What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved]Please Help Me

7 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
First of all, id like to give a big thanks to anyone out there that is willing to help a poor noob like me. This site is the best. Ive read a bunch of the stuff that other people posted, and it seems like u all are the real deal :),

My problems are very simmilar to many people on this board. As of tuesday, i believe that my computer has been infected with the adware.agent.bn malware. Like many other people, my symptons include

Red desktop featuring the biohazard symbol
3 reoccurring symbols on my desktop
really annoying popups telling me that my computer has been hacked.

Today, my computer is a little bit more stable, because i have installed a plethora of antivirus, antispiware, and firewalls. However, earlier last night, after i installed all of this stuff, my computer became infected with this virus again. Also, right now, when i was typing this, the program installed the red background again. I really need an experts help. (thats why i came to this site).

Below is my Hijackthis logfile

Logfile of HijackThis v1.99.1
Scan saved at 7:05:39 PM, on 8/16/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Softwin\BitDefender10\vsserv.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\TrojanHunter 4.7\THGuard.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Softwin\BitDefender10\bdmcon.exe
C:\Program Files\Softwin\BitDefender10\bdagent.exe
C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe
C:\Program Files\Ashampoo\Ashampoo FireWall\FireWall.exe
C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
C:\Program Files\Spam Monitor\SpamMonitor.Exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ycomp/def…/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ycomp/def…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=…6Ojg5&lid=2
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/def…//www.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: MSVPS System - {47C54F02-1B28-45F1-AE46-B5CDFB6E7926} - C:\WINDOWS\duocore.dll (file missing)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [LanzarT2006] "C:\DOCUME~1\User\LOCALS~1\Temp\T2006tmp\Install.exe" /SETUP:"/l0x0009"
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.7\THGuard.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
O4 - HKLM\..\Run: [cctray] "C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe"
O4 - HKLM\..\Run: [Ashampoo FireWall] "C:\Program Files\Ashampoo\Ashampoo FireWall\FireWall.exe" -TRAY
O4 - HKCU\..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
O4 - HKCU\..\Run: [Spam Monitor] C:\Program Files\Spam Monitor\SpamMonitor.Exe
O4 - Global Startup: 2Wire Wireless Client.lnk = C:\Program Files\2Wire 802.11g Wireless\PRISMCFG.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: &Save Flash In This Page by Flash Saver - C:\PROGRA~1\FLASHS~1\save.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Flash Saver - {09EA1F80-F40A-11D1-B792-444553540001} - C:\PROGRA~1\FLASHS~1\save.htm
O9 - Extra 'Tools' menuitem: Flash Saver - {09EA1F80-F40A-11D1-B792-444553540001} - C:\PROGRA~1\FLASHS~1\save.htm
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\ashampoo\ashampoo firewall\spi.dll
O10 - Unknown file in Winsock LSP: c:\program files\ashampoo\ashampoo firewall\spi.dll
O10 - Unknown file in Winsock LSP: c:\program files\ashampoo\ashampoo firewall\spi.dll
O10 - Unknown file in Winsock LSP: c:\program files\ashampoo\ashampoo firewall\spi.dll
O10 - Unknown file in Winsock LSP: c:\program files\ashampoo\ashampoo firewall\spi.dll
O10 - Unknown file in Winsock LSP: c:\program files\ashampoo\ashampoo firewall\spi.dll
O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} (ijjiPlugin2 Class) - http://gamedownload.ijjimax.com/gamedownlo…Plugin11USA.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O21 - SSODL: wmpenv - {0E2A5615-768E-40C5-A504-0E615853B97E} - C:\WINDOWS\wmpenv.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" -r (file missing)
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: CaCCProvSP - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: VET Message Service (VETMSGNT) - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender10\vsserv.exe" /service (file missing)
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)
Post #2
Hello mrX and welcome to the SpywareSupport Forums

My name is Trevuren and I will be helping you with your problem.


I notice from the log that there are running more than one different Anti-Virus programs with Auto-protect enabled.
Never install more than one Antivirus and Firewall! Rather than giving you extra protection, it will decrease the reliability of it seriously!
The reason for this is that if both products have their automatic (Real-Time) protection switched on, your system may lock up due to both software products attempting to access the same file at the same time.
Also because more than one Antivirus and Firewall installed are not compatible with each other, it can cause system performance problems and a serious system slowdown.

So you have to make a decision here and keep the Antivirus you prefer and uninstall the other one.
Then reboot after uninstalling.

Once that is done, please post a fresh HijackThis log


Trevuren
Post #3
thank you so much for responding. I am sorry for not posting up a reply sooner. I promise that i will get this done as soon as possible. Also, i cant connect to the internet using my existing computer, becuase the virus would just download itself agian. I wil transfer all info needed through a USB ill be right back in like 10 mins. thanks
Post #4
Ok. Here is my hjt log. My computer only has adaware, zonealarm, spywaredoctor, and bit defender.


Oh, by the way, my computer has multiple users (my brother being one of them)

here is my updated HJT log.

Logfile of HijackThis v1.99.1
Scan saved at 6:16:30 PM, on 8/17/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Softwin\BitDefender10\vsserv.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\Program Files\Softwin\BitDefender10\bdmcon.exe
C:\Program Files\Softwin\BitDefender10\bdagent.exe
C:\Program Files\Spam Monitor\SpamMonitor.Exe
C:\Program Files\2Wire 802.11g Wireless\PRISMCFG.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ycomp/def…/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ycomp/def…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=…6Ojg5&lid=2
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/def…//www.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: MSVPS System - {47C54F02-1B28-45F1-AE46-B5CDFB6E7926} - C:\WINDOWS\duocore.dll (file missing)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [LanzarT2006] "C:\DOCUME~1\User\LOCALS~1\Temp\T2006tmp\Install.exe" /SETUP:"/l0x0009"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
O4 - HKCU\..\Run: [Spam Monitor] C:\Program Files\Spam Monitor\SpamMonitor.Exe
O4 - Global Startup: 2Wire Wireless Client.lnk = C:\Program Files\2Wire 802.11g Wireless\PRISMCFG.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Save Flash In This Page by Flash Saver - C:\PROGRA~1\FLASHS~1\save.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Flash Saver - {09EA1F80-F40A-11D1-B792-444553540001} - C:\PROGRA~1\FLASHS~1\save.htm
O9 - Extra 'Tools' menuitem: Flash Saver - {09EA1F80-F40A-11D1-B792-444553540001} - C:\PROGRA~1\FLASHS~1\save.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} (ijjiPlugin2 Class) - http://gamedownload.ijjimax.com/gamedownlo…Plugin11USA.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O21 - SSODL: wmpenv - {0E2A5615-768E-40C5-A504-0E615853B97E} - C:\WINDOWS\wmpenv.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender10\vsserv.exe" /service (file missing)
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)
Post #5
Please download this file - combofix.exe by sUBs
  • You must download it to and run it from your Desktop
  • Double click combofix.exe & follow the prompts.
  • When finished, it will produce a log. Please save that log to post in your next reply along with a fresh HJT log.
Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

Regards,

Trevuren
Post #6
omg, i think i did something wrong. i downloaded combofixer, and i did the scan, but when i did the scan, it gave me an error message, and my computer logged off. What do i do?
Post #7
lol sorry about that. Turns out that the combofixer was working.

here are the two posts as requested

ComboFix 07-08-17.2 - "User" 2007-08-17 20:43:44.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.198 [GMT -5:00]
* Created a new restore point


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\dat.txt
C:\WINDOWS\wmpenv.dll


((((((((((((((((((((((((( Files Created from 2007-07-18 to 2007-08-18 )))))))))))))))))))))))))))))))


2007-08-17 20:43 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-08-16 19:28 d——– C:\DOCUME~1\User\APPLIC~1\AdwareAlert
2007-08-16 19:27 d——– C:\Program Files\AdwareAlert
2007-08-15 22:44 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
2007-08-15 21:50 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google Updater
2007-08-15 21:38 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Prism
2007-08-15 21:36 38,968 –a—— C:\WINDOWS\system32\drivers\ShlDrv51.sys
2007-08-15 21:36 178,872 –a—— C:\WINDOWS\system32\drivers\PavProc.sys
2007-08-15 21:22 d——– C:\Program Files\STOPzilla!
2007-08-15 21:21 d——– C:\DOCUME~1\User\APPLIC~1\Spam Monitor
2007-08-15 21:15 d——– C:\DOCUME~1\User\APPLIC~1\Bitdefender
2007-08-15 21:12 32,528 –a—— C:\WINDOWS\system32\drivers\vetmonnt.sys
2007-08-15 21:12 21,648 –a—— C:\WINDOWS\system32\drivers\vetfddnt.sys
2007-08-15 21:08 81,984 –a—— C:\WINDOWS\system32\bdod.bin
2007-08-15 21:03 d——– C:\Program Files\Ashampoo
2007-08-15 21:02 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\BitDefender
2007-08-15 20:01 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab
2007-08-15 19:59 d——– C:\KAV
2007-08-15 19:54 d——– C:\DOCUME~1\User\APPLIC~1\TrojanHunter
2007-08-15 19:09 d——– C:\Program Files\Privacy Guardian
2007-08-15 19:06 82,248 –a—— C:\WINDOWS\system32\drivers\iksyssec.sys
2007-08-15 19:06 57,672 –a—— C:\WINDOWS\system32\drivers\iksysflt.sys
2007-08-15 19:06 40,264 –a—— C:\WINDOWS\system32\drivers\ikfilesec.sys
2007-08-15 19:06 29,000 –a—— C:\WINDOWS\system32\drivers\kcom.sys
2007-08-15 19:06 d——– C:\Program Files\Spyware Doctor
2007-08-15 19:06 d——– C:\DOCUME~1\User\APPLIC~1\PC Tools
2007-08-15 19:05 626,688 –a—— C:\WINDOWS\system32\msvcr80.dll
2007-08-15 19:05 d——– C:\Program Files\Spam Monitor
2007-08-15 18:58 75,248 –a—— C:\WINDOWS\zllsputility.exe
2007-08-15 18:58 4,212 —h—– C:\WINDOWS\system32\zllictbl.dat
2007-08-15 18:58 11,264 –a—— C:\WINDOWS\system32\SpOrder.dll
2007-08-15 18:58 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\MailFrontier
2007-08-15 18:57 75,932 –a—— C:\WINDOWS\system32\drivers\klick.dat
2007-08-15 18:57 74,396 –a—— C:\WINDOWS\system32\drivers\klin.dat
2007-08-15 18:57 110,360 –a—— C:\WINDOWS\system32\drivers\kl1.sys
2007-08-15 18:57 1,086,952 –a—— C:\WINDOWS\system32\zpeng24.dll
2007-08-15 18:57 d——– C:\WINDOWS\system32\ZoneLabs
2007-08-15 18:56 d——– C:\WINDOWS\Internet Logs
2007-08-15 18:56 d——– C:\Program Files\TrojanHunter 4.7
2007-08-15 18:26 d——– C:\Program Files\Common Files\Panda Software
2007-08-10 12:55 d——– C:\DOCUME~1\User\APPLIC~1\Wizards of the Coast
2007-08-10 12:54 2,297,552 –a—— C:\WINDOWS\system32\d3dx9_26.dll
2007-08-08 07:42 d——– C:\DOCUME~1\User\APPLIC~1\InstallShield
2007-08-08 07:34 d—-c— C:\WINDOWS\system32\DRVSTORE
2007-08-08 07:34 d——– C:\Program Files\iTunes
2007-08-08 07:34 d——– C:\Program Files\iPod
2007-08-08 07:34 d——– C:\Program Files\Common Files\Apple
2007-08-06 14:58 d——– C:\Program Files\Magic Workstation
2007-08-05 10:37 d——– C:\Program Files\Kap.SATr
2007-08-05 10:32 d——– C:\WINDOWS\system32\appmgmt
2007-08-05 10:03 d——– C:\Program Files\Virtual CD v9
2007-08-02 22:42 d——– C:\DOCUME~1\User\APPLIC~1\Apple Computer
2007-08-02 18:13 d——– C:\Program Files\QuickTime
2007-08-02 18:13 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
2007-08-02 18:12 d——– C:\Program Files\Apple Software Update
2007-08-02 18:12 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
2007-07-26 23:00 d——– C:\DOCUME~1\User\APPLIC~1\Nexon
2007-07-25 22:04 d——– C:\DOCUME~1\User\APPLIC~1\RVM
2007-07-22 11:34 d——– C:\Program Files\ZC2.10
2007-07-21 15:15 d——– C:\Program Files\directx


