What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Hi...please check

22 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Logfile of HijackThis v1.99.1
Scan saved at 1:17:40 PM, on 10/9/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Intel\ASF Agent\ASFAgent.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Dell\OpenManage\Client\Iap.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\DOCUME~1\AdminBU\LOCALS~1\Temp\Temporary Directory 1 for hijackthis[1].zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://education.dellnet.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msnbc.msn.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = intranet.ext.wvu.edu
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: (no name) - {641F89DC-991A-4143-A0C1-A194A249042E} - C:\WINDOWS\system32\MORbby.dll
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [Iomega Drive Icons] C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
O4 - HKLM\..\Run: [Deskup] C:\Program Files\Iomega\DriveIcons\deskup.exe /IMGSTART
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - https://wvucentral.wvu.edu/Citrix/ICAWEB/en/ica32/ica32t.exe
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - file://C:\WINDOWS\msxml4.cab
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} (cpbrkpie Control) - http://a19.g.akamai.net/7/19/7125/4056/ftp…shi/Coupons.cab
O20 - AppInit_DLLs: c:\windows\system32\geebyax.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: MORbby - C:\WINDOWS\SYSTEM32\MORbby.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: ASF Agent (ASFAgent) - Intel Corporation - C:\Program Files\Intel\ASF Agent\ASFAgent.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Iap - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\Iap.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
Post #2
Hi goherd and welcome to TomCoyote's forums :wavey:

I am currently looking over your log. As I am an Undergraduate, everything that I post to you must be checked by an Admin or Moderator. Thus, there may be a tiny bit of a delay between posts, but it shouldn't be too long. I will post back shortly with a potential fix.

Thanks for your patience!
Post #3
HJT in it's own folder
————————

Please put your HijackThis in it's own folder, (I create a new folder in C:\ named HJT).
You can do a Right Click on any open area on the desktop, New> Folder, then rename the folder HJT.

Go to where your HijackThis is and Right Click on HijackThis.exe, select Cut, then open the new folder you just created (HJT) Right Click in the folder and select paste.

The reason we do this is Hijackthis creates backup files just in case you'd need to restore one and we'll be cleaning out the temp files.


Please download VundoFix.exe to your desktop.
  • Double-click VundoFix.exe to run it.
  • Click the Scan for Vundo button.
  • Once it's done scanning, click the Remove Vundo button.
  • You will receive a prompt asking if you want to remove the files, click YES
  • Once you click yes, your desktop will go blank as it starts removing Vundo.
  • When completed, it will prompt that it will reboot your computer, click OK.
  • Please post the contents of C:\vundofix.txt and a new HiJackThis log.
Note: It is possible that VundoFix encountered a file it could not remove.
In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot.
Post #4
It didn't fix it. Unable to remove. VundoFix V6.2.1 Checking Java version… Sun Java not detected Scan started at 4:31:08 PM 10/12/2006 Listing files found while scanning…. C:\WINDOWS\SYSTEM32\MORbby.dll Beginning removal… Attempting to delete C:\WINDOWS\SYSTEM32\MORbby.dll C:\WINDOWS\SYSTEM32\MORbby.dll Could not be deleted. Performing Repairs to the registry. Done! VundoFix V6.2.1 Checking Java version… Sun Java not detected Scan started at 4:41:21 PM 10/12/2006 Listing files found while scanning…. C:\WINDOWS\SYSTEM32\MORbby.dll Beginning removal… Attempting to delete C:\WINDOWS\SYSTEM32\MORbby.dll C:\WINDOWS\SYSTEM32\MORbby.dll Could not be deleted. Performing Repairs to the registry. Done! VundoFix V6.2.1 Checking Java version… Sun Java not detected Scan started at 4:47:29 PM 10/12/2006 Listing files found while scanning…. C:\WINDOWS\SYSTEM32\MORbby.dll Beginning removal… Attempting to delete C:\WINDOWS\SYSTEM32\MORbby.dll C:\WINDOWS\SYSTEM32\MORbby.dll Could not be deleted. Performing Repairs to the registry. Done! Beginning removal… Attempting to delete C:\WINDOWS\SYSTEM32\MORbby.dll C:\WINDOWS\SYSTEM32\MORbby.dll Could not be deleted. Performing Repairs to the registry. Done!
Post #5
Ok. Then we try this.

* Double-click VundoFix.exe to run it.
* Click the Scan for Vundo button.
* Once the scan is complete, Right Click inside the listbox (white box) and click add more files
* Copy&Paste the 2 entries below into the top 2 boxes
* C:\WINDOWS\system32\MORbby.dll
* C:\WINDOWS\system32\ybbROM.*
* Click Add Files and Click Close Window
* Click the Remove Vundo button.
* You will receive a prompt asking if you want to remove the files, click YES
* Once you click yes, your desktop will go blank as it starts removing Vundo.
* When completed, it will prompt that it will reboot your computer, click OK.
* Please post the contents of C:\vundofix.txt and a new HiJackThis log.


Note: It is possible that VundoFix encountered a file it could not remove.
In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot.
Post #6
Didn't fix it. VundoFix V6.2.1 Checking Java version… Sun Java not detected Scan started at 4:31:08 PM 10/12/2006 Listing files found while scanning…. C:\WINDOWS\SYSTEM32\MORbby.dll Beginning removal… Attempting to delete C:\WINDOWS\SYSTEM32\MORbby.dll C:\WINDOWS\SYSTEM32\MORbby.dll Could not be deleted. Performing Repairs to the registry. Done! VundoFix V6.2.1 Checking Java version… Sun Java not detected Scan started at 4:41:21 PM 10/12/2006 Listing files found while scanning…. C:\WINDOWS\SYSTEM32\MORbby.dll Beginning removal… Attempting to delete C:\WINDOWS\SYSTEM32\MORbby.dll C:\WINDOWS\SYSTEM32\MORbby.dll Could not be deleted. Performing Repairs to the registry. Done! VundoFix V6.2.1 Checking Java version… Sun Java not detected Scan started at 4:47:29 PM 10/12/2006 Listing files found while scanning…. C:\WINDOWS\SYSTEM32\MORbby.dll Beginning removal… Attempting to delete C:\WINDOWS\SYSTEM32\MORbby.dll C:\WINDOWS\SYSTEM32\MORbby.dll Could not be deleted. Performing Repairs to the registry. Done! Beginning removal… Attempting to delete C:\WINDOWS\SYSTEM32\MORbby.dll C:\WINDOWS\SYSTEM32\MORbby.dll Could not be deleted. Performing Repairs to the registry. Done! VundoFix V6.2.1 Checking Java version… Sun Java not detected Scan started at 1:31:56 PM 10/18/2006 Listing files found while scanning…. C:\WINDOWS\SYSTEM32\MORbby.dll Beginning removal… Attempting to delete C:\WINDOWS\SYSTEM32\MORbby.dll C:\WINDOWS\SYSTEM32\MORbby.dll Could not be deleted. Attempting to delete C:\WINDOWS\system32\MORbby.dll C:\WINDOWS\system32\MORbby.dll Could not be deleted. Performing Repairs to the registry. Done! Beginning removal… Attempting to delete C:\WINDOWS\SYSTEM32\MORbby.dll C:\WINDOWS\SYSTEM32\MORbby.dll Could not be deleted. Attempting to delete C:\WINDOWS\system32\MORbby.dll C:\WINDOWS\system32\MORbby.dll Could not be deleted. Attempting to delete C:\WINDOWS\system32\MORbby.dll C:\WINDOWS\system32\MORbby.dll Could not be deleted. Performing Repairs to the registry. Done!
Post #7
Before we'll continue I would like you to do something for me…
I need you to upload malware file for further inspection.

Make your hidden files visible:
  • Go to My Computer
  • Select the Tools menu and click Folder Options
  • Click the View tab.
  • Checkmark the "Display the contents of system folders"
  • Under the Hidden files and folders select "Show hidden files and folders"
  • Uncheck "Hide protected operating system files"
  • Click Apply and then the OK and close My Computer.
Please go here to upload a suspicious file for analysis.
  • Enter your username from this forum
  • Copy and paste the link to this thread
    • Click "Browse" on the 1. field.
      Browse to the following file and click the file with your mouse, press "Open"
      C:\WINDOWS\system32\MORbby.dll
  • In the comments, please mention that I asked you to upload this file
  • Click on Send File


1. Download this file - combofix.exe to your desktop.
2. Click start->run. Copy following bolded text (this is case sensitive) to field:
"%userprofile%\Desktop\combofix.exe" /v MORbby and click ok.

Post combofix log together with a new HJT log.
Post #8
AdminBU - 06-10-19 8:55:53.03 Service Pack 2 ComboFix 06.10.19 - Running from: "C:\Documents and Settings\AdminBU\Desktop" ((((((((((((((((((((((((((((((( Files Created from 2006-09-19 to 2006-10-19 )))))))))))))))))))))))))))))))))) 2006-10-12 16:45 7,460 –a—— C:\WINDOWSvundofix.reg 2006-09-29 13:53 4 –ah—– C:\WINDOWS\uccspecb.sys 2006-09-22 10:02 7,913 ——— C:\WINDOWS\SYSTEM32\geebyax.dll 2006-09-22 08:36 23,474 –a—— C:\WINDOWS\SYSTEM32\pmkhh.exe 2006-09-22 08:36 16,934 ——— C:\WINDOWS\SYSTEM32\MORbby.dll 2006-09-21 15:35 7,913 –a—— C:\WINDOWS\SYSTEM32\jkhfeby.dll (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-10-18 13:47 ——– d——– C:\Program Files\Microsoft AntiSpyware 2006-10-18 13:44 ——– d——– C:\Program Files\Symantec AntiVirus 2006-10-09 12:50 ——– d—s—- C:\Documents and Settings\AdminBU\Application Data\Microsoft 2006-10-09 12:36 ——– d——– C:\Documents and Settings\AdminBU\Application Data\FUJIFILM 2006-09-29 09:37 ——– d——– C:\Program Files\Google 2006-09-28 11:20 ——– d——– C:\Documents and Settings\AdminBU\Application Data\Google 2006-09-25 14:42 ——– d——– C:\Program Files\Siber Systems 2006-09-25 13:46 ——– d——– C:\Program Files\CyberScrub Professional 2006-09-25 13:46 ——– d——– C:\Documents and Settings\AdminBU\Application Data\CyberScrub 2006-09-25 13:42 ——– d——– C:\Program Files\Viewpoint 2006-09-25 08:13 ——– d——– C:\Documents and Settings\AdminBU\Application Data\AdobeUM 2006-09-21 16:05 ——– d——– C:\Documents and Settings\AdminBU\Application Data\Adobe 2006-09-19 09:16 ——– d——– C:\Program Files\Common Files\Viewpoint 2006-09-19 09:16 ——– d——– C:\Program Files\Common Files 2006-09-18 16:08 ——– d——– C:\Documents and Settings\AdminBU\Application Data\Lavasoft 2006-09-18 08:20 ——– d——– C:\Documents and Settings\AdminBU\Application Data\Apple Computer 2006-09-15 15:15 ——– d——– C:\Program Files\Citrix 2006-09-15 15:15 ——– d——– C:\Documents and Settings\AdminBU\Application Data\ICAClient 2006-09-13 01:01 1084416 –a—— C:\WINDOWS\SYSTEM32\msxml3.dll 2006-08-25 11:45 617472 –a—— C:\WINDOWS\SYSTEM32\comctl32.dll 2006-08-24 10:31 ——– d——– C:\Program Files\DeltaFlights 2006-08-22 15:53 ——– d–h—– C:\Program Files\InstallShield Installation Information 2006-08-22 15:53 ——– d——– C:\Program Files\QuickTime 2006-08-21 08:21 16896 –a—— C:\WINDOWS\SYSTEM32\fltlib.dll 2006-08-21 05:14 23040 –a—— C:\WINDOWS\SYSTEM32\fltmc.exe 2006-08-21 05:14 128896 ——— C:\WINDOWS\SYSTEM32\DRIVERS\fltmgr.sys 2006-08-16 07:58 100352 –a—— C:\WINDOWS\SYSTEM32\6to4svc.dll 2006-07-27 09:24 679424 –a—— C:\WINDOWS\SYSTEM32\inetcomm.dll 2006-07-21 04:24 72704 –a—— C:\WINDOWS\SYSTEM32\hlink.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe" "RoboForm"="\"C:\\Program Files\\Siber Systems\\AI RoboForm\\RoboTaskBarIcon.exe\"" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "IgfxTray"="C:\\WINDOWS\\System32\\igfxtray.exe" "HotKeysCmds"="C:\\WINDOWS\\System32\\hkcmd.exe" "DVDSentry"="C:\\WINDOWS\\System32\\DSentry.exe" "AdaptecDirectCD"="\"C:\\Program Files\\Roxio\\Easy CD Creator 5\\DirectCD\\DirectCD.exe\"" "Iomega Drive Icons"="C:\\Program Files\\Iomega\\DriveIcons\\ImgIcon.exe" "Deskup"="C:\\Program Files\\Iomega\\DriveIcons\\deskup.exe /IMGSTART" "REGSHAVE"="C:\\Program Files\\REGSHAVE\\REGSHAVE.EXE /AUTORUN" "TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" "ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\"" "vptray"="C:\\PROGRA~1\\SYMANT~1\\VPTray.exe" "gcasServ"="\"C:\\Program Files\\Microsoft AntiSpyware\\gcasServ.exe\"" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000001 [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" "Flags"=dword:00000002 "Position"=hex:2c,00,00,00,9c,00,00,00,00,00,00,00,64,03,00,00,e2,02,00,00,00,\ 00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00 "CurrentState"=hex:04,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\ ff,ff,04,00,00,00 "RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\ 00,00,01,00,00,00 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" "{9EF34FF2-3396-4527-9D27-04C8C1C67806}"="Microsoft AntiSpyware Service Hook" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 "CDRAutoRun"=dword:00000000 [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 "CDRAutoRun"=dword:00000000 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}" "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}" "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\MORbby [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\Disk Cleanup.job C:\WINDOWS\tasks\{39DC5553-0ACC-4658-861C-E591BD525FEE}_WAYNE503XP1_JFerry.job C:\WINDOWS\tasks\{61C537BD-A360-4DA0-B0CC-62A57E571818}_WAYNE503XP1_JFerry.job C:\WINDOWS\tasks\{E5E020A5-10F5-49D1-9C50-B3058AB36DE4}_WAYNE503XP1_JFerry.job Completion time: 06-10-19 8:56:46.06 C:\ComboFix.txt … 06-10-19 08:56 C:\ComboFix2.txt … 06-10-19 08:52
Post #9 last edited
Hi! Seems like you didn't follow my instructions. :( We can't achieve clean result if you don't do exactly as I ask you to do.

1. Click start on taskbar.
2. Select run
3. Write following line in the field:
"%userprofile%\Desktop\combofix.exe" /v geebyax MORbby jkhfeby
4. click ok.

Post new combofix log and a fresh hjt log
Post #12
AdminBU - 06-10-19 14:26:37.37 Service Pack 2 ComboFix 06.10.19 - Running from: "C:\Documents and Settings\AdminBU\Desktop" Command switches used :: /v geebyax MORbby jkhfeby (((((((((((((((((((((((((((((((((((((((((((((((( Vundo Log ))))))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\system32\geebyax.dll C:\WINDOWS\system32\MORbby.dll C:\WINDOWS\system32\jkhfeby.dll * * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * C:\WINDOWS\system32\geebyax.dll ((((((((((((((((((((((((((((((( Files Created from 2006-09-19 to 2006-10-19 )))))))))))))))))))))))))))))))))) 2006-10-19 14:28 25,358 –a—— C:\WINDOWS\SYSTEM32\vturq.exe 2006-10-19 14:28 18,529 –a—— C:\WINDOWS\SYSTEM32\DDEMLAY.dll 2006-10-12 16:45 7,460 –a—— C:\WINDOWSvundofix.reg 2006-09-29 13:53 4 –ah—– C:\WINDOWS\uccspecb.sys 2006-09-22 10:02 7,913 ——— C:\WINDOWS\SYSTEM32\geebyax.dll 2006-09-22 08:36 23,474 –a—— C:\WINDOWS\SYSTEM32\pmkhh.exe (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-10-19 14:28 ——– d——– C:\Program Files\Symantec AntiVirus 2006-10-18 13:47 ——– d——– C:\Program Files\Microsoft AntiSpyware 2006-10-09 12:50 ——– d—s—- C:\Documents and Settings\AdminBU\Application Data\Microsoft 2006-10-09 12:36 ——– d——– C:\Documents and Settings\AdminBU\Application Data\FUJIFILM 2006-09-29 09:37 ——– d——– C:\Program Files\Google 2006-09-28 11:20 ——– d——– C:\Documents and Settings\AdminBU\Application Data\Google 2006-09-25 14:42 ——– d——– C:\Program Files\Siber Systems 2006-09-25 13:46 ——– d——– C:\Program Files\CyberScrub Professional 2006-09-25 13:46 ——– d——– C:\Documents and Settings\AdminBU\Application Data\CyberScrub 2006-09-25 13:42 ——– d——– C:\Program Files\Viewpoint 2006-09-25 08:13 ——– d——– C:\Documents and Settings\AdminBU\Application Data\AdobeUM 2006-09-21 16:05 ——– d——– C:\Documents and Settings\AdminBU\Application Data\Adobe 2006-09-19 09:16 ——– d——– C:\Program Files\Common Files\Viewpoint 2006-09-19 09:16 ——– d——– C:\Program Files\Common Files 2006-09-18 16:08 ——– d——– C:\Documents and Settings\AdminBU\Application Data\Lavasoft 2006-09-18 08:20 ——– d——– C:\Documents and Settings\AdminBU\Application Data\Apple Computer 2006-09-15 15:15 ——– d——– C:\Program Files\Citrix 2006-09-15 15:15 ——– d——– C:\Documents and Settings\AdminBU\Application Data\ICAClient 2006-09-13 01:01 1084416 –a—— C:\WINDOWS\SYSTEM32\msxml3.dll 2006-08-25 11:45 617472 –a—— C:\WINDOWS\SYSTEM32\comctl32.dll 2006-08-24 10:31 ——– d——– C:\Program Files\DeltaFlights 2006-08-22 15:53 ——– d–h—– C:\Program Files\InstallShield Installation Information 2006-08-22 15:53 ——– d——– C:\Program Files\QuickTime 2006-08-21 08:21 16896 –a—— C:\WINDOWS\SYSTEM32\fltlib.dll 2006-08-21 05:14 23040 –a—— C:\WINDOWS\SYSTEM32\fltmc.exe 2006-08-21 05:14 128896 ——— C:\WINDOWS\SYSTEM32\DRIVERS\fltmgr.sys 2006-08-16 07:58 100352 –a—— C:\WINDOWS\SYSTEM32\6to4svc.dll 2006-07-27 09:24 679424 –a—— C:\WINDOWS\SYSTEM32\inetcomm.dll 2006-07-21 04:24 72704 –a—— C:\WINDOWS\SYSTEM32\hlink.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "IgfxTray"="C:\\WINDOWS\\System32\\igfxtray.exe" "HotKeysCmds"="C:\\WINDOWS\\System32\\hkcmd.exe" "DVDSentry"="C:\\WINDOWS\\System32\\DSentry.exe" "AdaptecDirectCD"="\"C:\\Program Files\\Roxio\\Easy CD Creator 5\\DirectCD\\DirectCD.exe\"" "Iomega Drive Icons"="C:\\Program Files\\Iomega\\DriveIcons\\ImgIcon.exe" "Deskup"="C:\\Program Files\\Iomega\\DriveIcons\\deskup.exe /IMGSTART" "REGSHAVE"="C:\\Program Files\\REGSHAVE\\REGSHAVE.EXE /AUTORUN" "TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" "ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\"" "vptray"="C:\\PROGRA~1\\SYMANT~1\\VPTray.exe" "gcasServ"="\"C:\\Program Files\\Microsoft AntiSpyware\\gcasServ.exe\"" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000001 [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" "Flags"=dword:00000002 "Position"=hex:2c,00,00,00,9c,00,00,00,00,00,00,00,64,03,00,00,e2,02,00,00,00,\ 00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00 "CurrentState"=hex:04,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\ ff,ff,04,00,00,00 "RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\ 00,00,01,00,00,00 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" "{9EF34FF2-3396-4527-9D27-04C8C1C67806}"="Microsoft AntiSpyware Service Hook" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 "CDRAutoRun"=dword:00000000 [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 "CDRAutoRun"=dword:00000000 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}" "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}" "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\DDEMLAY [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\Disk Cleanup.job C:\WINDOWS\tasks\{39DC5553-0ACC-4658-861C-E591BD525FEE}_WAYNE503XP1_JFerry.job C:\WINDOWS\tasks\{61C537BD-A360-4DA0-B0CC-62A57E571818}_WAYNE503XP1_JFerry.job C:\WINDOWS\tasks\{E5E020A5-10F5-49D1-9C50-B3058AB36DE4}_WAYNE503XP1_JFerry.job Completion time: 06-10-19 14:28:34.49 C:\ComboFix.txt … 06-10-19 14:28 C:\ComboFix2.txt … 06-10-19 13:38 C:\ComboFix3.txt … 06-10-19 08:56
Post #14
Logfile of HijackThis v1.99.1
Scan saved at 5:03:12 PM, on 10/19/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Intel\ASF Agent\ASFAgent.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Dell\OpenManage\Client\Iap.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Novell\GroupWise\grpwise.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\DOCUME~1\AdminBU\LOCALS~1\Temp\Temporary Directory 2 for hijackthis[1].zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://education.dellnet.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msnbc.msn.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = intranet.ext.wvu.edu
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: (no name) - {65DF4ED8-697D-4DC5-9389-0FA8C01C2713} - C:\WINDOWS\system32\DDEMLAY.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [Iomega Drive Icons] C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
O4 - HKLM\..\Run: [Deskup] C:\Program Files\Iomega\DriveIcons\deskup.exe /IMGSTART
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - https://wvucentral.wvu.edu/Citrix/ICAWEB/en/ica32/ica32t.exe
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - file://C:\WINDOWS\msxml4.cab
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} (cpbrkpie Control) - http://a19.g.akamai.net/7/19/7125/4056/ftp…shi/Coupons.cab
O20 - Winlogon Notify: DDEMLAY - C:\WINDOWS\SYSTEM32\DDEMLAY.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: ASF Agent (ASFAgent) - Intel Corporation - C:\Program Files\Intel\ASF Agent\ASFAgent.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Iap - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\Iap.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
Post #15
I asked you to move HJT to its own folder. It is very important that you follow my instructions carefully. Not doing so will make it more difficult to clean your computer. Please do the following:



HJT in its own folder
————————

Please put your HijackThis in it's own folder, (I create a new folder in C:\ named HJT).
You can do a Right Click on any open area on the desktop, New> Folder, then rename the folder HJT.

Go to where your HijackThis is and Right Click on HijackThis.exe, select Cut, then open the new folder you just created (HJT) Right Click in the folder and select paste.

The reason we do this is Hijackthis creates backup files just in case you'd need to restore one and we'll be cleaning out the temp files.



Disable MS AntiSpyware's realtime protection
  • Right-click on the Microsoft Anti-Spyware icon in the system tray
    (the red and yellow bulls-eye)
  • Click on Security Agents Status
  • Click on Disable real-time protection
  • Close the program

If you've deleted Vundofix I asked you to download earlier then please download it here to your desktop.

* Double-click VundoFix.exe to run it.
* Click the Scan for Vundo button.
* Once the scan is complete, Right Click inside the listbox (white box) and click add more files
* Copy&Paste the 2 entries below into the top 2 boxes
* C:\WINDOWS\system32\DDEMLAY.dll
* C:\WINDOWS\system32\YALMEDD.*
* Click Add Files and Click Close Window
* Click the Remove Vundo button.
* You will receive a prompt asking if you want to remove the files, click YES
* Once you click yes, your desktop will go blank as it starts removing Vundo.
* When completed, it will prompt that it will reboot your computer, click OK.
* Please post the contents of C:\vundofix.txt and a new HiJackThis log.


Note: It is possible that VundoFix encountered a file it could not remove.
In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot.


PS. This time I want you to post both contents of c:\vundofix.txt and new hjt log in your next post.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI