What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] My Anti Virus wont delete Trojan.Generic, Trojan.Spy...help

12 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hello My anti-virus scan came back saying i had 5 infections, when i look at the results, quarantine is empty, but i see 3 in the view log, i have Trojan.Generic.3617906 beside it has Firefox 3.5.3 setup.exe, said it failed to quarantine next one is Trojan.Generic.3617906 beside it its F_00001c failed to quarantine and then Keylogger.zip Trojan.Spy.keylogger.AI (this one said it was reported) how can i get rid of them without going to sites that have me dl trial products then only to want you to buy after it has scanned? ugh! thank you for your help on this matter Snow :)
Post #2
Hello Snow and welcome to WhatTheTech. I’ll be happy to look over your log and help you with your issues. It will be very helpful if you follow these guidelines:
  • Malware removal is a sometimes lengthy and tedious process. Please stick with the thread until I’ve given you the “All clear.” Absence of symptoms does not mean your machine is clean!
  • Please do not run any scans or install/uninstall any applications without being directed to do so.
  • Please follow my instructions carefully and in the order they are posted.
  • Any underlined text in my posts indicates a clickable link.
  • You should print any instructions I give you for ease of use and reference.
  • If you have any questions at all, please stop and ask before proceeding.
🖼Click to load external image (Posted Image) Please download DDS by sUBs from one of the following links and save it to your desktop.
    • DDS.scr
    • DDS.pif
  • Disable any script blocking protection (How to Disable your Security Programs)
  • Double click DDS icon to run the tool (may take up to 3 minutes to run)
  • When done, DDS.txt will open.
  • After a few moments, attach.txt will open in a second window.
  • Save both reports to your desktop.
—————————————————
  • Post the contents of the DDS.txt report in your next reply
  • Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and then click UPLOAD.
🖼Click to load external image (Posted Image) Download GMER Rootkit Scanner from here to your desktop.
  • Double click the exe file. If asked to allow gmer.sys driver to load, please consent .
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.


    [external image: Posted Image]
    Click the image to enlarge it


  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)a
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and post it in reply.
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

If you have trouble running GEMR:
  • Make sure that your security software is disabled
  • Uncheck the box next to "Files" this time also
  • If you still can't run it, try in the Safe Mode
Please include the following in your next post:
  • DDS and Attach.txt logs
  • GMER log
Post #3
Hi…i tried the scanner gmer but after 5 hrs of scanning my maching ended up in limbo and i never got a scan result, and the icons on my desktop disappeared so i had to reboot my machine..ill be gone for a couple of days so i will try again when i get back and check back in with you. thank you so much for the fast reply Snow :)
Post #4
Thanks for letting me know, I'll keep the thread open for you.

When you return, try running GMER checking only the boxes next to Sections and C:\
Post #5 last edited
Hi RPM

Here are the two files, GMER keeps freezing up my machine unfortunately and i had to reboot it once again

thankx
Snow


DDS (Ver_10-03-17.01) - NTFSx86
Run by [removed] at 12:43:09.25 on 07/05/2010
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_19
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2031.991 [GMT -4:00]

AV: Bell Internet Security Services Anti-Virus *On-access scanning enabled* (Updated) {5B5A3BD7-8573-4672-AEA8-C9BB713B6755}
FW: Bell Internet Security Services Firewall *enabled* {80593BF4-D969-4EC5-ADAE-A22F2DFC7A22}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Program Files\Bell\Bell Internet Security Services\Fws.exe
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bell\Bell Internet Security Services\AVG\Identity Protection\agent\Bin\AVGIDSAgent.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Intel\AMT\atchksrv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\svchost.exe -k hpdevmgmt
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Intel\AMT\LMS.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\Program Files\Bell\Bell Internet Security Services\RpsSecurityAwareR.exe
C:\Program Files\Bell\Internet Service Advisor\ServicepointService.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Intel\AMT\UNS.exe
C:\Program Files\Personal Vault Backup Manager\VaultClientSRV.exe
C:\Program Files\Personal Vault Backup Manager\VaultClientUpgrade.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Bell\Bell Internet Security Services\rps.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Intel\AMT\atchk.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Bell\Internet Service Advisor\BISA.exe
C:\DOCUME~1\Diane\LOCALS~1\Temp\InstallHelper.exe
C:\Program Files\BellCanada\McciTrayApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Bell\Internet Service Advisor\BISAComHandler.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Program Files\Bell\Bell Internet Security Services\AVG\Identity Protection\agent\Bin\AVGIDSMonitor.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Documents and Settings\Diane\My Documents\Downloads\dds.scr

============== Pseudo HJT Report ===============

uInternet Settings,ProxyOverride = *.local
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: [atchk] "c:\program files\intel\amt\atchk.exe"
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [NeroFilterCheck] c:\program files\common files\ahead\lib\NeroCheck.exe
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [hpqSRMon] c:\program files\hp\digital imaging\bin\hpqSRMon.exe
mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: []
mRun: [RoxWatchTray] "c:\program files\common files\roxio shared\10.0\sharedcom\RoxWatchTray10.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [DRPU PC Data Manager(Basic)] "c:\program files\drpu pc data manager(basic)\pcdm.exe" "hd"
mRun: [BISA.exe] "c:\program files\bell\internet service advisor\BISA.exe" /AUTORUN
mRun: [BellCanada_UninstallTracking] c:\docume~1\diane\locals~1\temp\InstallHelper.exe /uninstalltrackingvendor=BellCanada
mRun: [BellCanada_McciTrayApp] "c:\program files\bellcanada\McciTrayApp.exe"
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab
Handler: intu-qt2009 - {03947252-2355-4e9b-B446-8CCC75C43370} - c:\program files\quicktax 2009\ic2009pp.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\diane\applic~1\mozilla\firefox\profiles\t9rf6od4.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.sympatico.ca/
FF - plugin: c:\program files\bell\internet service advisor\nprpspa.dll
FF - plugin: c:\program files\common files\motive\npMotive.dll
FF - plugin: c:\program files\google\update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}

—- FIREFOX POLICIES —-
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R0 RadialpointIDSEH;RadialpointIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2010-5-6 25608]
R2 Radialpoint Security Services;Bell Internet Security Services;c:\program files\bell\bell internet security services\RpsSecurityAwareR.exe [2010-1-18 165408]
R2 RadialpointIDSAgent;RadialpointIDSAgent;c:\program files\bell\bell internet security services\avg\identity protection\agent\bin\AVGIDSAgent.exe [2010-5-6 5832712]
R2 ServicepointService;ServicepointService;c:\program files\bell\internet service advisor\ServicepointService.exe [2010-5-6 689392]
R2 UNS;Intel® Active Management Technology User Notification Service;c:\program files\intel\amt\UNS.exe [2009-10-13 2521624]
R2 VaultClientSRV;Personal Vault Backup Manager Service;c:\program files\personal vault backup manager\VaultClientSRV.exe [2010-1-17 1051728]
R2 VaultClientUpgrade;Personal Vault Backup Manager Upgrade Service;c:\program files\personal vault backup manager\VaultClientUpgrade.exe [2010-1-17 56400]
R3 RadialpointIDSDriver;RadialpointIDSDriver;c:\program files\bell\bell internet security services\avg\identity protection\agent\drivers\AVGIDSDriver.sys [2010-5-6 122376]
R3 RadialpointIDSFilter;RadialpointIDSFilter;c:\program files\bell\bell internet security services\avg\identity protection\agent\drivers\AVGIDSfilter.sys [2010-5-6 30216]
R3 RadialpointIDSShim;RadialpointIDSShim;c:\program files\bell\bell internet security services\avg\identity protection\agent\drivers\AVGIDSShim.sys [2010-5-6 25736]
S2 RoxLiveShare10;LiveShare P2P Server 10;c:\program files\common files\roxio shared\10.0\sharedcom\RoxLiveShare10.exe [2008-6-4 309744]
S2 RoxWatch10;Roxio Hard Drive Watcher 10;c:\program files\common files\roxio shared\10.0\sharedcom\RoxWatch10.exe [2008-6-4 166384]
S2 SessionLauncher;SessionLauncher; [x]
S3 RoxMediaDB10;RoxMediaDB10;c:\program files\common files\roxio shared\10.0\sharedcom\RoxMediaDB10.exe [2008-6-4 1120752]

=============== Created Last 30 ================

2010-05-06 15:46:59 0 d—–w- c:\program files\BellCanada
2010-05-06 15:34:44 25608 —-a-w- c:\windows\system32\drivers\AVGIDSEH.sys
2010-05-06 15:34:37 0 d—–w- c:\program files\Personal Vault Backup Manager
2010-05-06 15:34:25 285704 —-a-w- c:\windows\system32\drivers\bdfsfltr.sys
2010-05-06 15:34:21 53192 —-a-w- c:\windows\system32\drivers\rp_skt32.sys
2010-05-06 15:34:16 48384 —-a-w- c:\windows\system32\drivers\rp_pkt32.sys
2010-05-06 15:34:06 0 d—–w- c:\program files\Raxco
2010-05-06 15:32:53 0 d—–w- c:\docume~1\alluse~1\applic~1\Radialpoint
2010-05-06 13:07:59 0 d—–w- c:\docume~1\diane\applic~1\FixCleaner
2010-05-06 13:07:38 0 d—–w- c:\program files\FixCleaner
2010-05-04 21:18:59 775 –sh–w- c:\windows\system\actualspystart.lnk
2010-04-14 18:36:06 221184 —-a-w- c:\windows\system32\wmpns.dll
2010-04-13 12:07:16 664 —-a-w- c:\windows\system32\d3d9caps.dat

