HiJackThis Log

Hi osok,
thanks for the log from HijackThis.
Can you please post the vundo fix.txt?

Otherwise your HijackThis log looks clean.

Disable and Enable System Restore. - You should disable and enable system restore to make sure there are no infected files found in a restore point.

You can find instructions on how to enable and re-enable system restore here:
Windows XP System Restore Guide.

Reboot and let me know if you still got that error msg during startup.

Regards,

Rosty.

it isnt there? i looked everywhere,,i have one but it is from 11/28

it isnt there? i looked everywhere,,i have one but it is from 11/28

No worry. Did you followed this instructions?

Disable and Enable System Restore. - You should disable and enable system restore to make sure there are no infected files found in a restore point.

You can find instructions on how to enable and re-enable system restore here:
Windows XP System Restore Guide.

Reboot and let me know if you still got that error msg during startup.

Regards,

Rosty.

Hi osok, how are things running now? Please let me know. Regards, Rosty.

Hey Rosty, i am very very sorry for not replyin, but my finals week jus finished on friday and i had to finish some scheduling stuff more next semester so as you can imagine i ahve been under some serious stress and lack of time haha….things are runnin great…well for the most part…at times a bit slower than usual….but overall pretty good

Hi osok,

i am very very sorry for not replyin, but my finals week jus finished on friday and i had to finish some scheduling stuff more next semester so as you can imagine i ahve been under some serious stress and lack of time haha

I understand, no need to apologise!!

things are runnin great…

Good to hear.

at times a bit slower than usual….but overall pretty good

You may always post a new HijackThis log if you want, then I'll take another look.
If you don't feel the need for it, please do the next:

Turn off System Restore:

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

Restart your computer, turn it back on.

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Remove the Check Turn off System Restore.
Click Apply, and then click OK.

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Check "Hide file extensions for known file types."
Under the "Hidden files" folder, Uncheck "Show hidden files and folders."
Check "Hide protected operating system files."
Click Apply, and then click OK.




If you dont have any programs like these, I would recommend that you get them. Spywareblaster, Spywareguard. They will add 1000's of sites to your resticted zone and block some hijacks from happening. I also have a FREE FIREWALL and FREE ANTI VIRUS if you need one.

It is critical to have both a firewall and anti virus to protect your system.

Keep your system up to date and run Adaware & Spybot, once a week works, and hopefully you will be ok from here on. Both are available below.

Safe Surfing.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein

Regards,

Rosty.

* Download Combofix to your desktop.
Doubleclick combo.exe
Follow the prompts.
Don't click on the window while the fix is running, because that will cause your system to hang.

When finished, it should produce a log, combofix.txt.
Post this log in your next reply together with a new hijackthislog.

Regards,

Rosty.

Brandon Bredda - 06-12-21 1:39:56.34 Service Pack 2 ComboFix 06.11.27 - Running from: "C:\Documents and Settings\Brandon Bredda\Desktop" (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\system32\components C:\Program Files\Common Files\{38F59401-0724-1033-0613-060426060001} ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Folders Quarantined: C:\QooBox\Purity\Program Files\SSTEM3~1 C:\QooBox\Purity\Program Files\SSTEM3~1\s?stem32 C:\QooBox\Purity\Program Files\SSTEM3~1\s?stem32\ctxad-510.0000 C:\QooBox\Purity\Program Files\SSTEM3~1\s?stem32\dohinst-103.0000 ((((((((((((((((((((((((((((((( Files Created from 2006-11-21 to 2006-12-21 )))))))))))))))))))))))))))))))))) 2006-12-19 23:09 20,480 ——— C:\WINDOWS\system32\H@tKeysH@@k.DLL 2006-12-19 01:30 d——– C:\Program Files\Trainer Maker Kit 2006-12-18 11:57 d——– C:\Documents and Settings\Brandon Bredda\Application Data\Help 2006-12-14 22:45 d——– C:\Documents and Settings\All Users\Application Data\Adobe Systems 2006-12-14 22:41 d——– C:\Program Files\Common Files\Adobe Systems Shared 2006-12-06 05:07 24,576 –a—— C:\WINDOWS\system32\VundoFixSVC.exe 2006-12-05 00:00 3,968 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys 2006-12-05 00:00 d——– C:\Program Files\Grisoft 2006-12-04 12:49 d——– C:\Documents and Settings\Brandon Bredda\Application Data\Template 2006-12-01 00:33 d——– C:\Program Files\Foolish Entertainment 2006-11-30 00:36 d——– C:\WINDOWS\Performance 2006-11-30 00:36 d——– C:\Program Files\Microsoft Windows Vista Upgrade Advisor 2006-11-30 00:36 d——– C:\Documents and Settings\All Users\Application Data\Microsoft Corporation 2006-11-28 18:28 d——– C:\VundoFix Backups 2006-11-28 16:11 d——– C:\WINDOWS\SxsCaPendDel 2006-11-28 13:47 583,680 –a—— C:\WINDOWS\system\wininet.dll 2006-11-28 13:30 5,134 –a—— C:\WINDOWS\system32\tmp.reg 2006-11-27 21:24 d——– C:\Program Files\Lavasoft 2006-11-27 21:24 d——– C:\Documents and Settings\Brandon Bredda\Application Data\Lavasoft 2006-11-27 20:59 d——– C:\Program Files\Spybot - Search & Destroy 2006-11-27 20:59 d——– C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2006-11-27 19:53 d——– C:\Program Files\VSAdd-in 2006-11-27 19:05 d——– C:\WINDOWS\system32\ActiveScan 2006-11-27 19:05 d——– C:\Program Files\Trend Micro 2006-11-26 16:08 5,632 –a—— C:\WINDOWS\system32\ptpusb.dll 2006-11-26 16:08 159,232 –a—— C:\WINDOWS\system32\ptpusd.dll 2006-11-26 16:08 15,104 –a—— C:\WINDOWS\system32\drivers\usbscan.sys 2006-11-26 16:08 d–h—– C:\Config.Msi 2006-11-22 13:39 31,616 –a—— C:\WINDOWS\system32\drivers\usbccgp.sys 2006-11-22 13:39 21,504 –a—— C:\WINDOWS\system32\hidserv.dll (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-12-21 01:40 ——– d——– C:\Program Files\Common Files 2006-12-20 02:34 ——– d——– C:\Program Files\Symantec AntiVirus 2006-12-20 02:31 ——– d——– C:\Documents and Settings\Brandon Bredda\Application Data\Xfire 2006-12-19 22:28 ——– d–h—– C:\Program Files\InstallShield Installation Information 2006-12-19 21:08 1380 –a—— C:\Documents and Settings\Brandon Bredda\Application Data\wklnhst.dat 2006-12-17 23:00 ——– d——– C:\Documents and Settings\Brandon Bredda\Application Data\Adobe 2006-12-17 03:58 ——– d——– C:\Program Files\EA GAMES 2006-12-17 03:09 ——– d——– C:\Program Files\Internet Explorer 2006-12-17 03:07 ——– d——– C:\Program Files\Windows Media Player 2006-12-17 03:03 ——– d——– C:\Program Files\Outlook Express 2006-12-17 03:03 ——– d——– C:\Program Files\Common Files\System 2006-12-14 22:43 ——– d——– C:\Program Files\Adobe 2006-12-14 22:41 ——– d——– C:\Program Files\Common Files\Adobe 2006-12-14 21:47 ——– d——– C:\Program Files\RGB 2006-12-13 21:04 ——– d——– C:\Program Files\Common Files\Microsoft Shared 2006-12-13 21:02 ——– d——– C:\Program Files\Futuremark 2006-12-10 04:10 163644 –a—— C:\WINDOWS\system32\drivers\secdrv.sys 2006-12-09 00:08 ——– d—s—- C:\Program Files\Xfire 2006-12-06 22:14 2330624 –a—— C:\WINDOWS\system32\wmvcore.dll 2006-11-27 20:12 ——– d——– C:\Program Files\WinRAR 2006-11-27 20:08 ——– d——– C:\Program Files\MSN Messenger 2006-11-27 20:05 ——– d——– C:\Program Files\iTunes 2006-11-27 20:02 ——– d——– C:\Program Files\Google 2006-11-27 19:43 ——– d——– C:\Program Files\DIGStream 2006-11-27 19:43 ——– d——– C:\Program Files\DAEMON Tools 2006-11-27 19:43 ——– d——– C:\Program Files\Common Files\Symantec Shared 2006-11-27 19:41 ——– d——– C:\Program Files\Common Files\LightScribe 2006-11-17 12:40 86016 –a—— C:\WINDOWS\system32\OpenAL32.dll 2006-11-17 12:40 262144 –a—— C:\WINDOWS\system32\wrap_oal.dll 2006-11-11 22:47 ——– d——– C:\Documents and Settings\Brandon Bredda\Application Data\Ventrilo 2006-11-11 22:19 ——– d——– C:\Program Files\Ventrilo 2006-11-11 22:14 ——– d——– C:\Program Files\Common Files\Wise Installation Wizard 2006-11-09 16:43 ——– d——– C:\Program Files\Java 2006-11-08 17:41 ——– d——– C:\Documents and Settings\Brandon Bredda\Application Data\AdobeUM 2006-11-07 23:06 679424 –a—— C:\WINDOWS\system32\inetcomm.dll 2006-11-07 19:28 ——– d——– C:\Program Files\PokerStars 2006-11-06 12:59 ——– d——– C:\Program Files\iPod 2006-11-04 14:14 1245696 –a—— C:\WINDOWS\system32\msxml4.dll 2006-11-01 05:45 ——– d——– C:\Program Files\Electronic Arts 2006-10-30 12:33 ——– d——– C:\Program Files\MSXML 4.0 2006-10-19 07:56 713216 –a—— C:\WINDOWS\system32\sxs.dll 2006-10-13 06:35 65536 –a—— C:\WINDOWS\system32\nwwks.dll 2006-10-13 06:35 64000 –a—— C:\WINDOWS\system32\nwapi32.dll 2006-10-13 06:35 142336 –a—— C:\WINDOWS\system32\nwprovau.dll 2006-10-09 22:12 98304 –a—— C:\WINDOWS\system32\CmdLineExt.dll 2006-09-28 16:05 2414360 –a—— C:\WINDOWS\system32\d3dx9_31.dll 2006-09-28 16:05 237848 –a—— C:\WINDOWS\system32\xactengine2_4.dll 2006-09-28 16:04 68888 –a—— C:\WINDOWS\system32\xinput1_3.dll 2006-09-28 16:03 15128 –a—— C:\WINDOWS\system32\x3daudio1_1.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "MsnMsgr"="\"C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\" /background" "EA Core"="\"C:\\Program Files\\Electronic Arts\\EA Link\\Core.exe\" -silent" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "ehTray"="C:\\WINDOWS\\ehome\\ehtray.exe" "SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_09\\bin\\jusched.exe\"" "hpWirelessAssistant"="C:\\Program Files\\hpq\\HP Wireless Assistant\\HP Wireless Assistant.exe" "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup" "nwiz"="nwiz.exe /install" "MsmqIntCert"="regsvr32 /s mqrt.dll" "High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" "SynTPEnh"="C:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe" "QPService"="\"C:\\Program Files\\HP\\QuickPlay\\QPService.exe\"" "HP Software Update"="C:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe" @="" "ISUSPM Startup"="\"c:\\Program Files\\Common Files\\InstallShield\\UpdateService\\isuspm.exe\" -startup" "ISUSScheduler"="\"C:\\Program Files\\Common Files\\InstallShield\\UpdateService\\issch.exe\" -start" "QlbCtrl"=hex(2):25,50,72,6f,67,72,61,6d,46,69,6c,65,73,25,5c,48,65,77,6c,65,\ 74,74,2d,50,61,63,6b,61,72,64,5c,48,50,20,51,75,69,63,6b,20,4c,61,75,6e,63,\ 68,20,42,75,74,74,6f,6e,73,5c,51,6c,62,43,74,72,6c,2e,65,78,65,20,2f,53,74,\ 61,72,74,00 "Cpqset"="C:\\Program Files\\HPQ\\Default Settings\\cpqset.exe" "RecGuard"="C:\\Windows\\SMINST\\RecGuard.exe" "Reminder"="C:\\Windows\\CREATOR\\Remind_XP.exe" "DAEMON Tools"="\"C:\\Program Files\\DAEMON Tools\\daemon.exe\" -lang 1033" "ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\"" "vptray"="C:\\PROGRA~1\\SYMANT~1\\VPTray.exe" "DIGStream"="C:\\Program Files\\DIGStream\\digstream.exe" "ISUSPM"="\"C:\\Program Files\\Common Files\\InstallShield\\UpdateService\\isuspm.exe\" -scheduler" "iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\"" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000000 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 "InstallVisualStyle"=hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,52,65,73,6f,75,72,\ 63,65,73,5c,54,68,65,6d,65,73,5c,52,6f,79,61,6c,65,5c,52,6f,79,61,6c,65,2e,\ 6d,73,73,74,79,6c,65,73,00 "InstallTheme"=hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,52,65,73,6f,75,72,63,65,\ 73,5c,54,68,65,6d,65,73,5c,52,6f,79,61,6c,65,2e,74,68,65,6d,65,00 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoCDBurning"=dword:00000000 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run] [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}" "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}" "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" Completion time: 06-12-21 1:41:07.81 C:\ComboFix.txt … 06-12-21 01:41

Hi osok,
thanks for the logs I asked about and sorry for the delayin getting back to you.
I've just moved into my new house and I didn't have internet yet.

Delete this folder if listed:
C:\Program Files\VSAdd-in

You need to create a new Clean restore point.

Note: This will remove all previous Restore Points

Turn off System Restore:

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

Restart your computer, turn it back on.

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Remove the Check Turn off System Restore.
Click Apply, and then click OK.

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Check "Hide file extensions for known file types."
Under the "Hidden files" folder, Uncheck "Show hidden files and folders."
Check "Hide protected operating system files."
Click Apply, and then click OK.




If you dont have any programs like these, I would recommend that you get them. Spywareblaster, Spywareguard. They will add 1000's of sites to your resticted zone and block some hijacks from happening. I also have a FREE FIREWALL and FREE ANTI VIRUS if you need one.

It is critical to have both a firewall and anti virus to protect your system.

Keep your system up to date and run Adaware & Spybot, once a week works, and hopefully you will be ok from here on. Both are available below.

Safe Surfing. biggrin.gif

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein

Regards,

Rosty.

thank you very much for all your help, it is highly appreciated….

Hi osok,

thank you very much for all your help, it is highly appreciated….

You're welcome I did it with pleasure.

Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Regards,

Rosty.

Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php