WinAntiVirusPro2006

JIM SCHAEF - 06-12-17 15:23:11.18 Service Pack 2 ComboFix 06.11.27W - Running from: "C:\Documents and Settings\JIM SCHAEF\Desktop" ((((((((((((((((((((((((((((((((((((((((((((( Look2Me's Log )))))))))))))))))))))))))))))))))))))))))))))))))) REGISTRY ENTRIES REMOVED: * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * Granting sedebugprivilege to Administrators … successful ((((((((((((((((((((((((((((((((((((((((((((( Qoologic's Log ))))))))))))))))))))))))))))))))))))))))))))))))))) No infected Qoologic files found. Reg entries were fixed (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\system32\components ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Folders Quarantined: C:\QooBox\Purity\Documents and Settings\JIM SCHAEF\My Documents\PPATCH~2 ((((((((((((((((((((((((((((((( Files Created from 2006-11-17 to 2006-12-17 )))))))))))))))))))))))))))))))))) 2006-12-10 22:28 3,968 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys 2006-12-06 16:02 d——– C:\WINDOWS\CSC 2006-12-06 15:55 2,200 –a—— C:\WINDOWS\system32\tmp.reg 2006-12-06 10:52 d——– C:\Program Files\Lavasoft 2006-11-27 20:27 d——– C:\Program Files\SymNetDrv 2006-11-27 19:03 4,233,901 –a—— C:\WINDOWS\system32\SystemDoctorSetup.exe 2006-11-27 18:48 d——– C:\Program Files\Common Files\SystemDoctor 2006 2006-11-27 18:21 4,608 –a—— C:\WINDOWS\system32\drivers\symlcbrd.sys 2006-11-27 18:21 d——– C:\Program Files\Norton Internet Security 2006-11-27 18:20 91,904 –a—— C:\WINDOWS\system32\S32EVNT1.DLL 2006-11-27 18:20 124,016 –a—— C:\WINDOWS\system32\drivers\SYMEVENT.SYS 2006-11-27 18:17 d——– C:\WINDOWS\system32\appmgmt 2006-11-27 00:04 d——– C:\Documents and Settings\All Users\Application Data\Avg7 (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-12-17 15:13 ——– d——– C:\Program Files\Common Files\Symantec Shared 2006-12-17 15:04 ——– d-a—— C:\Program Files\Common Files 2006-12-10 22:28 ——– d——– C:\Program Files\Grisoft 2006-12-06 17:05 ——– d——– C:\Program Files\Internet Explorer 2006-12-06 11:07 ——– d——– C:\Program Files\Spybot - Search & Destroy 2006-12-06 10:53 ——– d——– C:\Documents and Settings\JIM SCHAEF\Application Data\Lavasoft 2006-12-04 18:57 ——– d——– C:\Program Files\Messenger 2006-12-04 18:55 ——– d——– C:\Program Files\Sierra On-Line 2006-12-04 18:55 ——– d——– C:\Program Files\NetWaiting 2006-12-04 18:55 ——– d——– C:\Program Files\Modem Helper 2006-12-04 18:55 ——– d——– C:\Program Files\Common Files\Services 2006-12-04 18:55 ——– d——– C:\Program Files\Apoint 2006-11-28 19:05 ——– d——– C:\Documents and Settings\JIM SCHAEF\Application Data\HP 2006-11-27 22:01 ——– d——– C:\Program Files\Common Files\AOL 2006-11-27 22:01 ——– d——– C:\Program Files\AOL 2006-11-27 21:23 ——– d——– C:\Program Files\Common Files\Companion Wizard 2006-11-27 20:27 ——– d——– C:\Program Files\Symantec 2006-11-11 19:13 ——– d——– C:\Documents and Settings\JIM SCHAEF\Application Data\U3 2006-11-11 13:43 ——– d——– C:\Program Files\Google (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe" "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "Aim6"="\"C:\\Program Files\\Common Files\\AOL\\Launch\\AOLLaunch.exe\" /d locale=en-US ee://aol/imApp" "swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\1.0.720.3640\\GoogleToolbarNotifier.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "HostManager"="C:\\Program Files\\Common Files\\AOL\\1124323516\\ee\\AOLSoftware.exe" "IPHSend"="C:\\Program Files\\Common Files\\AOL\\IPHSend\\IPHSend.exe" "ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\"" "cmonitor"="C:\\Program Files\\SystemDoctor 2006 Free\\pasmon.exe" "Symantec NetDriver Monitor"="C:\\PROGRA~1\\SYMNET~1\\SNDMon.exe /Consumer" "LWBMOUSE"="C:\\Program Files\\NASDAK\\OmniMouse Driver\\4.1\\MOUSE32A.EXE" "!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000004 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}" "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}" "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\HP Digital Imaging Monitor.lnk" "backup"="C:\\WINDOWS\\pss\\HP Digital Imaging Monitor.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\HP\\DIGITA~1\\bin\\hpqtra08.exe " "item"="HP Digital Imaging Monitor" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\HP Image Zone Fast Start.lnk" "backup"="C:\\WINDOWS\\pss\\HP Image Zone Fast Start.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\HP\\DIGITA~1\\bin\\hpqthb08.exe -s" "item"="HP Image Zone Fast Start" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="msmsgs" "hkey"="HKCU" "command"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spyware Doctor] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="swdoctor" "hkey"="HKCU" "command"="\"C:\\Program Files\\Spyware Doctor\\swdoctor.exe\" /Q" "inimapping"="0" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\HP Usg Daily.job C:\WINDOWS\tasks\Norton AntiVirus - Scan my computer - JIM SCHAEF.job Completion time: 06-12-17 15:29:03.96 C:\ComboFix.txt … 06-12-17 15:29

When I browsed for the file using the online program, i couldn't locate the file. It wasnt there (even after i exposed all hidden files), so that's why that posting isnt available to you. thank you

Hi mustang66gtguy,

Things look much better now. How is the computer running? Let's just run another scan. I am optimistic that it will not find anything and then we can wrap this up.

Now run this online scan using Internet Explorer:
Kaspersky Online Scanner from http://www.kaspersky.com/virusscanner

Next Click on Launch Kaspersky Online Scanner

You will be prompted to install an ActiveX component from Kaspersky, Click Yes.

• The program will launch and then begin downloading the latest definition files:
• Once the files have been downloaded click on NEXT
• Now click on Scan Settings
• In the scan settings make that the following are selected:
• Scan using the following Anti-Virus database:
• Standard
• Scan Options:
• Scan Archives
• Scan Mail Bases
• Click OK
• Now under select a target to scan:
• Select My Computer
• This will program will start and scan your system.
• The scan will take a while so be patient and let it run.
• Once the scan is complete it will display if your system has been infected.
• Now click on the Save as Text button:
• Save the file to your desktop.

Copy and paste that information from Kapersky in your next post along with another hijackthis log.