Spyware / Malware / Virus Removal

[Resolved]Help! Just Like Redhead's Problem

11 min read

Looking for the outcome? Ask AI

caricaturd Topic Starter

Post #1August 16, 2007, 5:07 PM UTC

Hi guys,
I've read a few other threads and you guys are the real deal. I came across redhead's thread and he seems to be experiencing the same problem I am. I've taken the liberty to read through his thread and download the programs you suggested. I haven't attempted using any yet, though. I have, however, ran HijackThis. Here is my report:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:49:05 PM, on 8/16/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\mbptece.exe
C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe
C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WUSB54GC.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\mbpteceA.exe
C:\windows\system32\nldsregl.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\DOBE~1\spool32.exe
C:\WINDOWS\M?crosoft\??chost.exe
C:\WINDOWS\system32\swinmodt.exe
C:\WINDOWS\system32\vswxbmtt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\odsihrhr.exe
C:\Documents and Settings\user\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.firstrade.com/
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [PPHIDPAD] C:\WINPENJR\Win32\pphidpad.exe
O4 - HKLM\..\Run: [Dell Wireless Manager UI] C:\WINDOWS\system32\WLTRAY
O4 - HKLM\..\Run: [poolsv] "C:\WINDOWS\poolsv.exe"
O4 - HKLM\..\Run: [NI.UWAS7_0001_N91M2703] "C:\Program Files\poolsv\WinAntiSpyware2007FreeInstall.exe" -nag
O4 - HKLM\..\Run: [svhost] "C:\WINDOWS\svhost.exe"
O4 - HKLM\..\Run: [mbpteceA] C:\WINDOWS\mbpteceA.exe
O4 - HKLM\..\Run: [{13-38-8E-EB-ZN}] C:\windows\system32\nldsregl.exe SKY009
O4 - HKLM\..\Run: [g4356cbvy63] C:\WINDOWS\g4356cbvy63
O4 - HKLM\..\Run: [ExploreUpdSched] C:\WINDOWS\system32\swinmodt.exe SKY009
O4 - HKLM\..\Run: [SystemOptimizer] rundll32.exe "C:\WINDOWS\system32\ietichin.dll",forkonce
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [custom.exe] "C:\WINPENJR\WIN32\CUSTOM.EXE"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Wens] "C:\WINDOWS\system32\DOBE~1\spool32.exe" -vt yazb
O4 - HKCU\..\Run: [Aegl] C:\WINDOWS\M?crosoft\??chost.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Think-Adz.lnk = C:\WINDOWS\system32\swinmodt.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: DomainService - - C:\WINDOWS\system32\vswxbmtt.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Net Agent - Unknown owner - C:\WINDOWS\dls0523pmw.exe
O23 - Service: Windows Overlay Components - Unknown owner - C:\WINDOWS\mbptece.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe
O23 - Service: WUSB54GCSVC - GEMTEKS - C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe

–
End of file - 4836 bytes

Here's hoping this is the start of a beautiful relationship.

- Stef

Trevuren

Post #2August 16, 2007, 7:58 PM UTC

Hello caricaturd and welcome to the TomCoyote Forums

My name is Trevuren and I will be helping you with your problem.

No Antivirus/No Software Firewall <==Are we surprised?

You don't appear to be running any anti-virus software

Anti-virus software are programs that detect, clean, and/or erase harmful virus files on a computer. Unchecked, virus files can unintentionally be forwarded to others, and thereby spread infection. Keeping your anti-virus updated is essential.

Please download a free anti-virus software from one these excellent vendors NOW:

It is strongly recommended that you run only one antivirus program at a time. Having more than one antivirus program active in memory uses additional resources and can result in program conflicts and false virus alerts.

You don't appear to have a software firewall running

It is important that you use a software firewall, to prevent unauthorised traffic both out of and into your computer.
If you have disabled it, please re-enable it.
If you do not have a firewall installed, please download and instal one of these excellent (and free) products:

It is important to note that you should only have one firewall installed at a time.

Once the above programs have been installed and the Antivirus updated and run, Reboot your system

Then please post a fresh HJT log.

Trevuren

caricaturd

Post #3August 17, 2007, 11:01 PM UTC

Hi again,
Agreed, that was a nooby mistake - but if its any sort of defense, I just got this computer used from my sister. Anyway, I dl'd the AVG antivirus program, but it froze halfway during the process. I have my windows firewall activated, though I'm not sure if that will suffice. If not, I'll gladly download from one of your suggested vendors. Please find my Hijack report below:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:46:55 PM, on 8/17/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\vswxbmtt.exe
C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe
C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WUSB54GC.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\windows\system32\nldsregl.exe
C:\WINDOWS\g4356cbvy63.exe
C:\WINDOWS\system32\swinmodt.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\WINDOWS\M?crosoft\??chost.exe
C:\Documents and Settings\user\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.firstrade.com/
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [Dell Wireless Manager UI] C:\WINDOWS\system32\WLTRAY
O4 - HKLM\..\Run: [poolsv] "C:\WINDOWS\poolsv.exe"
O4 - HKLM\..\Run: [NI.UWAS7_0001_N91M2703] "C:\Program Files\poolsv\WinAntiSpyware2007FreeInstall.exe" -nag
O4 - HKLM\..\Run: [svhost] "C:\WINDOWS\svhost.exe"
O4 - HKLM\..\Run: [{13-38-8E-EB-ZN}] C:\windows\system32\nldsregl.exe SKY009
O4 - HKLM\..\Run: [g4356cbvy63] C:\WINDOWS\g4356cbvy63
O4 - HKLM\..\Run: [ExploreUpdSched] C:\WINDOWS\system32\swinmodt.exe SKY009
O4 - HKLM\..\Run: [SystemOptimizer] rundll32.exe "C:\WINDOWS\system32\ietichin.dll",forkonce
O4 - HKLM\..\Run: [pofy] C:\Program Files\Common Files\pofy22011.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [custom.exe] "C:\WINPENJR\WIN32\CUSTOM.EXE"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Aegl] C:\WINDOWS\M?crosoft\??chost.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Think-Adz.lnk = C:\WINDOWS\system32\swinmodt.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O20 - AppInit_DLLs: c:\windows\system32\ldcore.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: DomainService - - C:\WINDOWS\system32\vswxbmtt.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Net Agent - Unknown owner - C:\WINDOWS\dls0523pmw.exe
O23 - Service: Windows Overlay Components - Unknown owner - C:\WINDOWS\mbptece.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe
O23 - Service: WUSB54GCSVC - GEMTEKS - C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe

–
End of file - 5306 bytes

Also, quick question: is it safe to use the same internet network between the infected computer and my pc? Would it also be safe to transfer files between them using a memory stick?
When this is all over with, you're getting a fruit basket.

Thanks again,
Stef

Trevuren

Post #4August 18, 2007, 1:02 AM UTC

Hi Stef,

I strongly recommend that you do as little transferring of files as possible as the machine that we are working on has every bug in the book apparently. Please follow these instructions to the letter:

Please download this file - combofix.exe by sUBs

Save it to your Desktop
Now physically disconnect from the internet and STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields)
Click on your START button and choose Run. Then copy/paste the entire content of the following quotebox (Including the "" marks and the Symbols) into the run box.

"%userprofile%\desktop\ComboFix.exe" /KillAll

[external image: Posted Image]
Click OK and this will start ComboFix in a special way.
When finished, it will produce a log. Please save that log to a Notepad File to post in your next reply along with a fresh HJT log.

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

* After you have saved the logs, restart your system to re-enable all the programs that were disabled during the running of ComboFix.

* Reconnect to the internet

* Post the following logs/Reports:

ComboFix.txt
Fresh HijackThis log run after all the other tools have performed their cleanup.

caricaturd

Post #5August 18, 2007, 3:37 AM UTC

WOW.

That was amazing. Its running 100X smoother now. Thank you so much for your help so far! Seriously, there's some fruit basket potential in this for you XD

Below, please find my combofix.txt and HiJackThis file:

ComboFix 07-08-16.3 - "user" 2007-08-17 22:55:06.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.707 [GMT -4:00]
Command switches used :: /KillAll
* Created a new restore point

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\DOCUME~1\NETWOR~1\APPLIC~1\WinTouch
C:\DOCUME~1\NETWOR~1\APPLIC~1\WinTouch\wintouch.cfg
C:\DOCUME~1\user\STARTM~1\Programs.\Outerinfo
C:\DOCUME~1\user\STARTM~1\Programs.\Outerinfo\Terms.lnk
C:\DOCUME~1\user\STARTM~1\Programs.\Outerinfo\Uninstall.lnk
C:\Program Files\Common Files\pofy22011.exe
C:\Program Files\Common Files\winantispyware 2007
C:\Program Files\Common Files\Yazzle1022OinAdmin.exe
C:\Program Files\Common Files\Yazzle1022OinUninstaller.exe
C:\Program Files\Common Files\Yazzle1122OinUninstaller.exe
C:\Program Files\Common Files\Yazzle1549OinUninstaller.exe
C:\Program Files\Common Files\Yazzle1552OinUninstaller.exe
C:\Program Files\inetget2
C:\Program Files\inetget2\popinstall.exe
C:\Program Files\Messenger\powexe455101.dll
C:\Program Files\Messenger\powexe5555.dll
C:\Program Files\Messenger\powexe83122.dll
C:\Program Files\outerinfo
C:\Program Files\outerinfo\Terms.rtf
C:\Program Files\ppatch~1
C:\Program Files\ppatch~1\??pPatch\
C:\Program Files\winpop
C:\Program Files\winpop\UnInstall.exe
C:\Program Files\winpop\winpop.exe
C:\Temp\1cb
C:\Temp\1cb\syscheck.log
C:\Temp\fse
C:\Temp\fse\tmpZTF.log
C:\temp\tn3
C:\WINDOWS\b103.exe
C:\WINDOWS\b104.exe
C:\WINDOWS\b122.exe
C:\WINDOWS\b136.exe
C:\WINDOWS\b138.exe
C:\WINDOWS\bhmaa0578.exe
C:\WINDOWS\csrss.exe
C:\WINDOWS\dls0523pmw.exe
C:\WINDOWS\g4356cbvy63.exe
C:\WINDOWS\mbptece.exe
C:\WINDOWS\mbpteceA.exe
C:\WINDOWS\mcroso~1
C:\WINDOWS\mcroso~1\??chost.exe
C:\WINDOWS\offun.exe
C:\WINDOWS\rau001978.exe
C:\WINDOWS\retadpu11.exe
C:\WINDOWS\retadpu361.exe
C:\WINDOWS\system32\acbeg.bak1
C:\WINDOWS\system32\acbeg.bak2
C:\WINDOWS\system32\acbeg.ini
C:\WINDOWS\system32\acbeg.tmp
C:\WINDOWS\system32\B0
C:\WINDOWS\system32\B0\mwspasrt83122.exe
C:\WINDOWS\system32\B1
C:\WINDOWS\system32\B1\wr73.exe
C:\WINDOWS\system32\b10FdUe
C:\WINDOWS\system32\b10FdUe\b10FdUe1099.exe
C:\WINDOWS\system32\B2
C:\WINDOWS\system32\B2\st2.exe
C:\WINDOWS\system32\B3
C:\WINDOWS\system32\B5
C:\WINDOWS\system32\B5\z53.exe
C:\WINDOWS\system32\dobe~1
C:\WINDOWS\system32\dobe~1\?dobe\
C:\WINDOWS\system32\driver
C:\WINDOWS\system32\drivers\alert_icon.gif
C:\WINDOWS\system32\drivers\blank.gif
C:\WINDOWS\system32\drivers\box_1.gif
C:\WINDOWS\system32\drivers\box_2.gif
C:\WINDOWS\system32\drivers\box_3.gif
C:\WINDOWS\system32\drivers\button_buynow.gif
C:\WINDOWS\system32\drivers\button_freescan.gif
C:\WINDOWS\system32\drivers\close_icon.gif
C:\WINDOWS\system32\drivers\core.cache.dsk
C:\WINDOWS\system32\drivers\core.sys
C:\WINDOWS\system32\drivers\detect.htm
C:\WINDOWS\system32\drivers\download_box.gif
C:\WINDOWS\system32\drivers\footer_back.jpg
C:\WINDOWS\system32\drivers\header_1.gif
C:\WINDOWS\system32\drivers\header_2.gif
C:\WINDOWS\system32\drivers\header_3.gif
C:\WINDOWS\system32\drivers\header_4.gif
C:\WINDOWS\system32\drivers\header_bg.gif
C:\WINDOWS\system32\drivers\icon_warning.gif
C:\WINDOWS\system32\drivers\infected.gif
C:\WINDOWS\system32\drivers\main_back.gif
C:\WINDOWS\system32\drivers\perfect_cleaner_box.jpg
C:\WINDOWS\system32\drivers\product_1_header.gif
C:\WINDOWS\system32\drivers\product_1_name_small.gif
C:\WINDOWS\system32\drivers\product_2_header.gif
C:\WINDOWS\system32\drivers\product_2_name_small.gif
C:\WINDOWS\system32\drivers\product_3_header.gif
C:\WINDOWS\system32\drivers\product_3_name_small.gif
C:\WINDOWS\system32\drivers\product_features.gif
C:\WINDOWS\system32\drivers\pt.htm
C:\WINDOWS\system32\drivers\remove_spyware_button.gif
C:\WINDOWS\system32\drivers\s_detect.htm
C:\WINDOWS\system32\drivers\secuity_center_logo.gif
C:\WINDOWS\system32\drivers\sep_hor.gif
C:\WINDOWS\system32\drivers\sep_vert.gif
C:\WINDOWS\system32\drivers\shadow.jpg
C:\WINDOWS\system32\drivers\spacer.gif
C:\WINDOWS\system32\drivers\spy_away_box.jpg
C:\WINDOWS\system32\drivers\star.gif
C:\WINDOWS\system32\drivers\star_gray.gif
C:\WINDOWS\system32\drivers\star_gray_small.gif
C:\WINDOWS\system32\drivers\star_small.gif
C:\WINDOWS\system32\drivers\style.css
C:\WINDOWS\system32\drivers\v.gif
C:\WINDOWS\system32\drivers\warning_icon.gif
C:\WINDOWS\system32\drivers\win_logo.gif
C:\WINDOWS\system32\drivers\x.gif
C:\WINDOWS\system32\dsp.dll
C:\WINDOWS\system32\f06WtR
C:\WINDOWS\system32\f06WtR\f06WtR1083.exe
C:\WINDOWS\system32\gebca.dll
C:\WINDOWS\system32\gebywxx.dll
C:\WINDOWS\system32\ietichin.dll
C:\WINDOWS\system32\ldinfo.ldr
C:\WINDOWS\system32\mdxgeeff.dll
C:\WINDOWS\system32\msbind32.exe
C:\WINDOWS\system32\msnav32.ax
C:\WINDOWS\system32\nihcitei.ini
C:\WINDOWS\system32\nldsregl.exe
C:\WINDOWS\system32\nnnnmnm.dll
C:\WINDOWS\system32\odsihrhr.exe
C:\WINDOWS\system32\setup155.exe
C:\WINDOWS\system32\skna455101.exe
C:\WINDOWS\system32\swinmodt.exe
C:\WINDOWS\system32\tajpdfps.dll
C:\WINDOWS\system32\TISKY008.exe
C:\WINDOWS\system32\user10.exe
C:\WINDOWS\system32\vswxbmtt.exe
C:\WINDOWS\system32\W6b2c62p.exe
C:\WINDOWS\system32\waverevenue.exe
C:\WINDOWS\system32\winkke32.dll
C:\WINDOWS\system32\winpfz32.sys
C:\WINDOWS\system32\wmltermd.dll
C:\WINDOWS\system32\wtssvcc.exe
C:\WINDOWS\system32\wvusssr.dll
C:\WINDOWS\system32\zxdnt3d.cfg
C:\WINDOWS\Tasks.\At1.job
C:\WINDOWS\Tasks.\At10.job
C:\WINDOWS\Tasks.\At11.job
C:\WINDOWS\Tasks.\At12.job
C:\WINDOWS\Tasks.\At13.job
C:\WINDOWS\Tasks.\At14.job
C:\WINDOWS\Tasks.\At15.job
C:\WINDOWS\Tasks.\At16.job
C:\WINDOWS\Tasks.\At17.job
C:\WINDOWS\Tasks.\At18.job
C:\WINDOWS\Tasks.\At19.job
C:\WINDOWS\Tasks.\At2.job
C:\WINDOWS\Tasks.\At20.job
C:\WINDOWS\Tasks.\At21.job
C:\WINDOWS\Tasks.\At22.job
C:\WINDOWS\Tasks.\At23.job
C:\WINDOWS\Tasks.\At24.job
C:\WINDOWS\Tasks.\At3.job
C:\WINDOWS\Tasks.\At4.job
C:\WINDOWS\Tasks.\At5.job
C:\WINDOWS\Tasks.\At6.job
C:\WINDOWS\Tasks.\At7.job
C:\WINDOWS\Tasks.\At8.job
C:\WINDOWS\Tasks.\At9.job
C:\WINDOWS\tk58.exe
C:\WINDOWS\tk68.exe
C:\WINDOWS\TTC-5555.exe
C:\WINDOWS\uni_eh44.exe
C:\WINDOWS\uninst1014.exe
C:\WINDOWS\uninst2.htm
C:\WINDOWS\unist1.htm
C:\WINDOWS\WebAssist.dll
C:\WINDOWS\wr.txt
C:\WINDOWS\xhelper.dll

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

——-\LEGACY_CORE
——-\LEGACY_DOMAINSERVICE
——-\LEGACY_NET_AGENT
——-\LEGACY_WINDOWS_OVERLAY_COMPONENTS
——-\core
——-\DomainService
——-\Net Agent
——-\nm
——-\Windows Overlay Components

((((((((((((((((((((((((( Files Created from 2007-07-18 to 2007-08-18 )))))))))))))))))))))))))))))))

2007-08-17 22:52 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-08-17 17:42 25,105 –a—— C:\WINDOWS\system32\bhMTE4ODA6ODoxNg.exe
2007-08-17 17:42 d——– C:\DOCUME~1\NETWOR~1\APPLIC~1\?racle
2007-08-17 17:41 d——– C:\WINDOWS\system32\ICM3
2007-08-17 17:41 d——– C:\WINDOWS\system32\CC1
2007-08-17 17:41 d——– C:\WINDOWS\system32\bgfig5

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-17 22:59 ——— d——– C:\Program Files\Messenger
2007-07-12 18:00 ——— d——– C:\Program Files\Common Files\qqiw
2007-07-12 17:53 ——— d——– C:\Program Files\Lavasoft
2007-07-12 17:51 ——— d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-07-06 00:58 ——— d——– C:\DOCUME~1\user\APPLIC~1\Real
2007-07-06 00:55 ——— d——– C:\Program Files\Real
2007-07-06 00:55 ——— d——– C:\Program Files\Common Files\xing shared
2007-07-06 00:55 ——— d——– C:\Program Files\Common Files\Real
2007-06-23 20:16 ——— d——– C:\DOCUME~1\user\APPLIC~1\Google
2007-06-21 23:26 ——— d——– C:\Program Files\Google

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2B85A003-93F7-4317-4998-FFD0DD7510E7}]
C:\Program Files\MSN\sajurufy.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 22:05]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-03 21:32]
"MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-03 21:31]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-03 21:32]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-03 21:32]
"Dell Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY" []
"svhost"="C:\WINDOWS\svhost.exe" []

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56]
"custom.exe"="C:\WINPENJR\WIN32\CUSTOM.EXE" [2005-11-14 15:33]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2007-06-21 23:26]
"Aegl"="C:\WINDOWS\M?crosoft\??chost.exe" []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

R1 ppmoucls;ppmoucls;C:\WINDOWS\system32\DRIVERS\ppmoucls.sys
R1 pptchpad;PenPower Touchpad;C:\WINDOWS\system32\DRIVERS\pptchpd5.sys
S3 ADM8511;ADMtek ADM8511/AN986 USB To Fast Ethernet Converter;C:\WINDOWS\system32\DRIVERS\ADM8511.SYS

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-17 23:03:17
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-17 23:03:47 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-08-17 23:03

— E O F —

…And the HiJack log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:33:41 PM, on 8/17/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe
C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WUSB54GC.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\user\Desktop\HiJackThis.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.firstrade.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: 0 - {2B85A003-93F7-4317-4998-FFD0DD7510E7} - C:\Program Files\MSN\sajurufy.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [Dell Wireless Manager UI] C:\WINDOWS\system32\WLTRAY
O4 - HKLM\..\Run: [svhost] "C:\WINDOWS\svhost.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [custom.exe] "C:\WINPENJR\WIN32\CUSTOM.EXE"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Aegl] C:\WINDOWS\M?crosoft\??chost.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe
O23 - Service: WUSB54GCSVC - GEMTEKS - C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe

–
End of file - 4747 bytes

Just to let you know, the latest AVG scan was successful, with 30 files eliminated and 1 apparently in holding. Also, there is still a suspicious icon on my desktop labelled "click to find and fix errors". Thanks again for all you're doing!

Stef

Trevuren

Post #6August 18, 2007, 5:07 AM UTC

A. There is a file in your log of which I am unsure. For that reason, I need you to submit it to Jotti's for analysis.

1. Click HERE to get to Jotti's site.

2. At the top of the Jotti window, use the Browse button to locate the following file on your system:

C:\WINPENJR\WIN32\CUSTOM.EXE

3. Once you have located the file, click SUBMIT and the content of the file will be uploaded by the site and analysed.

4. Please provide me with the results of the analysis.

B. 1. Please open Notepad

Click Start , then Run
Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

File::
C:\WINDOWS\system32\bhMTE4ODA6ODoxNg.exe
C:\WINDOWS\svhost.exe

Folder::
C:\WINDOWS\system32\ICM3
C:\WINDOWS\system32\CC1
C:\WINDOWS\system32\bgfig5
C:\Program Files\Common Files\qqiw
C:\DOCUME~1\NETWOR~1\APPLIC~1\Oracle

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2B85A003-93F7-4317-4998-FFD0DD7510E7}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"svhost"=-
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Aegl"=-

3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

[external image: Posted Image]

5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

Report from Jottu
Combofix.txt
A new HijackThis log.

caricaturd

Post #7August 18, 2007, 3:08 PM UTC

Hi,

I ran the jotti scan and it came out clear. Here are the results:

Scan taken on 18 Aug 2007 14:51:40 (GMT)
A-Squared
Found nothing
AntiVir
Found nothing
ArcaVir
Found nothing
Avast
Found nothing
AVG Antivirus
Found nothing
BitDefender
Found nothing
ClamAV
Found nothing
CPsecure
Found nothing
Dr.Web
Found nothing
F-Prot Antivirus
Found nothing
F-Secure Anti-Virus
Found nothing
Fortinet
Found nothing
Kaspersky Anti-Virus
Found nothing
NOD32
Found nothing
Norman Virus Control
Found nothing
Panda Antivirus
Found nothing
Rising Antivirus
Found nothing
Sophos Antivirus
Found nothing
VirusBuster
Found nothing
VBA32
Found nothing

Then I went ahead and used Combofix. Went off without a hitch as far as I can tell:

ComboFix 07-08-16.3 - "user" 2007-08-18 10:57:53.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.642 [GMT -4:00]
Command switches used :: C:\Documents and Settings\user\Desktop\CFScript.txt
* Created a new restore point

FILE::
C:\WINDOWS\system32\bhMTE4ODA6ODoxNg.exe
C:\WINDOWS\svhost.exe

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\Program Files\Common Files\qqiw
C:\Program Files\Common Files\qqiw\qqiwa.lck
C:\Program Files\Common Files\qqiw\qqiwd\class-barrel
C:\Program Files\Common Files\qqiw\qqiwd\vocabulary
C:\Program Files\Common Files\qqiw\qqiwh
C:\Program Files\Common Files\qqiw\qqiwl.lck
C:\Program Files\Common Files\qqiw\qqiwm.lck
C:\WINDOWS\system32\bgfig5
C:\WINDOWS\system32\CC1
C:\WINDOWS\system32\CC1\mon123bcz.exe
C:\WINDOWS\system32\ICM3
C:\WINDOWS\system32\ICM3\nbv22011.exe

((((((((((((((((((((((((( Files Created from 2007-07-18 to 2007-08-18 )))))))))))))))))))))))))))))))

2007-08-17 23:47 75,932 –a—— C:\WINDOWS\system32\drivers\klick.dat
2007-08-17 23:47 75,248 –a—— C:\WINDOWS\zllsputility.exe
2007-08-17 23:47 74,396 –a—— C:\WINDOWS\system32\drivers\klin.dat
2007-08-17 23:47 4,212 —h—– C:\WINDOWS\system32\zllictbl.dat
2007-08-17 23:47 11,264 –a—— C:\WINDOWS\system32\SpOrder.dll
2007-08-17 23:47 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\MailFrontier
2007-08-17 23:46 276,512 –ahs—- C:\WINDOWS\system32\drivers\fidbox.dat
2007-08-17 23:46 110,360 –a—— C:\WINDOWS\system32\drivers\kl1.sys
2007-08-17 23:46 1,086,952 –a—— C:\WINDOWS\system32\zpeng24.dll
2007-08-17 23:46 d——– C:\WINDOWS\system32\ZoneLabs
2007-08-17 23:45 d——– C:\WINDOWS\Internet Logs
2007-08-17 22:52 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-08-17 17:42 d——– C:\DOCUME~1\NETWOR~1\APPLIC~1\?racle

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-18 00:18 1988 –ahs—- C:\WINDOWS\system32\drivers\fidbox.idx
2007-08-18 00:02 9344 –a—— C:\WINDOWS\system32\drivers\NSDriver.sys
2007-08-18 00:02 8320 –a—— C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-08-17 22:59 ——— d——– C:\Program Files\Messenger
2007-07-12 17:53 ——— d——– C:\Program Files\Lavasoft
2007-07-12 17:51 ——— d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-07-06 00:58 ——— d——– C:\DOCUME~1\user\APPLIC~1\Real
2007-07-06 00:55 ——— d——– C:\Program Files\Real
2007-07-06 00:55 ——— d——– C:\Program Files\Common Files\xing shared
2007-07-06 00:55 ——— d——– C:\Program Files\Common Files\Real
2007-06-23 20:16 ——— d——– C:\DOCUME~1\user\APPLIC~1\Google
2007-06-21 23:26 ——— d——– C:\Program Files\Google

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 22:05]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-03 21:32]
"MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-03 21:31]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-03 21:32]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-03 21:32]
"Dell Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY" []
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-08-17 23:20]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-06-21 21:54]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56]
"custom.exe"="C:\WINPENJR\WIN32\CUSTOM.EXE" [2005-11-14 15:33]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2007-06-21 23:26]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

R1 ppmoucls;ppmoucls;C:\WINDOWS\system32\DRIVERS\ppmoucls.sys
R1 pptchpad;PenPower Touchpad;C:\WINDOWS\system32\DRIVERS\pptchpd5.sys
S3 ADM8511;ADMtek ADM8511/AN986 USB To Fast Ethernet Converter;C:\WINDOWS\system32\DRIVERS\ADM8511.SYS

*Newly Created Service* - GTNDIS5

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-18 10:59:50
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-18 11:01:02
C:\ComboFix-quarantined-files.txt … 2007-08-18 11:01
C:\ComboFix2.txt … 2007-08-17 23:03

— E O F —

And finally, here's a copy of my HiJack This log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:06:49 AM, on 8/18/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe
C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WUSB54GC.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\user\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.firstrade.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [Dell Wireless Manager UI] C:\WINDOWS\system32\WLTRAY
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [custom.exe] "C:\WINPENJR\WIN32\CUSTOM.EXE"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe
O23 - Service: WUSB54GCSVC - GEMTEKS - C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe

–
End of file - 4863 bytes

Thanks!

Stef

Trevuren

Post #8August 18, 2007, 6:03 PM UTC

A. Please RUN HijackThis

Click the SCAN button to produce a log.
Place a check mark beside each one of the following items:

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
Now with all the items selected, and all windows closed except for HJT, delete them by clicking the FIX checked button. Close the HijackThis window.

B. Please use the Internet Explorer browser, and do an online scan with Kaspersky Online Scanner
Click Yes, when prompted to install its ActiveX component.
(Note.. for Internet Explorer 7 users: If at any time you have trouble with the "Accept" button of the license, click on the "Zoom" tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license has been accepted, reset to 100%.)
The program launches and downloads the latest definition files.

Once the files are downloaded click on Next
Click on Scan Settings and configure as follows:
- Scan using the following Anti-Virus database:
  - Extended
- Scan Options:Scan Archives
  Scan Mail Bases
Click OK and, under select a target to scan, select My Computer

When the scan is done, in the Scan is completed window (below), any infection is displayed.
There is no option to clean/disinfect, however, we need to analyze the information on the report.
[external image: Posted Image]
[external image: Posted Image]
To obtain the report:
Click on: Save Report As (above - red blinking arrow)
Next, in the Save as prompt, Save in area, select: Desktop
In the File name area, use KScan, or something similar
In Save as type, click the drop arrow and select: Text file [*.txt]
Then, click: Save
Please post the Kaspersky Online Scanner Report in your reply, along with a fresh HijackThis log

caricaturd

Post #9August 19, 2007, 4:08 AM UTC

Stubborn little suckers, arent they:

——————————————————————————-
KASPERSKY ONLINE SCANNER REPORT
Sunday, August 19, 2007 12:05:30 AM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.93.0
Kaspersky Anti-Virus database last update: 19/08/2007
Kaspersky Anti-Virus database records: 385030
——————————————————————————-

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\
F:\

Scan Statistics:
Total number of scanned objects: 20608
Number of viruses found: 22
Number of infected objects: 81
Number of suspicious objects: 0
Duration of the scan process: 00:22:03

Infected Object Name / Virus Name / Last Action
C:\18.tmp/data0002 Infected: Trojan-Downloader.Win32.PurityScan.eg skipped
C:\18.tmp NSIS: infected - 1 skipped
C:\Documents and Settings\All Users\Application Data\avg7\Log\emc.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\G523G56J\lo1[1] Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\U9S16ZIL\TISKY008[1].exe Infected: not-a-virus:AdWare.Win32.ZenoSearch.o skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\YB2XEBY7\83122[1].exe/data0004 Infected: Trojan-Clicker.Win32.Small.jf skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\YB2XEBY7\83122[1].exe NSIS: infected - 1 skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\YB2XEBY7\bass[1].exe/data0002/data0004 Infected: not-a-virus:AdWare.Win32.TTC.c skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\YB2XEBY7\bass[1].exe/data0002 Infected: not-a-virus:AdWare.Win32.TTC.c skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\YB2XEBY7\bass[1].exe/data0006 Infected: Trojan-Downloader.Win32.Small.eqn skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\YB2XEBY7\bass[1].exe/data0007/data.rar/whiehlpr.dll Infected: not-a-virus:AdWare.Win32.WebHancer.390 skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\YB2XEBY7\bass[1].exe/data0007/data.rar Infected: not-a-virus:AdWare.Win32.WebHancer.390 skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\YB2XEBY7\bass[1].exe/data0007 Infected: not-a-virus:AdWare.Win32.WebHancer.390 skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\YB2XEBY7\bass[1].exe NSIS: infected - 6 skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\YB2XEBY7\TTC-5555[1].exe/data0002 Infected: not-a-virus:AdWare.Win32.TTC.a skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\YB2XEBY7\TTC-5555[1].exe NSIS: infected - 1 skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\user\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\user\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\user\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\user\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\user\Local Settings\History\History.IE5\MSHist012007081820070819\index.dat Object is locked skipped
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\user\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\user\ntuser.dat.LOG Object is locked skipped
C:\QooBox\Quarantine\C\Program Files\Common Files\pofy22011.exe.vir Infected: not-a-virus:AdWare.Win32.TTC.c skipped
C:\QooBox\Quarantine\C\Program Files\InetGet2\popinstall.exe.vir Infected: not-a-virus:AdWare.Win32.Rond.c skipped
C:\QooBox\Quarantine\C\Program Files\Messenger\powexe5555.dll.vir Infected: not-a-virus:AdWare.Win32.TTC.a skipped
C:\QooBox\Quarantine\C\Program Files\WinPop\winpop.exe.vir Infected: not-a-virus:AdWare.Win32.Rond.c skipped
C:\QooBox\Quarantine\C\WINDOWS\b104.exe.vir/stream/data0002 Infected: Trojan-Downloader.Win32.Small.buy skipped
C:\QooBox\Quarantine\C\WINDOWS\b104.exe.vir/stream/data0004 Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\QooBox\Quarantine\C\WINDOWS\b104.exe.vir/stream Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\QooBox\Quarantine\C\WINDOWS\b104.exe.vir NSIS: infected - 3 skipped
C:\QooBox\Quarantine\C\WINDOWS\b136.exe.vir/stream/data0002 Infected: Trojan-Dropper.Win32.Agent.bfr skipped
C:\QooBox\Quarantine\C\WINDOWS\b136.exe.vir/stream/data0004 Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\QooBox\Quarantine\C\WINDOWS\b136.exe.vir/stream Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\QooBox\Quarantine\C\WINDOWS\b136.exe.vir NSIS: infected - 3 skipped
C:\QooBox\Quarantine\C\WINDOWS\b138.exe.vir Infected: Trojan-Downloader.Win32.Agent.cbx skipped
C:\QooBox\Quarantine\C\WINDOWS\MCROSO~1\ѕνchost.exe.vir Infected: not-a-virus:AdWare.Win32.PurityScan.fn skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\CC1\mon123bcz.exe.vir/data.rar/whiehlpr.dll Infected: not-a-virus:AdWare.Win32.WebHancer.390 skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\CC1\mon123bcz.exe.vir/data.rar Infected: not-a-virus:AdWare.Win32.WebHancer.390 skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\CC1\mon123bcz.exe.vir RarSFX: infected - 2 skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\dsp.dll.vir Infected: not-a-virus:AdWare.Win32.PurityScan.ak skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\ICM3\nbv22011.exe.vir/data0004 Infected: not-a-virus:AdWare.Win32.TTC.c skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\ICM3\nbv22011.exe.vir NSIS: infected - 1 skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\nldsregl.exe.vir Infected: not-a-virus:AdWare.Win32.ZenoSearch.o skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\swinmodt.exe.vir Infected: not-a-virus:AdWare.Win32.ZenoSearch.r skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\TISKY008.exe.vir Infected: not-a-virus:AdWare.Win32.ZenoSearch.o skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\vswxbmtt.exe.vir Infected: Trojan.Win32.Agent.aoy skipped
C:\QooBox\Quarantine\C\WINDOWS\TTC-5555.exe.vir/data0002 Infected: not-a-virus:AdWare.Win32.TTC.a skipped
C:\QooBox\Quarantine\C\WINDOWS\TTC-5555.exe.vir NSIS: infected - 1 skipped
C:\QooBox\Quarantine\C\WINDOWS\WebAssist.dll.vir Infected: not-a-virus:AdWare.Win32.BHO.cz skipped
C:\QooBox\Quarantine\C\WINDOWS\xhelper.dll.vir Infected: not-a-virus:AdWare.Win32.Agent.db skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP25\A0007937.exe Object is locked skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP25\A0007939.exe Object is locked skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP25\A0007940.exe Infected: not-a-virus:AdWare.Win32.Rond.a skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP25\A0008000.exe Object is locked skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP25\A0008026.exe Infected: not-a-virus:AdWare.Win32.ZenoSearch.o skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP25\A0008030.exe Object is locked skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP25\A0008042.exe Object is locked skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP25\A0008043.exe/data0005 Infected: Trojan-Downloader.Win32.VB.awj skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP25\A0008043.exe NSIS: infected - 1 skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP25\A0008044.exe Object is locked skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP25\A0008045.exe Object is locked skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP25\A0008046.exe/data0002 Infected: Trojan-Downloader.Win32.PurityScan.eg skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP25\A0008046.exe NSIS: infected - 1 skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP25\A0008048.exe Infected: not-a-virus:AdWare.Win32.ZenoSearch.o skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP26\A0008074.exe Object is locked skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP26\A0008108.exe Infected: not-a-virus:AdWare.Win32.Rond.a skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP26\A0008109.exe Object is locked skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP26\A0008143.exe Object is locked skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP26\A0008145.exe Object is locked skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP26\A0008148.exe Object is locked skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP26\A0008149.exe Object is locked skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP26\A0008160.exe Object is locked skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP27\A0009176.exe Object is locked skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP28\A0009182.exe Object is locked skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP28\A0009183.exe Object is locked skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP28\A0009184.exe Object is locked skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP28\A0009185.exe Object is locked skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP28\A0009186.exe Object is locked skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP28\A0009187.exe Object is locked skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP28\A0009188.exe Object is locked skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP28\A0010163.exe Object is locked skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP28\A0010176.dll Object is locked skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP28\A0010177.dll Object is locked skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP28\A0010178.dll Object is locked skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP31\A0010291.exe Object is locked skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP31\A0010296.exe Object is locked skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP31\A0010297.exe Object is locked skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP31\A0010300.exe/stream/data0002 Infected: Trojan-Downloader.Win32.Small.buy skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP31\A0010300.exe/stream/data0004 Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP31\A0010300.exe/stream Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP31\A0010300.exe NSIS: infected - 3 skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP31\A0010301.exe Object is locked skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP31\A0010302.exe/stream/data0002 Infected: Trojan-Dropper.Win32.Agent.bfr skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP31\A0010302.exe/stream/data0004 Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP31\A0010302.exe/stream Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP31\A0010302.exe NSIS: infected - 3 skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP31\A0010303.exe Infected: Trojan-Downloader.Win32.Agent.cbx skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP31\A0010304.exe Object is locked skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP31\A0010305.exe Infected: not-a-virus:AdWare.Win32.ZenoSearch.o skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP31\A0010306.exe Infected: not-a-virus:AdWare.Win32.ZenoSearch.r skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP31\A0010307.exe Infected: not-a-virus:AdWare.Win32.ZenoSearch.o skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP31\A0010308.exe Infected: Trojan.Win32.Agent.aoy skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP31\A0010309.exe Infected: not-a-virus:AdWare.Win32.TTC.c skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP31\A0010310.exe Object is locked skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP31\A0010311.dll Infected: not-a-virus:AdWare.Win32.PurityScan.ak skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP31\A0010314.dll Infected: not-a-virus:AdWare.Win32.TTC.a skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP31\A0010315.exe Object is locked skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP31\A0010316.exe Object is locked skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP31\A0010317.exe Object is locked skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP31\A0010319.dll Object is locked skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP31\A0010320.dll Object is locked skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP31\A0010321.dll Object is locked skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP31\A0010322.dll Object is locked skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP31\A0010323.exe Object is locked skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP31\A0010324.dll Object is locked skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP31\A0010325.dll Object is locked skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP31\A0010329.exe Infected: not-a-virus:AdWare.Win32.Rond.c skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP31\A0010330.exe Object is locked skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP31\A0010331.exe Infected: not-a-virus:AdWare.Win32.Rond.c skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP31\A0010332.exe Infected: not-a-virus:AdWare.Win32.PurityScan.fn skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP31\A0010334.exe Object is locked skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP31\A0010335.exe Object is locked skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP31\A0010336.exe Object is locked skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP31\A0010337.exe Object is locked skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP31\A0010338.exe Object is locked skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP31\A0010341.exe Object is locked skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP31\A0010342.exe Object is locked skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP31\A0010343.exe Object is locked skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP31\A0010347.exe Object is locked skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP31\A0010348.dll Infected: not-a-virus:AdWare.Win32.Agent.db skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP31\A0010349.exe Object is locked skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP31\A0010351.dll Infected: not-a-virus:AdWare.Win32.BHO.cz skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP31\A0010355.exe/data0002 Infected: not-a-virus:AdWare.Win32.TTC.a skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP31\A0010355.exe NSIS: infected - 1 skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP31\A0010356.exe Object is locked skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP31\A0010357.exe Object is locked skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP31\A0010367.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP31\A0010368.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP32\A0010452.exe Object is locked skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP32\A0010453.exe Object is locked skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP33\A0010521.exe/data0004 Infected: not-a-virus:AdWare.Win32.TTC.c skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP33\A0010521.exe NSIS: infected - 1 skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP33\A0010522.exe/data.rar/whiehlpr.dll Infected: not-a-virus:AdWare.Win32.WebHancer.390 skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP33\A0010522.exe/data.rar Infected: not-a-virus:AdWare.Win32.WebHancer.390 skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP33\A0010522.exe RarSFX: infected - 2 skipped
C:\System Volume Information\_restore{466F14C7-C0CD-47CC-ABC0-5CABAA9F879F}\RP35\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\Internet Logs\fwdbglog.txt Object is locked skipped
C:\WINDOWS\Internet Logs\fwpktlog.txt Object is locked skipped
C:\WINDOWS\Internet Logs\IAMDB.RDB Object is locked skipped
C:\WINDOWS\Internet Logs\tvDebug.log Object is locked skipped
C:\WINDOWS\Internet Logs\USER-23F74C746A.ldb Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\TEMP\ZLT047e9.TMP Object is locked skipped
C:\WINDOWS\TEMP\ZLT05d2f.TMP Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
F:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

Scan process completed.

and the HiJack log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:07:02 AM, on 8/19/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe
C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WUSB54GC.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Documents and Settings\user\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.firstrade.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [Dell Wireless Manager UI] C:\WINDOWS\system32\WLTRAY
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [custom.exe] "C:\WINPENJR\WIN32\CUSTOM.EXE"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe
O23 - Service: WUSB54GCSVC - GEMTEKS - C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe

–
End of file - 4902 bytes

Many thanks =)

Trevuren

Post #10August 19, 2007, 4:32 AM UTC

Other than these few stragglers, all the rest are in quarantined areas and will be dealt with during the final cleanup procedures. After you have run this CFScript, please also tell me hoe your system is running. If all is OK, give me the OK and I will proceed with the final cleanup.

1. Please open Notepad

Click Start , then Run
Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

File::
C:\18.tmp
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\U9S16ZIL\TISKY008[1].exe
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\YB2XEBY7\83122[1].exe
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\YB2XEBY7\bass[1].exe
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\YB2XEBY7\TTC-5555[1].exe

Folder::
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\G523G56J\lo1[1]

Combofix.txt
A new HijackThis log.

caricaturd

Post #11August 19, 2007, 11:19 PM UTC

Here are the logs, as requested:

ComboFix 07-08-16.3 - "user" 2007-08-19 19:01:17.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.648 [GMT -4:00]
Command switches used :: C:\Documents and Settings\user\Desktop\CFScript.txt
* Created a new restore point

FILE::
C:\18.tmp
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\U9S16ZIL\TISKY008[1].exe
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\YB2XEBY7\83122[1].exe
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\YB2XEBY7\bass[1].exe
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\YB2XEBY7\TTC-5555[1].exe

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\18.tmp
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\G523G56J\lo1[1]\
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\U9S16ZIL\TISKY008[1].exe
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\YB2XEBY7\83122[1].exe
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\YB2XEBY7\bass[1].exe
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\YB2XEBY7\TTC-5555[1].exe

((((((((((((((((((((((((( Files Created from 2007-07-19 to 2007-08-19 )))))))))))))))))))))))))))))))

2007-08-19 00:54 95,608 –a—— C:\WINDOWS\system32\AvastSS.scr
2007-08-19 00:54 94,416 –a—— C:\WINDOWS\system32\drivers\aswmon2.sys
2007-08-19 00:54 92,848 –a—— C:\WINDOWS\system32\drivers\aswmon.sys
2007-08-19 00:54 783,224 –a—— C:\WINDOWS\system32\aswBoot.exe
2007-08-19 00:54 42,912 –a—— C:\WINDOWS\system32\drivers\aswTdi.sys
2007-08-19 00:54 26,624 –a—— C:\WINDOWS\system32\drivers\aavmker4.sys
2007-08-19 00:54 23,152 –a—— C:\WINDOWS\system32\drivers\aswRdr.sys
2007-08-19 00:53 d——– C:\Program Files\Alwil Software
2007-08-18 23:06 d——– C:\WINDOWS\system32\Kaspersky Lab
2007-08-18 23:06 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab
2007-08-18 11:28 1,156 –a—— C:\WINDOWS\mozver.dat
2007-08-17 23:47 75,932 –a—— C:\WINDOWS\system32\drivers\klick.dat
2007-08-17 23:47 75,248 –a—— C:\WINDOWS\zllsputility.exe
2007-08-17 23:47 74,396 –a—— C:\WINDOWS\system32\drivers\klin.dat
2007-08-17 23:47 4,212 —h—– C:\WINDOWS\system32\zllictbl.dat
2007-08-17 23:47 11,264 –a—— C:\WINDOWS\system32\SpOrder.dll
2007-08-17 23:47 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\MailFrontier
2007-08-17 23:46 311,328 –ahs—- C:\WINDOWS\system32\drivers\fidbox.dat
2007-08-17 23:46 110,360 –a—— C:\WINDOWS\system32\drivers\kl1.sys
2007-08-17 23:46 1,086,952 –a—— C:\WINDOWS\system32\zpeng24.dll
2007-08-17 23:46 d——– C:\WINDOWS\system32\ZoneLabs
2007-08-17 23:45 d——– C:\WINDOWS\Internet Logs
2007-08-17 22:52 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-08-17 17:42 d——– C:\DOCUME~1\NETWOR~1\APPLIC~1\?racle

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-18 12:26 5768 –ahs—- C:\WINDOWS\system32\drivers\fidbox.idx
2007-08-18 00:02 9344 –a—— C:\WINDOWS\system32\drivers\NSDriver.sys
2007-08-18 00:02 8320 –a—— C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-08-17 22:59 ——— d——– C:\Program Files\Messenger
2007-07-12 17:53 ——— d——– C:\Program Files\Lavasoft
2007-07-12 17:51 ——— d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-07-06 00:58 ——— d——– C:\DOCUME~1\user\APPLIC~1\Real
2007-07-06 00:55 ——— d——– C:\Program Files\Real
2007-07-06 00:55 ——— d——– C:\Program Files\Common Files\xing shared
2007-07-06 00:55 ——— d——– C:\Program Files\Common Files\Real
2007-06-23 20:16 ——— d——– C:\DOCUME~1\user\APPLIC~1\Google
2007-06-21 23:26 ——— d——– C:\Program Files\Google

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 22:05]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-03 21:32]
"MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-03 21:31]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-03 21:32]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-03 21:32]
"Dell Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY" []
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-06-21 21:54]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-07-27 18:03]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56]
"custom.exe"="C:\WINPENJR\WIN32\CUSTOM.EXE" [2005-11-14 15:33]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2007-06-21 23:26]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

R1 ppmoucls;ppmoucls;C:\WINDOWS\system32\DRIVERS\ppmoucls.sys
R1 pptchpad;PenPower Touchpad;C:\WINDOWS\system32\DRIVERS\pptchpd5.sys
S3 ADM8511;ADMtek ADM8511/AN986 USB To Fast Ethernet Converter;C:\WINDOWS\system32\DRIVERS\ADM8511.SYS

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-19 19:03:07
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-19 19:04:16
C:\ComboFix-quarantined-files.txt … 2007-08-19 19:04
C:\ComboFix2.txt … 2007-08-18 11:01
C:\ComboFix3.txt … 2007-08-17 23:03

— E O F —

HiJack This log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:15:18 PM, on 8/19/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe
C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WUSB54GC.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\user\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.firstrade.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [Dell Wireless Manager UI] C:\WINDOWS\system32\WLTRAY
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [custom.exe] "C:\WINPENJR\WIN32\CUSTOM.EXE"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe
O23 - Service: WUSB54GCSVC - GEMTEKS - C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe

–
End of file - 5005 bytes

I also had a quick question about gaming with my new firewall/AV setup. I keep getting error code messages when I initiate an online game I play (its not a windows error message). I've tried reinstalling the game as well as deactivating my ZoneAlarm firewall and temporarily uninstalling my AV program. Any ideas as to what that might be?

Stef

Trevuren

Post #12August 19, 2007, 11:57 PM UTC

I have no way of knowing. The exact error code could probably be Googled for an answer however. Hope that helps a bit.

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order in which they are mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes.

First we need to make all files and folders VISIBLE:
- Go to start>control panel>folder options>view
- Choose to "show hidden files and folders,"
- Uncheck the "hide protected operating system files" and the "hide extensions for know file types" boxes.
- Close the window with ok
Please RUN HijackThis.
. Click the SCAN button to produce a log.
Place a check mark beside the following item:

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
Now with the item selected, and all windows closed except for HJT, delete it by clicking the FIX checked button. Close the HijackThis window.
Reboot Your System in Safe Mode

How to use the F8 method to Start Your Computer in Safe Mode
- Restart the computer.
- As soon as BIOS is loaded begin tapping the F8 key until the Advanced Options menu appears.
- Use the arrow keys to select the Safe mode menu item
- Press Enter.
Using Windows Explorer (Windows Key + E), locate the following files/folders, and DELETE it (if still present):

C:\DOCUMENTS and Settings\NETWORK\APPLICATION DATA\?racle<==Folder and all its content. This folder could start by any letter or symbol and is usually located at the bottom of the list of folders.
Exit Explorer, and REBOOT BACK INTO NORMAL MODE
Finally, RUN Hijackthis again and produce a new HJT log. Post it in the forum so we can check how everything looks now.

Regards,

Trevuren

caricaturd

Post #13August 20, 2007, 3:31 AM UTC

Just to clarify - "?racle" in my case appeared as the "Oracle" folder.
Anyway, here's the requested HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:28:17 PM, on 8/19/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe
C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WUSB54GC.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\user\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.firstrade.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [Dell Wireless Manager UI] C:\WINDOWS\system32\WLTRAY
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [custom.exe] "C:\WINPENJR\WIN32\CUSTOM.EXE"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe
O23 - Service: WUSB54GCSVC - GEMTEKS - C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe

–
End of file - 4882 bytes

Do you like chocolate?

Trevuren

Post #14August 20, 2007, 3:35 AM UTC

Your log looks clean. If you have no more malware-related problems that you are aware of, just give me the OK and we can start the final but essential cleanup procedures and recommendations.

Trevuren

caricaturd

Post #15August 20, 2007, 8:42 PM UTC last edited August 20, 2007, 8:50 PM UTC

LETS DO THIS! (Except I still have a strange shortcut on my desktop that doesn't actually lead to any programs in the add/remove applications feature. Its a yellow yield sign icon labeled "click to find and fix errors") Since its not in the add/remove area, can I just delete the shortcut?)

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved]Help! Just Like Redhead's Problem

✨ Ask AI

Ask AI