==================== Find3M ====================

2010-05-06 14:02:30 933408 –sha-w- c:\windows\system32\drivers\fidbox2.dat
2010-05-06 14:02:30 88556 –sha-w- c:\windows\system32\drivers\fidbox2.idx
2010-05-06 14:02:30 449204 –sha-w- c:\windows\system32\drivers\fidbox.idx
2010-05-06 14:02:30 33460256 –sha-w- c:\windows\system32\drivers\fidbox.dat
2010-04-06 18:15:41 24728 —ha-w- c:\windows\system32\mlfcache.dat
2010-03-10 06:15:52 420352 —-a-w- c:\windows\system32\vbscript.dll
2010-03-09 08:28:20 411368 —-a-w- c:\windows\system32\deploytk.dll
2010-02-25 06:24:37 916480 —-a-w- c:\windows\system32\wininet.dll
2010-02-16 14:08:49 2146304 —-a-w- c:\windows\system32\ntoskrnl.exe
2010-02-16 13:25:04 2024448 —-a-w- c:\windows\system32\ntkrnlpa.exe
2010-02-12 04:33:11 100864 —-a-w- c:\windows\system32\6to4svc.dll
2009-10-20 16:24:34 1074 —-a-w- c:\program files\INSTALL.LOG
2006-06-23 06:48:54 32768 —-a-r- c:\windows\inf\UpdateUSB.exe

============= FINISH: 12:43:30.46 ===============


UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-03-17.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 13/10/2009 4:22:11 PM
System Uptime: 05/07/2010 10:54:47 AM (-1414 hours ago)

Motherboard: ASUSTeK Computer INC. | | P5E-VM DO
Processor: Intel® Core™2 Quad CPU Q6600 @ 2.40GHz | LGA775 | 2400/266mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 932 GiB total, 911.408 GiB free.
D: is CDROM ()

==== Disabled Device Manager Items =============

Class GUID: {4D36E96B-E325-11CE-BFC1-08002BE10318}
Description: Standard 101/102-Key or Microsoft Natural PS/2 Keyboard
Device ID: ACPI\PNP0303\4&3D90042&0
Manufacturer: (Standard keyboards)
Name: Standard 101/102-Key or Microsoft Natural PS/2 Keyboard
PNP Device ID: ACPI\PNP0303\4&3D90042&0
Service: i8042prt

==== System Restore Points ===================

RP106: 06/02/2010 1:01:09 PM - System Checkpoint
RP107: 07/02/2010 1:48:53 PM - System Checkpoint
RP108: 09/02/2010 8:32:56 AM - System Checkpoint
RP109: 10/02/2010 9:59:36 AM - System Checkpoint
RP110: 10/02/2010 2:14:49 PM - Software Distribution Service 3.0
RP111: 12/02/2010 8:17:39 AM - System Checkpoint
RP112: 13/02/2010 1:41:46 PM - System Checkpoint
RP113: 15/02/2010 11:25:23 AM - System Checkpoint
RP114: 16/02/2010 11:52:34 AM - System Checkpoint
RP115: 18/02/2010 8:09:24 AM - System Checkpoint
RP116: 19/02/2010 8:58:25 AM - System Checkpoint
RP117: 20/02/2010 6:09:06 PM - System Checkpoint
RP118: 22/02/2010 9:16:55 AM - System Checkpoint
RP119: 23/02/2010 9:58:52 AM - System Checkpoint
RP120: 24/02/2010 10:36:38 AM - System Checkpoint
RP121: 24/02/2010 2:24:06 PM - Software Distribution Service 3.0
RP122: 26/02/2010 12:06:03 PM - System Checkpoint
RP123: 28/02/2010 2:18:00 PM - System Checkpoint
RP124: 01/03/2010 3:20:11 PM - System Checkpoint
RP125: 03/03/2010 3:11:45 PM - System Checkpoint
RP126: 05/03/2010 8:22:32 AM - System Checkpoint
RP127: 06/03/2010 2:41:18 PM - System Checkpoint
RP128: 07/03/2010 4:51:49 PM - System Checkpoint
RP129: 09/03/2010 7:47:23 AM - System Checkpoint
RP130: 10/03/2010 8:19:36 AM - System Checkpoint
RP131: 10/03/2010 2:19:47 PM - Software Distribution Service 3.0
RP132: 12/03/2010 8:31:02 AM - System Checkpoint
RP133: 13/03/2010 9:34:29 AM - System Checkpoint
RP134: 13/03/2010 1:06:44 PM - Installed QuickTax 2009.
RP135: 14/03/2010 4:55:32 PM - System Checkpoint
RP136: 15/03/2010 5:21:49 PM - System Checkpoint
RP137: 17/03/2010 11:26:12 AM - System Checkpoint
RP138: 18/03/2010 2:36:57 PM - System Checkpoint
RP139: 19/03/2010 4:52:10 PM - System Checkpoint
RP140: 20/03/2010 5:30:04 PM - System Checkpoint
RP141: 23/03/2010 9:51:39 AM - System Checkpoint
RP142: 24/03/2010 12:00:41 PM - System Checkpoint
RP143: 25/03/2010 12:25:33 PM - System Checkpoint
RP144: 26/03/2010 3:29:15 PM - System Checkpoint
RP145: 28/03/2010 11:28:20 AM - System Checkpoint
RP146: 29/03/2010 2:44:00 PM - System Checkpoint
RP147: 30/03/2010 12:37:19 PM - Installed Java™ 6 Update 19
RP148: 31/03/2010 2:08:12 PM - System Checkpoint
RP149: 31/03/2010 2:33:14 PM - Software Distribution Service 3.0
RP150: 01/04/2010 5:19:23 PM - System Checkpoint
RP151: 06/04/2010 11:36:12 AM - System Checkpoint
RP152: 08/04/2010 8:14:31 AM - System Checkpoint
RP153: 09/04/2010 8:23:45 AM - System Checkpoint
RP154: 10/04/2010 1:20:41 PM - System Checkpoint
RP155: 12/04/2010 1:01:34 PM - System Checkpoint
RP156: 14/04/2010 11:15:18 AM - System Checkpoint
RP157: 14/04/2010 2:34:28 PM - Software Distribution Service 3.0
RP158: 16/04/2010 9:06:53 AM - System Checkpoint
RP159: 18/04/2010 12:45:43 PM - System Checkpoint
RP160: 19/04/2010 5:13:42 PM - System Checkpoint
RP161: 21/04/2010 11:51:30 AM - System Checkpoint
RP162: 22/04/2010 11:53:52 AM - System Checkpoint
RP163: 23/04/2010 4:52:10 PM - System Checkpoint
RP164: 25/04/2010 4:15:07 PM - System Checkpoint
RP165: 27/04/2010 8:27:07 AM - System Checkpoint
RP166: 28/04/2010 8:38:52 AM - System Checkpoint
RP167: 29/04/2010 11:54:40 AM - System Checkpoint
RP168: 02/05/2010 9:26:52 AM - System Checkpoint
RP169: 03/05/2010 9:47:27 AM - System Checkpoint
RP170: 04/05/2010 12:00:33 PM - System Checkpoint
RP171: 05/05/2010 12:05:26 PM - System Checkpoint
RP172: 06/05/2010 9:07:37 AM - Installed FixCleaner
RP173: 06/05/2010 9:22:54 AM - Removed FixCleaner
RP174: 06/05/2010 9:51:26 AM - Installed Kaspersky Internet Security 2010.
RP175: 06/05/2010 10:34:01 AM - Removed Kaspersky Internet Security 2010.
RP176: 07/05/2010 11:38:03 AM - System Checkpoint

==== Installed Programs ======================

32 Bit HP CIO Components Installer
Adobe Flash Player 10 Plugin
Adobe Reader 9.3.2
AiO_Scan
AiOSoftware
Apple Application Support
Apple Mobile Device Support
Apple Software Update
ASUS nVidia Driver
ATI - Software Uninstall Utility
Bell Internet Check-up
Bell Internet Security Services
Bell Internet Service Advisor 3.5.15
Bonjour
BufferChm
CCleaner
Copy
CP_Package_Variety1
CP_Package_Variety2
CP_Package_Variety3
Destination Component
DeviceDiscovery
DirectXInstallService
DJ_AIO_03_F4200_ProductContext
DJ_AIO_03_F4200_Software
DJ_AIO_03_F4200_Software_Min
DocProc
F4200
F4200_Help
Fax
GPBaseService
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB954708)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
HP Customer Participation Program 10.0
HP Deskjet F4200 All-In-One Driver Software 10.0 Rel .3
HP Image Zone Express
HP Imaging Device Functions 10.0
HP Photosmart Essential 3.5
HP PSC & OfficeJet 5.3.B
HP Smart Web Printing
HP Solution Center 10.0
HP Update
HPPhotoSmartDiscLabelContent1
HPPhotosmartEssential
HPProductAssistant
HPSSupply
Intel® PRO Network Connections Drivers
Intel® Active Management Technology
Intel® Management Engine Interface
iTunes
Java Auto Updater
Java™ 6 Update 19
Junk Mail filter update
Malwarebytes' Anti-Malware
MarketResearch
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Mozilla Firefox (3.6.3)
MSN
MSVCRT
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Nero 7 Essentials
neroxml
NewCopy
NVIDIA Drivers
PerfectDisk 10 Professional
ProductContext
PSSWCORE
QuickTax 2009
QuickTime
Readme
Realtek High Definition Audio Driver
Roxio Central Audio
Roxio Central Copy
Roxio Central Core
Roxio Central Data
Roxio Central Tools
Roxio RecordNow 10 Music Lab
Roxio Update Manager
RPS CRT
RPS PerfectDiskStub
RPS RpsCore
Scan
ScannerCopy
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB974455)
Security Update for Windows Internet Explorer 8 (KB976325)
Security Update for Windows Internet Explorer 8 (KB978207)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB979402)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371-v2)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974455)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB980232)
Segoe UI
Shop for HP Supplies
SmartWebPrintingOC
SolutionCenter
Sonic CinePlayer Decoder Pack
Status
Toolbox
TrayApp
TunePlus
Unload
UnloadSupport
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 8 (KB973874)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows Internet Explorer 8 (KB976749)
Update for Windows Internet Explorer 8 (KB980182)
Update for Windows XP (KB898461)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB961503)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
VideoToolkit01
WebFldrs XP
WebReg
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 8
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Mail
Windows Live Messenger
Windows Live Photo Gallery
Windows Live Sign-in Assistant
Windows Live Sync
Windows Live Upload Tool
Windows Live Writer
Windows Media Format Runtime

==== Event Viewer Messages From Past Week ========

06/05/2010 11:18:25 AM, error: Service Control Manager [7000] - The Security Services Driver (x86) service failed to start due to the following error: The system cannot find the file specified.
06/05/2010 11:10:59 AM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the service.
06/05/2010 11:10:29 AM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the VaultClientUpgrade service.
01/05/2010 1:38:17 PM, error: Service Control Manager [7022] - The HP CUE DeviceDiscovery Service service hung on starting.
01/05/2010 1:36:55 PM, error: Service Control Manager [7000] - The SessionLauncher service failed to start due to the following error: The system cannot find the path specified.

==== End Of File ===========================
GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-05-10 19:05:09
Windows 5.1.2600 Service Pack 3
Running: 0xpp8jb4.exe; Driver: C:\DOCUME~1\Diane\LOCALS~1\Temp\kwpiiaod.sys


—- Kernel code sections - GMER 1.0.15 —-

.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xB9640360, 0x37102D, 0xE8000020]
? System32\Drivers\96059c30.sys The system cannot find the path specified. !

—- EOF - GMER 1.0.15 —-
Post #6
Snow,

🖼Click to load external image (Posted Image) Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
  • Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

  • Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

Please include the following in your next post:
  • ComboFix log
Post #7
Goodmorning RPM here is the combofix log… ComboFix 10-05-10.03 - Diane 11/05/2010 7:30.1.4 - x86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2031.1230 [GMT -4:00] Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe AV: Bell Internet Security Services Anti-Virus *On-access scanning disabled* (Updated) {5B5A3BD7-8573-4672-AEA8-C9BB713B6755} FW: Bell Internet Security Services Firewall *disabled* {80593BF4-D969-4EC5-ADAE-A22F2DFC7A22} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\program files\INSTALL.LOG c:\windows\system32\AbaleZip.dll c:\windows\system32\system . ((((((((((((((((((((((((( Files Created from 2010-04-11 to 2010-05-11 ))))))))))))))))))))))))))))))) . 2010-05-06 15:46 . 2010-05-06 15:47 ——– d—–w- c:\program files\BellCanada 2010-05-06 15:45 . 2010-05-06 15:45 3236440 —-a-w- c:\documents and settings\Diane\Application Data\Bell\Internet Service Advisor\downloads\SSMInstaller.41.exe.dir\SSMInstaller.exe 2010-05-06 15:45 . 2010-05-06 15:45 77600 —-a-w- c:\documents and settings\Diane\Application Data\Bell\Internet Service Advisor\downloads\RegSetB1.41.exe.dir\RegSetB1.exe 2010-05-06 15:40 . 2010-05-06 15:40 156912 —-a-w- c:\documents and settings\Diane\Application Data\Bell\Internet Service Advisor\downloads\SPDFileCopier.41.exe.dir\SPDFileCopier.exe 2010-05-06 15:34 . 2009-11-02 19:27 25608 —-a-w- c:\windows\system32\drivers\AVGIDSEH.sys 2010-05-06 15:34 . 2010-05-06 15:36 ——– d—–w- c:\program files\Personal Vault Backup Manager 2010-05-06 15:34 . 2009-10-23 17:25 285704 —-a-w- c:\windows\system32\drivers\bdfsfltr.sys 2010-05-06 15:34 . 2010-05-06 15:34 53192 —-a-w- c:\windows\system32\drivers\rp_skt32.sys 2010-05-06 15:34 . 2010-05-06 15:34 48384 —-a-w- c:\windows\system32\drivers\rp_pkt32.sys 2010-05-06 15:34 . 2010-05-06 15:34 ——– d—–w- c:\program files\Raxco 2010-05-06 15:34 . 2010-05-06 15:34 ——– d—–w- c:\documents and settings\All Users\Application Data\Raxco 2010-05-06 15:32 . 2010-05-06 15:32 ——– d—–w- c:\documents and settings\All Users\Application Data\Radialpoint 2010-05-06 15:25 . 2010-05-06 15:28 135050336 —-a-w- c:\documents and settings\Diane\Application Data\Bell\Internet Service Advisor\downloads\BellInternetSecuritySuite.41.exe.dir\BellInternetSecuritySuite.exe 2010-05-06 13:07 . 2010-05-06 13:08 ——– d—–w- c:\documents and settings\Diane\Application Data\FixCleaner 2010-05-06 13:07 . 2010-05-06 13:22 ——– d—–w- c:\program files\FixCleaner 2010-04-16 12:29 . 2010-04-16 12:29 ——– d—–w- c:\program files\Common Files\Adobe 2010-04-14 18:36 . 2008-04-14 09:42 221184 —-a-w- c:\windows\system32\wmpns.dll 2010-04-13 12:07 . 2010-04-26 15:07 664 —-a-w- c:\windows\system32\d3d9caps.dat . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-05-06 17:43 . 2009-10-20 16:23 ——– d—–w- c:\documents and settings\All Users\Application Data\Motive 2010-05-06 15:47 . 2009-10-20 16:24 ——– d—–w- c:\program files\Common Files\Motive 2010-05-06 15:46 . 2010-03-13 18:06 ——– d—–w- c:\program files\QuickTax 2009 2010-05-06 15:46 . 2009-10-20 16:35 ——– d—–w- c:\program files\QuickTime 2010-05-06 15:46 . 2009-10-13 20:48 ——– d–h–w- c:\program files\InstallShield Installation Information 2010-05-06 15:37 . 2009-10-18 14:07 ——– d—–w- c:\documents and settings\Diane\Application Data\Bell 2010-05-06 15:33 . 2009-10-17 00:21 ——– d—–w- c:\program files\Bell 2010-05-06 15:33 . 2009-10-17 00:21 ——– d—–w- c:\documents and settings\All Users\Application Data\Bell 2010-05-06 14:02 . 2009-10-17 00:25 449204 –sha-w- c:\windows\system32\drivers\fidbox.idx 2010-05-06 14:02 . 2009-10-17 00:25 33460256 –sha-w- c:\windows\system32\drivers\fidbox.dat 2010-05-06 14:02 . 2009-10-17 00:25 933408 –sha-w- c:\windows\system32\drivers\fidbox2.dat 2010-05-06 14:02 . 2009-10-17 00:25 88556 –sha-w- c:\windows\system32\drivers\fidbox2.idx 2010-04-06 18:15 . 2009-10-20 16:40 24728 —ha-w- c:\windows\system32\mlfcache.dat 2010-03-30 16:37 . 2010-03-30 16:37 ——– d—–w- c:\program files\Common Files\Java 2010-03-30 16:37 . 2010-03-30 16:37 503808 —-a-w- c:\documents and settings\Diane\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-6e18cf2f-n\msvcp71.dll 2010-03-30 16:37 . 2010-03-30 16:37 499712 —-a-w- c:\documents and settings\Diane\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-6e18cf2f-n\jmc.dll 2010-03-30 16:37 . 2010-03-30 16:37 348160 —-a-w- c:\documents and settings\Diane\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-6e18cf2f-n\msvcr71.dll 2010-03-30 16:37 . 2010-03-30 16:37 61440 —-a-w- c:\documents and settings\Diane\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-7d36170c-n\decora-sse.dll 2010-03-30 16:37 . 2010-03-30 16:37 12800 —-a-w- c:\documents and settings\Diane\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-7d36170c-n\decora-d3d.dll 2010-03-30 16:37 . 2009-10-19 16:52 ——– d—–w- c:\program files\Java 2010-03-15 16:41 . 2009-10-18 14:09 30216 —-a-w- c:\documents and settings\Diane\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2010-03-13 18:06 . 2010-03-13 18:06 ——– d—–w- c:\program files\Common Files\AnswerWorks 4.0 2010-03-13 18:06 . 2010-03-13 18:06 ——– d—–w- c:\program files\Common Files\Intuit 2010-03-13 18:06 . 2010-03-13 18:06 ——– d—–w- c:\documents and settings\All Users\Application Data\Intuit Canada 2010-03-10 06:15 . 2008-04-14 09:42 420352 —-a-w- c:\windows\system32\vbscript.dll 2010-03-09 08:28 . 2009-10-19 16:52 411368 —-a-w- c:\windows\system32\deploytk.dll 2010-02-25 06:24 . 2008-04-14 09:42 916480 —-a-w- c:\windows\system32\wininet.dll 2010-02-24 13:11 . 2008-04-14 04:47 455680 —-a-w- c:\windows\system32\drivers\mrxsmb.sys 2010-02-16 14:08 . 2008-04-14 04:54 2146304 —-a-w- c:\windows\system32\ntoskrnl.exe 2010-02-16 13:25 . 2008-04-14 00:01 2024448 —-a-w- c:\windows\system32\ntkrnlpa.exe 2010-02-12 04:33 . 2008-04-14 09:41 100864 —-a-w- c:\windows\system32\6to4svc.dll 2010-02-11 12:02 . 2008-04-14 04:30 226880 —-a-w- c:\windows\system32\drivers\tcpip6.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\VaultIcon1] @="{B976888E-DC7B-456C-A62F-44EA07ED231F}" [HKEY_CLASSES_ROOT\CLSID\{B976888E-DC7B-456C-A62F-44EA07ED231F}] 2010-01-17 23:08 503808 —-a-w- c:\program files\Personal Vault Backup Manager\VaultClientMenu.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RTHDCPL"="RTHDCPL.EXE" [2007-07-05 16380416] "atchk"="c:\program files\Intel\AMT\atchk.exe" [2007-07-06 408088] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-03-11 13520896] "nwiz"="nwiz.exe" [2008-03-11 1626112] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-03-11 86016] "NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-09-21 305440] "hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-08-20 150016] "Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040] "RoxWatchTray"="c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatchTray10.exe" [2008-06-04 244208] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768] "BISA.exe"="c:\program files\Bell\Internet Service Advisor\BISA.exe" [2010-01-13 4281584] "BellCanada_McciTrayApp"="c:\program files\BellCanada\McciTrayApp.exe" [2010-01-19 1565696] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] c:\documents and settings\All Users\Start Menu\Programs\Startup\ HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2008-3-25 214360] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ PDBoot.exe\0autocheck autochk * [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Radialpoint Security Services] @="Service" [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqpse.exe"= "c:\\Program Files\\Common Files\\HP\\Digital Imaging\\Bin\\hpqPhotoCrm.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqsudi.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqpsapp.exe"= "c:\\Program Files\\Bell\\Internet Service Advisor\\ServicepointService.exe"= R0 RadialpointIDSEH;RadialpointIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [06/05/2010 11:34 AM 25608] R2 Radialpoint Security Services;Bell Internet Security Services;c:\program files\Bell\Bell Internet Security Services\RpsSecurityAwareR.exe [18/01/2010 4:11 PM 165408] R2 RadialpointIDSAgent;RadialpointIDSAgent;c:\program files\Bell\Bell Internet Security Services\AVG\Identity Protection\agent\bin\AVGIDSAgent.exe [06/05/2010 11:34 AM 5832712] R2 ServicepointService;ServicepointService;c:\program files\Bell\Internet Service Advisor\ServicepointService.exe [06/05/2010 11:32 AM 689392] R2 UNS;Intel® Active Management Technology User Notification Service;c:\program files\Intel\AMT\UNS.exe [13/10/2009 4:56 PM 2521624] R2 VaultClientSRV;Personal Vault Backup Manager Service;c:\program files\Personal Vault Backup Manager\VaultClientSRV.exe [17/01/2010 7:08 PM 1051728] R2 VaultClientUpgrade;Personal Vault Backup Manager Upgrade Service;c:\program files\Personal Vault Backup Manager\VaultClientUpgrade.exe [17/01/2010 7:08 PM 56400] R3 RadialpointIDSDriver;RadialpointIDSDriver;c:\program files\Bell\Bell Internet Security Services\AVG\Identity Protection\agent\drivers\AVGIDSDriver.sys [06/05/2010 11:34 AM 122376] R3 RadialpointIDSFilter;RadialpointIDSFilter;c:\program files\Bell\Bell Internet Security Services\AVG\Identity Protection\agent\drivers\AVGIDSfilter.sys [06/05/2010 11:34 AM 30216] R3 RadialpointIDSShim;RadialpointIDSShim;c:\program files\Bell\Bell Internet Security Services\AVG\Identity Protection\agent\drivers\AVGIDSShim.sys [06/05/2010 11:34 AM 25736] S2 RoxLiveShare10;LiveShare P2P Server 10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe [04/06/2008 9:59 AM 309744] S2 RoxWatch10;Roxio Hard Drive Watcher 10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatch10.exe [04/06/2008 9:59 AM 166384] S2 SessionLauncher;SessionLauncher; [x] S3 RoxMediaDB10;RoxMediaDB10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe [04/06/2008 9:59 AM 1120752] — Other Services/Drivers In Memory — *NewlyCreated* - AC6DDF45 *Deregistered* - ac6ddf45 [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc bdx REG_MULTI_SZ scan sysagent . Contents of the 'Scheduled Tasks' folder 2010-04-27 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34] . . ——- Supplementary Scan ——- . uInternet Settings,ProxyOverride = *.local FF - ProfilePath - c:\documents and settings\Diane\Application Data\Mozilla\Firefox\Profiles\t9rf6od4.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.sympatico.ca/ FF - plugin: c:\program files\Bell\Internet Service Advisor\nprpspa.dll FF - plugin: c:\program files\Common Files\Motive\npMotive.dll FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ —- FIREFOX POLICIES —- c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr ef", true); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); . - - - - ORPHANS REMOVED - - - - HKLM-Run-DRPU PC Data Manager(Basic) - c:\program files\DRPU PC Data Manager(Basic)\pcdm.exe ************************************************************************** scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: ************************************************************************** . Completion time: 2010-05-11 07:34:21 ComboFix-quarantined-files.txt 2010-05-11 11:34 Pre-Run: 978,545,348,608 bytes free Post-Run: 978,551,443,456 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect - - End Of File - - 520A4EEB01FCE735D42EA58072C282DB
Post #8
Snow,

Hello. Please run these for me next:

🖼Click to load external image (Posted Image) You have this program installed, Malwarebytes' Anti-Malware (MBAM). Please update it and run a scan.

Open MBAM
  • Click the Update tab
  • Click Check for Updates
  • If an update is found, it will download and install the latest version.
  • The program will close to update and reopen.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

🖼Click to load external image (Posted Image) Using Internet Explorer or Firefox, visit Kaspersky Online Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.

2. To optimize scanning time and produce a more sensible report for review:
  • Close any open programs
  • Turn off the real time scanner of any existing antivirus program while performing the online scan. Click HERE to see how to disable the most common antivirus programs.
3. Click Run at the Security prompt.

The program will then begin downloading and installing and will also update the database.
Please be patient as this can take quite a long time to download.
  • Once the update is complete, click on Settings.
  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
    • Spyware, adware, dialers, and other riskware
    • Archives
    • E-mail databases
  • Click on My Computer under the green Scan bar to the left to start the scan.
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Click View report… at the bottom.
  • Click the Save report… button.

    [external image: Posted Image]

  • Change the Files of type dropdown box to Text file (.txt) and name the file KasReport.txt to save the file to your desktop so that you may post it in your next reply
Please include the following in your next post:
  • MBAM log
  • Kaspersky log
  • Is your computer running better?
Post #9
Hello RPM here are the scans…my antivirus scanned today and found the trojan.keylogger.AI it says it has been reported again but every time it scanns it shows up again and reports it, looks like its still in my system somewhere… Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Database version: 4052 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 11/05/2010 11:12:52 AM mbam-log-2010-05-11 (11-12-52).txt Scan type: Quick scan Objects scanned: 115449 Time elapsed: 4 minute(s), 25 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) ——————————————————————————– KASPERSKY ONLINE SCANNER 7.0: scan report Tuesday, May 11, 2010 Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Last database update: Tuesday, May 11, 2010 12:41:21 Records in database: 4094290 ——————————————————————————– Scan settings: scan using the following database: extended Scan archives: yes Scan e-mail databases: yes Scan area - My Computer: C:\ D:\ Scan statistics: Objects scanned: 43983 Threats found: 0 Infected objects found: 0 Suspicious objects found: 0 Scan duration: 00:46:05 No threats found. Scanned area is clean. Selected area has been scanned.
Post #10
Hi, Please give me as much detail as possible about the message your AV is giving you about a keylogger. (ie: file path, etc.)
Post #11
Hello RPM… It says Keylogger.zip then Trojan.Keylogger.AI If i do a search on the zip file and delete it, will that get rid of it? Snow
Post #12
Snow,

Let's have a closer look:

🖼Click to load external image (Posted Image) Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2
  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:
    :filefind
keylogger.zip

:folderfind
keylogger.zip
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt
Post #13
Hi RPM we did a search on the zip file found it and deleted it, ran the anti virus and it came up clean, all the trojans etc are gone, the machine is clean :) SystemLook v1.0 by jpshortstuff (11.01.10) Log created at 21:06 on 11/05/2010 by Diane (Administrator - Elevation successful) No Context: CODE ========== filefind ========== Searching for "keylogger.zip" No files found. ========== folderfind ========== Searching for "keylogger.zip" No folders found. -=End Of File=-
Post #14
Good enough, that is exactly what I was trying to do. The rest of your logs look clean, but you have some important cleanup work to do now:

🖼Click to load external image (Posted Image) Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version Java components and update.
  • Download the latest version of Java Runtime Environment (JRE) 6 and save it to your desktop.
  • Scroll down to where it says "Java SE Runtime Environment (JRE) 6 Update 20. The Java SE Runtime Environment (JRE) allows end-users to run Java applications."
  • Click the "Download" button to the right.
  • Select the Windows platform from the dropdown menu.
  • Read the License Agreement and then check the box that says: " I agree to the Java SE Runtime Environment 6 with JavaFX License Agreement". Click on Continue.The page will refresh.
  • Click on the link to download Windows Offline Installation and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Now go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java™ 6) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java version.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u20-windows-i586-p.exe to install the newest version.
  • After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
    • On the General tab, under Temporary Internet Files, click the Settings button.
    • Next, click on the Delete Files button
    • There are two options in the window to clear the cache - Leave BOTH Checked
      Applications and AppletsTrace and Log Files
  • Click OK on Delete Temporary Files Window
    Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
  • Click OK to leave the Temporary Files Window
  • Click OK to leave the Java Control Panel.
🖼Click to load external image (Posted Image) Uninstall ComboFix
  • Press the Windows key + R on your keyboard or click Start -> Run. Copy and past the following text into the run box that opens and press OK:
    Combofix /Uninstall
🖼Click to load external image (Posted Image)

🖼Click to load external image (Posted Image) Now to remove most of the tools that we have used in fixing your machine:
  • Make sure you have an Internet Connection.
  • Download OTC to your desktop and run it
  • A list of tool components used in the cleanup of malware will be downloaded.
  • If your Firewall or Real Time protection attempts to block OTC to reach the Internet, please allow the application to do so.
  • Click Yes to begin the cleanup process and remove these components, including this application.
  • You will be asked to reboot the machine to finish the cleanup process. If you are asked to reboot the machine choose Yes.
  • Manually delete any remaining logs or tools from our fixes
🖼Click to load external image (Posted Image) Download TFC to your desktop
  • Close any open windows.
  • Double click the TFC icon to run the program
  • TFC will close all open programs itself in order to run,
  • Click the Start button to begin the process.
  • Allow TFC to run uninterrupted.
  • The program should not take long to finish it's job
  • Once its finished it should automatically reboot your machine, if it doesn't, manually reboot to ensure a complete clean
🖼Click to load external image (Posted Image) Finally, I'd like to make a couple of suggestions to help you stay clean in the future:
  • Restart any anti-malware programs that we disabled while we were cleaning your machine.
  • Keep your antivirus application current and updated. Also, hang on to MBAM. Scan with them at least weekly.
  • Consider running in a limited user account. See this post for more information.
  • Please carefully review the information in our Security - Best Practices and Prevention forum located HERE
Please post once more so I know you are all set and I can close this thread. Good luck and stay safe!
Post #15
Goodmorning RPM I did everything you asked, my machine is running 100% better! :) thank you so much for the fast reply and for all the help! much appreciated Snow :)

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI