Spyware / Malware / Virus Removal

[Resolved]Quicktime Eater

50 min read

Looking for the outcome? Ask AI

RCDM

Post #16July 31, 2007, 4:34 PM UTC

Ok done. I was not able to select the "Opera" task.

Logfile of HijackThis v1.99.1
Scan saved at 10:29:33 AM, on 7/31/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WFXSVC.EXE
C:\Program Files\WinFax\WFXMOD32.EXE
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Ebates__MoeMoney__Maker\ebatesmmmv.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Microsoft Encarta\Encarta Premium 2006\EDICT.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Ebates__MoeMoney__Maker\eb.exe
C:\Program Files\IncrediMail\bin\IncMail.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Ryan\Desktop\HIJACK\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mytelus.com/new_homepage/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mytelus.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Encarta Web Companion Helper Object - {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - C:\Program Files\Common Files\Microsoft Shared\Encarta Web Companion\ENCWCBAR.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Encarta Web Companion - {147D6308-0614-4112-89B1-31402F9B82C4} - C:\Program Files\Common Files\Microsoft Shared\Encarta Web Companion\ENCWCBAR.DLL
O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: (no name) - {EA5A82FB-D6BE-44F9-9363-B1ABABC153C1} - (no file)
O4 - HKLM\..\Run: [ebmmm] "C:\Program Files\Ebates__MoeMoney__Maker\ebatesmmmv.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [MalwareBot] C:\Program Files\MalwareBot\MalwareBot.exe -boot
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [E06ADXRC_1596765] "C:\Program Files\Microsoft Encarta\Encarta Premium 2006\EDICT.EXE" -m
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AROReminder] C:\Program Files\Advanced Registry Optimizer\ARO.exe -rem
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Ebates - file://C:\Documents and Settings\Ryan\Application Data\Ebates__MoeMoney__Maker\ebmmt\ebmmC5.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Ebates - {F2B441CC-E026-47fb-BDC3-A07750FA3D2C} - file://C:\Documents and Settings\Ryan\Application Data\Ebates__MoeMoney__Maker\ebmmt\ebmmC5.htm (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - https://mail.sperd.ca/iNotes6W.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O20 - Winlogon Notify: pptp32 - C:\WINDOWS\SYSTEM32\pptp32.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: WinFax PRO (wfxsvc) - Symantec Corporation - C:\WINDOWS\System32\WFXSVC.EXE
O23 - Service: WINLOAD - Unknown owner - c:\windows\system32\dllcache\win32\winlogon.exe
O23 - Service: WINSVCMGR - Unknown owner - c:\windows\system32\dllcache\win32\winlogon.exe

Scotty

Post #17July 31, 2007, 4:44 PM UTC last edited July 31, 2007, 4:46 PM UTC

Hi RCDM

Option 2 autofix

Open this folder program files > haxfix and double click on fix.bat (or double click on fix.bat desktop icon)
Close all other open windows since this step requires a reboot
Select option 2. Run auto fix by typing 2 and then pressing Enter

If an infection is found, you'll get a message to close all other open windows.

Close all open windows except the red dos window from haxfix and then press Enter
The computer will reboot
After reboot a logfile will open > (c:\haxfix.txt)
Post the contents of that logfile along with a new HijackThis log.

RCDM

Post #18July 31, 2007, 7:54 PM UTC

HAXFIX logfile - by Marckie

version 4.48
Tue 07/31/2007 13:21:41.35

— Auto Haxdoorfix —

searching for files:

searching for services….
service pptp32 found
[SWSC] DeleteService SUCCESS
service pptp64 found
[SWSC] DeleteService SUCCESS

— Goldunfix —

searching for files:

checking iexplore.exe
iexplore.exe is not infected

searching for SSODLkeys:
no SSODLkeys found

searching for notifykeys:
no notifykeys found

searching for services:
no services found

…..rebooting the computer…..

searching for ssodlkeys

not needed

searching for notifykeys

notifykey pptp32 not found

searching for services

service pptp32 not found
service pptp64 not found

searching for safeboot services

safeboot service pptp32.sys not found
safeboot service pptp64.sys not found

searching for files

pptp32.dll exists
deleting pptp32.dll
pptp32.dll has been deleted

pptp32.sys exists
deleting pptp32.sys
pptp32.sys has been deleted

pptp64.sys exists
deleting pptp64.sys
pptp64.sys has been deleted

checking for other files

klgcptini.dat exists
deleting klgcptini.dat
klgcptini.dat has been deleted

qz.dll exists
deleting qz.dll
qz.dll has been deleted

stt82.ini exists
deleting stt82.ini
stt82.ini has been deleted

checking for a3d files

ps.a3d
deleting a3d files
a3d files are deleted

— Catchme logfile - thank you Gmer —

catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-31 13:24:29
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden services …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

Finished

Logfile of HijackThis v1.99.1
Scan saved at 1:50:49 PM, on 7/31/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WFXSVC.EXE
C:\Program Files\WinFax\WFXMOD32.EXE
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Ebates__MoeMoney__Maker\ebatesmmmv.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Microsoft Encarta\Encarta Premium 2006\EDICT.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Ebates__MoeMoney__Maker\eb.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Ryan\Desktop\HIJACK\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mytelus.com/new_homepage/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mytelus.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Encarta Web Companion Helper Object - {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - C:\Program Files\Common Files\Microsoft Shared\Encarta Web Companion\ENCWCBAR.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Encarta Web Companion - {147D6308-0614-4112-89B1-31402F9B82C4} - C:\Program Files\Common Files\Microsoft Shared\Encarta Web Companion\ENCWCBAR.DLL
O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: (no name) - {EA5A82FB-D6BE-44F9-9363-B1ABABC153C1} - (no file)
O4 - HKLM\..\Run: [ebmmm] "C:\Program Files\Ebates__MoeMoney__Maker\ebatesmmmv.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [MalwareBot] C:\Program Files\MalwareBot\MalwareBot.exe -boot
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [E06ADXRC_1596765] "C:\Program Files\Microsoft Encarta\Encarta Premium 2006\EDICT.EXE" -m
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AROReminder] C:\Program Files\Advanced Registry Optimizer\ARO.exe -rem
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Ebates - file://C:\Documents and Settings\Ryan\Application Data\Ebates__MoeMoney__Maker\ebmmt\ebmmC5.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Ebates - {F2B441CC-E026-47fb-BDC3-A07750FA3D2C} - file://C:\Documents and Settings\Ryan\Application Data\Ebates__MoeMoney__Maker\ebmmt\ebmmC5.htm (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - https://mail.sperd.ca/iNotes6W.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: WinFax PRO (wfxsvc) - Symantec Corporation - C:\WINDOWS\System32\WFXSVC.EXE
O23 - Service: WINLOAD - Unknown owner - c:\windows\system32\dllcache\win32\winlogon.exe
O23 - Service: WINSVCMGR - Unknown owner - c:\windows\system32\dllcache\win32\winlogon.exe

Scotty

Post #19July 31, 2007, 10:10 PM UTC

Hello RCDM

This is quite an infected log, but we will get there in the end.

Download SDFix and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer in Safe Mode by doing the following :

Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, the Advanced Options Menu should appear;
Select the first option, to run Windows in Safe Mode, then press Enter.
Choose your usual account.

Open the extracted SDFix folder and double click RunThis.bat to start the script.
Type Y to begin the cleanup process.
It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
Press any Key and it will restart the PC.
When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
(Report.txt will also be copied to Clipboard ready for posting back on the forum).
Finally paste the contents of the Report.txt back in your next reply.

Before running the next tool, disconnect from the Internet, and disable your anti-virus, and any real-time anti-spy monitors. It would be best if you copy the instructions to notepad or write them down, so you dont forget.

Download and Run ComboFix

Download this file from below:

Here
Then double click combofix.exe & follow the prompts.
When finished, it shall produce a log for you. Post that log in your next reply with a new HijackThis log.

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Post back with the reports from SDFix and Combofix and the new HijackThis log, which must be run in that order.

Remember to re-enable your anti-virus and anti-spyware scanners, before reconnecting to the Internet

RCDM

Post #20July 31, 2007, 11:47 PM UTC

SDFix: Version 1.94

Run by [removed] on Tue 07/31/2007 at 05:21 PM

Microsoft Windows XP [Version 5.1.2600]

Running From: C:\DOCUME~1\Ryan\Desktop\HIJACK\SDFix

Safe Mode:
Checking Services:

Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting…

Normal Mode:
Checking Files:

Trojan Files Found:

C:\WINDOWS\system32\dllcache\win32\1.txt - Deleted
C:\WINDOWS\system32\dllcache\win32\cygcrypt-0.dll - Deleted
C:\WINDOWS\system32\dllcache\win32\cygwin1.dll - Deleted
C:\WINDOWS\system32\dllcache\win32\hide.EXE - Deleted
C:\WINDOWS\system32\dllcache\win32\hide.RB0 - Deleted
C:\WINDOWS\system32\dllcache\win32\libeay32.dll - Deleted
C:\WINDOWS\system32\dllcache\win32\pshut.bat - Deleted
C:\WINDOWS\system32\dllcache\win32\run.bat - Deleted
C:\WINDOWS\system32\dllcache\win32\servudaemon.ini - Deleted
C:\WINDOWS\system32\dllcache\win32\ServUStartUpLog.txt - Deleted
C:\WINDOWS\system32\dllcache\win32\ssleay32.dll - Deleted
C:\WINDOWS\system32\dllcache\win32\TzoLibr.dll - Deleted
C:\WINDOWS\system32\dllcache\win32\welcome.txt - Deleted
C:\WINDOWS\system32\dllcache\win32\winlogon.exe - Deleted
C:\WINDOWS\system32\dllcache\win32\xdcc.config - Deleted

Folder C:\WINDOWS\system32\dllcache\win32 - Removed

Removing Temp Files…

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.

Final Check:

Remaining Services:
——————

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Grisoft\\AVG Free\\avgw.exe"="C:\\Program Files\\Grisoft\\AVG Free\\avgw.exe:*:Enabled:AVG Free Edition for Windows"
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"="C:\\Program Files\\Grisoft\\AVG7\\avginet.exe:*:Enabled:avginet.exe"
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe:*:Enabled:avgamsvr.exe"
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe:*:Enabled:avgcc.exe"
"C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe:*:Enabled:avgemc.exe"
"C:\\Program Files\\uTorrent\\utorrent.exe"="C:\\Program Files\\uTorrent\\utorrent.exe:*:Enabled:æTorrent"
"C:\\Program Files\\NoAdware5.0\\NoAdware5.exe"="C:\\Program Files\\NoAdware5.0\\NoAdware5.exe:*:Enabled:NoAdware "
"C:\\Program Files\\Azureus\\Azureus.exe"="C:\\Program Files\\Azureus\\Azureus.exe:*:Disabled:Azureus"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

Remaining Files:
—————

Backups Folder: - C:\DOCUME~1\Ryan\Desktop\HIJACK\SDFix\backups\backups.zip

Files with Hidden Attributes:

C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp
C:\Documents and Settings\Ryan\My Documents\~WRL0001.tmp
C:\Documents and Settings\Ryan\My Documents\~WRL3332.tmp
C:\Documents and Settings\Ryan\My Documents\Corinne school\School 05-06\LA 9\Poetry\~WRL0746.tmp
C:\Documents and Settings\Ryan\My Documents\Corinne school\School 05-06\LA 9\Poetry\~WRL2069.tmp
C:\Documents and Settings\Ryan\My Documents\Corinne school\School 05-06\LA 9\Poetry\~WRL2766.tmp
C:\Documents and Settings\Ryan\My Documents\Corinne school\School 05-06\LA 9\Poetry\~WRL3242.tmp
C:\Documents and Settings\Ryan\My Documents\Corinne school\School 05-06\LA 9\Poetry\~WRL3292.tmp
C:\Documents and Settings\Ryan\My Documents\Corinne school\School 05-06\LA 9\Poetry\~WRL3904.tmp
C:\Documents and Settings\Ryan\My Documents\Corinne school\School 05-06\LA 9\Short Stories\~WRL0869.tmp
C:\Documents and Settings\Ryan\My Documents\Corinne school\School 05-06\LA 9\Short Stories\~WRL1514.tmp
C:\Documents and Settings\Ryan\My Documents\Corinne school\School 05-06\LA 9\Short Stories\~WRL1657.tmp
C:\Documents and Settings\Ryan\My Documents\Corinne school\School 05-06\LA 9\Short Stories\~WRL1803.tmp
C:\Documents and Settings\Ryan\My Documents\Corinne school\School 05-06\LA 9\Short Stories\~WRL1938.tmp
C:\Documents and Settings\Ryan\My Documents\Corinne school\School 05-06\LA 9\Short Stories\~WRL1955.tmp
C:\Documents and Settings\Ryan\My Documents\Corinne school\School 05-06\LA 9\Short Stories\~WRL2316.tmp
C:\Documents and Settings\Ryan\My Documents\Corinne school\School 05-06\LA 9\Short Stories\~WRL3164.tmp
C:\Documents and Settings\Ryan\My Documents\Corinne school\School 05-06\LA 9\Short Stories\~WRL3222.tmp
C:\Documents and Settings\Ryan\My Documents\Corinne school\School 05-06\LA 9\Short Stories\~WRL3865.tmp
C:\Documents and Settings\Ryan\My Documents\Corinne school\School 05-06\LA 9\Year End\~WRL1823.tmp
C:\Documents and Settings\Ryan\My Documents\Corinne school\School 1999-00\Extras\~WRL0001.tmp
C:\Program Files\InterActual\InterActual Player\iti3CD.tmp

