What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Hjt Log

6 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Logfile of HijackThis v1.99.1
Scan saved at 5:03:58 PM, on 6/14/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16441)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Dylan\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\program files\mcafee\virusscan\scriptcl.dll
O2 - BHO: (no name) - {bf71d8c7-d699-416c-b352-5da0aef6b0a2} - C:\WINDOWS\system32\autwiz.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /installquiet /nodetect
O4 - HKLM\..\Run: [hpWirelessAssistant] "C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe"
O4 - HKLM\..\Run: [QlbCtrl] "C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" /Start
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SiteAdvisor] "C:\Program Files\SiteAdvisor\6066\SiteAdv.exe"
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [setup] "rundll32.exe" "C:\WINDOWS\xxvtqp.dll",realset
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe /startintray
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqnbk/downloads/sysinfo.cab
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - http://ipgweb.cce.hp.com/rdqnbk/downloads/msxml4.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
O20 - AppInit_DLLs: c:\windows\system32\mljjjkl.dll
O20 - Winlogon Notify: autwiz - C:\WINDOWS\SYSTEM32\autwiz.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: SiteAdvisor Service - McAfee, Inc. - C:\Program Files\SiteAdvisor\6066\SAService.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
Post #2
Hello,

* Download Combofix to your desktop.
Doubleclick combofix.exe
Follow the prompts.
Don't click on the window while the fix is running, because that will cause your system to hang.

When finished and after reboot (in case it asks to reboot), it should open a log, combofix.txt.
Post this log in your next reply together with a new hijackthislog.
Do NOT post the ComboFix-quarantined-files.txt - unless I ask you to.
Post #3
ComboFix 07-06-13.3
"Dylan" - 2007-06-16 11:57:49 - Service Pack 2 NTFS [SAFE MODE]


((((((((((((((((((((((((( Files Created from 2007-05-16 to 2007-06-16 )))))))))))))))))))))))))))))))


2007-06-16 11:42 d——– C:\c59b40c5a94e0667aa6448ccf402
2007-06-16 11:32 49,152 –a—— C:\WINDOWS\nircmd.exe
2007-06-15 13:51 76,560 –a—— C:\WINDOWS\system32\drivers\tmcomm.sys
2007-06-15 13:50 d——– C:\DOCUME~1\Dylan\.housecall6.6
2007-06-10 13:58 d–hs—- C:\WINDOWS\CSC
2007-06-05 14:11 d——– C:\DOCUME~1\Dylan\APPLIC~1\PC Tools
2007-06-05 13:52 d——– C:\DOCUME~1\NETWOR~1\APPLIC~1\Webroot
2007-06-03 21:11 2,560 –a—— C:\WINDOWS\_MSRSTRT.EXE
2007-06-03 15:04 83,536 –a—— C:\WINDOWS\system32\drivers\iksyssec.sys
2007-06-03 15:04 626,688 –a—— C:\WINDOWS\system32\msvcr80.dll
2007-06-03 15:04 59,984 –a—— C:\WINDOWS\system32\drivers\iksysflt.sys
2007-06-03 15:04 52,304 –a—— C:\WINDOWS\system32\drivers\ikfilesec.sys
2007-06-03 15:04 499,712 –a—— C:\WINDOWS\system32\msvcp71.dll
2007-06-03 15:04 39,248 –a—— C:\WINDOWS\system32\drivers\ikfileflt.sys
2007-06-03 15:04 26,064 –a—— C:\WINDOWS\system32\drivers\kcom.sys
2007-06-03 15:04 d——– C:\Program Files\Spyware Doctor
2007-06-01 14:22 22,080 –a—— C:\WINDOWS\system32\drivers\sshrmd.sys
2007-06-01 14:22 21,056 –a—— C:\WINDOWS\system32\drivers\sskbfd.sys
2007-06-01 14:22 20,544 –a—— C:\WINDOWS\system32\drivers\SSFS0509.sys
2007-06-01 14:22 144,960 –a—— C:\WINDOWS\system32\drivers\ssidrv.sys
2007-06-01 14:22 d——– C:\DOCUME~1\LOCALS~1\APPLIC~1\Webroot
2007-06-01 14:21 164 –a—— C:\install.dat
2007-06-01 14:21 d——– C:\Program Files\Webroot
2007-06-01 14:21 d——– C:\DOCUME~1\Dylan\APPLIC~1\Webroot
2007-06-01 14:21 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Webroot
2007-06-01 14:08 221,184 –a—— C:\WINDOWS\system32\wmpns.dll
2007-06-01 14:08 d——– C:\Program Files\Windows Media Connect 2
2007-06-01 14:06 d——– C:\WINDOWS\system32\drivers\UMDF
2007-05-31 15:34 d——– C:\Program Files\MSXML 4.0
2007-05-31 15:19 48,015 –a—— C:\WINDOWS\system32\vtutq.exe
2007-05-31 15:14 d——– C:\Program Files\Common Files\Download Manager
2007-05-31 14:44 176,128 –a—— C:\WINDOWS\system32\nvusmb.exe
2007-05-31 14:44 176,128 –a—— C:\WINDOWS\system32\nvunrm.exe
2007-05-31 14:44 176,128 ——— C:\WINDOWS\system32\nvuide.exe
2007-05-31 14:44 101,888 –a—— C:\WINDOWS\system32\drivers\nvtcp.sys
2007-05-29 21:22 d——– C:\Program Files\Microsoft USB Flash Drive Manager
2007-05-29 21:09 d——– C:\TEMP\AT89
2007-05-29 21:09 d——– C:\TEMP
2007-05-29 19:11 d——– C:\WINDOWS\system32\LogFiles
2007-05-29 10:27 d——– C:\WINDOWS\system32\appmgmt
2007-05-29 00:24 d——– C:\DOCUME~1\NETWOR~1\APPLIC~1\SiteAdvisor
2007-05-28 19:34 d——– C:\Program Files\Call of Duty
2007-05-28 19:33 12,160 –a—— C:\WINDOWS\system32\drivers\mouhid.sys
2007-05-28 18:36 94,208 –a—— C:\WINDOWS\system32\PELZOOM.DLL
2007-05-28 18:36 9,600 –a—— C:\WINDOWS\system32\drivers\HIDUSB.SYS
2007-05-28 18:36 77,824 –a—— C:\WINDOWS\system32\PMPoPo.DLL
2007-05-28 18:36 73,728 –a—— C:\WINDOWS\system32\PELHOOKS.DLL
2007-05-28 18:36 650,532 –a—— C:\WINDOWS\system32\HPBDO.DLL
2007-05-28 18:36 65,536 –a—— C:\WINDOWS\system32\PMIBM.DLL
2007-05-28 18:36 57,344 –a—— C:\WINDOWS\system32\ICONSPY.EXE
2007-05-28 18:36 57,344 –a—— C:\WINDOWS\system32\ICO.EXE
2007-05-28 18:36 49,152 –a—— C:\WINDOWS\system32\PELCOMM.DLL
2007-05-28 18:36 471,040 –a—— C:\WINDOWS\system32\NOTIFIER.DLL
2007-05-28 18:36 45,056 –a—— C:\WINDOWS\system32\PELRESS.DLL
2007-05-28 18:36 40,960 –a—— C:\WINDOWS\system32\PMTilt3.DLL
2007-05-28 18:36 40,960 –a—— C:\WINDOWS\system32\PMPOPO2.dll
2007-05-28 18:36 36,864 –a—— C:\WINDOWS\system32\PMUNINNT.EXE
2007-05-28 18:36 348,160 –a—— C:\WINDOWS\system32\MSVCR71.DLL
2007-05-28 18:36 294,912 –a—— C:\WINDOWS\system32\HPWHEEL.DLL
2007-05-28 18:36 241,664 –a—— C:\WINDOWS\system32\PELUTIL.DLL
2007-05-28 18:36 24,576 –a—— C:\WINDOWS\system32\PELSETUP.DLL
2007-05-28 18:36 229,376 –a—— C:\WINDOWS\system32\PMUNINST.EXE
2007-05-28 18:36 215,040 –a—— C:\WINDOWS\system32\HPPPM.DLL
2007-05-28 18:36 16,512 –a—— C:\WINDOWS\system32\drivers\PELMOUSE.SYS
2007-05-28 18:36 159,854 –a—— C:\WINDOWS\system32\PMARIA.DLL
2007-05-28 18:36 147,456 –a—— C:\WINDOWS\system32\PELMICED.EXE
2007-05-28 18:36 13,184 –a—— C:\WINDOWS\system32\drivers\PELUSBlf.SYS
2007-05-28 18:36 126,976 –a—— C:\WINDOWS\system32\PELSCRLL.DLL
2007-05-28 18:36 1,060,864 –a—— C:\WINDOWS\system32\MFC71.DLL
2007-05-28 18:36 d——– C:\WINDOWS\_PrimaxInstallTempDir0
2007-05-28 18:35 d——– C:\Program Files\HP Optical USB Mobile Mouse
2007-05-28 18:21 d——– C:\WINDOWS\system32\URTTEMP
2007-05-28 15:59 82,944 –a—— C:\WINDOWS\system32\drivers\wdmaud.sys
2007-05-28 15:59 6,400 –a—— C:\WINDOWS\system32\drivers\splitter.sys
2007-05-28 15:59 52,864 –a—— C:\WINDOWS\system32\drivers\DMusic.sys
2007-05-28 15:58 7,552 –a—— C:\WINDOWS\system32\drivers\MSKSSRV.sys
2007-05-28 15:58 60,800 –a—— C:\WINDOWS\system32\drivers\sysaudio.sys
2007-05-28 15:58 54,272 –a—— C:\WINDOWS\system32\drivers\swmidi.sys
2007-05-28 15:58 5,376 –a—— C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2007-05-28 15:58 4,992 –a—— C:\WINDOWS\system32\drivers\MSPQM.sys
2007-05-28 15:58 2,944 –a—— C:\WINDOWS\system32\drivers\drmkaud.sys
2007-05-28 15:58 172,416 –a—— C:\WINDOWS\system32\drivers\kmixer.sys
2007-05-28 15:58 142,464 –a—— C:\WINDOWS\system32\drivers\aec.sys
2007-05-28 15:57 60,288 –a—— C:\WINDOWS\system32\drivers\drmk.sys
2007-05-28 15:57 4,096 –a—— C:\WINDOWS\system32\ksuser.dll
2007-05-28 15:57 d——– C:\Program Files\CONEXANT
2007-05-28 15:53 d——– C:\DOCUME~1\LOCALS~1\APPLIC~1\SiteAdvisor
2007-05-28 15:53 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\SiteAdvisor
2007-05-28 15:07 d——– C:\Program Files\iTunes
2007-05-28 15:07 d——– C:\Program Files\iPod
2007-05-28 15:07 d——– C:\DOCUME~1\Dylan\APPLIC~1\Apple Computer
2007-05-28 15:06 d——– C:\Program Files\QuickTime
2007-05-28 15:05 d——– C:\Program Files\Apple Software Update
2007-05-28 15:05 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
2007-05-28 15:01 d——– C:\DOCUME~1\Dylan\Shared
2007-05-28 15:01 d——– C:\DOCUME~1\Dylan\Incomplete
2007-05-28 14:59 d——– C:\DOCUME~1\Dylan\APPLIC~1\LimeWire
2007-05-28 14:58 d——– C:\Program Files\SiteAdvisor
2007-05-28 14:58 d——– C:\DOCUME~1\Dylan\APPLIC~1\SiteAdvisor
2007-05-28 14:57 71,496 –a—— C:\WINDOWS\system32\drivers\mfeavfk.sys


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-05-30 22:47:47 11,973 —-a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-04-18 16:12:23 2,854,400 —-a-w C:\WINDOWS\system32\msi.dll
2007-04-17 05:45:28 92,504 —-a-w C:\WINDOWS\system32\cdm.dll
2007-04-17 05:45:20 43,352 —-a-w C:\WINDOWS\system32\wups2.dll
2007-03-17 13:43:01 292,864 —-a-w C:\WINDOWS\system32\winsrv.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{089FD14D-132B-48FC-8861-0048AE113215}=C:\Program Files\SiteAdvisor\6066\SiteAdv.dll [2007-03-30 08:41]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [2007-03-14 03:43]
{7DB2D5A0-7241-4E79-B68D-6309F01C5231}=c:\program files\mcafee\virusscan\scriptcl.dll [2006-12-22 16:02]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nwiz"="nwiz.exe" [2006-09-27 17:10 C:\WINDOWS\system32\nwiz.exe]
"hpWirelessAssistant"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-01-10 15:13]
"QlbCtrl"="C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-11-06 10:58]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-04-27 11:25]
"SiteAdvisor"="C:\Program Files\SiteAdvisor\6066\SiteAdv.exe" [2006-08-10 12:38]
"Mouse Suite 98 Daemon"="ICO.EXE" [2004-07-14 15:36 C:\WINDOWS\system32\ICO.EXE]
"SDTray"="C:\Program Files\Spyware Doctor\SDTrayApp.exe" [2007-05-17 12:02]
"SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" [2007-03-01 20:09]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 09:24]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=c:\windows\system32\mljjjkl.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\sdauxservice]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\sdcoreservice]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\WebrootSpySweeperService]

*Newly Created Service* - MDMXSDK

Contents of the 'Scheduled Tasks' folder
2007-05-28 22:06:05 C:\WINDOWS\tasks\AppleSoftwareUpdate.job
2007-05-28 21:57:13 C:\WINDOWS\tasks\McDefragTask.job
2007-06-01 08:00:06 C:\WINDOWS\tasks\McQcTask.job
2007-06-16 18:57:33 C:\WINDOWS\tasks\MP Scheduled Scan.job

**************************************************************************

catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-06-16 11:58:47
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-06-16 11:59:01
C:\ComboFix-quarantined-files.txt … 2007-06-16 11:59

— E O F —

Logfile of HijackThis v1.99.1
Scan saved at 12:02:31 PM, on 6/16/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16441)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\Dylan\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\program files\mcafee\virusscan\scriptcl.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /installquiet /nodetect
O4 - HKLM\..\Run: [hpWirelessAssistant] "C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe"
O4 - HKLM\..\Run: [QlbCtrl] "C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" /Start
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SiteAdvisor] "C:\Program Files\SiteAdvisor\6066\SiteAdv.exe"
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKLM\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe /startintray
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqnbk/downloads/sysinfo.cab
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - http://ipgweb.cce.hp.com/rdqnbk/downloads/msxml4.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
O20 - AppInit_DLLs: c:\windows\system32\mljjjkl.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: DomainService - Unknown owner - C:\Documents and Settings\Dylan\Application Data\tmp3E.tmp.exe (file missing)
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: SiteAdvisor Service - McAfee, Inc. - C:\Program Files\SiteAdvisor\6066\SAService.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Web
Post #4
Hi,

From what I can see, the problem should already be gone now though. There are just some small leftovers to deal with.
Some bad entries that were present before in your log are gone now..

Do next please..

* Start HijackThis, close all open windows leaving only HijackThis running. Place a check against each of the following:

O20 - AppInit_DLLs: c:\windows\system32\mljjjkl.dll
O23 - Service: DomainService - Unknown owner - C:\Documents and Settings\Dylan\Application Data\tmp3E.tmp.exe (file missing)

* Click on Fix Checked when finished and exit HijackThis.
Make sure your Internet Explorer is closed when you click Fix Checked!
Don't worry if you get an error in HijackThis while fixing that O20 entry, this is normal.

Then, go to start > run and copy and paste next command in the field:

sc delete DomainService

Hit enter.

Navigate to and delete next file:

C:\WINDOWS\system32\vtutq.exe

Post a new HijackThislog in your next reply.

By the way.. are you having problems with McAfee?
Post #5
No I dont have a problem with mcafee. It doesnt work the best.

Log File of HijackThis v1.99.1
Scan saved at 1:00:36 PM, on 6/17/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16441)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Documents and Settings\Dylan\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
O2 - BHO: (no name) - {6a15d0cb-b2d1-4fe6-94b0-342fee665a38} - C:\WINDOWS\system32\bidgmt.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\program files\mcafee\virusscan\scriptcl.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /installquiet /nodetect
O4 - HKLM\..\Run: [hpWirelessAssistant] "C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe"
O4 - HKLM\..\Run: [QlbCtrl] "C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" /Start
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SiteAdvisor] "C:\Program Files\SiteAdvisor\6066\SiteAdv.exe"
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKLM\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe /startintray
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqnbk/downloads/sysinfo.cab
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - http://ipgweb.cce.hp.com/rdqnbk/downloads/msxml4.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
O20 - Winlogon Notify: bidgmt - C:\WINDOWS\SYSTEM32\bidgmt.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: SiteAdvisor Service - McAfee, Inc. - C:\Program Files\SiteAdvisor\6066\SAService.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Web
Post #6
Hi,

From what I can see, you got reinfected…

The reason why I asked you about McAfee is because I see it present in your HijackThislog in the O23 entries, but I don't see it running in your running processes - only one process and that's the main scanner… but I don't see the McAfee firewall running, the McAfee realtime protection and some other McAfee related processes - Unless you disable some ofcourse… Is this what you are doing? Please let me know in your next reply…

Also do next…

Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\WINDOWS\SYSTEM32\bidgmt.dll

Registry::
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6a15d0cb-b2d1-4fe6-94b0-342fee665a38}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\bidgmt]


Save this as ComboFix-Do.txt

Then drag the ComboFix-Do.txt into ComboFix.exe as you see in the screenshot below.

[external image: Posted Image]

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThislog.
Post #7
ComboFix 07-06-13.3 - C:\Documents and Settings\Dylan\Desktop\ComboFix.exe
"Dylan" - 2007-06-18 8:45:05 - Service Pack 2 NTFS
Command switches used :: C:\Documents and Settings\Dylan\Desktop\ComboFix-Do.txt


(((((((((((((((((((((((((((((((((((((((((((( V Log )))))))))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\system32\bidgmt.dll


* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *



((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\DOCUME~1\Dylan\APPLIC~1\tmp2B.tmp.exe
C:\DOCUME~1\Dylan\APPLIC~1\tmp2E.tmp.exe
C:\DOCUME~1\Dylan\APPLIC~1\tmp33.tmp.exe
C:\DOCUME~1\Dylan\APPLIC~1\tmp39.tmp.exe
C:\DOCUME~1\Dylan\APPLIC~1\tmp61.tmp.exe
C:\DOCUME~1\Dylan\APPLIC~1\tmp62.tmp.exe
C:\WINDOWS\SYSTEM32\bidgmt.dll


((((((((((((((((((((((((( Files Created from 2007-05-18 to 2007-06-18 )))))))))))))))))))))))))))))))


2007-06-18 08:40 46,336 –a—— C:\WINDOWS\system32\tmp61.tmp.dll
2007-06-18 00:00 76,560 –a—— C:\WINDOWS\system32\drivers\tmcomm.sys
2007-06-17 23:54 46,336 –a—— C:\WINDOWS\system32\tmp32.tmp.dll
2007-06-17 23:10 46,336 –a—— C:\WINDOWS\system32\tmp2A.tmp.dll
2007-06-17 13:44 d——– C:\461f9500fe73e4882b1d0cdef28b67
2007-06-16 11:42 d——– C:\c59b40c5a94e0667aa6448ccf402
2007-06-16 11:32 49,152 –a—— C:\WINDOWS\nircmd.exe
2007-06-15 13:50 d——– C:\DOCUME~1\Dylan\.housecall6.6
2007-06-10 13:58 d–hs—- C:\WINDOWS\CSC
2007-06-03 21:11 2,560 –a—— C:\WINDOWS\_MSRSTRT.EXE
2007-06-03 15:04 626,688 –a—— C:\WINDOWS\system32\msvcr80.dll
2007-06-03 15:04 499,712 –a—— C:\WINDOWS\system32\msvcp71.dll
2007-06-01 14:21 164 –a—— C:\install.dat
2007-06-01 14:21 d——– C:\Program Files\Webroot
2007-06-01 14:08 221,184 –a—— C:\WINDOWS\system32\wmpns.dll
2007-06-01 14:08 d——– C:\Program Files\Windows Media Connect 2
2007-06-01 14:06 d——– C:\WINDOWS\system32\drivers\UMDF
2007-05-31 15:34 d——– C:\Program Files\MSXML 4.0
2007-05-31 15:14 d——– C:\Program Files\Common Files\Download Manager
2007-05-31 14:44 176,128 –a—— C:\WINDOWS\system32\nvusmb.exe
2007-05-31 14:44 176,128 –a—— C:\WINDOWS\system32\nvunrm.exe
2007-05-31 14:44 176,128 ——— C:\WINDOWS\system32\nvuide.exe
2007-05-31 14:44 101,888 –a—— C:\WINDOWS\system32\drivers\nvtcp.sys
2007-05-29 21:22 d——– C:\Program Files\Microsoft USB Flash Drive Manager
2007-05-29 21:09 d——– C:\TEMP\AT89
2007-05-29 21:09 d——– C:\TEMP
2007-05-29 19:11 d——– C:\WINDOWS\system32\LogFiles
2007-05-29 10:27 d——– C:\WINDOWS\system32\appmgmt
2007-05-29 00:24 d——– C:\DOCUME~1\NETWOR~1\APPLIC~1\SiteAdvisor
2007-05-28 19:34 d——– C:\Program Files\Call of Duty
2007-05-28 19:33 12,160 –a—— C:\WINDOWS\system32\drivers\mouhid.sys
2007-05-28 18:36 94,208 –a—— C:\WINDOWS\system32\PELZOOM.DLL
2007-05-28 18:36 9,600 –a—— C:\WINDOWS\system32\drivers\HIDUSB.SYS
2007-05-28 18:36 77,824 –a—— C:\WINDOWS\system32\PMPoPo.DLL
2007-05-28 18:36 73,728 –a—— C:\WINDOWS\system32\PELHOOKS.DLL
2007-05-28 18:36 650,532 –a—— C:\WINDOWS\system32\HPBDO.DLL
2007-05-28 18:36 65,536 –a—— C:\WINDOWS\system32\PMIBM.DLL
2007-05-28 18:36 57,344 –a—— C:\WINDOWS\system32\ICONSPY.EXE
2007-05-28 18:36 57,344 –a—— C:\WINDOWS\system32\ICO.EXE
2007-05-28 18:36 49,152 –a—— C:\WINDOWS\system32\PELCOMM.DLL
2007-05-28 18:36 471,040 –a—— C:\WINDOWS\system32\NOTIFIER.DLL
2007-05-28 18:36 45,056 –a—— C:\WINDOWS\system32\PELRESS.DLL
2007-05-28 18:36 40,960 –a—— C:\WINDOWS\system32\PMTilt3.DLL
2007-05-28 18:36 40,960 –a—— C:\WINDOWS\system32\PMPOPO2.dll
2007-05-28 18:36 36,864 –a—— C:\WINDOWS\system32\PMUNINNT.EXE
2007-05-28 18:36 348,160 –a—— C:\WINDOWS\system32\MSVCR71.DLL
2007-05-28 18:36 294,912 –a—— C:\WINDOWS\system32\HPWHEEL.DLL
2007-05-28 18:36 241,664 –a—— C:\WINDOWS\system32\PELUTIL.DLL
2007-05-28 18:36 24,576 –a—— C:\WINDOWS\system32\PELSETUP.DLL
2007-05-28 18:36 229,376 –a—— C:\WINDOWS\system32\PMUNINST.EXE
2007-05-28 18:36 215,040 –a—— C:\WINDOWS\system32\HPPPM.DLL
2007-05-28 18:36 16,512 –a—— C:\WINDOWS\system32\drivers\PELMOUSE.SYS
2007-05-28 18:36 159,854 –a—— C:\WINDOWS\system32\PMARIA.DLL
2007-05-28 18:36 147,456 –a—— C:\WINDOWS\system32\PELMICED.EXE
2007-05-28 18:36 13,184 –a—— C:\WINDOWS\system32\drivers\PELUSBlf.SYS
2007-05-28 18:36 126,976 –a—— C:\WINDOWS\system32\PELSCRLL.DLL
2007-05-28 18:36 1,060,864 –a—— C:\WINDOWS\system32\MFC71.DLL
2007-05-28 18:36 d——– C:\WINDOWS\_PrimaxInstallTempDir0
2007-05-28 18:35 d——– C:\Program Files\HP Optical USB Mobile Mouse
2007-05-28 18:21 d——– C:\WINDOWS\system32\URTTEMP
2007-05-28 15:59 82,944 –a—— C:\WINDOWS\system32\drivers\wdmaud.sys
2007-05-28 15:59 6,400 –a—— C:\WINDOWS\system32\drivers\splitter.sys
2007-05-28 15:59 52,864 –a—— C:\WINDOWS\system32\drivers\DMusic.sys
2007-05-28 15:58 7,552 –a—— C:\WINDOWS\system32\drivers\MSKSSRV.sys
2007-05-28 15:58 60,800 –a—— C:\WINDOWS\system32\drivers\sysaudio.sys
2007-05-28 15:58 54,272 –a—— C:\WINDOWS\system32\drivers\swmidi.sys
2007-05-28 15:58 5,376 –a—— C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2007-05-28 15:58 4,992 –a—— C:\WINDOWS\system32\drivers\MSPQM.sys
2007-05-28 15:58 2,944 –a—— C:\WINDOWS\system32\drivers\drmkaud.sys
2007-05-28 15:58 172,416 –a—— C:\WINDOWS\system32\drivers\kmixer.sys
2007-05-28 15:58 142,464 –a—— C:\WINDOWS\system32\drivers\aec.sys
2007-05-28 15:57 60,288 –a—— C:\WINDOWS\system32\drivers\drmk.sys
2007-05-28 15:57 4,096 –a—— C:\WINDOWS\system32\ksuser.dll
2007-05-28 15:57 d——– C:\Program Files\CONEXANT
2007-05-28 15:53 d——– C:\DOCUME~1\LOCALS~1\APPLIC~1\SiteAdvisor
2007-05-28 15:53 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\SiteAdvisor
2007-05-28 15:07 d——– C:\Program Files\iTunes
2007-05-28 15:07 d——– C:\Program Files\iPod
2007-05-28 15:07 d——– C:\DOCUME~1\Dylan\APPLIC~1\Apple Computer
2007-05-28 15:06 d——– C:\Program Files\QuickTime
2007-05-28 15:05 d——– C:\Program Files\Apple Software Update
2007-05-28 15:05 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
2007-05-28 15:01 d——– C:\DOCUME~1\Dylan\Shared
2007-05-28 15:01 d——– C:\DOCUME~1\Dylan\Incomplete
2007-05-28 14:59 d——– C:\DOCUME~1\Dylan\APPLIC~1\LimeWire
2007-05-28 14:58 d——– C:\Program Files\SiteAdvisor
2007-05-28 14:58 d——– C:\DOCUME~1\Dylan\APPLIC~1\SiteAdvisor
2007-05-28 14:57 71,496 –a—— C:\WINDOWS\system32\drivers\mfeavfk.sys
2007-05-28 14:57 37,480 –a—— C:\WINDOWS\system32\drivers\mfesmfk.sys
2007-05-28 14:57 34,184 –a—— C:\WINDOWS\system32\drivers\mfebopk.sys
2007-05-28 14:57 32,008 –a—— C:\WINDOWS\system32\drivers\mferkdk.sys
2007-05-28 14:57 170,408 –a—— C:\WINDOWS\system32\drivers\mfehidk.sys
2007-05-28 14:57 109,608 –a—— C:\WINDOWS\system32\drivers\Mpfp.sys
2007-05-28 14:57 d——– C:\Program Files\LimeWire
2007-05-28 14:56 d——– C:\Program Files\McAfee.com
2007-05-28 14:56 d——– C:\Program Files\McAfee
2007-05-28 14:56 d——– C:\Program Files\Common Files\McAfee
2007-05-28 14:56 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\McAfee
2007-05-28 13:27 d——– C:\Program Files\Windows Defender
2007-05-28 13:26 d——– C:\WINDOWS\network diagnostic


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-05-30 22:47:47 11,973 —-a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-04-25 14:21:15 144,896 —-a-w C:\WINDOWS\system32\schannel.dll
2007-04-18 16:12:23 2,854,400 —-a-w C:\WINDOWS\system32\msi.dll
2007-04-17 05:45:28 92,504 —-a-w C:\WINDOWS\system32\cdm.dll
2007-04-17 05:45:20 43,352 —-a-w C:\WINDOWS\system32\wups2.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{089FD14D-132B-48FC-8861-0048AE113215}=C:\Program Files\SiteAdvisor\6066\SiteAdv.dll [2007-03-30 08:41]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [2007-03-14 03:43]
{7DB2D5A0-7241-4E79-B68D-6309F01C5231}=c:\program files\mcafee\virusscan\scriptcl.dll [2006-12-22 16:02]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nwiz"="nwiz.exe" [2006-09-27 17:10 C:\WINDOWS\system32\nwiz.exe]
"hpWirelessAssistant"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-01-10 15:13]
"QlbCtrl"="C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-11-06 10:58]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-04-27 11:25]
"SiteAdvisor"="C:\Program Files\SiteAdvisor\6066\SiteAdv.exe" [2006-08-10 12:38]
"Mouse Suite 98 Daemon"="ICO.EXE" [2004-07-14 15:36 C:\WINDOWS\system32\ICO.EXE]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-09-27 17:10]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 09:24]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480


Contents of the 'Scheduled Tasks' folder
2007-05-28 22:06:05 C:\WINDOWS\tasks\AppleSoftwareUpdate.job
2007-05-28 21:57:13 C:\WINDOWS\tasks\McDefragTask.job
2007-06-01 08:00:06 C:\WINDOWS\tasks\McQcTask.job
2007-06-18 08:40:46 C:\WINDOWS\tasks\MP Scheduled Scan.job

**************************************************************************

catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-06-18 08:47:49
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-06-18 8:48:42 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-06-18 08:48
C:\ComboFix2.txt … 2007-06-16 11:59

— E O F —



Logfile of HijackThis v1.99.1
Scan saved at 8:53:28 AM, on 6/18/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\SiteAdvisor\6066\SiteAdv.exe
C:\WINDOWS\system32\ICO.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\SiteAdvisor\6066\SAService.exe
C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\HEWLET~1\Shared\HPQTOA~1.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Dylan\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\program files\mcafee\virusscan\scriptcl.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /installquiet /nodetect
O4 - HKLM\..\Run: [hpWirelessAssistant] "C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe"
O4 - HKLM\..\Run: [QlbCtrl] "C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" /Start
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SiteAdvisor] "C:\Program Files\SiteAdvisor\6066\SiteAdv.exe"
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqnbk/downloads/sysinfo.cab
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - http://ipgweb.cce.hp.com/rdqnbk/downloads/msxml4.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: DomainService - Unknown owner - C:\Documents and Settings\Dylan\Application Data\tmpAF.tmp.exe (file missing)
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SiteAdvisor Service - McAfee, Inc. - C:\Program Files\SiteAdvisor\6066\SAService.exe
Post #8
Hi,

I guess you indeed disabled your McAfee previously. How are you supposed to protect your computer if you disable it?
If you have a reason why you are disabling it, let me know..

Anyway, navigate to and delete next files:

C:\WINDOWS\system32\tmp61.tmp.dll
C:\WINDOWS\system32\tmp32.tmp.dll
C:\WINDOWS\system32\tmp2A.tmp.dll

Then, Then, go to start > run and copy and paste next command in the field:

sc delete DomainService

Hit enter.

* Clean your Cache and Cookies in IE:
  • Close all instances of Outlook Express and Internet Explorer
  • Go to Control Panel > Internet Options > General tab
  • Under Browsing History, click "Delete".
  • Click "Delete Files", "Delete cookies" and "Delete history"
  • Click Close below.
* Clean your Cache and Cookies in Firefox (In case you also have Firefox installed):
  • Go to Tools > Options.
  • Click Privacy in the menu..
  • Click the Clear now button below.. A new window will popup what to clear.
  • Select all and click the Clear button again.
  • Click OK to close the Options window
* Clean other Temporary files + Recycle bin
  • Go to start > run and type: cleanmgr and click ok.
  • Let it scan your system for files to remove.
  • Make sure Temporary Files, Temporary Internet Files, and Recycle Bin are the only things checked.
  • Press OK to remove them.
Post a new HijackThislog in your next reply.
Post #9
Due to the lack of feedback, this Topic is closed. If you need this topic reopened for continuations of existing problems, please request this by sending me a PM with the address of the thread. This applies only to the original topic starter. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI