
HijackThis Log Please Help
#1
Posted 29 October 2007 - 11:26 PM
Register to Remove
#2
Posted 30 October 2007 - 07:59 AM


#3
Posted 31 October 2007 - 08:26 AM

1. Download this file - combofix.exe
2. Double click combofix.exe & follow the prompts.
3. When finished, it shall produce a log for you. Post that log in your next reply
Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall!
____________________
Download SmitfraudFix (by S!Ri) to your Desktop.
http://siri.urz.free...mitfraudFix.exe
Double-click SmitfraudFix.exe
Select option #1 - Search by typing 1 and press Enter
This program will scan large amounts of files on your computer for known patterns so please be patient while it works. When it is done, the results of the scan will be displayed and it will create a log named rapport.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.
IMPORTANT: Do NOT run any other options until you are asked to do so!
**If the tool fails to launch from the Desktop, please move SmitfraudFix.exe directly to the root of the system drive (usually C:), and launch from there.
_______________________
Looking over your log, it seems you don't have any evidence of an anti-virus software.
Anti-virus software are programs that detect, cleanse, and erase harmful virus files on a computer, Web server, or network. Unchecked, virus files can unintentionally be forwarded to others, including trading partners and thereby spreading infection. Because new viruses regularly emerge, anti-virus software should be updated frequently. Anti-virus software can scan the computer memory and disk drives for malicious code. They can alert the user if a virus is present, and will clean, delete (or quarantine) infected files or directories. Please download a free anti-virus software from one these excellent vendors NOW:
1) Antivir PersonalEdition Classic - Free anti-virus software for Windows. Detects and removes more than 50,000 viruses. Free support.
2) avast! 4 Home Edition - Anti-virus program for Windows. The home edition is freeware for noncommercial users.
3) AVG Anti-Virus Free Edition - Free edition of the AVG anti-virus program for Windows.
It is strongly recommended that you run only one antivirus program at a time. Having more than one antivirus program active in memory uses additional resources and can result in program conflicts and false virus alerts. If you choose to install more than one antivirus program on your computer, then only one of them should be active in memory at a time.
__________________
Post:
- A fresh HijackThis log
- Contents of C:\ComboFix.txt
- Contents of C:\Rapport.txt
#4
Posted 01 November 2007 - 12:27 AM
Hijack this log:
Logfile of HijackThis v1.99.1
Scan saved at 11:17:40 PM, on 10/31/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\Program Files\hijackthis\HijackThis.exe
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [CountrySelection] pctptt.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll
O20 - Winlogon Notify: cbxxy - C:\WINDOWS\System32\cbxxy.dll
O20 - Winlogon Notify: fccdd - C:\WINDOWS\System32\fccdd.dll
O20 - Winlogon Notify: hggfc - C:\WINDOWS\System32\hggfc.dll
O20 - Winlogon Notify: khfgd - C:\WINDOWS\System32\khfgd.dll
O20 - Winlogon Notify: khfgf - C:\WINDOWS\System32\khfgf.dll (file missing)
O20 - Winlogon Notify: nnnnljj - C:\WINDOWS\SYSTEM32\nnnnljj.dll
O20 - Winlogon Notify: rqrpm - C:\WINDOWS\System32\rqrpm.dll
O20 - Winlogon Notify: urqom - C:\WINDOWS\System32\urqom.dll
O20 - Winlogon Notify: vtspm - C:\WINDOWS\System32\vtspm.dll
O20 - Winlogon Notify: wvwts - C:\WINDOWS\System32\wvwts.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: W2k PCtel speaker phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
Combofix log:
ComboFix 07-11-01.1 - Tai 2007-10-31 23:02:48.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.1.1252.1.1033.18.285 [GMT -8:00]
Running from: F:\ComboFix.exe
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\All Users\Application Data.\salesmonitor
C:\Documents and Settings\Tai\Application Data\installer_en[1].exe
C:\Documents and Settings\Tai\Desktop\Error Cleaner.url
C:\Documents and Settings\Tai\Desktop\Privacy Protector.url
C:\Documents and Settings\Tai\Desktop\Spyware&Malware Protection.url
C:\Documents and Settings\Tai\err.log
C:\Documents and Settings\Tai\Favorites\Error Cleaner.url
C:\Documents and Settings\Tai\Favorites\Privacy Protector.url
C:\Documents and Settings\Tai\Favorites\Spyware&Malware Protection.url
C:\Documents and Settings\Tai\ResErrors.log
C:\Program Files\Common Files\companion wizard
C:\Program Files\Common Files\companion wizard\compwiz.exe
C:\Program Files\Common Files\Companion Wizard\WapCHK.dll
C:\Program Files\Insider
C:\Program Files\Insider\Insider.exe
C:\Program Files\Insider\UnInstall.exe
C:\Program Files\ISM2
C:\Program Files\ISM2\dictionary.gz
C:\Program Files\ISM2\targets.gz
C:\Program Files\Words
C:\Program Files\Words\list.txt
C:\Program Files\Words\script.txt
C:\Redemption.ECF
C:\Temp\1cb
C:\Temp\1cb\syscheck.log
C:\Temp\xOe
C:\Temp\xOe\tOasF.log
C:\WINDOWS\b147.exe
C:\WINDOWS\cookies.ini
C:\WINDOWS\Downloaded Program Files.\xpreload.ocx
C:\WINDOWS\Downloaded Program Files\UWA7P_0001_N99M2908NetInstaller.exe
C:\WINDOWS\main_uninstaller.exe
C:\WINDOWS\msmdev.dll
C:\WINDOWS\msmhost.dll
C:\WINDOWS\mssql.dll
C:\WINDOWS\nsduo.dll
C:\WINDOWS\privacy_danger
C:\WINDOWS\rs.txt
C:\WINDOWS\search_res.txt
C:\WINDOWS\syscore.dll
C:\WINDOWS\system32\adfii.bak1
C:\WINDOWS\system32\adfii.ini
C:\WINDOWS\system32\cfggh.bak1
C:\WINDOWS\system32\cfggh.ini
C:\WINDOWS\system32\ddccf.bak1
C:\WINDOWS\system32\ddccf.ini
C:\WINDOWS\system32\dgfhk.bak1
C:\WINDOWS\system32\dgfhk.bak2
C:\WINDOWS\system32\dgfhk.ini
C:\WINDOWS\system32\fgfhk.bak1
C:\WINDOWS\system32\fgfhk.ini
C:\WINDOWS\system32\hggdccb.dll
C:\WINDOWS\system32\hhhjl.bak1
C:\WINDOWS\system32\ihkmp.ini
C:\WINDOWS\system32\iifda.dll
C:\WINDOWS\system32\kkjjl.bak1
C:\WINDOWS\system32\kkjjl.bak2
C:\WINDOWS\system32\ljjkk.dll
C:\WINDOWS\system32\mljgeeb.dll
C:\WINDOWS\system32\moqru.bak1
C:\WINDOWS\system32\moqru.tmp
C:\WINDOWS\system32\mprqr.bak1
C:\WINDOWS\system32\mprqr.bak2
C:\WINDOWS\system32\mprqr.ini
C:\WINDOWS\system32\mprqr.ini2
C:\WINDOWS\system32\mprqr.tmp
C:\WINDOWS\system32\opnlklj.dll
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\system32\pmkhi.dll
C:\WINDOWS\system32\stera.log
C:\WINDOWS\system32\stwvw.bak1
C:\WINDOWS\system32\stwvw.ini
C:\WINDOWS\system32\stwvw.tmp
C:\WINDOWS\system32\sulimo.dat
C:\WINDOWS\system32\tssru.ini
C:\WINDOWS\system32\ursst.dll
C:\WINDOWS\system32\vMW02a
C:\WINDOWS\system32\vMW02a\vMW02a1065.exe
C:\WINDOWS\system32\yxxbc.bak1
C:\WINDOWS\system32\yxxbc.ini
C:\WINDOWS\tsitra572.exe
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\LEGACY_FOPN
((((((((((((((((((((((((( Files Created from 2007-10-01 to 2007-11-01 )))))))))))))))))))))))))))))))
.
2007-10-31 23:02 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-10-29 22:13 <DIR> d-------- C:\Documents and Settings\Tai\Application Data\U3
2007-10-21 20:36 <DIR> d-------- C:\Program Files\New Folder
2007-10-21 16:40 <DIR> d-------- C:\Program Files\Lavasoft
2007-10-21 16:40 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-10-21 14:31 <DIR> d-------- C:\Program Files\Google
2007-10-21 14:31 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Google Updater
2007-10-13 16:53 83,008 --a------ C:\WINDOWS\system32\fcvqsbmt.dll
2007-10-05 21:56 <DIR> d-------- C:\Program Files\CCleaner
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2154-11-18 18:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2154-11-18 18:12 --------- d-----w C:\Program Files\Connection Wizard
2154-11-18 17:53 --------- d-----w C:\Program Files\Yahoo!
2007-10-22 17:42 --------- d-----w C:\Program Files\SecurePCCleaner
2007-10-22 16:24 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-10-22 00:59 --------- d-----w C:\Documents and Settings\Tai\Application Data\MSN6
2007-10-11 16:49 --------- d-----w C:\Program Files\LexmarkX83
2007-10-01 11:20 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-09-23 06:24 --------- d-----w C:\Program Files\Common Files\AOL
2007-09-16 16:04 --------- d-----w C:\Documents and Settings\All Users\Application Data\Webroot
2007-09-12 15:01 --------- d-----w C:\Program Files\MSN Messenger
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe" [2004-02-22 22:44]
"CountrySelection"="pctptt.exe" [2001-03-22 02:08 C:\WINDOWS\system32\pctptt.exe]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ActiveDesktop"=0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cbxxy]
C:\WINDOWS\System32\cbxxy.dll 2007-09-29 22:19 283232 C:\WINDOWS\system32\cbxxy.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\fccdd]
C:\WINDOWS\System32\fccdd.dll 2007-09-30 13:13 283232 C:\WINDOWS\system32\fccdd.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\hggfc]
C:\WINDOWS\System32\hggfc.dll 2007-09-29 11:12 283232 C:\WINDOWS\system32\hggfc.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\khfgd]
C:\WINDOWS\System32\khfgd.dll 2007-09-28 19:27 283232 C:\WINDOWS\system32\khfgd.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\khfgf]
C:\WINDOWS\System32\khfgf.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\nnnnljj]
nnnnljj.dll 2007-09-26 12:28 23552 C:\WINDOWS\system32\nnnnljj.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\rqrpm]
C:\WINDOWS\System32\rqrpm.dll 2007-09-27 21:27 283232 C:\WINDOWS\system32\rqrpm.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\urqom]
C:\WINDOWS\System32\urqom.dll 2007-09-26 14:54 283744 C:\WINDOWS\system32\urqom.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\vtspm]
C:\WINDOWS\System32\vtspm.dll 2007-09-28 14:48 283232 C:\WINDOWS\system32\vtspm.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wvwts]
C:\WINDOWS\System32\wvwts.dll 2007-09-28 06:08 283232 C:\WINDOWS\system32\wvwts.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
R2 Pctspk;W2k PCtel speaker phone;C:\WINDOWS\system32\pctspk.exe
R3 SiS630;SiS630;C:\WINDOWS\System32\DRIVERS\sis630p.sys
S2 BulkUsb;Genesys Logic USB Scanner Controller NT 5.0;C:\WINDOWS\System32\Drivers\usbscan.sys
S3 Ip6FwHlp;IPv6 Internet Connection Firewall;C:\WINDOWS\System32\svchost.exe -k netsvcs
.
**************************************************************************
catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-31 23:06:19
Windows 5.1.2600 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
**************************************************************************
.
Completion time: 2007-10-31 23:07:36 - machine was rebooted
.
--- E O F ---
Rapport:
SmitFraudFix v2.246
Scan done at 23:12:26.87, Wed 10/31/2007
Run from C:\Documents and Settings\Tai\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode
»»»»»»»»»»»»»»»»»»»»»»»» Process
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\WINDOWS\system32\cmd.exe
»»»»»»»»»»»»»»»»»»»»»»»» hosts
»»»»»»»»»»»»»»»»»»»»»»»» C:\
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32
»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Tai
»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Tai\Application Data
»»»»»»»»»»»»»»»»»»»»»»»» Start Menu
»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Tai\FAVORI~1
»»»»»»»»»»»»»»»»»»»»»»»» Desktop
»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files
»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys
»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Privacy Protection"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\1]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""
»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""
»»»»»»»»»»»»»»»»»»»»»»»» Rustock
»»»»»»»»»»»»»»»»»»»»»»»» DNS
Description: SiS 900 PCI Fast Ethernet Adapter
DNS Server Search Order: 192.168.0.1
DNS Server Search Order: 205.171.3.65
HKLM\SYSTEM\CCS\Services\Tcpip\..\{3BCF5D96-10ED-480A-A53F-D6476C805ADA}: DhcpNameServer=192.168.0.1 205.171.3.65
HKLM\SYSTEM\CCS\Services\Tcpip\..\{B569F630-BAA8-4F02-AA15-D6B3C882A23A}: DhcpNameServer=192.168.0.1 205.171.3.65
HKLM\SYSTEM\CS1\Services\Tcpip\..\{3BCF5D96-10ED-480A-A53F-D6476C805ADA}: DhcpNameServer=192.168.0.1 205.171.3.65
HKLM\SYSTEM\CS1\Services\Tcpip\..\{B569F630-BAA8-4F02-AA15-D6B3C882A23A}: DhcpNameServer=192.168.0.1 205.171.3.65
HKLM\SYSTEM\CS2\Services\Tcpip\..\{3BCF5D96-10ED-480A-A53F-D6476C805ADA}: DhcpNameServer=192.168.0.1 205.171.3.65
HKLM\SYSTEM\CS2\Services\Tcpip\..\{B569F630-BAA8-4F02-AA15-D6B3C882A23A}: DhcpNameServer=192.168.0.1 205.171.3.65
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1 205.171.3.65
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1 205.171.3.65
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1 205.171.3.65
»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection
»»»»»»»»»»»»»»»»»»»»»»»» End
#5
Posted 01 November 2007 - 08:49 AM

Open HijackThis, Click Do a system scan only, checkmark these. Then close all other windows except HijackThis and press fix checked.
O20 - Winlogon Notify: cbxxy - C:\WINDOWS\System32\cbxxy.dll
O20 - Winlogon Notify: fccdd - C:\WINDOWS\System32\fccdd.dll
O20 - Winlogon Notify: hggfc - C:\WINDOWS\System32\hggfc.dll
O20 - Winlogon Notify: khfgd - C:\WINDOWS\System32\khfgd.dll
O20 - Winlogon Notify: khfgf - C:\WINDOWS\System32\khfgf.dll (file missing)
O20 - Winlogon Notify: nnnnljj - C:\WINDOWS\SYSTEM32\nnnnljj.dll
O20 - Winlogon Notify: rqrpm - C:\WINDOWS\System32\rqrpm.dll
O20 - Winlogon Notify: urqom - C:\WINDOWS\System32\urqom.dll
O20 - Winlogon Notify: vtspm - C:\WINDOWS\System32\vtspm.dll
O20 - Winlogon Notify: wvwts - C:\WINDOWS\System32\wvwts.dll
________________
Open notepad and copy/paste the text in the quotebox below into it:
File::
C:\WINDOWS\System32\fccdd.dll
C:\WINDOWS\System32\hggfc.dll
C:\WINDOWS\System32\khfgd.dll
C:\WINDOWS\System32\khfgf.dll
C:\WINDOWS\SYSTEM32\nnnnljj.dll
C:\WINDOWS\System32\rqrpm.dll
C:\WINDOWS\System32\urqom.dll
C:\WINDOWS\System32\vtspm.dll
C:\WINDOWS\system32\fcvqsbmt.dll
C:\WINDOWS\System32\cbxxy.dll
C:\WINDOWS\System32\wvwts.dll
Folder::
C:\Program Files\SecurePCCleaner
Save this as CFScript.txt
Then drag the CFScript.txt into ComboFix.exe as you see in the screenshot below.

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThislog.
#6
Posted 01 November 2007 - 03:39 PM
ComboFix 07-11-01.1 - Tai 2007-11-01 14:28:39.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.1.1252.1.1033.18.297 [GMT -8:00]
Running from: F:\ComboFix.exe
Command switches used :: C:\Documents and Settings\Tai\Desktop\CFScript.txt
* Created a new restore point
FILE::
C:\WINDOWS\System32\cbxxy.dll
C:\WINDOWS\System32\fccdd.dll
C:\WINDOWS\System32\fcvqsbmt.dll
C:\WINDOWS\System32\hggfc.dll
C:\WINDOWS\System32\khfgd.dll
C:\WINDOWS\System32\khfgf.dll
C:\WINDOWS\SYSTEM32\nnnnljj.dll
C:\WINDOWS\System32\rqrpm.dll
C:\WINDOWS\System32\urqom.dll
C:\WINDOWS\System32\vtspm.dll
C:\WINDOWS\System32\wvwts.dll
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Program Files\SecurePCCleaner
C:\Program Files\SecurePCCleaner\UGDCcw.exe_tobedeleted
C:\WINDOWS\System32\cbxxy.dll
C:\WINDOWS\System32\fccdd.dll
C:\WINDOWS\System32\fcvqsbmt.dll
C:\WINDOWS\System32\hggfc.dll
C:\WINDOWS\System32\khfgd.dll
C:\WINDOWS\SYSTEM32\nnnnljj.dll
C:\WINDOWS\System32\rqrpm.dll
C:\WINDOWS\System32\urqom.dll
C:\WINDOWS\System32\vtspm.dll
C:\WINDOWS\System32\wvwts.dll
.
((((((((((((((((((((((((( Files Created from 2007-10-01 to 2007-11-01 )))))))))))))))))))))))))))))))
.
2007-10-31 23:12 440 --a------ C:\WINDOWS\system32\tmp.reg
2007-10-31 23:11 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2007-10-31 23:11 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2007-10-31 23:11 53,248 --a------ C:\WINDOWS\system32\Process.exe
2007-10-31 23:11 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2007-10-31 23:11 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2007-10-31 23:02 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-10-29 22:13 <DIR> d-------- C:\Documents and Settings\Tai\Application Data\U3
2007-10-21 20:36 <DIR> d-------- C:\Program Files\New Folder
2007-10-21 16:40 <DIR> d-------- C:\Program Files\Lavasoft
2007-10-21 16:40 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-10-21 14:31 <DIR> d-------- C:\Program Files\Google
2007-10-21 14:31 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Google Updater
2007-10-05 21:56 <DIR> d-------- C:\Program Files\CCleaner
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2154-11-18 18:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2154-11-18 18:12 --------- d-----w C:\Program Files\Connection Wizard
2154-11-18 17:53 --------- d-----w C:\Program Files\Yahoo!
2007-10-22 16:24 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-10-22 00:59 --------- d-----w C:\Documents and Settings\Tai\Application Data\MSN6
2007-10-11 16:49 --------- d-----w C:\Program Files\LexmarkX83
2007-10-01 11:20 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-09-23 06:24 --------- d-----w C:\Program Files\Common Files\AOL
2007-09-16 16:04 --------- d-----w C:\Documents and Settings\All Users\Application Data\Webroot
2007-09-12 15:01 --------- d-----w C:\Program Files\MSN Messenger
.
((((((((((((((((((((((((((((( snapshot@2007-10-31_23.06.32.93 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-11-01 07:02:44 262,144 ----a-w C:\WINDOWS\system32\config\systemprofile\ntuser.dat
+ 2007-11-01 22:28:32 262,144 ----a-w C:\WINDOWS\system32\config\systemprofile\ntuser.dat
- 2007-10-30 06:15:12 52,968 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2007-11-01 07:07:11 52,968 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2007-10-30 06:15:12 380,680 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2007-11-01 07:07:11 380,680 ----a-w C:\WINDOWS\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe" [2004-02-22 22:44]
"CountrySelection"="pctptt.exe" [2001-03-22 02:08 C:\WINDOWS\system32\pctptt.exe]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ActiveDesktop"=0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
R3 SiS630;SiS630;C:\WINDOWS\System32\DRIVERS\sis630p.sys
S2 BulkUsb;Genesys Logic USB Scanner Controller NT 5.0;C:\WINDOWS\System32\Drivers\usbscan.sys
.
**************************************************************************
catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-01 14:32:09
Windows 5.1.2600 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
**************************************************************************
.
Completion time: 2007-11-01 14:33:21 - machine was rebooted
C:\ComboFix2.txt ... 2007-10-31 23:07
.
--- E O F ---
Hijackthis log
Logfile of HijackThis v1.99.1
Scan saved at 2:33:58 PM, on 11/1/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\Program Files\hijackthis\HijackThis.exe
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [CountrySelection] pctptt.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: W2k PCtel speaker phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
Thanks again
#7
Posted 02 November 2007 - 02:00 PM

Looking over your log, it seems you don't have any evidence of an anti-virus software.
Anti-virus software are programs that detect, cleanse, and erase harmful virus files on a computer, Web server, or network. Unchecked, virus files can unintentionally be forwarded to others, including trading partners and thereby spreading infection. Because new viruses regularly emerge, anti-virus software should be updated frequently. Anti-virus software can scan the computer memory and disk drives for malicious code. They can alert the user if a virus is present, and will clean, delete (or quarantine) infected files or directories. Please download a free anti-virus software from one these excellent vendors NOW:
1) Antivir PersonalEdition Classic - Free anti-virus software for Windows. Detects and removes more than 50,000 viruses. Free support.
2) avast! 4 Home Edition - Anti-virus program for Windows. The home edition is freeware for noncommercial users.
3) AVG Anti-Virus Free Edition - Free edition of the AVG anti-virus program for Windows.
It is strongly recommended that you run only one antivirus program at a time. Having more than one antivirus program active in memory uses additional resources and can result in program conflicts and false virus alerts. If you choose to install more than one antivirus program on your computer, then only one of them should be active in memory at a time.

__________________
Please download AVG Anti-Spyware to your Desktop or to your usual Download Folder.
http://www.ewido.net/en/download/
- Install AVG Anti-Spyware by double clicking the installer.
- Follow the prompts. Make sure that Launch AVG Anti-Spyware is checked.
- On the main screen under Your Computer's security.
- Click on Change state next to Resident shield. It should now change to inactive.
- Click on Change state next to Automatic updates. It should now change to inactive.
- Next to Last Update, click on Update now. (You will need an active internet connection to perform this)
- Wait until you see the Update succesfull message.
- Right-click the AVG Anti-Spyware Tray Icon and uncheck Start with Windows.
- Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
AVG Anti-Spyware manual updates.
Download the Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that AVG Anti-Spyware is closed before installing the update.
____________________
Please download ATF-cleaner and save it to your desktop.
- Double-click ATF-Cleaner.exe to run the program.
- Under Main choose: Select All
- Click the Empty Selected button.
If you use Firefox browser:
- Click Firefox at the top and choose: Select All
- Click the Empty Selected button.
- NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browser:
- Click Opera at the top and choose: Select All
- Click the Empty Selected button.
- NOTE: If you would like to keep your saved passwords, please click No at the prompt.
- Click Exit on the Main menu to close the program.
Close ALL open Windows / Programs / Folders. Please start AVG Anti-Spyware and run a full scan.
- Click on Scanner on the toolbar.
- Click on the Settings tab.
- Under How to act?
- Click on Recommended Action and choose Quarantine from the popup menu.
- Under How to scan?
- All checkboxes should be ticked.
- Under Possibly unwanted software:
- All checkboxes should be ticked.
- Under Reports:
- Select Automatically generate report after every scan and uncheck Only if threats were found.
- Under What to scan?
- Select Scan every file.
- Under How to act?
- Click on the Scan tab.
- Click on Complete System Scan to start the scan process.
- Let the program scan the machine.
- When the scan has finished, follow the instructions below.
IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button.- Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
- At the bottom of the window click on the Apply all Actions button. (3)
- When done, click the Save Scan Report button. (4)
- Click the Save Report as button.
- Save the report to your Desktop.
- Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
Post a fresh HijackThis log & AVG Anti-Spyware's report.
#8
Posted 05 November 2007 - 04:50 PM
Edited by Josh503, 05 November 2007 - 05:05 PM.
#9
Posted 06 November 2007 - 01:50 PM
Logfile of HijackThis v1.99.1
Scan saved at 12:45:07 PM, on 11/6/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\hijackthis\HijackThis.exe
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [CountrySelection] pctptt.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: W2k PCtel speaker phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------
+ Created at: 12:38:57 PM 11/6/2007
+ Scan result:
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP165\A0149453.exe -> Adware.180Solutions : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP165\A0149454.exe -> Adware.180Solutions : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP168\A0154352.exe -> Adware.180Solutions : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP168\A0154353.exe -> Adware.180Solutions : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP165\A0148878.dll -> Adware.Aureate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP165\A0148879.dll -> Adware.Aureate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP168\A0153782.dll -> Adware.Aureate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP168\A0153783.dll -> Adware.Aureate : Cleaned with backup (quarantined).
C:\Program Files\AWS\WeatherBug\MiniBugTransporter.dll -> Adware.Aws : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP162\A0137259.exe -> Adware.CommAd : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP162\A0137260.dll -> Adware.CommAd : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP167\A0153743.exe -> Adware.CommAd : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP167\A0153744.dll -> Adware.CommAd : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP148\A0077762.dll -> Adware.Companion : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP149\A0079763.dll -> Adware.Companion : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP149\A0087765.dll -> Adware.Companion : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP149\A0095774.dll -> Adware.Companion : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP150\A0103790.dll -> Adware.Companion : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP151\A0123006.dll -> Adware.Companion : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP171\A0157629.dll -> Adware.Companion : Cleaned with backup (quarantined).
C:\qoobox\Quarantine\C\Program Files\Common Files\Companion Wizard\WapCHK.dll.vir -> Adware.Companion : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP146\A0073508.DLL -> Adware.FunWeb : Cleaned with backup (quarantined).
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\\{c95fe080-8f5d-11d2-a20b-00aa003c157a} -> Adware.Generic : Cleaned with backup (quarantined).
HKU\S-1-5-18\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\\{c95fe080-8f5d-11d2-a20b-00aa003c157a} -> Adware.Generic : Error during cleaning.
HKU\S-1-5-21-1409082233-1580818891-1343024091-1004\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\\{c95fe080-8f5d-11d2-a20b-00aa003c157a} -> Adware.Generic : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP165\A0148882.exe -> Adware.HotBar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP165\A0149456.exe -> Adware.HotBar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP165\A0149457.exe -> Adware.Hotbar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP165\A0149458.exe -> Adware.HotBar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP165\A0149460.exe -> Adware.HotBar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP165\A0149461.exe -> Adware.HotBar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP165\A0149463.dll -> Adware.Hotbar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP165\A0149464.dll -> Adware.Hotbar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP165\A0149468.dll -> Adware.Hotbar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP165\A0149472.dll -> Adware.HotBar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP165\A0149473.dll -> Adware.HotBar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP165\A0149475.dll -> Adware.HotBar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP165\A0149476.dll -> Adware.HotBar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP168\A0153786.exe -> Adware.HotBar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP168\A0154355.exe -> Adware.Hotbar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP168\A0154357.exe -> Adware.HotBar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP168\A0154358.exe -> Adware.HotBar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP168\A0154360.dll -> Adware.Hotbar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP168\A0154361.dll -> Adware.Hotbar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP168\A0154365.dll -> Adware.Hotbar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP168\A0154369.dll -> Adware.HotBar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP168\A0154370.dll -> Adware.HotBar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP168\A0154372.dll -> Adware.HotBar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP168\A0154373.dll -> Adware.HotBar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP168\A0154382.exe -> Adware.HotBar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP168\A0154383.exe -> Adware.HotBar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP151\A0123008.exe -> Adware.SystemDoctor : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP162\A0137250.exe -> Adware.ZQuest : Cleaned with backup (quarantined).
C:\Documents and Settings\Tai\My Documents\My Downloads\installdrivecleanerstart.exe -> Downloader.Small : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP162\A0137273.exe -> Downloader.Small.buy : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP167\A0153746.exe -> Downloader.Small.buy : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP151\A0123012.exe -> Not-A-Virus.Downloader.Win32.WinFixer.o : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP151\A0122959.exe -> Not-A-Virus.Downloader.Win32.WinFixer.x : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP165\A0149357.exe -> Not-A-Virus.Monitor.Win32.NetMon.a : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP165\A0149358.exe -> Not-A-Virus.Monitor.Win32.NetMon.a : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP168\A0154259.exe -> Not-A-Virus.Monitor.Win32.NetMon.a : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP165\A0149459.exe -> Trojan.Holax.E : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP168\A0154356.exe -> Trojan.Holax.E : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP162\A0137257.vbs -> Trojan.Small : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP162\A0137258.vbs -> Trojan.Small : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP165\A0149356.vbs -> Trojan.Small : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{1713FFAC-0E49-49CE-8739-61CD95D9E9F5}\RP167\A0153742.vbs -> Trojan.Small : Cleaned with backup (quarantined).
::Report end
#10
Posted 07 November 2007 - 08:10 AM

Kaspersky online scanner works only with Internet Explorer!
Please run an online scanner with Kaspersky Online Scanner. You will be prompted to install an ActiveX component from Kaspersky, Click Yes.
- The program will launch and then start to download the latest definition files.
- Once the scanner is installed and the definitions downloaded, click Next.
- Now click on Scan Settings
- In the scan settings make sure that the following are selected:
o Scan using the following Anti-Virus database:
+ Extended (If available otherwise Standard)
o Scan Options:
+ Scan Archives
+ Scan Mail Bases
- Click OK
- Now under select a target to scan select My Computer
- The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
- Now click on the Save as Text button
- Save the file to your desktop.
- Copy and paste that information in your next post.
Register to Remove
#11
Posted 08 November 2007 - 12:40 AM
#12
Posted 08 November 2007 - 08:29 AM

OK, then we need to run this scanner:
Please Download Dr.Web CureIt and save it to your desktop.
Run a scan with Dr.Web CureIt
- Doubleclick the drweb-cureit.exe file and Allow to run the express scan
- This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan.
- Once the short scan has finished, you should now mark the drives that you want to scan.
- Select all drives. A red dot shows which drives have been chosen.
- Click the green arrow at the right, and the scan will start.
- Click 'Yes to all' if it asks if you want to cure/move the file.
- When the scan has finished, look if you can click next icon next to the files found
- If so, click it and then click the next icon right below and select Move incurable
- After the scan, in the menu, click file and choose save report list
- Save the report to your desktop. The report will be called DrWeb.csv
- Close Dr.Web Cureit.
- Post the Cure-it report and a fresh HijackThis log
#13
Posted 08 November 2007 - 04:56 PM
#14
Posted 09 November 2007 - 01:44 PM

Navigate to here: (Using windows explorer; windows key +e)
C:\Documents and Settings\Administrator\DoctorWeb\Quarantine
Check this file setup.exe and move it to here: C:\Program Files\Common Files\AOL\Backup\ACS\Current\Suite
Check this file WebColps.dll and move it to here: C:\Program Files\Common Files\Logitech\WebColct
Delete these folders: (Using windows explorer; windows key +e)
C:\qoobox
C:\Program Files\hijackthis\backups
Empty this folder: (Using windows explorer; windows key +e)
C:\Documents and Settings\Administrator\DoctorWeb\Quarantine
_____________________
Disable system restore:
- Right click on my computer icon
- Choose properties
- Click on system restore tab
- Select Turn off System Restore
- Click apply and click OK
- Reboot!
- Right click on my computer icon
- Choose properties
- Click on system restore tab
- un-check Turn off System Restore
- Click apply and click OK
- Reboot!
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. A malicious site could render Java content under older, vulnerable versions of Sun's software if the user has not removed them. Please follow these steps to remove older version Java components and update:
- Download the latest version of Java Runtime Environment (JRE) 6 Update 3 and save it to your desktop.
- Scroll down to where it says "Java Runtime Environment (JRE) 6u3...allows end-users to run Java applications".
- Click the "Download" button to the right.
- Read the License Agreement and then check the box that says: "Accept License Agreement".
- The page will refresh.
- Click on the link to download Windows Offline Installation and save the file to your desktop.
- Close any programs you may have running - especially your web browser.
- Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
- Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
- Click the Remove or Change/Remove button.
- Repeat as many times as necessary to remove each Java versions.
- Reboot your computer once all Java components are removed.
- Then from your desktop double-click on jre-6u3-windows-i586-p.exe to install the newest version.
#15
Posted 10 November 2007 - 02:39 AM
0 user(s) are reading this topic
0 members, 0 guests, 0 anonymous users