Helo with HJT log

Hi and welcome! [external image: Posted Image]

I'm Jet Ian [image unavailable: Posted Image], and I will be handling your log to help you get cleaned up. Please give me some time to look it over and I will get back to you as soon as possible.

Thanks for waiting.

I need you to rename Hijackthis because I suspect that you may have the Vundo infection that can hide some entries in your log.

• Please go to the folder where you saved Hijackthis.exe
• Right-click on it, then select Rename.
• Name it something like: 321.exe (or whatever you want)
• Then double-click 321.exe to scan and then post the new logfile.

– Jet

Ok let's continue.

You may want to print out these instructions or save it as a text document, and use them as a reference. If you have any questions regarding the fix, please ask us before proceeding. It is also important for you to don't miss a step and perform everything in the right order.

=====================================

First, do you know this program?

ZoneTick

=====================================

I notice that you have SpySweeper running. While this is normally a wonderful tool to protect against hijackers, it can also interfere with HijackThis fixes. You can re-enable this when your computer is already clean.

Disable SpySweeper

• Click Options.
• Click Program Options.
• Uncheck Load at Windows Startup.
• Click Shields.
• Uncheck all items.
• Uncheck Home Page Shield.
• Uncheck Automaticly restore default without notification.

=====================================

Please download VundoFix.exe to your Desktop.

• Double-click VundoFix.exe to run it.
• Click the Scan for Vundo button.
• Once it's done scanning, click the Remove Vundo button.
• You will receive a prompt asking if you want to remove the files, click YES
• Once you click yes, your desktop will go blank as it starts removing Vundo.
• When completed, it will prompt that it will reboot your computer, click OK.
• It will make a log in C:\vundofix.txt, please include that in your next reply.

=====================================

Download Killbox

• Save it to your Desktop.
• In the event you already have Killbox, this is a new version that I need you to download.
• Double-click on Killbox.exe to run it.
• Select Delete on Reboot.
• Click on the All Files button.
• Copy the words below (inside the box) by left clicking and covering all the text then right click inside the highlighted area and choose Copy:
  
  

  C:\WINDOWS\SYSTEM32\windyi32.dll

• Return to Killbox, go to the File menu, and choose Paste from Clipboard.
• Click the Unregister .dll Before Deleting button.
• Click the red-and-white Delete File button. Click Yes when prompted to restart your computer.

NOTES :

• If your computer does not restart automatically, please restart it manually.
• If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run Killbox, click here to download and run missingfilesetup.exe. Then try Killbox again.

=====================================

Please open HijackThis, click Do a system scan only, and then place a checkmark beside each of these entries:

O4 - HKLM\..\Run: [LanzarL2007] "C:\DOCUME~1\~Freda~\LOCALS~1\Temp\{2F91F92E-D1F4-41C3-A360-A2B5BC5A2108}\{D1DA2BA7-2592-4036-9BB2-DCCABDE8DC1A}\..\..\L2007tmp\Setup.exe" /SETUP:"/l0x0009"
O20 - Winlogon Notify: windyi32 - C:\WINDOWS\SYSTEM32\windyi32.dll

After placing all the checkmarks, close all windows (except HJT), and then hit Fix Checked. When it finishes, exit HJT.

=====================================

Clear IE's Cookies and Cache

• Close all instances of Outlook Express and Internet Explorer.
• Go to Control Panel » Internet Options » General tab.
• Click the Delete Cookies.
• Next to it, Click the Delete Files button.
• When prompted, place a check in: Delete all offline content, click OK.

Clear Firefox' Cookies ( in case you also have the Firefox browser )

• Open Firefox.
• Click Tools » Options.
• Click the Privacy tab, then the Cookies tab.
• Click the Clear Cookies Now button.
• Then click OK to exit.

Clean Temporary Files

• Go to Start » Run » type: cleanmgr » OK.
• Choose (C:) and then click OK.
• Make sure these are the only ones that are checked :
  • Temporary Internet Files
  • Temporary Files
  • Recycle Bin
• Click OK to remove them.
• Click Yes to confirm the deletion.

=====================================

Update Java

• Download the latest version of Java Runtime Environment (JRE) 5.0 Update 8.
• Check the box that says: "Accept License Agreement".
• The page will refresh.
• Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
• Close any programs you may have running - especially your web browser.
• Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
• Check any item with Java Runtime Environment (JRE or J2SE) in the name.
• Click the Remove or Change/Remove button.
• Repeat as many times as necessary to remove each Java versions.
• Reboot your computer once all Java components are removed.
• Then from your desktop double-click on jre-1_5_0_08-windows-i586-p to install the newest version.

=====================================

Then post these:

1. new hijackthis log
2. vundofix' log

– Jet

Ok, to start I do know what the ZoneTick is. Thats a legit program that I use as an add on to my regular clock to enable me to see what time it is in the UK as my work is based out of the UK.

Ok, thanks for clearing that.

Let's continue..

You may want to print out these instructions or save it as a text document, and use them as a reference. If you have any questions regarding the fix, please ask us before proceeding. It is also important for you to don't miss a step and perform everything in the right order.

=====================================

I notice that you have SpySweeper running. While this is normally a wonderful tool to protect against hijackers, it can also interfere with HijackThis fixes. You can re-enable this when your computer is already clean.

Disable SpySweeper

• Click Options.
• Click Program Options.
• Uncheck Load at Windows Startup.
• Click Shields.
• Uncheck all items.
• Uncheck Home Page Shield.
• Uncheck Automaticly restore default without notification.

=====================================

Please go here to upload a suspicious file for analysis.

• Enter your username from this forum
• Copy and paste the link to this thread
• Browse for this filename: C:\WINDOWS\system32\iifgdab.dll in the first filename box
• Browse for this filename: C:\WINDOWS\system32\vtstu.dll in the second filename box
• In the comments, please mention that I asked you to upload this file
• Click on Send File

=====================================

Download SmitfraudFix (by S!Ri)

• Extract the content (a folder named SmitfraudFix) to your Desktop.
• Do not do anything with it yet.

=====================================

Uninstall Programs

• Click Start » Run » type: appwiz.cpl » OK
• Find and remove the following program(s) (if present):
  
  ToolBar888
  
  
• Close Add/Remove Programs window after uninstalling.

=====================================


Please open HijackThis, click Do a system scan only, and then place a checkmark beside each of these entries:

O2 - BHO: (no name) - {a43385f0-7113-496d-96d7-b9b550e3fcca} - C:\WINDOWS\system32\ixt0.dll (file missing)
O2 - BHO: (no name) - {A4F94C0C-54A7-4DB1-9AF3-B22E63D00322} - C:\WINDOWS\g984187.dll
O2 - BHO: ToolBar888 - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - C:\Program Files\ToolBar888\MyToolBar.dll
O3 - Toolbar: ToolBar888 - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - C:\Program Files\ToolBar888\MyToolBar.dll

After placing all the checkmarks, close all windows (except HJT), and then hit Fix Checked. When it finishes, exit HJT.

=====================================


Download win32delfkil.exe.
Save it on your desktop.
Double click on win32delfkil.exe and install it. This creates a new folder on your desktop: win32delfkil.
Close all windows, open the win32delfkil folder and double click on fix.bat.
The computer will reboot automatically.
Post the contents of the logfile c\windelf.txt later.

=====================================

Show Hidden Files and Folders

Click Start » My Computer » Tools » Folder Options. Select the View tab.

• Check - Show hidden files and folders
• Uncheck - Hide file extensions for known types
• Uncheck - Hide protected operating system files

Click Yes to confirm, then OK to exit.

=====================================

Reboot into Safe Mode

• Restart your computer.
• Before the Windows logo appear, tap F8 repeatedly.
• A menu should appear, select Safe Mode from the menu using your arrow keys and then hit Enter on your keyboard.
• This will take a while than usual, so just wait.

=====================================

Locate and delete the following folder(s), if present : C:\Program Files\Common Files\{4841AEDD-0BB8-1033-0914-050823200001}
C:\Program Files\ToolBar888
=====================================

• Click Start » Run » type: Notepad » OK
• Copy (Ctrl+C) and paste (Ctrl+V) the following text below (inside the box) to Notepad.
  
  

  REGEDIT4
  
  [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run]
  
  [-HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{4841AEDD-0BB8-1033-0914-050823200001}] 
  
  

• Save it as All Files and name it FixME.reg on your desktop.
• It's icon should look like this : [external image: Posted Image]
• Double click FixME.reg. It will ask you if you want to merge it to the registry, click Yes.

=====================================

Open the SmitfraudFix folder.

• Double-click smitfraudfix.cmd.
• Select option #2 - Clean by typing 2 and press Enter to delete infected files.
• You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing Y and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection.
• The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing Y and press "Enter".
• The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart it into Normal Windows.
• A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report into your next reply.
• The report can also be found here - C:\rapport.txt
• NOTE : running option #2 on a non infected computer will remove your Desktop background.

=====================================

Reboot into Safe Mode again, then:

• Double-click VundoFix.exe to run it.
• Right Click inside the listbox (white box) and click add more files
• Copy&Paste the 2 entries below into the top 2 boxes
  • C:\WINDOWS\system32\iifgdab.dll
  • C:\WINDOWS\system32\badgfii.*
• Click Add Files, then click add more files again.
• Copy&Paste the 2 entries below into the top 2 boxes
  • C:\WINDOWS\system32\vtstu.dll
  • C:\WINDOWS\system32\utstv.*
• Click Scan for Vundo button.
• Once it's done scanning, click the Remove Vundo button.
• You will receive a prompt asking if you want to remove the files, click YES
• Once you click yes, your desktop will go blank as it starts removing Vundo.
• When completed, it will prompt that it will shutdown your computer, click OK.
• Turn your computer back on.
• It will produce a log of it's actions at C:\vundofix.txt

=====================================

Your computer should be back on Normal mode now..

In your next reply, please include these log(s):

• HijackThis log (new)
• Smitfraudfix log
• Windelf log
• Vundofix log
  

Also, with the VUndo, it is still saying unable to remove the one iifgdab.dll and wants to do it on reboot, after rebooting, it was still unsuccesful as last time.

Ok, I think we need to try another tool for that file..

1. Download combofix.exe from one of these locations -

http://download.bleepingcomputer.com/sUBs/combofix.exe
http://www.techsupportforum.com/sectools/combofix.exe

2. Click Start » Run - then copy/paste this into the run box & click OK :

"%userprofile%\desktop\combofix.exe" /v vtstu iifgdab

3. When finished, it shall produce a log for you. Post that log in your next reply along with a new Hijackthis log.

NOTE : Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

Here is the log from the combofix: ~Freda~ - 06-09-08 23:34:30.55 ComboFix 06.09.07 - Running from: C:\Documents and Settings\[removed]\desktop Microsoft Windows XP [Version 5.1.2600] (((((((((((((((((((((((((((((((((((((((((((((((( Vundo Log ))))))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\system32\vtstu.dll C:\WINDOWS\system32\iifgdab.dll C:\WINDOWS\system32\utstv.bak2 C:\WINDOWS\system32\utstv.ini C:\WINDOWS\system32\utstv.ini2 C:\WINDOWS\system32\utstv.tmp * * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\system32\components ((((((((((((((((((((((((((((((( Files Created from 2006-08-08 to 2006-09-08 )))))))))))))))))))))))))))))))))) 2006-09-08 07:40 40,960 –a—— C:\WINDOWS\system32\swsc.exe 2006-09-08 07:40 288,417 –a—— C:\WINDOWS\system32\SrchSTS.exe 2006-09-08 07:40 135,168 –a—— C:\WINDOWS\system32\swreg.exe 2006-09-08 07:18 53,248 –a—— C:\WINDOWS\system32\process.exe 2006-09-08 07:18 4,096 –a—— C:\WINDOWS\system32\reboot.exe 2006-09-08 07:18 16,384 –a—— C:\WINDOWS\system32\restart.exe 2006-09-08 07:18 15,703 –a—— C:\delfiles.bat 2006-09-06 01:21 98,345 –a—— C:\WINDOWS\system32\IMHOST32.DLL 2006-09-06 01:21 339,968 –a—— C:\WINDOWS\system32\IMGMAN32.DLL 2006-09-06 01:21 32,768 –a—— C:\WINDOWS\system32\LXPRMON.DLL 2006-09-06 01:21 20,480 –a—— C:\WINDOWS\system32\LXPMONUI.DLL 2006-09-06 01:21 12,288 –a—— C:\WINDOWS\system32\LXPMONRC.DLL 2006-09-06 01:13 65,536 -ra—— C:\WINDOWS\system32\lxcccfg.dll 2006-09-06 00:36 35,587 ——— C:\WINDOWS\system32\rmusb20.EXE 2006-09-06 00:36 28,672 ——— C:\WINDOWS\system32\Unusb20.exe 2006-09-06 00:30 87,040 –a—— C:\WINDOWS\system32\wiafbdrv.dll 2006-09-04 17:47 86,016 –a—— C:\WINDOWS\unvise32.exe 2006-09-04 15:38 57,344 –a—— C:\WINDOWS\Unwash6.exe 2006-09-04 15:38 486,400 –a—— C:\WINDOWS\system32\wwSecure.exe 2006-09-04 01:42 78,378 –a—— C:\WINDOWS\g984187.dll 2006-09-02 20:31 221,184 –a—— C:\WINDOWS\system32\wmpns.dll 2006-09-02 00:27 610 –a—— C:\WINDOWS\system32\wun32.dll 2006-09-02 00:14 24,816 –a—— C:\WINDOWS\system32\mdimon.dll 2006-09-01 22:05 721,168 –a—— C:\WINDOWS\system32\VB40032.DLL 2006-09-01 20:51 22,752 –a—— C:\WINDOWS\system32\spupdsvc.exe 2006-09-01 20:50 87,808 –a—— C:\WINDOWS\system32\S32EVNT1.DLL 2006-09-01 19:26 163,840 –a—— C:\WINDOWS\system32\igfxres.dll 2006-09-01 19:15 9,766,400 –a—— C:\WINDOWS\RTLCPL.EXE 2006-09-01 19:15 8,376,832 ——— C:\WINDOWS\RTHDCPL.exe 2006-09-01 19:15 77,824 –a—— C:\WINDOWS\SOUNDMAN.EXE 2006-09-01 19:15 57,344 –a—— C:\WINDOWS\ALCMTR.EXE 2006-09-01 19:15 40,960 –a—— C:\WINDOWS\system32\ChCfg.exe 2006-09-01 19:15 2,748,928 –a—— C:\WINDOWS\ALCWZRD.EXE 2006-09-01 19:15 156,672 –a—— C:\WINDOWS\system32\RTLCPAPI.dll 2006-09-01 19:13 879,226 –a—— C:\WINDOWS\system32\ialmdd5.dll 2006-09-01 19:13 86,016 –a—— C:\WINDOWS\system32\igfxdo.dll 2006-09-01 19:13 61,440 –a—— C:\WINDOWS\system32\iAlmCoIn_v4250.dll 2006-09-01 19:13 516,096 –a—— C:\WINDOWS\system32\ialmgdev.dll 2006-09-01 19:13 503,808 –a—— C:\WINDOWS\system32\igfxcfg.exe 2006-09-01 19:13 49,152 –a—— C:\WINDOWS\system32\ialmrem.dll 2006-09-01 19:13 45,056 –a—— C:\WINDOWS\system32\igfxdgps.dll 2006-09-01 19:13 38,014 –a—— C:\WINDOWS\system32\ialmrnt5.dll 2006-09-01 19:13 36,864 –a—— C:\WINDOWS\system32\igfxexps.dll 2006-09-01 19:13 348,160 –a—— C:\WINDOWS\system32\igfxsrvc.dll 2006-09-01 19:13 225,280 –a—— C:\WINDOWS\system32\igfxpph.dll 2006-09-01 19:13 225,280 –a—— C:\WINDOWS\system32\igfxeud.dll 2006-09-01 19:13 2,289,664 –a—— C:\WINDOWS\system32\ialmgicd.dll 2006-09-01 19:13 178,842 –a—— C:\WINDOWS\system32\ialmdev5.dll 2006-09-01 19:13 155,648 –a—— C:\WINDOWS\system32\igfxtray.exe 2006-09-01 19:13 151,552 –a—— C:\WINDOWS\system32\igfxdiag.exe 2006-09-01 19:13 139,264 –a—— C:\WINDOWS\system32\igfxdev.dll 2006-09-01 19:13 126,976 –a—— C:\WINDOWS\system32\igfxhk.dll 2006-09-01 19:13 126,976 –a—— C:\WINDOWS\system32\hkcmd.exe 2006-09-01 19:13 118,784 –a—— C:\WINDOWS\system32\hccutils.dll 2006-09-01 19:13 114,688 –a—— C:\WINDOWS\system32\igfxzoom.exe 2006-09-01 19:13 108,155 –a—— C:\WINDOWS\system32\ialmdnt5.dll 2006-09-01 19:13 106,496 –a—— C:\WINDOWS\system32\igfxext.exe 2006-09-01 19:13 1,245,184 –a—— C:\WINDOWS\system32\igfxress.dll 2006-09-01 19:12 88,363 –a—— C:\WINDOWS\AGRSMMSG.exe 2006-09-01 19:12 64,512 –a—— C:\WINDOWS\agrsmdel.exe 2006-09-01 19:12 4,096 –a—— C:\WINDOWS\system32\ksuser.dll 2006-09-01 17:27 112,128 –a—— C:\WINDOWS\system32\mapi32.dll 2006-09-01 17:27 0 -rahs—- C:\MSDOS.SYS 2006-09-01 17:27 0 -rahs—- C:\IO.SYS 2006-09-01 17:27 0 –a—— C:\CONFIG.SYS 2006-09-01 17:27 0 –a—— C:\AUTOEXEC.BAT 2006-09-01 17:26 11,264 –a—— C:\WINDOWS\system32\atrace.dll 2006-09-01 17:25 81,920 –a—— C:\WINDOWS\system32\isign32.dll 2006-09-01 17:25 81,920 –a—— C:\WINDOWS\system32\ils.dll 2006-09-01 17:25 8,192 –a—— C:\WINDOWS\system32\bitsprx2.dll 2006-09-01 17:25 73,728 –a—— C:\WINDOWS\system32\icwdial.dll 2006-09-01 17:25 7,168 –a—— C:\WINDOWS\system32\bitsprx3.dll 2006-09-01 17:25 69,632 –a—— C:\WINDOWS\system32\msconf.dll 2006-09-01 17:25 679,424 –a—— C:\WINDOWS\system32\inetcomm.dll 2006-09-01 17:25 67,584 –a—— C:\WINDOWS\system32\srclient.dll 2006-09-01 17:25 65,536 –a—— C:\WINDOWS\system32\icwphbk.dll 2006-09-01 17:25 64,512 –a—— C:\WINDOWS\system32\acctres.dll 2006-09-01 17:25 6,656 –a—— C:\WINDOWS\system32\wuauserv.dll 2006-09-01 17:25 48,128 –a—— C:\WINDOWS\system32\inetres.dll 2006-09-01 17:25 465,176 –a—— C:\WINDOWS\system32\wuapi.dll 2006-09-01 17:25 45,568 –a—— C:\WINDOWS\system32\safrslv.dll 2006-09-01 17:25 43,520 –a—— C:\WINDOWS\system32\safrcdlg.dll 2006-09-01 17:25 43,520 –a—— C:\WINDOWS\system32\racpldlg.dll 2006-09-01 17:25 41,240 –a—— C:\WINDOWS\system32\wups.dll 2006-09-01 17:25 382,464 –a—— C:\WINDOWS\system32\qmgr.dll 2006-09-01 17:25 34,560 –a—— C:\WINDOWS\system32\mnmdd.dll 2006-09-01 17:25 32,768 –a—— C:\WINDOWS\system32\mnmsrvc.exe 2006-09-01 17:25 32,768 –a—— C:\WINDOWS\system32\isrdbg32.dll 2006-09-01 17:25 29,696 –a—— C:\WINDOWS\system32\safrdm.dll 2006-09-01 17:25 28,672 –a—— C:\WINDOWS\system32\nmmkcert.dll 2006-09-01 17:25 274,944 –a—— C:\WINDOWS\system32\mstask.dll 2006-09-01 17:25 274,432 –a—— C:\WINDOWS\system32\inetcfg.dll 2006-09-01 17:25 252,928 –a—— C:\WINDOWS\system32\msoeacct.dll 2006-09-01 17:25 239,104 –a—— C:\WINDOWS\system32\srrstr.dll 2006-09-01 17:25 22,528 –a—— C:\WINDOWS\system32\fltMc.exe 2006-09-01 17:25 194,328 –a—— C:\WINDOWS\system32\wuaueng1.dll 2006-09-01 17:25 190,976 –a—— C:\WINDOWS\system32\schedsvc.dll 2006-09-01 17:25 18,944 –a—— C:\WINDOWS\system32\qmgrprxy.dll 2006-09-01 17:25 173,536 –a—— C:\WINDOWS\system32\wuweb.dll 2006-09-01 17:25 172,312 –a—— C:\WINDOWS\system32\wuauclt1.exe 2006-09-01 17:25 170,496 –a—— C:\WINDOWS\system32\srsvc.dll 2006-09-01 17:25 16,896 –a—— C:\WINDOWS\system32\fltlib.dll 2006-09-01 17:25 16,384 –a—— C:\WINDOWS\system32\icfgnt5.dll 2006-09-01 17:25 127,256 –a—— C:\WINDOWS\system32\wucltui.dll 2006-09-01 17:25 124,184 –a—— C:\WINDOWS\system32\wuauclt.exe 2006-09-01 17:25 12,288 –a—— C:\WINDOWS\system32\nmevtmsg.dll 2006-09-01 17:25 12,288 –a—— C:\WINDOWS\system32\mstinit.exe 2006-09-01 17:25 105,984 –a—— C:\WINDOWS\system32\msoert2.dll 2006-09-01 17:25 1,343,768 –a—— C:\WINDOWS\system32\wuaueng.dll 2006-09-01 17:24 5,632 –a—— C:\WINDOWS\system32\write.exe 2006-09-01 17:23 97,792 –a—— C:\WINDOWS\system32\comrepl.dll 2006-09-01 17:23 956,416 –a—— C:\WINDOWS\system32\msdtctm.dll 2006-09-01 17:23 93,696 –a—— C:\WINDOWS\system32\tscfgwmi.dll 2006-09-01 17:23 91,136 –a—— C:\WINDOWS\system32\mtxoci.dll 2006-09-01 17:23 9,728 –a—— C:\WINDOWS\system32\reset.exe 2006-09-01 17:23 87,176 –a—— C:\WINDOWS\system32\rdpwsx.dll 2006-09-01 17:23 85,504 –a—— C:\WINDOWS\system32\catsrvps.dll 2006-09-01 17:23 80,384 –a—— C:\WINDOWS\system32\charmap.exe 2006-09-01 17:23 73,216 –a—— C:\WINDOWS\system32\avwav.dll 2006-09-01 17:23 67,072 –a—— C:\WINDOWS\system32\rdshost.exe 2006-09-01 17:23 655,360 –a—— C:\WINDOWS\system32\mstscax.dll 2006-09-01 17:23 625,152 –a—— C:\WINDOWS\system32\catsrvut.dll 2006-09-01 17:23 62,464 –a—— C:\WINDOWS\system32\rdpclip.exe 2006-09-01 17:23 605,696 –a—— C:\WINDOWS\system32\getuname.dll 2006-09-01 17:23 60,416 –a—— C:\WINDOWS\system32\remotepg.dll 2006-09-01 17:23 60,416 –a—— C:\WINDOWS\system32\colbact.dll 2006-09-01 17:23 6,144 –a—— C:\WINDOWS\system32\msdtc.exe 2006-09-01 17:23 58,880 –a—— C:\WINDOWS\system32\msdtclog.dll 2006-09-01 17:23 56,832 –a—— C:\WINDOWS\system32\sol.exe 2006-09-01 17:23 55,296 –a—— C:\WINDOWS\system32\freecell.exe 2006-09-01 17:23 540,160 –a—— C:\WINDOWS\system32\comuid.dll 2006-09-01 17:23 54,272 –a—— C:\WINDOWS\system32\stclient.dll 2006-09-01 17:23 538,624 –a—— C:\WINDOWS\system32\spider.exe 2006-09-01 17:23 5,120 –a—— C:\WINDOWS\system32\dcomcnfg.exe 2006-09-01 17:23 498,688 –a—— C:\WINDOWS\system32\clbcatq.dll 2006-09-01 17:23 44,544 –a—— C:\WINDOWS\system32\tscupgrd.exe 2006-09-01 17:23 44,544 –a—— C:\WINDOWS\system32\hticons.dll 2006-09-01 17:23 426,496 –a—— C:\WINDOWS\system32\msdtcprx.dll 2006-09-01 17:23 407,552 –a—— C:\WINDOWS\system32\mstsc.exe 2006-09-01 17:23 4,096 –a—— C:\WINDOWS\system32\rdpcfgex.dll 2006-09-01 17:23 4,096 –a—— C:\WINDOWS\system32\mtxex.dll 2006-09-01 17:23 38,912 –a—— C:\WINDOWS\system32\cfgbkend.dll 2006-09-01 17:23 35,328 –a—— C:\WINDOWS\system32\winchat.exe 2006-09-01 17:23 347,136 –a—— C:\WINDOWS\system32\hypertrm.dll 2006-09-01 17:23 343,040 –a—— C:\WINDOWS\system32\mspaint.exe 2006-09-01 17:23 33,792 –a—— C:\WINDOWS\system32\regini.exe 2006-09-01 17:23 295,424 –a—— C:\WINDOWS\system32\termsrv.dll 2006-09-01 17:23 25,600 –a—— C:\WINDOWS\system32\comaddin.dll 2006-09-01 17:23 25,088 –a—— C:\WINDOWS\system32\mtxlegih.dll 2006-09-01 17:23 227,840 –a—— C:\WINDOWS\system32\avtapi.dll 2006-09-01 17:23 225,792 –a—— C:\WINDOWS\system32\catsrv.dll 2006-09-01 17:23 22,016 –a—— C:\WINDOWS\system32\qwinsta.exe 2006-09-01 17:23 20,992 –a—— C:\WINDOWS\system32\msg.exe 2006-09-01 17:23 20,480 –a—— C:\WINDOWS\system32\qprocess.exe 2006-09-01 17:23 20,480 –a—— C:\WINDOWS\system32\mtxdm.dll 2006-09-01 17:23 19,968 –a—— C:\WINDOWS\system32\rdpsnd.dll 2006-09-01 17:23 183,808 –a—— C:\WINDOWS\system32\accwiz.exe 2006-09-01 17:23 161,280 –a—— C:\WINDOWS\system32\msdtcuiu.dll 2006-09-01 17:23 16,896 –a—— C:\WINDOWS\system32\tsshutdn.exe 2006-09-01 17:23 16,896 –a—— C:\WINDOWS\system32\qappsrv.exe 2006-09-01 17:23 16,384 –a—— C:\WINDOWS\system32\tskill.exe 2006-09-01 17:23 16,384 –a—— C:\WINDOWS\system32\avmeter.dll 2006-09-01 17:23 15,872 –a—— C:\WINDOWS\system32\rwinsta.exe 2006-09-01 17:23 15,872 –a—— C:\WINDOWS\system32\cdmodem.dll 2006-09-01 17:23 15,360 –a—— C:\WINDOWS\system32\logoff.exe 2006-09-01 17:23 147,968 –a—— C:\WINDOWS\system32\rdchost.dll 2006-09-01 17:23 147,456 –a—— C:\WINDOWS\system32\comsnap.dll 2006-09-01 17:23 140,800 –a—— C:\WINDOWS\system32\sessmgr.exe 2006-09-01 17:23 14,848 –a—— C:\WINDOWS\system32\tsdiscon.exe 2006-09-01 17:23 14,848 –a—— C:\WINDOWS\system32\tscon.exe 2006-09-01 17:23 14,848 –a—— C:\WINDOWS\system32\shadow.exe 2006-09-01 17:23 138,752 –a—— C:\WINDOWS\system32\sndvol32.exe 2006-09-01 17:23 131,584 –a—— C:\WINDOWS\system32\sndrec32.exe 2006-09-01 17:23 13,824 –a—— C:\WINDOWS\system32\rdsaddin.exe 2006-09-01 17:23 126,976 –a—— C:\WINDOWS\system32\mshearts.exe 2006-09-01 17:23 123,392 –a—— C:\WINDOWS\system32\mplay32.exe 2006-09-01 17:23 119,808 –a—— C:\WINDOWS\system32\winmine.exe 2006-09-01 17:23 114,688 –a—— C:\WINDOWS\system32\calc.exe 2006-09-01 17:23 110,080 –a—— C:\WINDOWS\system32\clbcatex.dll 2006-09-01 17:23 11,776 –a—— C:\WINDOWS\system32\xolehlp.dll 2006-09-01 17:23 11,264 –a—— C:\WINDOWS\system32\icaapi.dll 2006-09-01 17:23 102,912 –a—— C:\WINDOWS\system32\clipbrd.exe 2006-09-01 17:23 1,267,200 –a—— C:\WINDOWS\system32\comsvcs.dll 2006-09-01 17:23 1,161 –a—— C:\WINDOWS\system32\usrlogon.cmd 2006-09-01 17:22 58,880 –a—— C:\WINDOWS\system32\licwmi.dll 2006-09-01 17:22 56,320 –a—— C:\WINDOWS\system32\servdeps.dll 2006-09-01 17:22 185,344 –a—— C:\WINDOWS\system32\cmprops.dll 2006-09-01 17:22 17,408 –a—— C:\WINDOWS\system32\mmfutil.dll 2006-09-01 13:17 74,240 –a—— C:\WINDOWS\system32\usbui.dll 2006-09-01 13:16 85,020 –a—— C:\WINDOWS\system32\dgsetup.dll 2006-09-01 13:16 8,704 –a—— C:\WINDOWS\system32\batt.dll 2006-09-01 13:16 8,192 -ra—— C:\WINDOWS\system32\kbdhept.dll 2006-09-01 13:16 74,752 –a—— C:\WINDOWS\system32\storprop.dll 2006-09-01 13:16 7,168 -ra—— C:\WINDOWS\system32\kbdcz.dll 2006-09-01 13:16 69,120 –a—— C:\WINDOWS\NOTEPAD.EXE 2006-09-01 13:16 6,656 -ra—— C:\WINDOWS\system32\kbdycl.dll 2006-09-01 13:16 6,656 -ra—— C:\WINDOWS\system32\kbdsl1.dll 2006-09-01 13:16 6,656 -ra—— C:\WINDOWS\system32\kbdsl.dll 2006-09-01 13:16 6,656 -ra—— C:\WINDOWS\system32\kbdpl.dll 2006-09-01 13:16 6,656 -ra—— C:\WINDOWS\system32\kbdhu.dll 2006-09-01 13:16 6,656 -ra—— C:\WINDOWS\system32\kbdhela3.dll 2006-09-01 13:16 6,656 -ra—— C:\WINDOWS\system32\kbdcz2.dll 2006-09-01 13:16 6,656 -ra—— C:\WINDOWS\system32\kbdcz1.dll 2006-09-01 13:16 6,656 -ra—— C:\WINDOWS\system32\kbdcr.dll 2006-09-01 13:16 6,656 -ra—— C:\WINDOWS\system32\KBDAL.DLL 2006-09-01 13:16 6,144 -ra—— C:\WINDOWS\system32\kbdtuq.dll 2006-09-01 13:16 6,144 -ra—— C:\WINDOWS\system32\kbdtuf.dll 2006-09-01 13:16 6,144 -ra—— C:\WINDOWS\system32\kbdlv1.dll 2006-09-01 13:16 6,144 -ra—— C:\WINDOWS\system32\kbdlv.dll 2006-09-01 13:16 6,144 -ra—— C:\WINDOWS\system32\kbdhela2.dll 2006-09-01 13:16 6,144 -ra—— C:\WINDOWS\system32\kbdgkl.dll 2006-09-01 13:16 6,144 -ra—— C:\WINDOWS\system32\kbdest.dll 2006-09-01 13:16 5,632 -ra—— C:\WINDOWS\system32\kbdycc.dll 2006-09-01 13:16 5,632 -ra—— C:\WINDOWS\system32\kbduzb.dll 2006-09-01 13:16 5,632 -ra—— C:\WINDOWS\system32\kbdur.dll 2006-09-01 13:16 5,632 -ra—— C:\WINDOWS\system32\kbdtat.dll 2006-09-01 13:16 5,632 -ra—— C:\WINDOWS\system32\kbdru1.dll 2006-09-01 13:16 5,632 -ra—— C:\WINDOWS\system32\kbdru.dll 2006-09-01 13:16 5,632 -ra—— C:\WINDOWS\system32\kbdro.dll 2006-09-01 13:16 5,632 -ra—— C:\WINDOWS\system32\kbdpl1.dll 2006-09-01 13:16 5,632 -ra—— C:\WINDOWS\system32\kbdmon.dll 2006-09-01 13:16 5,632 -ra—— C:\WINDOWS\system32\kbdlt1.dll 2006-09-01 13:16 5,632 -ra—— C:\WINDOWS\system32\kbdlt.dll 2006-09-01 13:16 5,632 -ra—— C:\WINDOWS\system32\kbdkyr.dll 2006-09-01 13:16 5,632 -ra—— C:\WINDOWS\system32\kbdkaz.dll 2006-09-01 13:16 5,632 -ra—— C:\WINDOWS\system32\kbdhu1.dll 2006-09-01 13:16 5,632 -ra—— C:\WINDOWS\system32\kbdhe319.dll 2006-09-01 13:16 5,632 -ra—— C:\WINDOWS\system32\kbdhe220.dll 2006-09-01 13:16 5,632 -ra—— C:\WINDOWS\system32\kbdhe.dll 2006-09-01 13:16 5,632 -ra—— C:\WINDOWS\system32\kbdbu.dll 2006-09-01 13:16 5,632 -ra—— C:\WINDOWS\system32\kbdblr.dll 2006-09-01 13:16 5,632 -ra—— C:\WINDOWS\system32\kbdazel.dll 2006-09-01 13:16 5,632 -ra—— C:\WINDOWS\system32\kbdaze.dll 2006-09-01 13:16 24,661 –a—— C:\WINDOWS\system32\spxcoins.dll 2006-09-01 13:16 176,157 –a—— C:\WINDOWS\system32\dgrpsetu.dll 2006-09-01 13:16 15,360 –a—— C:\WINDOWS\TASKMAN.EXE 2006-09-01 13:16 13,312 –a—— C:\WINDOWS\system32\irclass.dll 2006-09-01 13:16 103,424 –a—— C:\WINDOWS\system32\EqnClass.Dll (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-09-08 19:50 ——– d——– C:\Program Files\Common Files\Symantec Shared 2006-09-08 08:56 ——– d——– C:\Program Files\Wake up News 2006-09-08 08:38 ——– d——– C:\Program Files\Lx_cats 2006-09-08 08:38 ——– d——– C:\Documents and Settings\~Freda~\Application Data\FaxCtr 2006-09-08 08:37 ——– d——– C:\Program Files\Abbyy FineReader 6.0 Sprint 2006-09-08 07:37 ——– d——– C:\Program Files\Common Files 2006-09-07 19:44 ——– dr-h—– C:\Documents and Settings\~Freda~\Application Data\yahoo! 2006-09-07 17:36 ——– d——– C:\Program Files\QuickTime 2006-09-07 17:26 ——– d——– C:\Documents and Settings\~Freda~\Application Data\LimeWire 2006-09-07 17:25 ——– d——– C:\Program Files\BearShare 2006-09-07 01:55 ——– d——– C:\Program Files\WinMX 2006-09-06 16:33 ——– d——– C:\Program Files\Java 2006-09-06 16:32 ——– d——– C:\Program Files\Common Files\Java 2006-09-06 16:31 ——– d——– C:\Program Files\Norton Internet Security 2006-09-06 16:02 ——– d——– C:\Program Files\Lexmark 3300 Series 2006-09-06 01:21 ——– d——– C:\Program Files\Lexmark Fax Solutions 2006-09-06 00:57 ——– d——– C:\Program Files\Common Files\Sony Shared 2006-09-06 00:56 ——– d–h—– C:\Program Files\InstallShield Installation Information 2006-09-04 17:30 ——– d——– C:\Program Files\MessengerPlus! 3 2006-09-04 17:26 ——– d——– C:\Program Files\Font Xplorer Lite 2006-09-04 17:26 ——– d——– C:\Documents and Settings\~Freda~\Application Data\Help 2006-09-04 15:39 ——– d——– C:\Program Files\Webroot 2006-09-04 15:39 ——– d——– C:\Program Files\Common Files\Webroot Shared 2006-09-04 15:39 ——– d——– C:\Documents and Settings\~Freda~\Application Data\Webroot 2006-09-04 15:10 ——– d——– C:\Program Files\Symantec 2006-09-04 15:01 ——– d——– C:\Documents and Settings\~Freda~\Application Data\Symantec 2006-09-04 14:54 4608 –a—— C:\WINDOWS\system32\drivers\symlcbrd.sys 2006-09-04 14:42 ——– d——– C:\Program Files\SymNetDrv 2006-09-04 02:41 ——– d——– C:\Program Files\Common Files\Microsoft Shared 2006-09-04 02:28 ——– d——– C:\Program Files\Common Files\tooooo 2006-09-04 01:42 ——– d——– C:\Documents and Settings\~Freda~\Application Data\Sun 2006-09-04 00:23 ——– d——– C:\Program Files\Common Files\InstallShield 2006-09-04 00:14 ——– d——– C:\Program Files\ZoneTick 2006-09-04 00:14 ——– d——– C:\Program Files\Internet Explorer 2006-09-03 16:20 ——– d—s—- C:\Documents and Settings\~Freda~\Application Data\Microsoft 2006-09-03 10:25 ——– d——– C:\Program Files\InfoProcess 2006-09-02 23:14 ——– d——– C:\Program Files\Pando Networks 2006-09-02 21:53 ——– d——– C:\Program Files\Unlocker 2006-09-02 18:23 ——– d——– C:\Program Files\OfficeUpdate11 2006-09-02 00:25 ——– d——– C:\Documents and Settings\~Freda~\Application Data\Jasc 2006-09-02 00:22 ——– d——– C:\Program Files\Messenger 2006-09-02 00:13 ——– d——– C:\Program Files\Microsoft.NET 2006-09-02 00:13 ——– d——– C:\Program Files\Microsoft Office 2006-09-02 00:13 ——– d——– C:\Program Files\Microsoft ActiveSync 2006-09-02 00:13 ——– d——– C:\Program Files\Common Files\DESIGNER 2006-09-02 00:12 ——– d——– C:\Program Files\Common Files\System 2006-09-01 23:18 ——– d——– C:\Program Files\Jasc Software Inc 2006-09-01 23:18 ——– d——– C:\Documents and Settings\~Freda~\Application Data\Jasc Software Inc 2006-09-01 22:48 ——– d——– C:\Program Files\Lavasoft 2006-09-01 22:48 ——– d——– C:\Documents and Settings\~Freda~\Application Data\Lavasoft 2006-09-01 22:45 ——– d——– C:\Program Files\RegCleaner 2006-09-01 22:39 ——– d——– C:\Program Files\MSN Messenger 2006-09-01 21:19 ——– d——– C:\Program Files\Windows Media Player 2006-09-01 21:16 ——– d——– C:\Program Files\Outlook Express 2006-09-01 21:16 ——– d——– C:\Documents and Settings\~Freda~\Application Data\Macromedia 2006-09-01 21:15 ——– d——– C:\Program Files\IncrediMail 2006-09-01 20:46 ——– d——– C:\Program Files\ExtractNow 2006-09-01 19:15 ——– d——– C:\Program Files\Realtek 2006-09-01 19:14 ——– d——– C:\Program Files\Intel 2006-09-01 17:32 ——– d–h—– C:\Program Files\Uninstall Information 2006-09-01 17:32 ——– d——– C:\Documents and Settings\~Freda~\Application Data\Identities 2006-09-01 17:28 ——– d——– C:\Program Files\xerox 2006-09-01 17:28 ——– d——– C:\Program Files\microsoft frontpage 2006-09-01 17:26 ——– d–h—– C:\Program Files\WindowsUpdate 2006-09-01 17:25 ——– d——– C:\Program Files\NetMeeting 2006-09-01 17:25 ——– d——– C:\Program Files\Movie Maker 2006-09-01 17:25 ——– d——– C:\Program Files\Common Files\Services 2006-09-01 17:25 ——– d——– C:\Program Files\Common Files\MSSoap 2006-09-01 17:24 ——– d——– C:\Program Files\MSN Gaming Zone 2006-09-01 17:24 ——– d——– C:\Program Files\ComPlus Applications 2006-09-01 17:23 ——– d——– C:\Program Files\Windows NT 2006-09-01 17:23 ——– d——– C:\Program Files\MSN 2006-09-01 13:16 ——– d——– C:\Program Files\Common Files\SpeechEngines 2006-09-01 13:16 ——– d——– C:\Program Files\Common Files\ODBC 2006-09-01 13:15 62 –ahs—- C:\Documents and Settings\~Freda~\Application Data\desktop.ini 2006-08-03 19:33 15360 –a—— C:\WINDOWS\system32\drivers\sshrmd.sys 2006-08-03 19:33 14848 –a—— C:\WINDOWS\system32\drivers\sskbfd.sys 2006-08-03 19:33 13824 –a—— C:\WINDOWS\system32\drivers\SSFS0509.sys 2006-08-03 19:33 117248 –a—— C:\WINDOWS\system32\drivers\ssidrv.sys 2006-07-22 18:41 98304 –a—— C:\CDSTART.EXE 2006-07-21 04:24 72704 –a—— C:\WINDOWS\system32\hlink.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\"" "MessengerPlus3"="\"C:\\Program Files\\MessengerPlus! 3\\MsgPlus.exe\"" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS] "Installed"="1" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ZoneTick"="C:\\Program Files\\ZoneTick\\zonetick.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000000 [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run] [HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="" "hkey"="HKLM" "command"="" "inimapping"="0" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\Pando] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="Pando" "hkey"="HKLM" "command"="\"C:\\Program Files\\Pando Networks\\Pando\\Pando.exe\" /Automation" "inimapping"="0" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\SpySweeper] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="SpySweeperUI" "hkey"="HKLM" "command"="\"C:\\Program Files\\Webroot\\Spy Sweeper\\SpySweeperUI.exe\" /startintray" "inimapping"="0" HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\WebrootSpySweeperService Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\Norton AntiVirus - Scan my computer - ~Freda~.job Completion time: Fri 09/08/2006 23:36:43.95 ComboFix.txt

Can you post a new hijackthis log please?

Good, we nailed it!

Let's make sure nothing was left..

Run an online scan at Panda's ActiveScan

• Please go here using Internet Explorer.
• Once you are on the Panda site click the Scan your PC button.
• A new window will open, click the big Check Now button.
  • Enter your Country.
  • Enter your State/Province.
  • Enter your e-mail address and click send.
  • Select either Home User or Company.
  • Click the big Scan Now button.
• If it wants to install an ActiveX component allow it.
• It will start downloading the files it requires for the scan.
• When the download is complete, click on My Computer to start the scan.
• When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location.
• Post that report along with a new Hijackthis log.