What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Argh...Calgon take me away...

12 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Ok here goes…..sorry I didnt get here yesterday but again had no internet access. I hate my ISP! Ok I did as you asked. The HIjack this went fine. The Killbox gave me that prompt again (pendingFileRename) but I rebooted anyway and did another Killbox scan(?) and it was still listed. The second time I did the Killbox I chose single file delete and that worked. The C:WINDOWS\System32\RPCC.dll seems to be gone, but Ill leave you to decide that. I will now post the first HJT file, then the Kaspersky, and then another HJT.

Logfile of HijackThis v1.99.1
Scan saved at 7:39:12 PM, on 12/1/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\mcafee.com\agent\McAgent.exe
C:\DOCUME~1\Dawn\APPLIC~1\PPATCH~1\javaw.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\WINDOWS\System32\wuauclt.exe
c:\program files\mcafee.com\vso\mcvsshld.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\nofun\nofun.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {1A922934-96D3-CE07-D3F9-C26942DE8BB6} - C:\WINDOWS\System32\fzxbywpe.dll
O2 - BHO: (no name) - {013A653B-49A6-4f76-8B68-E4875EA6BA54} - C:\WINDOWS\System32\njegfjmc.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {1A922934-96D3-CE07-D3F9-C26942DE8BB6} - C:\WINDOWS\System32\fzxbywpe.dll
O2 - BHO: (no name) - {308042A6-AE5F-40A9-3C5B-0730A77BBB91} - C:\WINDOWS\System32\nlznnjb.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Jffdjljo Class - {A16AC1F4-BCA7-4401-B5F5-22240F78E776} - C:\WINDOWS\System32\p2jlseh8.dll (file missing)
O2 - BHO: Domain Helper - {B8A5DE1C-BC13-4DD2-BF00-7BE3C603F9F2} - C:\WINDOWS\System32\DomainHelper.dll
O2 - BHO: (no name) - {BACBEED9-5452-4627-A738-DF436E3C1F5D} - C:\WINDOWS\System32\jkhff.dll (file missing)
O2 - BHO: (no name) - {F18F04B0-9CF1-4b93-B004-77A288BEE28B} - C:\WINDOWS\System32\eyfxrbxf.dll (file missing)
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\McAgent.exe
O4 - HKLM\..\Run: [IPInSightLAN 01] "C:\Program Files\Verizon Online\VisualIpInSight\IPClient.exe" -l
O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\Verizon Online\VisualIpInSight\IPMon32.exe"
O4 - HKLM\..\Run: [McRegWiz] c:\PROGRA~1\mcafee.com\agent\mcregwiz.exe /autorun
O4 - HKCU\..\Run: [Aida] "C:\DOCUME~1\Dawn\APPLIC~1\PPATCH~1\javaw.exe" -vt ndrv
O4 - Global Startup: Verizon Online Support Center.lnk = C:\Program Files\Verizon Online\bin\matcli.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: rpcc - C:\WINDOWS\System32\rpcc.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Unknown owner - C:\WINDOWS\system32\drivers\KodakCCS.exe (file missing)
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe


This one was a real eye opener!

KASPERSKY ONLINE SCANNER REPORT
Friday, December 01, 2006 9:03:38 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 1 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 2/12/2006
Kaspersky Anti-Virus database records: 247278


Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true

Scan Target My Computer
A:\
C:\
D:\
E:\

Scan Statistics
Total number of scanned objects 77430
Number of viruses found 60
Number of infected objects 142 / 0
Number of suspicious objects 0
Duration of the scan process 00:58:41

Infected Object Name Virus Name Last Action
C:\!KillBox\ckeudsr.exe Infected: Trojan-Dropper.Win32.Agent.mu skipped

C:\!KillBox\ckeudsr.exe( 1) Infected: Trojan-Dropper.Win32.Agent.mu skipped

C:\ac3_0003.exe Infected: Trojan-Downloader.Win32.Small.cyh skipped

C:\deskbar_e53.exe/deskbar.exe/stream/data0004 Infected: not-a-virus:AdWare.Win32.Softomate.r skipped

C:\deskbar_e53.exe/deskbar.exe/stream Infected: not-a-virus:AdWare.Win32.Softomate.r skipped

C:\deskbar_e53.exe/deskbar.exe Infected: not-a-virus:AdWare.Win32.Softomate.r skipped

C:\deskbar_e53.exe ZIP: infected - 3 skipped

C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Logs\TaskScheduler\McTskshd001.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped

C:\Documents and Settings\Dawn\Application Data\ΑрpPatch\javaw.exe Infected: Trojan-Downloader.Win32.PurityScan.co skipped

C:\Documents and Settings\Dawn\Cookies\INDEX.DAT Object is locked skipped

C:\Documents and Settings\Dawn\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\Dawn\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\Dawn\Local Settings\History\History.IE5\INDEX.DAT Object is locked skipped

C:\Documents and Settings\Dawn\Local Settings\Temp\!update.exe Infected: Trojan-Downloader.Win32.PurityScan.co skipped

C:\Documents and Settings\Dawn\Local Settings\Temp\1.dlb Infected: Trojan-Downloader.Win32.Small.cxx skipped

C:\Documents and Settings\Dawn\Local Settings\Temp\21756\gm.exe Infected: Backdoor.Win32.Agent.ail skipped

C:\Documents and Settings\Dawn\Local Settings\Temp\adsponsor.exe/data0002 Infected: not-a-virus:AdWare.Win32.Agent.ay skipped

C:\Documents and Settings\Dawn\Local Settings\Temp\adsponsor.exe NSIS: infected - 1 skipped

C:\Documents and Settings\Dawn\Local Settings\Temp\cmfibula.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.CASClient.m skipped

C:\Documents and Settings\Dawn\Local Settings\Temp\cmfibula.exe/stream Infected: not-a-virus:AdWare.Win32.CASClient.m skipped

C:\Documents and Settings\Dawn\Local Settings\Temp\cmfibula.exe NSIS: infected - 2 skipped

C:\Documents and Settings\Dawn\Local Settings\Temp\D6DD1.tmp/tbiu5xkb.exe Infected: Trojan.Win32.Runner.j skipped

C:\Documents and Settings\Dawn\Local Settings\Temp\D6DD1.tmp/rnnypbw.exe Infected: not-a-virus:AdWare.Win32.Suggestor.o skipped

C:\Documents and Settings\Dawn\Local Settings\Temp\D6DD1.tmp CAB: infected - 2 skipped

C:\Documents and Settings\Dawn\Local Settings\Temp\daE3.tmp Infected: not-a-virus:AdWare.Win32.SurfSide.bb skipped

C:\Documents and Settings\Dawn\Local Settings\Temp\drsmartload180a.exe Infected: Trojan-Downloader.Win32.Adload.fu skipped

C:\Documents and Settings\Dawn\Local Settings\Temp\kkonqgfi.exe Infected: Trojan-Clicker.Win32.Small.cc skipped

C:\Documents and Settings\Dawn\Local Settings\Temp\lvazjehs.exe Infected: Trojan.Win32.Agent.pk skipped

C:\Documents and Settings\Dawn\Local Settings\Temp\maindll.dll Infected: Backdoor.Win32.Agent.uu skipped

C:\Documents and Settings\Dawn\Local Settings\Temp\maxdd1.game Infected: Trojan.Win32.Dialer.ay skipped

C:\Documents and Settings\Dawn\Local Settings\Temp\mma.chm/alien.cab/amm06.ocx Infected: not-a-virus:AdWare.Win32.MediaMotor.p skipped

C:\Documents and Settings\Dawn\Local Settings\Temp\mma.chm/alien.cab Infected: not-a-virus:AdWare.Win32.MediaMotor.p skipped

C:\Documents and Settings\Dawn\Local Settings\Temp\mma.chm/joysavsht.cab/amm06.ocx Infected: not-a-virus:AdWare.Win32.MediaMotor.p skipped

C:\Documents and Settings\Dawn\Local Settings\Temp\mma.chm/joysavsht.cab Infected: not-a-virus:AdWare.Win32.MediaMotor.p skipped

C:\Documents and Settings\Dawn\Local Settings\Temp\mma.chm/page.htm Infected: not-a-virus:AdWare.Win32.MediaMotor.p skipped

C:\Documents and Settings\Dawn\Local Settings\Temp\mma.chm CHM: infected - 5 skipped

C:\Documents and Settings\Dawn\Local Settings\Temp\padrecover1.exe/data0002 Infected: not-a-virus:AdWare.Win32.CASClient.q skipped

C:\Documents and Settings\Dawn\Local Settings\Temp\padrecover1.exe NSIS: infected - 1 skipped

C:\Documents and Settings\Dawn\Local Settings\Temp\pre.exe Infected: Trojan-Clicker.Win32.VB.lb skipped

C:\Documents and Settings\Dawn\Local Settings\Temp\rsysinit.exe Infected: Trojan.Win32.ExitWin.z skipped

C:\Documents and Settings\Dawn\Local Settings\Temp\spoolsvv.exe Infected: Trojan.Win32.Pakes skipped

C:\Documents and Settings\Dawn\Local Settings\Temp\vx3.game Infected: Trojan-Downloader.Win32.Small.coy skipped

C:\Documents and Settings\Dawn\Local Settings\Temp\vx4.game Infected: Trojan-Downloader.Win32.Small.dzd skipped

C:\Documents and Settings\Dawn\Local Settings\Temp\vx6.game Infected: Trojan-Downloader.Win32.Small.cxx skipped

C:\Documents and Settings\Dawn\Local Settings\Temp\YazzleBundle-1281.exe/data0002 Infected: Trojan-Downloader.Win32.PurityScan.dc skipped

C:\Documents and Settings\Dawn\Local Settings\Temp\YazzleBundle-1281.exe NSIS: infected - 1 skipped

C:\Documents and Settings\Dawn\Local Settings\Temporary Internet Files\Content.IE5\BYHUZJCA\!update-4295[1].0000 Infected: Trojan-Downloader.Win32.PurityScan.co skipped

C:\Documents and Settings\Dawn\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\Dawn\Local Settings\Temporary Internet Files\Content.IE5\TFVE38GE\ErrorSafeFreeInstall[1].cab/UERS_0001_N91M2007NetInstaller.exe Infected: not-a-virus:Downloader.Win32.WinFixer.o skipped

C:\Documents and Settings\Dawn\Local Settings\Temporary Internet Files\Content.IE5\TFVE38GE\ErrorSafeFreeInstall[1].cab CAB: infected - 1 skipped

C:\Documents and Settings\Dawn\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\Dawn\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Cookies\INDEX.DAT Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\INDEX.DAT Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\INDEX.DAT Object is locked skipped

C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

C:\lo1639643152.exe Infected: Packed.Win32.Tibs.i skipped

C:\mpnaaq7.exe Infected: Trojan-Downloader.Win32.Agent.ala skipped

C:\nofun\backups\backup-20061201-194115-141.dll Infected: Trojan.Win32.BHO.o skipped

C:\nofun\backups\backup-20061201-194115-934.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak skipped

C:\Program Files\CMFibula\equpd.exe/data0002 Infected: not-a-virus:AdWare.Win32.CASClient.p skipped

C:\Program Files\CMFibula\equpd.exe NSIS: infected - 1 skipped

C:\Program Files\CMIntex\CMIntex.exe Infected: not-a-virus:AdWare.Win32.CASClient.p skipped

C:\Program Files\Common Files\Yazzle1281OinAdmin.exe Infected: Trojan-Downloader.Win32.PurityScan.dc skipped

C:\Program Files\Windows Media Player\kycesojuj.html Infected: Trojan-Clicker.Win32.Small.jf skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP659\A0051818.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP659\A0051819.exe Infected: not-a-virus:AdWare.Win32.PurityScan.eu skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP664\A0056083.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP664\A0056084.exe Infected: not-a-virus:AdWare.Win32.PurityScan.ev skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP664\A0056117.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP664\A0056118.exe Infected: not-a-virus:AdWare.Win32.PurityScan.eu skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP665\A0056154.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP665\A0056155.exe Infected: not-a-virus:AdWare.Win32.PurityScan.ev skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP666\A0056196.exe Infected: not-a-virus:AdWare.Win32.PurityScan.eu skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP667\A0056228.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP669\A0056329.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP669\A0056330.exe Infected: not-a-virus:AdWare.Win32.PurityScan.ev skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP677\A0058607.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP677\A0058608.exe Infected: not-a-virus:AdWare.Win32.PurityScan.eu skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP682\A0059832.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP685\A0060193.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP686\A0060275.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP693\A0060585.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP696\A0060676.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP698\A0060790.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP702\A0061001.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP702\A0061002.exe Infected: not-a-virus:AdWare.Win32.PurityScan.ex skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP703\A0061011.exe Infected: Trojan-Downloader.Win32.Small.ajc skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP703\A0061994.exe Infected: Trojan.Win32.VB.tg skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP703\A0061995.exe Infected: Trojan-Downloader.Win32.Qoologic.at skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP703\A0062994.exe Infected: Trojan.Win32.VB.tg skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP703\A0062996.dll Infected: not-a-virus:AdWare.Win32.NewDotNet skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP707\A0068057.exe Infected: Trojan-Downloader.Win32.Small.cxx skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP707\A0069062.dll Infected: not-a-virus:AdWare.Win32.Agent.ay skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP709\A0069438.exe Infected: not-a-virus:AdWare.Win32.NewDotNet skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP709\A0069439.exe Infected: not-a-virus:AdWare.Win32.NewDotNet.e skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP715\A0070169.dll Infected: not-a-virus:AdWare.Win32.NewDotNet.i skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP715\A0070186.dll Infected: not-a-virus:AdWare.Win32.Suggestor.o skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP715\A0070187.exe Infected: not-a-virus:AdWare.Win32.Suggestor.o skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP715\A0070188.exe Infected: Trojan.Win32.Runner.j skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP715\A0070195.exe Infected: not-a-virus:AdWare.Win32.Suggestor.o skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP715\A0070201.exe Infected: Trojan.Win32.Pakes skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP715\A0076231.dll Infected: Trojan-Proxy.Win32.Agent.df skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP715\A0076269.dll Infected: Trojan-Spy.Win32.VBStat.h skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP715\A0076272.dll Infected: Trojan-Spy.Win32.VBStat.h skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP715\A0076283.exe Infected: Trojan-Clicker.Win32.Costrat.n skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP715\A0076284.exe Infected: Trojan-Downloader.Win32.Small.coy skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP715\A0076285.exe Infected: Trojan-Downloader.Win32.Small.cxx skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP715\A0076286.exe Infected: Trojan.Win32.Dialer.ay skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP715\A0077318.dll Infected: Trojan-Downloader.Win32.Qoologic.bj skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP715\A0077319.exe Infected: Trojan-Downloader.Win32.Qoologic.bj skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP715\A0077320.exe Infected: Backdoor.Win32.Hupigon.cj skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP715\A0077321.exe Infected: Trojan-Downloader.Win32.Qoologic.bj skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP715\A0077322.exe Infected: Backdoor.Win32.Hupigon.cj skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP715\A0077323.exe Infected: Trojan-Downloader.Win32.Qoologic.c skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP715\A0077324.dll Infected: Trojan-Downloader.Win32.Agent.agw skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP715\A0077331.exe Infected: Trojan-Dropper.Win32.Agent.mu skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP718\A0082420.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fj skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP737\A0083681.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP737\A0083693.dll Infected: Trojan.Win32.Spabot.ai skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP737\change.log Object is locked skipped

C:\t.inx Infected: Trojan-Downloader.Win32.Tibs.ir skipped

C:\VundoFix Backups\jkhff.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.fj skipped

C:\WINDOWS\ac3_0008.exe/data0002 Infected: not-a-virus:AdWare.Win32.CASClient.q skipped

C:\WINDOWS\ac3_0008.exe NSIS: infected - 1 skipped

C:\WINDOWS\Debug\oakley.log Object is locked skipped

C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

C:\WINDOWS\NDNuninstall6_38.exe Infected: not-a-virus:AdWare.Win32.NewDotNet skipped

C:\WINDOWS\NDNuninstall7_22.exe Infected: not-a-virus:AdWare.Win32.NewDotNet.e skipped

C:\WINDOWS\SchedLgU.Txt Object is locked skipped

C:\WINDOWS\SoftwareDistribution\EventCache\{ACAFCC1F-30A9-468A-9EE8-A0A75D1CC725}.bin Object is locked skipped

C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped

C:\WINDOWS\srvigpww.exe/data0002 Infected: Trojan.Win32.VB.tg skipped

C:\WINDOWS\srvigpww.exe/data0006 Infected: Trojan.Win32.VB.tg skipped

C:\WINDOWS\srvigpww.exe NSIS: infected - 2 skipped

C:\WINDOWS\Sti_Trace.log Object is locked skipped

C:\WINDOWS\SYSTEM32\a.exe Infected: Trojan-Downloader.Win32.Small.dmj skipped

C:\WINDOWS\SYSTEM32\adirss.exe Infected: Trojan-Proxy.Win32.Lager.ek skipped

C:\WINDOWS\SYSTEM32\CONFIG\AppEvent.Evt Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\SAM Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\SecEvent.Evt Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\SECURITY Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\SysEvent.Evt Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG Object is locked skipped

C:\WINDOWS\SYSTEM32\fnocnpli.dll Infected: not-a-virus:AdWare.Win32.Agent.e skipped

C:\WINDOWS\SYSTEM32\google.png.exe Infected: Trojan-Proxy.Win32.Lager.eg skipped

C:\WINDOWS\SYSTEM32\gwlsqwcg.dll Infected: Trojan-Spy.Win32.VBStat.h skipped

C:\WINDOWS\SYSTEM32\H323LOG.TXT Object is locked skipped

C:\WINDOWS\SYSTEM32\hlvi6wkjc.exe Infected: not-a-virus:AdWare.Win32.SearchAssistant.g skipped

C:\WINDOWS\SYSTEM32\iifecbx.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ex skipped

C:\WINDOWS\SYSTEM32\kernels8.exe Infected: Trojan-Downloader.Win32.Tibs.ir skipped

C:\WINDOWS\SYSTEM32\lmsuhsgr.dll Infected: Trojan-Spy.Win32.VBStat.h skipped

C:\WINDOWS\SYSTEM32\njegfjmc.dll Infected: Trojan.Win32.BHO.o skipped

C:\WINDOWS\SYSTEM32\se.exe.exe Infected: Trojan.Win32.Small.ku skipped

C:\WINDOWS\SYSTEM32\spoolsvv.exe Infected: Trojan-Proxy.Win32.Agent.ji skipped

C:\WINDOWS\SYSTEM32\ss.exe.exe Infected: Trojan-Proxy.Win32.Lager.ek skipped

C:\WINDOWS\SYSTEM32\umnpysfv.dll Infected: Trojan-Spy.Win32.VBStat.h skipped

C:\WINDOWS\SYSTEM32\vcfywtdq.exe Infected: not-a-virus:AdWare.Win32.Agent.at skipped

C:\WINDOWS\SYSTEM32\vxgame4.exe Infected: Trojan-Downloader.Win32.Small.dzd skipped

C:\WINDOWS\SYSTEM32\w.exe.exe Infected: Trojan.Win32.Pakes skipped

C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.BTR Object is locked skipped

C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.DATA Object is locked skipped

C:\WINDOWS\SYSTEM32\wservice.exe Infected: Trojan.Win32.Pakes skipped

C:\WINDOWS\SYSTEM32\ysjaevwx.exe Infected: Trojan.Win32.Runner.j skipped

C:\WINDOWS\System32hlvi6wkjc.exe Infected: not-a-virus:AdWare.Win32.SearchAssistant.g skipped

C:\WINDOWS\System32ysjaevwx.exe Infected: Trojan.Win32.Runner.j skipped

C:\WINDOWS\Temp\hsperfdata_SYSTEM\2312 Object is locked skipped

C:\WINDOWS\Temp\win2E19.tmp Infected: Trojan-Proxy.Win32.Agent.ji skipped

C:\WINDOWS\type32w.exe Infected: Backdoor.Win32.Agent.tk skipped

C:\WINDOWS\uninst108.exe Infected: Trojan.Win32.VB.tg skipped

C:\WINDOWS\WIADEBUG.LOG Object is locked skipped

C:\WINDOWS\WIASERVC.LOG Object is locked skipped

C:\WINDOWS\WindowsUpdate.log Object is locked skipped

C:\yz02.exe Infected: not-a-virus:AdWare.Win32.NewDotNet skipped

Scan process completed.


This is the last HJT file I did after Kaspersky.

Logfile of HijackThis v1.99.1
Scan saved at 9:06:35 PM, on 12/1/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\DOCUME~1\Dawn\APPLIC~1\PPATCH~1\javaw.exe
c:\program files\mcafee.com\vso\mcvsshld.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\wuauclt.exe
c:\program files\mcafee.com\shared\mghtml.exe
C:\DOCUME~1\Dawn\LOCALS~1\Temp\MCA1AF8.tmp\mcappins.exe
C:\nofun\nofun.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {1A922934-96D3-CE07-D3F9-C26942DE8BB6} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [IPInSightLAN 01] "C:\Program Files\Verizon Online\VisualIpInSight\IPClient.exe" -l
O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\Verizon Online\VisualIpInSight\IPMon32.exe"
O4 - HKLM\..\Run: [McRegWiz] c:\PROGRA~1\mcafee.com\agent\mcregwiz.exe /autorun
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKCU\..\Run: [Aida] "C:\DOCUME~1\Dawn\APPLIC~1\PPATCH~1\javaw.exe" -vt ndrv
O4 - Global Startup: Verizon Online Support Center.lnk = C:\Program Files\Verizon Online\bin\matcli.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m…,26/mcgdmgr.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A8809208-F2C7-4B5B-B866-887E60DCC07F}: NameServer = 68.237.161.12 71.250.0.12
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: rpcc - C:\WINDOWS\System32\rpcc.dll (file missing)
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Unknown owner - C:\WINDOWS\system32\drivers\KodakCCS.exe (file missing)
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

Awaiting your commands oh great one……
Post #17
After many attempts, I was FINALLY able to update my virus sofware, firewall and windows update. I was going to run my virus software but figured since I had run Kaspersky yesterday,andn sent you the file, I would wait and see if you thought that was a good idea or not. I have had a few "programs" that were found trying to access the internet by my firewall, which proceeded to shut them out or in or whatever a firewall does with these programs.

just because I think your going to ask for it….here is this mornings HJT file. I do notice differences in it…..



Logfile of HijackThis v1.99.1
Scan saved at 11:00:38 AM, on 12/2/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
c:\PROGRA~1\mcafee.com\vso\OasClnt.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\Program Files\McAfee.com\VSO\mcvsshld.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\PROGRA~1\mcafee.com\agent\McDash.exe
c:\program files\mcafee.com\shared\mghtml.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\nofun\nofun.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {1A922934-96D3-CE07-D3F9-C26942DE8BB6} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [IPInSightLAN 01] "C:\Program Files\Verizon Online\VisualIpInSight\IPClient.exe" -l
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m…,26/mcgdmgr.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: rpcc - C:\WINDOWS\System32\rpcc.dll (file missing)
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Unknown owner - C:\WINDOWS\system32\drivers\KodakCCS.exe (file missing)
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
Post #18
________________
It looks like you have been infected by at least one backdoor trojan.

This allows hackers to remotely control your computer, steal critical system information and Download and Execute files

Its very possible that anything could have been installed on your computer by the remote attacker, including opening other backdoors and installing rootkits. While we can attempt to clean what we see in your logs, we can't guarantee that your computer will be completely in the clear since we have no way of knowing that has been done to the computer. Your computer could be completely compromised at this moment. It may be prudent to backup your information, reformat, and reinstall.

More information on Remote Access Trojans can be found
http://antivirus.about.com/library/weekly/aa100400a.htm]here

I suggest you do the following immediately:
  • Call all of your banks, credit card companies, financial institutions and inform them that you may be a victim of identity theft and to put a watch on your accounts or change all your account numbers.
  • From a clean computer, change *all* your online passwords – for email, for banks, financial accounts, PayPal, eBay, online companies, any online forums or groups you belong to.
  • Do NOT change passwords or do any transactions while using the infected computer because the attacker will get the new passords and transaction information.
If, however, you decide that the computer is not used for any sensitive work, or if you do not wish to reformat at this time, I can help you clean your computer to the best of my abilities.

Should you have any questions, please feel free to ask.

Please let me know what you decide to do in your next post.

Should you decide to clean this machine start by doing the following.




Back up important files now just in case. Do not back up any exe files or scr files. They may be infected.





Please double-click Killbox.exe to run it.
Select:
Delete on Reboot
then Click on the All Files button.
Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):


C:\lo1639643152.exe
C:\mpnaaq7.exe
C:\Program Files\Windows Media Player\kycesojuj.html
C:\t.inx
C:\WINDOWS\ac3_0008.exe/data0002 Infected: not-a-virus:AdWare.Win32.CASClient.q skipped
C:\WINDOWS\ac3_0008.exe NSIS: infected - 1 skipped
C:\WINDOWS\NDNuninstall6_38.exe
C:\WINDOWS\NDNuninstall7_22.exe
C:\WINDOWS\srvigpww.exe
C:\WINDOWS\srvigpww.exe
C:\WINDOWS\srvigpww.exe
C:\WINDOWS\SYSTEM32\a.exe
C:\WINDOWS\SYSTEM32\adirss.exe
C:\WINDOWS\SYSTEM32\fnocnpli.dll
C:\WINDOWS\SYSTEM32\google.png.exe
C:\WINDOWS\SYSTEM32\gwlsqwcg.dll
C:\WINDOWS\SYSTEM32\hlvi6wkjc.exe
C:\WINDOWS\SYSTEM32\iifecbx.dll
C:\WINDOWS\SYSTEM32\kernels8.exe
C:\WINDOWS\SYSTEM32\lmsuhsgr.dll
C:\WINDOWS\SYSTEM32\njegfjmc.dll
C:\WINDOWS\SYSTEM32\se.exe.exe
C:\WINDOWS\SYSTEM32\spoolsvv.exe
C:\WINDOWS\SYSTEM32\ss.exe.exe
C:\WINDOWS\SYSTEM32\umnpysfv.dll
C:\WINDOWS\SYSTEM32\vcfywtdq.exe
C:\WINDOWS\SYSTEM32\vxgame4.exe
C:\WINDOWS\SYSTEM32\w.exe.exe
C:\WINDOWS\SYSTEM32\wservice.exe
C:\WINDOWS\SYSTEM32\ysjaevwx.exe
C:\WINDOWS\System32hlvi6wkjc.exe
C:\WINDOWS\System32ysjaevwx.exe
C:\WINDOWS\type32w.exe
C:\WINDOWS\uninst108.exe
C:\yz02.exe

Return to Killbox, go to the File menu, and choose Paste from Clipboard.

Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt. Click OK at any PendingFileRenameOperations prompt (and please let me know if you receive this message!).


If your computer does not restart automatically, please restart it manually.

If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run Killbox, click here to download and run missingfilesetup.exe. Then try Killbox again.







Download this scanner: Dr.Web CureIT!
To the Desktop
run it.
Save the report and post it …


______________

Run an online scan here.
Accept the ActiveX and select "clean"
Save any report provided, and post it back here.


__________________

In your next reply I would like to see:
  • A new HJT log
  • The report from Dr cureit
  • The report from CA virus center
Post #20
Sorry for the delay. I had to reach my sister, whos computer it is, and see what she wanted to do. She has decide I should just do a reformat and be done with the whole thing. I thank you for your help and appreciate your advice on how to finally fix the infection. I have taken your advice and also contacted all banks and such to advise them on the problem. At this point I guess you should close this topic, unless you need to advise me on anything regarding the reformat. Once again, thanks for all your help. You guys are priceless. I have advised my sister you guys work on donations and she will be hooking you up shortly. Hope I never have to deal with you guys again, not in a bad way of course, but will sleep better knowing if I need to you will be there. Have a great holiday!
Post #21
Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI