Spyware / Malware / Virus Removal

My Negligent Sister's Computer. Hijacked Desktop

6 min read

Looking for the outcome? Ask AI

agentjk Topic Starter

Post #1July 6, 2007, 6:47 AM UTC

This looks just like a number of computers I've seen w/ hijacked desktops. Windows Active Desktop Recovery on desktop. Two suspicious anti-virus progs that she says she didn't download, "SystemDoctor" and "WinAntiVirus Pro". Like to know what I should do to clean this up. Thanks

Logfile of HijackThis v1.99.1
Scan saved at 1:42:46 AM, on 7/6/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\Erin\My Documents\WG111CFG.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\PccGuide.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft Money\System\urlmap.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Roadrunner
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,omepppe.exe
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 3.0\aoltb.dll
O4 - HKLM\..\Run: [WindowsService] rundll32.exe "C:\WINDOWS\system32\uyrafgbu.dll",realset
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Smart Wizard Wireless Settings.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 3.0\resources\en-US\local\search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 3.0\aoltb.dll
O9 - Extra button: (no name) - {4ABF810A-F11D-4169-9D5F-7D274F2270A1} - (no file)
O9 - Extra 'Tools' menuitem: Java - {4ABF810A-F11D-4169-9D5F-7D274F2270A1} - (no file)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\BPGame.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (file missing) (HKCU)
O16 - DPF: Yahoo! Blackjack - http://download.games.yahoo.com/games/clients/y/jt0_x.cab
O16 - DPF: {09F1ADAC-76D8-4D0F-99A5-5C907DADB988} - http://winantivirus.com/download/2007/down…9CE5C5_acab3879 2C7A8CD078FA427FBF86AE333A20DC52&lng=en&cnt=us
O16 - DPF: {15B782AF-55D8-11D1-B477-006097098764} (Macromedia Authorware Web Player Control) - http://www.phgenit.com/plugin/awarewebplay…cab/awswaxf.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1148281183136
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

Markka

Post #2July 6, 2007, 9:51 AM UTC

Hi and welcome to the forums.

I'm Markka and I will be helping you with your malware issues. I'll check your HijackThis log. Right now I'm MRU Undergrad, everything that I post to you must be checked by teachers of Malware Removal University. Please be patient.

Markka

Post #3July 6, 2007, 1:07 PM UTC

Hello

Rename HijackThis.exe to Scanner.exe by doing the following;

Navigate to here; C:\Program Files\Hijackthis
Right-click on the HijackThis.exe
Choose from the pull-down menu; "Rename"
And now Rename HijackThis.exe to Scanner.exe
When you're renamed HijackThis, then open it..
Take a fresh HijackThis log (Do a system scan and save a log file)
Post the fresh HijackThis log to here.

agentjk

Post #4July 6, 2007, 5:56 PM UTC

Scanner.exe Run Log:

Logfile of HijackThis v1.99.1
Scan saved at 12:52:52 PM, on 7/6/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Erin\My Documents\WG111CFG.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\PccGuide.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Hijackthis\Scanner.exe.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Roadrunner
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,omepppe.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: CIEIntegrator Object - {2178F3FB-2560-458F-BDEE-631E2FE0DFE4} - C:\Program Files\WinAntiVirus Pro 2007\winpgi.dll
O2 - BHO: (no name) - {55DB983C-BDBF-426f-86F0-187B02DDA39B} - C:\WINDOWS\system32\vnxxcqil.dll
O2 - BHO: (no name) - {5ADF3862-9E2E-4ad3-86F7-4510E6550CD0} - C:\WINDOWS\system32\hibkfmbn.dll
O2 - BHO: ElnkScamBHO Class - {66252F33-BE30-4188-9199-63F2AC8BA137} - C:\Program Files\EarthLink TotalAccess\EScamBlk.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 3.0\aoltb.dll
O2 - BHO: IEFW Object - {B5141620-C2B2-4D95-9F0F-134D99C87AB0} - C:\Program Files\WinAntiVirus Pro 2007\IEFWBHO.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 3.0\aoltb.dll
O4 - HKLM\..\Run: [WindowsService] rundll32.exe "C:\WINDOWS\system32\uyrafgbu.dll",realset
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Smart Wizard Wireless Settings.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 3.0\resources\en-US\local\search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 3.0\aoltb.dll
O9 - Extra button: (no name) - {4ABF810A-F11D-4169-9D5F-7D274F2270A1} - (no file)
O9 - Extra 'Tools' menuitem: Java - {4ABF810A-F11D-4169-9D5F-7D274F2270A1} - (no file)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\BPGame.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (file missing) (HKCU)
O16 - DPF: Yahoo! Blackjack - http://download.games.yahoo.com/games/clients/y/jt0_x.cab
O16 - DPF: {09F1ADAC-76D8-4D0F-99A5-5C907DADB988} - http://winantivirus.com/download/2007/down…9CE5C5_acab3879 2C7A8CD078FA427FBF86AE333A20DC52&lng=en&cnt=us
O16 - DPF: {15B782AF-55D8-11D1-B477-006097098764} (Macromedia Authorware Web Player Control) - http://www.phgenit.com/plugin/awarewebplay…cab/awswaxf.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1148281183136
O16 - DPF: {B64F4A7C-97C9-11DA-8BDE-F66BAD1E3F3A} - http://www.winantivirus.com/download/2007/…F86AE333A20DC52
O20 - Winlogon Notify: runpc - C:\WINDOWS\TWAIN_32\runpc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

Markka

Post #5July 8, 2007, 6:34 AM UTC

Hello

Please download VundoFix.exe to your desktop.

Double-click VundoFix.exe to run it.
Click the Scan for Vundo button.
Once it's done scanning, click the Remove Vundo button.
You will receive a prompt asking if you want to remove the files, click YES
Once you click yes, your desktop will go blank as it starts removing Vundo.
When completed, it will prompt that it will reboot your computer, click OK.

Note: It is possible that VundoFix encountered a file it could not remove.
In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot.
_______________________________

1. Download this file - combofix.exe
2. Double click combofix.exe & follow the prompts.
3. When finished, it shall produce a log for you. Post that log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall!
_____________________________________

Post:
- A fresh HijackThis log
- Contents of C:\vundofix.txt
- Contents of C:\ComboFix.txt

agentjk

Post #6July 8, 2007, 7:28 PM UTC

Fresh Hijackthis Log:

Logfile of HijackThis v1.99.1
Scan saved at 2:23:25 PM, on 7/8/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\TRENDM~1\INTERN~2\PccGuide.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Erin\My Documents\WG111CFG.exe
C:\Program Files\Microsoft Money\System\urlmap.exe
C:\Program Files\Hijackthis\Scanner.exe.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: ElnkScamBHO Class - {66252F33-BE30-4188-9199-63F2AC8BA137} - C:\Program Files\EarthLink TotalAccess\EScamBlk.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 3.0\aoltb.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 3.0\aoltb.dll
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Smart Wizard Wireless Settings.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 3.0\resources\en-US\local\search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 3.0\aoltb.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\BPGame.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (file missing) (HKCU)
O16 - DPF: Yahoo! Blackjack - http://download.games.yahoo.com/games/clients/y/jt0_x.cab
O16 - DPF: {15B782AF-55D8-11D1-B477-006097098764} (Macromedia Authorware Web Player Control) - http://www.phgenit.com/plugin/awarewebplay…cab/awswaxf.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1148281183136
O16 - DPF: {B64F4A7C-97C9-11DA-8BDE-F66BAD1E3F3A} - http://www.winantivirus.com/download/2007/…F86AE333A20DC52
O20 - Winlogon Notify: runpc - C:\WINDOWS\TWAIN_32\runpc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

VundoFix Log:

VundoFix V6.5.4

Checking Java version…

Java version is 1.5.0.3
Old versions of java are exploitable and should be removed.

Scan started at 1:34:48 PM 7/8/2007

Listing files found while scanning….

C:\WINDOWS\system32\hibkfmbn.dll
C:\WINDOWS\system32\kpivlegk.dll
C:\WINDOWS\system32\ubgfaryu.ini
C:\WINDOWS\system32\uyrafgbu.dll
C:\WINDOWS\system32\vnxxcqil.dll

Beginning removal…

Attempting to delete C:\WINDOWS\system32\hibkfmbn.dll
C:\WINDOWS\system32\hibkfmbn.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\kpivlegk.dll
C:\WINDOWS\system32\kpivlegk.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\ubgfaryu.ini
C:\WINDOWS\system32\ubgfaryu.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\uyrafgbu.dll
C:\WINDOWS\system32\uyrafgbu.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\vnxxcqil.dll
C:\WINDOWS\system32\vnxxcqil.dll Has been deleted!

Performing Repairs to the registry.
Done!

Combofix Log:
"Erin" - 2007-07-08 13:58:55 - ComboFix 07-07-07.3 - Service Pack 2

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\defender21.exe
C:\DOCUME~1\ALLUSE~1\APPLIC~1\SystemDoctor
C:\DOCUME~1\ALLUSE~1\APPLIC~1\SystemDoctor Free
C:\DOCUME~1\ALLUSE~1\APPLIC~1\SystemDoctor Free\Data\Abbr
C:\DOCUME~1\ALLUSE~1\APPLIC~1\SystemDoctor Free\Data\ActivationCode
C:\DOCUME~1\ALLUSE~1\APPLIC~1\SystemDoctor Free\Data\HOURS
C:\DOCUME~1\ALLUSE~1\APPLIC~1\SystemDoctor Free\Data\ProductCode
C:\DOCUME~1\ALLUSE~1\APPLIC~1\SystemDoctor\Data\Abbr
C:\DOCUME~1\ALLUSE~1\APPLIC~1\SystemDoctor\Data\ActivationCode
C:\DOCUME~1\ALLUSE~1\APPLIC~1\SystemDoctor\Data\cid
C:\DOCUME~1\ALLUSE~1\APPLIC~1\SystemDoctor\Data\CustomerEmail
C:\DOCUME~1\ALLUSE~1\APPLIC~1\SystemDoctor\Data\CustomerName
C:\DOCUME~1\ALLUSE~1\APPLIC~1\SystemDoctor\Data\CustomerPassword
C:\DOCUME~1\ALLUSE~1\APPLIC~1\SystemDoctor\Data\NeededACRetransfer
C:\DOCUME~1\ALLUSE~1\APPLIC~1\SystemDoctor\Data\OID
C:\DOCUME~1\ALLUSE~1\APPLIC~1\SystemDoctor\Data\PCID
C:\DOCUME~1\ALLUSE~1\APPLIC~1\SystemDoctor\Data\ProductCode
C:\DOCUME~1\ALLUSE~1\APPLIC~1\SystemDoctor\Data\Suspicious
C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\SystemDoctor
C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\SystemDoctor\Feedback on Support Quality.lnk
C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\SystemDoctor\Report Software Defect.lnk
C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\SystemDoctor\Request for Instructions.lnk
C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\SystemDoctor\Share Your Suggestions.lnk
C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\SystemDoctor\SystemDoctor Manual.lnk
C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\SystemDoctor\SystemDoctor on the Web.lnk
C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\SystemDoctor\SystemDoctor.lnk
C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\SystemDoctor\Uninstall SystemDoctor.lnk
C:\DOCUME~1\Erin\APPLIC~1.\wnsxs~1
C:\DOCUME~1\Erin\APPLIC~1\SystemDoctor
C:\DOCUME~1\Erin\APPLIC~1\SystemDoctor Free
C:\DOCUME~1\Erin\APPLIC~1\SystemDoctor Free\Logs\update.log
C:\DOCUME~1\Erin\APPLIC~1\SystemDoctor\activator_info.txt
C:\DOCUME~1\Erin\APPLIC~1\SystemDoctor\Logs\Activate.log
C:\DOCUME~1\Erin\APPLIC~1\SystemDoctor\Logs\update.log
C:\DOCUME~1\Erin\MYDOCU~1.\crosof~1
C:\DOCUME~1\Erin\MYDOCU~1.\crosof~1\n?lookup.exe
C:\DOCUME~1\Erin\MYDOCU~1.\mbols~1
C:\DOCUME~1\Erin\MYDOCU~1.\ymbols~1
C:\Documents and Settings\Erin.\err.log
C:\Documents and Settings\Erin.\ResErrors.log
C:\keyboard21.exe
C:\newname21.exe
C:\Program Files\Common Files\companion wizard
C:\Program Files\Common Files\companion wizard\CompWiz.xml
C:\Program Files\Common Files\winantivirus pro 2007
C:\Program Files\Common Files\winantivirus pro 2007\atl71.dll
C:\Program Files\Common Files\winantivirus pro 2007\err.log
C:\Program Files\Common Files\winantivirus pro 2007\mav_startupmon.exe
C:\Program Files\Common Files\winantivirus pro 2007\mfc71.dll
C:\Program Files\Common Files\winantivirus pro 2007\msvcp71.dll
C:\Program Files\Common Files\winantivirus pro 2007\msvcr71.dll
C:\Program Files\Common Files\winantivirus pro 2007\SpOrder.dll
C:\Program Files\Common Files\winantivirus pro 2007\uwa7pcw.exe
C:\Program Files\Common Files\winantivirus pro 2007\wa7pinst.exe
C:\Program Files\Common Files\winantivirus pro 2007\WAPChk.dll
C:\Program Files\winantivirus pro 2007
C:\Program Files\winantivirus pro 2007\Activate.dat
C:\Program Files\winantivirus pro 2007\asmngr.dll
C:\Program Files\winantivirus pro 2007\ASupdater.dat
C:\Program Files\winantivirus pro 2007\atl71.dll
C:\Program Files\winantivirus pro 2007\AVupd.exe
C:\Program Files\winantivirus pro 2007\AWBase\database\enemies.dat
C:\Program Files\winantivirus pro 2007\AWBase\vbpv.dat
C:\Program Files\winantivirus pro 2007\BkSites.dat
C:\Program Files\winantivirus pro 2007\bnlink.dat
C:\Program Files\winantivirus pro 2007\bpupdater.dat
C:\Program Files\winantivirus pro 2007\CompWiz.exe
C:\Program Files\winantivirus pro 2007\CompWiz.xml
C:\Program Files\winantivirus pro 2007\fat.exe
C:\Program Files\winantivirus pro 2007\fopn.exe
C:\Program Files\winantivirus pro 2007\fopn.sys
C:\Program Files\winantivirus pro 2007\fopnl.dll
C:\Program Files\winantivirus pro 2007\forum.dat
C:\Program Files\winantivirus pro 2007\FWSettings.bin
C:\Program Files\winantivirus pro 2007\IEFWBHO.dll
C:\Program Files\winantivirus pro 2007\IH.exe
C:\Program Files\winantivirus pro 2007\integrity.dat
C:\Program Files\winantivirus pro 2007\kb.url
C:\Program Files\winantivirus pro 2007\lapv.dat
C:\Program Files\winantivirus pro 2007\License.rtf
C:\Program Files\winantivirus pro 2007\mfc71.dll
C:\Program Files\winantivirus pro 2007\msvcp71.dll
C:\Program Files\winantivirus pro 2007\msvcr71.dll
C:\Program Files\winantivirus pro 2007\msxml3.dll
C:\Program Files\winantivirus pro 2007\msxml3a.dll
C:\Program Files\winantivirus pro 2007\msxml3r.dll
C:\Program Files\winantivirus pro 2007\Online.url
C:\Program Files\winantivirus pro 2007\PGBase\vbpv.dat
C:\Program Files\winantivirus pro 2007\PGE.dat
C:\Program Files\winantivirus pro 2007\PGupdater.dat
C:\Program Files\winantivirus pro 2007\plugins\BORLNDMM.DLL
C:\Program Files\winantivirus pro 2007\plugins\SCANADWR.DLL
C:\Program Files\winantivirus pro 2007\plugins\SCANBCDR.DLL
C:\Program Files\winantivirus pro 2007\plugins\SCANDLDR.DLL
C:\Program Files\winantivirus pro 2007\plugins\SCANDOS1.DLL
C:\Program Files\winantivirus pro 2007\plugins\SCANEMUL.DLL
C:\Program Files\winantivirus pro 2007\plugins\SCANFUNC.DLL
C:\Program Files\winantivirus pro 2007\plugins\SCANKRNL.DLL
C:\Program Files\winantivirus pro 2007\plugins\SCANMCR1.DLL
C:\Program Files\winantivirus pro 2007\plugins\SCANOTHR.DLL
C:\Program Files\winantivirus pro 2007\plugins\SCANSCR.DLL
C:\Program Files\winantivirus pro 2007\plugins\SCANTOOL.DLL
C:\Program Files\winantivirus pro 2007\plugins\SCANTROJ.DLL
C:\Program Files\winantivirus pro 2007\plugins\SCANWIN1.DLL
C:\Program Files\winantivirus pro 2007\plugins\UNACPU.DLL
C:\Program Files\winantivirus pro 2007\plugins\UNADBX.DLL
C:\Program Files\winantivirus pro 2007\plugins\unamscan.dll
C:\Program Files\winantivirus pro 2007\plugins\UNMIME.DLL
C:\Program Files\winantivirus pro 2007\plugins\UNPACK.DLL
C:\Program Files\winantivirus pro 2007\plugins\UNPACKS.DLL
C:\Program Files\winantivirus pro 2007\plugins\UNPACKS2.DLL
C:\Program Files\winantivirus pro 2007\plugins\UNPEPACK.DLL
C:\Program Files\winantivirus pro 2007\plugins\UpDate\UA27601.DLL
C:\Program Files\winantivirus pro 2007\plugins\UpDate\UA27602.DLL
C:\Program Files\winantivirus pro 2007\plugins\UpDate\UADAILY.DLL
C:\Program Files\winantivirus pro 2007\plugins\vbpv.dat
C:\Program Files\winantivirus pro 2007\pv.dat
C:\Program Files\winantivirus pro 2007\pv.exe
C:\Program Files\winantivirus pro 2007\rbho.dat
C:\Program Files\winantivirus pro 2007\reform.exe
C:\Program Files\winantivirus pro 2007\res\cross.gif
C:\Program Files\winantivirus pro 2007\res\wa7p.gif
C:\Program Files\winantivirus pro 2007\ResErrors.log
C:\Program Files\winantivirus pro 2007\Restart.exe
C:\Program Files\winantivirus pro 2007\rpt.dll
C:\Program Files\winantivirus pro 2007\scnkrnl.dll
C:\Program Files\winantivirus pro 2007\Settings.ini
C:\Program Files\winantivirus pro 2007\SpOrder.dll
C:\Program Files\winantivirus pro 2007\sqlite3.dll
C:\Program Files\winantivirus pro 2007\st.dat
C:\Program Files\winantivirus pro 2007\Support.url
C:\Program Files\winantivirus pro 2007\UBUpdater.dat
C:\Program Files\winantivirus pro 2007\unins000.dat
C:\Program Files\winantivirus pro 2007\unins000.exe
C:\Program Files\winantivirus pro 2007\uninstall.ico
C:\Program Files\winantivirus pro 2007\up.dat
C:\Program Files\winantivirus pro 2007\updater.dat
C:\Program Files\winantivirus pro 2007\WAV6COM.dll
C:\Program Files\winantivirus pro 2007\WinAV.exe
C:\Program Files\winantivirus pro 2007\WinAV.xml
C:\Program Files\winantivirus pro 2007\winpgi.dll
C:\Program Files\winantivirus pro 2007\worldmap.swf
C:\UWA7P
C:\w.exe
C:\WINDOWS\DOWNLO~1\UWA7P_0001_N91M0809NetInstaller.exe
C:\WINDOWS\DOWNLO~1\UWAS6_0001_N68M2301NetInstaller.exe
C:\WINDOWS\keyboard51.dat
C:\WINDOWS\system32\drivers\fopn.sys
C:\WINDOWS\system32\stera.exe
C:\WINDOWS\system32\wcptr.exe
C:\WINDOWS\winsysupd71.dat

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

——-\LEGACY_MSDIRECTX

((((((((((((((((((((((((( Files Created from 2007-06-08 to 2007-07-08 )))))))))))))))))))))))))))))))

2007-07-08 13:57 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-07-08 13:34 108,544 –a—— C:\VundoFix.exe
2007-07-08 13:34 1,118,993 –a—— C:\ComboFix.exe
2007-07-08 13:34 d——– C:\VundoFix Backups
2007-06-24 20:27 125,716 –a—— C:\WINDOWS\SYSTEM32\oghrdwaq.dll

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-06 06:09:23 ——– d—–w C:\Program Files\Plaxo
2007-06-25 01:28:47 ——– d—–w C:\DOCUME~1\Erin\APPLIC~1\WinAntiVirus Pro 2007
2007-05-23 08:15:09 50,452 —-a-w C:\WINDOWS\system32\sbggfqpu.dll
2007-05-19 23:26:23 50,964 —-a-w C:\WINDOWS\system32\xdgavkny.dll
2007-05-16 15:12:02 683,520 —-a-w C:\WINDOWS\system32\inetcomm.dll
2007-05-10 15:56:35 50,452 —-a-w C:\WINDOWS\system32\lhixlcrh.dll
2007-05-09 09:08:54 ——– d—–w C:\Program Files\SystemDoctor
2007-05-07 14:54:37 125,716 —-a-w C:\WINDOWS\system32\gnqltqnc.dll
2007-05-05 18:18:28 43,796 —-a-w C:\WINDOWS\system32\wnxkirxj.dll
2007-04-25 14:21:15 144,896 —-a-w C:\WINDOWS\system32\schannel.dll
2007-04-18 16:12:23 2,854,400 —-a-w C:\WINDOWS\system32\msi.dll
2007-04-17 03:47:36 33,624 —-a-w C:\WINDOWS\system32\wups.dll
2007-04-17 03:45:54 1,710,936 —-a-w C:\WINDOWS\system32\wuaueng.dll
2007-04-17 03:45:48 549,720 —-a-w C:\WINDOWS\system32\wuapi.dll
2007-04-17 03:45:42 325,976 —-a-w C:\WINDOWS\system32\wucltui.dll
2007-04-17 03:45:36 203,096 —-a-w C:\WINDOWS\system32\wuweb.dll
2007-04-17 03:45:28 92,504 —-a-w C:\WINDOWS\system32\cdm.dll
2007-04-17 03:45:20 53,080 —-a-w C:\WINDOWS\system32\wuauclt.exe
2007-04-17 03:45:20 43,352 —-a-w C:\WINDOWS\system32\wups2.dll
2007-04-17 03:44:20 271,224 —-a-w C:\WINDOWS\system32\mucltui.dll
2007-04-17 03:44:18 208,248 —-a-w C:\WINDOWS\system32\muweb.dll
2005-07-29 22:24:26 472 –sha-r C:\WINDOWS\RXJpbiBLYXBuZXI\lrLDv21Msr1RtrK.vbs

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2004-12-14 01:56 63136 –a—— C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{66252F33-BE30-4188-9199-63F2AC8BA137}]
2004-10-19 13:30 173136 –a—— C:\Program Files\EarthLink TotalAccess\EScamBlk.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7C554162-8CB7-45A4-B8F4-8EA1C75885F9}]
2005-11-30 13:17 585728 –a—— C:\Program Files\AOL\AOL Toolbar 3.0\aoltb.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FDD3B846-8D59-4ffb-8758-209B6AD74ACC}]
2001-07-25 10:00 143420 –a—— C:\Program Files\Microsoft Money\System\mnyviewer.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-12 08:18]

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
Source= C:\WINDOWS\system32\ad.html
FriendlyName=

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\runpc]
C:\WINDOWS\TWAIN_32\runpc.dll

SafeBoot registry key needs repairs. This machine cannot enter Safe Mode.
~~\SafeBoot\Minimal\dmserver

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 8.0 Tray Icon.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\America Online 8.0 Tray Icon.lnk
backup=C:\WINDOWS\pss\America Online 8.0 Tray Icon.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AOL Companion.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\AOL Companion.lnk
backup=C:\WINDOWS\pss\AOL Companion.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^gpril.exe]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\gpril.exe
backup=C:\WINDOWS\pss\gpril.exeCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^LimeWire 4.0.4.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\LimeWire 4.0.4.lnk
backup=C:\WINDOWS\pss\LimeWire 4.0.4.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^MyWebSearch Email Plugin.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\MyWebSearch Email Plugin.lnk
backup=C:\WINDOWS\pss\MyWebSearch Email Plugin.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Smart Wizard Wireless Settings.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Smart Wizard Wireless Settings.lnk
backup=C:\WINDOWS\pss\Smart Wizard Wireless Settings.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Erin^Start Menu^Programs^Startup^BitTorrent.lnk]
path=C:\Documents and Settings\Erin\Start Menu\Programs\Startup\BitTorrent.lnk
backup=C:\WINDOWS\pss\BitTorrent.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Erin^Start Menu^Programs^Startup^Medic.lnk]
path=C:\Documents and Settings\Erin\Start Menu\Programs\Startup\Medic.lnk
backup=C:\WINDOWS\pss\Medic.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Erin^Start Menu^Programs^Startup^Webshots.lnk]
path=C:\Documents and Settings\Erin\Start Menu\Programs\Startup\Webshots.lnk
backup=C:\WINDOWS\pss\Webshots.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AIM]
C:\Program Files\AIM\aim.exe -cnetwait.odl

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
"C:\Program Files\Common Files\AOL\Launch\AOLLaunch.exe" /d locale=en-US ee://aol/imApp

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCMSMMSG]
BCMSMMSG.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DW4]
"C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Erse]
"C:\DOCUME~1\Erin\MYDOCU~1\YMBOLS~1\smss.exe" -vt yazr

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
C:\Program Files\Common Files\AOL\1129248799\ee\AOLSoftware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InternetShield]
C:\PROGRA~1\INTERN~3\InternetShield.exe -CheckStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\jvrag]
C:\WINDOWS\system32\nighfj.exe reg_run

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\jxwxjaj]
c:\windows\system32\jxwxjaj.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark X1100 Series]
"C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\makyfh]
C:\WINDOWS\system32\nighfj.exe reg_run

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mav_startupmon]
"C:\Program Files\Common Files\WinAntiVirus Pro 2007\mav_startupmon.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MoneyAgent]
"C:\Program Files\Microsoft Money\System\Money Express.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NoAdware]
"C:\Program Files\NoAdware\NoAdware.exe" /s

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\pccguide.exe]
"C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PlaxoUpdate]
C:\Program Files\Plaxo\2.6.2.9\PlaxoHelper.exe -a

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Salestart]
"C:\Program Files\Common Files\SystemDoctor\dcpasmon.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SDR6cw]
C:\Program Files\Common Files\SystemDoctor\SDR6cw.exe -c

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\STOPzilla]
C:\Program Files\STOPzilla!\STOPzilla.exe /autostart

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\strtas]
l074.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SurfSideKick 3]
C:\Program Files\SurfSideKick 3\Ssk.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SystemDoctor]
C:\Program Files\SystemDoctor\main.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UserFaultCheck]
%systemroot%\system32\dumprep 0 -u

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uwa7pcw]
"C:\Program Files\Common Files\WinAntiVirus Pro 2007\uwa7pcw.exe" -c

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\w0010a8a.dll]
RUNDLL32.EXE w0010a8a.dll,I2 0000321e00010a8a

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\w00130ee.dll]
RUNDLL32.EXE w00130ee.dll,I2 0000321e000130ee

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\w0013b6e.dll]
RUNDLL32.EXE w0013b6e.dll,I2 0000321e00013b6e

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\w0016dd8.dll]
RUNDLL32.EXE w0016dd8.dll,I2 0000321e00016dd8

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\w0018ebe.dll]
RUNDLL32.EXE w0018ebe.dll,I2 0000321e00018ebe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\w0025058.dll]
RUNDLL32.EXE w0025058.dll,I2 0000321e00025058

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\w00719cf.dll]
RUNDLL32.EXE w00719cf.dll,I2 0000321e000719cf

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\w009f83f.dll]
RUNDLL32.EXE w009f83f.dll,I2 0000321e0009f83f

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\w0118c4f.dll]
RUNDLL32.EXE w0118c4f.dll,I2 0000321e00118c4f

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\w0127111.dll]
RUNDLL32.EXE w0127111.dll,I2 0000321e00127111

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\w04d7e12.dll]
RUNDLL32.EXE w04d7e12.dll,I2 0000321e004d7e12

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\w0aca0ee.dll]
RUNDLL32.EXE w0aca0ee.dll,I2 0000321e00aca0ee

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\w14eee5e.dll]
RUNDLL32.EXE w14eee5e.dll,I2 0000321e014eee5e

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\w5207e2b.dll]
RUNDLL32.EXE w5207e2b.dll,I2 0000321e05207e2b

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\w530596f.dll]
RUNDLL32.EXE w530596f.dll,I2 0000321e0530596f

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Weather]
C:\PROGRA~1\AWS\WEATHE~1\Weather.exe 1

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinAntiVirus Pro 2007]
C:\Program Files\WinAntiVirus Pro 2007\WinAv.exe /min

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\windowsx]
C:\WINDOWS\system32\vo.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Winzip Archiver]
Winzip32.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\xkjfnsuA]
C:\WINDOWS\xkjfnsuA.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\zango]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zguo]
C:\Documents and Settings\Erin\My Documents\??crosoft\n?lookup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e8557ec6-d6de-11db-aeec-00038a000015}]
AutoRun\command- F:\setupSNK.exe

*Newly Created Service* - SHAREDACCESS

Contents of the 'Scheduled Tasks' folder
2007-06-05 07:07:03 C:\WINDOWS\tasks\MP Scheduled Scan.job

**************************************************************************

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-08 14:11:25
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-08 14:15:29 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-07-08 14:15

— E O F —

Markka

Post #7July 10, 2007, 6:18 AM UTC

Hello

Please download AVG Anti-Spyware to your Desktop or to your usual Download Folder.
http://www.ewido.net/en/download/

Install AVG Anti-Spyware by double clicking the installer.
Follow the prompts. Make sure that Launch AVG Anti-Spyware is checked.
On the main screen under Your Computer's security.
- Click on Change state next to Resident shield. It should now change to inactive.
- Click on Change state next to Automatic updates. It should now change to inactive.
- Next to Last Update, click on Update now. (You will need an active internet connection to perform this)
- Wait until you see the Update succesfull message.
Right-click the AVG Anti-Spyware Tray Icon and uncheck Start with Windows.
Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.

If you are having problems with the updater, you can use this link to manually update ewido.
AVG Anti-Spyware manual updates.
Download the Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that AVG Anti-Spyware is closed before installing the update.
_______________________________________________

Open HijackThis, Click Do a system scan only, checkmark these. Then close all other windows except HijackThis and press fix checked.

O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (file missing) (HKCU)
O20 - Winlogon Notify: runpc - C:\WINDOWS\TWAIN_32\runpc.dll
_________________________________________

Go HERE and download the SafeBoot Repair tool by sUBs

Save it to your Desktop. Double click to run the tool
A log shall be produced at C:\SafeBoot_Repair.txt. Please post that in your next reply.
_________________________________________

First we'll need to backup registry:

Start -> Run -> regedit -> ok. Then File -> Export. Give it a name and press Save.

Save text below as fix.reg on Notepad (save it as all files (*.*)) on Desktop

REGEDIT4

[-HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000000 

[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\runpc]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^gpril.exe]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^MyWebSearch Email Plugin.lnk]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Erse]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\jvrag]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\jxwxjaj]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\makyfh]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mav_startupmon]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\strtas]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SurfSideKick 3]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uwa7pcw]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinAntiVirus Pro 2007]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\windowsx]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\xkjfnsuA]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\zango]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zguo]

It should look like this -> [external image: Posted Image]

Doubleclick fix.reg, press Yes and ok.

(In case you are unsure how to create a reg file, take a look here with screenshots.)
_____________________________

Make your hidden files visible:

Click start
Click my computer
Select the Tools menu and click Folder Options.
After the new window appears select the View tab.
Put a checkmark in the checkbox labeled Display the contents of system folders.
Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.
Remove the checkmark from the checkbox labeled Hide file extensions for known file types.
Remove the checkmark from the checkbox labeled Hide protected operating system files.
Press the Apply button and then the OK button and shutdown My Computer.

_________________________________
Please download ATF-cleaner and save it to your desktop.

Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

If you use Firefox browser:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.

_____________________________________
Please then reboot your computer in Safe Mode by doing the following:

Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, the Advanced Options Menu should appear;
Select the first option, to run Windows in Safe Mode, then press Enter.
Choose your usual account.

____________________________________

Delete these files:
C:\WINDOWS\TWAIN_32\runpc.dll
C:\WINDOWS\SYSTEM32\oghrdwaq.dll
C:\WINDOWS\system32\sbggfqpu.dll
C:\WINDOWS\system32\xdgavkny.dll
C:\WINDOWS\system32\lhixlcrh.dll
C:\WINDOWS\system32\gnqltqnc.dll
C:\WINDOWS\system32\wnxkirxj.dll
C:\WINDOWS\pss\gpril.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\gpril.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\MyWebSearch Email Plugin.lnk
C:\WINDOWS\pss\MyWebSearch Email Plugin.lnk
C:\WINDOWS\system32\nighfj.exe
C:\windows\system32\jxwxjaj.exe
C:\WINDOWS\system32\vo.exe
C:\WINDOWS\xkjfnsuA.exe

Delete these folders:
C:\WINDOWS\RXJpbiBLYXBuZXI
__________________________________________

Use the Windows "search" tool
Start->Search
-> All files and folders
Click More advanced options

Checkmark these options:
"Search system folders"
"Search hidden files and folders"
"Search subfolders"

->Search for this and delete if found: l074.exe
_____________________________________
Close ALL open Windows / Programs / Folders. Please start AVG Anti-Spyware and run a full scan.

Click on Scanner on the toolbar.
Click on the Settings tab.
- Under How to act?
  - Click on Recommended Action and choose Quarantine from the popup menu.
- Under How to scan?
  - All checkboxes should be ticked.
- Under Possibly unwanted software:
  - All checkboxes should be ticked.
- Under Reports:
  - Select Automatically generate report after every scan and uncheck Only if threats were found.
- Under What to scan?
  - Select Scan every file.
Click on the Scan tab.
Click on Complete System Scan to start the scan process.
Let the program scan the machine.
When the scan has finished, follow the instructions below.
IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button.
- Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
- At the bottom of the window click on the Apply all Actions button. (3)
  [external image: Posted Image]
When done, click the Save Scan Report button. (4)
- Click the Save Report as button.
- Save the report to your Desktop.
Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.

Reboot in Normal Mode.
__________________________________

Post:
- A fresh HijackThis log
- AVG Anti-Spyware's report
- Contents of C:\SafeBoot_Repair.txt

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

My Negligent Sister's Computer. Hijacked Desktop

✨ Ask AI

Ask AI