What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Help

51 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #31
Yes, unfortunately Kasperskys still doesn't work. BTW, I looked at Microsoft concerning System Backup's blank calendar page. I wanted to see if there was something I could do. I checked to see whether the registry still had all the keys/values Microsoft says it should. It definitely does. So that's not the problem. Mike
Post #32
Still going through the logs.

You do not want to use system restore right now or anytime during the fix. If you did you would place back all we took out. :rant2:

Lets clear it.

___________________________________
Please create a 'clean' System Restore Point:
The reason for doing this is in case you need system restore you don't put back all we just took out.
Right click My Computer
Then Propeties then system restore
Place a check mark by turn off system restore
Click APPLY
Windows will give you a warning click yes
REBOOT

Now go right back to the same place and unchecksystem restore
Click APPLYand OK

It should give you a new system restore point.
Post #33 last edited
Hi Bob, I suppose I wasn't clear. I searched to see whether I could use System Restore (thinking I could go back before the problem arose). But the calendar page is down and I simply cannot use that function. So placing a new restore date seems to be out of the question for now. I am not in front of my computer at the moment, but I will try the approach you suggest. Could it lead to any great problem? Could I be left 'in between', with no system page? In my own naive imaginings, I suppose that it is related to the other problems I ahve whereby I can't see the text of my emails and cannot use the radio buttons. Best, Mike
Post #34
I am not home yet. But I will soon try the procedure you mentioned. I am a bit concerned though abou the issue I raised, above. Could this further compromise my system or give me no system page? If I do this procedure with System Restore, will it erase earlier points? I think, given the pobems I've had, it may not work at all.
Post #35
Yes it will erase ealier restore points. But at this point I truly believe your better off. But no reason to jump on that now. So just hold off. I hope to have a partial fix for you soon. But the first thing we need to do is get rid of the malware that may have more than likely caused all this . If we don't do that first were just spitting in the wind.
Post #36
Start WinPFind3U. Copy/Paste the information in the quotebox below into the pane where it says "Paste fix here" and then click the Run Fix button.

[Registry - Non-Microsoft Only]
< BHO's > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
YN -> {A3EC8848-59D5-41B4-CF82-DB69B8462960} [HKLM] -> %ProgramFiles%\Internet Explorer\qucaw.dll [Reg Data - Value does not exist]
[Files/Folders - Created Within 30 days]
NY -> core.cache.dsk -> %System32%\drivers\core.cache.dsk
NY -> core.sys -> %System32%\drivers\core.sys
[Files/Folders - Modified Within 30 days]
NY -> imsins.BAK -> %SystemRoot%\imsins.BAK
NY -> core.cache.dsk -> %System32%\drivers\core.cache.dsk
NY -> core.sys -> %System32%\drivers\core.sys
NY -> hosts.20070401-042640.backup -> %System32%\drivers\etc\hosts.20070401-042640.backup
[File String Scan - Non-Microsoft Only]
NY -> abetterinternet.com , -> %System32%\drivers\etc\hosts.20070401-042640.backup
NY -> abetterinternet.com , -> %System32%\drivers\etc\hosts.bak



The fix should only take a very short time. When the fix is completed a message box will popup telling you that it is finished. CLick the Ok button and Notepad will open with a log of actions taken during the fix. Post that information back here along with a new WinPFind3u scan.

I will review the information when it comes back in.

Also let me know of any problems you encountered performing the steps above.



___________________________

combofix.exe
2. Double click combofix.exe & follow the prompts.
3. When finished, it shall produce a log for you. Post that log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall


___________________________

Please post those 2 logs for me.
Post #37
Hi Bob,


I did the Winpfind3U run fix as you asked. The program opened a window that said it had to close and reboot in order to finish the fix. I clicked on 'ok' and it rebooted. But no Notepad log with actions of the fix came up (Is there soem saved file that I can find and send?). Below is the new Winpfind3u scan. Below that is the new ComboFix log. Please note that I already have ComboFix downloaded on your instructions earlier on (see above) and I am using that version, rather than downloading it again.


WinPFind3 logfile created on: 4/14/2007 7:27:22 PM
WinPFind3U by OldTimer - Version 1.0.34 Folder = C:\Documents and Settings\Mike H\Desktop\WinPFind3u\
Microsoft Windows XP Service Pack 2 (Version = 5.1.2600)
Internet Explorer (Version = 7.0.5730.11)

1.50 Gb Total Physical Memory | 1.10 Gb Available Physical Memory | 73.54% Memory free
2.10 Gb Paging File | 1.78 Gb Available in Paging File | 84.57% Paging File free
Paging file location(s): c:\pagefile.sys 768 1536;

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.26 Gb Total Space | 29.65 Gb Free Space | 79.58% Space Free
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded

Computer Name: MIKE
Current User Name: Mike H
Logged in as Administrator.
Current Boot Mode: Normal


[Processes - Non-Microsoft Only]
apntex.exe -> %ProgramFiles%\Apoint\ApntEx.exe -> Alps Electric Co., Ltd. [Ver = 5.5.1.19 | Size = 45056 bytes | Modified Date = 8/19/2004 9:40:08 AM | Attr = ]
apoint.exe -> %ProgramFiles%\Apoint\Apoint.exe -> Alps Electric Co., Ltd. [Ver = 5.5.101.141 | Size = 155648 bytes | Modified Date = 9/13/2004 11:33:20 AM | Attr = ]
ashdisp.exe -> %ProgramFiles%\Alwil Software\Avast4\ashDisp.exe -> [Ver = 4, 7, 936, 0 | Size = 108160 bytes | Modified Date = 1/15/2007 12:28:58 PM | Attr = ]
ashmaisv.exe -> %ProgramFiles%\Alwil Software\Avast4\ashMaiSv.exe -> ALWIL Software [Ver = 4, 7, 936, 0 | Size = 255616 bytes | Modified Date = 1/15/2007 12:28:32 PM | Attr = ]
ashserv.exe -> %ProgramFiles%\Alwil Software\Avast4\ashServ.exe -> [Ver = 4, 7, 936, 0 | Size = 132736 bytes | Modified Date = 1/15/2007 12:28:52 PM | Attr = ]
ashwebsv.exe -> %ProgramFiles%\Alwil Software\Avast4\ashWebSv.exe -> ALWIL Software [Ver = 4, 7, 936, 0 | Size = 370304 bytes | Modified Date = 1/15/2007 12:27:52 PM | Attr = ]
aswupdsv.exe -> %ProgramFiles%\Alwil Software\Avast4\aswUpdSv.exe -> [Ver = | Size = 59008 bytes | Modified Date = 1/15/2007 12:18:24 PM | Attr = ]
ati2evxx.exe -> %System32%\ati2evxx.exe -> [Ver = | Size = 389120 bytes | Modified Date = 8/31/2004 8:38:00 PM | Attr = ]
ati2evxx.exe -> %System32%\ati2evxx.exe -> [Ver = | Size = 389120 bytes | Modified Date = 8/31/2004 8:38:00 PM | Attr = ]
atiptaxx.exe -> %ProgramFiles%\ATI Technologies\ATI Control Panel\atiptaxx.exe -> ATI Technologies, Inc. [Ver = 6.14.10.5120 | Size = 339968 bytes | Modified Date = 8/31/2004 9:10:00 PM | Attr = ]
bcmwltry.exe -> %System32%\BCMWLTRY.EXE -> Dell Inc [Ver = 3.100.41.0 | Size = 872556 bytes | Modified Date = 2/23/2005 11:19:10 AM | Attr = ]
guard.exe -> %ProgramFiles%\AVG Anti-Spyware 7.5\guard.exe -> Anti-Malware Development a.s. [Ver = 7, 5, 0, 47 | Size = 204800 bytes | Modified Date = 9/28/2006 10:13:20 AM | Attr = ]
hpgs2wnd.exe -> %ProgramFiles%\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe -> Hewlett-Packard [Ver = 2,3,0,0\ 162 | Size = 69632 bytes | Modified Date = 4/17/2002 10:42:56 AM | Attr = ]
hpgs2wnf.exe -> %ProgramFiles%\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe -> [Ver = 2, 6, 0, 162 | Size = 77824 bytes | Modified Date = 4/17/2002 10:49:16 AM | Attr = ]
hpwuschd2.exe -> %ProgramFiles%\HP\HP Software Update\HPWuSchd2.exe -> Hewlett-Packard Co. [Ver = 50.0.146.000 | Size = 49152 bytes | Modified Date = 2/16/2005 11:11:42 PM | Attr = ]
jusched.exe -> %ProgramFiles%\Java\jre1.5.0_11\bin\jusched.exe -> Sun Microsystems, Inc. [Ver = 5.0.110.3 | Size = 75520 bytes | Modified Date = 12/15/2006 3:23:28 AM | Attr = ]
nicconfigsvc.exe -> %ProgramFiles%\Dell\NICCONFIGSVC\NICCONFIGSVC.exe -> Dell Inc. [Ver = 1, 0, 0, 1 | Size = 356352 bytes | Modified Date = 3/3/2005 11:29:02 PM | Attr = ]
pctspk.exe -> %System32%\pctspk.exe -> [Ver = 1, 0, 0, 1 | Size = 163840 bytes | Modified Date = 7/18/2002 4:58:40 PM | Attr = ]
superantispyware.exe -> %ProgramFiles%\SUPERAntiSpyware\SUPERAntiSpyware.exe -> SUPERAntiSpyware.com [Ver = 3, 6, 0, 1000 | Size = 1310720 bytes | Modified Date = 2/27/2007 11:39:26 AM | Attr = ]
winpfind3u.exe -> %SystemDrive%\Documents and Settings\Mike H\Desktop\WinPFind3u\WinPFind3U.exe -> OldTimer Tools [Ver = 1.0.34.0 | Size = 318976 bytes | Modified Date = 4/10/2007 10:00:18 PM | Attr = ]
wltray.exe -> %System32%\WLTRAY.EXE -> Dell Inc [Ver = 3.100.41.0 | Size = 696425 bytes | Modified Date = 2/23/2005 11:19:14 AM | Attr = ]
wltrysvc.exe -> %System32%\WLTRYSVC.EXE -> [Ver = | Size = 65536 bytes | Modified Date = 2/23/2005 11:19:14 AM | Attr = ]

[Win32 Services - Non-Microsoft Only]
(aswUpdSv) avast! iAVS4 Control Service [Win32_Own | Auto | Running] -> %ProgramFiles%\Alwil Software\Avast4\aswUpdSv.exe -> [Ver = | Size = 59008 bytes | Modified Date = 1/15/2007 12:18:24 PM | Attr = ]
(Ati HotKey Poller) Ati HotKey Poller [Win32_Own | Auto | Running] -> %System32%\ati2evxx.exe -> [Ver = | Size = 389120 bytes | Modified Date = 8/31/2004 8:38:00 PM | Attr = ]
(avast! Antivirus) avast! Antivirus [Win32_Own | Auto | Running] -> %ProgramFiles%\Alwil Software\Avast4\ashServ.exe -> [Ver = 4, 7, 936, 0 | Size = 132736 bytes | Modified Date = 1/15/2007 12:28:52 PM | Attr = ]
(avast! Mail Scanner) avast! Mail Scanner [Win32_Own | On_Demand | Running] -> %ProgramFiles%\Alwil Software\Avast4\ashMaiSv.exe -> ALWIL Software [Ver = 4, 7, 936, 0 | Size = 255616 bytes | Modified Date = 1/15/2007 12:28:32 PM | Attr = ]
(avast! Web Scanner) avast! Web Scanner [Win32_Own | On_Demand | Running] -> %ProgramFiles%\Alwil Software\Avast4\ashWebSv.exe -> ALWIL Software [Ver = 4, 7, 936, 0 | Size = 370304 bytes | Modified Date = 1/15/2007 12:27:52 PM | Attr = ]
(AVG Anti-Spyware Guard) AVG Anti-Spyware Guard [Win32_Own | Auto | Running] -> %ProgramFiles%\AVG Anti-Spyware 7.5\guard.exe -> Anti-Malware Development a.s. [Ver = 7, 5, 0, 47 | Size = 204800 bytes | Modified Date = 9/28/2006 10:13:20 AM | Attr = ]
(dmadmin) Logical Disk Manager Administrative Service [Win32_Shared | On_Demand | Stopped] -> %System32%\dmadmin.exe -> Microsoft Corp., Veritas Software [Ver = 2600.2180.503.0 | Size = 224768 bytes | Modified Date = 8/4/2004 8:00:00 AM | Attr = ]
(IDriverT) InstallDriver Table Manager [Win32_Own | On_Demand | Stopped] -> %CommonProgramFiles%\InstallShield\Driver\11\Intel 32\IDriverT.exe -> Macrovision Corporation [Ver = 11.00.28844 | Size = 69632 bytes | Modified Date = 4/4/2005 12:41:10 AM | Attr = ]
(NICCONFIGSVC) NICCONFIGSVC [Win32_Own | Auto | Running] -> %ProgramFiles%\Dell\NICCONFIGSVC\NICCONFIGSVC.exe -> Dell Inc. [Ver = 1, 0, 0, 1 | Size = 356352 bytes | Modified Date = 3/3/2005 11:29:02 PM | Attr = ]
(PREVXAgent) Prevx Agent [Win32_Own | Auto | Stopped] -> %ProgramFiles%\Prevx1\PXAgent.exe -> File not found
(wltrysvc) Dell Wireless WLAN Tray Service [Win32_Own | Auto | Running] -> %System32%\wltrysvc.exe C:\WINDOWS\System32\bcmwltry.exe -> File not found

[Registry - Non-Microsoft Only]
< Run [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Adobe Photo Downloader -> %ProgramFiles%\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe -> Adobe Systems Incorporated [Ver = 3.0.0.49815 | Size = 57344 bytes | Modified Date = 6/6/2005 11:46:24 PM | Attr = ]
Apoint -> %ProgramFiles%\Apoint\Apoint.exe -> Alps Electric Co., Ltd. [Ver = 5.5.101.141 | Size = 155648 bytes | Modified Date = 9/13/2004 11:33:20 AM | Attr = ]
ATIPTA -> %ProgramFiles%\ATI Technologies\ATI Control Panel\atiptaxx.exe -> ATI Technologies, Inc. [Ver = 6.14.10.5120 | Size = 339968 bytes | Modified Date = 8/31/2004 9:10:00 PM | Attr = ]
avast! -> %ProgramFiles%\Alwil Software\Avast4\ashDisp.exe -> [Ver = 4, 7, 936, 0 | Size = 108160 bytes | Modified Date = 1/15/2007 12:28:58 PM | Attr = ]
Dell Wireless Manager UI -> %System32%\WLTRAY.EXE -> Dell Inc [Ver = 3.100.41.0 | Size = 696425 bytes | Modified Date = 2/23/2005 11:19:14 AM | Attr = ]
HP Software Update -> %ProgramFiles%\HP\HP Software Update\HPWuSchd2.exe -> Hewlett-Packard Co. [Ver = 50.0.146.000 | Size = 49152 bytes | Modified Date = 2/16/2005 11:11:42 PM | Attr = ]
PCTVOICE -> %System32%\pctspk.exe -> [Ver = 1, 0, 0, 1 | Size = 163840 bytes | Modified Date = 7/18/2002 4:58:40 PM | Attr = ]
QuickTime Task -> %ProgramFiles%\QuickTime\qttask.exe -> File not found
Share-to-Web Namespace Daemon -> %ProgramFiles%\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe -> Hewlett-Packard [Ver = 2,3,0,0\ 162 | Size = 69632 bytes | Modified Date = 4/17/2002 10:42:56 AM | Attr = ]
SunJavaUpdateSched -> %ProgramFiles%\Java\jre1.5.0_11\bin\jusched.exe -> Sun Microsystems, Inc. [Ver = 5.0.110.3 | Size = 75520 bytes | Modified Date = 12/15/2006 3:23:28 AM | Attr = ]
UserFaultCheck -> -> File not found
< Run [HKCU] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SUPERAntiSpyware -> %ProgramFiles%\SUPERAntiSpyware\SUPERAntiSpyware.exe -> SUPERAntiSpyware.com [Ver = 3, 6, 0, 1000 | Size = 1310720 bytes | Modified Date = 2/27/2007 11:39:26 AM | Attr = ]
updateMgr -> %ProgramFiles%\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe -> Adobe Systems Incorporated [Ver = 3.1.0.9 | Size = 307200 bytes | Modified Date = 10/24/2005 4:53:40 PM | Attr = ]
Yahoo! Pager -> %ProgramFiles%\Yahoo!\Messenger\YahooMessenger.exe -> Yahoo! Inc. [Ver = 8,1,0,209 | Size = 4662776 bytes | Modified Date = 11/30/2006 10:49:04 PM | Attr = ]
< Common Startup > -> C:\Documents and Settings\All Users\Start Menu\Programs\Startup
%AllUsersStartup%\Adobe Reader Speed Launch.lnk -> %ProgramFiles%\Adobe\Acrobat 7.0\Reader\reader_sl.exe -> Adobe Systems Incorporated [Ver = 7.0.5.2005092300 | Size = 29696 bytes | Modified Date = 9/24/2005 2:05:26 AM | Attr = ]
%AllUsersStartup%\Image Transfer.lnk -> %ProgramFiles%\Sony Corporation\Image Transfer\SonyTray.exe -> [Ver = | Size = 73728 bytes | Modified Date = 7/11/2002 10:28:50 PM | Attr = ]
< ShellExecuteHooks [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
{57B86673-276A-48B2-BAE7-C6DBB3020EB8} [HKLM] -> %ProgramFiles%\AVG Anti-Spyware 7.5\shellexecutehook.dll [AVG Anti-Spyware 7.5] -> Anti-Malware Development a.s. [Ver = 7, 5, 0, 47 | Size = 73728 bytes | Modified Date = 9/28/2006 10:13:28 AM | Attr = ]
{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} [HKLM] -> %ProgramFiles%\SUPERAntiSpyware\SASSEH.DLL [] -> SuperAdBlocker.com [Ver = 1, 0, 0, 1008 | Size = 77824 bytes | Modified Date = 12/20/2006 12:55:48 PM | Attr = ]
< SecurityProviders [HKLM] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\\SecurityProviders
< Winlogon settings [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
< Winlogon settings [HKCU] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
< Winlogon\Notify settings [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
!SASWinLogon -> %ProgramFiles%\SUPERAntiSpyware\SASWINLO.dll -> SUPERAntiSpyware.com [Ver = 1, 0, 0, 1030 | Size = 282624 bytes | Modified Date = 2/27/2007 11:39:26 AM | Attr = ]
AtiExtEvent -> %System32%\ati2evxx.dll -> [Ver = | Size = 86016 bytes | Modified Date = 8/31/2004 8:38:00 PM | Attr = ]
< HOSTS File > (23 bytes) -> C:\WINDOWS\System32\drivers\etc\Hosts
127.0.0.1 localhost -> ->
< Internet Explorer Settings > ->
HKLM: Default_Page_URL -> http://go.microsoft.com/fwlink/?LinkId=69157 ->
HKLM: Main\\Default_Search_URL -> http://go.microsoft.com/fwlink/?LinkId=54896 ->
HKLM: Local Page -> %SystemRoot%\system32\blank.htm ->
HKLM: Search Page -> http://go.microsoft.com/fwlink/?LinkId=54896 ->
HKLM: Start Page -> about:blank ->
HKLM: CustomizeSearch -> http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm ->
HKLM: SearchAssistant -> http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm ->
HKCU: Local Page -> C:\WINDOWS\system32\blank.htm ->
HKCU: Search Page -> http://www.microsoft.com/isapi/redir.dll?p…amp;ar=iesearch ->
HKCU: Start Page -> http://www.google.com/ ->
HKCU: ProxyEnable -> 0 ->
< BHO's > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} [HKLM] -> %ProgramFiles%\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [Adobe PDF Reader Link Helper] -> Adobe Systems Incorporated [Ver = 7.0.7.2006011200 | Size = 63128 bytes | Modified Date = 1/12/2006 9:38:22 PM | Attr = ]
{53707962-6F74-2D53-2644-206D7942484F} [HKLM] -> %ProgramFiles%\Spybot - Search & Destroy\SDHelper.dll [] -> Safer Networking Limited [Ver = 1, 4, 0, 0 | Size = 853672 bytes | Modified Date = 5/31/2005 2:04:00 AM | Attr = ]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} [HKLM] -> %ProgramFiles%\Java\jre1.5.0_11\bin\ssv.dll [SSVHelper Class] -> Sun Microsystems, Inc. [Ver = 5.0.110.3 | Size = 440056 bytes | Modified Date = 12/15/2006 3:23:24 AM | Attr = ]
< Internet Explorer ToolBars [HKCU] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\
WebBrowser\\{C7768536-96F8-4001-B1A2-90EE21279187} [HKLM] -> Reg Data - Key not found [Reg Data - Key not found] -> File not found
WebBrowser\\{EF99BD32-C1FB-11D2-892F-0090271D4F88} [HKLM] -> Reg Data - Key not found [Yahoo! Toolbar] -> File not found
< Internet Explorer Extensions [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} [HKLM] -> %ProgramFiles%\Java\jre1.5.0_11\bin\npjpi150_11.dll [MenuText: Sun Java Console] -> Sun Microsystems, Inc. [Ver = 5.0.110.3 | Size = 75528 bytes | Modified Date = 12/15/2006 3:23:26 AM | Attr = ]
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} [HKCU] -> %ProgramFiles%\Java\jre1.5.0_11\bin\ssv.dll [MenuText: Sun Java Console] -> Sun Microsystems, Inc. [Ver = 5.0.110.3 | Size = 440056 bytes | Modified Date = 12/15/2006 3:23:24 AM | Attr = ]
< Internet Explorer Menu Extensions [HKCU] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\
Add to AD Black List -> %ProgramFiles%\Avant Browser\AddToADBlackList.htm -> [Ver = | Size = 166 bytes | Modified Date = 2/24/2006 3:38:52 AM | Attr = ]
Block All Images from the Same Server -> %ProgramFiles%\Avant Browser\AddAllToADBlackList.htm -> [Ver = | Size = 169 bytes | Modified Date = 2/24/2006 3:38:54 AM | Attr = ]
Highlight -> %ProgramFiles%\Avant Browser\Highlight.htm -> [Ver = | Size = 191 bytes | Modified Date = 2/24/2006 3:38:52 AM | Attr = ]
Open All Links in This Page… -> %ProgramFiles%\Avant Browser\OpenAllLinks.htm -> [Ver = | Size = 272 bytes | Modified Date = 2/24/2006 3:38:50 AM | Attr = ]
Open In New Avant Browser -> %ProgramFiles%\Avant Browser\OpenInNewBrowser.htm -> [Ver = | Size = 1496 bytes | Modified Date = 2/24/2006 3:38:44 AM | Attr = ]
Search -> %ProgramFiles%\Avant Browser\Search.htm -> [Ver = | Size = 188 bytes | Modified Date = 2/24/2006 3:38:58 AM | Attr = ]
< DNS Name Servers [HKLM] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\
{5030B2C4-9729-499E-ABDE-71357FB80D54} -> () ->
{6A6AE238-423F-4CC9-801D-CC60B167E986} -> (Dell TrueMobile 1300 WLAN Mini-PCI Card) ->
< Protocol Handlers [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\
ipp -> Reg Data - Key not found -> File not found
msdaipp -> Reg Data - Key not found -> File not found
< Downloaded Program Files > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\
{17492023-C23A-453E-A040-C7C580BBF700} -> Windows Genuine Advantage Validation Tool - CodeBase = http://download.microsoft.com/download/3/9…heckControl.cab ->
{30528230-99F7-4BB4-88D8-FA1D4F56A2AB} -> YInstStarter Class - CodeBase = http://us.dl1.yimg.com/download.yahoo.com/…nst_current.cab ->
{31E68DE2-5548-4B23-88F0-C51E6A0F695E} -> Microsoft PID Sniffer - CodeBase = https://support.microsoft.com/OAS/ActiveX/odc.cab ->
{4B48D5DF-9021-45F7-A240-60304302A215} -> Malicious Software Removal Tool - CodeBase = http://download.microsoft.com/download/5/c…/WebCleaner.cab ->
{4F1E5B1A-2A80-42CA-8532-2D05CB959537} -> MSN Photo Upload Tool - CodeBase = http://by112fd.bay112.hotmail.msn.com/resources/MsnPUpld.cab ->
{6414512B-B978-451D-A0D8-FCFDF33E833C} -> WUWebControl Class - CodeBase = http://update.microsoft.com/windowsupdate/…b?1136866715612 ->
{6E32070A-766D-4EE6-879C-DC1FA91D2FC3} -> MUWebControl Class - CodeBase = http://update.microsoft.com/microsoftupdat…b?1151131197821 ->
{8AD9C840-044E-11D1-B3E9-00805F499D93} -> Java Plug-in 1.5.0_11 - CodeBase = http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab ->
{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} -> Java Plug-in 1.5.0_11 - CodeBase = http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab ->
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} -> Java Plug-in 1.5.0_11 - CodeBase = http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab ->
{D27CDB6E-AE6D-11CF-96B8-444553540000} -> - CodeBase = http://fpdownload.macromedia.com/pub/shock…ash/swflash.cab ->


[Files/Folders - Created Within 30 days]
!KillBox -> %SystemDrive%\!KillBox -> [Folder | Created Date = 4/6/2007 8:50:05 PM | Attr = ]
63530fac73fa18291e2d055c -> %SystemDrive%\63530fac73fa18291e2d055c -> [Folder | Created Date = 3/31/2007 9:14:12 AM | Attr = ]
Drivers -> %SystemDrive%\Drivers -> [Folder | Created Date = 3/26/2007 1:03:14 AM | Attr = ]
fixwareout -> %SystemDrive%\fixwareout -> [Folder | Created Date = 4/4/2007 2:15:19 PM | Attr = ]
hiberfil.sys -> %SystemDrive%\hiberfil.sys -> [Ver = | Size = 1609871360 bytes | Created Date = 1/1/1601 5:00:00 AM | Attr = HS]
QooBox -> %SystemDrive%\QooBox -> [Folder | Created Date = 4/6/2007 2:52:22 AM | Attr = ]
SDFix -> %SystemDrive%\SDFix -> [Folder | Created Date = 4/5/2007 5:19:45 PM | Attr = ]
erdnt -> %SystemRoot%\erdnt -> [Folder | Created Date = 4/6/2007 2:52:58 AM | Attr = ]
temp -> %SystemRoot%\temp -> [Folder | Created Date = 4/9/2007 2:38:03 AM | Attr = ]
TWlrZSBI -> %SystemRoot%\TWlrZSBI -> [Folder | Created Date = 4/1/2007 8:43:13 PM | Attr = HS]
actskin4.ocx -> %System32%\actskin4.ocx -> [Ver = 4, 2, 7, 3 | Size = 380928 bytes | Created Date = 4/10/2007 11:23:09 PM | Attr = ]
aswBoot.exe -> %System32%\aswBoot.exe -> [Ver = 4, 7, 936, 0 | Size = 689280 bytes | Created Date = 4/10/2007 11:23:09 PM | Attr = ]
AVASTSS.scr -> %System32%\AVASTSS.scr -> ALWIL Software [Ver = 4, 7, 936, 0 | Size = 90112 bytes | Created Date = 4/10/2007 11:23:09 PM | Attr = ]
CMMGR32.EXE -> %System32%\CMMGR32.EXE -> [Ver = | Size = 0 bytes | Created Date = 4/11/2007 11:43:47 PM | Attr = ]
java.exe -> %System32%\java.exe -> Sun Microsystems, Inc. [Ver = 5.0.110.3 | Size = 49248 bytes | Created Date = 4/6/2007 1:04:49 PM | Attr = ]
javaw.exe -> %System32%\javaw.exe -> Sun Microsystems, Inc. [Ver = 5.0.110.3 | Size = 53346 bytes | Created Date = 4/6/2007 1:04:49 PM | Attr = ]
javaws.exe -> %System32%\javaws.exe -> Sun Microsystems, Inc. [Ver = 5.0.110.3 | Size = 127078 bytes | Created Date = 4/6/2007 1:04:49 PM | Attr = ]
jpicpl32.cpl -> %System32%\jpicpl32.cpl -> Sun Microsystems, Inc. [Ver = 5.0.110.3 | Size = 49265 bytes | Created Date = 4/6/2007 1:04:49 PM | Attr = ]
LTOCX12n.INF -> %System32%\LTOCX12n.INF -> [Ver = | Size = 1458 bytes | Created Date = 3/26/2007 1:04:17 AM | Attr = ]
ltocx12n.ocx -> %System32%\ltocx12n.ocx -> LEAD Technologies, Inc. [Ver = 12.1.0.015 | Size = 610816 bytes | Created Date = 3/26/2007 1:04:17 AM | Attr = ]
SONYHCY.DLL -> %System32%\SONYHCY.DLL -> Sony Corporation [Ver = 1.00.0628 | Size = 53248 bytes | Created Date = 3/26/2007 1:03:14 AM | Attr = ]
aavmker4.sys -> %System32%\drivers\aavmker4.sys -> ALWIL Software [Ver = 4.7.892.0 | Size = 31560 bytes | Created Date = 4/10/2007 11:23:16 PM | Attr = ]
aswmon.sys -> %System32%\drivers\aswmon.sys -> ALWIL Software [Ver = 4.7.892.0 | Size = 85952 bytes | Created Date = 4/10/2007 11:23:14 PM | Attr = ]
aswmon2.sys -> %System32%\drivers\aswmon2.sys -> ALWIL Software [Ver = 4.7.892.0 | Size = 94424 bytes | Created Date = 4/10/2007 11:23:14 PM | Attr = ]
aswRdr.sys -> %System32%\drivers\aswRdr.sys -> ALWIL Software [Ver = 4.7.936.0 | Size = 23352 bytes | Created Date = 4/10/2007 11:23:17 PM | Attr = ]
aswTdi.sys -> %System32%\drivers\aswTdi.sys -> ALWIL Software [Ver = 4.7.936.0 | Size = 43176 bytes | Created Date = 4/10/2007 11:23:17 PM | Attr = ]
AvgAsCln.sys -> %System32%\drivers\AvgAsCln.sys -> GRISOFT, s.r.o. [Ver = 1.0.0.14 | Size = 3968 bytes | Created Date = 4/3/2007 5:13:50 PM | Attr = ]
core.cache.dsk -> %System32%\drivers\core.cache.dsk -> [Ver = | Size = 182323 bytes | Created Date = 3/31/2007 3:38:35 AM | Attr = ]
core.sys -> %System32%\drivers\core.sys -> [Ver = | Size = 72320 bytes | Created Date = 3/31/2007 3:38:35 AM | Attr = ]
sonyhcb.sys -> %System32%\drivers\sonyhcb.sys -> Sony Corporation [Ver = 1, 0, 0, 53 | Size = 6097 bytes | Created Date = 3/26/2007 1:03:14 AM | Attr = ]
sonyhcc.sys -> %System32%\drivers\sonyhcc.sys -> Sony Corporation [Ver = 1, 0, 0, 53 | Size = 38739 bytes | Created Date = 3/26/2007 1:03:14 AM | Attr = ]
Sonyhcp.dll -> %System32%\drivers\Sonyhcp.dll -> [Ver = | Size = 3654 bytes | Created Date = 3/26/2007 1:03:14 AM | Attr = ]
sonyhcs.sys -> %System32%\drivers\sonyhcs.sys -> Sony Corporation [Ver = 1, 0, 0, 53 | Size = 299923 bytes | Created Date = 3/26/2007 1:03:14 AM | Attr = ]

[Files/Folders - Modified Within 30 days]
!KillBox -> %SystemDrive%\!KillBox -> [Folder | Modified Date = 4/11/2007 3:38:36 AM | Attr = ]
63530fac73fa18291e2d055c -> %SystemDrive%\63530fac73fa18291e2d055c -> [Folder | Modified Date = 3/31/2007 10:14:14 AM | Attr = ]
boot.ini -> %SystemDrive%\boot.ini -> [Ver = | Size = 211 bytes | Modified Date = 3/27/2007 6:34:12 PM | Attr = HS]
Config.Msi -> %SystemDrive%\Config.Msi -> [Folder | Modified Date = 4/12/2007 12:28:40 AM | Attr = H ]
Documents and Settings -> %SystemDrive%\Documents and Settings -> [Folder | Modified Date = 4/3/2007 2:00:24 AM | Attr = ]
Drivers -> %SystemDrive%\Drivers -> [Folder | Modified Date = 3/26/2007 2:03:16 AM | Attr = ]
fixwareout -> %SystemDrive%\fixwareout -> [Folder | Modified Date = 4/6/2007 10:24:12 PM | Attr = ]
hiberfil.sys -> %SystemDrive%\hiberfil.sys -> [Ver = | Size = 1609871360 bytes | Modified Date = 4/14/2007 7:10:02 PM | Attr = HS]
HijackThis -> %SystemDrive%\HijackThis -> [Folder | Modified Date = 4/12/2007 1:24:48 AM | Attr = ]
Program Files -> %ProgramFiles% -> [Folder | Modified Date = 4/12/2007 4:19:34 PM | Attr = ]
QooBox -> %SystemDrive%\QooBox -> [Folder | Modified Date = 4/6/2007 3:52:24 AM | Attr = ]
RECYCLER -> %SystemDrive%\RECYCLER -> [Folder | Modified Date = 4/6/2007 2:46:12 AM | Attr = HS]
SDFix -> %SystemDrive%\SDFix -> [Folder | Modified Date = 4/5/2007 6:19:46 PM | Attr = ]
WINDOWS -> %SystemRoot% -> [Folder | Modified Date = 4/14/2007 7:10:32 PM | Attr = ]
Downloaded Program Files -> %SystemRoot%\Downloaded Program Files -> [Folder | Modified Date = 4/11/2007 4:15:16 AM | Attr = S]
erdnt -> %SystemRoot%\erdnt -> [Folder | Modified Date = 4/6/2007 3:53:00 AM | Attr = ]
inf -> %SystemRoot%\inf -> [Folder | Modified Date = 3/30/2007 4:01:40 PM | Attr = H ]
Installer -> %SystemRoot%\Installer -> [Folder | Modified Date = 4/12/2007 12:28:40 AM | Attr = HS]
Minidump -> %SystemRoot%\Minidump -> [Folder | Modified Date = 3/31/2007 7:58:36 PM | Attr = ]
Prefetch -> %SystemRoot%\Prefetch -> [Folder | Modified Date = 4/6/2007 3:01:08 AM | Attr = ]
system.ini -> %SystemRoot%\system.ini -> [Ver = | Size = 227 bytes | Modified Date = 3/27/2007 6:34:12 PM | Attr = ]
system32 -> %System32% -> [Folder | Modified Date = 4/14/2007 7:23:50 PM | Attr = ]
Tasks -> %SystemRoot%\Tasks -> [Folder | Modified Date = 4/14/2007 7:13:28 PM | Attr = S]
temp -> %SystemRoot%\temp -> [Folder | Modified Date = 4/14/2007 7:24:30 PM | Attr = ]
TWlrZSBI -> %SystemRoot%\TWlrZSBI -> [Folder | Modified Date = 4/2/2007 3:04:36 AM | Attr = HS]
win.ini -> %SystemRoot%\win.ini -> [Ver = | Size = 677 bytes | Modified Date = 3/27/2007 6:34:12 PM | Attr = ]
WinSxS -> %SystemRoot%\WinSxS -> [Folder | Modified Date = 4/1/2007 10:36:26 PM | Attr = ]
MP Scheduled Scan.job -> %SystemRoot%\tasks\MP Scheduled Scan.job -> [Ver = | Size = 330 bytes | Modified Date = 4/14/2007 7:13:28 PM | Attr = H ]
SA.DAT -> %SystemRoot%\tasks\SA.DAT -> [Ver = | Size = 6 bytes | Modified Date = 4/14/2007 7:10:22 PM | Attr = H ]
CatRoot2 -> %System32%\CatRoot2 -> [Folder | Modified Date = 4/13/2007 1:36:44 AM | Attr = ]
CMMGR32.EXE -> %System32%\CMMGR32.EXE -> [Ver = | Size = 0 bytes | Modified Date = 4/12/2007 12:43:48 AM | Attr = ]
config -> %System32%\config -> [Folder | Modified Date = 4/11/2007 11:20:14 PM | Attr = ]
CONFIG.NT -> %System32%\CONFIG.NT -> [Ver = | Size = 2626 bytes | Modified Date = 4/11/2007 12:23:18 AM | Attr = ]
dllcache -> %System32%\dllcache -> [Folder | Modified Date = 4/12/2007 10:52:16 PM | Attr = RHS]
drivers -> %System32%\drivers -> [Folder | Modified Date = 4/14/2007 7:22:42 PM | Attr = ]
FxsTmp -> %System32%\FxsTmp -> [Folder | Modified Date = 4/13/2007 12:12:54 PM | Attr = ]
mapisvc.inf -> %System32%\mapisvc.inf -> [Ver = | Size = 1074 bytes | Modified Date = 4/3/2007 1:57:36 AM | Attr = ]
tmp.reg -> %System32%\tmp.reg -> [Ver = | Size = 2222 bytes | Modified Date = 4/6/2007 10:26:10 PM | Attr = ]
wpa.dbl -> %System32%\wpa.dbl -> [Ver = | Size = 2206 bytes | Modified Date = 4/1/2007 9:06:56 PM | Attr = ]
core.cache.dsk -> %System32%\drivers\core.cache.dsk -> [Ver = | Size = 182323 bytes | Modified Date = 3/31/2007 4:38:36 AM | Attr = ]
core.sys -> %System32%\drivers\core.sys -> [Ver = | Size = 72320 bytes | Modified Date = 3/31/2007 4:38:36 AM | Attr = ]
etc -> %System32%\drivers\etc -> [Folder | Modified Date = 4/14/2007 7:08:36 PM | Attr = ]

[File String Scan - Non-Microsoft Only]
UPX! , UPX0 , -> %System32%\aswBoot.exe -> [Ver = 4, 7, 936, 0 | Size = 689280 bytes | Modified Date = 1/15/2007 12:32:08 PM | Attr = ]
PEC2 , -> %System32%\dfrg.msc -> [Ver = | Size = 41397 bytes | Modified Date = 8/4/2004 8:00:00 AM | Attr = ]
PEC2 , PECompact2 , -> %System32%\DivX.dll -> DivX, Inc. [Ver = 6.5.0.53 | Size = 639066 bytes | Modified Date = 2/1/2007 12:56:06 AM | Attr = ]
UPX! , UPX0 , -> %System32%\intr32.dll -> Home [Ver = 1.00 | Size = 12800 bytes | Modified Date = 10/20/2006 3:27:34 AM | Attr = ]
Thawte Consulting , -> %System32%\SmartUI2.ocx -> Xceed Software Inc [removed] [removed] www.xceedsoft.com [Ver = 2.00.0202 | Size = 874248 bytes | Modified Date = 6/14/2004 4:04:34 PM | Attr = ]
UPX! , UPX0 , -> %System32%\SrchSTS.exe -> S!Ri [Ver = | Size = 288417 bytes | Modified Date = 4/27/2006 5:49:30 PM | Attr = ]
UPX! , UPX0 , -> %System32%\swreg.exe -> SteelWerX [Ver = 2.0.1.0 | Size = 135168 bytes | Modified Date = 8/29/2006 7:43:54 PM | Attr = ]
UPX! , UPX0 , -> %System32%\swsc.exe -> [Ver = | Size = 40960 bytes | Modified Date = 1/9/2006 10:36:06 AM | Attr = ]
UPX! , UPX0 , -> %System32%\swxcacls.exe -> SteelWerX [Ver = 1.0.1.1 | Size = 79360 bytes | Modified Date = 12/1/2006 6:20:34 AM | Attr = ]
winsync , -> %System32%\wbdbase.deu -> [Ver = | Size = 1309184 bytes | Modified Date = 8/4/2004 8:00:00 AM | Attr = ]
Thawte Consulting , -> %System32%\XceedCry.dll -> Xceed Software Inc [removed] [removed] www.xceedsoft.com [Ver = 1.1.107.0 | Size = 512688 bytes | Modified Date = 11/19/2003 3:59:36 PM | Attr = ]
Thawte Consulting , -> %System32%\XceedZip.dll -> Xceed Software Inc [removed] [removed] www.xceedsoft.com [Ver = 5.0.117.0 | Size = 427864 bytes | Modified Date = 6/14/2004 3:56:26 PM | Attr = ]

< End of report >



HERE IS THE COMBOFOX LOG:

"Mike H" - 07-04-14 19:22:37 Service Pack 2
ComboFix 07-04-05 - Running from: "C:\Documents and Settings\Mike H\Desktop"


(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~
Folders Quarantined:
C:\qoobox\purity\Program Files\FNTS~1
C:\qoobox\purity\Program Files\YSTEM3~1
C:\qoobox\purity\WINDOWS\system32\YMANTE~1


((((((((((((((((((((((((((((((( Files Created from 2007-03-14 to 2007-04-14 ))))))))))))))))))))))))))))))))))


2007-04-12 16:19 d——– C:\Program Files\Avant Browser
2007-04-12 16:19 d——– C:\DOCUME~1\MIKEH~1\APPLIC~1\Avant Profiles
2007-04-12 00:43 0 –a—— C:\WINDOWS\system32\CMMGR32.EXE
2007-04-12 00:28 d——– C:\Program Files\SUPERAntiSpyware
2007-04-12 00:28 d——– C:\DOCUME~1\MIKEH~1\APPLIC~1\SUPERAntiSpyware.com
2007-04-12 00:28 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\SUPERAntiSpyware.com
2007-04-12 00:27 d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-04-11 23:34 d——– C:\DOCUME~1\MIKEH~1\DoctorWeb
2007-04-11 00:23 94,424 –a—— C:\WINDOWS\system32\drivers\aswmon2.sys
2007-04-11 00:23 90,112 –a—— C:\WINDOWS\system32\AVASTSS.scr
2007-04-11 00:23 85,952 –a—— C:\WINDOWS\system32\drivers\aswmon.sys
2007-04-11 00:23 689,280 –a—— C:\WINDOWS\system32\aswBoot.exe
2007-04-11 00:23 43,176 –a—— C:\WINDOWS\system32\drivers\aswTdi.sys
2007-04-11 00:23 31,560 –a—— C:\WINDOWS\system32\drivers\aavmker4.sys
2007-04-11 00:23 23,352 –a—— C:\WINDOWS\system32\drivers\aswRdr.sys
2007-04-11 00:23 1,060,864 –a—— C:\WINDOWS\system32\MFC71.dll
2007-04-11 00:23 d——– C:\Program Files\Alwil Software
2007-04-06 21:50 d——– C:\!KillBox
2007-04-06 14:04 d——– C:\Program Files\Java
2007-04-06 14:01 d——– C:\Program Files\Common Files\Java
2007-04-06 02:45 d——– C:\DOCUME~1\ADMINI~1\APPLIC~1\Share-to-Web Upload Folder
2007-04-03 18:13 3,968 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-04-03 18:13 d——– C:\Program Files\AVG Anti-Spyware 7.5
2007-04-02 02:53 218,112 –a—— C:\Program Files\HijackThis.exe
2007-04-01 21:43 d–hs—- C:\WINDOWS\TWlrZSBI
2007-03-31 10:14 d——– C:\63530fac73fa18291e2d055c
2007-03-31 04:39 1,183,550 –a—— C:\DOCUME~1\NETWOR~1\APPLIC~1\Install.dat
2007-03-31 04:38 8,464 –a—— C:\WINDOWS\system32\sporder.dll
2007-03-31 04:38 72,320 –a—— C:\WINDOWS\system32\drivers\core.sys
2007-03-26 02:04 d——– C:\Program Files\Sony Corporation
2007-03-26 02:04 d——– C:\Program Files\PIXELA
2007-03-26 02:03 6,097 –a—— C:\WINDOWS\system32\drivers\sonyhcb.sys
2007-03-26 02:03 53,248 –a—— C:\WINDOWS\system32\SONYHCY.DLL
2007-03-26 02:03 38,739 –a—— C:\WINDOWS\system32\drivers\sonyhcc.sys
2007-03-26 02:03 3,654 –a—— C:\WINDOWS\system32\drivers\Sonyhcp.dll
2007-03-26 02:03 299,923 –a—— C:\WINDOWS\system32\drivers\sonyhcs.sys
2007-03-26 02:03 d——– C:\Drivers


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2007-04-06 22:26 2222 –a—— C:\WINDOWS\system32\tmp.reg
2007-04-02 04:28 ——– d——– C:\Program Files\spywareblaster
2007-04-02 04:28 ——– d——– C:\Program Files\spywareblaster
2007-03-26 02:04 ——– d–h—– C:\Program Files\installshield installation information
2007-03-26 02:04 ——– d–h—– C:\Program Files\installshield installation information
2007-02-01 00:56 823296 –a—— C:\WINDOWS\system32\divx_xx0c.dll
2007-02-01 00:56 823296 –a—— C:\WINDOWS\system32\divx_xx07.dll
2007-02-01 00:56 802816 –a—— C:\WINDOWS\system32\divx_xx11.dll
2007-02-01 00:56 639066 –a—— C:\WINDOWS\system32\divx.dll
2007-01-31 17:27 524288 –a—— C:\WINDOWS\system32\divxsm.exe
2007-01-30 19:15 118784 –a—— C:\WINDOWS\system32\divxcodecupdatechecker.exe
2007-01-30 01:03 3596288 –a—— C:\WINDOWS\system32\qt-dx331.dll
2007-01-30 01:03 200704 –a—— C:\WINDOWS\system32\ssldivx.dll
2007-01-30 01:03 129784 ——— C:\WINDOWS\system32\pxafs.dll
2007-01-30 01:03 118520 ——— C:\WINDOWS\system32\pxinsi64.exe
2007-01-30 01:03 116472 ——— C:\WINDOWS\system32\pxcpyi64.exe
2007-01-30 01:03 1044480 –a—— C:\WINDOWS\system32\libdivx.dll
2007-01-30 00:56 73728 –a—— C:\WINDOWS\system32\dpl100.dll
2007-01-30 00:56 593920 –a—— C:\WINDOWS\system32\dpugui11.dll
2007-01-30 00:56 57344 –a—— C:\WINDOWS\system32\dpv11.dll
2007-01-30 00:56 53248 –a—— C:\WINDOWS\system32\dpugui10.dll
2007-01-30 00:56 344064 –a—— C:\WINDOWS\system32\dpus11.dll
2007-01-30 00:56 294912 –a—— C:\WINDOWS\system32\dpu11.dll
2007-01-30 00:56 294912 –a—— C:\WINDOWS\system32\dpu10.dll
2007-01-30 00:56 196608 –a—— C:\WINDOWS\system32\dtu100.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"Yahoo! Pager"="\"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe\" -quiet"
"updateMgr"="\"C:\\Program Files\\Adobe\\Acrobat 7.0\\Reader\\AdobeUpdateManager.exe\" AcRdB7_0_7 -reboot 1"
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"SUPERAntiSpyware"="C:\\Program Files\\SUPERAntiSpyware\\SUPERAntiSpyware.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"ATIPTA"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe"
"Dell Wireless Manager UI"="C:\\WINDOWS\\system32\\WLTRAY"
"Apoint"="C:\\Program Files\\Apoint\\Apoint.exe"
"PCTVOICE"="pctspk.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"Share-to-Web Namespace Daemon"="c:\\Program Files\\Hewlett-Packard\\HP Share-to-Web\\hpgs2wnd.exe"
"Adobe Photo Downloader"="\"C:\\Program Files\\Adobe\\Photoshop Album Starter Edition\\3.0\\Apps\\apdproxy.exe\""
"HP Software Update"="C:\\Program Files\\Hp\\HP Software Update\\HPWuSchd2.exe"
"Windows Defender"="\"C:\\Program Files\\Windows Defender\\MSASCui.exe\" -hide"
"UserFaultCheck"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,65,\
6d,33,32,5c,64,75,6d,70,72,65,70,20,30,20,2d,75,00
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_11\\bin\\jusched.exe\""
"avast!"="C:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe"


[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}"="Microsoft AntiMalware ShellExecuteHook"
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=""

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"DWQueuedReporting"="\"C:\\PROGRA~1\\COMMON~1\\MICROS~1\\DW\\dwtrig20.exe\" -t"

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
Authentication Packages REG_MULTI_SZ msv1_0\
Security Packages REG_MULTI_SZ kerberosmsv1_0schannelwdigest\
Notification Packages REG_MULTI_SZ scecli\

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter REG_MULTI_SZ HTTPFilter\
LocalService REG_MULTI_SZ AlerterWebClientLmHostsRemoteRegistryupnphostSSDPSRV\
NetworkService REG_MULTI_SZ DnsCache\
DcomLaunch REG_MULTI_SZ DcomLaunchTermService\
rpcss REG_MULTI_SZ RpcSs\
imgsvc REG_MULTI_SZ StiSvc\
termsvcs REG_MULTI_SZ TermService\


[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E]
Shell\AutoRun\command E:\LaunchU3.exe -a

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{190c8644-4b23-11db-ac41-00904b286f06}]
Shell\AutoRun\command E:\LaunchU3.exe -a


Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\MP Scheduled Scan.job


********************************************************************

catchme 0.2 W2K/XP/Vista - userland rootkit detector by Gmer, 17 October 2006
http://www.gmer.net

scanning hidden processes …

scanning hidden services …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

********************************************************************

Completion time: 07-04-14 19:24:24
C:\ComboFix-quarantined-files.txt … 07-04-14 19:24
C:\ComboFix2.txt … 07-04-09 03:38
Post #38
Hi again Mike,
Yes, there should be a log for wpfind3u folder.
It will look like this.
004152007_082037.log where the part I have in bold are actually a date.

Post that for me.



Download FileASSASSIN.zip and save to your desktop (this tool is compatible with Win 2000/NT/XP only).
  • Create a new folder on C:\ called FileASSASSIN and extract (unzip) it to that folder. (Click here for information on how to do this if not sure.
  • Boot into Safe Mode.
  • Open the folder and double-click on FileASSASSIN.exe.
  • Select the following file to delete by copying and pasting into the text area the following:

    C:/WINDOWS\System32\intr32.dll
    C:\WINDOWS\system32\drivers\core.sys
  • Select a removal method. Start with "Attempt FileASSASSIN's method of file removal."
  • Click delete and the removal process will begin.
  • If that did not work then, start the program again and this time check "Use delete on reboot function from Windows.".
Note: If you cannot find the file, you may have to Reconfigure Windows XP to show hidden files, folders. (We are doing this so we can look for and delete hidden files if necessary but don't delete anything other than what I ask you to delete. After your system is clean, follow the same procedure to hide these files and folders again to protect them from accidental deletion).

_____________________________________





Look in your control panels add/remove programs for any of these and uninstall them:

Oin
Yazzle by Oin
Purityscan by Oin
Snowballwars by Oin
or anything similar with Oin or Outerinfo in it.
Zolero
Tizzletalk
MediaTickets
Cowabanga
and any other programs you didn't install or don't recognize - if your not sure please ask first

Download and run this uninstaller:
http://www.outerinfo.com/OiUninstaller.exe

Tutorial for the uninstaller if needed






Now install MVPS HOSTS:

Download and unzip hosts.zip from HERE to a folder (hosts).

When you get a chance please read more about what we are doing HERE.

Here's a Tutorial on how to install it, but it's installed like this:

Open up the hosts folder and double-click on the mvps.bat file, it will rename your present HOSTS file to HOSTS.MVP, then it will copy the new HOSTS file to the correct location on your machine. It happens very quickly so don't blink!



___________________________________
Download FindAWF and save the file to your desktop
  • Go to your Desktop and double-click on FindAWF.exe to run it.
  • If your security software asks, please allow FindAWF to run.
  • A command window will open - press any key to continue.
  • A Notepad window will open called awf.txt (this will have been saved to your desktop)
Click the Format menu and make sure that Wordwrap is NOT ticked. If it is then click on it to UNtick it.
copy the content of that log with your next reply.



______________________________________________



In your next reply I would like to see:
  • A new HJT log
  • The report from wpfind3u
  • The report from FIND AWF
Post #39
Hi Bob,

I will provide the first two logs immediately, and come back to the third since it will take some time to download, install and follow the instructions. So, first, here is the HijackThis log:

Logfile of HijackThis v1.99.1
Scan saved at 11:53:38 PM, on 4/15/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\system32\pctspk.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Avant Browser\avant.exe
C:\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Dell Wireless Manager UI] C:\WINDOWS\system32\WLTRAY
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Image Transfer.lnk = ?
O8 - Extra context menu item: Add to AD Black List - C:\Program Files\Avant Browser\AddToADBlackList.htm
O8 - Extra context menu item: Block All Images from the Same Server - C:\Program Files\Avant Browser\AddAllToADBlackList.htm
O8 - Extra context menu item: Highlight - C:\Program Files\Avant Browser\Highlight.htm
O8 - Extra context menu item: Open All Links in This Page… - C:\Program Files\Avant Browser\OpenAllLinks.htm
O8 - Extra context menu item: Open In New Avant Browser - C:\Program Files\Avant Browser\OpenInNewBrowser.htm
O8 - Extra context menu item: Search - C:\Program Files\Avant Browser\Search.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst_current.cab
O16 - DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E} (Microsoft PID Sniffer) - https://support.microsoft.com/OAS/ActiveX/odc.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by112fd.bay112.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1136866715612
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1151131197821
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: Prevx Agent (PREVXAgent) - Unknown owner - C:\Program Files\Prevx1\PXAgent.exe" -f (file missing)
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

I hope this is the right log for the WinpFind3U:

[Registry - Non-Microsoft Only]
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A3EC8848-59D5-41B4-CF82-DB69B8462960} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A3EC8848-59D5-41B4-CF82-DB69B8462960} deleted successfully.
[Files/Folders - Created Within 30 days]
File move failed. C:\WINDOWS\SYSTEM32\drivers\core.cache.dsk scheduled to be moved on reboot.
File move failed. C:\WINDOWS\SYSTEM32\drivers\core.sys scheduled to be moved on reboot.
[Files/Folders - Modified Within 30 days]
C:\WINDOWS\imsins.BAK moved successfully.
File move failed. C:\WINDOWS\SYSTEM32\drivers\core.cache.dsk scheduled to be moved on reboot.
File move failed. C:\WINDOWS\SYSTEM32\drivers\core.sys scheduled to be moved on reboot.
C:\WINDOWS\SYSTEM32\drivers\etc\hosts.20070401-042640.backup moved successfully.
[File String Scan - Non-Microsoft Only]
File C:\WINDOWS\SYSTEM32\drivers\etc\hosts.20070401-042640.backup not found!
C:\WINDOWS\SYSTEM32\drivers\etc\hosts.bak moved successfully.
< End of log >
Created on 04/14/2007 19:08:34
Post #40
TWO QUESTIONS: First, you've asked that I download FileAssassin and create a new folder on C:. Is it ok if the folder I create is on the desktop, as we had done once before? Second, when starting OiUninstaller, the Avast virus protection starts up and says 'you have a trojan' -but it doesn't offer the opportunity to permit the program to run. The window for a trojan just keeps re-appearing. SHould I disable Avast ? If not,w hat else should I do? Best, Mike
Post #41
Well Mike,
Looks as if file ass. has changed a bit.
It's now an EXE file. Which means it will just install itself to c:/program files. Just do that. Then follow the instructions from:


1. Boot into Safe Mode.
2. Click starty/all programs /FileAssassin
3. Select the following file to delete by copying and pasting into the text area the following: You have to do this for each file. The first one should go away without a wimper. The second one is a pain and may whine a bit.

C:\WINDOWS\System32\intr32.dll

C:\WINDOWS\system32\drivers\core.sys

Select a removal method. Start with "Attempt FileASSASSIN's method of file removal."
Click delete and the removal process will begin.
If that did not work then, start the program again and this time check "Use delete on reboot function from Windows.".
Note: If you cannot find the file, you may have to Reconfigure Windows XP to show hidden files, folders. (We are doing this so we can look for and delete hidden files if necessary but don't delete anything other than what I ask you to delete. After your system is clean, follow the same procedure to hide these files and folders again to protect them from accidental deletion).

Reboot to normal mode.

If you have installed the MVPS HOSTS FILE: You will nort be able to get to that page. Let me know if you have done that part already. You'll need help fixing that.
If not do this please:

In as much as I hate to go ahead and disable avast for now and run that uninstaller.Right click avast icon and choose disable all.
As soon as thats done. Turn AVAST BACK ON. If it mentions the uninstaller let it get rid of it after you have run it.


Then post the log from find AWF..

Also please lastly let me see another winPfind3U log.
Post #42 last edited
Hi Bob, Tried to do as you asked. I received this message while in Safe Mode, trying to open File Assassin: "Run Time Error 7 Out of Memory." That seems odd, since I have 1.5 gig of RAM. I have not yet downloaded MVPS, so that won't be a problem. What should I do now? Is the memory problem due, in part at least, to the virus/malware? Lastly, since I am thinking about it can we discover how I downloaded these horrors in the first place -or is it enough simply to know that I now have a virus shield in place? Thanks, Mike
Post #43 last edited
__________________________________

The error you had was a Visual Basic code error.
Something else we will have to try and fix after we think your clean.



As far as how you got all this>>
Hmm.
Accidental clicks on the inernet.
Bad surfing habits
No antivirus

Some of these were trojan downloaders. That's there job, simply to download more garbage just to ruin your computer. Then it's the snowball effect.
Seem to have done thier job too!



________________________________

Go to
Start/control panel/add remove programs ;
And Uninstall

Fileassassin


. Please download The Avenger by Swandog46 to your Desktop.

Click on Avenger.zip to open the file
Extract avenger.exe to your desktop

2. Copy all the text in bold contained in the code box below to your Clipboard by highlighting it and right clicking and then copy:

Files to delete:

C:\WINDOWS\System32\intr32.dll
C:\WINDOWS\system32\drivers\core.sys

[/Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, start The Avenger program by clicking on its icon on your desktop.
Under "Script file to execute" choose "Input Script Manually".
Now click on the Magnifying Glass icon which will open a new window titled "View/edit script"
Paste the text copied to clipboard into this window
Click Done
Now click on the Green Light to begin execution of the script
Answer "Yes" twice when prompted.

4. Restart your computer. ( In cases where the code to execute contains "Drivers to Unload", The Avenger will actually restart your system twice.) [*]On reboot, briefly open a black command window on your desktop, this is normal.
[*]After the restart, create a log file that should open with the results of Avenger's actions. This log file will be located at C:\avenger.txt
[*]The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
5. Please copy/paste the content of avenger.txt into your reply along with a fresh HJT log by using Add/Reply.

___________________________________

That should work OK.

Then post :
The report from FIND AWF

The other 2 logs looked good!
Post #44
Hi Bob,

Uninstalled FileAssassin -should I delete the zipped file from my desktop?

As requested, here is the Avenger text:

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\sfiriqtx

*******************

Script file located at: \??\C:\Documents and Settings\nqoasbea.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File C:\WINDOWS\System32\intr32.dll deleted successfully.
File C:\WINDOWS\system32\drivers\core.sys deleted successfully.

Completed script processing.

*******************

Finished! Terminate.


AND HERE IS A NEW HijackThis log:

Logfile of HijackThis v1.99.1
Scan saved at 3:32:35 AM, on 4/18/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\system32\pctspk.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
C:\Program Files\Avant Browser\avant.exe
C:\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Dell Wireless Manager UI] C:\WINDOWS\system32\WLTRAY
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Image Transfer.lnk = ?
O8 - Extra context menu item: Add to AD Black List - C:\Program Files\Avant Browser\AddToADBlackList.htm
O8 - Extra context menu item: Block All Images from the Same Server - C:\Program Files\Avant Browser\AddAllToADBlackList.htm
O8 - Extra context menu item: Highlight - C:\Program Files\Avant Browser\Highlight.htm
O8 - Extra context menu item: Open All Links in This Page… - C:\Program Files\Avant Browser\OpenAllLinks.htm
O8 - Extra context menu item: Open In New Avant Browser - C:\Program Files\Avant Browser\OpenInNewBrowser.htm
O8 - Extra context menu item: Search - C:\Program Files\Avant Browser\Search.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst_current.cab
O16 - DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E} (Microsoft PID Sniffer) - https://support.microsoft.com/OAS/ActiveX/odc.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by112fd.bay112.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1136866715612
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1151131197821
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: Prevx Agent (PREVXAgent) - Unknown owner - C:\Program Files\Prevx1\PXAgent.exe" -f (file missing)
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe



Thanks,

Mike
Post #45
Here is the report (it's not much) from Find AWF: Find AWF report by noahdfear ©2006 bak folders found ~~~~~~~~~~~ Duplicate files of bak directory contents ~~~~~~~~~~~~~~~~~~~~~~~ end of report

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI