What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Some Info And Latest Hjt Log

18 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Failed uploading to mediafire due to the following: This file could not be processed because it may be infected with a virus or trojan. Please check the file and try uploading it again.
Post #18
i just attempted re-emailing it as well…im using yahoo mail and possibly it is stopping it from sending even though it said it never scanned the file.
Post #19
HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 6:56:46 PM, on 6/28/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16441)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\PROGRA~1\MUSICM~1\MUSICM~3\MMDiag.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mim.exe
C:\Program Files\Creative\Shared Files\CamTray.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\Program Files\Hijackthis\HijackThis.exe

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [PD0630 STISvc] RunDLL32.exe P0630Pin.dll,RunDLL32EP 513
O4 - HKLM\..\Run: [ShowLOMControl] 
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~3\mimboot.exe
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Registry Cleaner] "C:\Program Files\Registry Cleaner Trial\Regclean.exe" -startminimize
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [Creative WebCam Tray] "C:\Program Files\Creative\Shared Files\CamTray.exe"
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
Post #20
Hi much2fast4u,

If it's being detected then the zip file can't be password-protected, that's likely to be the reason it hasn't gone through yet. The Jotti online scanner can handle zipped files so please upload the zip file you have using the previous instructions, then delete it and empty your recycle bin.

We have some more files to delete, please use OTMoveIt again:
Select the contents of the below file list, then press Ctrl+C to copy it to the clipboard
In OTMoveIt, click in the left-hand pane and press Ctrl+V to paste the file-list into the program
Then, press MoveIt!
Copy the Results output and paste it into a new notepad file so you can post it in your next response. Do this by clicking in the right-hand pane, press Ctrl-A then Ctrl-C to select all and copy. Then open Notepad, press Ctrl-V to paste in the text, and save this text file to your desktop.

OTMoveIt file list:
C:\WINDOWS\system32\msorcl32.exe
C:\WINDOWS\system32\tmrsrv32.exe

Then reboot your computer

Next, some uninstalls to consider, please open Start->Control Panel->Add/Remove Programs:

You have a P2P file sharing program called My Kazaa Gold, this program either installs or is bundled with malware according to Bleeping Computer and should be removed - locate My Kazaa Gold on the Add/Remove Programs list and select Remove

You have Viewpoint Media Player installed on your system. This program is not malware but it is foistware in that it is usually installed without the user's knowledge or approval, and for this reason I recommend you remove it. If you actually use this program, I recommend you try using alternatives such as VLC Player or Media Player Classic.
To remove, find Viewpoint Media Player and select Remove

Your Java is outdated and is now a security risk
Find Java 2 Runtime Environment, SE v1.4.2_03 and select Remove
You can download and install the newest version of Java Runtime Environment (JRE), from here:
http://java.sun.com/javase/downloads/index.jsp

You have a program called Registry Cleaner 4.0 installed. This appears to be the rogue program described on this page at Sunbelt. I recommend you remove this program, to do so, find Registry Cleaner 4.0 and select Remove

Next, run Combofix again:
  • Double click combofix.exe and follow the prompts.
  • Note: Do not click ComboFix's window while it's running - it may cause it to stall!
  • When finished, it shall produce a log for you, please post it in your next response.
Then, download Dr.WEB CureIt to your desktop from here:
ftp://ftp.drweb.com/pub/drweb/cureit/cureit.exe
  • Double-click cureit.exe to start the program.
  • Press Start and then OK to start the Express scan
  • The Express scan takes just a few moments to finish, if something is found, click Yes to cure it
  • Once the short scan has finished, Click Options->Change settings
  • Choose the Scan tab and remove the check mark from Heuristic analysis
  • Choose the Actions tab and next to Infected objects select Move, then press OK to close the settings box.
  • Select all hard drives to be scanned by clicking on them - choose all drives - a red dot confirms they will be scanned
  • Click the green arrow on the right to start the scan
  • Click Yes to all if it asks if you want to move a file
  • Click File-> Save report list and save the report to your desktop
  • Close Dr.Web Cureit and reboot your computer (this is important as files may be moved/deleted during reboot)
Once complete, please post the Jotti results, the OtMoveIt log, the ComboFix log, the Dr Web log and a new HijackThis log.
Post #21
i'll go carry out these instructions since the jotti servers are too busy right now to upload. With regards to the zip file, it prompted me twice for a password and i selected the highest level of encryption so i'm pretty sure it is password protected. I named it 607x.zip however so possibly that is a banned filename???
Post #22
move it log 3:

File/Folder c:\windows\systen32\msorc132.exe not found.
File/Folder c:\windows\systen32\tmrsrv32.exe not found.

Created on 06/28/2007 19:54:02


combofixlog2.txt:



"Stephanie Howard" - 2007-06-28 20:10:03 - ComboFix 07-06-27.7 - Service Pack 2 NTFS


((((((((((((((((((((((((( Files Created from 2007-05-28 to 2007-06-29 )))))))))))))))))))))))))))))))


2007-06-28 16:48 49,152 –a—— C:\WINDOWS\nircmd.exe
2007-06-27 20:53 2,384 –a—— C:\WINDOWS\system32\tmp.reg
2007-06-27 20:51 53,248 –a—— C:\WINDOWS\system32\Process.exe
2007-06-27 20:51 51,200 –a—— C:\WINDOWS\system32\dumphive.exe
2007-06-27 20:51 288,417 –a—— C:\WINDOWS\system32\SrchSTS.exe
2007-06-27 20:43 d——– C:\Deckard
2007-06-27 18:40 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\WinZip
2007-06-27 18:22 d——– C:\DOCUME~1\STEPHA~1\APPLIC~1\ACD Systems
2007-06-27 18:18 10,368 –a—— C:\WINDOWS\system32\drivers\pfc.sys
2007-06-27 18:18 d——– C:\Program Files\Common Files\ACD Systems
2007-06-27 18:18 d——– C:\Program Files\ACD Systems
2007-06-27 18:18 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\ACD Systems
2007-06-27 17:33 d——– C:\DOCUME~1\STEPHA~1\APPLIC~1\U3
2007-06-18 18:27 d——– C:\VundoFix Backups
2007-06-16 11:12 d——– C:\Program Files\Eusing Free Registry Cleaner
2007-06-16 02:32 d——– C:\Program Files\RegCleaner
2007-06-16 02:22 d——– C:\Program Files\Registry Clean Expert
2007-06-16 02:10 d——– C:\WINDOWS\pss
2007-06-16 02:08 d——– C:\Program Files\XP Smoker
2007-06-15 22:18 77,312 –a—— C:\WINDOWS\ua2.dll
2007-06-14 21:17 32,418 –a—— C:\WINDOWS\system32\drivers\Partizan.sys
2007-06-14 21:17 22,528 –a—— C:\WINDOWS\system32\Partizan.exe
2007-06-13 18:37 512 –a—— C:\ScanSectorLog.dat
2007-06-13 17:06 d——– C:\DOCUME~1\STEPHA~1\APPLIC~1\MailFrontier
2007-06-13 17:01 27,168 –ahs—- C:\WINDOWS\system32\drivers\fidbox2.dat
2007-06-13 17:01 1,437,216 –ahs—- C:\WINDOWS\system32\drivers\fidbox.dat
2007-06-13 00:34 75,512 –a—— C:\WINDOWS\zllsputility.exe
2007-06-13 00:34 4,212 —h—– C:\WINDOWS\system32\zllictbl.dat
2007-06-13 00:34 11,264 –a—— C:\WINDOWS\system32\SpOrder.dll
2007-06-13 00:33 1,087,216 –a—— C:\WINDOWS\system32\zpeng24.dll
2007-06-13 00:33 d——– C:\WINDOWS\system32\ZoneLabs
2007-06-13 00:15 786,432 –ah—– C:\DOCUME~1\ADMINI~1\NTUSER.DAT
2007-06-13 00:15 d——– C:\DOCUME~1\ADMINI~1\APPLIC~1\Jasc Software Inc
2007-06-12 23:47 d——– C:\WINDOWS\Internet Logs
2007-06-12 23:46 d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-06-12 23:42 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-06-12 23:38 d——– C:\DOCUME~1\STEPHA~1\DoctorWeb


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-06-29 02:02:02 ——– d—–w C:\Program Files\My Kazaa Gold
2007-06-16 08:25:13 ——– d–h–w C:\Program Files\InstallShield Installation Information
2007-06-14 21:59:48 ——– d—–w C:\Program Files\NoAdware4
2007-05-18 07:41:01 17,408 —-a-w C:\WINDOWS\system32\tmrsrv32.exe
2007-05-18 07:39:53 82,439 —-a-w C:\WINDOWS\system32\msorcl32.exe
2007-05-18 07:38:34 10,759 —-a-w C:\WINDOWS\607x.exe
2007-05-07 14:39:34 ——– d—–w C:\DOCUME~1\STEPHA~1\APPLIC~1\Registry Cleaner
2007-04-18 16:12:23 2,854,400 —-a-w C:\WINDOWS\system32\msi.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{02478D38-C3F9-4EFB-9B51-7695ECA05670}=C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [2006-04-17 18:37]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll [2003-11-03 14:17]
{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}=C:\Program Files\Yahoo!\Common\yiesrvc.dll [2006-01-06 11:52]
{5CA3D70E-1895-11CF-8E15-001234567890}=C:\WINDOWS\system32\dla\tfswshx.dll [2004-12-06 01:05]
{9030D464-4C02-4ABF-8ECC-5164760863C6}=C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2006-04-06 23:02]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-03-09 00:02]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-11-29 04:56]
"SigmatelSysTrayApp"="stsystra.exe" [2005-09-09 23:19 C:\WINDOWS\stsystra.exe]
"PD0630 STISvc"="P0630Pin.dll" [2005-06-05 11:01 C:\WINDOWS\system32\P0630Pin.dll]
"ShowLOMControl"="" []
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-02-28 12:19]
"MimBoot"="C:\PROGRA~1\MUSICM~1\MUSICM~3\mimboot.exe" [2006-01-19 10:06]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 16:50]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 16:50]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 16:19]
"DMXLauncher"="C:\Program Files\Dell\Media Experience\DMXLauncher.exe" [2005-01-27 01:02]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:00]
"DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 11:09]
"Creative WebCam Tray"="C:\Program Files\Creative\Shared Files\CamTray.exe" [2005-03-29 00:13]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Usnsvc usnsvc


HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{F146C9B1-VMVQ-A9RC-NUFL-D02300B4E999}
C:\WINDOWS\system32\tmrsrv32.exe

HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}
C:\WINDOWS\system32\msorcl32.exe

**************************************************************************

catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-06-28 20:13:00
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-06-28 20:14:42
C:\ComboFix-quarantined-files.txt … 2007-06-28 20:14
C:\ComboFix2.txt … 2007-06-28 17:31

— E O F —

Dr Web.csv:

tmrsrv32.exe;c:\windows\system32;BackDoor.Generic.1598;Deleted.;
Process.exe;C:\Documents and Settings\Stephanie Howard\Desktop\files_to_fix_pcs\SmitfraudFix;Tool.Prockill;;
restart.exe;C:\Documents and Settings\Stephanie Howard\Desktop\files_to_fix_pcs\SmitfraudFix;Tool.ShutDown.11;;
Current Home Page_HKCU.reg;C:\Documents and Settings\Stephanie Howard\My Documents\RegRun2\back14d_06m_07y_213441;Trojan.StartPage.1505;Moved.;
Current Home Page_HKCU.reg;C:\Documents and Settings\Stephanie Howard\My Documents\RegRun2\back14d_06m_07y_213600;Trojan.StartPage.1505;Moved.;
Current Home Page_HKCU.reg;C:\Documents and Settings\Stephanie Howard\My Documents\RegRun2\back14d_06m_07y_213643;Trojan.StartPage.1505;Moved.;
Current Home Page_HKCU.reg;C:\Documents and Settings\Stephanie Howard\My Documents\RegRun2\back14d_06m_07y_213703;Trojan.StartPage.1505;Moved.;
Current Home Page_HKCU.reg;C:\Documents and Settings\Stephanie Howard\My Documents\RegRun2\back14d_06m_07y_213718;Trojan.StartPage.1505;Moved.;
backup-20070618-182050-699.dll;C:\Program Files\Hijackthis\backups;Trojan.Virtumod;Moved.;
backup-20070618-182540-848.dll;C:\Program Files\Hijackthis\backups;Trojan.Virtumod;Moved.;
backup-20070618-220811-533.dll;C:\Program Files\Hijackthis\backups;Trojan.Virtumod;Moved.;
159x.exe.vir;C:\QooBox\Quarantine\C\WINDOWS;Trojan.DownLoader.22375;Moved.;
zzzx.exe.vir;C:\QooBox\Quarantine\C\WINDOWS;Trojan.DownLoader.22896;Moved.;
perfc000.dat.vir;C:\QooBox\Quarantine\C\WINDOWS\system32;Trojan.Proxy.1800;Moved.;
wmvds32.dll.vir;C:\QooBox\Quarantine\C\WINDOWS\system32;Trojan.DownLoader.23174;Moved.;
Dc1.exe;C:\RECYCLER\S-1-5-21-1399178205-1846775105-1821118613-500;Trojan.Click.1487;Moved.;
Process.exe;C:\SDFix\apps;Tool.Prockill;;
A0006109.exe;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP5;Trojan.DownLoader.20279;Moved.;
A0006110.exe;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP5;Trojan.DownLoader.20279;Moved.;
A0006118.exe;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP5;Trojan.DownLoader.22042;Moved.;
A0006153.dll;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP5;Trojan.DownLoader.23174;Moved.;
A0006154.exe;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP5;Trojan.DownLoader.22375;Moved.;
A0006175.exe;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP5;Trojan.DownLoader.22896;Moved.;
A0006541.exe;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP8;BackDoor.Generic.1598;Moved.;
A0006545.dll;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP8;Trojan.Virtumod;Moved.;
A0006546.dll;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP8;Trojan.Virtumod;Moved.;
A0006547.dll;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP8;Trojan.Virtumod;Moved.;
A0006548.exe;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP8;Trojan.Click.1487;Moved.;
cthpycbu.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Moved.;
ddcyy.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Moved.;
fccayya.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Moved.;
iifdefc.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Moved.;
jkklm.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Moved.;
pmnli.dll.bad;C:\VundoFix Backups;Trojan.Virtumod;Moved.;
607x.exe;C:\WINDOWS;Trojan.DownLoader.21675;Moved.;
Process.exe;C:\WINDOWS\system32;Tool.Prockill;;
tbhelper.dll;C:\WINDOWS\system32\Search\tbu02653;Adware.Softomate;;
wizard.dll;C:\WINDOWS\system32\Search\tbu02653;Adware.Softomate;;
Yazzle1549OinAdmin.exe;C:\_OTMoveIt\MovedFiles\Program Files\Common Files;Adware.ClickSpring;;
141x.exe;C:\_OTMoveIt\MovedFiles\WINDOWS;Trojan.DownLoader.22375;Moved.;
475x.exe;C:\_OTMoveIt\MovedFiles\WINDOWS;Trojan.DownLoader.22376;Moved.;
perfc000.dat;C:\_OTMoveIt\MovedFiles\WINDOWS\system32;Trojan.Proxy.1800;Moved.;


hijackthis3.log:


Logfile of HijackThis v1.99.1
Scan saved at 9:16:09 PM, on 6/28/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16441)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\MUSICM~1\MUSICM~3\MMDiag.exe
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mim.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\Creative\Shared Files\CamTray.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\WINDOWS\explorer.exe
F:\files to fix pcs\cureit.exe
C:\DOCUME~1\STEPHA~1\LOCALS~1\Temp\RarSFX0\_start.exe
C:\DOCUME~1\STEPHA~1\LOCALS~1\Temp\RarSFX0\cureit.exe
C:\Program Files\Hijackthis\HijackThis.exe

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [PD0630 STISvc] RunDLL32.exe P0630Pin.dll,RunDLL32EP 513
O4 - HKLM\..\Run: [ShowLOMControl] 
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~3\mimboot.exe
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [Creative WebCam Tray] "C:\Program Files\Creative\Shared Files\CamTray.exe"
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE



jottilog.txt:


Service load: 0% 100%

File: 607x.zip
Status: POSSIBLY INFECTED/MALWARE (Note: this file was only classified as malware by scanners known to generate more false positives than the average scanner. Do not consider these results definately accurate. Also, because of this, results of this scan will not be recorded in the database.)
MD5: 4d14ceb08b14d5a40cc0965a99fe558c
Packers detected: -
Bit9 reports: File not found

Scanner results
Scan taken on 29 Jun 2007 03:20:37 (GMT)
A-Squared Found nothing
AntiVir Found nothing
ArcaVir Found nothing
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found nothing
Dr.Web Found nothing
F-Prot Antivirus Found suspicious file (encrypted program in archive)
F-Secure Anti-Virus Found nothing
Fortinet Found nothing
Kaspersky Anti-Virus Found nothing
NOD32 Found nothing
Norman Virus Control Found nothing
Panda Antivirus Found nothing
Rising Antivirus Found nothing
VirusBuster Found nothing
VBA32 Found nothing
Post #23
Hi much2fast4u,

Well Dr Web settled the question of 607x.exe by detecting it so you can delete any remaining zip files you have.

The filenames you input into OTMoveIt weren't exactly the same as posted, so the files weren't found. Copying and pasting is the best way; if it's easier, save a copy of these instructions or the file list and transfer it to the other machine.
Please run OTMoveIt and Combofix again as follows:

Open OTMoveIt
Select the contents of the below file list, then press Ctrl+C to copy it to the clipboard
In OTMoveIt, click in the left-hand pane and press Ctrl+V to paste the file-list into the program
Then, press MoveIt!
Copy the Results output and paste it into a new notepad file so you can post it in your next response. Do this by clicking in the right-hand pane, press Ctrl-A then Ctrl-C to select all and copy. Then open Notepad, press Ctrl-V to paste in the text, and save this text file to your desktop.

OTMoveIt file list:
C:\WINDOWS\system32\msorcl32.exe
C:\WINDOWS\system32\tmrsrv32.exe
C:\Documents and Settings\Stephanie Howard\DoctorWeb\Quarantine

Then reboot your computer

Next, run combofix once more:
  • Double click combofix.exe and follow the prompts.
  • Note: Do not click ComboFix's window while it's running - it may cause it to stall!
  • When finished, it shall produce a log for you, please post it in your next response.
Once complete, please post the OTMoveIt log, the ComboFix log and a new HijackThis log.
Post #25
when u said delete 607x.exe….i will delete the zip file I have, should I also be deleting the original file still on the laptop as well or will that be taken care of later?
Post #26
nevermind that last question, i see that it was quarantined by doctorweb which is included in the moveit instructions u posted….
Post #27
moveit log 004.txt

C:\WINDOWS\system32\msorcl32.exe moved successfully.
File/Folder C:\WINDOWS\system32\tmrsrv32.exe not found.
C:\Documents and Settings\Stephanie Howard\DoctorWeb\Quarantine moved successfully.

Created on 06/29/2007 14:21:25

combofixlog3.txt


"Stephanie Howard" - 2007-06-29 14:30:08 - ComboFix 07-06-27.7 - Service Pack 2 NTFS


((((((((((((((((((((((((( Files Created from 2007-05-28 to 2007-06-29 )))))))))))))))))))))))))))))))


2007-06-28 16:48 49,152 –a—— C:\WINDOWS\nircmd.exe
2007-06-27 20:53 2,384 –a—— C:\WINDOWS\system32\tmp.reg
2007-06-27 20:51 53,248 –a—— C:\WINDOWS\system32\Process.exe
2007-06-27 20:51 51,200 –a—— C:\WINDOWS\system32\dumphive.exe
2007-06-27 20:51 288,417 –a—— C:\WINDOWS\system32\SrchSTS.exe
2007-06-27 20:43 d——– C:\Deckard
2007-06-27 18:40 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\WinZip
2007-06-27 18:22 d——– C:\DOCUME~1\STEPHA~1\APPLIC~1\ACD Systems
2007-06-27 18:18 10,368 –a—— C:\WINDOWS\system32\drivers\pfc.sys
2007-06-27 18:18 d——– C:\Program Files\Common Files\ACD Systems
2007-06-27 18:18 d——– C:\Program Files\ACD Systems
2007-06-27 18:18 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\ACD Systems
2007-06-27 17:33 d——– C:\DOCUME~1\STEPHA~1\APPLIC~1\U3
2007-06-18 18:27 d——– C:\VundoFix Backups
2007-06-16 11:12 d——– C:\Program Files\Eusing Free Registry Cleaner
2007-06-16 02:32 d——– C:\Program Files\RegCleaner
2007-06-16 02:22 d——– C:\Program Files\Registry Clean Expert
2007-06-16 02:10 d——– C:\WINDOWS\pss
2007-06-16 02:08 d——– C:\Program Files\XP Smoker
2007-06-15 22:18 77,312 –a—— C:\WINDOWS\ua2.dll
2007-06-14 21:17 32,418 –a—— C:\WINDOWS\system32\drivers\Partizan.sys
2007-06-14 21:17 22,528 –a—— C:\WINDOWS\system32\Partizan.exe
2007-06-13 18:37 512 –a—— C:\ScanSectorLog.dat
2007-06-13 17:06 d——– C:\DOCUME~1\STEPHA~1\APPLIC~1\MailFrontier
2007-06-13 17:01 30,496 –ahs—- C:\WINDOWS\system32\drivers\fidbox2.dat
2007-06-13 17:01 1,596,704 –ahs—- C:\WINDOWS\system32\drivers\fidbox.dat
2007-06-13 00:34 75,512 –a—— C:\WINDOWS\zllsputility.exe
2007-06-13 00:34 4,212 —h—– C:\WINDOWS\system32\zllictbl.dat
2007-06-13 00:34 11,264 –a—— C:\WINDOWS\system32\SpOrder.dll
2007-06-13 00:33 1,087,216 –a—— C:\WINDOWS\system32\zpeng24.dll
2007-06-13 00:33 d——– C:\WINDOWS\system32\ZoneLabs
2007-06-13 00:15 786,432 –ah—– C:\DOCUME~1\ADMINI~1\NTUSER.DAT
2007-06-13 00:15 d——– C:\DOCUME~1\ADMINI~1\APPLIC~1\Jasc Software Inc
2007-06-12 23:47 d——– C:\WINDOWS\Internet Logs
2007-06-12 23:46 d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-06-12 23:42 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-06-12 23:38 d——– C:\DOCUME~1\STEPHA~1\DoctorWeb


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-06-29 02:02:02 ——– d—–w C:\Program Files\My Kazaa Gold
2007-06-16 08:25:13 ——– d–h–w C:\Program Files\InstallShield Installation Information
2007-06-14 21:59:48 ——– d—–w C:\Program Files\NoAdware4
2007-05-07 14:39:34 ——– d—–w C:\DOCUME~1\STEPHA~1\APPLIC~1\Registry Cleaner
2007-04-18 16:12:23 2,854,400 —-a-w C:\WINDOWS\system32\msi.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{02478D38-C3F9-4EFB-9B51-7695ECA05670}=C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [2006-04-17 18:37]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll [2003-11-03 14:17]
{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}=C:\Program Files\Yahoo!\Common\yiesrvc.dll [2006-01-06 11:52]
{5CA3D70E-1895-11CF-8E15-001234567890}=C:\WINDOWS\system32\dla\tfswshx.dll [2004-12-06 01:05]
{9030D464-4C02-4ABF-8ECC-5164760863C6}=C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2006-04-06 23:02]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-03-09 00:02]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-11-29 04:56]
"SigmatelSysTrayApp"="stsystra.exe" [2005-09-09 23:19 C:\WINDOWS\stsystra.exe]
"PD0630 STISvc"="P0630Pin.dll" [2005-06-05 11:01 C:\WINDOWS\system32\P0630Pin.dll]
"ShowLOMControl"="" []
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-02-28 12:19]
"MimBoot"="C:\PROGRA~1\MUSICM~1\MUSICM~3\mimboot.exe" [2006-01-19 10:06]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 16:50]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 16:50]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 16:19]
"DMXLauncher"="C:\Program Files\Dell\Media Experience\DMXLauncher.exe" [2005-01-27 01:02]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:00]
"DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 11:09]
"Creative WebCam Tray"="C:\Program Files\Creative\Shared Files\CamTray.exe" [2005-03-29 00:13]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Usnsvc usnsvc


HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{F146C9B1-VMVQ-A9RC-NUFL-D02300B4E999}
C:\WINDOWS\system32\tmrsrv32.exe

HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}
C:\WINDOWS\system32\msorcl32.exe

**************************************************************************

catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-06-29 14:33:01
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-06-29 14:34:23
C:\ComboFix-quarantined-files.txt … 2007-06-29 14:34
C:\ComboFix2.txt … 2007-06-28 20:14
C:\ComboFix3.txt … 2007-06-28 17:31

— E O F —

hijackthis log4.txt

Logfile of HijackThis v1.99.1
Scan saved at 2:38:03 PM, on 6/29/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16441)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\Creative\Shared Files\CamTray.exe
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mim.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\MMDiag.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Hijackthis\HijackThis.exe

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [PD0630 STISvc] RunDLL32.exe P0630Pin.dll,RunDLL32EP 513
O4 - HKLM\..\Run: [ShowLOMControl] 
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~3\mimboot.exe
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [Creative WebCam Tray] "C:\Program Files\Creative\Shared Files\CamTray.exe"
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
Post #28
Hi much2fast4u,

Great, things are looking a lot better, we're almost there :)

Backup Your Registry with ERUNT:
  • Download erunt.zip to your Desktop from here:
    http://aumha.org/downloads/erunt.zip
  • Right-click erunt.zip, select Extract All… and follow the prompts to extract ERUNT to a new folder on your Desktop
  • Inside the new folder, double-click ERUNT.exe to start the program
  • OK all the prompts to back up your registry to the default location.
Note: to restore your registry, go to the backup folder and start ERDNT.exe

Then, open Notepad (press Start->Run, enter notepad and press OK)
Copy everything inside the code box below (Starting with REGEDIT4) and paste it into a new notepad file.
Change the Save As Type to All Files and save it as fix.reg to your Desktop.

Note: Please copy and paste all the text at once, and check that there is NO blank line above REGEDIT4 and one blank line at the bottom.
REGEDIT4

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\\Documents and Settings\\Stephanie Howard\\Application Data\\Microsoft\\Installer\\{21329DB6-ACC2-48AC-BE6E-BDDBCEB667D7}\\MyGoldKazaa.exe1_21329DB6ACC248ACBE6EBDDBCEB667D7.exe"=-
"C:\\Documents and Settings\\Stephanie Howard\\Application Data\\Microsoft\\Installer\\{21329DB6-ACC2-48AC-BE6E-BDDBCEB667D7}\\MyGoldKazaa.exe_21329DB6ACC248ACBE6EBDDBCEB667D7.exe"=-
"C:\\Program Files\\My Kazaa Gold\\giFT\\giFTl.exe"=-

[-HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce\ApprovedByRegRun2\AntiRepl]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{C26450C4-10DE-4DA1-9593-230AD4DB491D}"=-

[-HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{F146C9B1-VMVQ-A9RC-NUFL-D02300B4E999}]

[-HKEY_CLASSES_ROOT\CLSID\{F146C9B1-VMVQ-A9RC-NUFL-D02300B4E999}]

[-HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}]

[-HKEY_CLASSES_ROOT\CLSID\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}]
Locate fix.reg on your Desktop, if you did it right it should look like this:[external image: Posted Image]
Double-click it, when it asks if you want to merge with the registry, click Yes.

Next please run Dr Web once more:
  • Double-click cureit.exe to start the program.
  • Press Start and then OK to start the Express scan
  • The Express scan takes just a few moments to finish, if something is found, click Yes to cure it
  • Once the short scan has finished, Click Options->Change settings
  • Choose the Scan tab and remove the check mark from Heuristic analysis
  • Choose the Actions tab and next to Infected objects select Move, then press OK to close the settings box.
  • Select all hard drives to be scanned by clicking on them - choose all drives - a red dot confirms they will be scanned
  • Click the green arrow on the right to start the scan
  • Click Yes to all if it asks if you want to move a file
  • Click File-> Save report list and save the report to your desktop
  • Close Dr.Web Cureit and reboot your computer (this is important as files may be moved/deleted during reboot)
Then please download F-Secure Blacklight
  • Click I ACCEPT and download the graphical user interface version to your Desktop
  • Double click the file to run it, choose I accept the agreement then press Scan
  • It will create the fsbl-xxxxxxx.log on your desktop.
  • The log will have a list of all items found.
  • Do not choose to rename any yet! I want to see the log first because legitimate items can also be present.
  • Exit Blacklight and post the contents of the log in your next reply.
Once complete, please post the Dr Web log and the Blacklight log along with a new HijackThis log
Post #29
hey Silver,

here's all the latest requested logs…

DrWeb2:

Process.exe;C:\Documents and Settings\Stephanie Howard\Desktop\files_to_fix_pcs\SmitfraudFix;Tool.Prockill;;
restart.exe;C:\Documents and Settings\Stephanie Howard\Desktop\files_to_fix_pcs\SmitfraudFix;Tool.ShutDown.11;;
Process.exe;C:\SDFix\apps;Tool.Prockill;;
A0006550.exe;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP8;Trojan.DownLoader.21675;Moved.;
A0006552.exe;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP8;Trojan.DownLoader.22375;Moved.;
A0006553.exe;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP8;Trojan.DownLoader.22376;Moved.;
Process.exe;C:\WINDOWS\system32;Tool.Prockill;;
tbhelper.dll;C:\WINDOWS\system32\Search\tbu02653;Adware.Softomate;;
wizard.dll;C:\WINDOWS\system32\Search\tbu02653;Adware.Softomate;;
141x.exe;C:\_OTMoveIt\MovedFiles\Documents and Settings\Stephanie Howard\DoctorWeb\Quarantine;Trojan.DownLoader.22375;Moved.;
159x.exe.vir;C:\_OTMoveIt\MovedFiles\Documents and Settings\Stephanie Howard\DoctorWeb\Quarantine;Trojan.DownLoader.22375;Moved.;
475x.exe;C:\_OTMoveIt\MovedFiles\Documents and Settings\Stephanie Howard\DoctorWeb\Quarantine;Trojan.DownLoader.22376;Moved.;
607x.exe;C:\_OTMoveIt\MovedFiles\Documents and Settings\Stephanie Howard\DoctorWeb\Quarantine;Trojan.DownLoader.21675;Moved.;
A0006109.exe;C:\_OTMoveIt\MovedFiles\Documents and Settings\Stephanie Howard\DoctorWeb\Quarantine;Trojan.DownLoader.20279;Moved.;
A0006110.exe;C:\_OTMoveIt\MovedFiles\Documents and Settings\Stephanie Howard\DoctorWeb\Quarantine;Trojan.DownLoader.20279;Moved.;
A0006118.exe;C:\_OTMoveIt\MovedFiles\Documents and Settings\Stephanie Howard\DoctorWeb\Quarantine;Trojan.DownLoader.22042;Moved.;
A0006153.dll;C:\_OTMoveIt\MovedFiles\Documents and Settings\Stephanie Howard\DoctorWeb\Quarantine;Trojan.DownLoader.23174;Moved.;
A0006154.exe;C:\_OTMoveIt\MovedFiles\Documents and Settings\Stephanie Howard\DoctorWeb\Quarantine;Trojan.DownLoader.22375;Moved.;
A0006175.exe;C:\_OTMoveIt\MovedFiles\Documents and Settings\Stephanie Howard\DoctorWeb\Quarantine;Trojan.DownLoader.22896;Moved.;
A0006541.exe;C:\_OTMoveIt\MovedFiles\Documents and Settings\Stephanie Howard\DoctorWeb\Quarantine;BackDoor.Generic.1598;Moved.;
A0006545.dll;C:\_OTMoveIt\MovedFiles\Documents and Settings\Stephanie Howard\DoctorWeb\Quarantine;Trojan.Virtumod;Moved.;
A0006546.dll;C:\_OTMoveIt\MovedFiles\Documents and Settings\Stephanie Howard\DoctorWeb\Quarantine;Trojan.Virtumod;Moved.;
A0006547.dll;C:\_OTMoveIt\MovedFiles\Documents and Settings\Stephanie Howard\DoctorWeb\Quarantine;Trojan.Virtumod;Moved.;
A0006548.exe;C:\_OTMoveIt\MovedFiles\Documents and Settings\Stephanie Howard\DoctorWeb\Quarantine;Trojan.Click.1487;Moved.;
backup-20070618-182050-699.dll;C:\_OTMoveIt\MovedFiles\Documents and Settings\Stephanie Howard\DoctorWeb\Quarantine;Trojan.Virtumod;Moved.;
backup-20070618-182540-848.dll;C:\_OTMoveIt\MovedFiles\Documents and Settings\Stephanie Howard\DoctorWeb\Quarantine;Trojan.Virtumod;Moved.;
backup-20070618-220811-533.dll;C:\_OTMoveIt\MovedFiles\Documents and Settings\Stephanie Howard\DoctorWeb\Quarantine;Trojan.Virtumod;Moved.;
cthpycbu.dll.bad;C:\_OTMoveIt\MovedFiles\Documents and Settings\Stephanie Howard\DoctorWeb\Quarantine;Trojan.Virtumod;Moved.;
Current Home Page_HKC0.reg;C:\_OTMoveIt\MovedFiles\Documents and Settings\Stephanie Howard\DoctorWeb\Quarantine;Trojan.StartPage.1505;Moved.;
Current Home Page_HKC1.reg;C:\_OTMoveIt\MovedFiles\Documents and Settings\Stephanie Howard\DoctorWeb\Quarantine;Trojan.StartPage.1505;Moved.;
Current Home Page_HKC2.reg;C:\_OTMoveIt\MovedFiles\Documents and Settings\Stephanie Howard\DoctorWeb\Quarantine;Trojan.StartPage.1505;Moved.;
Current Home Page_HKC3.reg;C:\_OTMoveIt\MovedFiles\Documents and Settings\Stephanie Howard\DoctorWeb\Quarantine;Trojan.StartPage.1505;Moved.;
Current Home Page_HKCU.reg;C:\_OTMoveIt\MovedFiles\Documents and Settings\Stephanie Howard\DoctorWeb\Quarantine;Trojan.StartPage.1505;Moved.;
Dc1.exe;C:\_OTMoveIt\MovedFiles\Documents and Settings\Stephanie Howard\DoctorWeb\Quarantine;Trojan.Click.1487;Moved.;
ddcyy.dll.bad;C:\_OTMoveIt\MovedFiles\Documents and Settings\Stephanie Howard\DoctorWeb\Quarantine;Trojan.Virtumod;Moved.;
fccayya.dll.bad;C:\_OTMoveIt\MovedFiles\Documents and Settings\Stephanie Howard\DoctorWeb\Quarantine;Trojan.Virtumod;Moved.;
iifdefc.dll.bad;C:\_OTMoveIt\MovedFiles\Documents and Settings\Stephanie Howard\DoctorWeb\Quarantine;Trojan.Virtumod;Moved.;
jkklm.dll.bad;C:\_OTMoveIt\MovedFiles\Documents and Settings\Stephanie Howard\DoctorWeb\Quarantine;Trojan.Virtumod;Moved.;
perfc000.dat;C:\_OTMoveIt\MovedFiles\Documents and Settings\Stephanie Howard\DoctorWeb\Quarantine;Trojan.Proxy.1800;Moved.;
perfc000.dat.vir;C:\_OTMoveIt\MovedFiles\Documents and Settings\Stephanie Howard\DoctorWeb\Quarantine;Trojan.Proxy.1800;Moved.;
pmnli.dll.bad;C:\_OTMoveIt\MovedFiles\Documents and Settings\Stephanie Howard\DoctorWeb\Quarantine;Trojan.Virtumod;Moved.;
wmvds32.dll.vir;C:\_OTMoveIt\MovedFiles\Documents and Settings\Stephanie Howard\DoctorWeb\Quarantine;Trojan.DownLoader.23174;Moved.;
zzzx.exe.vir;C:\_OTMoveIt\MovedFiles\Documents and Settings\Stephanie Howard\DoctorWeb\Quarantine;Trojan.DownLoader.22896;Moved.;
Yazzle1549OinAdmin.exe;C:\_OTMoveIt\MovedFiles\Program Files\Common Files;Adware.ClickSpring;;


Blacklight Log

07/01/07 15:58:32 [Info]: BlackLight Engine 1.0.64 initialized
07/01/07 15:58:32 [Info]: OS: 5.1 build 2600 (Service Pack 2)
07/01/07 15:58:32 [Note]: 7019 4
07/01/07 15:58:32 [Note]: 7005 0
07/01/07 15:58:51 [Note]: 7006 0
07/01/07 15:58:51 [Note]: 7011 1316
07/01/07 15:58:52 [Note]: 7026 0
07/01/07 15:58:53 [Note]: 7026 0
07/01/07 15:58:56 [Note]: FSRAW library version 1.7.1022
07/01/07 16:04:08 [Note]: 2000 1012
07/01/07 16:04:08 [Note]: 2000 1012
07/01/07 16:04:08 [Note]: 2000 1012
07/01/07 16:04:08 [Note]: 2000 1012
07/01/07 16:04:08 [Note]: 2000 1012
07/01/07 16:04:08 [Note]: 2000 1012
07/01/07 16:04:08 [Note]: 2000 1012
07/01/07 16:04:08 [Note]: 2000 1012
07/01/07 16:04:08 [Note]: 2000 1012
07/01/07 16:04:08 [Note]: 2000 1012
07/01/07 16:04:08 [Note]: 2000 1012
07/01/07 16:04:08 [Note]: 2000 1012
07/01/07 16:04:08 [Note]: 2000 1012
07/01/07 16:08:51 [Note]: 7007 0


Hijackthis5.log

Logfile of HijackThis v1.99.1
Scan saved at 4:11:42 PM, on 7/1/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16441)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\PROGRA~1\MUSICM~1\MUSICM~3\MMDiag.exe
C:\Program Files\Creative\Shared Files\CamTray.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mim.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\Program Files\Hijackthis\HijackThis.exe

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [PD0630 STISvc] RunDLL32.exe P0630Pin.dll,RunDLL32EP 513
O4 - HKLM\..\Run: [ShowLOMControl] 
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~3\mimboot.exe
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [Creative WebCam Tray] "C:\Program Files\Creative\Shared Files\CamTray.exe"
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
Post #30
Hi much2fast4u,

Looks good, just some tidying up to do:

Clean up with OTMoveIt:

First, re-move the Dr Web quarantine folder:

Double-click OTMoveIt.exe to start the program
Copy/paste this path into the left-hand pane:
C:\Documents and Settings\Stephanie Howard\DoctorWeb\Quarantine
Then, press MoveIt!
Once it has been successfully moved, press the CleanUp! button
Say Yes to the prompt and then allow the program to reboot your computer.

You can also delete fix.reg and cureit.exe from your Desktop

Re-hide hidden/system files and folders:
Click Start -> My Computer
Select the Tools menu, click Folder Options and select the View tab
Under the Hidden files and folders heading SELECT Do not show hidden files and folders
CHECK the Hide extensions for known file types option
CHECK the Hide protected operating system files (recommended) option
Press OK

Create a new, clean System Restore point which you can use in case of future system problems:
Press Start->All Programs->Accessories->System Tools->System Restore
Select Create a restore point, then Next, type a name like clean then press the Create button and once it's done press Close

Now remove old, infected System Restore points:
Next click Start->Run and type cleanmgr in the box and press OK
Ensure the boxes for Temporary Files and Temporary Internet Files are checked, you can choose to check other boxes if you wish but they are not required.
Select the More Options tab, under System Restore press Clean up… and say Yes to the prompt
Press OK and Yes to confirm

At this stage I think your machine is clean :) here are some tips to help you keep it that way:

Operating system vulnerabilities can easily be exploited by malware so please ensure your operating system is automatically kept up to date by using Windows Update:
Go to Start->Control Panel->Automatic Updates
Select Automatic and select a suitable schedule
Also, check that your antivirus and antispyware programs are set to automatically update daily.

You have good protection programs installed, however I recommend you install specialist antispyware software with real-time capabilities - this means it protects you from system changes and spyware while you are working, not just removing malware after it has been installed. There are a range of paid-for and free packages available, a free one I can recommend is Windows Defender, available here:
http://www.microsoft.com/athome/security/s…re/default.mspx

Spywareblaster is a free program which prevents the download and installation of Internet Explorer ActiveX based malware by immunizing your system against it. You can download Spywareblaster from here and a tutorial to help you get started is available here.

Consider a custom hosts file such as MVPS HOSTS. This custom hosts file effectively blocks a wide range of unwanted ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers.
For information on how to download and install, please read this tutorial by WinHelp2002
If you install this, be sure to follow the DNS Client service instructions before doing so.

Please take care when downloading programs. One of the easiest ways to be infected is to download freeware/shareware programs which come laden with malware. Before downloading, it is crucial to check whether the source is reputable.
One way to check is to use McAfee SiteAdvisor. Copy the domain name into the space provided and SiteAdvisor will give you a report on the website which can help you decide if it is safe. They also have a toolbar for IE and Firefox which adds this functionality to your browser.

Find out more about how to prevent infection in the future
http://forum.malwareremoval.com/viewtopic.php?p=33687

Please post back to let me know that you have read this, and if there are any further issues.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI