup=c:\windows\pss\Quicken Scheduled Updates.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^Yahoo! Widgets.lnk]
backup=c:\windows\pss\Yahoo! Widgets.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe -onlytray [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
c:\program files\QuickTime\qttask.exe -atboottime [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
c:\program files\Steam\Steam.exe -silent [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe]
c:\program files\TomTom HOME 2\HOMERunner.exe -s [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
2008-07-23 01:42 116040 —-a-w- c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 ——w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]
2003-10-24 00:51 233472 —-a-w- c:\program files\HP\hpcoretech\hpcmpmgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2003-06-25 16:24 49152 —-a-w- c:\program files\Hewlett-Packard\HP Software Update\hpwuSchd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
2005-07-23 02:33 176128 —-a-w- c:\windows\system32\spool\drivers\w32x86\3\hpztsb09.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2008-07-30 15:47 289064 —-a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 —-a-w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 18:50 155648 —-a-w- c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
2004-11-03 03:24 32768 —-a-w- c:\program files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-03-09 10:19 148888 —-a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YMailAdvisor]
2008-06-05 22:06 125208 —-a-w- c:\program files\Yahoo!\Common\YMailAdvisor.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\AIM\\aim.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\SopCast\\SopCast.exe"=
"c:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [4/4/2009 1:50 PM 717296]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [12/10/2009 11:51 AM 333192]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [12/10/2009 11:51 AM 360584]
R2 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [12/10/2009 11:51 AM 906520]
R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [12/10/2009 11:51 AM 285392]
R2 Viewpoint Service;Viewpoint Service;c:\program files\Viewpoint\Common\ViewpointService.exe [1/15/2009 11:55 PM 30152]
R3 HSFHWATI;HSFHWATI;c:\windows\system32\drivers\HSFHWATI.sys [8/9/2008 9:19 AM 200192]
S2 gupdate1c9d821288668ec;Google Update Service (gupdate1c9d821288668ec);c:\program files\Google\Update\GoogleUpdate.exe [5/18/2009 7:28 PM 133104]
S2 mrtRate;mrtRate; [x]
S3 AMDMSRIO;AMDMSRIO;\??\c:\docume~1\Owner\LOCALS~1\Temp\Safe To Delete 3_0_4_8\AMDMSRIO.sys –> c:\docume~1\Owner\LOCALS~1\Temp\Safe To Delete 3_0_4_8\AMDMSRIO.sys [?]
S3 ICDUSB2;Sony IC Recorder (P);c:\windows\system32\drivers\IcdUsb2.sys [10/20/2008 4:09 PM 39048]
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.yahoo.com/
uInternet Connection Wizard,ShellNext = hxxp://www.gateway.com/
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\zrllhoen.default\
FF - component: c:\program files\Nokia\Nokia PC Suite 7\bkmrksync\components\BkMrkExt.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1591.6512\npCIDetect13.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npyaxmpb.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint_.dll
.
- - - - ORPHANS REMOVED - - - -

BHO-{0EB5F347-BE12-4B07-9616-1F4993E846A1} - c:\windows\system32\yaywVLBQ.dll
BHO-{91D0DBE7-D7C9-40DF-849D-BED5FA864A6A} - c:\windows\system32\qoMggGVo.dll
HKCU-Run-AIM - c:\program files\AIM\aim.exe -cnetwait.odl
HKCU-Run-Internet Security 2010 - c:\program files\InternetSecurity2010\IS2010.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-10 17:56
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys sppj.sys >>UNKNOWN [0x86F88938]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf75d6f28
\Driver\ACPI -> ACPI.sys @ 0xf72d1cb8
\Driver\atapi -> atapi.sys @ 0xf726eb40
IoDeviceObjectType -> ParseProcedure -> ntkrnlpa.exe @ 0x80577c84
\Device\Harddisk0\DR0 -> ParseProcedure -> ntkrnlpa.exe @ 0x80577c84
NDIS: Broadcom 802.11g Network Adapter -> SendCompleteHandler -> NDIS.sys @ 0xf7132bb0
PacketIndicateHandler -> NDIS.sys @ 0xf713fa21
SendHandler -> NDIS.sys @ 0xf711d87b
user & kernel MBR OK

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-295320125-4248868747-4094414448-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{BA8E038E-46D1-7E6C-EE59-06FBE5112C01}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(696)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(3060)
c:\windows\system32\WININET.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\mshtml.dll
c:\windows\system32\msls31.dll
c:\windows\system32\webcheck.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\Ati2evxx.exe
c:\program files\AVG\AVG9\avgchsvx.exe
c:\program files\AVG\AVG9\avgrsx.exe
c:\program files\AVG\AVG9\avgcsrvx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Google\Update\1.2.183.13\GoogleCrashHandler.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
c:\windows\system32\wdfmgr.exe
c:\program files\AVG\AVG9\avgcsrvx.exe
c:\windows\system32\wscntfy.exe
c:\program files\QuickTime\qttask.exe
c:\program files\AIM\aim.exe
c:\progra~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
c:\program files\Viewpoint\Viewpoint Manager\ViewMgr.exe
.
**************************************************************************
.
Completion time: 2009-12-10 18:06:06 - machine was rebooted
ComboFix-quarantined-files.txt 2009-12-11 00:06

Pre-Run: 12,589,486,080 bytes free
Post-Run: 13,782,544,384 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - DE95DEA982F9F3E6D8BCDC6DCE10C5DE


Everything seems to be back to normal. The desktop wallpaper went back to normal and the websites that weren't loading before are loading now.

Thank you so much for your help and for getting back to me so quickly!!
Post #5
Please download DeFogger to your desktop.

Double click DeFogger to run the tool.
  • The application window will appear
  • Click the Disable button to disable your CD Emulation drivers
  • Click Yes to continue
  • A 'Finished!' message will appear
  • Click OK
  • DeFogger will now ask to reboot the machine - click OK
IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_disable which will appear on your desktop.

Do not re-enable these drivers until otherwise instructed.

Scanning with GMER
[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.
  • Extract the contents of the zipped file to desktop.
  • Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • Sections
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and attach it in your reply.
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

Please make sure you include the following items in your next post:
1. The log that was produced after running the GMER Scan.
2. An update on how your computer is currently running.

It would be helpful if you could answer each question in the order asked, as well as numbering your answers.
Post #6
Here is the GMER scan:

GMER 1.0.15.15273 - http://www.gmer.net
Rootkit scan 2009-12-11 09:23:32
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\Owner\LOCALS~1\Temp\axtdypow.sys


—- Devices - GMER 1.0.15 —-

AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

—- Registry - GMER 1.0.15 —-

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xF3 0x22 0x6E 0x0F …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x51 0x9C 0x0E 0x83 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xFE 0xBF 0x74 0x15 …
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xF3 0x22 0x6E 0x0F …
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x51 0x9C 0x0E 0x83 …
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xFE 0xBF 0x74 0x15 …
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{BA8E038E-46D1-7E6C-EE59-06FBE5112C01}

—- EOF - GMER 1.0.15 —-


My computer is running the same since the last reply.
Post #7
To re-enable your Emulation drivers, double click DeFogger to run the tool.
  • The application window will appear
  • Click the Re-enable button to re-enable your CD Emulation drivers
  • Click Yes to continue
  • A 'Finished!' message will appear
  • Click OK
  • DeFogger will now ask to reboot the machine - click OK
IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_enable which will appear on your desktop.

Your Emulation drivers are now re-enabled.

Malwarebytes' Anti-Malware

I see that you have Malwarebytes' Anti-Malware installed on your computer could you please do a scan using these settings:

  • Open Malwarebytes' Anti-Malware
  • Select the Update tab
  • Click Check for Updates
  • After the update have been completed, Select the Scanner tab.
  • Select Perform quick scan, then click on Scan
  • Leave the default options as it is and click on Start Scan
  • When done, you will be prompted. Click OK, then click on Show Results
  • Checked (ticked) all items and click on Remove Selected
  • After it has removed the items, Notepad will open. Please post this log in your next reply. You can also find the log in the Logs tab. The bottom most log is the latest
Extra Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

Kaspersky Online Scanner
I'd like for you to run this next online scan to check for remnants or anything that might be hidden.
The below scan can take up to an hour or longer, please be patient.

Note:
It is recommended to disable on board Anti-Virus program and Anti-Spyware programs while performing scans so no conflicts and to speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once scan is finished remember to re-enable resident Anti-Virus protection along with whatever Anti-Spyware app you use.


Please do a scan with Kaspersky Online Scanner or from Here.
  • Click on the Accept button and install any components it needs.
  • The program will install and then begin downloading the latest definition files.
  • After the files have been downloaded on the left side of the page in the Scan section select My Computer.
  • This will start the program and scan your system.
  • The scan will take a while, so be patient and let it run. (At times it may appear to stall)
  • Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
    • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
    • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Once the scan is complete, click on View scan report To obtain the report:
  • Click on: Save Report As
  • Next, in the Save as prompt, Save in area, select: Desktop
  • In the File name area, use KScan, or something similar In Save as type, click the drop arrow and select: Text file [*.txt]
  • Then, click: Save
  • Please post the Kaspersky Online Scanner Report in your reply.

Please make sure you include the following items in your next post:
1. The log that was produced after running MalwareBytes' Anti-Malware.
2. The log that was produced after running the Kaspersky Online Scan.
3. Any outstanding issues that you are experiencing with your computer (if any).

It would be helpful if you could answer each question in the order asked, as well as numbering your answers.
Post #8
Please visit this link.
  • Under "Select Download" choose Windows Media Player.
  • Under "Select Version" choose Player 11 (for Windows XP).
  • Under "Select Language" choose The language that applies to you.
  • Click the Download Now button which should be towards the bottom of the page.
  • You should be presented with a Save File box. Click on Save File
  • After it has finished downloading to your computer, go to the location you downloaded the file to and Double-Click the file and run the installation for your computer.
Post #9
The Malwarebytes scan: Malwarebytes' Anti-Malware 1.42 Database version: 3345 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 12/11/2009 11:31:09 AM mbam-log-2009-12-11 (11-31-09).txt Scan type: Quick Scan Objects scanned: 105607 Time elapsed: 7 minute(s), 6 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) The Kaspersky scan: ——————————————————————————– KASPERSKY ONLINE SCANNER 7.0: scan report Friday, December 11, 2009 Operating system: Microsoft Windows XP Home Edition Service Pack 3 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Last database update: Friday, December 11, 2009 17:33:49 Records in database: 3358932 ——————————————————————————– Scan settings: scan using the following database: extended Scan archives: yes Scan e-mail databases: yes Scan area - My Computer: C:\ D:\ E:\ G:\ Scan statistics: Objects scanned: 122851 Threats found: 2 Infected objects found: 2 Suspicious objects found: 0 Scan duration: 03:50:38 File name / Threat / Threats count C:\Qoobox\Quarantine\C\WINDOWS\system32\critical_warning.html.vir Infected: Trojan.JS.Hoax.b 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\winhelper86.dll.vir Infected: Trojan-Ransom.Win32.Agent.il 1 Selected area has been scanned. Computer is running the same, except earlier during the Kaspersky scan it turned itself off for some reason. Other than that one time it's been fine.
Post #10
You are doing great :thumbup:

Did you upgrade your Windows Media Player as instructed in this post.

SystemLook
  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:
    :filefind
*MsPMSNSv*
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt

Update Adobe Reader
Earlier versions of Adobe Reader have known security flaws so it is recommended that you update your copy
  • Go to Start > Control Panel > Add/Remove Programs
  • Remove ALL instances of Adobe Reader
  • Re-boot your computer as required.
  • Once ALL versions of Adobe Reader have been uninstalled, visit: <> and download the latest version of Adobe Reader
Alternative Option: after uninstalling Adobe Reader, you could try installing Foxit Reader from >here< Foxit Reader has fewer add-ons therefore loads more quickly.

Java Outdated
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version Java components and update.

  • Download the latest version of Java Runtime Environment (JRE) 6 and save it to your desktop.
  • Scroll down to where it says "Java SE Runtime Environment (JRE) 6 Update 17. The Java SE Runtime Environment (JRE) allows end-users to run Java applications."
  • Click the "Download" button to the right.
  • Select the Windows platform from the drop-down menu.
  • Read the License Agreement and then check the box that says: " I agree to the Java SE Runtime Environment 6 with JavaFX License Agreement". Click on Continue.The page will refresh.
  • Click on the link to download Windows Offline Installation and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Now go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java™ 6) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java version.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u17-windows-i586-p.exe to install the newest version.
  • After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
    • On the General tab, under Temporary Internet Files, click the Settings button.
    • Next, click on the Delete Files button
    • There are two options in the window to clear the cache - Leave BOTH CheckedApplications and AppletsTrace and Log Files
  • Click OK on Delete Temporary Files Window

    Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
  • Click OK to leave the Temporary Files Window
  • Click OK to leave the Java Control Panel.
Please make sure you include the following items in your next post:
1. The log that was produced after running SystemLook.

It would be helpful if you could answer each question in the order asked, as well as numbering your answers.
Post #12 last edited
I'm sorry. I was under the impression that I had already asked you to download SystemLook to your computer but I see that wasn't the case. Please visit this link here to download SystemLook to your computer.
Post #13
The SystemLook scan: SystemLook v1.0 by jpshortstuff (29.08.09) Log created at 13:06 on 13/12/2009 by Owner (Administrator - Elevation successful) ========== filefind ========== Searching for "*MsPMSNSv*" C:\WINDOWS\$NtUninstallWMFDist11$\mspmsnsv.dll —–c 25088 bytes [07:50 12/12/2009] [16:45 11/08/2004] A477391B7A8B0A0DAABADB17CF533A4B C:\WINDOWS\I386\MSPMSNSV.DL_ —— 24963 bytes [16:51 23/03/2005] [19:00 04/08/2004] 27BFF15DBD5FC22CCE60D1993D9A85D7 C:\WINDOWS\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}$BACKUP$\System\MsPMSNSv.dll –a— 52224 bytes [18:19 23/03/2005] [19:00 04/08/2004] C086483E3DBA8C1C0A687EC8D5B3D4C1 C:\WINDOWS\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}\MsPMSNSv.dll –a— 25088 bytes [18:19 23/03/2005] [16:45 11/08/2004] A477391B7A8B0A0DAABADB17CF533A4B C:\WINDOWS\system32\mspmsnsv.dll –a— 27136 bytes [16:53 23/03/2005] [03:47 19/10/2006] C51B4A5C05A5475708E3C81C7765B71D -=End Of File=- I updated WMP and Java, but I couldn't update Adobe. Every time I tried to open the link IE froze; I think it was taking up too much memory.
Post #14
Update Firefox
Open up Firefox > Go to Help > Click Check For Updates.

You are using Firefox 3.0.11 and the latest version of Firefox is 3.5.5.

Update Adobe
After you've updated Firefox go ahead and visit this link to update Adobe. Make sure you uninstall all previous version of Adobe before installing the latest.

Time for some housekeeping
The following will implement some cleanup procedures as well as reset System Restore points:
[external image: Posted Image]
Click Start > Run and copy/paste the following bolded text into the Run box and click OK: ComboFix /Uninstall

Now to remove most of the tools that we have used in fixing your machine:
  • Make sure you have an Internet Connection.
  • Download OTC to your desktop and run it
  • A list of tool components used in the cleanup of malware will be downloaded.
  • If your Firewall or Real Time protection attempts to block OTC to reach the Internet, please allow the application to do so.
  • Click Yes to begin the cleanup process and remove these components, including this application.
  • You will be asked to reboot the machine to finish the cleanup process. If you are asked to reboot the machine choose Yes.
All Clean Speech

===> Make sure you've re-enabled any Security Programs that we may have disabled during the malware removal process. <===

Below I have included a number of recommendations for how to protect your computer against malware infections.
  • It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
    Strong passwords: How to create and use them     then consider a password keeper, to keep all your passwords safe.
  • Keep Windows updated by regularly checking their website at: http://windowsupdate.microsoft.com/
    This will ensure your computer has always the latest security updates available installed on your computer.
  • SpywareBlaster protects against bad ActiveX, it immunizes your PC against them.
  • SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program ( eg : TeaTimer, Windows Defender ) or there will be a conflict.
  • Make Internet Explorer more secure
    • Click Start > Run
    • Type Inetcpl.cpl & click OK
    • Click on the Security tab
    • Click Reset all zones to default level
    • Make sure the Internet Zone is selected & Click Custom level
    • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
    • Next Click OK, then Apply button and then OK to exit the Internet Properties page.
  • ATF Cleaner - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.
  • MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.
  • WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
    • Green to go
    • Yellow for caution
    • Red to stop
    WOT has an addon available for both Firefox and IE
  • You are already using an alternative browser. More specifically Mozilla's Firefox. It is a fantastic browser that is much more secure than Internet Explorer. It is practically immune to all known browser hijackers.
    • I highly recommend this add-on to keep your PC even more secure.
      • NoScript - for blocking ads and other potential website attacks
  • Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
  • ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
  • In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles:
    Think Prevention.
    PC Safety and Security–What Do I Need?.
**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.

Thank you for your patience, and performing all of the procedures requested.

Please respond one last time so we can consider the thread resolved and close it, thank-you.
Post #15
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI