Please help

Tomorrowsnightmarefrank

Welcome to Tom Coyote

Sorry for the delay

1. Please download the Killbox. Save it to the desktop.

2. Reboot into Safe Mode
This can be done byRestart your PC, and after it starts, but before you see the Windows Splash screen
Begin tapping the F8 key twice a second untill you reach another menu screen (black background with white menu choices)
Use your arrow keys and select Safe Mode and then Enter
3.1) Run Killbox
2) Select "Delete on Reboot", and then select "All files".
3) Copy the file names below to the clipboard by highlighting them and pressing Control-C:
C:\WINDOWS\System32\lixaj.exe
C:\WINDOWS\System32\uyhvjw.exe
4) Return to Killbox, go to the File menu, and choose "Paste from Clipboard".
5) Click the red-and-white "Delete File" button.  Click "Yes" at the Delete on Reboot prompt.  Click "No" at the Pending Operations prompt.
4. Using Windows Search (Click Start->>Search)
Locate and Delete the following fileALCXMNTR.EXE
Close Windows Search->>Reboot your PC

5.1. Download this file - combofix.exe
2. Double click combofix.exe & follow the prompts.
3. When finished, it shall produce a log for you. Post that log in your next reply
Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

thanks bamajim

Thank You for your help so far. Here's the combofix log: Owner - 06-12-02 22:05:15.10 Service Pack 2 ComboFix 06.11.27W - Running from: "C:\Documents and Settings\Owner.BOB.000\Desktop" ((((((((((((((((((((((((((((((((((((((((((((( Qoologic's Log ))))))))))))))))))))))))))))))))))))))))))))))))))) * * * POST-RUN - Files in the Quarantine folder * * * * * * * * * * * * * * * * * * * * * * * * * DO NOT DELETE ANY FILES FROM THIS DIRECTORY UNLESS INSTRUCTED TO (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\system32\wnsintsv.exe C:\Program Files\Common Files\Yazzle1122OinAdmin.exe C:\Program Files\Common Files\Yazzle1122OinUninstaller.exe C:\WINDOWS\uninstall_nmon.vbs C:\WINDOWS\system32\atmtd.dll C:\WINDOWS\system32\atmtd.dll._ C:\Documents and Settings\LocalService\Application Data\NetMon C:\Program Files\Common Files\download C:\Program Files\Cowabanga C:\Program Files\Inetget2 C:\Program Files\network monitor C:\Program Files\ql C:\Program Files\Common Files\{3868A95C-09BA-1033-1016-030224200001} C:\Program Files\Common Files\{8868A95C-09BA-1033-1016-030224200001} C:\Program Files\Common Files\{8868A95C-09BA-1033-1016-030224200001} C:\WINDOWS\RmVsaWNlIFByaWFtbw ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Folders Quarantined: C:\QooBox\Purity\Program Files\SEMBLY~1 C:\QooBox\Purity\Program Files\SMBOLS~1 C:\QooBox\Purity\Program Files\Common Files\CROSOF~1.NET C:\QooBox\Purity\Program Files\Common Files\FNTS~1 C:\QooBox\Purity\Program Files\Common Files\STEM~1 C:\QooBox\Purity\Program Files\Common Files\YSTEM~1 C:\QooBox\Purity\Program Files\SMBOLS~1\r?gsvr32.exe C:\QooBox\Purity\WINDOWS\RACLE~1 C:\QooBox\Purity\WINDOWS\SEMBLY~1 C:\QooBox\Purity\WINDOWS\RACLE~1\RACLE~1 C:\QooBox\Purity\WINDOWS\RACLE~1\winword.exe C:\QooBox\Purity\WINDOWS\system32\SMANTE~1 ((((((((((((((((((((((((((((((( Files Created from 2006-11-02 to 2006-12-02 )))))))))))))))))))))))))))))))))) 2006-12-02 21:13 d——– C:\!KillBox 2006-11-30 00:18 56,320 –a—— C:\WINDOWS\system32\rgbcly.dll 2006-11-23 22:46 d——– C:\Documents and Settings\Owner.BOB.000\Application Data\Motive 2006-11-23 08:53 145 –a-s—- C:\WINDOWS\test.bat 2006-11-23 00:04 76,560 –a—— C:\WINDOWS\system32\drivers\tmcomm.sys 2006-11-18 00:00 d——– C:\Program Files\Apple Software Update 2006-11-05 18:18 d——– C:\Program Files\SpacialAudio 2006-11-05 18:05 737,280 –a—— C:\WINDOWS\iun6002.exe (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-12-02 22:07 ——– d——– C:\Program Files\Common Files 2006-11-22 23:05 ——– d——– C:\Program Files\VirtualDJ 2006-11-18 03:00 ——– d——– C:\Program Files\Internet Explorer 2006-11-18 00:03 ——– d——– C:\Program Files\iTunes 2006-11-18 00:03 ——– d——– C:\Program Files\iPod 2006-11-18 00:02 ——– d——– C:\Program Files\QuickTime 2006-11-07 21:40 ——– d——– C:\Program Files\Common Files\AOL 2006-11-07 21:40 ——– d——– C:\Program Files\AOL 2006-11-07 21:40 ——– d——– C:\Program Files\AOD 2006-11-05 18:00 ——– d——– C:\Program Files\MixVibes6 2006-10-30 20:35 ——– d——– C:\Documents and Settings\Owner.BOB.000\Application Data\Atari 2006-10-30 20:28 ——– d–h—– C:\Program Files\InstallShield Installation Information 2006-10-30 20:28 ——– d——– C:\Program Files\Atari 2006-10-25 00:48 ——– d——– C:\Program Files\Common Files\Microsoft Shared 2006-10-18 12:40 ——– d——– C:\Program Files\Google 2006-10-15 23:35 ——– d——– C:\Documents and Settings\Owner.BOB.000\Application Data\Google 2006-10-15 21:06 ——– d——– C:\Program Files\MtStudio 2006-10-15 19:45 ——– d——– C:\Program Files\Image-Line 2006-10-15 19:44 ——– d——– C:\Program Files\AtomixMP3 2006-10-13 07:35 142336 –a—— C:\WINDOWS\system32\nwprovau.dll 2006-10-10 21:17 ——– d——– C:\Program Files\REGSHAVE 2006-10-10 21:17 ——– d——– C:\Program Files\Common Files\Symantec Shared 2006-10-10 21:17 ——– d——– C:\Program Files\AIM 2006-10-10 21:11 25600 –a—— C:\WINDOWS\system32\ps2.exe 2006-10-10 21:11 25600 –a—— C:\WINDOWS\system32\igfxtray.exe 2006-10-10 21:11 25600 –a—— C:\WINDOWS\system32\hkcmd.exe 2006-10-09 20:08 ——– d——– C:\Program Files\MixVibesFREE5 2006-10-08 12:44 ——– d——– C:\Program Files\Visiosonic 2006-10-08 12:20 ——– d——– C:\Program Files\SoftJock 2006-10-06 22:55 56 -r-hs—- C:\WINDOWS\system32\C5E2E194A4.sys 2006-10-05 19:51 ——– d——– C:\Documents and Settings\Owner.BOB.000\Application Data\LimeWire 2006-10-03 00:06 ——– d——– C:\Documents and Settings\Owner.BOB.000\Application Data\AdobeUM 2006-09-20 20:11 61678 –a—— C:\Documents and Settings\Owner.BOB.000\Application Data\PFP110JPR.{PB 2006-09-20 20:11 12358 –a—— C:\Documents and Settings\Owner.BOB.000\Application Data\PFP110JCM.{PB 2006-09-19 15:43 109360 –a—— C:\WINDOWS\system32\GEARAspi.dll 2006-09-13 00:01 1084416 –a—— C:\WINDOWS\system32\msxml3.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "NVIEW"="rundll32.exe nview.dll,nViewLoadHook" "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "RealPlayer"="\"C:\\Program Files\\Real\\RealOne Player\\realplay.exe\" /RunUPGToolCommandReBoot" "AIM"="C:\\Program Files\\AIM\\aim.exe -cnetwait.odl" "swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\1.0.720.3640\\GoogleToolbarNotifier.exe" "Regscan"="C:\\WINDOWS\\System32\\regscan.exe" "Aim6"="\"C:\\Program Files\\Common Files\\AOL\\Launch\\AOLLaunch.exe\" /d locale=en-US ee://aol/imApp" "Notn"="\"C:\\WINDOWS\\RACLE~1\\winword.exe\" -vt yazr" "Twm"="C:\\Program Files\\s?mbols\\r?gsvr32.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "hpsysdrv"="c:\\windows\\system\\hpsysdrv.exe" "HotKeysCmds"="C:\\WINDOWS\\System32\\hkcmd.exe" "KBD"="C:\\HP\\KBD\\KBD.EXE" "StorageGuard"="\"C:\\Program Files\\Common Files\\Sonic\\Update Manager\\sgtray.exe\" /r" "TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" "Recguard"="C:\\WINDOWS\\SMINST\\RECGUARD.EXE" "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvCpl.dll,NvStartup" "nwiz"="nwiz.exe /installquiet /keeploaded /nodetect" "ccApp"="\"c:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\"" "ccRegVfy"="\"c:\\Program Files\\Common Files\\Symantec Shared\\ccRegVfy.exe\"" "PS2"="C:\\WINDOWS\\system32\\ps2.exe" "HPDJ Taskbar Utility"="C:\\WINDOWS\\System32\\spool\\drivers\\w32x86\\3\\hpztsb08.exe" "ViewMgr"="C:\\Program Files\\Viewpoint\\Viewpoint Manager\\ViewMgr.exe" "REGSHAVE"="C:\\Program Files\\REGSHAVE\\REGSHAVE.EXE /AUTORUN" "AlcxMonitor"="ALCXMNTR.EXE" "IgfxTray"="C:\\WINDOWS\\System32\\igfxtray.exe" "SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_03\\bin\\jusched.exe" "mmtask"="C:\\Program Files\\MUSICMATCH\\MUSICMATCH Jukebox\\mmtask.exe" "ALUAlert"="C:\\Program Files\\Symantec\\LiveUpdate\\ALUNOTIFY.EXE" "QuickFinder Scheduler"="\"c:\\Program Files\\WordPerfect Office 11\\Programs\\QFSCHD110.EXE\"" "xFXMixer"="C:\\PROGRA~1\\xFXMixer\\xfxmixer.exe /min" "HostManager"="C:\\Program Files\\Common Files\\AOL\\1162953580\\ee\\AOLSoftware.exe" "IPHSend"="C:\\Program Files\\Common Files\\AOL\\IPHSend\\IPHSend.exe" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\"" [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000001 [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" "Flags"=dword:00000002 "Position"=hex:2c,00,00,00,a0,00,00,00,00,00,00,00,80,02,00,00,3a,02,00,00,00,\ 00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00 "CurrentState"=hex:04,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\ ff,ff,04,00,00,00 "RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\ 00,00,01,00,00,00 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" "{54D9498B-CF93-414F-8984-8CE7FDE0D391}"="ewido shell guard" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}" "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}" "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OPXPGina [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\AppleSoftwareUpdate.job C:\WINDOWS\tasks\Norton AntiVirus - Scan my computer.job Completion time: 06-12-02 22:14:26.20 C:\ComboFix.txt … 06-12-02 22:14 C:\ComboFix2.txt … 06-12-02 21:36

Tomorrowsnightmarefrank

First We need to make sure we can see hidden files and folders:

To enable the viewing of Hidden and System files follow these steps: Right click on Start and select Explore.
Select the Tools menu and click Folder Options.
After the new window appears select the View tab.
Put a checkmark in the checkbox labeled Display the contents of system folders.
Under the Hidden files and folders section select the radio button labeled Show hidden files and folders. Remove the checkmark from the checkbox labeled Hide file extensions for known file types.
Remove the checkmark from the checkbox labeled Hide protected operating system files.
Click Yes To confirm
Press the Apply button and then the OK button.
Next You have a suspicious file I need some more info on

Please upload this file to Jotti's Online Virus Scan C:\WINDOWS\system32\C5E2E194A4.sys
Click "Browse" at the top of the page
- Navigate to (Locate)C:\WINDOWS\system32\C5E2E194A4.sys
- Click "Open" Then the "Submit" and let the scan finish
- Scroll down to the bottom of the page to find the results
- Copy/paste the results in your next reply.
thanks bamajim

Sorry, for the delay, I still have the same problem, and once again thanks for your help. THis is what was yielded by the scan: Service load: 0% 100% File: C5E2E194A4.sys Status: OK MD5 5d993a7eecdc9625d104c3e958590518 Packers detected: - Scanner results AntiVir Found nothing ArcaVir Found nothing Avast Found nothing AVG Antivirus Found nothing BitDefender Found nothing ClamAV Found nothing Dr.Web Found nothing F-Prot Antivirus Found nothing F-Secure Anti-Virus Found nothing Fortinet Found nothing Kaspersky Anti-Virus Found nothing NOD32 Found nothing Norman Virus Control Found nothing VirusBuster Found nothing VBA32 Found nothing Powered by Disclaimer This service is by no means 100% safe. If this scanner says 'OK', it does not necessarily mean the file is clean. There could be a whole new virus on the loose. NEVER EVER rely on one single product only, not even this service, even though it utilizes several products. Therefore, We cannot and will not be held responsible for any damage caused by results presented by this non-profit online service. Also, we are aware of the implications of a setup like this. We are sure this whole thing is by no means scientifically correct, since this is a fully automated service (although manual correction is possible). We are aware, in spite of efforts to proactively counter these, false positives might occur, for example. We do not consider this a very big issue, so please do not e-mail us about it. This is a simple online scan service, not the university of Wichita. Scanning can take a while, since several scanners are being used, plus the fact some scanners use very high levels of (time consuming) heuristics. Scanners used are Linux versions, differences with Windows scanners may or may not occur. Another note: some scanners will only report one virus when scanning archives with multiple pieces of malware. Virus definitions are updated every hour. There is a 15Mb limit per file. Please refrain from uploading tons of hex-edited or repacked variants of the same sample. Please do not ask for viruses uploaded here, unless you work for an anti-virus vendor. They are not for trade. This is a legitimate service, not a VX site. Viruses uploaded here will be distributed to antivirus vendors without exception. Read more about this in our privacy policy. If you do not want your files to be distributed, please do not send them at all. Sponsored by donations (in random order) from: Stormbyte Technologies LLC, The ClamAV project, Steve S., Eric Johansen, Eric Schechter, Paul Bokel, Wilders Security, Wilfried Lilie, Prevx, SonicWALL, Lance Mueller, Ewido networks, HotelScraper.com, people who donated in the past, and some people who prefer to remain anonymous… many thanks to all! Statistics Last file scanned at least one scanner reported something about: netmng.exe (MD5: 727c2b3fffd2c077f5afb736802c331c), detected by: Scanner Malware name AntiVir Heuristic/Crypted ArcaVir X Avast X AVG Antivirus X BitDefender MemScan:Backdoor.Eggdrop.1.7 ClamAV X Dr.Web BackDoor.EggDrop.17 F-Prot Antivirus X F-Secure Anti-Virus X Fortinet X Kaspersky Anti-Virus X NOD32 X Norman Virus Control X VirusBuster X VBA32 Backdoor.EggDrop.17 You're free to (mis)interpret these automated, flawed statistics at your own discretion. For antivirus comparisons, visit AV comparatives We are not affiliated with any third parties that conduct tests using this service.

Tomorrowsnightmarefrank

O.k. that file seems o.k.

1. Open Notepad (Not Wordpad)
Copy and paste the following into notepad
(Making sure there is no space between the top of the window and the first line)

REGEDIT4

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"Notn"=-
"Regscan"=-
"Twm"=-

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"AlcxMonitor"=-

After you copy and paste it your cursor should be at the end of the first line
Hit Enter so your cursor is under the last lineClick File->>Save as->>type in fix.reg->>
Under "Save as type" Select "All Files"->> save it to your Desktop
Close Notepad
The fix.reg file should now appear on your Desktop

Rt Click and Select merge->>If prompted to merge with registry Select Yes (it will appear that nothing has happened but that's o.k.)

2. Using Windows Explorer(Right click on "Start," select "Explore," and you will see the "tree' of file folders in the left side of the window. Click on the "+" next to any folder name to expand its contents)
Locate and Delete the following filesC:\WINDOWS\system32\rgbcly.dll
C:\WINDOWS\iun6002.exe
Close Windows Explorer->>Reboot your PC

3. Please perform an Ewido Online Malware Scan

• When a dialog box appears asking you if you would like to download and install the ewido anti-spyware online scanner please click Yes to allow the download.
• Click on Start Scan.
• after the scan completes i twill produce a log for you, copy and paste the results of that scan as a reply to this thread
• If any infections are found, (After you save the logfile), Click on Remove Infections.

thanks bamajim