LDTate,
Sorry. I forgot to save the log. I did find this however. Hopefully it will help.
Spy Cookie: atlas dmt cookie
Spy Cookie: falkag cookie
Spy Cookie: realmedia cookie
Spy Cookie: trafficmp cookie
Spy Cookie: yieldmanager cookie
Trojan Horse: trojan agent winlogonhook
* Download
Combofix to your desktop.
Doubleclick
combo.exe
Follow the prompts.
Don't click on the window while the fix is running, because that will cause your system to hang.
When finished, it should produce a log, combofix.txt.
Post this log in your next reply together with a new hijackthislog.
LDTate,
Download Pocket Killbox
http://www.atribune.org/downloads/KillBox.exe
If you already have Killbox first ensure it is this version !.
Then double-click on the killbox.exe program.
Start Killbox and click on Tools->Delete Temp Files.
Then select the option labeled
Delete on reboot.
Do not close killbox, and open
notepad , by clicking on Start, then Run, and typing notepad.exe and pressing the OK button.
When notepad is open,
copy and paste the following
bolded text into the notepad screen. You do this by highlighting each of the below bolded filenames and then pressing
Control-C on your keyboard. Then click on the open notepad windows and press
Control-V to paste the contents into the notepad.
Return to Killbox, go to the File menu and select
Paste from Clipboard.
Still in Killbox, click the
red-and-white Delete File button. Click
Yes at the Delete on Reboot prompt. Click No at the Pending Operations prompt.
If your computer does not restart automatically, please restart it manually
"copy/paste" a new log file into this thread.
Also please describe how your computer behaves at the moment.
LDTate,
lets see if this will help speed it up.Backup your Registry… IMPORTANT: make sure to set the export range to ALL NOTE: To be extra safe you can choose to only remove the items in RED.
LDTate,
I have not done anything with Regseeker yet, but i am now getting a message from windows saying that it has to stop a data execution process. Also, I am still getting popups from winantivirus pro.
Open the HijackThis Folder. Find the file HijackThis.exe , Right Click on the file and Select Rename . Rename Hijackthis.exe to Spyware.exe.
Here is the new log.
You need To
disable SpySweeper, it can stop our fix.
SpySweeper
To disable SpySweeper Shields
Open SpySweeper. Click Shield Settings on the rightShields on the left, depending what screen you're on). Click Internet Explorer and uncheck all items. Click Windows System and uncheck all items. Click Hosts File and uncheck all items. Click Startup Programs and uncheck all items. Close SpySweeper.After all of the fixes are complete it is very important that you enable Real-time Protection again.
Doubleclick
combo.exe
Follow the prompts.
Don't click on the window while the fix is running, because that will cause your system to hang.
When finished, it should produce a log, combofix.txt.
Post this log in your next reply together with a new hijackthislog.
LDTate,
Here is th log.
FCPS - 06-10-01 10:58:30.08 Service Pack 2
ComboFix 06.09.25 - Running from: "C:\Documents and Settings\FCPS\Desktop"
((((((((((((((((((((((((((((((( Files Created from 2006-09-01 to 2006-10-01 ))))))))))))))))))))))))))))))))))
2006-09-26 22:27 850,094 —hs—- C:\WINNT\system32\ccccf.ini2
2006-09-26 14:55 45,525 –a—— C:\WINNT\system32\brkipmva.dll
2006-09-25 19:51 45,525 –a—— C:\WINNT\system32\knqkcelv.dll
2006-09-17 22:38 53,248 –a—— C:\WINNT\system32\Process.exe
2006-09-17 22:38 40,960 –a—— C:\WINNT\system32\swsc.exe
2006-09-17 22:38 288,417 –a—— C:\WINNT\system32\SrchSTS.exe
2006-09-17 22:38 135,168 –a—— C:\WINNT\system32\swreg.exe
2006-09-16 15:17 845,772 —hs—- C:\WINNT\system32\ccccf.bak2
2006-09-14 18:56 822,095 —hs—- C:\WINNT\system32\ccccf.bak1
2006-09-14 18:56 577,588 —hs—- C:\WINNT\system32\fcccc.dll
(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))
2006-10-01 10:48 ——– d——– C:\Program Files\Common Files\Symantec Shared
2006-10-01 10:46 ——– d-a—— C:\Program Files\Common Files
2006-10-01 10:46 ——– d——– C:\Program Files\Steam
2006-09-26 10:03 ——– d——– C:\Program Files\ewido anti-spyware 4.0
2006-09-25 14:41 ——– d——– C:\Program Files\VSToolbar
2006-09-24 22:26 ——– d——– C:\Program Files\AIM
2006-09-24 22:26 ——– d——– C:\Documents and Settings\FCPS\Application Data\Aim
2006-09-24 22:24 ——– d——– C:\Program Files\Viewpoint
2006-09-24 22:24 ——– d——– C:\Program Files\AOD
2006-09-23 18:00 ——– d——– C:\Program Files\Webroot
2006-09-23 18:00 ——– d——– C:\Documents and Settings\FCPS\Application Data\Webroot
2006-09-11 19:05 ——– d——– C:\Program Files\WinAce
2006-09-05 19:56 ——– d——– C:\Program Files\GameSpy Arcade
2006-08-30 19:40 ——– d——– C:\Program Files\Microsoft Games
2006-08-21 08:21 16896 –a—— C:\WINNT\system32\fltlib.dll
2006-08-21 05:14 23040 –a—— C:\WINNT\system32\fltmc.exe
2006-08-21 05:14 128896 –a—— C:\WINNT\system32\drivers\fltmgr.sys
2006-08-12 02:13 ——– d——– C:\Program Files\Internet Explorer
2006-08-09 02:36 ——– d——– C:\Program Files\Zinio
2006-08-09 02:35 ——– d——– C:\Documents and Settings\FCPS\Application Data\ContentGuard
2006-08-09 02:28 ——– d——– C:\Program Files\Common Files\Zinio
2006-08-03 01:55 ——– d——– C:\Program Files\Java
2006-08-03 01:53 ——– d——– C:\Program Files\Common Files\Java
2006-08-03 01:50 ——– d–h—– C:\Program Files\InstallShield Installation Information
2006-08-03 01:49 ——– d——– C:\Program Files\WinImage
2006-08-01 14:02 ——– d——– C:\Program Files\ATI Technologies
2006-08-01 13:42 ——– d——– C:\Program Files\Windows Media Player
2006-07-27 09:24 679424 –a—— C:\WINNT\system32\inetcomm.dll
2006-07-21 04:24 72704 –a—— C:\WINNT\system32\hlink.dll
(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries are not shown
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AIM"="\"C:\\PROGRA~1\\AIM\\aim.exe\" -cnetwait.odl"
"Zinio DLM"="\"C:\\Program Files\\Zinio\\ZinioDeliveryManager.exe\" /autostart"
"Steam"="\"C:\\Program Files\\Steam\\Steam.exe\" -silent"
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"="\"mobsync.exe\" /logon"
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"ccRegVfy"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccRegVfy.exe\""
"Advanced Tools Check"="C:\\PROGRA~1\\NORTON~1\\AdvTools\\ADVCHK.EXE"
"Symantec NetDriver Monitor"="\"C:\\PROGRA~1\\SYMNET~1\\SNDMon.exe\" /Consumer"
"NeroFilterCheck"="C:\\WINNT\\system32\\NeroCheck.exe"
"HP Component Manager"="\"C:\\Program Files\\HP\\hpcoretech\\hpcmpmgr.exe\""
"SM1BG"="C:\\WINNT\\SM1BG.EXE"
"Disc Detector"="\"C:\\Program Files\\Creative\\ShareDLL\\CtNotify.exe\""
"CreativeMixer"="\"C:\\Program Files\\Creative\\Audio2K\\PROGRAM\\CTMIX32.EXE\" /t"
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe\""
"SpySweeper"="\"C:\\Program Files\\Webroot\\Spy Sweeper\\SpySweeperUI.exe\" /startintray"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"NoChange"="1"
"Installed"="1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000005
[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Runonce]
"^SetupICWDesktop"="C:\\Program Files\\Internet Explorer\\Connection Wizard\\icwconn1.exe /desktop"
"tscuninstall"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,65,6d,\
33,32,5c,74,73,63,75,70,67,72,64,2e,65,78,65,00
[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Runonce]
"^SetupICWDesktop"="C:\\Program Files\\Internet Explorer\\Connection Wizard\\icwconn1.exe /desktop"
"tscuninstall"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,65,6d,\
33,32,5c,74,73,63,75,70,67,72,64,2e,65,78,65,00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="ewido anti-spyware 4.0"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=hex:df,00,00,00
"CDRAutoRun"=dword:00000000
"SpecifyDefaultButtons"=dword:00000000
"Btn_Search"=dword:00000000
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\fcccc
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wineaj32
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders
securityproviders REG_SZ msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\WebrootSpySweeperService
Contents of the 'Scheduled Tasks' folder
C:\WINNT\tasks\Norton AntiVirus - Scan my computer.job
Completion time: Sun 10/01/2006 11:02:37.64
ComboFix.txt
ComboFix2.txt
Next, launch Notepad (Start>All Programs>Accessories), and copy/paste all the BOLD REGEDIT below to it. Don't forget to include REGEDIT4.REGEDIT4 Please do not delete anything unless instructed to. VSToolbar Viewpoint Folders if listed:VSToolbar Viewpoint copy/paste " a new HijackThis log file into this thread.
I cannot find fix.reg on the desktop or anywhere else
Save in: DesktopAll files
LDTate,
I have retried but it still will not show up.
