What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

My HJT Log

24 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Darn. Not seeing anything in review of logs to assist on this one. Often an issue with protective software blocking ActiveX content, so check those settings as well. You may want to post this as a new request in the WTT Microsoft Windows forum for other ideas.
Post #18 last edited
I checked myspace - the only Flash Player option I noticed was for the ads - though the one I saw was entertaining enough. To listen to those there is an option to allow access for a speed.pointroll.com webserver, which is a media adserver. If you are not getting that option you may have this particular site blocked in perhaps your Hosts file or through some other software setting that blocks ads and popups. Navigate to C:\WINDOWS\system32\drivers\etc and open the Hosts file using Notepad - if you see an entry there for pointroll you can remove that to check. Can't say as this is a known bad site, just an ad site.
Post #19 last edited
Ill check that but no if you have a profile on myspace though there is mini music players people have on there profiles to listen to music. I just checked though and there is no pointroll entry
Post #20
Whatever is wrong im not sure if it is fixed. I was on my computer and suddenly everything went EXTREMELY slow. After about 15 minutes a error came up saying something about low virtual memory. Then after about 20 minutes when I got slight control of my computer i restarted my computer. RIght as i was restarting my antivirus came up with its auto protect screen saying it found like 5 virus's! Ahh
Post #21
Did you write down any files or locations of items found? Hard to guess from just that info if it isn't picking up active items or things like System Restore entries.

Download ComboFix.exe again from here to your desktop, and click the downloaded file to run the repair.

When the command window opens, select 1 (and Enter). Allow the scan to run. When completed a text window will appear - please copy/paste the contents back here. This log can also be found at C:\ComboFix.txt.

A caution - do not touch your mouse/keyboard until the scan has completed. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs, please reboot to restore the desktop.

Post back that log along with a HijackThis log and any file info from what the scan located please.
Post #22
Well autoprotect hasnt opened up again yet for me to get more information. But im leaving my house now for like half the day and will run a full scan with norton.

ComboFix 07-11-02.3 - Michael Rendon 2007-11-03 7:28:36.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.276 [GMT -4:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2007-10-03 to 2007-11-03 )))))))))))))))))))))))))))))))
.

2007-10-24 22:49 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-10-17 18:16 d——– C:\Program Files\iTunes
2007-10-17 18:13 d——– C:\Program Files\QuickTime
2007-10-17 18:11 d——– C:\Program Files\Apple Software Update
2007-10-17 18:10 d—-c— C:\WINDOWS\system32\DRVSTORE
2007-10-17 18:10 d——– C:\Program Files\Common Files\Apple
2007-10-17 18:10 d——– C:\Documents and Settings\All Users\Application Data\Apple
2007-10-11 18:12 d——– C:\Program Files\Viewpoint
2007-10-11 18:02 d——– C:\Program Files\AIM6
2007-10-09 18:01 582,656 ——— C:\WINDOWS\system32\dllcache\rpcrt4.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-03 04:10 ——— d—–w C:\Program Files\Symantec AntiVirus
2007-10-17 22:16 ——— d—–w C:\Program Files\iPod
2007-10-17 03:16 ——— d—–w C:\Documents and Settings\Michael Rendon\Application Data\AdobeUM
2007-10-12 16:37 ——— d—–w C:\Documents and Settings\Michael Rendon\Application Data\Viewpoint
2007-10-11 22:12 ——— d—–w C:\Documents and Settings\All Users\Application Data\Viewpoint
2007-10-11 01:06 ——— d—–w C:\Documents and Settings\Michael Rendon\Application Data\Azureus
2007-10-02 00:35 ——— d–h–w C:\Documents and Settings\Michael Rendon\Application Data\Move Networks
2007-09-16 01:48 ——— d—–w C:\Program Files\McGraw-Hill's SAT I Review
2007-09-12 00:21 ——— d—–w C:\Documents and Settings\Michael Rendon\Application Data\acccore
2007-09-11 23:19 ——— d—–w C:\Program Files\Microsoft IntelliPoint
2007-09-11 23:18 ——— d—–w C:\Program Files\Microsoft IntelliType Pro
2007-09-06 01:57 ——— d—–w C:\Program Files\SUPERAntiSpyware
2007-09-06 01:54 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2007-09-06 01:54 ——— d—–w C:\Documents and Settings\Michael Rendon\Application Data\SUPERAntiSpyware.com
2007-09-06 01:54 ——— d—–w C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2007-08-21 06:15 683,520 —-a-w C:\WINDOWS\system32\inetcomm.dll
2007-08-21 06:15 683,520 ——w C:\WINDOWS\system32\dllcache\inetcomm.dll
2007-08-20 10:04 824,832 —-a-w C:\WINDOWS\system32\dllcache\wininet.dll
2007-08-20 10:04 671,232 —-a-w C:\WINDOWS\system32\dllcache\mstime.dll
2007-08-20 10:04 63,488 ——w C:\WINDOWS\system32\dllcache\icardie.dll
2007-08-20 10:04 6,058,496 ——w C:\WINDOWS\system32\dllcache\ieframe.dll
2007-08-20 10:04 52,224 ——w C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2007-08-20 10:04 477,696 —-a-w C:\WINDOWS\system32\dllcache\mshtmled.dll
2007-08-20 10:04 459,264 ——w C:\WINDOWS\system32\dllcache\msfeeds.dll
2007-08-20 10:04 44,544 ——w C:\WINDOWS\system32\dllcache\iernonce.dll
2007-08-20 10:04 384,512 ——w C:\WINDOWS\system32\dllcache\iedkcs32.dll
2007-08-20 10:04 383,488 ——w C:\WINDOWS\system32\dllcache\ieapfltr.dll
2007-08-20 10:04 3,584,512 —-a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2007-08-20 10:04 27,648 —-a-w C:\WINDOWS\system32\dllcache\jsproxy.dll
2007-08-20 10:04 267,776 ——w C:\WINDOWS\system32\dllcache\iertutil.dll
2007-08-20 10:04 232,960 ——w C:\WINDOWS\system32\dllcache\webcheck.dll
2007-08-20 10:04 230,400 ——w C:\WINDOWS\system32\dllcache\ieaksie.dll
2007-08-20 10:04 214,528 —-a-w C:\WINDOWS\system32\dllcache\dxtrans.dll
2007-08-20 10:04 193,024 —-a-w C:\WINDOWS\system32\dllcache\msrating.dll
2007-08-20 10:04 153,088 ——w C:\WINDOWS\system32\dllcache\ieakeng.dll
2007-08-20 10:04 132,608 —-a-w C:\WINDOWS\system32\dllcache\extmgr.dll
2007-08-20 10:04 124,928 ——w C:\WINDOWS\system32\dllcache\advpack.dll
2007-08-20 10:04 105,984 ——w C:\WINDOWS\system32\dllcache\url.dll
2007-08-20 10:04 102,400 ——w C:\WINDOWS\system32\dllcache\occache.dll
2007-08-20 10:04 1,152,000 —-a-w C:\WINDOWS\system32\dllcache\urlmon.dll
2007-08-17 10:21 625,152 ——w C:\WINDOWS\system32\dllcache\iexplore.exe
2007-08-17 10:20 63,488 ——w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2007-08-17 10:20 13,824 ——w C:\WINDOWS\system32\dllcache\ieudinit.exe
2007-08-17 07:34 161,792 ——w C:\WINDOWS\system32\dllcache\ieakui.dll
2007-08-13 01:51 737,280 —-a-w C:\WINDOWS\iun6002.exe
2006-10-21 03:39 49 —-a-w C:\Documents and Settings\Michael Rendon\Application Data\internaldb41.dat
2006-10-21 03:39 337 —-a-w C:\Documents and Settings\Michael Rendon\Application Data\internaldb1942.dat
2006-10-21 03:27 13,046 —-a-w C:\Documents and Settings\Michael Rendon\Application Data\internaldb6131.dat
2006-10-21 03:27 0 —-a-w C:\Documents and Settings\Michael Rendon\Application Data\internaldb1424.dat
2006-10-21 01:57 179,200 —-a-w C:\Documents and Settings\Michael Rendon\Application Data\internaldb7487.dat
2006-10-19 00:44 9,216 —-a-w C:\Documents and Settings\Michael Rendon\Application Data\internaldb7517.dat
2006-10-19 00:44 0 —-a-w C:\Documents and Settings\Michael Rendon\Application Data\internaldb8614.dat
2006-10-19 00:44 0 —-a-w C:\Documents and Settings\Michael Rendon\Application Data\internaldb7741.dat
2006-10-19 00:44 0 —-a-w C:\Documents and Settings\Michael Rendon\Application Data\internaldb7190.dat
2006-10-19 00:44 0 —-a-w C:\Documents and Settings\Michael Rendon\Application Data\internaldb4864.dat
2006-10-19 00:44 0 —-a-w C:\Documents and Settings\Michael Rendon\Application Data\internaldb4562.dat
2006-05-17 06:20 17 —-a-w C:\Program Files\d.bat
2006-03-19 20:58:37 56 –sh–r C:\WINDOWS\system32\4B22DF3795.sys
2006-03-19 20:58:42 3,350 –sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HostManager"="C:\Program Files\Common Files\AOL\1152943990\ee\AOLSoftware.exe" [2006-05-09 20:24]
"Windows Media Connect 2"="C:\Program Files\Windows Media Connect 2\WMCCFG.exe" [2005-10-06 19:12]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-07-20 21:07]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]
"itype"="C:\Program Files\Microsoft IntelliType Pro\itype.exe" [2006-07-07 19:14]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2006-07-07 19:15]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-09-26 14:42]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 12:24]
"Steam"="C:\Program Files\Valve\Steam\Steam.exe" [2007-10-10 11:29]
"DW4"="C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe" [2006-04-19 09:30]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 07:00]
"NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [2005-04-14 17:56]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-06-21 14:06]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"MySpaceIM"=C:\Program Files\MySpace\IM\MySpaceIM.exe
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2005-12-21 08:58:32]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

R2 nvcap;nVidia WDM Video Capture (universal);C:\WINDOWS\system32\DRIVERS\nvcap.sys
R2 NVXBAR;nVidia WDM A/V Crossbar;C:\WINDOWS\system32\DRIVERS\NVxbar.sys
R2 SVKP;SVKP;\??\C:\WINDOWS\system32\SVKP.sys
R3 LinksysFVNETusbl(AR)®;Linksys FVNETusbl(AR)® Service for Instant Wireless USB Network Adapter ver.2.6;C:\WINDOWS\system32\DRIVERS\vnetusbl.sys

.
Contents of the 'Scheduled Tasks' folder
"2007-10-30 19:49:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
"2007-11-03 11:30:00 C:\WINDOWS\Tasks\User_Feed_Synchronization-{0B07D1DA-5A61-4854-BE9D-D73CF9DE28BA}.job"
- C:\WINDOWS\system32\msfeedssync.exe
.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-03 07:31:44
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-03 7:32:47
C:\ComboFix-quarantined-files.txt … 2007-07-22 21:29
C:\ComboFix2.txt … 2007-10-21 14:52
C:\ComboFix3.txt … 2007-07-22 21:29
.
— E O F —



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:34:48 AM, on 11/03/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Common Files\AOL\1152943990\ee\AOLSoftware.exe
C:\Program Files\Windows Media Connect 2\WMCCFG.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1152943990\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [Windows Media Connect 2] "C:\Program Files\Windows Media Connect 2\WMCCFG.exe" /StartQuiet
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Valve\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [DW4] "C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1163654940968
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.com/games/popcaploader_v10_en.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…800/mcfscan.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

–
End of file - 7283 bytes
Post #23
Not seeing anything right off newly arrived or unwanted there. There are some files I see an expert I know as highly skilled remove, but the info on their use is sketchy right now.


Make sure you can View Hidden Files. Also uncheck "Hide Extensions for Known File Types"

Please locate the following hilighted file(s), zip a copy of it, and go here and follow the instructions to upload the files.

C:\Documents and Settings\Michael Rendon\Application Data\internaldb7487.dat
C:\Documents and Settings\Michael Rendon\Application Data\internaldb7517.dat

You DO NOT need to be a member to upload, anybody can upload the files.


Also Go here for an online AV scan (requires IE to run). If your AV alerts you while the scan installs ignore this - Panda's Active Scan method is often mistaken for infection activity.

Scan "Local Disks" and when finished save the scan log and then post the log here. To save the log first select the See Report button, then select the Save report button, and post that log back here.
Post #24
Ok here is everything you asked for… thanks Incident Status Location Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Michael Rendon\Cookies\michael_rendon@2o7[2].txt Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Michael Rendon\Cookies\[removed][1].txt Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Michael Rendon\Cookies\michael_rendon@atwola[1].txt Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Michael Rendon\Cookies\michael_rendon@mediaplex[2].txt Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Michael Rendon\Cookies\michael_rendon@realmedia[1].txt Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\Documents and Settings\Michael Rendon\Desktop\ComboFix.exe[nircmd.exe] Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\Documents and Settings\Michael Rendon\Desktop\ComboFix.exe[nircmd.cfexe] Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\WINDOWS\nircmd.exe

Attachments:

Post #25
Those files are definitely malware generated, and at a glance appear to generate spam or popup traffic. Not seeing any recent more active functions related to the 5 alerts your AV gave you though, and wondering if it located the same items Panda just found, which are ComboFix.exe and nircmd.exe, both part of the ComboFix tool repairs we did. Post back on any additional info you can provide about those alerts, and delete the following files now (including the two zip copies you made):

C:\Documents and Settings\Michael Rendon\Application Data\internaldb41.dat
C:\Documents and Settings\Michael Rendon\Application Data\internaldb1942.dat
C:\Documents and Settings\Michael Rendon\Application Data\internaldb6131.dat
C:\Documents and Settings\Michael Rendon\Application Data\internaldb1424.dat
C:\Documents and Settings\Michael Rendon\Application Data\internaldb7487.dat
C:\Documents and Settings\Michael Rendon\Application Data\internaldb7517.dat
C:\Documents and Settings\Michael Rendon\Application Data\internaldb8614.dat
C:\Documents and Settings\Michael Rendon\Application Data\internaldb7741.dat
C:\Documents and Settings\Michael Rendon\Application Data\internaldb7190.dat
C:\Documents and Settings\Michael Rendon\Application Data\internaldb4864.dat
C:\Documents and Settings\Michael Rendon\Application Data\internaldb4562.dat

Also, as it is an unknown, locate the following file, right click and select Edit, and see what the text in it refers to. If you do not recognize it's purpose right off post back those contents here as well:

C:\Program Files\d.bat
Post #26
Well i deleted all those. And i havnt noticed anymore recent problems. But i didnt recognize the text when i clicked edit. This is what came up in notepad when i did click edit 
del %1
del d.bat
Post #27
Typical of a file left over from infection installation - it is intended to delete something showing there as a variable (%1) as well as itself. It failed on that second task, so you can help it out by deleting it now. Looks like your system is doing okay now. You can delete the files we used as well as folders. To have ComboFix now remove it's files/folders and some changes it just made, go to Start - Run, type the following (Enter after):

ComboFix /u
Post #30 last edited
I really hate to keep this topic going but there was one other small thing that also started when all this happened that i forgot to ask about. My sound. Well I have my speakers plugged in and i CAN hear noise. But the little volume icon is not in my display tray for me to adjust my volume (on the computer). When I go to control panel, then sounds and audio devices it says no audio devices. So evidentaly my computer is not detecting my speakers therefore i cannot adjust the volume at all except by the volume control on the speakers. Some audio files that just happen to be more quiet i cant listen to now. This actualy could have something to do with not being able to hear music on myspace. Here is an example. My keyboard has volume control and mute. When i hit mute nothing happens anymore. And when I try to adjust the volume it shows a little volume bar but it wont move at all it just stays still. OK heres an update before you waste your time. I messed around with the properties and somehow it was set to another audio device (which didnt exist). So I changed it to the other. and BOOM all problems fixed including the myspace thing. haha thanks anyways…and sorry for wastin yur time while you read this lol

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI