Help with ads.k8l.info . Please help :(

Hello dude and Welcome to TomCoyote,

Please do the following:

STEP 1.
======
GMER
Please create a new subfolder in the Program Files folder called GMER. If you have an older version of GMER installed, you must delete it.

• Download GMER and extract it to the C:\program files\GMER folder.
  
• Please rename the GMER file
  Note: You can rename gmer.exe to anything you like as long as you keep the .exe ending.
  Run the Gmer.exe renamed program by double-clicking the executable file (gmer.exe) in Windows Explorer.
  You may be prompted to scan immediately if GMER detects rootkit activity.
• If you are prompted to scan your system click "yes" to begin the scan.
• If you are not prompted, Click the "Rootkit" tab, then click "Scan".

At the end of the scan, click "Copy" to copy the scan results to the clipboard. Then paste the results in a notepad file and also paste them back in your next reply.


Download this file – combofix.exe
and save it to your desktop. Also save the below command in Notepad as a text file so that you can copy/paste in safe mode.

"%userprofile%\desktop\combofix.exe" /wow

Boot into safe mode by tapping the F8 key just before Windows starts to load.

go to start –> run and copy/paste in the following:

"%userprofile%\desktop\combofix.exe" /wow

When finished, it shall produce a log for you. Save it and post that log in your next reply.

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

In your next post, please include

• the results from the GMER scan
• combofix log
• new hijackthis log

*use separate posts to ensure the logs don't get cut off!

Hi Susan, Thank you so much for your quick response. However I am unable to post a new reply to show you my Gmer scan log. A microsoft internet explorer dialog box pop-up saying that the maximum allowed length is 102400 characters. Current Characters 171894. What should I do in order to post the results to show you?????

Here is the results of my combofix log as requested: "KeLviN" - 07-01-12 23:38:29 Service Pack 2 ComboFix 07-01-10 - Running from: "C:\Documents and Settings\KeLviN\desktop" Command switches used :: /wow ((((((((((((((((((((((((((((((( Files Created from 2006-12-12 to 2007-01-12 )))))))))))))))))))))))))))))))))) 2007-01-12 22:54 d——– C:\Program Files\GMER 2007-01-12 22:53 80 –a—— C:\WINDOWS\gmer_uninstall.cmd 2007-01-11 23:05 d——– C:\WINDOWS\system32\ActiveScan 2007-01-03 23:31 d——– C:\DOCUME~1\ALLUSE~1\Application Data\Spybot - Search & Destroy 2007-01-03 20:02 d——– C:\Program Files\Yahoo! 2007-01-03 19:09 d——– C:\DOCUME~1\KeLviN\Application Data\System Restore 2006-12-28 00:26 223,128 –a—— C:\WINDOWS\system32\drivers\vaxscsi.sys 2006-12-27 22:08 12,928 –a—— C:\WINDOWS\system32\drivers\filedisk.sys 2006-12-27 21:47 223,128 –a—— C:\WINDOWS\system32\drivers\dtscsi.sys 2006-12-27 21:40 d——– C:\DVDShrink 2006-12-27 21:39 5,600 –a—— C:\WINDOWS\system\WINASPI.DLL 2006-12-27 21:39 45,056 –a—— C:\WINDOWS\system32\WNASPI32.DLL 2006-12-27 21:39 4,672 –a—— C:\WINDOWS\system\WOWPOST.EXE 2006-12-27 21:39 25,244 –a—— C:\WINDOWS\system32\drivers\ASPI32.SYS 2006-12-27 21:21 d——– C:\DOCUME~1\KeLviN\Application Data\SlySoft (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-01-12 23:37 ——– d——– C:\DOCUME~1\KeLviN\Application Data\utorrent 2007-01-03 19:25 ——– d——– C:\DOCUME~1\KeLviN\Application Data\lavasoft 2006-12-27 21:20 40 —hs—- C:\DOCUME~1\KeLviN\Application Data\.zreglib 2006-12-08 00:05 639224 –a—— C:\WINDOWS\system32\drivers\sptd.sys 2006-12-07 14:40 2362184 –a—— C:\WINDOWS\system32\wmvcore.dll 2006-11-08 13:06 679424 –a—— C:\WINDOWS\system32\inetcomm.dll 2006-10-19 21:56 713216 –a—— C:\WINDOWS\system32\sxs.dll 2006-10-13 20:35 142336 –a—— C:\WINDOWS\system32\nwprovau.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\system32\\ctfmon.exe" "PID41IER.exe "="C:\\WINDOWS\\system32\\PID41IER.exe " [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "PaperPort PTD"="C:\\Program Files\\ScanSoft\\PaperPort\\pptd40nt.exe" "IndexSearch"="C:\\Program Files\\ScanSoft\\PaperPort\\IndexSearch.exe" "SetDefPrt"="C:\\Program Files\\Brother\\Brmfl04a\\BrStDvPt.exe" "ControlCenter2.0"="C:\\Program Files\\Brother\\ControlCenter2\\brctrcen.exe /autorun" "AVG7_CC"="D:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe /STARTUP" "TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" "iTunesHelper"="\"D:\\Program Files\\iTunes\\iTunesHelper.exe\"" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "PCSuiteTrayApplication"="D:\\PROGRA~1\\Nokia\\NOKIAP~1\\LAUNCH~1.EXE -startup" "MSConfig"="C:\\WINDOWS\\PCHealth\\HelpCtr\\Binaries\\MSConfig.exe /auto" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\Adobe Reader Speed Launch.lnk" "backup"="C:\\WINDOWS\\pss\\Adobe Reader Speed Launch.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\Adobe\\ACROBA~1.0\\Reader\\READER~1.EXE " "item"="Adobe Reader Speed Launch" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\Microsoft Office.lnk" "backup"="C:\\WINDOWS\\pss\\Microsoft Office.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\MICROS~2\\Office\\OSA9.EXE -b -l" "item"="Microsoft Office" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="iTunesHelper" "hkey"="HKLM" "command"="\"D:\\Program Files\\iTunes\\iTunesHelper.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\leci] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="leci" "hkey"="HKLM" "command"="C:\\WINDOWS\\$NtUninstallKB905414$\\leci.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="NeroCheck" "hkey"="HKLM" "command"="C:\\WINDOWS\\system32\\NeroCheck.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="qttask" "hkey"="HKLM" "command"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\rejififa] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="rejififa" "hkey"="HKLM" "command"="C:\\WINDOWS\\$NtUninstallKB910437$\\rejififa.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="PDVDServ" "hkey"="HKLM" "command"="\"d:\\Program Files\\CyberLink\\PowerDVD\\PDVDServ.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="SOUNDMAN" "hkey"="HKLM" "command"="SOUNDMAN.EXE" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="SSBkgdupdate" "hkey"="HKLM" "command"="\"C:\\Program Files\\Common Files\\Scansoft Shared\\SSBkgdUpdate\\SSBkgdupdate.exe\" -Embedding -boot" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="jusched" "hkey"="HKLM" "command"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe" "inimapping"="0" [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "AVG7_Run"="D:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE" [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run] "AVG7_Run"="D:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 Usnsvc REG_MULTI_SZ usnsvc\0\0 [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{355e9941-a890-11da-85ba-806d6172696f}] Shell\AutoRun\command E:\ASUSACPI.exe Completion time: 07-01-12 23:38:47

A microsoft internet explorer dialog box pop-up saying that the maximum allowed length is 102400 characters. Current Characters 171894.

So GMER ran and gave you huge log and you cannot post it all? Can you split it up and post it in serveral replies?

Also can you tell me anything about this file?

C:\WINDOWS\system32\PID41IER.exe

Please show all files for your system.
You will need to reverse this process when all steps are done.


Submit File to Jotti
Please click on Jotti
Use the "Browse" button and locate the following file on your computer:
C:\WINDOWS\system32\PID41IER.exe
Click the "Submit" button.
Please copy and post (reply) with the results

If Jotti's service load is too high, you can use the following scanner instead:
http://www.virustotal.com/xhtml/index_en.html

Please also check the properties of those files (right-click and select properties from the popupmenu). Look if you can find some company information, etc.

Hi susan this is the first part of the GMer log. Second part of the GMER log to follow. Device \FileSystem\Fastfat \FatCdrom IRP_MJ_QUERY_VOLUME_INFORMATION 89AE2980 Device \FileSystem\Fastfat \FatCdrom IRP_MJ_SET_VOLUME_INFORMATION 89AE2980 Device \FileSystem\Fastfat \FatCdrom IRP_MJ_DIRECTORY_CONTROL 89AE2980 Device \FileSystem\Fastfat \FatCdrom IRP_MJ_FILE_SYSTEM_CONTROL 89AE2980 Device \FileSystem\Fastfat \FatCdrom IRP_MJ_DEVICE_CONTROL 89AE2980 Device \FileSystem\Fastfat \FatCdrom IRP_MJ_SHUTDOWN 89AE2980 Device \FileSystem\Fastfat \FatCdrom IRP_MJ_LOCK_CONTROL 89AE2980 Device \FileSystem\Fastfat \FatCdrom IRP_MJ_CLEANUP 89AE2980 Device \FileSystem\Fastfat \FatCdrom IRP_MJ_PNP 89AE2980 Device \Driver\00000034 \Device\00000044 IRP_MJ_POWER [BA6DFD74] sptd.sys Device \Driver\00000034 \Device\00000044 IRP_MJ_SYSTEM_CONTROL [BA6F92A2] sptd.sys Device \Driver\00000034 \Device\00000044 IRP_MJ_PNP [BA6FA228] sptd.sys Device \Driver\usbohci \Device\USBPDO-0 IRP_MJ_CREATE 89C09980 Device \Driver\usbohci \Device\USBPDO-0 IRP_MJ_CLOSE 89C09980 Device \Driver\usbohci \Device\USBPDO-0 IRP_MJ_DEVICE_CONTROL 89C09980 Device \Driver\usbohci \Device\USBPDO-0 IRP_MJ_INTERNAL_DEVICE_CONTROL 89C09980 Device \Driver\usbohci \Device\USBPDO-0 IRP_MJ_POWER 89C09980 Device \Driver\usbohci \Device\USBPDO-0 IRP_MJ_SYSTEM_CONTROL 89C09980 Device \Driver\usbohci \Device\USBPDO-0 IRP_MJ_PNP 89C09980 Device \Driver\usbehci \Device\USBPDO-1 IRP_MJ_CREATE 89C546C0 Device \Driver\usbehci \Device\USBPDO-1 IRP_MJ_CLOSE 89C546C0 Device \Driver\usbehci \Device\USBPDO-1 IRP_MJ_DEVICE_CONTROL 89C546C0 Device \Driver\usbehci \Device\USBPDO-1 IRP_MJ_INTERNAL_DEVICE_CONTROL 89C546C0 Device \Driver\usbehci \Device\USBPDO-1 IRP_MJ_POWER 89C546C0 Device \Driver\usbehci \Device\USBPDO-1 IRP_MJ_SYSTEM_CONTROL 89C546C0 Device \Driver\usbehci \Device\USBPDO-1 IRP_MJ_PNP 89C546C0 Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_CREATE 89E521D8 Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_READ 89E521D8 Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_WRITE 89E521D8 Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_FLUSH_BUFFERS 89E521D8 Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_DEVICE_CONTROL 89E521D8 Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_INTERNAL_DEVICE_CONTROL 89E521D8 Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_SHUTDOWN 89E521D8 Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_CLEANUP 89E521D8 Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_POWER 89E521D8 Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_SYSTEM_CONTROL 89E521D8 Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_PNP 89E521D8 Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_CREATE 89E521D8 Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_READ 89E521D8 Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_WRITE 89E521D8 Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_FLUSH_BUFFERS 89E521D8 Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_DEVICE_CONTROL 89E521D8 Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_INTERNAL_DEVICE_CONTROL 89E521D8 Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_SHUTDOWN 89E521D8 Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_CLEANUP 89E521D8 Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_POWER 89E521D8 Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_SYSTEM_CONTROL 89E521D8 Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_PNP 89E521D8 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CREATE 89C47310 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CLOSE 89C47310 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_READ 89C47310 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_WRITE 89C47310 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_FLUSH_BUFFERS 89C47310 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_DEVICE_CONTROL 89C47310 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_INTERNAL_DEVICE_CONTROL 89C47310 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SHUTDOWN 89C47310 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_POWER 89C47310 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SYSTEM_CONTROL 89C47310 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_PNP 89C47310 Device \Driver\nvata \Device\00000065 IRP_MJ_CREATE 89E511D8 Device \Driver\nvata \Device\00000065 IRP_MJ_CREATE_NAMED_PIPE 89E511D8 Device \Driver\nvata \Device\00000065 IRP_MJ_CLOSE 89E511D8 Device \Driver\nvata \Device\00000065 IRP_MJ_READ 89E511D8 Device \Driver\nvata \Device\00000065 IRP_MJ_WRITE 89E511D8 Device \Driver\nvata \Device\00000065 IRP_MJ_QUERY_INFORMATION 89E511D8 Device \Driver\nvata \Device\00000065 IRP_MJ_SET_INFORMATION 89E511D8 Device \Driver\nvata \Device\00000065 IRP_MJ_QUERY_EA 89E511D8 Device \Driver\nvata \Device\00000065 IRP_MJ_SET_EA 89E511D8 Device \Driver\nvata \Device\00000065 IRP_MJ_FLUSH_BUFFERS 89E511D8 Device \Driver\nvata \Device\00000065 IRP_MJ_QUERY_VOLUME_INFORMATION 89E511D8 Device \Driver\nvata \Device\00000065 IRP_MJ_SET_VOLUME_INFORMATION 89E511D8 Device \Driver\nvata \Device\00000065 IRP_MJ_DIRECTORY_CONTROL 89E511D8 Device \Driver\nvata \Device\00000065 IRP_MJ_FILE_SYSTEM_CONTROL 89E511D8 Device \Driver\nvata \Device\00000065 IRP_MJ_DEVICE_CONTROL 89E511D8 Device \Driver\nvata \Device\00000065 IRP_MJ_INTERNAL_DEVICE_CONTROL 89E511D8 Device \Driver\nvata \Device\00000065 IRP_MJ_SHUTDOWN 89E511D8 Device \Driver\nvata \Device\00000065 IRP_MJ_LOCK_CONTROL 89E511D8 Device \Driver\nvata \Device\00000065 IRP_MJ_CLEANUP 89E511D8 Device \Driver\nvata \Device\00000065 IRP_MJ_CREATE_MAILSLOT 89E511D8 Device \Driver\nvata \Device\00000065 IRP_MJ_QUERY_SECURITY 89E511D8 Device \Driver\nvata \Device\00000065 IRP_MJ_SET_SECURITY 89E511D8 Device \Driver\nvata \Device\00000065 IRP_MJ_POWER 89E511D8 Device \Driver\nvata \Device\00000065 IRP_MJ_SYSTEM_CONTROL 89E511D8 Device \Driver\nvata \Device\00000065 IRP_MJ_DEVICE_CHANGE 89E511D8 Device \Driver\nvata \Device\00000065 IRP_MJ_QUERY_QUOTA 89E511D8 Device \Driver\nvata \Device\00000065 IRP_MJ_SET_QUOTA 89E511D8 Device \Driver\nvata \Device\00000065 IRP_MJ_PNP 89E511D8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CREATE 89C47310 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CLOSE 89C47310 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_READ 89C47310 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_WRITE 89C47310 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_FLUSH_BUFFERS 89C47310 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_DEVICE_CONTROL 89C47310 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_INTERNAL_DEVICE_CONTROL 89C47310 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SHUTDOWN 89C47310 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_POWER 89C47310 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SYSTEM_CONTROL 89C47310 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_PNP 89C47310 Device \Driver\nvata \Device\00000067 IRP_MJ_CREATE 89E511D8 Device \Driver\nvata \Device\00000067 IRP_MJ_CREATE_NAMED_PIPE 89E511D8 Device \Driver\nvata \Device\00000067 IRP_MJ_CLOSE 89E511D8 Device \Driver\nvata \Device\00000067 IRP_MJ_READ 89E511D8 Device \Driver\nvata \Device\00000067 IRP_MJ_WRITE 89E511D8 Device \Driver\nvata \Device\00000067 IRP_MJ_QUERY_INFORMATION 89E511D8 Device \Driver\nvata \Device\00000067 IRP_MJ_SET_INFORMATION 89E511D8 Device \Driver\nvata \Device\00000067 IRP_MJ_QUERY_EA 89E511D8 Device \Driver\nvata \Device\00000067 IRP_MJ_SET_EA 89E511D8 Device \Driver\nvata \Device\00000067 IRP_MJ_FLUSH_BUFFERS 89E511D8 Device \Driver\nvata \Device\00000067 IRP_MJ_QUERY_VOLUME_INFORMATION 89E511D8 Device \Driver\nvata \Device\00000067 IRP_MJ_SET_VOLUME_INFORMATION 89E511D8 Device \Driver\nvata \Device\00000067 IRP_MJ_DIRECTORY_CONTROL 89E511D8 Device \Driver\nvata \Device\00000067 IRP_MJ_FILE_SYSTEM_CONTROL 89E511D8 Device \Driver\nvata \Device\00000067 IRP_MJ_DEVICE_CONTROL 89E511D8 Device \Driver\nvata \Device\00000067 IRP_MJ_INTERNAL_DEVICE_CONTROL 89E511D8 Device \Driver\nvata \Device\00000067 IRP_MJ_SHUTDOWN 89E511D8 Device \Driver\nvata \Device\00000067 IRP_MJ_LOCK_CONTROL 89E511D8 Device \Driver\nvata \Device\00000067 IRP_MJ_CLEANUP 89E511D8 Device \Driver\nvata \Device\00000067 IRP_MJ_CREATE_MAILSLOT 89E511D8 Device \Driver\nvata \Device\00000067 IRP_MJ_QUERY_SECURITY 89E511D8 Device \Driver\nvata \Device\00000067 IRP_MJ_SET_SECURITY 89E511D8 Device \Driver\nvata \Device\00000067 IRP_MJ_POWER 89E511D8 Device \Driver\nvata \Device\00000067 IRP_MJ_SYSTEM_CONTROL 89E511D8 Device \Driver\nvata \Device\00000067 IRP_MJ_DEVICE_CHANGE 89E511D8 Device \Driver\nvata \Device\00000067 IRP_MJ_QUERY_QUOTA 89E511D8 Device \Driver\nvata \Device\00000067 IRP_MJ_SET_QUOTA 89E511D8 Device \Driver\nvata \Device\00000067 IRP_MJ_PNP 89E511D8 Device \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_CREATE 890C0980 Device \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_CLOSE 890C0980 Device \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_DEVICE_CONTROL 890C0980 Device \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_INTERNAL_DEVICE_CONTROL 890C0980 Device \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_CLEANUP 890C0980 Device \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_PNP 890C0980 Device \Driver\NetBT \Device\NetbiosSmb IRP_MJ_CREATE 890C0980 Device \Driver\NetBT \Device\NetbiosSmb IRP_MJ_CLOSE 890C0980 Device \Driver\NetBT \Device\NetbiosSmb IRP_MJ_DEVICE_CONTROL 890C0980 Device \Driver\NetBT \Device\NetbiosSmb IRP_MJ_INTERNAL_DEVICE_CONTROL 890C0980 Device \Driver\NetBT \Device\NetbiosSmb IRP_MJ_CLEANUP 890C0980 Device \Driver\NetBT \Device\NetbiosSmb IRP_MJ_PNP 890C0980 Device \Driver\usbohci \Device\USBFDO-0 IRP_MJ_CREATE 89C09980 Device \Driver\usbohci \Device\USBFDO-0 IRP_MJ_CLOSE 89C09980 Device \Driver\usbohci \Device\USBFDO-0 IRP_MJ_DEVICE_CONTROL 89C09980 Device \Driver\usbohci \Device\USBFDO-0 IRP_MJ_INTERNAL_DEVICE_CONTROL 89C09980 Device \Driver\usbohci \Device\USBFDO-0 IRP_MJ_POWER 89C09980 Device \Driver\usbohci \Device\USBFDO-0 IRP_MJ_SYSTEM_CONTROL 89C09980 Device \Driver\usbohci \Device\USBFDO-0 IRP_MJ_PNP 89C09980 Device \Driver\usbehci \Device\USBFDO-1 IRP_MJ_CREATE 89C546C0 Device \Driver\usbehci \Device\USBFDO-1 IRP_MJ_CLOSE 89C546C0 Device \Driver\usbehci \Device\USBFDO-1 IRP_MJ_DEVICE_CONTROL 89C546C0 Device \Driver\usbehci \Device\USBFDO-1 IRP_MJ_INTERNAL_DEVICE_CONTROL 89C546C0 Device \Driver\usbehci \Device\USBFDO-1 IRP_MJ_POWER 89C546C0 Device \Driver\usbehci \Device\USBFDO-1 IRP_MJ_SYSTEM_CONTROL 89C546C0 Device \Driver\usbehci \Device\USBFDO-1 IRP_MJ_PNP 89C546C0 Device \Driver\nvata \Device\NvAta0 IRP_MJ_CREATE 89E511D8 Device \Driver\nvata \Device\NvAta0 IRP_MJ_CREATE_NAMED_PIPE 89E511D8 Device \Driver\nvata \Device\NvAta0 IRP_MJ_CLOSE 89E511D8 Device \Driver\nvata \Device\NvAta0 IRP_MJ_READ 89E511D8 Device \Driver\nvata \Device\NvAta0 IRP_MJ_WRITE 89E511D8 Device \Driver\nvata \Device\NvAta0 IRP_MJ_QUERY_INFORMATION 89E511D8 Device \Driver\nvata \Device\NvAta0 IRP_MJ_SET_INFORMATION 89E511D8 Device \Driver\nvata \Device\NvAta0 IRP_MJ_QUERY_EA 89E511D8 Device \Driver\nvata \Device\NvAta0 IRP_MJ_SET_EA 89E511D8 Device \Driver\nvata \Device\NvAta0 IRP_MJ_FLUSH_BUFFERS 89E511D8 Device \Driver\nvata \Device\NvAta0 IRP_MJ_QUERY_VOLUME_INFORMATION 89E511D8 Device \Driver\nvata \Device\NvAta0 IRP_MJ_SET_VOLUME_INFORMATION 89E511D8 Device \Driver\nvata \Device\NvAta0 IRP_MJ_DIRECTORY_CONTROL

Hi Susan, the iwerd thing is I have followed your steps to show all hidden files and folders. However, I couldn't locate the C:\WONDOWS\system32\PID41PER.exe. Instead I use to windows search funtion and found 2 files to be in C:\WINDOWS\Prefetch\PID41IER.EXE-18D9EB8E.pf and C:\WINDOWS\Prefetch\PID41IER.EXE-21FA56DF.pf. I have run the Jotti program and here are the results: File: PID41IER.EXE-18D9EB8E.pf Status: OK MD5 1068f78850b6e692d270bf436d2e9e4e Packers detected: - Scan taken on 14 Jan 2007 16:06:23 (GMT) AntiVir Found nothing ArcaVir Found nothing Avast Found nothing AVG Antivirus Found nothing BitDefender Found nothing ClamAV Found nothing Dr.Web Found nothing F-Prot Antivirus Found nothing F-Secure Anti-Virus Found nothing Fortinet Found nothing Kaspersky Anti-Virus Found nothing NOD32 Found nothing Norman Virus Control Found nothing VirusBuster Found nothing VBA32 Found nothing File: PID41IER.EXE-21FA56DF.pf Status: OK MD5 2862b5845e1c97c075cc4a2887ae0f4d Packers detected: - AntiVir Found nothing ArcaVir Found nothing Avast Found nothing AVG Antivirus Found nothing BitDefender Found nothing ClamAV Found nothing Dr.Web Found nothing F-Prot Antivirus Found nothing F-Secure Anti-Virus Found nothing Fortinet Found nothing Kaspersky Anti-Virus Found nothing NOD32 Found nothing Norman Virus Control Found nothing VirusBuster Found nothing VBA32 Found nothing

as requested this are the description for each files. One thing to note is that the time and date of these files creation happens to be the first attack of spyware for my computer.

PID41IER.EXE-18D9EB8E.pf
Type of file: pf file
Opens with: unkown application
Location: C:\WINDOWS\Prefetch
Size 21.4 KB
Size on disk 24 KB

PID41IER.EXE-21FA56DF.pf
Type of file: pf file
Opens with: unkown application
Location: C:\WINDOWS\Prefetch
Size 21.4 KB
Size on disk 24 KB

Your GMER scan was cut off. I was interested in seeing the end to make sure I did not miss anything.

STEP 1.
======
Please download ATF Cleaner by Atribune.

This program is for XP and Windows 2000 only

• Double-click ATF-Cleaner.exe to run the program.
• Under Main choose: Select All
• Click the Empty Selected button.

If you use Firefox browser

• Click Firefox at the top and choose:Select All
• Click the Empty Selected button.
• NOTE: If you would like to keep your saved passwords, please click
• No at the prompt.

If you use Opera browser

• Click Opera at the top and choose: Select All
• Click the Empty Selected button.
• NOTE:If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.


This scan works with Internet Explorer.
======
Panda Active Scan
Please go to Panda ActiveScan.
Once you are on the Panda site click the Scan your PC button
A new window will open…click the Check Now button

• Enter your Country
• Enter your State/Province
• Enter your e-mail address and click send
• Select either Home User or Company
• Click the big Scan Now button
• If it wants to install an ActiveX component allow it
• It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
• When download is complete, click on Local Disks to start the scan
• When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location.

Post the contents of the Panda scan report, along with a new HijackThis Log, by using Add Reply.

Let us know if any problems persist.

Can you tell me anything about the lavukasyk.dll file? Do you have any ComPlus Applications?

O2 - BHO: 0 - {C2941232-6F95-4D41-6387-3B6C9FAF4ADD} - C:\Program Files\ComPlus Applications\lavukasyk.dll

STEP 1.
======
Please show all files for your system.
You will need to reverse this process when all steps are done.


Submit File to Jotti
Please click on Jotti
Use the "Browse" button and locate the following file on your computer:
C:\Program Files\ComPlus Applications\lavukasyk.dll
Click the "Submit" button.
Please copy and post (reply) with the results

If Jotti's service load is too high, you can use the following scanner instead:
http://www.virustotal.com/xhtml/index_en.html

Please also check the properties of those files (right-click and select properties from the popupmenu). Look if you can find some company information, etc.

STEP 2.
======
Combofix

• You can skip the download if you still have the ComboFix.
• Download this file - combofix.exe
• Double click combofix.exe & follow the prompts.
• When finished, it shall produce a log for you. Post that log in your next reply

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Please let me know about the ComPlus Applications and post(reply) with the results from Jotti, the ComboFix log and a new hijackthis log.

Hi Susan, What is a complus application? What are examples of common complus applications? As is, I don't know anything about lavukasyk.dll file, as well. Anyway, will run the following steps you've mentioned in the above reply when i get back from work Will post reply as soon as i get the results. Thank you so much, you've been a great help thus far.