Finished

ComboFix 07-07-31 - "Ryan" 2007-07-31 17:33:18.1 [GMT -6:00] - NTFS
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.True
* Created a new restore point

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\Program Files\myglobalsearch
C:\Program Files\myglobalsearch\bar\1.bin\M9FFXTBR.JAR
C:\Program Files\myglobalsearch\bar\1.bin\M9FFXTBR.MANIFEST
C:\Program Files\myglobalsearch\bar\1.bin\M9NTSTBR.JAR
C:\Program Files\myglobalsearch\bar\1.bin\M9NTSTBR.MANIFEST
C:\Program Files\myglobalsearch\bar\1.bin\M9PLUGIN.DLL
C:\Program Files\myglobalsearch\bar\1.bin\MGSBAR.DLL
C:\Program Files\myglobalsearch\bar\1.bin\NPMYGLSH.DLL
C:\Program Files\myglobalsearch\bar\Cache\0D183B
C:\Program Files\myglobalsearch\bar\Cache\171146.bin
C:\Program Files\myglobalsearch\bar\Cache\171453.bin
C:\Program Files\myglobalsearch\bar\Cache\1716F3.bin
C:\Program Files\myglobalsearch\bar\Cache\82C7FB
C:\Program Files\myglobalsearch\bar\Cache\files.ini
C:\Program Files\myglobalsearch\bar\History\search
C:\Program Files\myglobalsearch\bar\Settings\prevcfg.htm

((((((((((((((((((((((((( Files Created from 2007-06-28 to 2007-07-31 )))))))))))))))))))))))))))))))

2007-07-31 17:32 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-07-31 17:20 d——– C:\WINDOWS\ERUNT
2007-07-29 13:52 90,112 –a—— C:\WINDOWS\system32\RegDACL.exe
2007-07-29 13:52 9,006 –a—— C:\clean.bat
2007-07-29 13:52 53,248 –a—— C:\WINDOWS\system32\process.exe
2007-07-29 13:52 4,096 –a—— C:\WINDOWS\system32\reboot.exe
2007-07-25 22:48 10,872 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-07-20 08:26 d——– C:\Program Files\MalwareBot
2007-07-20 08:26 d——– C:\DOCUME~1\Ryan\APPLIC~1\MalwareBot
2007-07-20 08:11 d——– C:\Program Files\NoAdware5.0
2007-07-17 16:01 28,672 –a—— C:\WINDOWS\system32\drivers\CO_Mon.sys
2007-07-16 14:57 d——– C:\!KillBox
2007-07-15 22:16 d——– C:\DOCUME~1\Corinne\APPLIC~1\Google
2007-07-15 21:14 d——– C:\DOCUME~1\Corinne\APPLIC~1\Ebates__MoeMoney__Maker
2007-07-15 21:13 d–hs—- C:\WINDOWS\CSC
2007-07-03 18:11 d——– C:\Program Files\Red Kawa
2007-07-03 18:02 d——– C:\Program Files\uTorrent
2007-07-03 18:02 d——– C:\DOCUME~1\Ryan\APPLIC~1\uTorrent
2007-07-03 17:59 697,492 –a—— C:\temp\uTorrent-1.6.1-install.exe
2007-07-03 17:59 244,736 –a—— C:\temp\utorrent-1.7-rc2.exe
2007-07-03 17:59 177,152 –a—— C:\temp\utorrent.exe
2007-06-26 14:03 d——– C:\DOCUME~1\Ryan\APPLIC~1\Ebates__MoeMoney__Maker
2007-06-26 14:03 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ebates__MoeMoney__Maker
2007-06-09 11:48 d——– C:\Program Files\Advanced Registry Optimizer
2007-06-09 11:48 d——– C:\DOCUME~1\Ryan\APPLIC~1\Sammsoft
2007-06-03 17:42 d——– C:\78763be80e44b86654
2007-06-03 17:41 d——– C:\WINDOWS\system32\LogFiles
2007-06-03 17:41 d——– C:\WINDOWS\system32\drivers\UMDF
2007-06-01 19:06 d——– C:\DOCUME~1\Ryan\APPLIC~1\Azureus
2007-06-01 19:06 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Azureus

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-26 16:17 ——— d——– C:\Program Files\DivX
2007-07-26 08:41 ——— d——– C:\Program Files\QuickTime
2007-07-24 13:53 ——— d——– C:\Program Files\GameSpy Arcade
2007-07-16 14:42 ——— d——– C:\DOCUME~1\Ryan\APPLIC~1\Apple Computer
2007-06-26 14:04 ——— d——– C:\Program Files\Ebates__MoeMoney__Maker
2007-06-09 12:40 ——— d——– C:\Program Files\Apple Software Update
2007-06-09 11:59 ——— d——– C:\Program Files\Diablo II
2006-05-29 19:23 108680 –a—— C:\DOCUME~1\Ryan\APPLIC~1\GDIPFONTCACHEV1.DAT

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ebmmm"="C:\Program Files\Ebates__MoeMoney__Maker\ebatesmmmv.exe" [2007-06-15 12:47]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-04-20 19:49]
"MalwareBot"="C:\Program Files\MalwareBot\MalwareBot.exe" []
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 03:25]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"E06ADXRC_1596765"="C:\Program Files\Microsoft Encarta\Encarta Premium 2006\EDICT.exe" [2005-06-03 11:30]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:56]
"AROReminder"="C:\Program Files\Advanced Registry Optimizer\ARO.exe" [2007-03-23 11:45]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{A213B520-C6C2-11d0-AF9D-008029E1027E}"= C:\Program Files\WinFax\WfxSeh32.Dll [1998-07-27 05:54 38400]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Acrobat Assistant.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk
backup=C:\WINDOWS\pss\Acrobat Assistant.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HotSync Manager.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HotSync Manager.lnk
backup=C:\WINDOWS\pss\HotSync Manager.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^TELUS eCare.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\TELUS eCare.lnk
backup=C:\WINDOWS\pss\TELUS eCare.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC]
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_EMC]
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cppc]
C:\DOCUME~1\Ryan\LOCALS~1\Temp\Rar$EX00.016\hl2crack.exe hide

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\E06ADXRC_3487375]
"C:\Program Files\Microsoft Encarta\Encarta Premium 2006\EDICT.EXE" -m

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ebmmm]
"C:\Program Files\Ebates__MoeMoney__Maker\ebatesmmmv.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IncrediMail]
C:\PROGRA~1\INCRED~1\bin\IncMail.exe /c

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Motive SmartBridge]
C:\PROGRA~1\TELUSE~1\SMARTB~1\MotiveSB.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WFXSwtch]
C:\PROGRA~1\WinFax\WFXSWTCH.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFaxAppPortStarter]
wfxsnt40.exe

R2 ElbyCDIO;ElbyCDIO Driver;C:\WINDOWS\system32\Drivers\ElbyCDIO.sys
R2 wfxsvc;WinFax PRO;C:\WINDOWS\System32\WFXSVC.EXE
R3 bcm4sbxp;ASUSTeK/Broadcom 440x 10/100 Integrated Controller XP Driver;C:\WINDOWS\system32\DRIVERS\bcm4sbxp.sys
R3 ElbyCDFL;ElbyCDFL;C:\WINDOWS\system32\Drivers\ElbyCDFL.sys
R3 Intels51;Intel® 536EP V.92 Modem;C:\WINDOWS\system32\DRIVERS\Intels51.sys
S2 WINLOAD;WINLOAD;c:\windows\system32\dllcache\win32\winlogon.exe
S2 WINSVCMGR;WINSVCMGR;c:\windows\system32\dllcache\win32\winlogon.exe
S3 CO_Mon;CO_Mon;\??\C:\WINDOWS\system32\Drivers\CO_Mon.sys
S3 hidgame;Microsoft Hid to Joystick Port Enabler;C:\WINDOWS\system32\DRIVERS\hidgame.sys
S3 iMSPCLOj;iMSPCLOj;\??\C:\DOCUME~1\Ryan\LOCALS~1\Temp\iMSPCLOj.sys

Contents of the 'Scheduled Tasks' folder
2007-06-09 18:40:26 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
2007-07-26 12:17:08 C:\WINDOWS\Tasks\MalwareBot Scheduled Scan.job - C:\Program Files\MalwareBot\MalwareBot.exe

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-31 17:35:25
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden registry entries …

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Reinstall\\27:\xf5wjY\1]
"DisplayName"="\t"
"DeviceDesc"="\t"
"ProviderName"=""
"MFG"="\x1058"
"ReinstallString"="2002, 6.13.10.6102"
"DeviceInstanceIds"=str(7):""

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-31 17:36:23
C:\ComboFix-quarantined-files.txt … 2007-07-31 17:35

— E O F —

Logfile of HijackThis v1.99.1
Scan saved at 5:41:42 PM, on 7/31/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WFXSVC.EXE
C:\Program Files\WinFax\WFXMOD32.EXE
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Ebates__MoeMoney__Maker\ebatesmmmv.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Microsoft Encarta\Encarta Premium 2006\EDICT.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Ebates__MoeMoney__Maker\eb.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Ryan\Desktop\HIJACK\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mytelus.com/new_homepage/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Encarta Web Companion Helper Object - {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - C:\Program Files\Common Files\Microsoft Shared\Encarta Web Companion\ENCWCBAR.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Encarta Web Companion - {147D6308-0614-4112-89B1-31402F9B82C4} - C:\Program Files\Common Files\Microsoft Shared\Encarta Web Companion\ENCWCBAR.DLL
O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (file missing)
O3 - Toolbar: &Google; - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: (no name) - {EA5A82FB-D6BE-44F9-9363-B1ABABC153C1} - (no file)
O4 - HKLM\..\Run: [ebmmm] "C:\Program Files\Ebates__MoeMoney__Maker\ebatesmmmv.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [MalwareBot] C:\Program Files\MalwareBot\MalwareBot.exe -boot
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [E06ADXRC_1596765] "C:\Program Files\Microsoft Encarta\Encarta Premium 2006\EDICT.EXE" -m
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AROReminder] C:\Program Files\Advanced Registry Optimizer\ARO.exe -rem
O8 - Extra context menu item: &Add; animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Ebates - file://C:\Documents and Settings\Ryan\Application Data\Ebates__MoeMoney__Maker\ebmmt\ebmmC5.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Ebates - {F2B441CC-E026-47fb-BDC3-A07750FA3D2C} - file://C:\Documents and Settings\Ryan\Application Data\Ebates__MoeMoney__Maker\ebmmt\ebmmC5.htm (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - https://mail.sperd.ca/iNotes6W.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: WinFax PRO (wfxsvc) - Symantec Corporation - C:\WINDOWS\System32\WFXSVC.EXE
O23 - Service: WINLOAD - Unknown owner - c:\windows\system32\dllcache\win32\winlogon.exe (file missing)
O23 - Service: WINSVCMGR - Unknown owner - c:\windows\system32\dllcache\win32\winlogon.exe (file missing)

Scotty

Post #21August 1, 2007, 10:08 AM UTC

Hello RCDM

Im not here to preach, as Im sure you are aware but I believe the source of your problem is P2P file-sharing. Most of the infected users we see on these forums are P2P users. All I can do is urge you to use caution, when downloading. And avoid crack/warez. They are notoriously bad.

Step 1

End malicious processes: (if they are present)

Press the CTRL+ALT+DEL keys simultaneously to open Task Manager
Click on the Processes tab to show running processes
Find eb.exe and click on it
Click End Process
Repeat steps 4 & 5 for each of the following processes: (if present)
- ebatesmmmv.exe
Close Task Manager

Step 2

Remove programs from Add/Remove Programs List

Please go to:
Start
Control Panel
Add/Remove Programs

Find and remove these programs (if they are present)

Ebates__MoeMoney__Maker

Step 3

Open Notepad and Copy/Paste the text in the codebox below into it:

File::
C:\78763be80e44b86654
C:\DOCUME~1\Ryan\LOCALS~1\Temp\iMSPCLOj.sys


Folder::
C:\DOCUME~1\Ryan\APPLIC~1\Ebates__MoeMoney__Maker
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ebates__MoeMoney__Maker
C:\DOCUME~1\Corinne\APPLIC~1\Ebates__MoeMoney__Maker
C:\Program Files\MalwareBot
C:\DOCUME~1\Ryan\APPLIC~1\MalwareBot
C:\Program Files\Ebates__MoeMoney__Maker
C:\DOCUME~1\Ryan\LOCALS~1\Temp\Rar$EX00.016

Driver::
WINLOAD
WINSVCMGR
iMSPCLOj

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ebmmm"=-
"MalwareBot"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cppc]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ebmmm]

Save this as "CFScript"

[external image: Posted Image]

Refering to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log with a new HijackThis log. And let me know if you use Incredimail, as well as how your computer is running now.

RCDM

Post #22August 1, 2007, 4:18 PM UTC

ComboFix 07-07-31 - "Ryan" 2007-08-01 9:58:03.2 [GMT -6:00] - NTFS
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.True
Command switches used :: C:\Documents and Settings\Ryan\Desktop\CFScript
* Created a new restore point

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\78763be80e44b86654
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ebates__MoeMoney__Maker
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ebates__MoeMoney__Maker\ebmmd\f46817190763e.dat
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ebates__MoeMoney__Maker\ebmmd\v4681716cfb0.dat
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ebates__MoeMoney__Maker\ebmmd\v4681716e7b36.dat
C:\DOCUME~1\Corinne\APPLIC~1\Ebates__MoeMoney__Maker
C:\DOCUME~1\Corinne\APPLIC~1\Ebates__MoeMoney__Maker\ebmmd\a469ae325bde.dat
C:\DOCUME~1\Corinne\APPLIC~1\Ebates__MoeMoney__Maker\ebmmd\d469ae309534e.dat
C:\DOCUME~1\Corinne\APPLIC~1\Ebates__MoeMoney__Maker\ebmmt\ebmmC5.htm
C:\DOCUME~1\Corinne\APPLIC~1\Ebates__MoeMoney__Maker\ebmmt\ebmmH5.htm
C:\DOCUME~1\Corinne\APPLIC~1\Ebates__MoeMoney__Maker\log.txt
C:\DOCUME~1\Ryan\APPLIC~1\Ebates__MoeMoney__Maker
C:\DOCUME~1\Ryan\APPLIC~1\Ebates__MoeMoney__Maker\ebmmd\c4681718d74a2.dat
C:\DOCUME~1\Ryan\APPLIC~1\Ebates__MoeMoney__Maker\ebmmd\c46b0ac4a3149.dat
C:\DOCUME~1\Ryan\APPLIC~1\Ebates__MoeMoney__Maker\ebmmt\ebmmC5.htm
C:\DOCUME~1\Ryan\APPLIC~1\Ebates__MoeMoney__Maker\ebmmt\ebmmH5.htm
C:\DOCUME~1\Ryan\APPLIC~1\Ebates__MoeMoney__Maker\log.txt
C:\DOCUME~1\Ryan\APPLIC~1\MalwareBot
C:\DOCUME~1\Ryan\APPLIC~1\MalwareBot\Log\log_2007_07_24_10_50_03.log
C:\DOCUME~1\Ryan\APPLIC~1\MalwareBot\Log\log_2007_07_24_10_50_04.log
C:\DOCUME~1\Ryan\APPLIC~1\MalwareBot\Log\log_2007_07_24_12_48_30.log
C:\DOCUME~1\Ryan\APPLIC~1\MalwareBot\Log\log_2007_07_24_12_48_31.log
C:\DOCUME~1\Ryan\APPLIC~1\MalwareBot\Log\log_2007_07_24_13_42_37.log
C:\DOCUME~1\Ryan\APPLIC~1\MalwareBot\Log\log_2007_07_24_13_44_42.log
C:\DOCUME~1\Ryan\APPLIC~1\MalwareBot\Log\log_2007_07_25_22_36_17.log
C:\DOCUME~1\Ryan\APPLIC~1\MalwareBot\Log\log_2007_07_25_22_36_20.log
C:\DOCUME~1\Ryan\APPLIC~1\MalwareBot\Log\log_2007_07_26_06_17_03.log
C:\DOCUME~1\Ryan\APPLIC~1\MalwareBot\Log\log_2007_07_26_06_17_07.log
C:\DOCUME~1\Ryan\APPLIC~1\MalwareBot\Settings\CustomScan.stg
C:\DOCUME~1\Ryan\APPLIC~1\MalwareBot\Settings\IgnoreList.stg
C:\DOCUME~1\Ryan\APPLIC~1\MalwareBot\Settings\ScanInfo.stg
C:\DOCUME~1\Ryan\APPLIC~1\MalwareBot\Settings\ScanResults.stg
C:\DOCUME~1\Ryan\APPLIC~1\MalwareBot\Settings\SelectedFolders.stg
C:\DOCUME~1\Ryan\APPLIC~1\MalwareBot\Settings\Settings.stg
C:\Program Files\Ebates__MoeMoney__Maker
C:\Program Files\Ebates__MoeMoney__Maker\eb.exe
C:\Program Files\Ebates__MoeMoney__Maker\ebatesmmmv.exe
C:\Program Files\Ebates__MoeMoney__Maker\ebmma\eb399.dat
C:\Program Files\Ebates__MoeMoney__Maker\ebmma\ebmm5.dat
C:\Program Files\Ebates__MoeMoney__Maker\ebmmh\ebmmC5.htm
C:\Program Files\Ebates__MoeMoney__Maker\ebmmh\ebmmH5.htm
C:\Program Files\Ebates__MoeMoney__Maker\ebmmh\ebmmP5.htm
C:\Program Files\Ebates__MoeMoney__Maker\ebmmh\ebmmP5_dis.htm
C:\Program Files\Ebates__MoeMoney__Maker\ebmmh\ebmmR5.htm
C:\Program Files\Ebates__MoeMoney__Maker\ebmmh\ebmmRNICP5.htm
C:\Program Files\Ebates__MoeMoney__Maker\ebmmh\ebmmRPMP5.htm
C:\Program Files\Ebates__MoeMoney__Maker\ebmmh\ebmmRPMS5.htm
C:\Program Files\Ebates__MoeMoney__Maker\ebmmm.dll
C:\Program Files\Ebates__MoeMoney__Maker\ebmms\ebmml.dat
C:\Program Files\Ebates__MoeMoney__Maker\ebmms\ebmmp.dat
C:\Program Files\Ebates__MoeMoney__Maker\ebmms\ebmms.dat
C:\Program Files\Ebates__MoeMoney__Maker\images\ebmm.gif
C:\Program Files\Ebates__MoeMoney__Maker\images\ebmm.ico
C:\Program Files\Ebates__MoeMoney__Maker\images\ebmm_button_clickhere.gif
C:\Program Files\Ebates__MoeMoney__Maker\images\ebmm_button_getcashbck.gif
C:\Program Files\Ebates__MoeMoney__Maker\images\ebmm_button_no.gif
C:\Program Files\Ebates__MoeMoney__Maker\images\ebmm_button_submit.gif
C:\Program Files\Ebates__MoeMoney__Maker\images\ebmm_button_yes.gif
C:\Program Files\Ebates__MoeMoney__Maker\images\ebmm_clear.gif
C:\Program Files\Ebates__MoeMoney__Maker\images\ebmm_clrpxl.gif
C:\Program Files\Ebates__MoeMoney__Maker\images\ebmm_cou_button_savenow.gif
C:\Program Files\Ebates__MoeMoney__Maker\images\ebmm_cou_logo_greenbground.gif
C:\Program Files\Ebates__MoeMoney__Maker\images\ebmm_cou_moe.gif
C:\Program Files\Ebates__MoeMoney__Maker\images\ebmm_cou_moe_logo.gif
C:\Program Files\Ebates__MoeMoney__Maker\images\ebmm_dotted_divider.gif
C:\Program Files\Ebates__MoeMoney__Maker\images\ebmm_doublelines_bot.gif
C:\Program Files\Ebates__MoeMoney__Maker\images\ebmm_doublelines_bot_grn.gif
C:\Program Files\Ebates__MoeMoney__Maker\images\ebmm_grayblock.gif
C:\Program Files\Ebates__MoeMoney__Maker\images\ebmm_green_bg.gif
C:\Program Files\Ebates__MoeMoney__Maker\images\ebmm_hot.ico
C:\Program Files\Ebates__MoeMoney__Maker\images\ebmm_instructions_header.gif
C:\Program Files\Ebates__MoeMoney__Maker\images\ebmm_logo_lrg.gif
C:\Program Files\Ebates__MoeMoney__Maker\images\ebmm_logo1.gif
C:\Program Files\Ebates__MoeMoney__Maker\images\ebmm_moe_question.gif
C:\Program Files\Ebates__MoeMoney__Maker\images\ebmm_moe_reminder.gif
C:\Program Files\Ebates__MoeMoney__Maker\images\ebmm_moe_top.gif
C:\Program Files\Ebates__MoeMoney__Maker\images\ebmm_moe_with_cash.gif
C:\Program Files\Ebates__MoeMoney__Maker\images\ebmm_preferences.gif
C:\Program Files\Ebates__MoeMoney__Maker\images\ebmm_prefs_browser.gif
C:\Program Files\Ebates__MoeMoney__Maker\images\ebmm_spacer.gif
C:\Program Files\Ebates__MoeMoney__Maker\images\ebmm_step1.gif
C:\Program Files\Ebates__MoeMoney__Maker\images\ebmm_step2.gif
C:\Program Files\Ebates__MoeMoney__Maker\images\ebmm_step3.gif
C:\Program Files\Ebates__MoeMoney__Maker\images\ebmm_step4.gif
C:\Program Files\Ebates__MoeMoney__Maker\images\ebmm_step5_tear.gif
C:\Program Files\Ebates__MoeMoney__Maker\images\ebmm_step6_tear.gif
C:\Program Files\Ebates__MoeMoney__Maker\README.txt
C:\Program Files\MalwareBot
C:\Program Files\MalwareBot\Launcher.exe

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

——-\LEGACY_IMSPCLOJ
——-\LEGACY_WINLOAD
——-\LEGACY_WINSVCMGR
——-\iMSPCLOj
——-\WINLOAD
——-\WINSVCMGR

((((((((((((((((((((((((( Files Created from 2007-07-01 to 2007-08-01 )))))))))))))))))))))))))))))))

2007-07-31 17:32 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-07-31 17:20 d——– C:\WINDOWS\ERUNT
2007-07-29 13:52 90,112 –a—— C:\WINDOWS\system32\RegDACL.exe
2007-07-29 13:52 9,006 –a—— C:\clean.bat
2007-07-29 13:52 53,248 –a—— C:\WINDOWS\system32\process.exe
2007-07-29 13:52 4,096 –a—— C:\WINDOWS\system32\reboot.exe
2007-07-25 22:48 10,872 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-07-20 08:11 d——– C:\Program Files\NoAdware5.0
2007-07-17 16:01 28,672 –a—— C:\WINDOWS\system32\drivers\CO_Mon.sys
2007-07-16 14:57 d——– C:\!KillBox
2007-07-15 22:16 d——– C:\DOCUME~1\Corinne\APPLIC~1\Google
2007-07-15 21:13 d–hs—- C:\WINDOWS\CSC
2007-07-03 18:11 d——– C:\Program Files\Red Kawa
2007-07-03 18:02 d——– C:\Program Files\uTorrent
2007-07-03 18:02 d——– C:\DOCUME~1\Ryan\APPLIC~1\uTorrent
2007-07-03 17:59 697,492 –a—— C:\temp\uTorrent-1.6.1-install.exe
2007-07-03 17:59 244,736 –a—— C:\temp\utorrent-1.7-rc2.exe
2007-07-03 17:59 177,152 –a—— C:\temp\utorrent.exe

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-26 16:17 ——— d——– C:\Program Files\DivX
2007-07-26 08:41 ——— d——– C:\Program Files\QuickTime
2007-07-24 13:53 ——— d——– C:\Program Files\GameSpy Arcade
2007-07-16 14:42 ——— d——– C:\DOCUME~1\Ryan\APPLIC~1\Apple Computer
2007-06-09 12:40 ——— d——– C:\Program Files\Apple Software Update
2007-06-09 11:59 ——— d——– C:\Program Files\Diablo II
2007-06-09 11:48 ——— d——– C:\Program Files\Advanced Registry Optimizer
2007-06-09 11:48 ——— d——– C:\DOCUME~1\Ryan\APPLIC~1\Sammsoft
2007-06-03 22:42 ——— d——– C:\DOCUME~1\Ryan\APPLIC~1\Azureus
2006-05-29 19:23 108680 –a—— C:\DOCUME~1\Ryan\APPLIC~1\GDIPFONTCACHEV1.DAT

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-04-20 19:49]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 03:25]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"E06ADXRC_1596765"="C:\Program Files\Microsoft Encarta\Encarta Premium 2006\EDICT.exe" [2005-06-03 11:30]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:56]
"AROReminder"="C:\Program Files\Advanced Registry Optimizer\ARO.exe" [2007-03-23 11:45]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{A213B520-C6C2-11d0-AF9D-008029E1027E}"= C:\Program Files\WinFax\WfxSeh32.Dll [1998-07-27 05:54 38400]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Acrobat Assistant.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk
backup=C:\WINDOWS\pss\Acrobat Assistant.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HotSync Manager.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HotSync Manager.lnk
backup=C:\WINDOWS\pss\HotSync Manager.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^TELUS eCare.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\TELUS eCare.lnk
backup=C:\WINDOWS\pss\TELUS eCare.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC]
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_EMC]
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\E06ADXRC_3487375]
"C:\Program Files\Microsoft Encarta\Encarta Premium 2006\EDICT.EXE" -m

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IncrediMail]
C:\PROGRA~1\INCRED~1\bin\IncMail.exe /c

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Motive SmartBridge]
C:\PROGRA~1\TELUSE~1\SMARTB~1\MotiveSB.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WFXSwtch]
C:\PROGRA~1\WinFax\WFXSWTCH.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFaxAppPortStarter]
wfxsnt40.exe

R2 ElbyCDIO;ElbyCDIO Driver;C:\WINDOWS\system32\Drivers\ElbyCDIO.sys
R2 wfxsvc;WinFax PRO;C:\WINDOWS\System32\WFXSVC.EXE
R3 bcm4sbxp;ASUSTeK/Broadcom 440x 10/100 Integrated Controller XP Driver;C:\WINDOWS\system32\DRIVERS\bcm4sbxp.sys
R3 ElbyCDFL;ElbyCDFL;C:\WINDOWS\system32\Drivers\ElbyCDFL.sys
R3 Intels51;Intel® 536EP V.92 Modem;C:\WINDOWS\system32\DRIVERS\Intels51.sys
S3 CO_Mon;CO_Mon;\??\C:\WINDOWS\system32\Drivers\CO_Mon.sys
S3 hidgame;Microsoft Hid to Joystick Port Enabler;C:\WINDOWS\system32\DRIVERS\hidgame.sys

Contents of the 'Scheduled Tasks' folder
2007-06-09 18:40:26 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
2007-07-26 12:17:08 C:\WINDOWS\Tasks\MalwareBot Scheduled Scan.job - C:\Program Files\MalwareBot\MalwareBot.exe

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-01 10:03:25
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden registry entries …

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Reinstall\\27:\xf5wjY\1]
"DisplayName"="\t"
"DeviceDesc"="\t"
"ProviderName"=""
"MFG"="\x1058"
"ReinstallString"="2002, 6.13.10.6102"
"DeviceInstanceIds"=str(7):""

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-01 10:05:38 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-08-01 10:05
C:\ComboFix2.txt … 2007-07-31 17:36

— E O F —

Logfile of HijackThis v1.99.1
Scan saved at 10:07:36 AM, on 8/1/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WFXSVC.EXE
C:\Program Files\WinFax\WFXMOD32.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Microsoft Encarta\Encarta Premium 2006\EDICT.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Ryan\Desktop\HIJACK\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mytelus.com/new_homepage/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Encarta Web Companion Helper Object - {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - C:\Program Files\Common Files\Microsoft Shared\Encarta Web Companion\ENCWCBAR.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Encarta Web Companion - {147D6308-0614-4112-89B1-31402F9B82C4} - C:\Program Files\Common Files\Microsoft Shared\Encarta Web Companion\ENCWCBAR.DLL
O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: (no name) - {EA5A82FB-D6BE-44F9-9363-B1ABABC153C1} - (no file)
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [E06ADXRC_1596765] "C:\Program Files\Microsoft Encarta\Encarta Premium 2006\EDICT.EXE" -m
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AROReminder] C:\Program Files\Advanced Registry Optimizer\ARO.exe -rem
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Ebates - file://C:\Documents and Settings\Ryan\Application Data\Ebates__MoeMoney__Maker\ebmmt\ebmmC5.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Ebates - {F2B441CC-E026-47fb-BDC3-A07750FA3D2C} - file://C:\Documents and Settings\Ryan\Application Data\Ebates__MoeMoney__Maker\ebmmt\ebmmC5.htm (file missing) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - https://mail.sperd.ca/iNotes6W.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: WinFax PRO (wfxsvc) - Symantec Corporation - C:\WINDOWS\System32\WFXSVC.EXE

Well I went through your steps and as soon as it ended the two tasks from the task manager they would pop-up agian. When I tried to remove Ebates Mo Money Maker from my program files the computer locked up. On the bright side I got acess to QuickTime again but unfortunatly when I try to run it it give me an error message "Buffer Overrun detected!" and when I try to uninstall it I get a "fatal error" message. Otherwise my computer seems to be running faster and the internet is smoother. Oh I do use IncrediMail. One more question, what is P2P and crack/warez.

Thanks for all your help so far!

Scotty

Post #23August 1, 2007, 4:56 PM UTC

Hello RCDM

P2P file-sharing is downloading music etc through software like utorrent. The software itself is safe, I use it myself, but theres always a good chance of an infection as you are getting files from others pc's. Torrents are the safer option, as you download pieces of files instead of whole files, but there is always the risk, so always be aware.
Crack/warez are a different kettle of fish, but if you dont know what they are, I shouldnt worry. They are used for software piracy. eg if someone fancies Nero but not the idea of paying for it, they download a "cracked" copy. Just visiting those kind of sites will infect you!

Try uninstalling Quicktime in Safe Mode, then re-installing a fresh program.

Run HijackThis, select Do a system scan only and place checks against the following entries (if they are still present):
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (file missing)
O3 - Toolbar: (no name) - {EA5A82FB-D6BE-44F9-9363-B1ABABC153C1} - (no file)
O8 - Extra context menu item: Ebates - file://C:\Documents and Settings\Ryan\Application Data\Ebates__MoeMoney__Maker\ebmmt\ebmmC5.htm
O9 - Extra button: Ebates - {F2B441CC-E026-47fb-BDC3-A07750FA3D2C} - file://C:\Documents and Settings\Ryan\Application Data\Ebates__MoeMoney__Maker\ebmmt\ebmmC5.htm (file missing) (HKCU

WITH ALL OTHER WINDOWS CLOSED Click on Fix Checked and exit HijackThis.

Delete the older versions of Java and download the newest.
Please follow these steps to remove older version Java components.

Close any programmes you may have running, ESPECIALLY your web browser
Click Start > Control Panel.
Click Add/Remove Programs.
Check any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove all versions of Java.
Reboot your computer once all Java components are removed.

Then download the latest version of Java Runtime Environment (JRE) (4th one down the list), which is JRE6u2, and click Yes at the page warning, then accept the Licence Agreement before downloading the Offline file.

Now delete ComboFix and Haxfix from your Desktop then navigate to and delete these folders/files.
c:\haxfix.txt
C:\Qoobox
C:\!KillBox
C:\SDFix
C:\program files\haxfix

If you have a problem deleting the Qoobox folder let me know.

Download AVG Anti-Spyware.

Install AVG Anti-Spyware.
Launch AVG by double-clicking on the icon.
The program will now open to the main screen.
You will need to update AVG to the latest definition files.
At the top of the main screen click Update.
Then in the Manual Update section, click on Start Update.

[*]The update will start and a progress bar will show the updates being installed.

[*]When updates are completed, close AVG.

If you are having problems with the updater, you can use this link to manually update AVG.
AVG manual updates

Run a scan with AVG.

Click on Scanner
- Click on the Settings tab, and set the following settings.
  - How to act
  - Click on Recommended actions, and set to Quarantine.
- How to scan
  - Check all options.
- Possibly unwanted software.
  - Check all options.
- Reports
  - Check Do not automatically generate reports after every scan.
- What to scan
  - Check Scan every file.
Click on the Scan tab.
- Click on Complete System Scan and the scan will begin.
- When the scan has finished
- Make sure that Set all elements to: shows Quarantine, if not click on the link and choose Quarantine from the popup menu.
- At the bottom of the window click on the Apply all Actions button.

Note: Don't save the report before you hit the Apply action button.

Close AVG Anti-Spyware.

AVG will save a report in the following location C:\Program Files\Grisoft\AVG anti-spyware 7.5\Reports

Post the AVG report in your next reply with a new HijackThis log, please.

RCDM

Post #24August 1, 2007, 9:27 PM UTC

AVG Anti-Spyware - Scan Report
———————————————————

+ Created at: 3:12:40 PM 8/1/2007

+ Scan result:

HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\ins -> Adware.WebRebates : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0C9B82A3-7382-4045-BEDA-BAF35DA5B179}\RP740\A0155486.dll -> Backdoor.Haxdoor.gh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0C9B82A3-7382-4045-BEDA-BAF35DA5B179}\RP740\A0155495.dll -> Backdoor.Haxdoor.gh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{0C9B82A3-7382-4045-BEDA-BAF35DA5B179}\RP740\A0155487.sys -> Backdoor.Haxdoor.ho : Cleaned with backup (quarantined).
C:\Documents and Settings\Ryan\Cookies\ryan@2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Ryan\Cookies\ryan@bluestreak[2].txt -> TrackingCookie.Bluestreak : Cleaned.

::Report end

Logfile of HijackThis v1.99.1
Scan saved at 3:24:07 PM, on 8/1/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WFXSVC.EXE
C:\Program Files\WinFax\WFXMOD32.EXE
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Microsoft Encarta\Encarta Premium 2006\EDICT.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Ryan\Desktop\HIJACK\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mytelus.com/new_homepage/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Encarta Web Companion Helper Object - {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - C:\Program Files\Common Files\Microsoft Shared\Encarta Web Companion\ENCWCBAR.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Encarta Web Companion - {147D6308-0614-4112-89B1-31402F9B82C4} - C:\Program Files\Common Files\Microsoft Shared\Encarta Web Companion\ENCWCBAR.DLL
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: (no name) - {EA5A82FB-D6BE-44F9-9363-B1ABABC153C1} - (no file)
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKCU\..\Run: [E06ADXRC_1596765] "C:\Program Files\Microsoft Encarta\Encarta Premium 2006\EDICT.EXE" -m
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AROReminder] C:\Program Files\Advanced Registry Optimizer\ARO.exe -rem
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - https://mail.sperd.ca/iNotes6W.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: WinFax PRO (wfxsvc) - Symantec Corporation - C:\WINDOWS\System32\WFXSVC.EXE

Scotty

Post #25August 2, 2007, 8:55 AM UTC

Hello RCDM

This is my usual speech for when you are clean, which you appear to be.

Please follow these simple steps in order to keep your computer clean and secure:
Disable and Enable System Restore. - If you are using Windows ME or XP then you should disable
and reenable system restore to make sure there are no infected files found in a restore point.

You can find instructions on how to enable and reenable system restore here:

Managing Windows Millenium System Restore

or

Windows XP System Restore Guide

Re-enable system restore with instructions from tutorial above
Make your Internet Explorer more secure - This can be done by following these simple instructions:
From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
- Change the Download signed ActiveX controls to Prompt
- Change the Download unsigned ActiveX controls to Disable
- Change the Initialize and script ActiveX controls not marked as safe to Disable
- Change the Installation of desktop items to Prompt
- Change the Launching programs and files in an IFRAME to Prompt
- Change the Navigate sub-frames across different domains to Prompt
- When all these settings have been made, click on the OK button.
- If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.

Set correct settings for files that should be hidden in Windows XP

Click Start > My Computer > Tools menu (at top of page) > Folder Options > View tab.
Under "Hidden files and folders" if necessary select Do not show hidden files and folders.
If unchecked please checkHide protected operating system files (Recommended)
If necessary check "Display content of system folders"
If necessary Uncheck Hide file extensions for known file types.
Click OK

And take a look at this LINKY for further recommendations and tips to stay clean.

Follow this list and your potential for being infected again will reduce dramatically.

Glad I was able to help.

RCDM

Post #26August 2, 2007, 3:09 PM UTC

Thank you so much! You guys provide a great service!

Scotty

Post #27August 2, 2007, 3:14 PM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved]Quicktime Eater

✨ Ask AI

Ask AI