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-15 21:52 ——— d——– C:\Program Files\Google
2007-08-10 16:34 43520 –a—— C:\WINDOWS\system32\CmdLineExt03.dll
2007-08-10 12:32 ——— d–h—– C:\Program Files\InstallShield Installation Information
2007-08-06 16:13 21840 –a—-t- C:\WINDOWS\system32\SIntfNT.dll
2007-08-06 16:13 17212 –a—-t- C:\WINDOWS\system32\SIntf32.dll
2007-08-06 16:13 12067 –a—-t- C:\WINDOWS\system32\SIntf16.dll
2007-08-06 15:35 ——— d——– C:\DOCUME~1\User\APPLIC~1\My Battle for Middle-earth Files
2007-08-05 10:33 ——— d——– C:\Program Files\Starcraft
2007-08-05 10:23 ——— d——– C:\Program Files\Camelot Systems
2007-07-28 10:54 454 –a—— C:\Program Files\Shortcut to xerox.lnk
2007-07-15 21:55 ——— d——– C:\DOCUME~1\User\APPLIC~1\AdobeUM
2007-07-15 21:54 ——— d——– C:\DOCUME~1\User\APPLIC~1\WinRAR
2007-07-12 17:29 ——— d——– C:\DOCUME~1\User\APPLIC~1\Dev-Cpp
2007-07-08 18:35 ——— d–h—– C:\DOCUME~1\User\APPLIC~1\ijjigame
2007-07-08 10:13 ——— d——– C:\Program Files\Flash Saver
2007-07-03 17:49 73216 –a—— C:\WINDOWS\ST6UNST.EXE
2007-07-03 17:49 249856 ——— C:\WINDOWS\Setup1.exe
2007-07-03 17:15 ——— d——– C:\Program Files\Yahoo!
2007-07-03 17:15 ——— d——– C:\Program Files\Common Files\Scanner
2007-07-03 17:14 ——— d——– C:\DOCUME~1\User\APPLIC~1\Yahoo!
2007-06-26 22:38 ——— d——– C:\DOCUME~1\User\APPLIC~1\CyberLink
2007-06-24 20:35 ——— d——– C:\Program Files\Common Files\EasyInfo
2007-06-23 18:43 ——— d——– C:\Program Files\Samsung
2007-06-18 17:32 ——— d——– C:\Program Files\Lavasoft
2007-06-18 17:31 ——— d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-06-16 19:35 28672 –a—— C:\WINDOWS\system32\qttask.exe
2007-06-16 17:29 2722 –a—— C:\WINDOWS\pchealth\helpctr\PackageStore\SkuStore.bin
2007-06-16 17:28 8972 –a—— C:\WINDOWS\pchealth\helpctr\Config\Cntstore.bin
2007-06-16 13:46 0 -rahs—- C:\MSDOS.SYS
2007-06-16 13:46 0 -rahs—- C:\IO.SYS
2007-06-16 13:46 0 –a—— C:\CONFIG.SYS
2007-06-16 13:46 0 –a—— C:\AUTOEXEC.BAT
2007-06-09 16:50 52224 –a—— C:\WINDOWS\system32\dmutil.dll
2007-06-09 16:50 51712 –a—— C:\WINDOWS\system32\wzcsapi.dll
2007-06-09 16:50 47616 –a—— C:\WINDOWS\system32\iyuv_32.dll
2007-06-09 16:50 47104 –a—— C:\WINDOWS\system32\cnbjmon.dll
2007-06-09 16:50 359936 –a—— C:\WINDOWS\system32\wzcsvc.dll
2007-06-09 16:50 35328 –a—— C:\WINDOWS\system32\pid.dll
2007-06-09 16:50 20992 –a—— C:\WINDOWS\system32\hid.dll
2007-06-09 16:50 17408 –a—— C:\WINDOWS\system32\msyuv.dll
2007-06-09 16:50 1580544 –a—— C:\WINDOWS\system32\sfcfiles.dll
2007-06-09 16:50 15360 –a—— C:\WINDOWS\system32\pjlmon.dll
2007-06-09 16:48 86073 –a—— C:\WINDOWS\system32\usrfaxa.dll
2007-06-09 16:48 8192 –a—— C:\WINDOWS\system32\tsbyuv.dll
2007-06-09 16:48 8192 –a—— C:\WINDOWS\system32\streamci.dll
2007-06-09 16:48 77891 –a—— C:\WINDOWS\system32\usrmlnka.exe
2007-06-09 16:48 77890 –a—— C:\WINDOWS\system32\usrdpa.dll
2007-06-09 16:48 77883 –a—— C:\WINDOWS\system32\usrrtosa.dll
2007-06-09 16:48 72192 –a—— C:\WINDOWS\system32\sprio800.dll
2007-06-09 16:48 70656 –a—— C:\WINDOWS\system32\sprio600.dll
2007-06-09 16:48 69700 –a—— C:\WINDOWS\system32\usrshuta.exe
2007-06-09 16:48 69699 –a—— C:\WINDOWS\system32\usrcoina.dll
2007-06-09 16:48 69632 –a—— C:\WINDOWS\system32\spnike.dll
2007-06-09 16:48 61508 –a—— C:\WINDOWS\system32\usrprbda.exe
2007-06-09 16:48 61500 –a—— C:\WINDOWS\system32\usrcntra.dll
2007-06-09 16:48 55296 –a—— C:\WINDOWS\system32\dvdplay.exe
2007-06-09 16:48 53305 –a—— C:\WINDOWS\system32\usrlbva.dll
2007-06-09 16:48 49211 –a—— C:\WINDOWS\system32\usrvpa.dll
2007-06-09 16:48 49211 –a—— C:\WINDOWS\system32\usrsdpia.dll
2007-06-09 16:48 49209 –a—— C:\WINDOWS\system32\usrv80a.dll
2007-06-09 16:48 45116 –a—— C:\WINDOWS\system32\usrvoica.dll
2007-06-09 16:48 41019 –a—— C:\WINDOWS\system32\usrsvpia.dll
2007-06-09 16:48 323641 –a—— C:\WINDOWS\system32\usrdtea.dll
2007-06-09 16:48 3200 –a—— C:\WINDOWS\system32\wowfax.dll
2007-06-09 16:48 157696 –a—— C:\WINDOWS\system32\paqsp.dll
2007-06-09 16:48 147968 –a—— C:\WINDOWS\system32\mdwmdmsp.dll
2007-06-09 16:48 13824 –a—— C:\WINDOWS\system32\wowfaxui.dll
2007-06-09 16:48 102457 –a—— C:\WINDOWS\system32\usrv42a.dll
2007-06-09 16:39 498742 –a—— C:\WINDOWS\system32\dxmasf.dll
2007-06-09 16:39 2854400 –a—— C:\WINDOWS\system32\msi.dll
2007-06-09 16:39 246814 –a—— C:\WINDOWS\system32\strmdll.dll
2007-06-09 16:37 292864 –a—— C:\WINDOWS\system32\winsrv.dll
2007-06-09 16:37 185344 –a—— C:\WINDOWS\system32\upnphost.dll
2007-06-09 16:36 981760 –a—— C:\WINDOWS\system32\mfc42u.dll
2007-06-09 16:36 927504 –a—— C:\WINDOWS\system32\mfc40u.dll
2007-06-09 16:36 726528 –a—— C:\WINDOWS\system32\lsasrv.dll
2007-06-09 16:36 713216 –a—— C:\WINDOWS\system32\sxs.dll
2007-06-09 16:36 679424 –a—— C:\WINDOWS\system32\inetcomm.dll
2007-06-09 16:36 65536 –a—— C:\WINDOWS\system32\nwwks.dll
2007-06-09 16:36 64000 –a—— C:\WINDOWS\system32\nwapi32.dll
2007-06-09 16:36 578048 –a—— C:\WINDOWS\system32\user32.dll
2007-06-09 16:36 40960 –a—— C:\WINDOWS\system32\mf3216.dll
2007-06-09 16:36 282112 –a—— C:\WINDOWS\system32\gdi32.dll
2007-06-09 16:36 1843968 –a—— C:\WINDOWS\system32\win32k.sys
2007-06-09 16:36 142336 –a—— C:\WINDOWS\system32\nwprovau.dll
2007-06-09 16:36 132096 –a—— C:\WINDOWS\system32\wkssvc.dll
2007-06-09 16:36 122880 –a—— C:\WINDOWS\system32\oledlg.dll
2007-06-09 16:36 1084416 –a—— C:\WINDOWS\system32\msxml3.dll
2007-06-09 16:35 956416 –a—— C:\WINDOWS\system32\msdtctm.dll
2007-06-09 16:35 91136 –a—— C:\WINDOWS\system32\mtxoci.dll
2007-06-09 16:35 74752 –a—— C:\WINDOWS\system32\olecli32.dll
2007-06-09 16:35 72704 –a—— C:\WINDOWS\system32\hlink.dll
2007-06-09 16:35 69120 –a—— C:\WINDOWS\system32\ciodm.dll
2007-06-09 16:35 66560 –a—— C:\WINDOWS\system32\mtxclu.dll
2007-06-09 16:35 617472 –a—— C:\WINDOWS\system32\comctl32.dll
2007-06-09 16:35 59392 –a—— C:\WINDOWS\system32\stclient.dll
2007-06-09 16:35 426496 –a—— C:\WINDOWS\system32\msdtcprx.dll
2007-06-09 16:35 398848 –a—— C:\WINDOWS\system32\rpcss.dll
2007-06-09 16:35 37376 –a—— C:\WINDOWS\system32\olecnv32.dll
2007-06-09 16:35 23040 –a—— C:\WINDOWS\system32\fltMc.exe


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{47C54F02-1B28-45F1-AE46-B5CDFB6E7926}]
C:\WINDOWS\duocore.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-03 15:32]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-03 15:32]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-04-05 14:22]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-04-05 14:19]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-06-21 21:54]
"SDTray"="C:\Program Files\Spyware Doctor\SDTrayApp.exe" [2007-08-14 17:02]
"BDMCon"="C:\Program Files\Softwin\BitDefender10\bdmcon.exe" [2007-04-02 16:48]
"BDAgent"="C:\Program Files\Softwin\BitDefender10\bdagent.exe" [2007-03-26 15:49]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Spam Monitor"="C:\Program Files\Spam Monitor\SpamMonitor.Exe" [2007-05-08 17:33]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"nltide_3"=rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
2Wire Wireless Client.lnk - C:\Program Files\2Wire 802.11g Wireless\PRISMCFG.exe [2007-06-16 15:48:32]
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=sockspy.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk
backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]
C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
C:\WINDOWS\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PRISMSVR.EXE]
"C:\WINDOWS\system32\PRISMSVR.EXE" /APPLY

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegistryMechanic]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
"C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
C:\Program Files\Analog Devices\Core\smax4pnp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ose"=3 (0x3)
"iPod Service"=3 (0x3)

R1 ShldDrv;Panda File Shield Driver;C:\WINDOWS\system32\DRIVERS\ShlDrv51.sys
R2 PavProc;Panda Process Protection Driver;\??\C:\WINDOWS\system32\DRIVERS\PavProc.sys
S3 ASFWHide;ASFWHide;\??\C:\DOCUME~1\User\LOCALS~1\Temp\ASFWHide
S3 MOSUMAC;USB-Ethernet Driver;C:\WINDOWS\system32\DRIVERS\MOSUMAC.SYS
S3 WlanUIG;2Wire 802.11g USB Driver;C:\WINDOWS\system32\DRIVERS\WlanUIG.sys


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{efbcf344-1c0d-11dc-bba3-806d6172696f}]
AutoRun\command- D:\autorun.exe

*Newly Created Service* - WUAUSERV

Contents of the 'Scheduled Tasks' folder
2007-08-17 22:59:59 C:\WINDOWS\Tasks\AdwareAlert Scheduled Scan.job
2007-08-15 03:19:19 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-17 20:48:26
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-17 20:50:36 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-08-17 20:50

— E O F —












Logfile of HijackThis v1.99.1
Scan saved at 8:54:03 PM, on 8/17/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Softwin\BitDefender10\vsserv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Softwin\BitDefender10\bdmcon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Softwin\BitDefender10\bdagent.exe
C:\Program Files\Spam Monitor\SpamMonitor.Exe
C:\Program Files\2Wire 802.11g Wireless\PRISMCFG.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=…6Ojg5&lid=2
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/def…//www.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: MSVPS System - {47C54F02-1B28-45F1-AE46-B5CDFB6E7926} - C:\WINDOWS\duocore.dll (file missing)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
O4 - HKCU\..\Run: [Spam Monitor] C:\Program Files\Spam Monitor\SpamMonitor.Exe
O4 - Global Startup: 2Wire Wireless Client.lnk = C:\Program Files\2Wire 802.11g Wireless\PRISMCFG.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Save Flash In This Page by Flash Saver - C:\PROGRA~1\FLASHS~1\save.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Flash Saver - {09EA1F80-F40A-11D1-B792-444553540001} - C:\PROGRA~1\FLASHS~1\save.htm
O9 - Extra 'Tools' menuitem: Flash Saver - {09EA1F80-F40A-11D1-B792-444553540001} - C:\PROGRA~1\FLASHS~1\save.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} (ijjiPlugin2 Class) - http://gamedownload.ijjimax.com/gamedownlo…Plugin11USA.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender10\vsserv.exe" /service (file missing)
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)
Post #8
1. Please open Notepad
  • Click Start , then Run
  • Type notepad .exe in the Run Box.
2. Now copy/paste the entire content of the codebox below into the Notepad window:

File::
C:\DOCUME~1\User\LOCALS~1\Temp\ASFWHide

Driver::
ASFWHide

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{47C54F02-1B28-45F1-AE46-B5CDFB6E7926}]


3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

[external image: Posted Image]


5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
  • Combofix.txt
  • A new HijackThis log.
Post #9
Ok. I will get to work at this as soon as possible. I wont be able to post later today though, so dont waste your time checking on this particular topic. I will be able to get on tomorrow though. thanks, mrX
Post #11 last edited
Hey, its me again. I did the two things like you requested.



I will post the two right now. Combofixer is first, HJT is second. Oh and btw, can you tell me what is wrong with my computer? I really want to know incase something like this happens again.


thanks,

mrX





ComboFix 07-08-17.2 - "User" 2007-08-19 13:29:23.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.131 [GMT -5:00]
Command switches used :: C:\Documents and Settings\User\Desktop\CFScript.txt
* Created a new restore point

FILE::
C:\DOCUME~1\User\LOCALS~1\Temp\ASFWHide


((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


——-\LEGACY_ASFWHIDE
——-\ASFWHide


((((((((((((((((((((((((( Files Created from 2007-07-19 to 2007-08-19 )))))))))))))))))))))))))))))))


2007-08-17 20:43 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-08-16 19:28 d——– C:\DOCUME~1\User\APPLIC~1\AdwareAlert
2007-08-16 19:27 d——– C:\Program Files\AdwareAlert
2007-08-15 22:44 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
2007-08-15 21:50 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google Updater
2007-08-15 21:38 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Prism
2007-08-15 21:36 38,968 –a—— C:\WINDOWS\system32\drivers\ShlDrv51.sys
2007-08-15 21:36 178,872 –a—— C:\WINDOWS\system32\drivers\PavProc.sys
2007-08-15 21:22 d——– C:\Program Files\STOPzilla!
2007-08-15 21:21 d——– C:\DOCUME~1\User\APPLIC~1\Spam Monitor
2007-08-15 21:15 d——– C:\DOCUME~1\User\APPLIC~1\Bitdefender
2007-08-15 21:12 32,528 –a—— C:\WINDOWS\system32\drivers\vetmonnt.sys
2007-08-15 21:12 21,648 –a—— C:\WINDOWS\system32\drivers\vetfddnt.sys
2007-08-15 21:08 81,984 –a—— C:\WINDOWS\system32\bdod.bin
2007-08-15 21:03 d——– C:\Program Files\Ashampoo
2007-08-15 21:02 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\BitDefender
2007-08-15 20:01 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab
2007-08-15 19:59 d——– C:\KAV
2007-08-15 19:54 d——– C:\DOCUME~1\User\APPLIC~1\TrojanHunter
2007-08-15 19:09 d——– C:\Program Files\Privacy Guardian
2007-08-15 19:06 82,248 –a—— C:\WINDOWS\system32\drivers\iksyssec.sys
2007-08-15 19:06 57,672 –a—— C:\WINDOWS\system32\drivers\iksysflt.sys
2007-08-15 19:06 40,264 –a—— C:\WINDOWS\system32\drivers\ikfilesec.sys
2007-08-15 19:06 29,000 –a—— C:\WINDOWS\system32\drivers\kcom.sys
2007-08-15 19:06 d——– C:\Program Files\Spyware Doctor
2007-08-15 19:06 d——– C:\DOCUME~1\User\APPLIC~1\PC Tools
2007-08-15 19:05 626,688 –a—— C:\WINDOWS\system32\msvcr80.dll
2007-08-15 19:05 d——– C:\Program Files\Spam Monitor
2007-08-15 18:58 75,248 –a—— C:\WINDOWS\zllsputility.exe
2007-08-15 18:58 4,212 —h—– C:\WINDOWS\system32\zllictbl.dat
2007-08-15 18:58 11,264 –a—— C:\WINDOWS\system32\SpOrder.dll
2007-08-15 18:58 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\MailFrontier
2007-08-15 18:57 75,932 –a—— C:\WINDOWS\system32\drivers\klick.dat
2007-08-15 18:57 74,396 –a—— C:\WINDOWS\system32\drivers\klin.dat
2007-08-15 18:57 110,360 –a—— C:\WINDOWS\system32\drivers\kl1.sys
2007-08-15 18:57 1,086,952 –a—— C:\WINDOWS\system32\zpeng24.dll
2007-08-15 18:57 d——– C:\WINDOWS\system32\ZoneLabs
2007-08-15 18:56 d——– C:\WINDOWS\Internet Logs
2007-08-15 18:56 d——– C:\Program Files\TrojanHunter 4.7
2007-08-15 18:26 d——– C:\Program Files\Common Files\Panda Software
2007-08-10 12:55 d——– C:\DOCUME~1\User\APPLIC~1\Wizards of the Coast
2007-08-10 12:54 2,297,552 –a—— C:\WINDOWS\system32\d3dx9_26.dll
2007-08-08 07:42 d——– C:\DOCUME~1\User\APPLIC~1\InstallShield
2007-08-08 07:34 d—-c— C:\WINDOWS\system32\DRVSTORE
2007-08-08 07:34 d——– C:\Program Files\iTunes
2007-08-08 07:34 d——– C:\Program Files\iPod
2007-08-08 07:34 d——– C:\Program Files\Common Files\Apple
2007-08-06 14:58 d——– C:\Program Files\Magic Workstation
2007-08-05 10:37 d——– C:\Program Files\Kap.SATr
2007-08-05 10:32 d——– C:\WINDOWS\system32\appmgmt
2007-08-05 10:03 d——– C:\Program Files\Virtual CD v9
2007-08-02 22:42 d——– C:\DOCUME~1\User\APPLIC~1\Apple Computer
2007-08-02 18:13 d——– C:\Program Files\QuickTime
2007-08-02 18:13 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
2007-08-02 18:12 d——– C:\Program Files\Apple Software Update
2007-08-02 18:12 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
2007-07-26 23:00 d——– C:\DOCUME~1\User\APPLIC~1\Nexon
2007-07-25 22:04 d——– C:\DOCUME~1\User\APPLIC~1\RVM
2007-07-22 11:34 d——– C:\Program Files\ZC2.10
2007-07-21 15:15 d——– C:\Program Files\directx


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-15 21:52 ——— d——– C:\Program Files\Google
2007-08-10 16:34 43520 –a—— C:\WINDOWS\system32\CmdLineExt03.dll
2007-08-10 12:32 ——— d–h—– C:\Program Files\InstallShield Installation Information
2007-08-06 16:13 21840 –a—-t- C:\WINDOWS\system32\SIntfNT.dll
2007-08-06 16:13 17212 –a—-t- C:\WINDOWS\system32\SIntf32.dll
2007-08-06 16:13 12067 –a—-t- C:\WINDOWS\system32\SIntf16.dll
2007-08-06 15:35 ——— d——– C:\DOCUME~1\User\APPLIC~1\My Battle for Middle-earth Files
2007-08-05 10:33 ——— d——– C:\Program Files\Starcraft
2007-08-05 10:23 ——— d——– C:\Program Files\Camelot Systems
2007-07-28 10:54 454 –a—— C:\Program Files\Shortcut to xerox.lnk
2007-07-15 21:55 ——— d——– C:\DOCUME~1\User\APPLIC~1\AdobeUM
2007-07-15 21:54 ——— d——– C:\DOCUME~1\User\APPLIC~1\WinRAR
2007-07-12 17:29 ——— d——– C:\DOCUME~1\User\APPLIC~1\Dev-Cpp
2007-07-08 18:35 ——— d–h—– C:\DOCUME~1\User\APPLIC~1\ijjigame
2007-07-08 10:13 ——— d——– C:\Program Files\Flash Saver
2007-07-03 17:49 73216 –a—— C:\WINDOWS\ST6UNST.EXE
2007-07-03 17:49 249856 ——— C:\WINDOWS\Setup1.exe
2007-07-03 17:15 ——— d——– C:\Program Files\Yahoo!
2007-07-03 17:15 ——— d——– C:\Program Files\Common Files\Scanner
2007-07-03 17:14 ——— d——– C:\DOCUME~1\User\APPLIC~1\Yahoo!
2007-06-26 22:38 ——— d——– C:\DOCUME~1\User\APPLIC~1\CyberLink
2007-06-24 20:35 ——— d——– C:\Program Files\Common Files\EasyInfo
2007-06-23 18:43 ——— d——– C:\Program Files\Samsung
2007-06-16 19:35 28672 –a—— C:\WINDOWS\system32\qttask.exe
2007-06-16 17:29 2722 –a—— C:\WINDOWS\pchealth\helpctr\PackageStore\SkuStore.bin
2007-06-16 17:28 8972 –a—— C:\WINDOWS\pchealth\helpctr\Config\Cntstore.bin
2007-06-16 13:46 0 -rahs—- C:\MSDOS.SYS
2007-06-16 13:46 0 -rahs—- C:\IO.SYS
2007-06-16 13:46 0 –a—— C:\CONFIG.SYS
2007-06-16 13:46 0 –a—— C:\AUTOEXEC.BAT
2007-06-09 16:50 52224 –a—— C:\WINDOWS\system32\dmutil.dll
2007-06-09 16:50 51712 –a—— C:\WINDOWS\system32\wzcsapi.dll
2007-06-09 16:50 47616 –a—— C:\WINDOWS\system32\iyuv_32.dll
2007-06-09 16:50 47104 –a—— C:\WINDOWS\system32\cnbjmon.dll
2007-06-09 16:50 359936 –a—— C:\WINDOWS\system32\wzcsvc.dll
2007-06-09 16:50 35328 –a—— C:\WINDOWS\system32\pid.dll
2007-06-09 16:50 20992 –a—— C:\WINDOWS\system32\hid.dll
2007-06-09 16:50 17408 –a—— C:\WINDOWS\system32\msyuv.dll
2007-06-09 16:50 1580544 –a—— C:\WINDOWS\system32\sfcfiles.dll
2007-06-09 16:50 15360 –a—— C:\WINDOWS\system32\pjlmon.dll
2007-06-09 16:48 86073 –a—— C:\WINDOWS\system32\usrfaxa.dll
2007-06-09 16:48 8192 –a—— C:\WINDOWS\system32\tsbyuv.dll
2007-06-09 16:48 8192 –a—— C:\WINDOWS\system32\streamci.dll
2007-06-09 16:48 77891 –a—— C:\WINDOWS\system32\usrmlnka.exe
2007-06-09 16:48 77890 –a—— C:\WINDOWS\system32\usrdpa.dll
2007-06-09 16:48 77883 –a—— C:\WINDOWS\system32\usrrtosa.dll
2007-06-09 16:48 72192 –a—— C:\WINDOWS\system32\sprio800.dll
2007-06-09 16:48 70656 –a—— C:\WINDOWS\system32\sprio600.dll
2007-06-09 16:48 69700 –a—— C:\WINDOWS\system32\usrshuta.exe
2007-06-09 16:48 69699 –a—— C:\WINDOWS\system32\usrcoina.dll
2007-06-09 16:48 69632 –a—— C:\WINDOWS\system32\spnike.dll
2007-06-09 16:48 61508 –a—— C:\WINDOWS\system32\usrprbda.exe
2007-06-09 16:48 61500 –a—— C:\WINDOWS\system32\usrcntra.dll
2007-06-09 16:48 55296 –a—— C:\WINDOWS\system32\dvdplay.exe
2007-06-09 16:48 53305 –a—— C:\WINDOWS\system32\usrlbva.dll
2007-06-09 16:48 49211 –a—— C:\WINDOWS\system32\usrvpa.dll
2007-06-09 16:48 49211 –a—— C:\WINDOWS\system32\usrsdpia.dll
2007-06-09 16:48 49209 –a—— C:\WINDOWS\system32\usrv80a.dll
2007-06-09 16:48 45116 –a—— C:\WINDOWS\system32\usrvoica.dll
2007-06-09 16:48 41019 –a—— C:\WINDOWS\system32\usrsvpia.dll
2007-06-09 16:48 323641 –a—— C:\WINDOWS\system32\usrdtea.dll
2007-06-09 16:48 3200 –a—— C:\WINDOWS\system32\wowfax.dll
2007-06-09 16:48 157696 –a—— C:\WINDOWS\system32\paqsp.dll
2007-06-09 16:48 147968 –a—— C:\WINDOWS\system32\mdwmdmsp.dll
2007-06-09 16:48 13824 –a—— C:\WINDOWS\system32\wowfaxui.dll
2007-06-09 16:48 102457 –a—— C:\WINDOWS\system32\usrv42a.dll
2007-06-09 16:39 498742 –a—— C:\WINDOWS\system32\dxmasf.dll
2007-06-09 16:39 2854400 –a—— C:\WINDOWS\system32\msi.dll
2007-06-09 16:39 246814 –a—— C:\WINDOWS\system32\strmdll.dll
2007-06-09 16:37 292864 –a—— C:\WINDOWS\system32\winsrv.dll
2007-06-09 16:37 185344 –a—— C:\WINDOWS\system32\upnphost.dll
2007-06-09 16:36 981760 –a—— C:\WINDOWS\system32\mfc42u.dll
2007-06-09 16:36 927504 –a—— C:\WINDOWS\system32\mfc40u.dll
2007-06-09 16:36 726528 –a—— C:\WINDOWS\system32\lsasrv.dll
2007-06-09 16:36 713216 –a—— C:\WINDOWS\system32\sxs.dll
2007-06-09 16:36 679424 –a—— C:\WINDOWS\system32\inetcomm.dll
2007-06-09 16:36 65536 –a—— C:\WINDOWS\system32\nwwks.dll
2007-06-09 16:36 64000 –a—— C:\WINDOWS\system32\nwapi32.dll
2007-06-09 16:36 578048 –a—— C:\WINDOWS\system32\user32.dll
2007-06-09 16:36 40960 –a—— C:\WINDOWS\system32\mf3216.dll
2007-06-09 16:36 282112 –a—— C:\WINDOWS\system32\gdi32.dll
2007-06-09 16:36 1843968 –a—— C:\WINDOWS\system32\win32k.sys
2007-06-09 16:36 142336 –a—— C:\WINDOWS\system32\nwprovau.dll
2007-06-09 16:36 132096 –a—— C:\WINDOWS\system32\wkssvc.dll
2007-06-09 16:36 122880 –a—— C:\WINDOWS\system32\oledlg.dll
2007-06-09 16:36 1084416 –a—— C:\WINDOWS\system32\msxml3.dll
2007-06-09 16:35 956416 –a—— C:\WINDOWS\system32\msdtctm.dll
2007-06-09 16:35 91136 –a—— C:\WINDOWS\system32\mtxoci.dll
2007-06-09 16:35 74752 –a—— C:\WINDOWS\system32\olecli32.dll
2007-06-09 16:35 72704 –a—— C:\WINDOWS\system32\hlink.dll
2007-06-09 16:35 69120 –a—— C:\WINDOWS\system32\ciodm.dll
2007-06-09 16:35 66560 –a—— C:\WINDOWS\system32\mtxclu.dll
2007-06-09 16:35 617472 –a—— C:\WINDOWS\system32\comctl32.dll
2007-06-09 16:35 59392 –a—— C:\WINDOWS\system32\stclient.dll
2007-06-09 16:35 426496 –a—— C:\WINDOWS\system32\msdtcprx.dll
2007-06-09 16:35 398848 –a—— C:\WINDOWS\system32\rpcss.dll
2007-06-09 16:35 37376 –a—— C:\WINDOWS\system32\olecnv32.dll
2007-06-09 16:35 23040 –a—— C:\WINDOWS\system32\fltMc.exe
2007-06-09 16:35 16896 –a—— C:\WINDOWS\system32\fltlib.dll
2007-06-09 16:35 161280 –a—— C:\WINDOWS\system32\msdtcuiu.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-03 15:32]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-03 15:32]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-04-05 14:22]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-04-05 14:19]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-06-21 21:54]
"SDTray"="C:\Program Files\Spyware Doctor\SDTrayApp.exe" [2007-08-14 17:02]
"BDMCon"="C:\Program Files\Softwin\BitDefender10\bdmcon.exe" [2007-04-02 16:48]
"BDAgent"="C:\Program Files\Softwin\BitDefender10\bdagent.exe" [2007-03-26 15:49]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Spam Monitor"="C:\Program Files\Spam Monitor\SpamMonitor.Exe" [2007-05-08 17:33]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"nltide_3"=rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
2Wire Wireless Client.lnk - C:\Program Files\2Wire 802.11g Wireless\PRISMCFG.exe [2007-06-16 15:48:32]
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=sockspy.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk
backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]
C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
C:\WINDOWS\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PRISMSVR.EXE]
"C:\WINDOWS\system32\PRISMSVR.EXE" /APPLY

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegistryMechanic]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
"C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
C:\Program Files\Analog Devices\Core\smax4pnp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ose"=3 (0x3)
"iPod Service"=3 (0x3)

R1 ShldDrv;Panda File Shield Driver;C:\WINDOWS\system32\DRIVERS\ShlDrv51.sys
R2 PavProc;Panda Process Protection Driver;\??\C:\WINDOWS\system32\DRIVERS\PavProc.sys
S3 MOSUMAC;USB-Ethernet Driver;C:\WINDOWS\system32\DRIVERS\MOSUMAC.SYS
S3 WlanUIG;2Wire 802.11g USB Driver;C:\WINDOWS\system32\DRIVERS\WlanUIG.sys


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{efbcf344-1c0d-11dc-bba3-806d6172696f}]
AutoRun\command- D:\autorun.exe


Contents of the 'Scheduled Tasks' folder
2007-08-17 22:59:59 C:\WINDOWS\Tasks\AdwareAlert Scheduled Scan.job
2007-08-15 03:19:19 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-19 13:33:56
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-19 13:36:12 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-08-19 13:36
C:\ComboFix2.txt … 2007-08-17 20:50

— E O F —








Logfile of HijackThis v1.99.1
Scan saved at 1:37:32 PM, on 8/19/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Softwin\BitDefender10\vsserv.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Softwin\BitDefender10\bdmcon.exe
C:\Program Files\Softwin\BitDefender10\bdagent.exe
C:\Program Files\Spam Monitor\SpamMonitor.Exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\2Wire 802.11g Wireless\PRISMCFG.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=…6Ojg5&lid=2
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/def…//www.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
O4 - HKCU\..\Run: [Spam Monitor] C:\Program Files\Spam Monitor\SpamMonitor.Exe
O4 - Global Startup: 2Wire Wireless Client.lnk = C:\Program Files\2Wire 802.11g Wireless\PRISMCFG.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Save Flash In This Page by Flash Saver - C:\PROGRA~1\FLASHS~1\save.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Flash Saver - {09EA1F80-F40A-11D1-B792-444553540001} - C:\PROGRA~1\FLASHS~1\save.htm
O9 - Extra 'Tools' menuitem: Flash Saver - {09EA1F80-F40A-11D1-B792-444553540001} - C:\PROGRA~1\FLASHS~1\save.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} (ijjiPlugin2 Class) - http://gamedownload.ijjimax.com/gamedownlo…Plugin11USA.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender10\vsserv.exe" /service (file missing)
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)
Post #12 last edited
You appear to have picked up a trojan!

Your logs are looking pretty good. Now one last check of your ENTIRE system to make sure that no "baddies" are lurking:

Please use the Internet Explorer browser, and do an online scan with Kaspersky Online Scanner
Click Yes, when prompted to install its ActiveX component.
(Note.. for Internet Explorer 7 users: If at any time you have trouble with the "Accept" button of the license, click on the "Zoom" tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license has been accepted, reset to 100%.)
The program launches and downloads the latest definition files.
  • Once the files are downloaded click on Next
  • Click on Scan Settings and configure as follows:
    • Scan using the following Anti-Virus database:
      • Extended
    • Scan Options:Scan Archives
      Scan Mail Bases
  • Click OK and, under select a target to scan, select My Computer
When the scan is done, in the Scan is completed window (below), any infection is displayed.
There is no option to clean/disinfect, however, we need to analyze the information on the report.
[external image: Posted Image]
[external image: Posted Image]
To obtain the report:
Click on: Save Report As (above - red blinking arrow)
Next, in the Save as prompt, Save in area, select: Desktop
In the File name area, use KScan, or something similar
In Save as type, click the drop arrow and select: Text file [*.txt]
Then, click: Save
Please post the Kaspersky Online Scanner Report in your reply, along with a fresh HijackThis log
Post #13
K thanks. I will do this as fast as i can. Oh, btw, thanks a lot. You saved my computer :) i am noticing that the wierd thing is not downloading anymore :) your the best. i will post up the new log as soon as i am done
Post #14
Hey, i finished the scan. Also, im kind of worried, because the scanner said i had a virus. The virus was the same one as before, but it was located in the system restore section. Im gonna post the log. Please tell me what to do. Do i have to delete that system restore or something?


——————————————————————————-
KASPERSKY ONLINE SCANNER REPORT
Sunday, August 19, 2007 4:23:18 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.93.0
Kaspersky Anti-Virus database last update: 19/08/2007
Kaspersky Anti-Virus database records: 385227
——————————————————————————-

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\

Scan Statistics:
Total number of scanned objects: 31013
Number of viruses found: 1
Number of infected objects: 1
Number of suspicious objects: 0
Duration of the scan process: 00:46:34

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Prism\e0ef72c5 Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\User\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\User\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\User\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\User\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\User\Local Settings\History\History.IE5\MSHist012007081920070820\index.dat Object is locked skipped
C:\Documents and Settings\User\Local Settings\Temp\~DF61E5.tmp Object is locked skipped
C:\Documents and Settings\User\Local Settings\Temp\~DF9482.tmp Object is locked skipped
C:\Documents and Settings\User\Local Settings\Temp\~DF9493.tmp Object is locked skipped
C:\Documents and Settings\User\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\User\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\User\ntuser.dat.LOG Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{8FFA6114-93D9-48C9-AD28-7DAB203C9983}\RP78\A0016004.ocx Infected: Trojan.Win32.Agent.ahq skipped
C:\System Volume Information\_restore{8FFA6114-93D9-48C9-AD28-7DAB203C9983}\RP87\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\Internet Logs\fwdbglog.txt Object is locked skipped
C:\WINDOWS\Internet Logs\fwpktlog.txt Object is locked skipped
C:\WINDOWS\Internet Logs\IAMDB.RDB Object is locked skipped
C:\WINDOWS\Internet Logs\L33T_H4XX0RZ.ldb Object is locked skipped
C:\WINDOWS\Internet Logs\tvDebug.log Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{7ED18D8C-EE82-4880-9432-2941A4F306AF}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\system32\bdss.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edbtmp.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\Temp\tmp00000112\tmp00000000 Object is locked skipped
C:\WINDOWS\Temp\ZLT041de.TMP Object is locked skipped
C:\WINDOWS\Temp\ZLT068c8.TMP Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.













Logfile of HijackThis v1.99.1
Scan saved at 4:24:31 PM, on 8/19/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\Program Files\Softwin\BitDefender10\bdmcon.exe
C:\Program Files\Softwin\BitDefender10\bdagent.exe
C:\Program Files\Spam Monitor\SpamMonitor.Exe
C:\Program Files\2Wire 802.11g Wireless\PRISMCFG.exe
C:\WINDOWS\system32\PRISMSVR.EXE
C:\WINDOWS\System32\alg.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Softwin\BitDefender10\vsserv.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/def…//www.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
O4 - HKCU\..\Run: [Spam Monitor] C:\Program Files\Spam Monitor\SpamMonitor.Exe
O4 - Global Startup: 2Wire Wireless Client.lnk = C:\Program Files\2Wire 802.11g Wireless\PRISMCFG.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Save Flash In This Page by Flash Saver - C:\PROGRA~1\FLASHS~1\save.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Flash Saver - {09EA1F80-F40A-11D1-B792-444553540001} - C:\PROGRA~1\FLASHS~1\save.htm
O9 - Extra 'Tools' menuitem: Flash Saver - {09EA1F80-F40A-11D1-B792-444553540001} - C:\PROGRA~1\FLASHS~1\save.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} (ijjiPlugin2 Class) - http://gamedownload.ijjimax.com/gamedownlo…Plugin11USA.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender10\vsserv.exe" /service (file missing)
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)
Post #15
Nothing to worry about. Cleaning out the Restore Cache is one part of our final cleanup procedures. The trojan will not do any harm there. Seeing that everything links so good, please tell me how things are now running and things are good on your end, give the the OK and we will proceed with the final cleanup procedures. Trevuren

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI