What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved]Winfixer

14 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #19
My husband was just looking in the control panel and discovered that the box for "Block pop-ups" wasn't checked. Will this have solved my problems or would I still have a virus?
Post #21
Yay! :D That did it. I don't know how I lost it in the first place. Oh, well. What about the pop-up blocker box in the control panel? Will that fix our problem?
Post #22
To answer your other question on the pop-up blocker. It will block most non-malicious pop ups. But you had Vundo, an SDBot, and other yet to be identified infections. No pop-up blocker will stop them. Anyway, it should still be on, that's how I set it. Are you still getting them? Any luck on running Kaspersky yet?
Post #24
Ok, new question. I let Kaspersky run all night but when we got up this morning it had disconnected from the internet and said something about restarting the computer. How do I get to the report? Do I have to run that whole thing over again? I'll be gone for the afternoon but will check in again tonight.
Post #25
I am not sure. Do you see a file on the desktop? That's where it should have been saved. If not we'll try to come up with something else. When was the last time you ran a full system scan with your antivirus, making sure that it is updated? If Kaspersky is too long you can try that. Tell me what it finds.
Post #26
Ok, kaspersky is 88% done. I'll post the report as soon as it's finished. Another stupid question–now the bar at the top of IE is gone. You know the one with back, stop, refresh, home, favorites, mail, etc. I had it this morning but not anymore. I've gone to view but can't seem to get it back.
Post #27
Thursday, August 16, 2007 12:16:02 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.93.0
Kaspersky Anti-Virus database last update: 16/08/2007
Kaspersky Anti-Virus database records: 382815


Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true

Scan Target My Computer
C:\
D:\
E:\
F:\
G:\
H:\
I:\

Scan Statistics
Total number of scanned objects 95797
Number of viruses found 38
Number of infected objects 142
Number of suspicious objects 1
Duration of the scan process 02:32:29

Infected Object Name Virus Name Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp Object is locked skipped

C:\Documents and Settings\All Users\Application Data\STOPzilla!\targets.db Object is locked skipped

C:\Documents and Settings\All Users\Application Data\STOPzilla!\userdata.db Object is locked skipped

C:\Documents and Settings\All Users\Application Data\STOPzilla!\zilla.data Object is locked skipped

C:\Documents and Settings\All Users\Application Data\STOPzilla!\zilla.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\Confid.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\Content.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\Privacy.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\Restrict.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\WebHist.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\HPPAppActivity.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\HPPHomePageActivity.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\2007-08-16_Log.ALUSchedulerSvc.LiveUpdate Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\QuarantineC291A88.hta Infected: Trojan-Downloader.VBS.Psyme.at skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\QuarantineDAC473E.exe Infected: Trojan.Win32.LowZones.dm skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\QuarantineF321F6F.exe Infected: Trojan-Clicker.Win32.Small.jf skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1046491E.exe Infected: Trojan-Dropper.Win32.Agent.mu skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\107A68E5.exe Infected: Trojan-Clicker.Win32.Small.jf skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\204A0B6F.exe Infected: Trojan-Clicker.Win32.Small.jf skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\23FA5844.exe Infected: Trojan-Clicker.Win32.Small.jf skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\29DA306F.htm Infected: Trojan-Clicker.Win32.Spywad.b skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\312D52E7.exe Infected: Trojan-Clicker.Win32.Small.jf skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\35AC53DC.exe Infected: Trojan-Clicker.Win32.Small.jf skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\40E276F3.wmf Infected: Exploit.Win32.IMG-WMF.v skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\50A56F6B.wmf Infected: Trojan-Downloader.Win32.Agent.acd skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\50D23B39.zip/Matrix.class Infected: Trojan-Downloader.Java.OpenStream.c skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\50D23B39.zip/Counter.class Infected: Trojan.Java.ClassLoader.h skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\50D23B39.zip/Parser.class Infected: Trojan.Java.ClassLoader.d skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\50D23B39.zip ZIP: infected - 3 skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\50D23B39.zip CryptFF: infected - 3 skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\50D90F31.htm Infected: Exploit.JS.CVE-2006-1359.aa skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\517D1C69.tmp Infected: Trojan-Downloader.Java.OpenConnection.aj skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\51814666.tmp Infected: Trojan-Downloader.Java.OpenConnection.aj skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\51896A6F.cla Infected: Exploit.Java.ByteVerify skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\51EE0000.cla Infected: Exploit.Java.ByteVerify skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\520525E7.cla Infected: Trojan.Java.ClassLoader.Dummy.d skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\52084FE3.cla Infected: Trojan.Java.ClassLoader.Dummy.d skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\520C79E0.cla Infected: Exploit.Java.ByteVerify skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\520F23DC.cla Infected: Exploit.Java.ByteVerify skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\52124DD9.cla Infected: Exploit.Java.ByteVerify skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\59793A3F.tmp Suspicious: Exploit.VBS.Phel skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\68820652.cla Infected: Exploit.Java.ByteVerify skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\68EA45DF.cla Infected: Trojan.Java.ClassLoader.Dummy.d skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\69073FBE.exe Infected: Trojan.Win32.LowZones.dt skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\691811AC.cla Infected: Exploit.Java.ByteVerify skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6A2107FC.dll Infected: not-a-virus:AdWare.Win32.SearchPage skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6A4555D5.tmp Infected: Trojan.Java.ClassLoader.h skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\707433D4.exe Infected: Trojan-Clicker.Win32.Small.jf skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\7B9964ED.exe Infected: Trojan-Clicker.Win32.Small.jf skipped

C:\Documents and Settings\HP_Owner\Application Data\STOPzilla!\HP_Owner.pdb Object is locked skipped

C:\Documents and Settings\HP_Owner\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv420.jar-19cdd09a-3b294b43.zip/Matrix.class Infected: Trojan-Downloader.Java.OpenStream.c skipped

C:\Documents and Settings\HP_Owner\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv420.jar-19cdd09a-3b294b43.zip ZIP: infected - 1 skipped

C:\Documents and Settings\HP_Owner\Application Data\Symantec\PendingAlertsQueue.log Object is locked skipped

C:\Documents and Settings\HP_Owner\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\HP_Owner\Desktop\SDFix\backups\backups.zip/backups/k11u72.exe/data0005 Infected: Trojan-Downloader.Win32.VB.awj skipped

C:\Documents and Settings\HP_Owner\Desktop\SDFix\backups\backups.zip/backups/k11u72.exe Infected: Trojan-Downloader.Win32.VB.awj skipped

C:\Documents and Settings\HP_Owner\Desktop\SDFix\backups\backups.zip/backups/poolsv.exe Infected: Trojan-Downloader.Win32.VB.aya skipped

C:\Documents and Settings\HP_Owner\Desktop\SDFix\backups\backups.zip/backups/retadpu1000106.exe Infected: Trojan-Downloader.Win32.Agent.bls skipped

C:\Documents and Settings\HP_Owner\Desktop\SDFix\backups\backups.zip/backups/retadpu1000106.exe.tmp Infected: Trojan-Downloader.Win32.Agent.bls skipped

C:\Documents and Settings\HP_Owner\Desktop\SDFix\backups\backups.zip/backups/retadpu77.exe Infected: Trojan-Downloader.Win32.Agent.bls skipped

C:\Documents and Settings\HP_Owner\Desktop\SDFix\backups\backups.zip/backups/wr-1-0000077.exe Infected: Trojan-Downloader.Win32.Small.eqn skipped

C:\Documents and Settings\HP_Owner\Desktop\SDFix\backups\backups.zip/backups/YazzleBundle-1549.exe/data0002 Infected: Trojan-Downloader.Win32.PurityScan.eg skipped

C:\Documents and Settings\HP_Owner\Desktop\SDFix\backups\backups.zip/backups/YazzleBundle-1549.exe Infected: Trojan-Downloader.Win32.PurityScan.eg skipped

C:\Documents and Settings\HP_Owner\Desktop\SDFix\backups\backups.zip ZIP: infected - 9 skipped

C:\Documents and Settings\HP_Owner\Local Settings\Application Data\ApplicationHistory\hpqimzone.exe.3204510e.ini.inuse Object is locked skipped

C:\Documents and Settings\HP_Owner\Local Settings\Application Data\HP\Digital Imaging\db\administrativeInfo.dbf Object is locked skipped

C:\Documents and Settings\HP_Owner\Local Settings\Application Data\HP\Digital Imaging\db\albumImagesTable.cdx Object is locked skipped

C:\Documents and Settings\HP_Owner\Local Settings\Application Data\HP\Digital Imaging\db\albumImagesTable.dbf Object is locked skipped

C:\Documents and Settings\HP_Owner\Local Settings\Application Data\HP\Digital Imaging\db\albumTable.cdx Object is locked skipped

C:\Documents and Settings\HP_Owner\Local Settings\Application Data\HP\Digital Imaging\db\albumTable.dbf Object is locked skipped

C:\Documents and Settings\HP_Owner\Local Settings\Application Data\HP\Digital Imaging\db\CB_Server_Errors.txt Object is locked skipped

C:\Documents and Settings\HP_Owner\Local Settings\Application Data\HP\Digital Imaging\db\EXIFTable.cdx Object is locked skipped

C:\Documents and Settings\HP_Owner\Local Settings\Application Data\HP\Digital Imaging\db\EXIFTable.dbf Object is locked skipped

C:\Documents and Settings\HP_Owner\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.cdx Object is locked skipped

C:\Documents and Settings\HP_Owner\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.dbf Object is locked skipped

C:\Documents and Settings\HP_Owner\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.fpt Object is locked skipped

C:\Documents and Settings\HP_Owner\Local Settings\Application Data\HP\Digital Imaging\db\keywordImagesTable.cdx Object is locked skipped

C:\Documents and Settings\HP_Owner\Local Settings\Application Data\HP\Digital Imaging\db\keywordImagesTable.dbf Object is locked skipped

C:\Documents and Settings\HP_Owner\Local Settings\Application Data\HP\Digital Imaging\db\keywordTable.cdx Object is locked skipped

C:\Documents and Settings\HP_Owner\Local Settings\Application Data\HP\Digital Imaging\db\keywordTable.dbf Object is locked skipped

C:\Documents and Settings\HP_Owner\Local Settings\Application Data\HP\Digital Imaging\db\managedFolderTable.dbf Object is locked skipped

C:\Documents and Settings\HP_Owner\Local Settings\Application Data\HP\Digital Imaging\db\pathnameTable.cdx Object is locked skipped

C:\Documents and Settings\HP_Owner\Local Settings\Application Data\HP\Digital Imaging\db\pathnameTable.dbf Object is locked skipped

C:\Documents and Settings\HP_Owner\Local Settings\Application Data\HP\Digital Imaging\db\propertiesTable.cdx Object is locked skipped

C:\Documents and Settings\HP_Owner\Local Settings\Application Data\HP\Digital Imaging\db\propertiesTable.dbf Object is locked skipped

C:\Documents and Settings\HP_Owner\Local Settings\Application Data\HP\Digital Imaging\db\ROFImagesTable.cdx Object is locked skipped

C:\Documents and Settings\HP_Owner\Local Settings\Application Data\HP\Digital Imaging\db\ROFImagesTable.dbf Object is locked skipped

C:\Documents and Settings\HP_Owner\Local Settings\Application Data\HP\Digital Imaging\db\ROFTable.cdx Object is locked skipped

C:\Documents and Settings\HP_Owner\Local Settings\Application Data\HP\Digital Imaging\db\ROFTable.dbf Object is locked skipped

C:\Documents and Settings\HP_Owner\Local Settings\Application Data\Identities\{658DCA9C-9C3D-41FA-AAC2-D94E78D91F50}\Microsoft\Outlook Express\Folders.dbx Object is locked skipped

C:\Documents and Settings\HP_Owner\Local Settings\Application Data\Identities\{658DCA9C-9C3D-41FA-AAC2-D94E78D91F50}\Microsoft\Outlook Express\Inbox.dbx Object is locked skipped

C:\Documents and Settings\HP_Owner\Local Settings\Application Data\Identities\{658DCA9C-9C3D-41FA-AAC2-D94E78D91F50}\Microsoft\Outlook Express\Offline.dbx Object is locked skipped

C:\Documents and Settings\HP_Owner\Local Settings\Application Data\Identities\{658DCA9C-9C3D-41FA-AAC2-D94E78D91F50}\Microsoft\Outlook Express\Pop3uidl.dbx Object is locked skipped

C:\Documents and Settings\HP_Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\HP_Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\HP_Owner\Local Settings\History\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\HP_Owner\Local Settings\History\History.IE5\MSHist012007081620070817\index.dat Object is locked skipped

C:\Documents and Settings\HP_Owner\Local Settings\Temp\hpodvd09.log Object is locked skipped

C:\Documents and Settings\HP_Owner\Local Settings\Temp\_hphtra07.log Object is locked skipped

C:\Documents and Settings\HP_Owner\Local Settings\Temp\~DF93CF.tmp Object is locked skipped

C:\Documents and Settings\HP_Owner\Local Settings\Temporary Internet Files\Content.IE5\7Z9J7L4W\idien[1] Infected: Trojan.Win32.Agent.aoy skipped

C:\Documents and Settings\HP_Owner\Local Settings\Temporary Internet Files\Content.IE5\BNTBZDGW\kcehc_eicooc[1] Infected: Trojan-Downloader.Win32.Tiny.id skipped

C:\Documents and Settings\HP_Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\HP_Owner\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\HP_Owner\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\Melissa\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\omfg.class-2389f797-55407200.class Infected: Trojan-Downloader.Java.OpenStream.y skipped

C:\Documents and Settings\Melissa\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\omfg.class-52d8b673-4146c351.class Infected: Trojan-Downloader.Java.OpenStream.y skipped

C:\Documents and Settings\Melissa\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\omfge.class-2b3d7713-208658cd.class Infected: Trojan-Downloader.Java.OpenStream.y skipped

C:\Documents and Settings\Melissa\Local Settings\Temp\lgmatjgo.exe Infected: Trojan-Dropper.Win32.Agent.bmk skipped

C:\Documents and Settings\Melissa\Local Settings\Temp\poolsv.exe Infected: Trojan-Downloader.Win32.VB.aya skipped

C:\Documents and Settings\Melissa\Local Settings\Temporary Internet Files\Content.IE5\6ROVFC94\idien[1] Infected: Trojan.Win32.Agent.aoy skipped

C:\Documents and Settings\Melissa\Local Settings\Temporary Internet Files\Content.IE5\MN4VY1W7\kcehc_eicooc20070702[1] Infected: Trojan-Downloader.Win32.Tiny.id skipped

C:\Documents and Settings\Melissa\Local Settings\Temporary Internet Files\Content.IE5\MN4VY1W7\_affvm[1] Infected: not-a-virus:AdWare.Win32.Virtumonde.kp skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

C:\hp\bin\KillWind.exe Infected: not-a-virus:RiskTool.Win32.PsKill.p skipped

C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\EENGINE\EPERSIST.DAT Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SNDALRT.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SNDCON.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SNDDBG.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SNDFW.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SNDIDS.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SNDSYS.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBConfig.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBDebug.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBDetect.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBNotify.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBRefr.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetCfg.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetCfg2.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetDev.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetLoc.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetUsr.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMNot.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMReg.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMRSt.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBStHash.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBStMSI.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBValid.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPPolicy.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPStart.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPStop.log Object is locked skipped

C:\Program Files\Common Files\Verizon Online\SFP\vzbb.dll Infected: not-a-virus:AdWare.Win32.MegaSearch.b skipped

C:\Program Files\Common Files\Yazzle1549OinAdmin.exe Infected: Trojan-Downloader.Win32.PurityScan.eg skipped

C:\Program Files\Hijackthis\backups\backup-20070813-211749-385.dll Infected: Trojan.Win32.BHO.ab skipped

C:\Program Files\Hijackthis\backups\backup-20070813-211749-408.dll Infected: not-a-virus:AdWare.Win32.TTC.b skipped

C:\Program Files\Hijackthis\backups\backup-20070813-211749-469.dll Infected: not-a-virus:AdWare.Win32.TTC.a skipped

C:\Program Files\Hijackthis\backups\backup-20070813-211749-751.dll Infected: not-a-virus:AdWare.Win32.Agent.co skipped

C:\Program Files\MSN\lacuryh.dll Infected: Trojan.Win32.BHO.ab skipped

C:\Program Files\MSN Gaming Zone\hoqex4444.dll Infected: not-a-virus:AdWare.Win32.TTC.a skipped

C:\Program Files\MSN Gaming Zone\hoqex83122.dll Infected: not-a-virus:AdWare.Win32.TTC.b skipped

C:\Program Files\Norton AntiVirus\AVApp.log Object is locked skipped

C:\Program Files\Norton AntiVirus\AVError.log Object is locked skipped

C:\Program Files\Norton AntiVirus\AVVirus.log Object is locked skipped

C:\Program Files\Norton AntiVirus\Savrt187NAV~.TMP Object is locked skipped

C:\Program Files\Norton AntiVirus\Savrt733NAV~.TMP Object is locked skipped

C:\Program Files\Updates from HP\309731\Users\Default\Data\chandir.dat Object is locked skipped

C:\Program Files\Updates from HP\309731\Users\Default\Data\chandir.idx Object is locked skipped

C:\Program Files\Updates from HP\309731\Users\Default\Data\chn.dat Object is locked skipped

C:\Program Files\Updates from HP\309731\Users\Default\Data\chn.idx Object is locked skipped

C:\Program Files\Updates from HP\309731\Users\Default\Data\D0000000.FCS Object is locked skipped

C:\Program Files\Updates from HP\309731\Users\Default\Data\inuse.txt Object is locked skipped

C:\Program Files\Updates from HP\309731\Users\Default\Data\L0000006.FCS Object is locked skipped

C:\Program Files\Updates from HP\309731\Users\Default\Data\main.log Object is locked skipped

C:\Program Files\Updates from HP\309731\Users\Default\Data\prs.dat Object is locked skipped

C:\Program Files\Updates from HP\309731\Users\Default\Data\prs.idx Object is locked skipped

C:\Program Files\Updates from HP\309731\Users\Default\Data\prs_die.dat Object is locked skipped

C:\Program Files\Updates from HP\309731\Users\Default\Data\prs_die.idx Object is locked skipped

C:\Program Files\Updates from HP\309731\Users\Default\Data\prs_dnd.dat Object is locked skipped

C:\Program Files\Updates from HP\309731\Users\Default\Data\prs_dnd.idx Object is locked skipped

C:\Program Files\Updates from HP\309731\Users\Default\Data\prs_ext.dat Object is locked skipped

C:\Program Files\Updates from HP\309731\Users\Default\Data\prs_ext.idx Object is locked skipped

C:\Program Files\Updates from HP\309731\Users\Default\Data\prs_rcv.dat Object is locked skipped

C:\Program Files\Updates from HP\309731\Users\Default\Data\prs_rcv.idx Object is locked skipped

C:\Program Files\Updates from HP\309731\Users\Default\Data\storydb.dat Object is locked skipped

C:\Program Files\Updates from HP\309731\Users\Default\Data\storydb.idx Object is locked skipped

C:\Program Files\Verizon Online\log\mpbtn.log Object is locked skipped

C:\Program Files\Verizon Online\SmartBridge\log\httpclient.log Object is locked skipped

C:\Program Files\Verizon Online\SmartBridge\SmartBridge.log Object is locked skipped

C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

C:\System Volume Information\_restore{02818594-CB0B-43E3-8139-587D9EF98970}\RP629\A0049247.exe Infected: not-a-virus:AdWare.Win32.Agent.co skipped

C:\System Volume Information\_restore{02818594-CB0B-43E3-8139-587D9EF98970}\RP629\A0049258.exe Infected: Trojan-Clicker.Win32.Small.jf skipped

C:\System Volume Information\_restore{02818594-CB0B-43E3-8139-587D9EF98970}\RP629\A0049321.exe Infected: Trojan-Downloader.Win32.Agent.bls skipped

C:\System Volume Information\_restore{02818594-CB0B-43E3-8139-587D9EF98970}\RP629\A0049323.exe Infected: Trojan-Clicker.Win32.Small.jf skipped

C:\System Volume Information\_restore{02818594-CB0B-43E3-8139-587D9EF98970}\RP629\A0049326.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.kp skipped

C:\System Volume Information\_restore{02818594-CB0B-43E3-8139-587D9EF98970}\RP630\A0049532.exe Infected: Trojan-Clicker.Win32.Small.jf skipped

C:\System Volume Information\_restore{02818594-CB0B-43E3-8139-587D9EF98970}\RP630\A0049579.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.lh skipped

C:\System Volume Information\_restore{02818594-CB0B-43E3-8139-587D9EF98970}\RP630\A0049707.exe Infected: Trojan-Clicker.Win32.Small.jf skipped

C:\System Volume Information\_restore{02818594-CB0B-43E3-8139-587D9EF98970}\RP633\A0050101.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.hb skipped

C:\System Volume Information\_restore{02818594-CB0B-43E3-8139-587D9EF98970}\RP634\A0050157.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.lh skipped

C:\System Volume Information\_restore{02818594-CB0B-43E3-8139-587D9EF98970}\RP634\A0050190.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.lh skipped

C:\System Volume Information\_restore{02818594-CB0B-43E3-8139-587D9EF98970}\RP634\A0050224.exe/data0002 Infected: not-a-virus:AdWare.Win32.TTC.a skipped

C:\System Volume Information\_restore{02818594-CB0B-43E3-8139-587D9EF98970}\RP634\A0050224.exe NSIS: infected - 1 skipped

C:\System Volume Information\_restore{02818594-CB0B-43E3-8139-587D9EF98970}\RP634\A0050225.exe Infected: Trojan.Win32.BHO.ab skipped

C:\System Volume Information\_restore{02818594-CB0B-43E3-8139-587D9EF98970}\RP634\A0050227.exe Infected: Trojan-Clicker.Win32.Small.jf skipped

C:\System Volume Information\_restore{02818594-CB0B-43E3-8139-587D9EF98970}\RP634\A0050231.dll Infected: not-a-virus:AdWare.Win32.TTC.a skipped

C:\System Volume Information\_restore{02818594-CB0B-43E3-8139-587D9EF98970}\RP634\A0050274.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.hb skipped

C:\System Volume Information\_restore{02818594-CB0B-43E3-8139-587D9EF98970}\RP634\A0050306.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.kp skipped

C:\System Volume Information\_restore{02818594-CB0B-43E3-8139-587D9EF98970}\RP635\A0050319.exe/data0002 Infected: not-a-virus:AdWare.Win32.TTC.a skipped

C:\System Volume Information\_restore{02818594-CB0B-43E3-8139-587D9EF98970}\RP635\A0050319.exe NSIS: infected - 1 skipped

C:\System Volume Information\_restore{02818594-CB0B-43E3-8139-587D9EF98970}\RP635\A0050320.exe Infected: Trojan.Win32.BHO.ab skipped

C:\System Volume Information\_restore{02818594-CB0B-43E3-8139-587D9EF98970}\RP635\A0050321.exe Infected: Trojan-Clicker.Win32.Small.jf skipped

C:\System Volume Information\_restore{02818594-CB0B-43E3-8139-587D9EF98970}\RP635\A0050330.dll Infected: not-a-virus:AdWare.Win32.TTC.a skipped

C:\System Volume Information\_restore{02818594-CB0B-43E3-8139-587D9EF98970}\RP635\A0050358.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped

C:\System Volume Information\_restore{02818594-CB0B-43E3-8139-587D9EF98970}\RP635\A0050359.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped

C:\System Volume Information\_restore{02818594-CB0B-43E3-8139-587D9EF98970}\RP635\A0050361.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.kp skipped

C:\System Volume Information\_restore{02818594-CB0B-43E3-8139-587D9EF98970}\RP635\A0050362.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.la skipped

C:\System Volume Information\_restore{02818594-CB0B-43E3-8139-587D9EF98970}\RP635\A0050381.exe/data0005 Infected: Trojan-Downloader.Win32.VB.awj skipped

C:\System Volume Information\_restore{02818594-CB0B-43E3-8139-587D9EF98970}\RP635\A0050381.exe NSIS: infected - 1 skipped

C:\System Volume Information\_restore{02818594-CB0B-43E3-8139-587D9EF98970}\RP635\A0050382.exe Infected: Trojan-Downloader.Win32.Small.eqn skipped

C:\System Volume Information\_restore{02818594-CB0B-43E3-8139-587D9EF98970}\RP635\A0050383.exe/data0002 Infected: Trojan-Downloader.Win32.PurityScan.eg skipped

C:\System Volume Information\_restore{02818594-CB0B-43E3-8139-587D9EF98970}\RP635\A0050383.exe NSIS: infected - 1 skipped

C:\System Volume Information\_restore{02818594-CB0B-43E3-8139-587D9EF98970}\RP635\A0050384.exe Infected: Trojan-Downloader.Win32.VB.aya skipped

C:\System Volume Information\_restore{02818594-CB0B-43E3-8139-587D9EF98970}\RP635\A0050385.exe Infected: Trojan-Downloader.Win32.Agent.bls skipped

C:\System Volume Information\_restore{02818594-CB0B-43E3-8139-587D9EF98970}\RP635\A0050386.exe Infected: Trojan-Downloader.Win32.Agent.bls skipped

C:\System Volume Information\_restore{02818594-CB0B-43E3-8139-587D9EF98970}\RP635\A0050391.exe/data0005 Infected: Trojan-Downloader.Win32.VB.awj skipped

C:\System Volume Information\_restore{02818594-CB0B-43E3-8139-587D9EF98970}\RP635\A0050391.exe NSIS: infected - 1 skipped

C:\System Volume Information\_restore{02818594-CB0B-43E3-8139-587D9EF98970}\RP635\A0050392.exe Infected: Trojan-Downloader.Win32.VB.aya skipped

C:\System Volume Information\_restore{02818594-CB0B-43E3-8139-587D9EF98970}\RP635\A0050393.exe Infected: Trojan-Downloader.Win32.Agent.bls skipped

C:\System Volume Information\_restore{02818594-CB0B-43E3-8139-587D9EF98970}\RP635\A0050394.exe Infected: Trojan-Downloader.Win32.Agent.bls skipped

C:\System Volume Information\_restore{02818594-CB0B-43E3-8139-587D9EF98970}\RP635\A0050395.exe Infected: Trojan-Downloader.Win32.Small.eqn skipped

C:\System Volume Information\_restore{02818594-CB0B-43E3-8139-587D9EF98970}\RP635\A0050396.exe/data0002 Infected: Trojan-Downloader.Win32.PurityScan.eg skipped

C:\System Volume Information\_restore{02818594-CB0B-43E3-8139-587D9EF98970}\RP635\A0050396.exe NSIS: infected - 1 skipped

C:\System Volume Information\_restore{02818594-CB0B-43E3-8139-587D9EF98970}\RP638\change.log Object is locked skipped

C:\VundoFix Backups\byxustu.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped

C:\VundoFix Backups\byxxvtt.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped

C:\VundoFix Backups\dnmrxhdk.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.kp skipped

C:\VundoFix Backups\gebya.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.la skipped

C:\WINDOWS\$hf_mig$\KB873333\SP2QFE\olecnv32.dll Infected: Email-Worm.Win32.Brontok.a skipped

C:\WINDOWS\$hf_mig$\KB894391\SP2QFE\olecnv32.dll Infected: Email-Worm.Win32.Brontok.a skipped

C:\WINDOWS\$hf_mig$\KB902400\SP2QFE\olecnv32.dll Infected: Email-Worm.Win32.Brontok.a skipped

C:\WINDOWS\$NtUninstallKB894391$\olecnv32.dll Infected: Email-Worm.Win32.Brontok.a skipped

C:\WINDOWS\$NtUninstallKB902400$\olecnv32.dll Infected: Email-Worm.Win32.Brontok.a skipped

C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

C:\WINDOWS\ModemLog_Agere Systems PCI Soft Modem.txt Object is locked skipped

C:\WINDOWS\SchedLgU.Txt Object is locked skipped

C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped

C:\WINDOWS\Sti_Trace.log Object is locked skipped

C:\WINDOWS\system32\aectnbec.exe Infected: Trojan.Win32.Agent.aoy skipped

C:\WINDOWS\system32\akxbyqow.exe Infected: Trojan-Dropper.Win32.Agent.bmk skipped

C:\WINDOWS\system32\b10FdUe\b10FdUe1099.exe Infected: Trojan-Downloader.Win32.VB.awj skipped

C:\WINDOWS\system32\cdpkscjp.exe Infected: Trojan.Win32.Agent.aoy skipped

C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\default Object is locked skipped

C:\WINDOWS\system32\config\default.LOG Object is locked skipped

C:\WINDOWS\system32\config\SAM Object is locked skipped

C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\SECURITY Object is locked skipped

C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped

C:\WINDOWS\system32\config\software Object is locked skipped

C:\WINDOWS\system32\config\software.LOG Object is locked skipped

C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\system Object is locked skipped

C:\WINDOWS\system32\config\system.LOG Object is locked skipped

C:\WINDOWS\system32\ddgbbslx.exe Infected: Trojan-Dropper.Win32.Agent.bmk skipped

C:\WINDOWS\system32\dllcache\olecnv32.dll Infected: Email-Worm.Win32.Brontok.a skipped

C:\WINDOWS\system32\G1\kmhp83122.exe/data0002 Infected: not-a-virus:AdWare.Win32.TTC.b skipped

C:\WINDOWS\system32\G1\kmhp83122.exe NSIS: infected - 1 skipped

C:\WINDOWS\system32\G3\wr725.exe Infected: Trojan-Downloader.Win32.Small.eqn skipped

C:\WINDOWS\system32\h323log.txt Object is locked skipped

C:\WINDOWS\system32\hxkbeful.exe Infected: Trojan-Dropper.Win32.Agent.bmk skipped

C:\WINDOWS\system32\iicljstx.exe Infected: Trojan-Dropper.Win32.Agent.bmk skipped

C:\WINDOWS\system32\jtqrxvjw.exe Infected: Trojan.Win32.Agent.aoy skipped

C:\WINDOWS\system32\nxcjsnxj.exe Infected: Trojan-Dropper.Win32.Agent.bmk skipped

C:\WINDOWS\system32\olecnv32.dll Infected: Email-Worm.Win32.Brontok.a skipped

C:\WINDOWS\system32\omcdphhs.exe Infected: Trojan.Win32.Agent.aoy skipped

C:\WINDOWS\system32\qeowswkn.exe Infected: Trojan.Win32.Agent.aoy skipped

C:\WINDOWS\system32\rhpnpatv.exe Infected: Trojan.Win32.Agent.aoy skipped

C:\WINDOWS\system32\slbaxqxg.exe Infected: Trojan.Win32.Agent.aoy skipped

C:\WINDOWS\system32\twcerbn.dll Infected: not-a-virus:AdWare.Win32.Agent.co skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped

C:\WINDOWS\system32\xriptpjb.exe Infected: Trojan-Dropper.Win32.Agent.bmk skipped

C:\WINDOWS\tk58.exe Infected: Trojan.Win32.BHO.ab skipped

C:\WINDOWS\TTC-4444.exe/data0002 Infected: not-a-virus:AdWare.Win32.TTC.a skipped

C:\WINDOWS\TTC-4444.exe NSIS: infected - 1 skipped

C:\WINDOWS\wiadebug.log Object is locked skipped

C:\WINDOWS\wiaservc.log Object is locked skipped

C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.


Logfile of HijackThis v1.99.1
Scan saved at 12:19:28 PM, on 8/16/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\STOPzilla!\SZServer.exe
c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\Explorer.EXE
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\hphmon06.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\support.com\bin\tgcmd.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\PROGRA~1\VERIZO~1\SMARTB~1\MotiveSB.exe
C:\Program Files\STOPzilla!\STOPzilla.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft Money\System\mnyexpr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Updates from HP\309731\Program\Updates from HP.exe
C:\Program Files\Verizon Online\bin\mpbtn.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\COMMON~1\MICROS~1\Msinfo\OFFPROV.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\freecell.exe
C:\Program Files\Hijackthis\FindVundo.exe.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com/avcenter/fix_homepage/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Verizon Online
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - C:\PROGRA~1\COMMON~1\VERIZO~1\SFP\vzbb.dll
O2 - BHO: (no name) - {695e7671-ecad-4a95-9ffc-50e73e839d1e} - C:\WINDOWS\system32\twcerbn.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - c:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: STOPzilla Browser Helper Object - {E3215F20-3212-11D6-9F8B-00D0B743919D} - C:\Program Files\STOPzilla!\SZIEBHO.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O3 - Toolbar: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - C:\PROGRA~1\COMMON~1\VERIZO~1\SFP\vzbb.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPHUPD06] c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\support.com\bin\tgcmd.exe" /server
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\VERIZO~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [STOPzilla] C:\Program Files\STOPzilla!\STOPzilla.exe /autostart
O4 - HKLM\..\Run: [HPHUPD08] C:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
O4 - HKLM\..\Run: [AutoTBar] c:\Program Files\HP\Digital Imaging\bin\AUTOTBAR.EXE
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: Creating Keepsakes Scrapbook Designer Event Reminder.lnk = C:\Program Files\Scrapbook Designer\scrapremind.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\309731\Program\Updates from HP.exe
O4 - Global Startup: Verizon Online Support Center.lnk = C:\Program Files\Verizon Online\bin\matcli.exe
O8 - Extra context menu item: Add To HP Organize… - C:\PROGRA~1\HEWLET~1\HPORGA~1\bin\core.hp.main\SendTo.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: ComcastHSI - {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - http://www.comcast.net/ (file missing)
O9 - Extra button: Support - {8828075D-D097-4055-AA02-2DBFA9D85E8A} - http://www.comcastsupport.com/ (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Help - {97809617-3937-4F84-B335-9BB05EF1A8D4} - http://online.comcast.net/help/ (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/…ro.cab56649.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{21E77DDB-9C76-4FF5-BAC1-0A8027E427C2}: NameServer = 198.6.100.125 198.6.1.125
O17 - HKLM\System\CS1\Services\Tcpip\..\{21E77DDB-9C76-4FF5-BAC1-0A8027E427C2}: NameServer = 198.6.100.125 198.6.1.125
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: STOPzilla Service (szserver) - Unknown owner - C:\Program Files\Common Files\STOPzilla!\SZServer.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
Post #28
Hi,

Good job. Kaspersky has turned up some interesting items. Which means I need another scan run, but Combofix is not an online scan and is a fairly small download. I'd also like you to do some cleanup with ATFCleaner.


Use ATF Cleaner to remove temp files,
cookies, cache, ect…
Please download ATF Cleaner by Atribune.
This program is for XP and Windows 2000 onlyDouble-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.



Download and Run ComboFix
  • Download this file from below:
    Here
  • Disconnect from the Internet, than disable your Anti-virus and any real-time Anti-spyware monitors that are running.
  • Then double click Combofix.exe & follow the prompts.
  • When finished, it shall produce a log for you. Post that log in your next reply with a new HijackThis log.
Note 1: Do not mouseclick combofix's window whilst it's running. That may cause it to stall
Note 2:Remember to re-enable your Anti-virus and Anti-spyware before reconnecting to the Internet.
Post #30
I'm assuming you use Internet Explorer. If you were using either one of the other ones you would likely know it. Hope that clears it up.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI