[Resolved] Internet Speed Test / Ism Module / Bnddrive2 Found

Hi

Please open FindAWF and press the number 3.

In the Notepad file that opens, copy and paste the following in the Code box into Notepad. Make sure that it's after the line, not before.

Note:Do not type it out to minimize the risk of typo error.

C:\Program Files\iTunes\bak
C:\Program Files\Messenger\bak
C:\Program Files\Microsoft ActiveSync\bak 
C:\Program Files\QuickTime\bak
C:\WINDOWS\ehome\bak 
C:\WINDOWS\system32\bak
C:\Program Files\Alienware\Alienware AlienFX\bak 
C:\Program Files\Alienware\Alienware AlienFX\bak
C:\Program Files\Alwil Software\Avast4\bak
C:\Program Files\CyberLink\PowerDVD\Language\bak

Click on File > Save. Do not choose the Save As… option. Close this Notepad file.

FindAWF will now delete the bad folders. Once done, a log will produced. Do not close this log.

Please do an online scan with Kaspersky Online Scanner. You will be prompted to install an ActiveX component from Kaspersky, Click Yes.

• The program will launch and then start to download the latest definition files.
• Once the scanner is installed and the definitions downloaded, click Next.
• Now click on Scan Settings
• In the scan settings make sure that the following are selected:
  • Scan using the following Anti-Virus database:
    
    + Extended(If available otherwise Standard)
  • Scan Options:
    
    + Scan Archives
    + Scan Mail Bases
• Click OK
• Now under select a target to scan select My Computer
• The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
• Now click on the Save as Text button
• Save the file to your desktop.
• Copy and paste that information in your next post with the new FindAWF log, please.

Find AWF report by noahdfear ©2006 Version 1.40 Option 3 run successfully The current date is: Mon 09/03/2007 The current time is: 17:01:55.26 bak folders found ~~~~~~~~~~~ Duplicate files of bak directory contents ~~~~~~~~~~~~~~~~~~~~~~~ end of report ——————————————————————————- KASPERSKY ONLINE SCANNER REPORT Monday, September 03, 2007 5:52:05 PM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.93.0 Kaspersky Anti-Virus database last update: 4/09/2007 Kaspersky Anti-Virus database records: 403211 ——————————————————————————- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: C:\ D:\ Scan Statistics: Total number of scanned objects: 87694 Number of viruses found: 2 Number of infected objects: 12 Number of suspicious objects: 0 Duration of the scan process: 00:46:19 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\All Users\Application Data\Microsoft\eHome\logs\ehRecvr.log Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Owner\Application Data\$_hpcst$.hpc Object is locked skipped C:\Documents and Settings\Owner\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Application Data\ApplicationHistory\AlienwareAlienFXController.exe.213c96d2.ini.inuse Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Owner\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Owner\Local Settings\History\History.IE5\MSHist012007090320070904\index.dat Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Temp\WCESLog.log Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Owner\ntuser.dat Object is locked skipped C:\Documents and Settings\Owner\NTUSER.DAT.LOG Object is locked skipped C:\Program Files\Alwil Software\Avast4\DATA\aswResp.dat Object is locked skipped C:\Program Files\Alwil Software\Avast4\DATA\Avast4.db Object is locked skipped C:\Program Files\Alwil Software\Avast4\DATA\integ\avast.int Object is locked skipped C:\Program Files\Alwil Software\Avast4\DATA\log\AshWebSv.ws Object is locked skipped C:\Program Files\Alwil Software\Avast4\DATA\log\aswMaiSv.log Object is locked skipped C:\Program Files\Alwil Software\Avast4\DATA\log\nshield.log Object is locked skipped C:\Program Files\Alwil Software\Avast4\DATA\report\Resident protection.txt Object is locked skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{A9A9450F-DBAB-47BB-BC96-7B2012710E69}\RP122\A0031256.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.621 skipped C:\System Volume Information\_restore{A9A9450F-DBAB-47BB-BC96-7B2012710E69}\RP164\A0041135.exe Infected: Trojan.Win32.Small.qi skipped C:\System Volume Information\_restore{A9A9450F-DBAB-47BB-BC96-7B2012710E69}\RP169\A0042326.exe Infected: Trojan.Win32.Small.qi skipped C:\System Volume Information\_restore{A9A9450F-DBAB-47BB-BC96-7B2012710E69}\RP169\A0042612.exe Infected: Trojan.Win32.Small.qi skipped C:\System Volume Information\_restore{A9A9450F-DBAB-47BB-BC96-7B2012710E69}\RP169\A0042636.exe Infected: Trojan.Win32.Small.qi skipped C:\System Volume Information\_restore{A9A9450F-DBAB-47BB-BC96-7B2012710E69}\RP172\A0043314.exe Infected: Trojan.Win32.Small.qi skipped C:\System Volume Information\_restore{A9A9450F-DBAB-47BB-BC96-7B2012710E69}\RP172\A0043315.exe Infected: Trojan.Win32.Small.qi skipped C:\System Volume Information\_restore{A9A9450F-DBAB-47BB-BC96-7B2012710E69}\RP172\A0043316.exe Infected: Trojan.Win32.Small.qi skipped C:\System Volume Information\_restore{A9A9450F-DBAB-47BB-BC96-7B2012710E69}\RP172\A0043317.exe Infected: Trojan.Win32.Small.qi skipped C:\System Volume Information\_restore{A9A9450F-DBAB-47BB-BC96-7B2012710E69}\RP172\A0043319.exe Infected: Trojan.Win32.Small.qi skipped C:\System Volume Information\_restore{A9A9450F-DBAB-47BB-BC96-7B2012710E69}\RP172\A0043320.exe Infected: Trojan.Win32.Small.qi skipped C:\System Volume Information\_restore{A9A9450F-DBAB-47BB-BC96-7B2012710E69}\RP172\A0043323.exe Infected: Trojan.Win32.Small.qi skipped C:\System Volume Information\_restore{A9A9450F-DBAB-47BB-BC96-7B2012710E69}\RP172\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{B1A90E51-C418-44BE-B9B3-59B20D672E95}.crmlog Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Media Ce.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\Temp\Perflib_Perfdata_738.dat Object is locked skipped C:\WINDOWS\Temp\_avast4_\Webshlock.txt Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed.

Hi Could you post a new HijackThis log and let me know how the computer is behaving now?

Hi

You can delete FindAWF and Combofix from your Desktop now.

Navigate to and delete the following folders (if they are present):

Folders:
C:\Combofix
C:\Qoobox

Run HijackThis, select Do a system scan only and place checks against the following entries (if they are still present):
O2 - BHO: (no name) - {348FE907-249E-4C65-A838-F34A193FE1D1} - (no file)


WITH ALL OTHER WINDOWS CLOSED Click on Fix Checked and exit HijackThis.

I would advise updating Adobe Reader, as the latest version clears up any vulnerabilities of previous versions.
First uninstall the version you have on your computer then download and install Adobe Reader 8.1.

This is my usual speech for when you are clean, which you appear to be.

Please follow these simple steps in order to keep your computer clean and secure:
Disable and Enable System Restore.

• Click Start | Help and Support | Undo changes to your computer with System Restore.
• Click Create A Restore Point then click Next. Give it a name it and then click Create, then Close.
• Close the Help and Support Center box.
• Click Start | Run and type Cleanmgr
• Select (C: ) then click OK.
• Click the More Options tab.
• Click Clean Up in the System Restore Section.

This will remove all previous restore points except the newly created one.

Here are some free programs, I recommend.

Spybot Search and Destroy
Download it from here . Just choose a mirror and off you go.
Find here the tutorial on how to use Spybot properly here

Install Spyware Guard
Download it from here
Find here the tutorial on how to use Spyware Guard here

Install SpyWare Blaster
Download it from here
Find here the tutorial on how to use Spyware Blaster here

Install WinPatrol
Download it from here
Here you can find information about how WinPatrol works here


Make sure your Windows is ALWAYS up to date!

An unpatched Windows is vulnerable and even with the "best" Antivirus and Firewall installed, malware will find its way through.
So visit http://windowsupdate.microsoft.com/ to download and install the latest updates.


Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.

Please check out Tony Klein's article "How did I get infected in the first place?"


Follow this list and your potential for being infected again will reduce dramatically.

Glad I was able to help.

Hi Scotty, I cannot thank you enough for taking the time to help me. Everything seems to be running great. Thanks a bunch!

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.