WE'RE SURE THAT YOU'LL LOVE US!

Hey there! :wub: Looks like you're enjoying the discussion, but you're not signed up for an account. When you create an account, we remember exactly what you've read, so you always come right back where you left off. You also get notifications, here and via email, whenever new posts are made. You can like posts to share the love. Join 93112 other members! Anybody can ask, anybody can answer. Consistently helpful members may be invited to become staff. Here's how it works. Virus cleanup? Start here -> Malware Removal Forum.

Try What the Tech -- It's free!

Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

[Closed]Virtumonde

Started by CHIEFS5140 , Aug 13 2007 08:36 PM

This topic is locked

7 replies to this topic

#1 CHIEFS5140

New Member

New Member
3 posts

Posted 13 August 2007 - 08:36 PM

Logfile of HijackThis v1.99.1
Scan saved at 10:02, on 2007-08-13
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\basfipm.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Microsoft SQL Server\MSSQL$NR2005\Binn\sqlservr.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\iolo\System Mechanic 6\SMSystemAnalyzer.exe
C:\Program Files\iolo\System Mechanic 6\PopupBlocker.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Apoint\HidFind.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\Ad-Watch2007.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\YTBSDK.exe
C:\Program Files\Verizon Wireless\VZAccess Manager\VZAccess Manager.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Administrator\Desktop\hijackthis\HijackThis.exe
C:\WINDOWS\SoftwareDistribution\Download\208c1a8c52f47d7b2df4baa21f58d3da\update\update.exe
C:\WINDOWS\system32\HPZinw12.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c.../search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.c...//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.c...//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [bascstray] BascsTray.exe
O4 - HKLM\..\Run: [Apoint] "C:\Program Files\Apoint\Apoint.exe"
O4 - HKLM\..\Run: [ioloDelayModule] "C:\Program Files\iolo\System Mechanic 6\delay.exe"
O4 - HKLM\..\Run: [Ad-Watch] "C:\Program Files\Lavasoft\Ad-Aware 2007\Ad-Watch2007.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] "C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [SMSystemAnalyzer] "C:\Program Files\iolo\System Mechanic 6\SMSystemAnalyzer.exe"
O4 - HKCU\..\Run: [System Mechanic Popup Blocker] "C:\Program Files\iolo\System Mechanic 6\PopupBlocker.exe"
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell....iler/SysPro.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.c...nst20040510.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/b...lineScanner.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onec...lscbase8300.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.mi...b?1185414623205
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1180210649294
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.m...ash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C871C1A8-D8E1-43F2-95AA-288AE30B1DFD}: NameServer = 66.174.95.44 66.174.92.14
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Broadcom ASF IP monitoring service v6.0.3 (BAsfIpM) - Broadcom Corp. - C:\WINDOWS\system32\basfipm.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
O23 - Service: Intel® PROSet/Wireless SSO Service (WLANKEEPER) - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
HAD VIRTUMONDE VIRUS OR SPYWARE , REMOVED ,MOST OF IT. NOTE: THIS PROBLEM ALSO INSTALLED A VSO IN DEVICE HARDWARE SECTION ,IT WOULD NOT BOOT UP IN SAFE MODE UNTIL I DELETED, THATS FIX, HOWEVER WILL NOT LET ME
INSTALL XP UPDATES, ERROR MESSAGE IS , UPDATES FAILED TO INSTALL THANKS SO MUCH

Edited by CHIEFS5140, 13 August 2007 - 08:45 PM.

Advertisements

Register to Remove

#2 LDTate

Grand Poobah

Root Admin
57,211 posts

Posted 18 August 2007 - 08:45 AM

Hello and welcome to the forums

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»

Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time.

Next:

Download ComboFix from Here to your Desktop.

Double click combofix.exe and follow the prompts.
When finished, it shall produce a log for you, combofix.txt. Post that log and a HiJackthis log in your next reply

Note: Do not mouseclick while its running. That may cause it to stall

The forum is run by volunteers who donate their time and expertise.

Want to help others? Join the ClassRoom and learn how.

Logs will be closed if you haven't replied within 3 days

If you would like to for the help you received.

Proud graduate of TC/WTT Classroom

#3 CHIEFS5140

New Member

New Member
3 posts

Posted 18 August 2007 - 01:34 PM

VERY THANKFUL FOR YOUR EFFORTS , DAN
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1367 [GMT -4:00]
* Created a new restore point

((((((((((((((((((((((((( Files Created from 2007-07-17 to 2007-08-17 )))))))))))))))))))))))))))))))

2007-08-17 10:40 <DIR> d-------- C:\WINDOWS\LastGood
2007-08-17 02:57 53,248 --a------ C:\WINDOWS\system32\Process.exe
2007-08-17 02:57 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2007-08-17 02:57 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2007-08-17 02:57 1,880 --a------ C:\WINDOWS\system32\tmp.reg
2007-08-14 02:38 8,192 --a--c--- C:\WINDOWS\system32\dllcache\wshirda.dll
2007-08-12 23:07 <DIR> d-------- C:\WINDOWS\CSC
2007-08-12 11:46 <DIR> d-------- C:\Program Files\Common Files\Ahead
2007-08-12 11:46 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Nero
2007-08-11 22:51 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-08-10 18:22 4,608 --a--c--- C:\WINDOWS\system32\dllcache\xrxflnch.exe
2007-08-10 18:22 27,648 --a--c--- C:\WINDOWS\system32\dllcache\xrxftplt.exe
2007-08-10 18:22 23,040 --a--c--- C:\WINDOWS\system32\dllcache\xrxwbtmp.dll
2007-08-10 18:22 17,408 --a--c--- C:\WINDOWS\system32\dllcache\xrxscnui.dll
2007-08-10 18:22 116,224 --a--c--- C:\WINDOWS\system32\dllcache\xrxwiadr.dll
2007-08-10 18:21 99,865 --a--c--- C:\WINDOWS\system32\dllcache\xlog.exe
2007-08-10 18:21 19,455 --a--c--- C:\WINDOWS\system32\dllcache\wvchntxx.sys
2007-08-10 18:21 19,328 --a--c--- C:\WINDOWS\system32\dllcache\wstcodec.sys
2007-08-10 18:21 16,970 --a--c--- C:\WINDOWS\system32\dllcache\xem336n5.sys
2007-08-10 18:21 12,063 --a--c--- C:\WINDOWS\system32\dllcache\wsiintxx.sys
2007-08-10 18:20 8,832 --a--c--- C:\WINDOWS\system32\dllcache\wmiacpi.sys
2007-08-10 18:20 771,581 --a--c--- C:\WINDOWS\system32\dllcache\winacisa.sys
2007-08-10 18:20 701,386 --a--c--- C:\WINDOWS\system32\dllcache\wdhaalba.sys
2007-08-10 18:20 53,760 --a--c--- C:\WINDOWS\system32\dllcache\wiamsmud.dll
2007-08-10 18:20 41,600 --a--c--- C:\WINDOWS\system32\dllcache\weitekp9.dll
2007-08-10 18:20 35,871 --a--c--- C:\WINDOWS\system32\dllcache\wbfirdma.sys
2007-08-10 18:20 34,890 --a--c--- C:\WINDOWS\system32\dllcache\wlandrv2.sys
2007-08-10 18:20 31,744 --a--c--- C:\WINDOWS\system32\dllcache\wceusbsh.sys
2007-08-10 18:20 31,232 --a--c--- C:\WINDOWS\system32\dllcache\weitekp9.sys
2007-08-10 18:20 23,615 --a--c--- C:\WINDOWS\system32\dllcache\wch7xxnt.sys
2007-08-10 18:20 154,624 --a--c--- C:\WINDOWS\system32\dllcache\wlluc48.sys
2007-08-10 18:19 86,073 --a--c--- C:\WINDOWS\system32\dllcache\voicesub.dll
2007-08-10 18:19 64,605 --a--c--- C:\WINDOWS\system32\dllcache\vvoice.sys
2007-08-10 18:19 48,256 --a--c--- C:\WINDOWS\system32\dllcache\w32.dll
2007-08-10 18:19 397,502 --a--c--- C:\WINDOWS\system32\dllcache\vpctcom.sys
2007-08-10 18:19 33,599 --a--c--- C:\WINDOWS\system32\dllcache\watv04nt.sys
2007-08-10 18:19 29,311 --a--c--- C:\WINDOWS\system32\dllcache\watv01nt.sys
2007-08-10 18:19 25,471 --a--c--- C:\WINDOWS\system32\dllcache\watv10nt.sys
2007-08-10 18:19 22,271 --a--c--- C:\WINDOWS\system32\dllcache\watv06nt.sys
2007-08-10 18:19 19,551 --a--c--- C:\WINDOWS\system32\dllcache\watv02nt.sys
2007-08-10 18:19 19,528 --a--c--- C:\WINDOWS\system32\dllcache\w840nd.sys
2007-08-10 18:19 19,016 --a--c--- C:\WINDOWS\system32\dllcache\w926nd.sys
2007-08-10 18:19 16,925 --a--c--- C:\WINDOWS\system32\dllcache\w940nd.sys
2007-08-10 18:19 13,568 --a--c--- C:\WINDOWS\system32\dllcache\wacompen.sys
2007-08-10 18:19 12,415 --a--c--- C:\WINDOWS\system32\dllcache\wadv01nt.sys
2007-08-10 18:19 12,127 --a--c--- C:\WINDOWS\system32\dllcache\wadv02nt.sys
2007-08-10 18:19 11,935 --a--c--- C:\WINDOWS\system32\dllcache\wadv11nt.sys
2007-08-10 18:19 11,871 --a--c--- C:\WINDOWS\system32\dllcache\wadv09nt.sys
2007-08-10 18:19 11,807 --a--c--- C:\WINDOWS\system32\dllcache\wadv07nt.sys
2007-08-10 18:19 11,775 --a--c--- C:\WINDOWS\system32\dllcache\wadv05nt.sys
2007-08-10 18:19 11,295 --a--c--- C:\WINDOWS\system32\dllcache\wadv08nt.sys
2007-08-10 18:18 765,884 --a--c--- C:\WINDOWS\system32\dllcache\usrti.sys
2007-08-10 18:18 7,556 --a--c--- C:\WINDOWS\system32\dllcache\usroslba.sys
2007-08-10 18:18 687,999 --a--c--- C:\WINDOWS\system32\dllcache\usrwdxjs.sys
2007-08-10 18:18 604,253 --a--c--- C:\WINDOWS\system32\dllcache\vmodem.sys
2007-08-10 18:18 53,760 --a--c--- C:\WINDOWS\system32\dllcache\vfwwdm32.dll
2007-08-10 18:18 5,376 --a--c--- C:\WINDOWS\system32\dllcache\viaide.sys
2007-08-10 18:18 426,041 --a--c--- C:\WINDOWS\system32\dllcache\voicepad.dll
2007-08-10 18:18 249,402 --a--c--- C:\WINDOWS\system32\dllcache\vinwm.sys
2007-08-10 18:18 24,576 --a--c--- C:\WINDOWS\system32\dllcache\viairda.sys
2007-08-10 18:18 113,762 --a--c--- C:\WINDOWS\system32\dllcache\usrpda.sys
2007-08-10 18:18 11,325 --a--c--- C:\WINDOWS\system32\dllcache\vchnt5.dll
2007-08-10 18:17 94,720 --a--c--- C:\WINDOWS\system32\dllcache\umaxud32.dll
2007-08-10 18:17 794,654 --a--c--- C:\WINDOWS\system32\dllcache\usr1801.sys
2007-08-10 18:17 794,399 --a--c--- C:\WINDOWS\system32\dllcache\usr1806v.sys
2007-08-10 18:17 793,598 --a--c--- C:\WINDOWS\system32\dllcache\usr1806.sys
2007-08-10 18:17 78,464 --a--c--- C:\WINDOWS\system32\dllcache\usbvideo.sys
2007-08-10 18:17 76,288 --a--c--- C:\WINDOWS\system32\dllcache\uniime.dll
2007-08-10 18:17 59,264 --a--c--- C:\WINDOWS\system32\dllcache\usbaudio.sys
2007-08-10 18:17 32,384 --a--c--- C:\WINDOWS\system32\dllcache\usb101et.sys
2007-08-10 18:17 28,160 --a--c--- C:\WINDOWS\system32\dllcache\umaxu40.dll
2007-08-10 18:17 25,600 --a--c--- C:\WINDOWS\system32\dllcache\usbser.sys
2007-08-10 18:17 224,802 --a--c--- C:\WINDOWS\system32\dllcache\usr1807a.sys
2007-08-10 18:17 12,672 --a--c--- C:\WINDOWS\system32\dllcache\usb8023x.sys
2007-08-10 18:16 69,632 --a--c--- C:\WINDOWS\system32\dllcache\umaxu12.dll
2007-08-10 18:16 50,688 --a--c--- C:\WINDOWS\system32\dllcache\umaxscan.dll
2007-08-10 18:16 50,176 --a--c--- C:\WINDOWS\system32\dllcache\umaxp60.dll
2007-08-10 18:16 47,616 --a--c--- C:\WINDOWS\system32\dllcache\umaxcam.dll
2007-08-10 18:16 36,736 --a--c--- C:\WINDOWS\system32\dllcache\ultra.sys
2007-08-10 18:16 26,624 --a--c--- C:\WINDOWS\system32\dllcache\umaxu22.dll
2007-08-10 18:16 22,912 --a--c--- C:\WINDOWS\system32\dllcache\umaxpcls.sys
2007-08-10 18:16 216,064 --a--c--- C:\WINDOWS\system32\dllcache\um34scan.dll
2007-08-10 18:16 211,968 --a--c--- C:\WINDOWS\system32\dllcache\um54scan.dll
2007-08-10 18:15 525,568 --a--c--- C:\WINDOWS\system32\dllcache\tridxp.dll
2007-08-10 18:15 440,576 --a--c--- C:\WINDOWS\system32\dllcache\tridkb.dll
2007-08-10 18:15 34,375 --a--c--- C:\WINDOWS\system32\dllcache\tpro4.sys
2007-08-10 18:15 315,520 --a--c--- C:\WINDOWS\system32\dllcache\trid3d.dll
2007-08-10 18:15 222,336 --a--c--- C:\WINDOWS\system32\dllcache\trid3dm.sys
2007-08-10 18:15 166,784 --a--c--- C:\WINDOWS\system32\dllcache\tridxpm.sys
2007-08-10 18:15 159,232 --a--c--- C:\WINDOWS\system32\dllcache\tridkbm.sys
2007-08-10 18:15 14,336 --a--c--- C:\WINDOWS\system32\dllcache\tsprof.exe
2007-08-10 18:15 11,520 --a--c--- C:\WINDOWS\system32\dllcache\twotrack.sys
2007-08-10 18:14 82,432 --a--c--- C:\WINDOWS\system32\dllcache\tp4mon.exe
2007-08-10 18:14 455,168 --a--c--- C:\WINDOWS\system32\dllcache\tintsetp.exe
2007-08-10 18:14 44,032 --a--c--- C:\WINDOWS\system32\dllcache\tintlphr.exe
2007-08-10 18:14 42,496 --a--c--- C:\WINDOWS\system32\dllcache\tp4res.dll
2007-08-10 18:14 4,992 --a--c--- C:\WINDOWS\system32\dllcache\toside.sys
2007-08-10 18:14 31,744 --a--c--- C:\WINDOWS\system32\dllcache\tp4.dll
2007-08-10 18:14 28,232 --a--c--- C:\WINDOWS\system32\dllcache\tos4mo.sys
2007-08-10 18:14 241,664 --a--c--- C:\WINDOWS\system32\dllcache\tosdvd02.sys

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-17 11:04 9344 --a------ C:\WINDOWS\system32\drivers\NSDriver.sys
2007-08-17 11:04 8320 --a------ C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-08-13 03:39 --------- d-------- C:\Program Files\FPFS
2007-08-09 01:38 --------- d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-08-01 00:18 1731307 --ahs---- C:\WINDOWS\system32\uwwxx.bak2
2007-07-29 11:57 --------- d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\uTorrent
2007-07-26 16:19 --------- d-------- C:\Program Files\Online Services
2007-07-16 16:40 --------- d-------- C:\Program Files\ResumeMaker
2007-07-16 14:50 --------- d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\AdobeUM
2007-07-12 23:17 6369 --ahs---- C:\WINDOWS\system32\uwwxx.bak1
2007-07-08 22:50 249856 --a------ C:\WINDOWS\Setup1.exe
2007-07-08 19:01 --------- d-------- C:\Program Files\Nero
2007-07-06 01:19 --------- d--h----- C:\Program Files\InstallShield Installation Information
2007-07-06 00:39 --------- d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Brother
2007-07-03 17:41 132904 --a------ C:\WINDOWS\system32\drivers\imagesrv.sys
2007-07-03 17:40 11304 --a------ C:\WINDOWS\system32\drivers\imagedrv.sys
2007-06-27 19:05 972072 --a------ C:\WINDOWS\UNNeroMediaHome.exe
2007-06-26 21:20 --------- d-------- C:\Program Files\Four_Pillars_Finance
2007-06-26 14:12 972072 --a------ C:\WINDOWS\UNNeroVision.exe
2007-06-25 23:39 73216 --a------ C:\WINDOWS\ST6UNST.EXE
2007-06-25 08:47 38440 --a------ C:\WINDOWS\system32\drivers\InCDRm.sys
2007-06-25 08:47 36776 --a------ C:\WINDOWS\system32\drivers\InCDPass.sys
2007-06-25 08:47 238888 --a------ C:\WINDOWS\NuNInst.exe
2007-06-25 08:47 16040 --a------ C:\WINDOWS\system32\drivers\InCDrec.sys
2007-06-25 08:47 119080 --a------ C:\WINDOWS\system32\drivers\InCDfs.sys
2007-06-24 23:27 --------- d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Help
2007-06-24 23:26 --------- d-------- C:\Program Files\VoiceSync
2007-06-13 11:10 77824 --a------ C:\WINDOWS\system32\OnlineScannerUninstaller.exe
2007-05-28 04:20 112910705 --a------ C:\NR_Pro_v213-v255.sfx.exe
2007-05-28 03:36 47360 --a------ C:\DOCUME~1\ADMINI~1\APPLIC~1\pcouffin.sys
2007-05-28 03:35 3334488 --a------ C:\DVDFabDecrypter3050.exe
2007-05-28 03:30 330930 --a------ C:\dvdgn410.exe
2007-05-28 02:10 180351392 --a------ C:\Nero-7.9.6.0_eng_update.exe
2007-05-27 02:52 28672 --a------ C:\WINDOWS\system32\qttask.exe
2007-05-27 01:50 5149152 --a------ C:\rminstall.exe
2007-05-27 00:53 6722094 --a------ C:\aawsepro.exe
2007-05-26 23:54 6805941 --a------ C:\fpf11.exe
2007-05-26 23:35 4608 --a------ C:\WINDOWS\system32\nuaayiyo.dll
2007-05-26 23:34 7637641 --a------ C:\fpfs42.exe
2007-05-26 04:25 2722 --a------ C:\WINDOWS\pchealth\helpctr\PackageStore\SkuStore.bin
2007-05-26 04:24 8972 --a------ C:\WINDOWS\pchealth\helpctr\Config\Cntstore.bin
2007-05-26 00:40 298104 --a------ C:\WINDOWS\system32\imon.dll
2007-05-26 00:40 12349368 --a------ C:\ndntenst.exe

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-05-26 00:40]
"bascstray"="BascsTray.exe" []
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2005-10-07 14:13]
"ioloDelayModule"="C:\Program Files\iolo\System Mechanic 6\delay.exe" [2005-06-08 20:31]
"Ad-Watch"="C:\Program Files\Lavasoft\Ad-Aware 2007\Ad-Watch2007.exe" [2007-07-26 09:57]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 15:57]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 08:00]
"SMSystemAnalyzer"="C:\Program Files\iolo\System Mechanic 6\SMSystemAnalyzer.exe" [2006-12-20 12:38]
"System Mechanic Popup Blocker"="C:\Program Files\iolo\System Mechanic 6\PopupBlocker.exe" [2006-12-20 12:38]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-09-24 00:28:44]

R0 SSFS0BB8;Spy Sweeper File System Filer Driver: 0BB8;C:\WINDOWS\system32\Drivers\SSFS0BB8.SYS
R2 BASFND;BASFND;\??\C:\WINDOWS\system32\Drivers\BASFND.sys
R2 MSSQL$NR2005;MSSQL$NR2005;C:\Program Files\Microsoft SQL Server\MSSQL$NR2005\Binn\sqlservr.exe -sNR2005
R2 SNMP;SNMP Service;C:\WINDOWS\System32\snmp.exe
R3 GTICARD;GTICARD;C:\WINDOWS\system32\DRIVERS\gticard.sys
R3 pwi_bus;Curitel PC Card Composite Device driver (WDM);C:\WINDOWS\system32\DRIVERS\pwi_bus.sys
R3 pwi_mdfl;Curitel PC Card Filter;C:\WINDOWS\system32\DRIVERS\pwi_mdfl.sys
R3 pwi_mdm;Curitel PC Card Drivers;C:\WINDOWS\system32\DRIVERS\pwi_mdm.sys
R3 pwi_oflt;Curitel PC Card OHCI Filter;C:\WINDOWS\system32\DRIVERS\pwi_oflt.sys
R3 pwi_serd;Curitel PC Card Diagnostic Serial Port (WDM);C:\WINDOWS\system32\DRIVERS\pwi_serd.sys
R3 SMNDIS5;SMNDIS5 NDIS Protocol Driver;\??\C:\PROGRA~1\VERIZO~1\VZACCE~1\SMNDIS5.SYS
S2 SMTPSVC;Simple Mail Transfer Protocol (SMTP);C:\WINDOWS\system32\inetsrv\inetinfo.exe
S3 {E2B953A7-195A-44F9-9BA3-3D5F4E32BB55};AIM 3.0 Part 01 Codec Driver CH-7009-B;C:\WINDOWS\system32\drivers\wA301b.sys
S3 LPDSVC;TCP/IP Print Server;C:\WINDOWS\system32\tcpsvcs.exe
S3 SNMPTRAP;SNMP Trap Service;C:\WINDOWS\System32\snmptrap.exe
S3 SQLAgent$NR2005;SQLAgent$NR2005;C:\Program Files\Microsoft SQL Server\MSSQL$NR2005\Binn\sqlagent.EXE -i NR2005

Contents of the 'Scheduled Tasks' folder
2007-08-14 07:00:03 C:\WINDOWS\Tasks\AntiSpyware Scheduled Scan.job
2007-08-17 14:30:53 C:\WINDOWS\Tasks\MP Scheduled Scan.job - C:\Program Files\Windows Defender\MpCmdRun.exe

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-17 16:16:02
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-17 16:16:43

--- E O F ---

#4 LDTate

Grand Poobah

Root Admin
57,211 posts

Posted 18 August 2007 - 01:51 PM

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Clear "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Clear "Hide protected operating system files."
Click Apply, and then click OK.

Delete these Files if listed:
C:\WINDOWS\system32\uwwxx.bak2
C:\WINDOWS\system32\uwwxx.bak1
C:\WINDOWS\system32\nuaayiyo.dll

Reboot and "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.

The forum is run by volunteers who donate their time and expertise.

Want to help others? Join the ClassRoom and learn how.

Logs will be closed if you haven't replied within 3 days

If you would like to for the help you received.

Proud graduate of TC/WTT Classroom

#5 CHIEFS5140

New Member

New Member
3 posts

Posted 18 August 2007 - 04:35 PM

LD, STILL GET ERROR MESSAGE,THESE UPDATES FAILED TO INSTALL , WHEN I TRY TO INSTALL THEM . ALSO I NOW HAVE A
ANNOYING POP UP , MARKET RESEARCH INSTALLER? GOES THROUGH INSTALLER MODE THEN ASK FOR DISC?
THANK YOU !AGAIN FOR HELPING ME WITH THIS DIFFICULT ISSUE
Logfile of HijackThis v1.99.1
Scan saved at 6:18:43 PM, on 8/18/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\basfipm.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Microsoft SQL Server\MSSQL$NR2005\Binn\sqlservr.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iolo\System Mechanic 6\SMSystemAnalyzer.exe
C:\Program Files\iolo\System Mechanic 6\PopupBlocker.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Apoint\HidFind.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\Ad-Watch2007.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\YTBSDK.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe
C:\Program Files\Intel\Wireless\Bin\iFrmewrk.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Verizon Wireless\VZAccess Manager\VZAccess Manager.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\HPZinw12.exe
C:\Program Files\Hijackthis\HijackThis.exe
C:\WINDOWS\SoftwareDistribution\Download\5652d934eec8bfa4dc68c4e256a23d5e\update\update.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.c...//www.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [bascstray] BascsTray.exe
O4 - HKLM\..\Run: [Apoint] "C:\Program Files\Apoint\Apoint.exe"
O4 - HKLM\..\Run: [ioloDelayModule] "C:\Program Files\iolo\System Mechanic 6\delay.exe"
O4 - HKLM\..\Run: [Ad-Watch] "C:\Program Files\Lavasoft\Ad-Aware 2007\Ad-Watch2007.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] "C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SMSystemAnalyzer] "C:\Program Files\iolo\System Mechanic 6\SMSystemAnalyzer.exe"
O4 - HKCU\..\Run: [System Mechanic Popup Blocker] "C:\Program Files\iolo\System Mechanic 6\PopupBlocker.exe"
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell....iler/SysPro.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/b...lineScanner.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onec...lscbase8300.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.mi...b?1185414623205
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1180210649294
O17 - HKLM\System\CCS\Services\Tcpip\..\{C871C1A8-D8E1-43F2-95AA-288AE30B1DFD}: NameServer = 66.174.95.44 69.78.96.14
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Broadcom ASF IP monitoring service v6.0.3 (BAsfIpM) - Broadcom Corp. - C:\WINDOWS\system32\basfipm.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
O23 - Service: Intel® PROSet/Wireless SSO Service (WLANKEEPER) - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

#6 LDTate

Grand Poobah

Root Admin
57,211 posts

Posted 18 August 2007 - 04:41 PM

Download the trial version of AVG Anti-Spyware from here and install it. When the program has been installed, and you click the Finish button, AVG Anti-Spyware will open.

If the program does not automatically update itself during installation, or you are unsure whether it has done so, please do the following:

Click the Update icon at the top and under Manual Update click the Start update button.
The program will either update or inform you that no update was available.
It is essential that you get the update - keep trying until successful. (Note: If you have problems getting the update, you can download an installer for the full database from here (save it on your desktop). Once you have downloaded the installer, make sure that AVG Anti-Spyware is closed and then double-click on avgas-signatures-full-current.exe to install the database).

Please set up the program as follows:

Click the Shield icon at the top and under Resident shield is... click active. This should now
change to inactive.
Click the Update icon and untick the automatic update option.
Click on Scanner on the toolbar.
Click on the Settings tab.
Under How to act? - make sure that Quarantine is selected.
Under How to scan? - All checkboxes should be ticked.
Under Possibly unwanted software - All checkboxes should be ticked.
Under Reports - Select Do not automatically generate reports.
Under What to scan? - Select Scan every file.

Close all open windows.
Do not run a scan yet.

Reboot your computer into SafeMode
You can do this by restarting your computer and continually tapping the F8 key until a menu appears.
Use your up arrow key to highlight SafeMode then hit enter.

IMPORTANT: Do not open any other windows or
programs while AVG Anti-Spyware is scanning, it may interfere with the scanning proccess:

Lauch AVG Anti-Spyware by double-clicking the icon on your desktop.
Select the "Scanner" icon at the top and then the "Scan" tab
then click on "Complete System Scan".
ewido will now begin the scanning process, be patient this may take a little
time.
Let the program scan your computer.
When the scan has finished, follow the instructions below:[list]
Make sure that Set all elements to: shows Quarantine
Important: Click on the Apply all Actions button (*** This must done before saving the report ***)
When the program has finished, it will display the message All actions have been applied.
Then click the Save Scan Report button.
Click the Save Report as button.
Save the report to your Desktop.
Right-click the AVG Tray Icon and select Exit. Confirm by clicking Yes.
Reboot in normal mode and copy the report back to this topic along with a new HijackThis log.

The forum is run by volunteers who donate their time and expertise.

Want to help others? Join the ClassRoom and learn how.

Logs will be closed if you haven't replied within 3 days

If you would like to for the help you received.

Proud graduate of TC/WTT Classroom

#7 LDTate

Grand Poobah

Root Admin
57,211 posts

Posted 25 August 2007 - 10:52 PM

You still needing help?

The forum is run by volunteers who donate their time and expertise.

Want to help others? Join the ClassRoom and learn how.

Logs will be closed if you haven't replied within 3 days

If you would like to for the help you received.

Proud graduate of TC/WTT Classroom

#8 LDTate

Grand Poobah

Root Admin
57,211 posts

Posted 27 August 2007 - 08:20 PM

Due to inactivity this topic will be closed. If you need help please start a new thread and post a new HJT log

The forum is run by volunteers who donate their time and expertise.

Want to help others? Join the ClassRoom and learn how.

Logs will be closed if you haven't replied within 3 days

If you would like to for the help you received.

Proud graduate of TC/WTT Classroom

Body Background

skin color theme