LDTate
Can you check to see if those files are gone now?
Spyware / Malware / Virus Removal
[Resolved] vundo and p hacker (i think)
12 min read
mad.house
was supposed to remove them? you only said to post the results. Am i supposed o run the scan, remove them and then run again? the other thng hat keeps happening is that since doing these clean ups when i load the comp andstopzila launches, several new objects are appearing at start up. These are called SYSTEM POLICIES DISABLE REGISTRY TOOLS (type - hijacker) and CATCHME (type - registry). are these new? or are they something to do with the scans you are asking me todo?
thanks
LDTate
I was asking if the scan removed them as I don't know if it does or not. When you did the scan did it give you the option to remove them?
Are these sill there?
C:\Documents and Settings\HP_Owner\My Documents\Nikki\limewire\beautifull eminem.wma
C:\Documents and Settings\HP_Owner\My Documents\Nikki\limewire\black eyed peasi got a feeling(1).wma
C:\Documents and Settings\HP_Owner\My Documents\Nikki\limewire\black eyed peasi got a feeling.wma
C:\Documents and Settings\HP_Owner\My Documents\Nikki\limewire\la roux bullet proof.wma
C:\Documents and Settings\HP_Owner\My Documents\Nikki\limewire\waffles pankakes french toast rare record.wma
C:\Documents and Settings\HP_Owner\My Documents\Nikki\limewire\waffles pankakes french toast.wma
C:\Documents and Settings\Joshua Allcock\My Documents\My Music\la roux bullet proof.wma
C:\Program Files\Online Services\BTYahoo\HPPre05.msi
CATCHME is part of combofix but combofix doesn't disable registry tools
mad.house
the documents are still there on my computer, i cant remember if the scan gave mean option to delete them as i hadnt instruction to and scard of doing somethng i shouldnt
LDTate
Copy/paste the text in the Codebox below into notepad:
Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:
Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text.
Save this file to your desktop, Save this as "CFScript"
Here's how to do that:
1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …
[external image: Posted Image]
Drag CFScript.txt into ComboFix.exe
Then post the results log and a new HijackThis log.
Also please describe how your computer behaves at the moment.
Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:
Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text.
File:: C:\Documents and Settings\HP_Owner\My Documents\Nikki\limewire\beautifull eminem.wma C:\Documents and Settings\HP_Owner\My Documents\Nikki\limewire\black eyed peasi got a feeling(1).wma C:\Documents and Settings\HP_Owner\My Documents\Nikki\limewire\black eyed peasi got a feeling.wma C:\Documents and Settings\HP_Owner\My Documents\Nikki\limewire\la roux bullet proof.wma C:\Documents and Settings\HP_Owner\My Documents\Nikki\limewire\waffles pankakes french toast rare record.wma C:\Documents and Settings\HP_Owner\My Documents\Nikki\limewire\waffles pankakes french toast.wma C:\Documents and Settings\Joshua Allcock\My Documents\My Music\la roux bullet proof.wma C:\Program Files\Online Services\BTYahoo\HPPre05.msi
Save this file to your desktop, Save this as "CFScript"
Here's how to do that:
1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …
[external image: Posted Image]
Drag CFScript.txt into ComboFix.exe
Then post the results log and a new HijackThis log.
Also please describe how your computer behaves at the moment.
mad.house
Here is the combofix log. I do not know what a hijack this log is i dont think you have given me a link for it yet so link me and ill do it. The computer is running ok once up and running. When i first switch on it is not powering the monitor. The monitor will turn on but then will say 'rgb no input' or display a scrambled screen or nothing at all. To get it on i either have to keep switching on and off by the monitor switch until i get lucky with a screen, or keep switching off and on at the plug if the monitor cant be turned off on the monitor switch. The dvd drive is choosing when it wants to respond. will play some discs but not others. This becomes a problem when im trying to install new things like my new internet router - this came with a disc that did not work, so tried another one which also did not get recognised. this also happens with music cds, recognising some but not others. Since these scans have been done my internet connection seems to have changed. Although now i have looked it up to tell you about it it seems to have changed again, i did have a net adapter connected all of a sudden with an ip address and 'demonware' both listed and checked and said i had been connected for 3 days - but it seems to have gone now so i suppose i shouldnt worry about it now lol.
ComboFix 10-01-23.02 - HP_Owner 23/01/2010 23:11:58.3.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.1015.538 [GMT 0:00]
Running from: c:\documents and settings\[removed]\Desktop\ABCD.exe
Command switches used :: c:\documents and settings\HP_Owner\Desktop\CFScript.txt
AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
FILE ::
"c:\documents and settings\HP_Owner\My Documents\Nikki\limewire\beautifull eminem.wma"
"c:\documents and settings\HP_Owner\My Documents\Nikki\limewire\black eyed peasi got a feeling(1).wma"
"c:\documents and settings\HP_Owner\My Documents\Nikki\limewire\black eyed peasi got a feeling.wma"
"c:\documents and settings\HP_Owner\My Documents\Nikki\limewire\la roux bullet proof.wma"
"c:\documents and settings\HP_Owner\My Documents\Nikki\limewire\waffles pankakes french toast rare record.wma"
"c:\documents and settings\HP_Owner\My Documents\Nikki\limewire\waffles pankakes french toast.wma"
"c:\documents and settings\Joshua Allcock\My Documents\My Music\la roux bullet proof.wma"
"c:\program files\Online Services\BTYahoo\HPPre05.msi"
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\HP_Owner\My Documents\Nikki\limewire\beautifull eminem.wma
c:\documents and settings\HP_Owner\My Documents\Nikki\limewire\black eyed peasi got a feeling(1).wma
c:\documents and settings\HP_Owner\My Documents\Nikki\limewire\black eyed peasi got a feeling.wma
c:\documents and settings\HP_Owner\My Documents\Nikki\limewire\la roux bullet proof.wma
c:\documents and settings\HP_Owner\My Documents\Nikki\limewire\waffles pankakes french toast rare record.wma
c:\documents and settings\HP_Owner\My Documents\Nikki\limewire\waffles pankakes french toast.wma
c:\documents and settings\Joshua Allcock\My Documents\My Music\la roux bullet proof.wma
c:\program files\Online Services\BTYahoo\HPPre05.msi
.
((((((((((((((((((((((((( Files Created from 2009-12-23 to 2010-01-23 )))))))))))))))))))))))))))))))
.
2010-01-17 20:02 . 2010-01-17 20:02 ——– d—–w- c:\documents and settings\HP_Owner\Application Data\Malwarebytes
2010-01-17 20:01 . 2010-01-17 20:01 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-01-17 20:01 . 2010-01-18 15:28 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-01-13 18:26 . 2010-01-13 18:26 ——– d—–w- c:\documents and settings\Kyle Allcock\Application Data\HPQ
2010-01-13 18:22 . 2009-11-21 15:51 471552 ——w- c:\windows\system32\dllcache\aclayers.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-23 22:56 . 2007-10-24 09:51 ——– d—–w- c:\documents and settings\All Users\Application Data\STOPzilla!
2010-01-23 21:34 . 2010-01-23 21:33 560 —-a-w- c:\windows\system32\drivers\kgpcpy.cfg
2010-01-22 21:12 . 2006-08-07 22:14 12 —-a-w- c:\windows\bthservsdp.dat
2010-01-21 17:16 . 2009-11-07 21:17 ——– d—–w- c:\program files\Microsoft Silverlight
2010-01-19 16:29 . 2009-10-21 15:02 ——– d—–w- c:\documents and settings\HP_Owner\Application Data\HpUpdate
2010-01-17 19:44 . 2006-05-16 19:54 61120 —-a-w- c:\documents and settings\HP_Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-01-06 20:50 . 2009-04-14 20:50 ——– d—–w- c:\program files\McAfee
2010-01-05 20:36 . 2009-04-15 22:24 ——– d—–w- c:\documents and settings\LocalService\Application Data\SACore
2010-01-05 10:00 . 2004-08-04 11:00 832512 ——w- c:\windows\system32\wininet.dll
2010-01-05 10:00 . 2004-08-04 12:00 78336 —-a-w- c:\windows\system32\ieencode.dll
2010-01-05 10:00 . 2004-08-04 12:00 17408 —-a-w- c:\windows\system32\corpol.dll
2009-12-24 11:04 . 2008-07-05 08:40 39 —-a-w- c:\documents and settings\Joshua Allcock\jagex_runescape_preferences.dat
2009-12-24 10:59 . 2009-09-02 17:48 69 —-a-w- c:\documents and settings\Joshua Allcock\jagex_runescape_preferences2.dat
2009-12-20 16:15 . 2009-12-20 16:14 ——– d—–w- c:\documents and settings\Kyle Allcock\Application Data\HpUpdate
2009-12-12 16:47 . 2009-05-30 16:53 280 —-a-w- c:\documents and settings\Kyle Allcock\Application Data\wklnhst.dat
2009-12-09 23:46 . 2007-03-04 20:13 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-12-09 19:54 . 2006-07-29 15:40 61120 —-a-w- c:\documents and settings\Joshua Allcock\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-08 20:40 . 2006-05-16 19:54 36624 —-a-w- c:\documents and settings\HP_Owner\Application Data\wklnhst.dat
2009-12-06 17:26 . 2009-04-26 12:08 ——– d—–w- c:\documents and settings\Kyle Allcock\Application Data\FaxCtr
2009-12-03 18:10 . 2009-12-03 17:47 360 —-a-w- c:\documents and settings\Lewis Allcock\Application Data\wklnhst.dat
2009-12-02 18:17 . 2009-12-02 18:17 61120 —-a-w- c:\documents and settings\Kyle Allcock\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-21 15:51 . 2004-08-04 12:00 471552 —-a-w- c:\windows\AppPatch\aclayers.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-08 61952]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-06-08 94208]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-06-08 77824]
"Persistence"="c:\windows\system32\igfxpers.exe" [2005-06-08 114688]
"SoundMan"="SOUNDMAN.EXE" [2005-05-04 90112]
"AlcWzrd"="ALCWZRD.EXE" [2005-05-04 2805248]
"HPHUPD08"="c:\program files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe" [2005-06-02 49152]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2004-04-14 233472]
"Reminder"="c:\windows\Creator\Remind_XP.exe" [2004-12-14 663552]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576]
"LXBUCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\LXBUtime.dll" [2004-11-02 69632]
"lxbumon.exe"="c:\program files\Lexmark 6200 Series\lxbumon.exe" [2005-01-18 196608]
"FaxCenterServer"="c:\program files\Lexmark Fax Solutions\fm3032.exe" [2004-11-22 299008]
"EzPrint"="c:\program files\Lexmark 6200 Series\ezprint.exe" [2004-09-17 61440]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2006-06-14 278528]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-07-19 282624]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]
"KBD"="c:\hp\KBD\KBD.EXE" [2005-02-02 61440]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"snpstd3"="c:\windows\vsnpstd3.exe" [2005-01-14 339968]
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 159744]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-10-29 1218008]
"McENUI"="c:\progra~1\McAfee\MHN\McENUI.exe" [2009-07-07 1176808]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-10-05 198160]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"PcSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-11-09 1634304]
c:\documents and settings\Joshua Allcock\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2008-10-25 98696]
c:\documents and settings\HP_Owner\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2008-10-25 98696]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
camtool.lnk - c:\program files\camtool\VideoMonitor\CamTool.exe [2007-9-30 94208]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-12 282624]
Sonic CinePlayer Quick Launch.lnk - c:\program files\Common Files\Sonic Shared\CineTray.exe [2005-8-11 114688]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"c:\\Program Files\\Advanced Registry Optimizer\\ARO.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
R0 szkg5;szkg5;c:\windows\system32\drivers\SZKG.sys [12/05/2009 13:13 61328]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [07/11/2009 21:16 54752]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [15/04/2009 20:54 93320]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [09/04/2008 11:00 24652]
R3 PortDRv;PST Port I/O Driver;c:\windows\system32\drivers\PortDRv.sys [21/01/2007 21:40 7168]
R3 SRBoxDRv;PST Serial Response Box Driver;c:\windows\system32\drivers\SRBoxDRv.sys [21/01/2007 21:40 14848]
S3 fsssvc;Windows Live Family Safety Service;c:\program files\Windows Live\Family Safety\fsssvc.exe [05/08/2009 22:48 704864]
— Other Services/Drivers In Memory —
*NewlyCreated* - MBACKMONITOR
.
Contents of the 'Scheduled Tasks' folder
2010-01-18 c:\windows\Tasks\Disk Cleanup.job
- c:\windows\system32\cleanmgr.exe [2004-08-04 00:12]
2009-04-14 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-04-14 11:22]
2010-01-01 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-04-14 11:22]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.facebook.com/home.php
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
LSP: c:\program files\Common Files\iS3\Anti-Spyware\iS3lsp.dll
DPF: CabBuilder - hxxp://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-23 23:16
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes …
scanning hidden autostart entries …
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
LXBUCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\LXBUtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
- - - - - - - > 'lsass.exe'(760)
c:\program files\Common Files\iS3\Anti-Spyware\iS3lsp.dll
.
Completion time: 2010-01-23 23:18:38
ComboFix-quarantined-files.txt 2010-01-23 23:18
ComboFix2.txt 2010-01-23 23:07
ComboFix3.txt 2010-01-21 17:40
Pre-Run: 145,767,673,856 bytes free
Post-Run: 145,725,075,456 bytes free
- - End Of File - - 1D70A247CA61F07555EBC70F3782691E
ComboFix 10-01-23.02 - HP_Owner 23/01/2010 23:11:58.3.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.1015.538 [GMT 0:00]
Running from: c:\documents and settings\[removed]\Desktop\ABCD.exe
Command switches used :: c:\documents and settings\HP_Owner\Desktop\CFScript.txt
AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
FILE ::
"c:\documents and settings\HP_Owner\My Documents\Nikki\limewire\beautifull eminem.wma"
"c:\documents and settings\HP_Owner\My Documents\Nikki\limewire\black eyed peasi got a feeling(1).wma"
"c:\documents and settings\HP_Owner\My Documents\Nikki\limewire\black eyed peasi got a feeling.wma"
"c:\documents and settings\HP_Owner\My Documents\Nikki\limewire\la roux bullet proof.wma"
"c:\documents and settings\HP_Owner\My Documents\Nikki\limewire\waffles pankakes french toast rare record.wma"
"c:\documents and settings\HP_Owner\My Documents\Nikki\limewire\waffles pankakes french toast.wma"
"c:\documents and settings\Joshua Allcock\My Documents\My Music\la roux bullet proof.wma"
"c:\program files\Online Services\BTYahoo\HPPre05.msi"
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\HP_Owner\My Documents\Nikki\limewire\beautifull eminem.wma
c:\documents and settings\HP_Owner\My Documents\Nikki\limewire\black eyed peasi got a feeling(1).wma
c:\documents and settings\HP_Owner\My Documents\Nikki\limewire\black eyed peasi got a feeling.wma
c:\documents and settings\HP_Owner\My Documents\Nikki\limewire\la roux bullet proof.wma
c:\documents and settings\HP_Owner\My Documents\Nikki\limewire\waffles pankakes french toast rare record.wma
c:\documents and settings\HP_Owner\My Documents\Nikki\limewire\waffles pankakes french toast.wma
c:\documents and settings\Joshua Allcock\My Documents\My Music\la roux bullet proof.wma
c:\program files\Online Services\BTYahoo\HPPre05.msi
.
((((((((((((((((((((((((( Files Created from 2009-12-23 to 2010-01-23 )))))))))))))))))))))))))))))))
.
2010-01-17 20:02 . 2010-01-17 20:02 ——– d—–w- c:\documents and settings\HP_Owner\Application Data\Malwarebytes
2010-01-17 20:01 . 2010-01-17 20:01 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-01-17 20:01 . 2010-01-18 15:28 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-01-13 18:26 . 2010-01-13 18:26 ——– d—–w- c:\documents and settings\Kyle Allcock\Application Data\HPQ
2010-01-13 18:22 . 2009-11-21 15:51 471552 ——w- c:\windows\system32\dllcache\aclayers.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-23 22:56 . 2007-10-24 09:51 ——– d—–w- c:\documents and settings\All Users\Application Data\STOPzilla!
2010-01-23 21:34 . 2010-01-23 21:33 560 —-a-w- c:\windows\system32\drivers\kgpcpy.cfg
2010-01-22 21:12 . 2006-08-07 22:14 12 —-a-w- c:\windows\bthservsdp.dat
2010-01-21 17:16 . 2009-11-07 21:17 ——– d—–w- c:\program files\Microsoft Silverlight
2010-01-19 16:29 . 2009-10-21 15:02 ——– d—–w- c:\documents and settings\HP_Owner\Application Data\HpUpdate
2010-01-17 19:44 . 2006-05-16 19:54 61120 —-a-w- c:\documents and settings\HP_Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-01-06 20:50 . 2009-04-14 20:50 ——– d—–w- c:\program files\McAfee
2010-01-05 20:36 . 2009-04-15 22:24 ——– d—–w- c:\documents and settings\LocalService\Application Data\SACore
2010-01-05 10:00 . 2004-08-04 11:00 832512 ——w- c:\windows\system32\wininet.dll
2010-01-05 10:00 . 2004-08-04 12:00 78336 —-a-w- c:\windows\system32\ieencode.dll
2010-01-05 10:00 . 2004-08-04 12:00 17408 —-a-w- c:\windows\system32\corpol.dll
2009-12-24 11:04 . 2008-07-05 08:40 39 —-a-w- c:\documents and settings\Joshua Allcock\jagex_runescape_preferences.dat
2009-12-24 10:59 . 2009-09-02 17:48 69 —-a-w- c:\documents and settings\Joshua Allcock\jagex_runescape_preferences2.dat
2009-12-20 16:15 . 2009-12-20 16:14 ——– d—–w- c:\documents and settings\Kyle Allcock\Application Data\HpUpdate
2009-12-12 16:47 . 2009-05-30 16:53 280 —-a-w- c:\documents and settings\Kyle Allcock\Application Data\wklnhst.dat
2009-12-09 23:46 . 2007-03-04 20:13 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-12-09 19:54 . 2006-07-29 15:40 61120 —-a-w- c:\documents and settings\Joshua Allcock\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-08 20:40 . 2006-05-16 19:54 36624 —-a-w- c:\documents and settings\HP_Owner\Application Data\wklnhst.dat
2009-12-06 17:26 . 2009-04-26 12:08 ——– d—–w- c:\documents and settings\Kyle Allcock\Application Data\FaxCtr
2009-12-03 18:10 . 2009-12-03 17:47 360 —-a-w- c:\documents and settings\Lewis Allcock\Application Data\wklnhst.dat
2009-12-02 18:17 . 2009-12-02 18:17 61120 —-a-w- c:\documents and settings\Kyle Allcock\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-21 15:51 . 2004-08-04 12:00 471552 —-a-w- c:\windows\AppPatch\aclayers.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-08 61952]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-06-08 94208]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-06-08 77824]
"Persistence"="c:\windows\system32\igfxpers.exe" [2005-06-08 114688]
"SoundMan"="SOUNDMAN.EXE" [2005-05-04 90112]
"AlcWzrd"="ALCWZRD.EXE" [2005-05-04 2805248]
"HPHUPD08"="c:\program files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe" [2005-06-02 49152]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2004-04-14 233472]
"Reminder"="c:\windows\Creator\Remind_XP.exe" [2004-12-14 663552]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576]
"LXBUCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\LXBUtime.dll" [2004-11-02 69632]
"lxbumon.exe"="c:\program files\Lexmark 6200 Series\lxbumon.exe" [2005-01-18 196608]
"FaxCenterServer"="c:\program files\Lexmark Fax Solutions\fm3032.exe" [2004-11-22 299008]
"EzPrint"="c:\program files\Lexmark 6200 Series\ezprint.exe" [2004-09-17 61440]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2006-06-14 278528]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-07-19 282624]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]
"KBD"="c:\hp\KBD\KBD.EXE" [2005-02-02 61440]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"snpstd3"="c:\windows\vsnpstd3.exe" [2005-01-14 339968]
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 159744]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-10-29 1218008]
"McENUI"="c:\progra~1\McAfee\MHN\McENUI.exe" [2009-07-07 1176808]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-10-05 198160]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"PcSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-11-09 1634304]
c:\documents and settings\Joshua Allcock\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2008-10-25 98696]
c:\documents and settings\HP_Owner\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2008-10-25 98696]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
camtool.lnk - c:\program files\camtool\VideoMonitor\CamTool.exe [2007-9-30 94208]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-12 282624]
Sonic CinePlayer Quick Launch.lnk - c:\program files\Common Files\Sonic Shared\CineTray.exe [2005-8-11 114688]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"c:\\Program Files\\Advanced Registry Optimizer\\ARO.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
R0 szkg5;szkg5;c:\windows\system32\drivers\SZKG.sys [12/05/2009 13:13 61328]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [07/11/2009 21:16 54752]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [15/04/2009 20:54 93320]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [09/04/2008 11:00 24652]
R3 PortDRv;PST Port I/O Driver;c:\windows\system32\drivers\PortDRv.sys [21/01/2007 21:40 7168]
R3 SRBoxDRv;PST Serial Response Box Driver;c:\windows\system32\drivers\SRBoxDRv.sys [21/01/2007 21:40 14848]
S3 fsssvc;Windows Live Family Safety Service;c:\program files\Windows Live\Family Safety\fsssvc.exe [05/08/2009 22:48 704864]
— Other Services/Drivers In Memory —
*NewlyCreated* - MBACKMONITOR
.
Contents of the 'Scheduled Tasks' folder
2010-01-18 c:\windows\Tasks\Disk Cleanup.job
- c:\windows\system32\cleanmgr.exe [2004-08-04 00:12]
2009-04-14 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-04-14 11:22]
2010-01-01 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-04-14 11:22]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.facebook.com/home.php
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
LSP: c:\program files\Common Files\iS3\Anti-Spyware\iS3lsp.dll
DPF: CabBuilder - hxxp://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-23 23:16
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes …
scanning hidden autostart entries …
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
LXBUCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\LXBUtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
- - - - - - - > 'lsass.exe'(760)
c:\program files\Common Files\iS3\Anti-Spyware\iS3lsp.dll
.
Completion time: 2010-01-23 23:18:38
ComboFix-quarantined-files.txt 2010-01-23 23:18
ComboFix2.txt 2010-01-23 23:07
ComboFix3.txt 2010-01-21 17:40
Pre-Run: 145,767,673,856 bytes free
Post-Run: 145,725,075,456 bytes free
- - End Of File - - 1D70A247CA61F07555EBC70F3782691E
LDTate
Don't worry about HijackThis, I didn't have you install it.
It sounds to me that your power supply in your computer doesn't have enough power to power up everything as needed.
When you finish the below all clean post I suggest you start a new topic in our Hardware Forum and have one of the Tech Team work with you on that. I suggest you put this in your topic.
Do this now.
Good job
The following will implement some cleanup procedures as well as reset System Restore points:
Only run one Anti-Virus and Firewall program.
I would suggest you read How to Prevent Malware:
It sounds to me that your power supply in your computer doesn't have enough power to power up everything as needed.
When you finish the below all clean post I suggest you start a new topic in our Hardware Forum and have one of the Tech Team work with you on that. I suggest you put this in your topic.
The computer is running ok once up and running. When i first switch on it is not powering the monitor. The monitor will turn on but then will say 'rgb no input' or display a scrambled screen or nothing at all. To get it on i either have to keep switching on and off by the monitor switch until i get lucky with a screen, or keep switching off and on at the plug if the monitor cant be turned off on the monitor switch. The dvd drive is choosing when it wants to respond. will play some discs but not others. This becomes a problem when im trying to install new things like my new internet router - this came with a disc that did not work, so tried another one which also did not get recognised. this also happens with music cds, recognising some but not others. Since these scans have been done my internet connection seems to have changed. Although now i have looked it up to tell you about it it seems to have changed again, i did have a net adapter connected all of a sudden with an ip address and 'demonware' both listed and checked and said i had been connected for 3 days - but it seems to have gone now so i suppose i shouldnt worry about it now
Do this now.
Good job
The following will implement some cleanup procedures as well as reset System Restore points:
- Click START then RUN
- Now type ComboFix /Uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.
- [external image: Posted Image]
To be on the safe side, I would also change all my passwords.
Here's my usual all clean post
Log looks good
- Make your Internet Explorer more secure - This can be done by following these simple instructions:
- From within Internet Explorer click on the Tools menu and then click on Options.
- Click once on the Security tab
- Click once on the Internet icon so it becomes highlighted.
- Click once on the Custom Level button.
- Change the Download signed ActiveX controls to Prompt
- Change the Download unsigned ActiveX controls to Disable
- Change the Initialize and script ActiveX controls not marked as safe to Disable
- Change the Installation of desktop items to Prompt
- Change the Launching programs and files in an IFRAME to Prompt
- Change the Navigate sub-frames across different domains to Prompt
- When all these settings have been made, click on the OK button.
- If it prompts you as to whether or not you want to save the settings, press the Yes button.
- Next press the Apply button and then the OK to exit the Internet Properties page.
- Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week
(Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
- Use a Firewall - I can not stress how important it is that you use a Firewall on your computer.
Without a firewall your computer is succeptible to being hacked and taken over.
I am very serious about this and see it happen almost every day with my clients.
Simply using a Firewall in its default configuration can lower your risk greatly.
- Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly.
This will ensure your computer has always the latest security updates available installed on your computer.
If there are new updates to install, install them immediately, reboot your computer, and revisit the site
until there are no more critical updates.
- Update all these programs regularly - Make sure you update all the programs I have listed regularly.
Without regular updates you WILL NOT be protected when new malicious programs are released.
Only run one Anti-Virus and Firewall program.
I would suggest you read How to Prevent Malware:
mad.house
Thank you so much for your time and patience. Its appreciated. I will follow up your recommendations.
LDTate
Great job
You're more then welcome.
Glad we were able to help
Peace be with you 
You're more then welcome.
Glad we were able to help
Peace be with you
LDTate
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.
If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.
Everyone else please begin a New Topic.
Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI