help please!

Welcome to the forum

Download combofix.exe from the link below:

Combofix.exe

Save it to your desktop.

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run combofix.

When finished, it will produce a log for you.

Post that log in your next reply, along with a new HijackThis! log.


Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

thanks for your help! usually i just do a fresh install of windows but im getting tired of wasting a whole afternoon every few months. here is the combofix log…. 06-10-30 20:07:21.24 Service Pack 2 ComboFix 06.10.19 - Running from: "C:\Documents and Settings\Travis Coufal\Desktop" ((((((((((((((((((((((((((((((((((((((((((((( Look2Me's Log )))))))))))))))))))))))))))))))))))))))))))))))))) REGISTRY ENTRIES REMOVED: [HKEY_CLASSES_ROOT\clsid\{CDCA9EA7-05A7-427A-B396-3ACFBB866C3A}] @="" [HKEY_CLASSES_ROOT\clsid\{CDCA9EA7-05A7-427A-B396-3ACFBB866C3A}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\clsid\{CDCA9EA7-05A7-427A-B396-3ACFBB866C3A}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\clsid\{CDCA9EA7-05A7-427A-B396-3ACFBB866C3A}\InprocServer32] @="C:\\WINDOWS\\system32\\cal3d32.dll" "ThreadingModel"="Apartment" * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * Granting sedebugprivilege to Administrators … successful (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\system32\wapisu.exe C:\Program Files\batty2 C:\Program Files\cmfibula C:\Program Files\outlook C:\Program Files\Common Files\{D4A4ABA7-0711-1033-0811-050531200001} ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Folders Quarantined: C:\QooBox\Purity\Documents and Settings\Travis Coufal\My Documents\PPATCH~1 C:\QooBox\Purity\Documents and Settings\Travis Coufal\My Documents\STEM32~1 C:\QooBox\Purity\Program Files\SSEMBL~1 C:\QooBox\Purity\Program Files\Common Files\SEMBLY~1 C:\QooBox\Purity\Program Files\Common Files\SSTEM~1 C:\QooBox\Purity\Program Files\SSEMBL~1\fast.exe C:\QooBox\Purity\Program Files\SSEMBL~1\?ssembly C:\QooBox\Purity\WINDOWS\RACLE~1 C:\QooBox\Purity\WINDOWS\RACLE~1\wowexec.exe C:\QooBox\Purity\WINDOWS\system32\ICROSO~1 C:\QooBox\Purity\WINDOWS\system32\ICROSO~2 ((((((((((((((((((((((((((((((( Files Created from 2006-09-30 to 2006-10-30 )))))))))))))))))))))))))))))))))) 2006-10-28 21:24 126,976 –a—— C:\WINDOWS\system32\evjr.dll 2006-10-25 14:59 36,864 –a—— C:\WINDOWS\system32\wbsys.dll 2006-10-19 22:35 121,856 ——— C:\WINDOWS\system32\xmllite.dll 2006-10-17 12:33 6,049,280 ——— C:\WINDOWS\system32\ieframe.dll 2006-10-17 12:33 50,688 ——— C:\WINDOWS\system32\msfeedsbs.dll 2006-10-17 12:33 458,752 ——— C:\WINDOWS\system32\msfeeds.dll 2006-10-17 12:33 180,736 ——— C:\WINDOWS\system32\ieui.dll 2006-10-17 12:05 206,336 ——— C:\WINDOWS\system32\WinFXDocObj.exe 2006-10-17 12:01 13,312 –a—— C:\WINDOWS\system32\ieudinit.exe 2006-10-17 11:58 61,952 ——— C:\WINDOWS\system32\icardie.dll 2006-10-17 11:58 12,288 ——— C:\WINDOWS\system32\msfeedssync.exe 2006-10-17 11:57 266,752 ——— C:\WINDOWS\system32\iertutil.dll 2006-10-17 11:27 380,928 ——— C:\WINDOWS\system32\ieapfltr.dll 2006-10-12 21:34 89,184 ——— C:\WINDOWS\system32\drivers\imagedrv.sys 2006-10-12 21:34 569,344 -ra—— C:\WINDOWS\system32\imagr5.dll 2006-10-12 21:34 544,768 -ra—— C:\WINDOWS\system32\imagx5.dll 2006-10-12 21:34 38,912 -ra—— C:\WINDOWS\system32\picn20.dll 2006-10-12 21:34 283,920 -ra—— C:\WINDOWS\system32\ImagXpr5.dll 2006-10-12 21:34 155,648 -ra—— C:\WINDOWS\system32\NeroCheck.exe 2006-10-08 19:58 1,184,984 –a—— C:\WINDOWS\system32\wvc1dmod.dll (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-10-30 20:07 ——– d——– C:\Program Files\Common Files 2006-10-30 20:04 ——– d——– C:\Program Files\Mozilla Firefox 2 Beta 2 2006-10-30 15:46 ——– d——– C:\Program Files\Napster 2006-10-30 13:02 ——– d——– C:\Program Files\ewido anti-spyware 4.0 2006-10-27 06:57 ——– d——– C:\Program Files\AOL 2006-10-27 06:57 ——– d——– C:\Program Files\AOD 2006-10-27 06:56 ——– d——– C:\Program Files\Common Files\aolshare 2006-10-27 06:56 ——– d——– C:\Program Files\Common Files\AOL 2006-10-25 15:52 ——– d——– C:\Program Files\MusicForMasses 2006-10-25 15:08 ——– d——– C:\Program Files\AlienGUIse 2006-10-25 15:00 ——– d——– C:\Program Files\PSDream 2006-10-25 14:59 ——– d——– C:\Program Files\Common Files\Stardock 2006-10-25 07:10 ——– d——– C:\Documents and Settings\Travis Coufal\Application Data\vlc 2006-10-24 23:33 ——– d——– C:\Program Files\TVUPlayer 2006-10-19 22:42 ——– d——– C:\Program Files\Internet Explorer 2006-10-18 21:01 93664 –ahs—- C:\Program Files\Common Files\Y1324OU.exe 2006-10-17 12:33 413696 –a—— C:\WINDOWS\system32\vbscript.dll 2006-10-17 12:33 231424 –a—— C:\WINDOWS\system32\webcheck.dll 2006-10-17 12:33 156160 –a—— C:\WINDOWS\system32\msls31.dll 2006-10-17 12:06 78336 –a—— C:\WINDOWS\system32\ieencode.dll 2006-10-17 12:05 40960 –a—— C:\WINDOWS\system32\licmgr10.dll 2006-10-17 12:05 105984 –a—— C:\WINDOWS\system32\url.dll 2006-10-17 12:04 101376 –a—— C:\WINDOWS\system32\occache.dll 2006-10-17 12:03 17408 –a—— C:\WINDOWS\system32\corpol.dll 2006-10-17 12:01 71680 –a—— C:\WINDOWS\system32\admparse.dll 2006-10-17 12:01 55296 –a—— C:\WINDOWS\system32\iesetup.dll 2006-10-17 12:01 382976 –a—— C:\WINDOWS\system32\iedkcs32.dll 2006-10-17 12:01 229376 –a—— C:\WINDOWS\system32\ieaksie.dll 2006-10-17 12:01 152064 –a—— C:\WINDOWS\system32\ieakeng.dll 2006-10-17 12:00 54784 –a—— C:\WINDOWS\system32\ie4uinit.exe 2006-10-17 12:00 43008 –a—— C:\WINDOWS\system32\iernonce.dll 2006-10-17 12:00 123904 –a—— C:\WINDOWS\system32\advpack.dll 2006-10-17 11:57 36352 –a—— C:\WINDOWS\system32\imgutil.dll 2006-10-17 11:56 45568 –a—— C:\WINDOWS\system32\mshta.exe 2006-10-17 11:28 48128 –a—— C:\WINDOWS\system32\mshtmler.dll 2006-10-17 11:23 161792 –a—— C:\WINDOWS\system32\ieakui.dll 2006-10-14 17:52 ——– d——– C:\Program Files\CloneDVD 2006-10-14 02:00 ——– d——– C:\Program Files\MSXML 4.0 2006-10-12 21:35 ——– d——– C:\Program Files\DVD Shrink 2006-10-12 21:34 ——– d——– C:\Program Files\Common Files\Ahead 2006-10-12 21:34 ——– d——– C:\Program Files\Ahead 2006-10-12 20:23 ——– d–h—– C:\Program Files\InstallShield Installation Information 2006-10-12 20:23 ——– d——– C:\Program Files\Google 2006-10-12 20:23 ——– d——– C:\Documents and Settings\Travis Coufal\Application Data\Google 2006-10-07 12:35 ——– d——– C:\Program Files\DiscwareLite 2006-10-07 12:33 ——– d–h—– C:\Program Files\Zero G Registry 2006-09-25 22:22 ——– d——– C:\Program Files\ComPlus Applications 2006-09-25 21:30 ——– d—s—- C:\Documents and Settings\Travis Coufal\Application Data\Microsoft 2006-09-25 20:14 ——– d——– C:\Program Files\CCleaner 2006-09-25 20:08 ——– d——– C:\Documents and Settings\Travis Coufal\Application Data\Lavasoft 2006-09-25 20:07 ——– d——– C:\Program Files\Lavasoft 2006-09-25 19:14 76560 –a—— C:\WINDOWS\system32\drivers\tmcomm.sys 2006-09-25 19:03 183478 –a—— C:\WINDOWS\srvaepjvkg.exe 2006-09-25 19:03 ——– d——– C:\Program Files\Messenger 2006-09-25 10:27 ——– d——– C:\Program Files\Microsoft IntelliType Pro 2006-09-13 00:01 1084416 –a—— C:\WINDOWS\system32\msxml3.dll 2006-09-12 16:51 1245184 –a—— C:\WINDOWS\system32\msxml4.dll 2006-09-07 21:14 ——– d——– C:\Program Files\PartyGaming 2006-09-06 21:01 ——– d——– C:\Documents and Settings\Travis Coufal\Application Data\Nokia Multimedia Player 2006-09-06 20:54 ——– d——– C:\Documents and Settings\Travis Coufal\Application Data\Nokia 2006-09-06 20:54 ——– d——– C:\Documents and Settings\Travis Coufal\Application Data\Datalayer 2006-09-06 20:45 ——– d——– C:\Program Files\Nokia 2006-09-06 20:45 ——– d——– C:\Documents and Settings\Travis Coufal\Application Data\PC Suite 2006-09-06 20:44 ——– d——– C:\Program Files\Common Files\PCSuite 2006-09-06 20:44 ——– d——– C:\Program Files\Common Files\Nokia 2006-09-06 16:43 22752 –a—— C:\WINDOWS\system32\spupdsvc.exe 2006-09-05 17:18 ——– d——– C:\Documents and Settings\Travis Coufal\Application Data\U3 2006-08-31 07:00 ——– d——– C:\Program Files\Mozilla Firefox 2006-08-25 10:45 617472 –a—— C:\WINDOWS\system32\comctl32.dll 2006-08-21 07:21 16896 –a—— C:\WINDOWS\system32\fltlib.dll 2006-08-21 04:14 23040 –a—— C:\WINDOWS\system32\fltmc.exe 2006-08-18 10:28 188487 –a—— C:\WINDOWS\system32\atasnt40.dll 2006-08-16 06:58 100352 –a—— C:\WINDOWS\system32\6to4svc.dll 2006-08-08 15:50 737280 –a—— C:\WINDOWS\iun6002.exe (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "Aim6"="" "H/PC Connection Agent"="\"C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe\"" "googletalk"="\"C:\\Program Files\\Google\\Google Talk\\googletalk.exe\" /autostart" "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="\"C:\\Program Files\\Common Files\\Ahead\\Lib\\NMBgMonitor.exe\"" "PcSync"="C:\\Program Files\\Nokia\\Nokia PC Suite 6\\PcSync2.exe /NoDialog" "Helb"="\"C:\\PROGRA~1\\SSEMBL~1\\fast.exe\" -vt yazb" "Aesl"="C:\\WINDOWS\\?racle\\wowexec.exe" "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "IMJPMIG8.1"="\"C:\\WINDOWS\\IME\\imjp8_1\\IMJPMIG.EXE\" /Spoil /RemAdvDef /Migration32" "PHIME2002ASync"="C:\\WINDOWS\\system32\\IME\\TINTLGNT\\TINTSETP.EXE /SYNC" "PHIME2002A"="C:\\WINDOWS\\system32\\IME\\TINTLGNT\\TINTSETP.EXE /IMEName" "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup" "nwiz"="nwiz.exe /install" "HostManager"="C:\\Program Files\\Common Files\\AOL\\1150674040\\ee\\AOLSoftware.exe" "SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe" "NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit" "iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\"" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "NapsterShell"="C:\\Program Files\\Napster\\napster.exe /systray" "Windows Media Connect 2"="\"C:\\Program Files\\Windows Media Connect 2\\WMCCFG.exe\" /StartQuiet" "RemoteControl"="\"C:\\Program Files\\CyberLink\\PowerDVD\\PDVDServ.exe\"" "LanguageShortcut"="\"C:\\Program Files\\CyberLink\\PowerDVD\\Language\\Language.exe\"" "Windows Defender"="\"C:\\Program Files\\Windows Defender\\MSASCui.exe\" -hide" "TosGbWatcher"="\"C:\\Program Files\\TOSHIBA\\gigabeat room 3.0\\TosGbWatcher.exe\"" "PCSuiteTrayApplication"="C:\\Program Files\\Nokia\\Nokia PC Suite 6\\LaunchApplication.exe -onlytray" "DataLayer"="C:\\Program Files\\Common Files\\PCSuite\\DataLayer\\DataLayer.exe" "type32"="\"C:\\Program Files\\Microsoft IntelliType Pro\\type32.exe\"" "NeroCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe" "IPHSend"="C:\\Program Files\\Common Files\\AOL\\IPHSend\\IPHSend.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000001 [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" "Flags"=dword:00000002 "Position"=hex:2c,00,00,00,77,01,00,00,00,00,00,00,89,03,00,00,e1,03,00,00,00,\ 00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00 "CurrentState"=hex:04,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\ ff,ff,04,00,00,00 "RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\ 00,00,01,00,00,00 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" "{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}"="Microsoft AntiMalware ShellExecuteHook" "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="ewido anti-spyware 4.0" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 "CDRAutoRun"=dword:00000000 [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 "CDRAutoRun"=dword:00000000 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}" "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}" "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\MP Scheduled Scan.job Completion time: 06-10-30 20:09:50.07 C:\ComboFix.txt … 06-10-30 20:09

Disable Microsoft Windows Defender:
We need to disable your Microsoft Windows Defender Real-time Protection as it may interfere with the fixes that we need to make.

• Open Microsoft Windows Defender. Click Start, Programs, Windows Defender
• Click on Tools, General Settings.
• Under Real-time protection options, unselect the Turn on real-time protection check box
• Click Save

After all of the fixes are complete it is very important that you enable Real-time Protection again.

Copy and paste the contents of the quote box below into notepad.

Save it as file name: "fixme.reg" (not including the quotes). Save as file type: *All files* and save it on your Desktop.

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="wbsys.dll"

Then, locate fixme.reg on your desktop and it.

You will receive a prompt similar to: "Do you wish to merge the information into the registry?".

Answer 'Yes' and wait for a message to appear similar to "Merged Successfully".

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Do a systen scan only".
Then "check" the box to the left of these item(s):

R3 - URLSearchHook: (no name) - {801D1F3C-FA8B-805B-8DDB-A528E55160CB} - C:\WINDOWS\system32\evjr.dll

F2 - REG:system.ini: UserInit=userinit.exe

O2 - BHO: (no name) - {0A48E8AF-5713-289F-4562-5EC7EB01B0C9} - C:\WINDOWS\system32\poelkb.dll (file missing)

O2 - BHO: (no name) - {801D1F3C-FA8B-805B-8DDB-A528E55160CB} - C:\WINDOWS\system32\evjr.dll

O2 - BHO: (no name) - {9737DA90-677B-1CAD-7364-6E7490A67A90} - C:\WINDOWS\system32\pdfin.dll (file missing)

O4 - HKCU\..\Run: [Helb] "C:\PROGRA~1\SSEMBL~1\fast.exe" -vt yazb

O4 - HKCU\..\Run: [Aesl] C:\WINDOWS\?racle\wowexec.exe

Then click "Fix checked" and close Hijack This!.

Reboot in "safe" mode.

Delete all of the following noted (in red) file(s)/FOLDER(s) you can find:

c:\windows\?racle <— FOLDER

c:\program files\SSEMBL~1 <— FOLDER

Some malware files may be "hidden".
Be sure to show hidden files when looking for these file(s) and/or folder(s).

Reboot in normal mode and "copy/paste" a new HijackThis! log file into this thread.

Disable Microsoft Windows Defender:
We need to disable your Microsoft Windows Defender Real-time Protection as it may interfere with the fixes that we need to make.

• Open Microsoft Windows Defender. Click Start, Programs, Windows Defender
• Click on Tools, General Settings.
• Under Real-time protection options, unselect the Turn on real-time protection check box
• Click Save

After all of the fixes are complete it is very important that you enable Real-time Protection again.

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Do a systen scan only".
Then "check" the box to the left of these item(s):

O2 - BHO: (no name) - {801D1F3C-FA8B-805B-8DDB-A528E55160CB} - C:\WINDOWS\system32\evjr.dll

O2 - BHO: (no name) - {9737DA90-677B-1CAD-7364-6E7490A67A90} - C:\WINDOWS\system32\pdfin.dll (file missing)

Then click "Fix checked" and close Hijack This!.

Reboot in "safe" mode.

Delete all of the following noted (in red) file(s)/FOLDER(s) you can find:

c:\windows\system32\evjr.dll <— file

Some malware files may be "hidden".
Be sure to show hidden files when looking for these file(s) and/or folder(s).

Reboot in normal mode and "copy/paste" a new HijackThis! log file into this thread.

Looks good.

How is it running?


Securing Your PC After An Attack

no popups! looking good so far. thanks alot!

Thank you for choosing TomCoyote for your malware removal solutions.

M68

Please read:
Securing Your PC After An Attack

This topic is now closed.

If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.