Spyware / Malware / Virus Removal

Antispysolutions.com, Red Desktop, Bubbles, Etc...

8 min read

Looking for the outcome? Ask AI

LisaRhea2 Topic Starter

Post #1June 7, 2007, 12:05 AM UTC last edited June 7, 2007, 12:14 AM UTC

My desktop turns red, Antispysolution bubbles pop up in my taskbar, web pages for antispysolutions pop up, task manager is disabled, blank "microsoft internet explorer" pages pop up and won't close ("page is busy").

I am not very computer savy, however I'm pretty sure there is something wrong! I will probably need very specific directions. *sigh* I really appreciate your help. Thank you!

EDIT: I have not tried anything to fix this besides running Ad-aware and Spybot. It didn't fix anything.

LisaRhea2

Logfile of HijackThis v1.99.1
Scan saved at 7:50:47 PM, on 6/6/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\S24EvMon.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\cisvc.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\RegSrvc.exe
C:\WINDOWS\System32\svchost.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\system32\ZCfgSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\1XConfig.exe
C:\WINDOWS\system32\tmrsrv32.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\System32\pctspk.exe
C:\WINDOWS\System32\BacsTray.exe
C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\Dell Photo AIO Printer 962\dlbxmon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\dlbxcoms.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Napster\napster.exe
C:\PROGRA~1\MUSICM~1\MUSICM~1\MMDiag.exe
C:\Program Files\Microsoft Money\System\Money Express.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mim.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {00000250-0320-4dd4-be4f-7566d2314352} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {13197ace-6851-45c3-a7ff-c281324d5489} - (no file)
O2 - BHO: (no name) - {30000273-8230-4dd4-be4f-6889d1e74167} - (no file)
O2 - BHO: (no name) - {4e1075f4-eec4-4a86-add7-cd5f52858c31} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5dafd089-24b1-4c5e-bd42-8ca72550717b} - (no file)
O2 - BHO: (no name) - {5fa6752a-c4a0-4222-88c2-928ae5ab4966} - (no file)
O2 - BHO: (no name) - {669695bc-a811-4a9d-8cdf-ba8c795f261e} - (no file)
O2 - BHO: (no name) - {8674aea0-9d3d-11d9-99dc-00600f9a01f1} - (no file)
O2 - BHO: (no name) - {965a592f-8efa-4250-8630-7960230792f1} - (no file)
O2 - BHO: (no name) - {b8875bfe-b021-11d4-bfa8-00508b8e9bd3} - (no file)
O2 - BHO: (no name) - {ca1d1b05-9c66-11d5-a009-000103c1e50b} - (no file)
O2 - BHO: (no name) - {cf021f40-3e14-23a5-cba2-717765728274} - (no file)
O2 - BHO: msdn_lib.msdn_hlp - {EC84A858-8398-48D6-8E6B-DB0C4CD7B731} - C:\WINDOWS\System32\msdn_lib.dll
O2 - BHO: (no name) - {fc3a74e5-f281-4f10-ae1e-733078684f3c} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: (no name) - {C1B4DEC2-2623-438e-9CA2-C9043AB28508} - (no file)
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [bacstray] BacsTray.exe
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [MoneyStartUp10.0] "C:\Program Files\Microsoft Money\System\Activation.exe"
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [MCAgentExe] C:\Program Files\McAfee.com\Agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\McAfee.com\Agent\McUpdate.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [oypasttdjlirf] C:\WINDOWS\System32\jxvjreko.exe
O4 - HKLM\..\Run: [dlbxmon.exe] "C:\Program Files\Dell Photo AIO Printer 962\dlbxmon.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NapsterShell] C:\Program Files\Napster\napster.exe /systray
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~1\mimboot.exe
O4 - HKLM\..\Run: [IESet] IExplorer.dll .dbt
O4 - HKLM\..\RunServices: [IESet] IExplorer.dll .dbt
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [IESet] IExplorer.dll .dbt
O4 - Startup: DLHelperEXE.exe
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O16 - DPF: {08BEF711-06DA-48B2-9534-802ECAA2E4F9} (PlxInstall Class) - http://down.plaxo.com/down/release/PlaxoInstall.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1110289403360
O16 - DPF: {89D75D39-5531-47BA-9E4F-B346BA9C362C} (CWDL_DownLoadControl Class) - http://www.callwave.com/include/cab/CWDL_DownLoad.CAB
O16 - DPF: {AED98630-0251-4E83-917D-43A23D66D507} (WebHandler Class) - http://activex.microgaming.com/dlhelper/ve…n7/dlhelper.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/vir…l/installer.exe
O16 - DPF: {DD8C9372-35FD-4F7D-8CE4-909ABCFAB2C5} - ms-its:mhtml:file://c:\\nores.mht!http://adxtend.net/code/chm/xpre.chm::/xpreload.ocx
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…337/mcfscan.cab
O20 - Winlogon Notify: Sebring - C:\WINDOWS\System32\LgNotify.dll
O23 - Service: COM+ Messages - Unknown owner - C:\WINDOWS\System32\svchosts.exe" -e te-110-12-0000213 (file missing)
O23 - Service: dlbx_device - Dell - C:\WINDOWS\System32\dlbxcoms.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Mcafee.com Corporation - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee.com Personal Firewall Service (MpfService) - McAfee.com Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe

FencerGirl

Post #2June 13, 2007, 4:12 PM UTC

Hello!
I go by FencerGirl. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research.

Please be patient and I'd be grateful if you would note the following:

I will working be on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for this issue on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Finally, please reply to this thread. Do not start a new topic.

It may take me a while to reply to you as all of my fixes are being checked by experts to ensure that you are getting a good fix. And remember, like you I have a real life, so I may not be at my computer when you are!

FencerGirl

FencerGirl

Post #3June 13, 2007, 8:26 PM UTC

Hello LisaRhea2,
You have a number of infections on your computer including several trojans. Some of these infections could have been prevented if you had Service Pack 2 installed. Is there a reason that you have not installed it yet?
Please DO NOT install Service Pack 2 until your computer is clean. I will let you know when would be a good time to install it.

I would also like to alert you that you have a trojan that is capable of steeling passwords for on-line games, specifically chinese games. If you play any of these games, please refrain from doing so until your computer is clean.
Also, you will want to change any passwords for these games from a clean computer.

Now, let's get cleaning!

Step 1: Please download SmitfraudFix
Please download SmitfraudFix (by S!Ri)
Extract the content (a folder named SmitfraudFix) to your Desktop.

Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply.

Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.
http://www.beyondlogic.org/consulting/proc…processutil.htm

Step 2:Download and Run ComboFix.

Download this file from either of the two below listed places :

http://download.bleepingcomputer.com/sUBs/ComboFix.exe
http://www.techsupportforum.com/sectools/ComboFix.exe
Then double click combofix.exe & follow the prompts.
When finished, it shall produce a log for you. Post that log in your next reply

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Step 3:Download and Run SDFix.
Download SDFix and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer in Safe Mode by doing the following :

Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, the Advanced Options Menu should appear;
Select the first option, to run Windows in Safe Mode, then press Enter.
Choose your usual account.

Open the extracted SDFix folder and double click RunThis.bat to start the script.
Type Y to begin the cleanup process.
It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
Press any Key and it will restart the PC.
When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
(Report.txt will also be copied to Clipboard ready for posting back on the forum).

After you've completed all of the above steps, please post back with the results of the SmitfraudFix, SDFix, and ComboFix scans, along with a new HijackThis! log.

Thanks,
FencerGirl

LisaRhea2

Post #4June 14, 2007, 3:38 AM UTC

Okay, I did every step you said. However, I don't know what serivce pack 2 is. I'm not the most computer literate person, LOL! Could you give me a heads up on that?

I appreciate your time and effort on this. Thank you for your help. All the logs are listed below.

SmitFraudFix v2.195

Scan done at 21:20:37.61, Wed 06/13/2007
Run from C:\Documents and Settings\Lisa\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\S24EvMon.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\cisvc.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\RegSrvc.exe
C:\WINDOWS\System32\svchost.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\ZCfgSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\1XConfig.exe
C:\WINDOWS\system32\tmrsrv32.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\System32\pctspk.exe
C:\WINDOWS\System32\BacsTray.exe
C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\Dell Photo AIO Printer 962\dlbxmon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Napster\napster.exe
C:\WINDOWS\System32\dlbxcoms.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Microsoft Money\System\Money Express.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mim.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\MMDiag.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\cmd.exe
C:\WINDOWS\system32\CSCRIPT.EXE

»»»»»»»»»»»»»»»»»»»»»»»» hosts

»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

C:\WINDOWS\system32\susp.exe FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Lisa

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Lisa\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Start Menu

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Lisa\FAVORI~1

»»»»»»»»»»»»»»»»»»»»»»»» Desktop

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys

»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» Rustock

»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Broadcom 440x 10/100 Integrated Controller - Packet Scheduler Miniport
DNS Server Search Order: 10.0.0.138

HKLM\SYSTEM\CCS\Services\Tcpip\..\{377B7F5D-CC3E-496A-A347-D77DC6DE73E0}: DhcpNameServer=10.0.0.138
HKLM\SYSTEM\CS2\Services\Tcpip\..\{377B7F5D-CC3E-496A-A347-D77DC6DE73E0}: DhcpNameServer=10.0.0.138
HKLM\SYSTEM\CS3\Services\Tcpip\..\{377B7F5D-CC3E-496A-A347-D77DC6DE73E0}: DhcpNameServer=10.0.0.138
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=10.0.0.138
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=10.0.0.138
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=10.0.0.138

»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection

»»»»»»»»»»»»»»»»»»»»»»»» End

ComboFix 07-06-13.3 - C:\Documents and Settings\Lisa\Desktop\ComboFix.exe
"Lisa" - 2007-06-13 21:23:58 - Service Pack 1 NTFS

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\DOCUME~1\Lisa\APPLIC~1.\asks~1
C:\DOCUME~1\Lisa\APPLIC~1.\dobe~1
C:\DOCUME~1\Lisa\APPLIC~1.\scurit~1
C:\DOCUME~1\Lisa\APPLIC~1.\ystem~1
C:\DOCUME~1\Lisa\MYDOCU~1.\asembl~1
C:\DOCUME~1\Lisa\MYDOCU~1.\sembly~1
C:\DOCUME~1\LOCALS~1\APPLIC~1\netmon
C:\DOCUME~1\LOCALS~1\APPLIC~1\netmon\domains.txt
C:\DOCUME~1\LOCALS~1\APPLIC~1\netmon\log.txt
C:\Program Files\Common Files\{30F20~1
C:\Program Files\Common Files\{30F20~1\Bar888.dll
C:\Program Files\Common Files\{40F20~1
C:\Program Files\Common Files\{40F20~2
C:\Program Files\Common Files\{40F20~3
C:\Program Files\Common Files\{40F20~4
C:\Program Files\Common Files\Yazzle1122OinAdmin.exe
C:\Program Files\Common Files\Yazzle1122OinUninstaller.exe
C:\Program Files\Common Files\ymbols~1
C:\Program Files\cowabanga
C:\Program Files\cowabanga\License.txt
C:\Program Files\cowabanga\uninstaller.exe
C:\Program Files\inetget2
C:\Program Files\ipwindows
C:\Program Files\ipwindows\UnInstall.exe
C:\Program Files\outerinfo
C:\Program Files\outerinfo\OiUninstaller.exe
C:\Program Files\outerinfo\outerinfo.ico
C:\Program Files\outerinfo\Terms.rtf
C:\Program Files\sembly~1
C:\Program Files\smbols~1
C:\Program Files\stem~1
C:\Temp\tn3
C:\WINDOWS\764.exe
C:\WINDOWS\asks~1
C:\WINDOWS\notedad.exe
C:\WINDOWS\ppatch~2
C:\WINDOWS\system32\appatc~1
C:\WINDOWS\system32\drivers\core.cache.dsk
C:\WINDOWS\system32\drivers\core.sys
C:\WINDOWS\system32\drivers\fad.sys
C:\windows\system32\explorer.exe
C:\WINDOWS\system32\icroso~1.net
C:\WINDOWS\system32\IExplorer.dll .dbt
C:\WINDOWS\system32\mp43.exe
C:\WINDOWS\system32\pppatc~1
C:\WINDOWS\system32\unsvchosts.lzma
C:\WINDOWS\system32\winttr.exe
C:\WINDOWS\system32\wmvds32.dll
C:\WINDOWS\uninstall_nmon.vbs

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

——-\LEGACY_CMDSERVICE
——-\LEGACY_COM+_MESSAGES
——-\LEGACY_CORE
——-\LEGACY_NETWORK_MONITOR
——-\COM+ Messages
——-\core

((((((((((((((((((((((((( Files Created from 2007-05-14 to 2007-06-14 )))))))))))))))))))))))))))))))

2007-06-13 21:23 49,152 –a—— C:\WINDOWS\nircmd.exe
2007-06-13 21:20 4,224 –a—— C:\WINDOWS\SYSTEM32\tmp.reg
2007-06-13 21:19 51,200 –a—— C:\WINDOWS\SYSTEM32\dumphive.exe
2007-06-13 21:16 53,248 –a—— C:\WINDOWS\SYSTEM32\Process.exe
2007-06-13 21:16 0 –a—— C:\WINDOWS\SYSTEM32\SrchSTS.exe
2007-06-10 02:27 98,304 –a—— C:\WINDOWS\SYSTEM32\CmdLineExt.dll
2007-06-10 02:27 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\EIDOS
2007-06-10 02:26 62,744 –a—— C:\WINDOWS\SYSTEM32\xinput1_2.dll
2007-06-10 02:26 236,824 –a—— C:\WINDOWS\SYSTEM32\xactengine2_3.dll
2007-06-10 02:02 d——– C:\Program Files\Eidos
2007-06-01 19:18 0 –a—— C:\WINDOWS\SYSTEM32\it_reg.exe
2007-05-27 11:26 18,432 –a—— C:\WINDOWS\sysrlb32.exe
2007-05-27 10:52 4 –a—— C:\WINDOWS\SYSTEM32\stfv.bin
2007-05-27 10:48 82,439 –a—— C:\WINDOWS\SYSTEM32\msorcl32.exe
2007-05-27 10:48 12 –a—— C:\WINDOWS\SYSTEM32\sl.bin
2007-05-27 10:48 12 –a—— C:\WINDOWS\SYSTEM32\gtv_sd.bin
2007-05-27 10:48 10,759 –a—— C:\sysaqkl.exe
2007-05-21 20:08 d——– C:\WINDOWS\SYSTEM32\SoftwareDistribution
2007-05-21 20:06 465,176 –a—— C:\WINDOWS\SYSTEM32\wuapi.dll
2007-05-21 20:06 41,240 –a—— C:\WINDOWS\SYSTEM32\wups.dll
2007-05-21 20:06 194,328 –a—— C:\WINDOWS\SYSTEM32\wuaueng1.dll
2007-05-21 20:06 172,312 –a—— C:\WINDOWS\SYSTEM32\wuauclt1.exe
2007-05-21 20:06 127,256 –a—— C:\WINDOWS\SYSTEM32\wucltui.dll
2007-05-20 20:04 d——– C:\WINDOWS\Profiles
2007-05-20 20:01 d——– C:\Program Files\viewsonic

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-06-13 20:36:58 ——– d—–w C:\Program Files\Finale NotePad 2006
2007-06-10 06:27:10 ——– d–h–w C:\Program Files\InstallShield Installation Information
2007-06-10 04:39:41 44,582 —-a-w C:\WINDOWS\system32\nvModes.dat
2007-06-07 01:28:29 ——– d–h–w C:\DOCUME~1\Lisa\APPLIC~1\Move Networks
2007-06-05 16:59:06 ——– d—–w C:\DOCUME~1\Lisa\APPLIC~1\SmartDraw
2007-05-24 12:11:44 99,024 —-a-w C:\DOCUME~1\Lisa\APPLIC~1\GDIPFONTCACHEV1.DAT
2007-05-22 00:06:37 ——– d–h–w C:\Program Files\WindowsUpdate
2007-04-16 00:23:16 774,144 —-a-w C:\Program Files\RngInterstitial.dll
2007-04-16 00:22:46 ——– d—–w C:\Program Files\Real
2007-04-04 21:18:14 1,012,993 —-a-w C:\WINDOWS\system32\bmaker.exe
2007-04-04 11:36:38 2 —-a-w C:\WINDOWS\system32\wintisv32.exe
2007-04-03 21:33:06 491 —-a-w C:\WINDOWS\eReg.dat
2007-04-02 21:00:06 1,248 –sha-w C:\tvhtoc3v.sys
2005-07-29 21:24:26 472 –sha-r C:\WINDOWS\TGlzYQ\n35Wsk.vbs

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 01:56]
{53707962-6F74-2D53-2644-206D7942484F}=C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2004-05-12 01:03]
{EC84A858-8398-48D6-8E6B-DB0C4CD7B731}=C:\WINDOWS\System32\msdn_lib.dll [2003-05-27 10:48]
{FDD3B846-8D59-4ffb-8758-209B6AD74ACC}=C:\Program Files\Microsoft Money\System\mnyviewer.dll [2001-07-25 11:00]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2002-08-22 20:28]
"nwiz"="nwiz.exe" [2003-06-24 19:32 C:\WINDOWS\SYSTEM32\nwiz.exe]
"PCTVOICE"="pctspk.exe" [2002-07-18 17:58 C:\WINDOWS\SYSTEM32\pctspk.exe]
"bacstray"="BacsTray.exe" [2003-05-14 19:37 C:\WINDOWS\SYSTEM32\BacsTray.exe]
"PRONoMgr.exe"="C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe" [2003-05-28 18:32]
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2003-06-20 15:18]
"MoneyStartUp10.0"="C:\Program Files\Microsoft Money\System\Activation.exe" [2001-07-25 11:00]
"MMTray"="C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe" [2006-01-19 12:06]
"MCAgentExe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2002-09-06 19:15]
"MCUpdateExe"="C:\PROGRA~1\McAfee.com\Agent\McUpdate.exe" [2002-09-04 11:28]
"AdaptecDirectCD"="C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" [2002-12-17 13:28]
"VirusScan Online"="c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe" [2002-10-04 16:09]
"DwlClient"="C:\Program Files\Common Files\Dell\EUSW\Support.exe" [2003-06-24 18:01]
"MPFExe"="C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe" [2002-10-10 18:14]
"dlbxmon.exe"="C:\Program Files\Dell Photo AIO Printer 962\dlbxmon.exe" [2004-08-27 15:29]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-02-24 19:57]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-06-14 16:24]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-08-13 15:26]
"NapsterShell"="C:\Program Files\Napster\napster.exe" [2006-06-29 14:17]
"MimBoot"="C:\PROGRA~1\MUSICM~1\MUSICM~1\mimboot.exe" [2006-01-19 12:06]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MoneyAgent"="C:\Program Files\Microsoft Money\System\Money Express.exe" [2001-07-25 11:00]
"ctfmon.exe"="C:\WINDOWS\System32\ctfmon.exe" [2002-08-29 06:00]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Sebring]
C:\WINDOWS\System32\LgNotify.dll

Contents of the 'Scheduled Tasks' folder
2007-06-14 01:31:00 C:\WINDOWS\tasks\McAfee.com Update Check (D6YMVK31-Owner).job
2007-06-14 01:35:00 C:\WINDOWS\tasks\McAfee.com Update Check (JONATHAN-Darren).job
2007-06-14 01:34:00 C:\WINDOWS\tasks\McAfee.com Update Check (JONATHAN-Jon).job
2007-06-14 01:32:47 C:\WINDOWS\tasks\McAfee.com Update Check (JONATHAN-Lisa).job
2007-06-14 01:31:00 C:\WINDOWS\tasks\McAfee.com Update Check (JONATHAN-Shannon).job

**************************************************************************

catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-06-13 21:32:41
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-06-13 21:35:38 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-06-13 21:35

— E O F —

SDFix: Version 1.87

Run by [removed] on Wed 06/13/2007 at 11:03 PM

Microsoft Windows XP [Version 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:

Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting…

Normal Mode:
Checking Files:

Below files will be copied to Backups folder then removed:

C:\WINDOWS\SYSTEM32\IT_REG.EXE - Deleted
C:\WINDOWS\SYSTEM32\SRCHSTS.EXE - Deleted

Removing Temp Files…

ADS Check:

Checking C:\WINDOWS\
C:\WINDOWS
No streams found.

Checking C:\WINDOWS\system32
C:\WINDOWS\system32
No streams found.

Checking C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
No streams found.

Checking C:\WINDOWS\system32\ntoskrnl.exe
C:\WINDOWS\system32\ntoskrnl.exe
No streams found.

Final Check:

Remaining Services:
——————

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

Remaining Files:
—————

Backups Folder: - C:\SDFix\backups\backups.zip

Listing Files with Hidden Attributes:

C:\Program Files\Autodesk\Autodesk DWF Viewer\_Setupx.dll
C:\Documents and Settings\Lisa\My Documents\VLL3.2demowin\VLL3.2 demo\._VLL3-2.exe
C:\Program Files\Autodesk\Autodesk DWF Viewer\Setup.exe
C:\Program Files\Messenger\MSMSGS.EXE
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP842\A0100624.exe
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP844\A0103669.exe
C:\tvhjaeh0.sys
C:\tvhjaezn.sys
C:\tvhtoc3v.sys
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP823\A0096367.sys
C:\Documents and Settings\Lisa\Application Data\Microsoft\Templates\~WRL2245.tmp
C:\Documents and Settings\Lisa\Application Data\Microsoft\Word\~WRL0002.tmp
C:\Documents and Settings\Lisa\Application Data\Microsoft\Word\~WRL0104.tmp
C:\Documents and Settings\Lisa\Application Data\Microsoft\Word\~WRL0147.tmp
C:\Documents and Settings\Lisa\Application Data\Microsoft\Word\~WRL0416.tmp
C:\Documents and Settings\Lisa\Application Data\Microsoft\Word\~WRL0678.tmp
C:\Documents and Settings\Lisa\Application Data\Microsoft\Word\~WRL0965.tmp
C:\Documents and Settings\Lisa\Application Data\Microsoft\Word\~WRL1468.tmp
C:\Documents and Settings\Lisa\Application Data\Microsoft\Word\~WRL1583.tmp
C:\Documents and Settings\Lisa\Application Data\Microsoft\Word\~WRL1645.tmp
C:\Documents and Settings\Lisa\Application Data\Microsoft\Word\~WRL1654.tmp
C:\Documents and Settings\Lisa\Application Data\Microsoft\Word\~WRL1670.tmp
C:\Documents and Settings\Lisa\Application Data\Microsoft\Word\~WRL1861.tmp
C:\Documents and Settings\Lisa\Application Data\Microsoft\Word\~WRL2806.tmp
C:\Documents and Settings\Lisa\Application Data\Microsoft\Word\~WRL2884.tmp
C:\Documents and Settings\Lisa\Application Data\Microsoft\Word\~WRL3112.tmp
C:\Documents and Settings\Lisa\Application Data\Microsoft\Word\~WRL3188.tmp
C:\Documents and Settings\Lisa\Application Data\Microsoft\Word\~WRL3368.tmp
C:\Documents and Settings\Lisa\Application Data\Microsoft\Word\~WRL4025.tmp
C:\Documents and Settings\Lisa\My Documents\recipes\~WRL2786.tmp
C:\Program Files\InterActual\InterActual Player\iti18A.tmp
C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.tmp.LOG
C:\WINDOWS\SYSTEM32\CONFIG\SAM.tmp.LOG
C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.tmp.LOG
C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.tmp.LOG
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.tmp.LOG

Listing User Accounts:

User accounts for \\JONATHAN

Administrator Guest HelpAssistant
Jon Lisa Shannon
SUPPORT_388945a0 SUPPORT_3f151ab9

Finished

Logfile of HijackThis v1.99.1
Scan saved at 11:19:48 PM, on 6/13/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\S24EvMon.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\ZCfgSvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\RegSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\1XConfig.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\WINDOWS\system32\tmrsrv32.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\System32\pctspk.exe
C:\WINDOWS\System32\BacsTray.exe
C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\Dell Photo AIO Printer 962\dlbxmon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Napster\napster.exe
C:\WINDOWS\System32\dlbxcoms.exe
C:\Program Files\Apoint\Apntex.exe
C:\PROGRA~1\MUSICM~1\MUSICM~1\MMDiag.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Microsoft Money\System\Money Express.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mim.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
O2 - BHO: (no name) - {00000250-0320-4dd4-be4f-7566d2314352} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {13197ace-6851-45c3-a7ff-c281324d5489} - (no file)
O2 - BHO: (no name) - {30000273-8230-4dd4-be4f-6889d1e74167} - (no file)
O2 - BHO: (no name) - {4e1075f4-eec4-4a86-add7-cd5f52858c31} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5dafd089-24b1-4c5e-bd42-8ca72550717b} - (no file)
O2 - BHO: (no name) - {5fa6752a-c4a0-4222-88c2-928ae5ab4966} - (no file)
O2 - BHO: (no name) - {669695bc-a811-4a9d-8cdf-ba8c795f261e} - (no file)
O2 - BHO: (no name) - {8674aea0-9d3d-11d9-99dc-00600f9a01f1} - (no file)
O2 - BHO: (no name) - {965a592f-8efa-4250-8630-7960230792f1} - (no file)
O2 - BHO: (no name) - {b8875bfe-b021-11d4-bfa8-00508b8e9bd3} - (no file)
O2 - BHO: (no name) - {ca1d1b05-9c66-11d5-a009-000103c1e50b} - (no file)
O2 - BHO: (no name) - {cf021f40-3e14-23a5-cba2-717765728274} - (no file)
O2 - BHO: msdn_lib.msdn_hlp - {EC84A858-8398-48D6-8E6B-DB0C4CD7B731} - C:\WINDOWS\System32\msdn_lib.dll
O2 - BHO: (no name) - {fc3a74e5-f281-4f10-ae1e-733078684f3c} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [bacstray] BacsTray.exe
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [MoneyStartUp10.0] "C:\Program Files\Microsoft Money\System\Activation.exe"
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [MCAgentExe] C:\Program Files\McAfee.com\Agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [dlbxmon.exe] "C:\Program Files\Dell Photo AIO Printer 962\dlbxmon.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NapsterShell] C:\Program Files\Napster\napster.exe /systray
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~1\mimboot.exe
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Startup: DLHelperEXE.exe
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O16 - DPF: {08BEF711-06DA-48B2-9534-802ECAA2E4F9} (PlxInstall Class) - http://down.plaxo.com/down/release/PlaxoInstall.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1110289403360
O16 - DPF: {89D75D39-5531-47BA-9E4F-B346BA9C362C} (CWDL_DownLoadControl Class) - http://www.callwave.com/include/cab/CWDL_DownLoad.CAB
O16 - DPF: {AED98630-0251-4E83-917D-43A23D66D507} (WebHandler Class) - http://activex.microgaming.com/dlhelper/ve…n7/dlhelper.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/vir…l/installer.exe
O16 - DPF: {DD8C9372-35FD-4F7D-8CE4-909ABCFAB2C5} - ms-its:mhtml:file://c:\\nores.mht!http://adxtend.net/code/chm/xpre.chm::/xpreload.ocx
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…337/mcfscan.cab
O20 - Winlogon Notify: Sebring - C:\WINDOWS\System32\LgNotify.dll
O23 - Service: dlbx_device - Dell - C:\WINDOWS\System32\dlbxcoms.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Mcafee.com Corporation - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee.com Personal Firewall Service (MpfService) - McAfee.com Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe

FencerGirl

Post #5June 14, 2007, 4:40 PM UTC

Hi LisaRhea2,

ComboFix cleaned up a lot of stuff, but we still have a long way to go.

However, I don't know what serivce pack 2 is. I'm not the most computer literate person, LOL! Could you give me a heads up on that?

Service Pack 2 was released by Microsoft a few years ago to fix several security holes in Windows XP. After we get your computer clean, I'll give you instructions on how to install it.

Also, I have a question for you. Did you intentionally install a chinese game called BurgerMaker? Please let me know in your next post.

Alright, roll up your sleeves, we have more cleaning to do!

Step 1: Show Hidden Files.
Be sure that Windows is set to show hidden and system files and folders.
In My Computer, click Tools >> Folder Options >> View, set Hidden files and folder to "Show," and uncheck Hide protected operating system files.

Step 2: End a bad process.
Press Ctrl+Alt+Delete to bring up the Windows Security window and click on Task Manager.
Click on the Processes tab and highlight tmrsrv32.exe.
Click End Process. When prompted click Yes to end the process.
Close out of Task Manager using the red X in the upper right hand corner.

Step 3: Clean up with ComboFix.
Open notepad and copy/paste the text in the code box below into it:

File::
C:\WINDOWS\system32\tmrsrv32.exe
C:\WINDOWS\system32\susp.exe
C:\WINDOWS\SYSTEM32\it_reg.exe
C:\WINDOWS\sysrlb32.exe
C:\WINDOWS\SYSTEM32\stfv.bin
C:\WINDOWS\SYSTEM32\msorcl32.exe
C:\WINDOWS\SYSTEM32\gtv_sd.bin
C:\WINDOWS\system32\wintisv32.exe

Folder::
C:\WINDOWS\TGlzYQ\
C:\Documents and Settings\Lisa\My Documents\VLL3.2demowin

Save this as ComboFix-Do.txt

Then drag the ComboFix-Do.txt into ComboFix.exe as you see in the screenshot below.

[external image: Posted Image]

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.

Step 4: Scan some files.

Please visit Virustotal

Click the Browse… button
Navigate to the file C:\tvhjaeh0.sys
Click the Open button
Click the Send button
Copy and paste the results back here please.

Please repeat the above steps for each of the following files, as well.
C:\tvhjaezn.sys
C:\tvhtoc3v.sys
C:\sysaqkl.exe
C:\Program Files\Autodesk\Autodesk DWF Viewer\_Setupx.dll

Step 5: Fix with HijackThis.
Scan with HijackThis and check the following if present.

O2 - BHO: (no name) - {00000250-0320-4dd4-be4f-7566d2314352} - (no file)
O2 - BHO: (no name) - {13197ace-6851-45c3-a7ff-c281324d5489} - (no file)
O2 - BHO: (no name) - {30000273-8230-4dd4-be4f-6889d1e74167} - (no file)
O2 - BHO: (no name) - {4e1075f4-eec4-4a86-add7-cd5f52858c31} - (no file)
O2 - BHO: (no name) - {5dafd089-24b1-4c5e-bd42-8ca72550717b} - (no file)
O2 - BHO: (no name) - {5fa6752a-c4a0-4222-88c2-928ae5ab4966} - (no file)
O2 - BHO: (no name) - {669695bc-a811-4a9d-8cdf-ba8c795f261e} - (no file)
O2 - BHO: (no name) - {8674aea0-9d3d-11d9-99dc-00600f9a01f1} - (no file)
O2 - BHO: (no name) - {965a592f-8efa-4250-8630-7960230792f1} - (no file)
O2 - BHO: (no name) - {b8875bfe-b021-11d4-bfa8-00508b8e9bd3} - (no file)
O2 - BHO: (no name) - {ca1d1b05-9c66-11d5-a009-000103c1e50b} - (no file)
O2 - BHO: (no name) - {cf021f40-3e14-23a5-cba2-717765728274} - (no file)
O2 - BHO: msdn_lib.msdn_hlp - {EC84A858-8398-48D6-8E6B-DB0C4CD7B731} - C:\WINDOWS\System32\msdn_lib.dll
O2 - BHO: (no name) - {fc3a74e5-f281-4f10-ae1e-733078684f3c} - (no file)
O4 - Startup: DLHelperEXE.exe
O16 - DPF: {AED98630-0251-4E83-917D-43A23D66D507} (WebHandler Class) - http://activex.microgaming.com/dlhelper/ve…n7/dlhelper.cab
O16 - DPF: {DD8C9372-35FD-4F7D-8CE4-909ABCFAB2C5} - ms-its:mhtml:file://c:\\nores.mht!http://adxtend.net/code/chm/xpre.chm::/xpreload.ocx

CLOSE ALL OTHER WINDOWS and select "Fixed Checked".

After you've completed all of the above steps, please post back with your new ComboFix log, the results from VirusTotal and a new HijackThis log.
Thanks,
FencerGirl

LisaRhea2

Post #6June 15, 2007, 2:27 AM UTC

Thank you, FencerGirl!

*I don't know anything about the Chinese game. It could have been downloaded by my son…a problem to which we put a stop.

set Hidden files and folder to "Show," and uncheck Hide protected operating system files.—These were already set this way (I don't know if that makes a difference!)

Again, thank you for your help. I don't know how time consuming these things are for you, but I sure appreciate your help. :-)

Here are the logs in the order you requested: Combofix, virustotal and new hijackthis log.

ComboFix 07-06-13.3 - C:\Documents and Settings\Lisa\Desktop\ComboFix.exe
"Lisa" - 2007-06-14 13:42:16 - Service Pack 1 NTFS
Command switches used :: C:\Documents and Settings\Lisa\Desktop\ComboFix-Do.txt

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\Documents and Settings\Lisa\My Documents\VLL3.2demowin
C:\Documents and Settings\Lisa\My Documents\VLL3.2demowin\VLL3.2 demo\._.DS_Store
C:\Documents and Settings\Lisa\My Documents\VLL3.2demowin\VLL3.2 demo\._VLL3-2.exe
C:\Documents and Settings\Lisa\My Documents\VLL3.2demowin\VLL3.2 demo\._VLL3.0 Reference Guide.pdf
C:\Documents and Settings\Lisa\My Documents\VLL3.2demowin\VLL3.2 demo\.DS_Store
C:\Documents and Settings\Lisa\My Documents\VLL3.2demowin\VLL3.2 demo\Help\._.DS_Store
C:\Documents and Settings\Lisa\My Documents\VLL3.2demowin\VLL3.2 demo\Help\._001-Introduction.html
C:\Documents and Settings\Lisa\My Documents\VLL3.2demowin\VLL3.2 demo\Help\._002-Stage & Scenes Window.html
C:\Documents and Settings\Lisa\My Documents\VLL3.2demowin\VLL3.2 demo\Help\._003-Lighting Window.html
C:\Documents and Settings\Lisa\My Documents\VLL3.2demowin\VLL3.2 demo\Help\._004-Slideshow Window.html
C:\Documents and Settings\Lisa\My Documents\VLL3.2demowin\VLL3.2 demo\Help\._005-Keyboard Shortcuts.html
C:\Documents and Settings\Lisa\My Documents\VLL3.2demowin\VLL3.2 demo\Help\._006-General.html
C:\Documents and Settings\Lisa\My Documents\VLL3.2demowin\VLL3.2 demo\Help\._007-Registration.html
C:\Documents and Settings\Lisa\My Documents\VLL3.2demowin\VLL3.2 demo\Help\.DS_Store
C:\Documents and Settings\Lisa\My Documents\VLL3.2demowin\VLL3.2 demo\Help1-Introduction.html
C:\Documents and Settings\Lisa\My Documents\VLL3.2demowin\VLL3.2 demo\Help2-Stage & Scenes Window.html
C:\Documents and Settings\Lisa\My Documents\VLL3.2demowin\VLL3.2 demo\Help3-Lighting Window.html
C:\Documents and Settings\Lisa\My Documents\VLL3.2demowin\VLL3.2 demo\Help4-Slideshow Window.html
C:\Documents and Settings\Lisa\My Documents\VLL3.2demowin\VLL3.2 demo\Help5-Keyboard Shortcuts.html
C:\Documents and Settings\Lisa\My Documents\VLL3.2demowin\VLL3.2 demo\Help6-General.html
C:\Documents and Settings\Lisa\My Documents\VLL3.2demowin\VLL3.2 demo\Help7-Registration.html
C:\Documents and Settings\Lisa\My Documents\VLL3.2demowin\VLL3.2 demo\Models\._Sphere.vmd
C:\Documents and Settings\Lisa\My Documents\VLL3.2demowin\VLL3.2 demo\Models\Sphere.vmd
C:\Documents and Settings\Lisa\My Documents\VLL3.2demowin\VLL3.2 demo\VLL Guide 3.2 update.pdf
C:\Documents and Settings\Lisa\My Documents\VLL3.2demowin\VLL3.2 demo\VLL3-2.exe
C:\Documents and Settings\Lisa\My Documents\VLL3.2demowin\VLL3.2 demo\VLL3.0 Reference Guide.pdf
C:\WINDOWS\sysrlb32.exe
C:\WINDOWS\SYSTEM32\gtv_sd.bin
C:\WINDOWS\SYSTEM32\msorcl32.exe
C:\WINDOWS\SYSTEM32\stfv.bin
C:\WINDOWS\system32\susp.exe
C:\WINDOWS\system32\tmrsrv32.exe
C:\WINDOWS\system32\wintisv32.exe
C:\WINDOWS\TGlzYQ\
C:\WINDOWS\TGlzYQ\\n35Wsk.vbs

((((((((((((((((((((((((( Files Created from 2007-05-14 to 2007-06-14 )))))))))))))))))))))))))))))))

2007-06-13 22:53 786,432 –ah—– C:\DOCUME~1\ADMINI~1.JON\NTUSER.DAT
2007-06-13 22:53 d–h—– C:\DOCUME~1\ADMINI~1.JON\WLANProfiles
2007-06-13 22:53 d——– C:\DOCUME~1\ADMINI~1.JON\APPLIC~1\Real
2007-06-13 21:23 49,152 –a—— C:\WINDOWS\nircmd.exe
2007-06-13 21:20 4,224 –a—— C:\WINDOWS\SYSTEM32\tmp.reg
2007-06-13 21:19 51,200 –a—— C:\WINDOWS\SYSTEM32\dumphive.exe
2007-06-13 21:16 53,248 –a—— C:\WINDOWS\SYSTEM32\Process.exe
2007-06-10 02:27 98,304 –a—— C:\WINDOWS\SYSTEM32\CmdLineExt.dll
2007-06-10 02:27 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\EIDOS
2007-06-10 02:26 62,744 –a—— C:\WINDOWS\SYSTEM32\xinput1_2.dll
2007-06-10 02:26 236,824 –a—— C:\WINDOWS\SYSTEM32\xactengine2_3.dll
2007-06-10 02:02 d——– C:\Program Files\Eidos
2007-05-27 10:48 12 –a—— C:\WINDOWS\SYSTEM32\sl.bin
2007-05-27 10:48 10,759 –a—— C:\sysaqkl.exe
2007-05-21 20:08 d——– C:\WINDOWS\SYSTEM32\SoftwareDistribution
2007-05-21 20:06 465,176 –a—— C:\WINDOWS\SYSTEM32\wuapi.dll
2007-05-21 20:06 41,240 –a—— C:\WINDOWS\SYSTEM32\wups.dll
2007-05-21 20:06 194,328 –a—— C:\WINDOWS\SYSTEM32\wuaueng1.dll
2007-05-21 20:06 172,312 –a—— C:\WINDOWS\SYSTEM32\wuauclt1.exe
2007-05-21 20:06 127,256 –a—— C:\WINDOWS\SYSTEM32\wucltui.dll
2007-05-20 20:04 d——– C:\WINDOWS\Profiles
2007-05-20 20:01 d——– C:\Program Files\viewsonic

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-06-14 17:33:46 ——– d—–w C:\Program Files\Finale NotePad 2006
2007-06-10 06:27:10 ——– d–h–w C:\Program Files\InstallShield Installation Information
2007-06-10 04:39:41 44,582 —-a-w C:\WINDOWS\system32\nvModes.dat
2007-06-07 01:28:29 ——– d–h–w C:\DOCUME~1\Lisa\APPLIC~1\Move Networks
2007-06-05 16:59:06 ——– d—–w C:\DOCUME~1\Lisa\APPLIC~1\SmartDraw
2007-05-24 12:11:44 99,024 —-a-w C:\DOCUME~1\Lisa\APPLIC~1\GDIPFONTCACHEV1.DAT
2007-05-22 00:06:37 ——– d–h–w C:\Program Files\WindowsUpdate
2007-04-16 00:23:16 774,144 —-a-w C:\Program Files\RngInterstitial.dll
2007-04-16 00:22:46 ——– d—–w C:\Program Files\Real
2007-04-04 21:18:14 1,012,993 —-a-w C:\WINDOWS\system32\bmaker.exe
2007-04-03 21:33:06 491 —-a-w C:\WINDOWS\eReg.dat
2007-04-02 21:00:06 1,248 –sha-w C:\tvhtoc3v.sys

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 01:56]
{53707962-6F74-2D53-2644-206D7942484F}=C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2004-05-12 01:03]
{EC84A858-8398-48D6-8E6B-DB0C4CD7B731}=C:\WINDOWS\System32\msdn_lib.dll [2003-05-27 10:48]
{FDD3B846-8D59-4ffb-8758-209B6AD74ACC}=C:\Program Files\Microsoft Money\System\mnyviewer.dll [2001-07-25 11:00]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2002-08-22 20:28]
"nwiz"="nwiz.exe" [2003-06-24 19:32 C:\WINDOWS\SYSTEM32\nwiz.exe]
"PCTVOICE"="pctspk.exe" [2002-07-18 17:58 C:\WINDOWS\SYSTEM32\pctspk.exe]
"bacstray"="BacsTray.exe" [2003-05-14 19:37 C:\WINDOWS\SYSTEM32\BacsTray.exe]
"PRONoMgr.exe"="C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe" [2003-05-28 18:32]
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2003-06-20 15:18]
"MoneyStartUp10.0"="C:\Program Files\Microsoft Money\System\Activation.exe" [2001-07-25 11:00]
"MMTray"="C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe" [2006-01-19 12:06]
"MCAgentExe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2002-09-06 19:15]
"MCUpdateExe"="C:\PROGRA~1\McAfee.com\Agent\McUpdate.exe" [2002-09-04 11:28]
"AdaptecDirectCD"="C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" [2002-12-17 13:28]
"VirusScan Online"="c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe" [2002-10-04 16:09]
"DwlClient"="C:\Program Files\Common Files\Dell\EUSW\Support.exe" [2003-06-24 18:01]
"MPFExe"="C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe" [2002-10-10 18:14]
"dlbxmon.exe"="C:\Program Files\Dell Photo AIO Printer 962\dlbxmon.exe" [2004-08-27 15:29]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-02-24 19:57]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-06-14 16:24]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-08-13 15:26]
"NapsterShell"="C:\Program Files\Napster\napster.exe" [2006-06-29 14:17]
"MimBoot"="C:\PROGRA~1\MUSICM~1\MUSICM~1\mimboot.exe" [2006-01-19 12:06]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MoneyAgent"="C:\Program Files\Microsoft Money\System\Money Express.exe" [2001-07-25 11:00]
"ctfmon.exe"="C:\WINDOWS\System32\ctfmon.exe" [2002-08-29 06:00]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Sebring]
C:\WINDOWS\System32\LgNotify.dll

Contents of the 'Scheduled Tasks' folder
2007-06-14 17:46:00 C:\WINDOWS\tasks\McAfee.com Update Check (D6YMVK31-Owner).job
2007-06-14 17:45:00 C:\WINDOWS\tasks\McAfee.com Update Check (JONATHAN-Darren).job
2007-06-14 17:44:00 C:\WINDOWS\tasks\McAfee.com Update Check (JONATHAN-Jon).job
2007-06-14 17:44:00 C:\WINDOWS\tasks\McAfee.com Update Check (JONATHAN-Lisa).job
2007-06-14 17:46:00 C:\WINDOWS\tasks\McAfee.com Update Check (JONATHAN-Shannon).job

**************************************************************************

catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-06-14 13:46:47
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

**************************************************************************

Completion time: 2007-06-14 13:47:34
C:\ComboFix-quarantined-files.txt … 2007-06-14 13:47
C:\ComboFix2.txt … 2007-06-13 21:35

— E O F —

STATUS: FINISHEDComplete scanning result of "tvhjaeh0.sys", received in VirusTotal at 06.14.2007, 20:10:59 (CET).

Antivirus Version Update Result
AhnLab-V3 2007.6.12.2 06.14.2007 no virus found
AntiVir 7.4.0.32 06.14.2007 no virus found
Authentium 4.93.8 06.14.2007 no virus found
Avast 4.7.997.0 06.14.2007 no virus found
AVG 7.5.0.467 06.14.2007 no virus found
BitDefender 7.2 06.14.2007 no virus found
CAT-QuickHeal 9.00 06.14.2007 no virus found
ClamAV devel-20070416 06.14.2007 no virus found
DrWeb 4.33 06.14.2007 no virus found
eSafe 7.0.15.0 06.14.2007 no virus found
eTrust-Vet 30.7.3718 06.14.2007 no virus found
Ewido 4.0 06.14.2007 no virus found
FileAdvisor 1 06.14.2007 no virus found
Fortinet 2.85.0.0 06.14.2007 no virus found
F-Prot 4.3.2.48 06.14.2007 no virus found
F-Secure 6.70.13030.0 06.14.2007 no virus found
Ikarus T3.1.1.8 06.14.2007 no virus found
Kaspersky 4.0.2.24 06.14.2007 no virus found
McAfee 5053 06.14.2007 no virus found
Microsoft 1.2503 06.14.2007 no virus found
NOD32v2 2329 06.14.2007 no virus found
Norman 5.80.02 06.14.2007 no virus found
Panda 9.0.0.4 06.14.2007 no virus found
Prevx1 V2 06.14.2007 no virus found
Sophos 4.18.0 06.12.2007 no virus found
Sunbelt 2.2.907.0 06.14.2007 no virus found
Symantec 10 06.14.2007 no virus found
TheHacker [removed] 06.14.2007 no virus found
VBA32 [removed] 06.13.2007 no virus found
VirusBuster 4.3.23:9 06.14.2007 no virus found
Webwasher-Gateway 6.0.1 06.14.2007 no virus found

Aditional Information
File size: 1248 bytes
MD5: 7007e21e6274286932dcc78f0ac42a03
SHA1: 9dc80628d68e120affa031d2ad7de09259df1601

VirusTotal is a free service offered by Hispasec Sistemas. There are no guarantees about the availability and continuity of this service. Although the detection rate afforded by the use of multiple antivirus engines is far superior to that offered by just one product, these results DO NOT guarantee the harmlessness of a file. Currently, there is not any solution that offers a 100% effectiveness rate for detecting viruses and malware.
> Go to: Home Contactar En Español
——————————————————————————–
www.virustotal.com :: ©Hispasec Sistemas 2004-07:: e-mail [removed]

STATUS: FINISHEDComplete scanning result of "tvhjaezn.sys", received in VirusTotal at 06.14.2007, 20:26:31 (CET).

Antivirus Version Update Result
AhnLab-V3 2007.5.9.0 05.09.2007 no virus found
AntiVir 7.4.0.32 06.14.2007 no virus found
Authentium 4.93.8 06.14.2007 no virus found
Avast 4.7.997.0 06.14.2007 no virus found
AVG 7.5.0.467 05.08.2007 no virus found
BitDefender 7.2 06.14.2007 no virus found
CAT-QuickHeal 9.00 06.14.2007 no virus found
ClamAV devel-20070416 05.09.2007 no virus found
DrWeb 4.33 06.14.2007 no virus found
eSafe 7.0.15.0 05.08.2007 no virus found
eTrust-Vet 30.7.3718 06.14.2007 no virus found
FileAdvisor 1 06.14.2007 no virus found
Fortinet 2.85.0.0 06.14.2007 no virus found
F-Prot 4.3.2.48 05.08.2007 no virus found
F-Secure 6.70.13030.0 05.09.2007 no virus found
Ikarus T3.1.1.7 05.09.2007 no virus found
Kaspersky 4.0.2.24 06.14.2007 no virus found
McAfee 5053 06.14.2007 no virus found
Microsoft 1.2503 06.14.2007 no virus found
NOD32v2 2329 06.14.2007 no virus found
Norman 5.80.02 06.14.2007 no virus found
Panda 9.0.0.4 06.14.2007 no virus found
Prevx1 V2 06.14.2007 no virus found
Sophos 4.18.0 06.12.2007 no virus found
Sunbelt 2.2.907.0 05.05.2007 no virus found
Symantec 10 05.09.2007 no virus found
TheHacker [removed] 06.14.2007 no virus found
VBA32 [removed] 06.13.2007 no virus found
VirusBuster 4.3.23:9 06.14.2007 no virus found
Webwasher-Gateway 6.0.1 05.09.2007 no virus found

Aditional Information
File size: 1248 bytes
MD5: f334c9a9318679c2ec301e650fd6ecc2
SHA1: 96d58bdbd5df2a1b16d9d1adae6623342838a4ae

STATUS: FINISHEDComplete scanning result of "tvhtoc3v.sys", received in VirusTotal at 06.14.2007, 19:52:34 (CET).

Antivirus Version Update Result
AhnLab-V3 2007.6.12.2 06.14.2007 no virus found
AntiVir 7.4.0.32 06.14.2007 no virus found
Authentium 4.93.8 06.14.2007 no virus found
Avast 4.7.997.0 06.14.2007 no virus found
AVG 7.5.0.467 06.14.2007 no virus found
BitDefender 7.2 06.14.2007 no virus found
CAT-QuickHeal 9.00 06.14.2007 no virus found
ClamAV devel-20070416 06.14.2007 no virus found
DrWeb 4.33 06.14.2007 no virus found
eSafe 7.0.15.0 06.14.2007 no virus found
eTrust-Vet 30.7.3718 06.14.2007 no virus found
Ewido 4.0 06.14.2007 no virus found
FileAdvisor 1 06.14.2007 no virus found
Fortinet 2.85.0.0 06.14.2007 no virus found
F-Prot 4.3.2.48 06.14.2007 no virus found
F-Secure 6.70.13030.0 06.14.2007 no virus found
Ikarus T3.1.1.8 06.14.2007 no virus found
Kaspersky 4.0.2.24 06.14.2007 no virus found
McAfee 5053 06.14.2007 no virus found
Microsoft 1.2503 06.14.2007 no virus found
NOD32v2 2329 06.14.2007 no virus found
Norman 5.80.02 06.14.2007 no virus found
Panda 9.0.0.4 06.14.2007 no virus found
Prevx1 V2 06.14.2007 no virus found
Sophos 4.18.0 06.12.2007 no virus found
Sunbelt 2.2.907.0 06.14.2007 no virus found
Symantec 10 06.14.2007 no virus found
TheHacker [removed] 06.14.2007 no virus found
VBA32 [removed] 06.13.2007 no virus found
VirusBuster 4.3.23:9 06.14.2007 no virus found
Webwasher-Gateway 6.0.1 06.14.2007 no virus found

Aditional Information
File size: 1248 bytes
MD5: d6a2a1386e7e6cb45b78d9e8a524ca22
SHA1: b68bdd3fe3c66281fd5fe819c19114dfaef26aed

STATUS: FINISHEDComplete scanning result of "sysaqkl.exe", received in VirusTotal at 06.14.2007, 20:44:14 (CET).

Antivirus Version Update Result
AhnLab-V3 2007.6.12.2 06.14.2007 Win-Trojan/Xema.variant
AntiVir 7.4.0.32 06.14.2007 TR/Crypt.FKM.Gen
Authentium 4.93.8 06.14.2007 W32/Trojan.AOZI
Avast 4.7.997.0 06.14.2007 Win32:VB-TFA
AVG 7.5.0.467 06.14.2007 Downloader.Generic4.ILI
BitDefender 7.2 06.14.2007 Trojan.Downloader.VB.AKM
CAT-QuickHeal 9.00 06.14.2007 TrojanDownloader.VB.att
ClamAV devel-20070416 06.14.2007 Trojan.Downloader-8014
DrWeb 4.33 06.14.2007 Trojan.DownLoader.21675
eSafe 7.0.15.0 06.14.2007 Win32.VB.att
eTrust-Vet 30.7.3718 06.14.2007 Win32/Cadux.BO
Ewido 4.0 06.14.2007 Downloader.VB.att
FileAdvisor 1 06.14.2007 no virus found
Fortinet 2.85.0.0 06.14.2007 W32/VB.DMF!tr
F-Prot 4.3.2.48 06.14.2007 no virus found
F-Secure 6.70.13030.0 06.14.2007 Trojan-Downloader.Win32.VB.att
Ikarus T3.1.1.8 06.14.2007 Trojan-Downloader.Win32.VB.att
Kaspersky 4.0.2.24 06.14.2007 Trojan-Downloader.Win32.VB.att
McAfee 5053 06.14.2007 TFactory
Microsoft 1.2503 06.14.2007 TrojanDownloader:Win32/VB!BE34
NOD32v2 2329 06.14.2007 no virus found
Norman 5.80.02 06.14.2007 W32/DLoader.CSOZ
Panda 9.0.0.4 06.14.2007 Trj/VB.WA
Prevx1 V2 06.14.2007 Covert.Sys.Exec
Sophos 4.18.0 06.12.2007 Troj/DwnLdr-GUV
Sunbelt 2.2.907.0 06.14.2007 no virus found
Symantec 10 06.14.2007 Downloader
TheHacker 6.1.6.133 06.14.2007 Trojan/Downloader.VB.att
VBA32 [removed] 06.13.2007 Trojan-Downloader.Win32.VB.att
VirusBuster 4.3.23:9 06.14.2007 no virus found
Webwasher-Gateway 6.0.1 06.14.2007 Trojan.Crypt.FKM.Gen

Aditional Information
File size: 10759 bytes
MD5: 52f5056073c8980843d37c9a5e3a80d0
SHA1: fa4583db6cd80c87ecc26312e4569f7a1fd1c2cf
packers: UPX
packers: UPX
packers: UPX
packers: UPX
Prevx info: http://fileinfo.prevx.com/fileinfo.asp?PXC=ef5995057526

STATUS: FINISHEDComplete scanning result of "_Setupx.dll", received in VirusTotal at 06.14.2007, 20:54:27 (CET).

Antivirus Version Update Result
AhnLab-V3 2007.6.12.2 06.14.2007 no virus found
AntiVir 7.4.0.32 06.14.2007 no virus found
Authentium 4.93.8 06.14.2007 no virus found
Avast 4.7.997.0 06.14.2007 no virus found
AVG 7.5.0.467 06.14.2007 no virus found
BitDefender 7.2 06.14.2007 no virus found
CAT-QuickHeal 9.00 06.14.2007 no virus found
ClamAV devel-20070416 06.14.2007 no virus found
DrWeb 4.33 06.14.2007 no virus found
eSafe 7.0.15.0 06.14.2007 no virus found
eTrust-Vet 30.7.3718 06.14.2007 no virus found
Ewido 4.0 06.14.2007 no virus found
FileAdvisor 1 06.14.2007 no virus found
Fortinet 2.85.0.0 06.14.2007 no virus found
F-Prot 4.3.2.48 06.14.2007 no virus found
F-Secure 6.70.13030.0 06.14.2007 no virus found
Ikarus T3.1.1.8 06.14.2007 no virus found
Kaspersky 4.0.2.24 06.14.2007 no virus found
McAfee 5053 06.14.2007 no virus found
Microsoft 1.2503 06.14.2007 no virus found
NOD32v2 2329 06.14.2007 no virus found
Norman 5.80.02 06.14.2007 no virus found
Panda 9.0.0.4 06.14.2007 no virus found
Prevx1 V2 06.14.2007 no virus found
Sophos 4.18.0 06.12.2007 no virus found
Sunbelt 2.2.907.0 06.14.2007 no virus found
Symantec 10 06.14.2007 no virus found
TheHacker [removed] 06.14.2007 no virus found
VBA32 [removed] 06.13.2007 no virus found
VirusBuster 4.3.23:9 06.14.2007 no virus found
Webwasher-Gateway 6.0.1 06.14.2007 no virus found

Aditional Information
File size: 11360 bytes
MD5: 9fa6011d6b1d143558b42ae739b81320
SHA1: 67cc9d060a36f9e9825647a5b12461e8112a15fb

Logfile of HijackThis v1.99.1
Scan saved at 10:13:41 PM, on 6/14/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\S24EvMon.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\RegSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZCfgSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\1XConfig.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\System32\pctspk.exe
C:\WINDOWS\System32\BacsTray.exe
C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\Dell Photo AIO Printer 962\dlbxmon.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Napster\napster.exe
C:\PROGRA~1\MUSICM~1\MUSICM~1\MMDiag.exe
C:\Program Files\Microsoft Money\System\Money Express.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mim.exe
C:\WINDOWS\System32\wuauclt.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\System32\dlbxcoms.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [bacstray] BacsTray.exe
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [MoneyStartUp10.0] "C:\Program Files\Microsoft Money\System\Activation.exe"
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [MCAgentExe] C:\Program Files\McAfee.com\Agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\McAfee.com\Agent\McUpdate.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [dlbxmon.exe] "C:\Program Files\Dell Photo AIO Printer 962\dlbxmon.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NapsterShell] C:\Program Files\Napster\napster.exe /systray
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~1\mimboot.exe
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O16 - DPF: {08BEF711-06DA-48B2-9534-802ECAA2E4F9} (PlxInstall Class) - http://down.plaxo.com/down/release/PlaxoInstall.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1110289403360
O16 - DPF: {89D75D39-5531-47BA-9E4F-B346BA9C362C} (CWDL_DownLoadControl Class) - http://www.callwave.com/include/cab/CWDL_DownLoad.CAB
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/vir…l/installer.exe
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…337/mcfscan.cab
O20 - Winlogon Notify: Sebring - C:\WINDOWS\System32\LgNotify.dll
O23 - Service: dlbx_device - Dell - C:\WINDOWS\System32\dlbxcoms.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Mcafee.com Corporation - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee.com Personal Firewall Service (MpfService) - McAfee.com Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe

FencerGirl

Post #7June 16, 2007, 2:11 PM UTC

You're doing great! All of your logs are looking much better. There are just a few more things to clean up.

Browse to the following files and delete them if present.

C:\sysaqkl.exe

Then, we've got one more file for VirusTotal.
Please visit Virustotal

Click the Browse… button
Navigate to the file C:\WINDOWS\system32\bmaker.exe
Click the Open button
Click the Send button
Copy and paste the results back here please.

After you've done that, I want to run one more scan to make sure we got everything.
Please do an online scan withKasperskyWebScanner

Click on Kaspersky Online Scanner

You will be promted to install an ActiveX component from Kaspersky,
Click Yes.

The program will launch and then begin downloading the latest definition files:
Once the files have been downloaded click on NEXT
Now click on Scan Settings
In the scan settings make that the following are selected:
- Scan using the following Anti-Virus database:
Extended (if available otherwise
Standard)
- Scan Options:
Scan Archives
Scan Mail Bases
Click OK
Now under select a target to scan:Select My Computer
This will program will start and scan your system.
The scan will take a while so be patient and let it run.
Once the scan is complete it will display if your system has been
infected.
- Now click on the Save as Text button:
Save the file to your desktop.
Copy and paste that information in your next post.

After you've completed the above steps, please post back with your Kaspersky log, the VirusTotal results and a new HijackThis log.
Thanks!
FencerGirl

FencerGirl

Post #8June 25, 2007, 4:42 PM UTC

Hi LisaRhea2, I just wondered how the fix was going. Thanks! FencerGirl

LDTate

Post #9June 27, 2007, 12:45 PM UTC

Due to inactivity this topic will be closed.

LDTate

Post #10June 27, 2007, 12:45 PM UTC

Your post has been Moved, Closed or Edited for one of the following reasons:

1.) You posted multiple topics and only one is required

2.) You are spamming links to other places without approval

3.) You have posted your hijackthis log to the wrong forum:
( http://forums.tomcoyote.org/index.php?showforum=27 ) <— correct forum for HijackThis Logs

4.) Abusive language or other problems in your text

5.) Your log is too old (20 days or more) and no replies from you after a volunteer tried to help you

If you came here for help, and you have not posted a Hijackthis log to the proper forum, then you may do so now, if you came here to spam or abuse, you will be dealt with harsher on your next offense

This is a family oriented forum to help those that need help.

==============================

Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Antispysolutions.com, Red Desktop, Bubbles, Etc...

✨ Ask AI

Ask AI