What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Virtumonde.gen and htepo.com

18 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
HELP! My notebook has been infected with a malware–virus–trojan that appears to be generated by htepo.com. It has been identified (correctly, I hope) as Adware: Win32/Virtumonde.gen.

The malicious program/s open/s multiple popups to what appears various sites. It also presents messages proclaiming my computer has been infected by a several trojans or viruses (including "w32.myzor.fk@yf") and recommends I purchase specific antiviirus program by opening pop-up windows. No doubt some fine irony there.
These pop ups from hell come in waves and propagate faster than rabbits on viagra. My computer receives internet through wifi and I was able to stop the popups by disconnecting from my network. Seems the popups can't work without an IE connection.

Two short-cuts appeared on my desk-top labeled: "ONLINE SECURITY GUIDE" and "LIFE SAFETY CENTER." I have deleted them several times but they continue to return. Both show their target as "htepo.com."

I have been totally unsuccessful in removing or killing the malware using the Computer Associates anti-virus program provided by my ISP, sbcglobal, nor their spyware program or through Spybot.

Although both spyware programs removed files including "smitfraud-C.CoreService," the basic problem keeps returning.

I did go into Windows looking for the problem and found a file labeled "PREFETCH" created this date and containing mutiple files to what appeared multiple websites. I deleted this file in the hopes it would solve the problem but, alas, it has not.

Following an online Google search, I wound up at Kaspersky Online Scanner and ran the program. It stated it found 18 viruses and 42 infected objects.

Other than sending an electronic pipe bomb to these swine at hxxp://htepo.com (Edit by Simon V. to disable live link), what can I do to free my computer from such nefarious programming of villians and brigands?

I look forward to hearing from you with your sound advise and help.
Post #2
  • Hi :)

    The first step in cleaning your computer is to make a HijackThis log:

    HijackThis Setup
  • Download HJTInstall.exe to your desktop.
  • Doubleclick HJTInstall.exe to install it.
  • By default it will install to C:\Program Files\Trend Micro\HijackThis .
  • Click on Install.
  • It will create a HijackThis icon on the desktop.
  • Once installed, it will launch Hijackthis.
  • Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
  • Copy/Paste the log to your next reply please.
Don't use the Analyse This button, its findings are dangerous if misinterpreted.
Don't have Hijackthis fix anything yet. Most of what it finds will be harmless or even required.
Post #3
I hope this makes sense to you because it is Greek to me!
Do you want to see the results of the Kaspersky log?

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:42:15 PM, on 11/1/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\basfipm.exe
C:\Program Files\Yahoo!\Antivirus\ISafe.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Yahoo!\Antivirus\CAVTray.exe
C:\Program Files\Yahoo!\Antivirus\CAVRID.exe
C:\PROGRA~1\Yahoo!\YOP\yop.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\SBC Self Support Tool\bin\mad.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\SBC Self Support Tool\bin\mpbtn.exe
C:\Program Files\Franklin Covey\Planner\Compass.exe
C:\PROGRA~1\Motive\ASSTCO~1\MOTIVE~1.EXE
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\Corel\WordPerfect Office 2002\Programs\wpwin10.exe
C:\PROGRA~1\MICROS~2\OFFICE11\OUTLOOK.EXE
C:\PROGRA~1\Yahoo!\browser\ybrowser.exe
C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows NT\Accessories\wordpad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://dsl.sbc.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://yahoo.sbc.com/dsl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…/search/ie.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy 1.4\SDHelper.dll
O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\Common\YIeTagBm.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: (no name) - {820A2C8D-DFC0-4A9F-B3CA-4410CA4F7C04} - C:\WINDOWS\system32\pmnmjgh.dll
O2 - BHO: (no name) - {89AD4D75-2429-462e-BD4E-443F233F6033} - C:\WINDOWS\system32\uilmatmp.dll
O2 - BHO: (no name) - {A95B2816-1D7E-4561-A202-68C0DE02353A} - C:\WINDOWS\system32\rfdchjjs.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: (no name) - {AF81DB7D-5605-4289-93E0-87A5366AFECB} - C:\WINDOWS\system32\vtuvt.dll
O2 - BHO: (no name) - {ccf45a8b-f273-421d-872c-0dce8118d2a9} - C:\WINDOWS\system32\nlogvfj.dll (file missing)
O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O3 - Toolbar: Time Matters - {00F17ECE-12DA-46A0-B541-BDE4EB7DF027} - C:\Program Files\tmietb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\system32\rfdchjjs.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [bascstray] BascsTray.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [QuickFinder Scheduler] "C:\Program Files\Corel\WordPerfect Office 2002\Programs\QFSCHD100.EXE"
O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\Yahoo!\Antivirus\CAVTray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\Yahoo!\Antivirus\CAVRID.exe"
O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-18\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'Default user')
O4 - Startup: Weekly Compass.lnk = C:\Program Files\Franklin Covey\Planner\Compass.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: AT&T Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: officejet 6100.lnk = ?
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: SBC Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=67633
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
O16 - DPF: {231B1C6E-F934-42A2-92B6-C2FEFEC24276} (yucsetreg Class) - C:\Program Files\Yahoo!\common\yucconfig.dll
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst_current.cab
O16 - DPF: {3EB4F9EA-51A6-48DA-846A-0D69DCBA39EF} (DownloadManager Control) - http://download.akamaitools.com.edgesuite….loadManager.ocx
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqaio/downloads/sysinfo.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/11282ec7b06bc5…ip/RdxIE601.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1133306662764
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - http://ipgweb.cce.hp.com/rdqaio/downloads/msxml4.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30155.www3.hp.com/ediags/hpfix/aio…/qdiagh.cab?326
O20 - Winlogon Notify: pmnmjgh - C:\WINDOWS\SYSTEM32\pmnmjgh.dll
O20 - Winlogon Notify: rfdchjjs - C:\WINDOWS\SYSTEM32\rfdchjjs.dll
O23 - Service: Broadcom ASF IP monitoring service v6.0.3 (BAsfIpM) - Broadcom Corp. - C:\WINDOWS\System32\basfipm.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\ISafe.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\SYSTEM32\YPCSER~1.EXE

–
End of file - 14250 bytes
Post #4
  • Hi :)

    Do you want to see the results of the Kaspersky log?


    Yes please.

    VundoFix
  • Please download VundoFix.exe to your desktop.
    • Double-click VundoFix.exe to run it.
    • Click the Scan for Vundo button.
    • Once it's done scanning, click the Remove Vundo button.
    • You will receive a prompt asking if you want to remove the files, click YES.
    • Once you click yes, your desktop will go blank as it starts removing Vundo.
    • When completed, it will prompt that it will reboot your computer, click OK.
    • A logfile will be saved at C:\vundofix.txt.
    Note: It is possible that VundoFix encountered a file it could not remove.
    In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot.

    Make an Uninstall List
  • To access the Uninstall Manager you would do the following:

    1. Start HijackThis
    2. Click on the Config button
    3. Click on the Misc Tools button
    4. Click on the Open Uninstall Manager button.
    5. Click on the Save list… button and save the file to a convenient location. When you press Save, Notepad will open with the contents of that file. Please post the Uninstall List, the reports from Vundofix and the Kaspersky Online Scan, and a new HijackThis log in your next reply.
Post #5
1/ When I ran Vundofix reported the following files as bad:
coovdhoi.dll
rfdchjjs.dll
uilmatmp.dll
pmnmjgh.dll
It corrected/deleted? all of the files except: c:\windows\system32\pmnmjgh.dll despite rebooting and rerunning the program several time.

2/ When I first turned my computer back on today "Anti-Virus - Yahoo Online Protection stated it had deleted:
win32\Abetear.G

3/ When I opened HiJack This there was no Config button to click on. But there was the Misc Tools button which I did. Then pressed Open Uninstall Mananger. Click on Save List button. The list as follows:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:30:17 PM, on 11/2/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\basfipm.exe
C:\Program Files\Yahoo!\Antivirus\ISafe.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Yahoo!\Antivirus\CAVTray.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\Yahoo!\Antivirus\CAVRID.exe
C:\PROGRA~1\Yahoo!\YOP\yop.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Franklin Covey\Planner\Compass.exe
C:\Program Files\SBC Self Support Tool\bin\mpbtn.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\Corel\WordPerfect Office 2002\Programs\wpwin10.exe
C:\Program Files\Java\jre1.5.0_10\bin\jucheck.exe
C:\PROGRA~1\MICROS~2\OFFICE11\OUTLOOK.EXE
C:\PROGRA~1\Yahoo!\browser\ybrowser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows NT\Accessories\wordpad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://dsl.sbc.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://yahoo.sbc.com/dsl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…/search/ie.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O3 - Toolbar: Time Matters - {00F17ECE-12DA-46A0-B541-BDE4EB7DF027} - C:\Program Files\tmietb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: (no name) - {11A69AE4-FBED-4832-A2BF-45AF82825583} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [bascstray] BascsTray.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [QuickFinder Scheduler] "C:\Program Files\Corel\WordPerfect Office 2002\Programs\QFSCHD100.EXE"
O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\Yahoo!\Antivirus\CAVTray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\Yahoo!\Antivirus\CAVRID.exe"
O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [a8ae757d] rundll32.exe "C:\WINDOWS\system32\phmubjgy.dll",b
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-18\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'Default user')
O4 - Startup: Weekly Compass.lnk = C:\Program Files\Franklin Covey\Planner\Compass.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: AT&T Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: officejet 6100.lnk = ?
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: SBC Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=67633
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
O16 - DPF: {231B1C6E-F934-42A2-92B6-C2FEFEC24276} (yucsetreg Class) - C:\Program Files\Yahoo!\common\yucconfig.dll
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst_current.cab
O16 - DPF: {3EB4F9EA-51A6-48DA-846A-0D69DCBA39EF} (DownloadManager Control) - http://download.akamaitools.com.edgesuite….loadManager.ocx
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqaio/downloads/sysinfo.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/11282ec7b06bc5…ip/RdxIE601.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1133306662764
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - http://ipgweb.cce.hp.com/rdqaio/downloads/msxml4.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30155.www3.hp.com/ediags/hpfix/aio…/qdiagh.cab?326
O23 - Service: Broadcom ASF IP monitoring service v6.0.3 (BAsfIpM) - Broadcom Corp. - C:\WINDOWS\System32\basfipm.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\ISafe.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\SYSTEM32\YPCSER~1.EXE
–
End of file - 12493 bytes

4/ORIGINAL SCAN FROM YESTERDAY
——————————————————————————-
KASPERSKY ONLINE SCANNER REPORT
Thursday, November 01, 2007 1:18:41 AM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 1/11/2007
Kaspersky Anti-Virus database records: 449519
——————————————————————————-

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\

Scan Statistics:
Total number of scanned objects: 117703
Number of viruses found: 18
Number of infected objects: 42
Number of suspicious objects: 0
Duration of the scan process: 03:40:27

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Support\MPLog-03242007-125947.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Mirar1.zip/WinATS.dll Infected: not-a-virus:AdWare.Win32.Mirar.e skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Mirar1.zip ZIP: infected - 1 skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Virtumonde.zip/pmnolkk.dll Infected: Trojan-Downloader.Win32.Agent.epy skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Virtumonde.zip ZIP: infected - 1 skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Virtumonde1.zip/pmnmjgh.dll Infected: Trojan-Downloader.Win32.Agent.epy skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Virtumonde1.zip ZIP: infected - 1 skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Virtumonde2.zip/ddcawvu.dll Infected: Trojan-Downloader.Win32.Agent.epy skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Virtumonde2.zip ZIP: infected - 1 skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Virtumonde5.zip/pmnmjgh.dll Infected: Trojan-Downloader.Win32.Agent.epy skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Virtumonde5.zip ZIP: infected - 1 skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WebBuyingAssistant.zip/v1.8.5/wbuninst.exe Infected: not-a-virus:AdWare.Win32.Agent.tb skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WebBuyingAssistant.zip/v1.8.5/webbuying.exe Infected: not-a-virus:AdWare.Win32.Agent.ta skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WebBuyingAssistant.zip ZIP: infected - 2 skipped
C:\Documents and Settings\Andy\Cookies\INDEX.DAT Object is locked skipped
C:\Documents and Settings\Andy\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Andy\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Andy\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{72F2BBAD-D971-46AB-9A61-61C1B7A4AB0A} Object is locked skipped
C:\Documents and Settings\Andy\Local Settings\History\History.IE5\INDEX.DAT Object is locked skipped
C:\Documents and Settings\Andy\Local Settings\History\History.IE5\MSHist012007103120071101\index.dat Object is locked skipped
C:\Documents and Settings\Andy\Local Settings\Temp\bbassistant.log Object is locked skipped
C:\Documents and Settings\Andy\Local Settings\Temp\fla362.tmp Object is locked skipped
C:\Documents and Settings\Andy\Local Settings\Temp\ICD1.tmp\UPCTP_0001_91M1101NetInstaller.exe Infected: not-a-virus:Downloader.Win32.WinFixer.i skipped
C:\Documents and Settings\Andy\Local Settings\Temp\ICD2.tmp\setup.exe Infected: not-virus:Hoax.Win32.Renos.hv skipped
C:\Documents and Settings\Andy\Local Settings\Temp\JET1B.tmp Object is locked skipped
C:\Documents and Settings\Andy\Local Settings\Temp\qrjatydi.exe Infected: not-a-virus:Downloader.Win32.WinFixer.au skipped
C:\Documents and Settings\Andy\Local Settings\Temp\snapsnet.exe/data0006 Infected: Trojan-Downloader.Win32.VB.bqc skipped
C:\Documents and Settings\Andy\Local Settings\Temp\snapsnet.exe NSIS: infected - 1 skipped
C:\Documents and Settings\Andy\Local Settings\Temp\xrun.exe Infected: Trojan-Downloader.Win32.Agent.dxj skipped
C:\Documents and Settings\Andy\Local Settings\Temporary Internet Files\Content.IE5\4TENKTQJ\xpre[1].exe Infected: Trojan-Downloader.Win32.VB.axa skipped
C:\Documents and Settings\Andy\Local Settings\Temporary Internet Files\Content.IE5\812Z4LQN\a8f5a020e4b833865a1034489887c8b9[2].zip/b122.exe Infected: Trojan-Downloader.Win32.Agent.erf skipped
C:\Documents and Settings\Andy\Local Settings\Temporary Internet Files\Content.IE5\812Z4LQN\a8f5a020e4b833865a1034489887c8b9[2].zip ZIP: infected - 1 skipped
C:\Documents and Settings\Andy\Local Settings\Temporary Internet Files\Content.IE5\812Z4LQN\vasya[1] Infected: Trojan.Win32.Agent.bck skipped
C:\Documents and Settings\Andy\Local Settings\Temporary Internet Files\Content.IE5\BJTFVPK8\upd32_v13[1] Infected: not-a-virus:AdWare.Win32.SecToolBar.h skipped
C:\Documents and Settings\Andy\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Andy\Local Settings\Temporary Internet Files\Content.IE5\WZ3RQ0P5\xrun[1].exe Infected: Trojan-Downloader.Win32.Agent.dxj skipped
C:\Documents and Settings\Andy\ntuser.dat Object is locked skipped
C:\Documents and Settings\Andy\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\INDEX.DAT Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\INDEX.DAT Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\INDEX.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Data\master.mdf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Data\mastlog.ldf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Data\model.mdf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Data\modellog.ldf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Data\tempdb.mdf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Data\templog.ldf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\LOG\ERRORLOG Object is locked skipped
C:\Program Files\Motive\AsstCommon\log\actl.log Object is locked skipped
C:\Program Files\Motive\AsstCommon\log\MotiveDirectory.log Object is locked skipped
C:\Program Files\SBC Self Support Tool\log\diag_svc.log Object is locked skipped
C:\Program Files\SBC Self Support Tool\log\mad.log Object is locked skipped
C:\Program Files\SBC Self Support Tool\log\MotivePlugin.log Object is locked skipped
C:\Program Files\SBC Self Support Tool\log\mpbtn.log Object is locked skipped
C:\Program Files\SBC Self Support Tool\log\Updater.log Object is locked skipped
C:\Program Files\SBC Self Support Tool\SmartBridge\AlertFilter.log Object is locked skipped
C:\Program Files\SBC Self Support Tool\SmartBridge\log\httpclient.log Object is locked skipped
C:\Program Files\SBC Self Support Tool\SmartBridge\SmartBridge.log Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq124.tmp Infected: not-a-virus:AdWare.Win32.Mirar.a skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1197\A0175233.exe Infected: not-a-virus:AdWare.Win32.Agent.co skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1199\A0176310.dll Infected: not-a-virus:AdWare.Win32.Agent.ta skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1199\A0176321.dll Infected: Trojan-Downloader.Win32.Agent.epy skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1199\A0176322.dll Infected: Trojan-Downloader.Win32.Agent.epy skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1199\A0176323.exe Infected: not-a-virus:AdWare.Win32.Agent.tb skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1199\A0176324.exe Infected: not-a-virus:AdWare.Win32.Agent.ta skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1199\A0177355.exe Infected: Trojan-Downloader.Win32.VB.bqc skipped
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1200\change.log Object is locked skipped
C:\WINDOWS\b122.exe Infected: Trojan-Downloader.Win32.Agent.erf skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\Downloaded Program Files\UDC6_0001_D19M1908NetInstaller.exe Infected: not-a-virus:Downloader.Win32.WinFixer.ar skipped
C:\WINDOWS\Downloaded Program Files\UPCTP_0001_91M1101NetInstaller.exe Infected: not-a-virus:Downloader.Win32.WinFixer.i skipped
C:\WINDOWS\mrofinu1000106.exe Infected: Trojan-Downloader.Win32.Agent.emo skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{A243F059-19E6-41FA-9D8B-B99CBB33EBD6}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\SYSTEM32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\SYSTEM32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\AppEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\Internet.evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SAM Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SecEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SECURITY Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SysEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\coovdhoi.dll Infected: not-a-virus:AdWare.Win32.SecToolBar.h skipped
C:\WINDOWS\SYSTEM32\DRIVERS\core.cache.dsk Object is locked skipped
C:\WINDOWS\SYSTEM32\DRIVERS\core.sys Object is locked skipped
C:\WINDOWS\SYSTEM32\H323LOG.TXT Object is locked skipped
C:\WINDOWS\SYSTEM32\Mz02r\Mz02r1065.exe Infected: Trojan-Downloader.Win32.VB.bqc skipped
C:\WINDOWS\SYSTEM32\pmnmjgh.dll Infected: Trojan-Downloader.Win32.Agent.epy skipped
C:\WINDOWS\SYSTEM32\rfdchjjs.dll Infected: not-a-virus:AdWare.Win32.SecToolBar.h skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\x22\c124wvr.exe Infected: Trojan-Downloader.Win32.Small.gks skipped
C:\WINDOWS\Temp\Perflib_Perfdata_bc.dat Object is locked skipped
C:\WINDOWS\WIADEBUG.LOG Object is locked skipped
C:\WINDOWS\WIASERVC.LOG Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.
Post #6

1/ When I ran Vundofix reported the following files as bad:


Please post this log: C:\Vundofix.txt (use Windows Explorer to navigate to the file)

3/ When I opened HiJack This there was no Config button to click on. But there was the Misc Tools button which I did. Then pressed Open Uninstall Mananger. Click on Save List button. The list as follows:


You have posted a regular HijackThis log. When you click on the Save List… button, a window should pop up, asking where to save the file. Please save it to your dekstop and post the contents of uninstall_list.
Post #7
VundoFix V6.5.11

Checking Java version…

Java version is 1.4.2.3
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.10

Scan started at 9:24:05 PM 11/1/2007

Listing files found while scanning….

C:\windows\system32\coovdhoi.dll
C:\windows\system32\pmnmjgh.dll
C:\WINDOWS\system32\rfdchjjs.dll
C:\WINDOWS\system32\uilmatmp.dll

Beginning removal…

Attempting to delete C:\windows\system32\coovdhoi.dll
C:\windows\system32\coovdhoi.dll Has been deleted!

Attempting to delete C:\windows\system32\pmnmjgh.dll
C:\windows\system32\pmnmjgh.dll Could not be deleted.

Attempting to delete C:\WINDOWS\system32\rfdchjjs.dll
C:\WINDOWS\system32\rfdchjjs.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\uilmatmp.dll
C:\WINDOWS\system32\uilmatmp.dll Has been deleted!

Performing Repairs to the registry.
Done!

Beginning removal…

Attempting to delete C:\windows\system32\pmnmjgh.dll
C:\windows\system32\pmnmjgh.dll Could not be deleted.

Performing Repairs to the registry.
Done!

VundoFix V6.5.11

Checking Java version…

Java version is 1.4.2.3
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.10

Scan started at 7:15:17 AM 11/2/2007

Listing files found while scanning….

C:\windows\system32\pmnmjgh.dll

Beginning removal…

Attempting to delete C:\windows\system32\pmnmjgh.dll
C:\windows\system32\pmnmjgh.dll Could not be deleted.

Performing Repairs to the registry.
Done!
——————-

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:05:35 AM, on 11/3/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\basfipm.exe
C:\Program Files\Yahoo!\Antivirus\ISafe.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Yahoo!\Antivirus\CAVTray.exe
C:\Program Files\Yahoo!\Antivirus\CAVRID.exe
C:\PROGRA~1\Yahoo!\YOP\yop.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
C:\Program Files\SBC Self Support Tool\bin\mpbtn.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Franklin Covey\Planner\Compass.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\PROGRA~1\Yahoo!\browser\ybrowser.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Java\jre1.5.0_10\bin\jucheck.exe
C:\Program Files\Yahoo!\Messenger\YPAGER.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://dsl.sbc.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://yahoo.sbc.com/dsl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…/search/ie.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O3 - Toolbar: Time Matters - {00F17ECE-12DA-46A0-B541-BDE4EB7DF027} - C:\Program Files\tmietb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: (no name) - {11A69AE4-FBED-4832-A2BF-45AF82825583} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [bascstray] BascsTray.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [QuickFinder Scheduler] "C:\Program Files\Corel\WordPerfect Office 2002\Programs\QFSCHD100.EXE"
O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\Yahoo!\Antivirus\CAVTray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\Yahoo!\Antivirus\CAVRID.exe"
O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [a8ae757d] rundll32.exe "C:\WINDOWS\system32\phmubjgy.dll",b
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-18\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'Default user')
O4 - Startup: Weekly Compass.lnk = C:\Program Files\Franklin Covey\Planner\Compass.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: AT&T Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: officejet 6100.lnk = ?
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: SBC Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=67633
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
O16 - DPF: {231B1C6E-F934-42A2-92B6-C2FEFEC24276} (yucsetreg Class) - C:\Program Files\Yahoo!\common\yucconfig.dll
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst_current.cab
O16 - DPF: {3EB4F9EA-51A6-48DA-846A-0D69DCBA39EF} (DownloadManager Control) - http://download.akamaitools.com.edgesuite….loadManager.ocx
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqaio/downloads/sysinfo.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/11282ec7b06bc5…ip/RdxIE601.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1133306662764
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - http://ipgweb.cce.hp.com/rdqaio/downloads/msxml4.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30155.www3.hp.com/ediags/hpfix/aio…/qdiagh.cab?326
O23 - Service: Broadcom ASF IP monitoring service v6.0.3 (BAsfIpM) - Broadcom Corp. - C:\WINDOWS\System32\basfipm.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\ISafe.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\SYSTEM32\YPCSER~1.EXE

–
End of file - 12408 bytes
Post #8
You have posted a regular HijackThis log. When you click on the Save List… button, a window should pop up, asking where to save the file. Please save it to your dekstop and post the contents of uninstall_list. I am sorry but I couldn't find the uninstall_list. on the Main Menu or any of the other sub menu. I seem to be running the regular log over and over again.
Post #9
Hi :)

I'd still like to see an Uninstall List. Let's try this:

Step 1

Please download and install CCleaner.
  • Open CCleaner. In the Left Pane, click Tools.
  • Verify that Uninstall is highlighted in color, or click on it.
  • In the lower right, click Save to Text File.
  • Pull down the arrow at the top of the Save dialog and choose Desktop as the location.
  • You can leave the filename as install.txt.
  • Click Save.
  • Exit Ccleaner by clicking on the X button in the upper right of the CCleaner window.
Step 2

Please download Combofix:Double-click on combofix.exe and follow the prompts.
When finished, it will produce a log for you. Save it to a convenient location.

Note: Do not mouseclick Combofix's window whilst it's running. That may cause it to stall.

Step 3

In your next reply, please post:
  • the Uninstall List from CCleaner (install.txt)
  • the log from Combofix (C:\Combofix.txt)
Post #10
Simon, thanks for your time, patience and fine effort in try to resolve this problem.

COMBOFIX LOG:
ComboFix 07-11-01.1** - Andy 2007-11-03 14:48:44.1 - NTFSx86
Running from: C:\My Downloads\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Start Menu\Live Safety Center.lnk
C:\Documents and Settings\All Users\Start Menu\Online Security Guide.lnk
C:\Temp\1cb
C:\Temp\1cb\syscheck.log
C:\temp\tn3
C:\WINDOWS\Downloaded Program Files\UDC6_0001_D19M1908NetInstaller.exe
C:\WINDOWS\Downloaded Program Files\UPCTP_0001_91M1101NetInstaller.exe
C:\WINDOWS\system32\a13
C:\WINDOWS\system32\drivers\core.cache.dsk
C:\WINDOWS\system32\drivers\core.sys
C:\WINDOWS\system32\e2
C:\WINDOWS\SYSTEM32\edcfe.bak1
C:\WINDOWS\SYSTEM32\edcfe.bak2
C:\WINDOWS\SYSTEM32\edcfe.ini
C:\WINDOWS\system32\efcde.dll
C:\WINDOWS\system32\g1
C:\WINDOWS\system32\i8
C:\WINDOWS\system32\i8\taldrvr11.exe
C:\WINDOWS\SYSTEM32\iikmp.bak1
C:\WINDOWS\SYSTEM32\iikmp.bak2
C:\WINDOWS\SYSTEM32\iikmp.ini
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\system32\pmkii.dll
C:\WINDOWS\SYSTEM32\popoq.bak1
C:\WINDOWS\SYSTEM32\popoq.bak2
C:\WINDOWS\SYSTEM32\popoq.ini
C:\WINDOWS\SYSTEM32\qruvw.bak1
C:\WINDOWS\SYSTEM32\qruvw.ini
C:\WINDOWS\system32\rfdchjjs.dllbox
C:\WINDOWS\SYSTEM32\tvutv.bak1
C:\WINDOWS\SYSTEM32\tvutv.ini
C:\WINDOWS\system32\vtuvt.dll
C:\WINDOWS\system32\x22
C:\WINDOWS\system32\x22\c124wvr.exe
C:\WINDOWS\SYSTEM32\ycbeg.bak1
C:\WINDOWS\SYSTEM32\ycbeg.ini

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
——-\LEGACY_CORE
——-\core


((((((((((((((((((((((((( Files Created from 2007-10-03 to 2007-11-03 )))))))))))))))))))))))))))))))
.

2007-11-03 14:40 51,200 –a—— C:\WINDOWS\NirCmd.exe
2007-11-03 14:29 d——– C:\Program Files\CCleaner
2007-11-03 14:03 81,472 –a—— C:\WINDOWS\SYSTEM32\wwtfboxc.dll
2007-11-03 14:00 87,616 –a—— C:\WINDOWS\SYSTEM32\gpbmwprd.dll
2007-11-02 11:14 82,496 –a—— C:\WINDOWS\SYSTEM32\kehkjpos.dll
2007-11-01 21:24 d——– C:\VundoFix Backups
2007-11-01 15:40 d——– C:\Program Files\Trend Micro
2007-11-01 15:39 812,344 –a—— C:\Program Files\HJTInstall.exe
2007-10-31 20:25 d——– C:\WINDOWS\SYSTEM32\Kaspersky Lab
2007-10-31 20:25 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-10-30 21:00 35,840 –a—— C:\WINDOWS\mrofinu1000106.exe
2007-10-30 20:59 34,816 –a—— C:\WINDOWS\SYSTEM32\pmnmjgh.dll
2007-10-30 20:58 d——– C:\WINDOWS\SYSTEM32\Mz02r
2007-10-30 20:58 d——– C:\Temp\mZOr
2007-10-09 23:19 584,192 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\rpcrt4.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-25 08:20 ——— d—–w C:\Program Files\Spybot - Search & Destroy 1.4
2007-10-16 15:20 ——— d—–w C:\Documents and Settings\Andy\Application Data\AdobeUM
2007-10-03 23:10 ——— d—–w C:\Program Files\DivX
2007-09-28 16:08 156,992 —-a-w C:\WINDOWS\SYSTEM32\DivXCodecVersionChecker.exe
2007-09-28 16:07 524,288 —-a-w C:\WINDOWS\SYSTEM32\DivXsm.exe
2007-09-28 16:07 3,596,288 —-a-w C:\WINDOWS\SYSTEM32\qt-dx331.dll
2007-09-28 16:07 200,704 —-a-w C:\WINDOWS\SYSTEM32\ssldivx.dll
2007-09-28 16:07 1,044,480 —-a-w C:\WINDOWS\SYSTEM32\libdivx.dll
2007-09-28 16:05 823,296 —-a-w C:\WINDOWS\SYSTEM32\divx_xx0c.dll
2007-09-28 16:05 823,296 —-a-w C:\WINDOWS\SYSTEM32\divx_xx07.dll
2007-09-28 16:05 81,920 —-a-w C:\WINDOWS\SYSTEM32\dpl100.dll
2007-09-28 16:05 802,816 —-a-w C:\WINDOWS\SYSTEM32\divx_xx11.dll
2007-09-28 16:05 739,840 —-a-w C:\WINDOWS\SYSTEM32\DivX.dll
2007-09-28 16:05 593,920 —-a-w C:\WINDOWS\SYSTEM32\dpuGUI11.dll
2007-09-28 16:05 57,344 —-a-w C:\WINDOWS\SYSTEM32\dpv11.dll
2007-09-28 16:05 53,248 —-a-w C:\WINDOWS\SYSTEM32\dpuGUI10.dll
2007-09-28 16:05 344,064 —-a-w C:\WINDOWS\SYSTEM32\dpus11.dll
2007-09-28 16:05 294,912 —-a-w C:\WINDOWS\SYSTEM32\dpu11.dll
2007-09-28 16:05 294,912 —-a-w C:\WINDOWS\SYSTEM32\dpu10.dll
2007-09-28 16:05 196,608 —-a-w C:\WINDOWS\SYSTEM32\dtu100.dll
2007-09-28 16:05 12,288 —-a-w C:\WINDOWS\SYSTEM32\DivXWMPExtType.dll
2007-08-22 12:55 96,256 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\inseng.dll
2007-08-22 12:55 665,600 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wininet.dll
2007-08-22 12:55 617,984 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\urlmon.dll
2007-08-22 12:55 55,808 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\extmgr.dll
2007-08-22 12:55 532,480 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\mstime.dll
2007-08-22 12:55 474,112 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\shlwapi.dll
2007-08-22 12:55 449,024 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\mshtmled.dll
2007-08-22 12:55 39,424 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\pngfilt.dll
2007-08-22 12:55 357,888 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\dxtmsft.dll
2007-08-22 12:55 3,064,832 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\mshtml.dll
2007-08-22 12:55 251,904 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\iepeers.dll
2007-08-22 12:55 205,824 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\dxtrans.dll
2007-08-22 12:55 16,384 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\jsproxy.dll
2007-08-22 12:55 151,040 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\cdfview.dll
2007-08-22 12:55 146,432 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\msrating.dll
2007-08-22 12:55 1,498,112 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\shdocvw.dll
2007-08-22 12:55 1,054,208 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\danim.dll
2007-08-22 12:55 1,022,976 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\browseui.dll
2007-08-21 10:19 18,432 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\iedw.exe
2007-08-21 06:15 683,520 —-a-w C:\WINDOWS\SYSTEM32\inetcomm.dll
2007-08-21 06:15 683,520 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\inetcomm.dll
2007-02-03 09:46 14,993,976 ——w C:\Program Files\GoogleEarthWin.exe
2006-03-16 20:32 720 —-a-w C:\Program Files\TMW.CFG
2006-03-16 20:12 720 —-a-w C:\Program Files\TMLAP.CFG
2006-03-09 17:48 93,944 —-a-w C:\Program Files\install.log
2006-03-09 17:47 13,708,800 —-a-w C:\Program Files\tmapp6.dll
2006-03-04 07:52 15,489,256 ——w C:\Program Files\DivXPlay.exe
2006-02-18 22:02 3,735,480 ——w C:\Program Files\setup_mj.exe
2006-02-08 12:23 486,912 ——w C:\Program Files\CalcPlus.msi
2006-02-01 05:13 5,037,072 ——w C:\Program Files\spybotsd14.exe
2006-02-01 05:08 532,480 ——w C:\Program Files\cwshredder.exe
2006-02-01 04:46 6,910,088 ——w C:\Program Files\MicrosoftAntiSpywareInstall.exe
2006-01-27 07:24 3,762,269 ——w C:\Program Files\WinAvi7[1].0.zip
2006-01-16 11:18 1,014,477 ——w C:\Program Files\WinRAR3.51.exe
2005-12-02 10:56 1,416,944 ——w C:\Program Files\WM9Codecs.exe
2005-12-02 10:46 11,590,784 ——w C:\Program Files\DivXPlay codec.exe
2005-12-02 10:44 210,224 ——w C:\Program Files\XviD-1.0.3-20122004 Codec.exe
2005-11-26 05:10 5,529,600 —-a-w C:\Program Files\MediaPlayerClassic.exe
2005-11-09 13:38 98,304 —-a-w C:\Program Files\qwinet.dll
2005-11-09 13:38 860,160 —-a-w C:\Program Files\qreports.dll
2005-11-09 13:38 86,016 —-a-w C:\Program Files\lbtmngr.dll
2005-11-09 13:38 81,920 —-a-w C:\Program Files\qindex.dll
2005-11-09 13:38 81,920 —-a-w C:\Program Files\graphs.dll
2005-11-09 13:38 8,192 —-a-w C:\Program Files\custprof.dll
2005-11-09 13:38 73,728 —-a-w C:\Program Files\mvmc14n.dll
2005-11-09 13:38 73,728 —-a-w C:\Program Files\atwork_xprint.dll
2005-11-09 13:38 69,632 —-a-w C:\Program Files\qwinver.dll
2005-11-09 13:38 68,608 —-a-w C:\Program Files\mvix14n.dll
2005-11-09 13:38 65,536 —-a-w C:\Program Files\helptl.dll
2005-11-09 13:38 65,536 —-a-w C:\Program Files\dllapps_dedfnd.dll
2005-11-09 13:38 61,440 —-a-w C:\Program Files\qwsnap.dll
2005-11-09 13:38 585,728 —-a-w C:\Program Files\qvault.dll
2005-11-09 13:38 56,320 —-a-w C:\Program Files\mvfs14n.dll
2005-11-09 13:38 55,808 —-a-w C:\Program Files\ltfil70n.dll
2005-11-09 13:38 528,384 —-a-w C:\Program Files\qaccess.dll
2005-11-09 13:38 51,200 —-a-w C:\Program Files\mvsr14n.dll
2005-11-09 13:38 50,688 —-a-w C:\Program Files\mvtl14n.dll
2005-11-09 13:38 484,864 —-a-w C:\Program Files\alrtint8.dll
2005-11-09 13:38 475,136 —-a-w C:\Program Files\qdb.dll
2005-11-09 13:38 47,616 —-a-w C:\Program Files\qsac.dll
2005-11-09 13:38 45,568 —-a-w C:\Program Files\qwcntr.dll
2005-11-09 13:38 44,544 —-a-w C:\Program Files\xmlparse_tok.dll
2005-11-09 13:38 43,008 —-a-w C:\Program Files\dllapps_savgol.dll
2005-11-09 13:38 42,496 —-a-w C:\Program Files\QShowHelp.dll
2005-11-09 13:38 413,696 —-a-w C:\Program Files\pfpro.dll
2005-11-09 13:38 40,960 —-a-w C:\Program Files\QWVER.DLL
2005-11-09 13:38 349,696 —-a-w C:\Program Files\ltkrn70n.dll
2005-11-09 13:38 339,968 —-a-w C:\Program Files\qcomutil.dll
2005-11-09 13:38 33,792 —-a-w C:\Program Files\qdapp.dll
2005-11-09 13:38 33,280 —-a-w C:\Program Files\imveng.dll
2005-11-09 13:38 32,768 —-a-w C:\Program Files\mvmg14n.dll
2005-11-09 13:38 315,392 —-a-w C:\Program Files\qtax.dll
2005-11-09 13:38 28,672 —-a-w C:\Program Files\cipher.dll
2005-11-09 13:38 278,528 —-a-w C:\Program Files\qwpr.dll
2005-11-09 13:38 258,048 —-a-w C:\Program Files\qwwin.dll
2005-11-09 13:38 25,600 —-a-w C:\Program Files\onlncall.dll
2005-11-09 13:38 25,600 —-a-w C:\Program Files\mvbk14n.dll
2005-11-09 13:38 24,576 —-a-w C:\Program Files\lfbmp70n.dll
2005-11-09 13:38 225,280 —-a-w C:\Program Files\lfcmp70n.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{50920958-4679-44ed-a327-9872f004bf84}]
2007-11-03 14:03 81472 –a—— C:\WINDOWS\system32\wwtfboxc.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ccf45a8b-f273-421d-872c-0dce8118d2a9}]
C:\WINDOWS\system32\nlogvfj.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2004-10-26 13:01]
"nwiz"="nwiz.exe" [2004-10-26 13:01 C:\WINDOWS\SYSTEM32\nwiz.exe]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2004-02-02 15:32]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe" [2006-11-09 16:07]
"bascstray"="BascsTray.exe" []
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2004-03-04 20:59]
"DVDSentry"="C:\WINDOWS\System32\DSentry.exe" [2002-07-17 10:18]
"AdaptecDirectCD"="C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" [2002-12-17 12:28]
"HPDJ Taskbar Utility"="C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe" [2002-04-22 17:49]
"QuickFinder Scheduler"="C:\Program Files\Corel\WordPerfect Office 2002\Programs\QFSCHD100.EXE" [2002-08-15 04:54]
"YBrowser"="C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe" [2003-12-09 12:03]
"BJCFD"="C:\Program Files\BroadJump\Client Foundation\CFD.exe" [2002-09-10 21:26]
"Motive SmartBridge"="C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe" [2007-02-05 09:16]
"CaAvTray"="C:\Program Files\Yahoo!\Antivirus\CAVTray.exe" [2005-08-05 21:25]
"CAVRID"="C:\Program Files\Yahoo!\Antivirus\CAVRID.exe" [2005-08-05 21:25]
"YOP"="C:\PROGRA~1\Yahoo!\YOP\yop.exe" [2005-04-22 19:49]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 18:20]
"Share-to-Web Namespace Daemon"="C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [2002-04-11 04:19]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41]
"Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY.exe" [2006-11-01 20:48]
"a8ae757d"="C:\WINDOWS\system32\gpbmwprd.dll" [2007-11-03 14:00]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 11:24]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 21:05]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"ALUAlert"=C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t

C:\Documents and Settings\Andy\Start Menu\Programs\Startup\
Weekly Compass.lnk - C:\Program Files\Franklin Covey\Planner\Compass.exe [2004-11-24 19:21:41]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Acrobat Assistant.lnk - C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-10-23 23:37:56]
AT&T Self Support Tool.lnk - C:\Program Files\SBC Self Support Tool\bin\matcli.exe [2005-07-01 10:33:35]
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2004-06-19 02:19:24]
hp psc 2000 Series.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe [2002-06-27 01:20:58]
officejet 6100.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe [2002-06-27 01:21:30]
Service Manager.lnk - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2005-05-03 22:07:32]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\pmkii.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^officejet 6100.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\officejet 6100.lnk
backup=C:\WINDOWS\pss\officejet 6100.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Picasa Media Detector]
C:\Program Files\Picasa2\PicasaMediaDetector.exe

R2 BASFND;BASFND;\??\C:\WINDOWS\System32\Drivers\BASFND.sys
R3 GTICARD;GTICARD;C:\WINDOWS\system32\DRIVERS\gticard.sys

.
Contents of the 'Scheduled Tasks' folder
"2007-10-31 20:48:12 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
"2007-06-25 00:28:07 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 2100 series#1174774917.job"
- C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe
"2004-12-17 17:52:59 C:\WINDOWS\Tasks\Low Battery Alarm Program.job"
"2007-11-03 20:13:30 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-03 15:12:29
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-03 15:16:38 - machine was rebooted
.
— E O F —

—————————————————————————–
—————————————————————————–

CCLEANER - INSTALL. TXT:

Adobe Acrobat - Reader 6.0.2 Update
Adobe Acrobat 6.0.1 Standard
Adobe Acrobat and Reader 6.0.3 Update
Adobe Acrobat and Reader 6.0.4 Update
Adobe Acrobat and Reader 6.0.5 Update
Adobe Acrobat and Reader 6.0.6 Update
Adobe Atmosphere Player for Acrobat and Adobe Reader
Adobe Flash Player ActiveX
Adobe Shockwave Player
ALPS Touch Pad Driver
Apple Software Update
ASF
AT&T Self Support Tool
AutoUpdate
AVS DVDMenu Editor 1.0.0.5
AVS Video Tools 5.5
Broadcom Advanced Control Suite
Broadcom ASF Management Applications
BroadJump Client Foundation
CCleaner (remove only)
Conexant D480 MDC V.92 Modem
CutePDF Writer 2.7
Dell Solution Center
Dell Wireless WLAN Card
DepPrep - InstallShield Wizard
Digital Line Detect
DivX Codec
DivX Content Uploader
DivX Converter
DivX Player
DivX Web Player
DVDSentry
Easy CD Creator 5 Basic
FLV Player 1.3.3
FranklinCovey Planning Software
Google Toolbar for Internet Explorer
Help and Support Customization
HighMAT Extension to Microsoft Windows XP CD Writing Wizard
HijackThis 2.0.2
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB896344)
Hotfix for Windows XP (KB914440)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB926239)
hp instant support
HP LaserJet 2100 Software
HP Photo and Imaging 1.0 - HP PSC - HP OfficeJet
HP Photo and Imaging 1.0 - HP PSC - HP OfficeJet Drivers
InterVideo WinDVD
ItsDeductible Express
iTunes
J2SE Runtime Environment 5.0 Update 10
Java 2 Runtime Environment, SE v1.4.2_03
Kaspersky Online Scanner
MediaJoin
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0
Microsoft Base Smart Card Cryptographic Service Provider Package
Microsoft Calculator Plus
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Data Access Components KB870669
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Outlook 2003 with Business Contact Manager Update
Microsoft Office Professional Edition 2003
Microsoft Outlook Personal Folders Backup
Microsoft SQL Server Desktop Engine (MICROSOFTSMLBIZ)
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Windows XP Video Decoder Checkup Utility
Modem Helper
MSN Music Assistant
MSXML 4.0 SP2 (KB925672)
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
NetWaiting
NoteMap 2 - InstallShield Wizard
NVIDIA Drivers
Photo Story 3 for Windows
Picasa 2
Quicken 2005
QuickSet
QuickTime
Readiris 7.5
RealPlayer
Remove Hidden Data Tool
Rhapsody Player Engine
SBC Yahoo! Applications
Security Update for CAPICOM (KB931906)
Security Update for Microsoft .NET Framework 2.0 (KB928365)
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB883939)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896422)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB896688)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899588)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB903235)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB905915)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB908531)
Security Update for Windows XP (KB911280)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912812)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913446)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB916281)
Security Update for Windows XP (KB917159)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB918899)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920214)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922760)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923694)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925454)
Security Update for Windows XP (KB925486)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928090)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB929969)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931768)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933566)
Security Update for Windows XP (KB933729)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB937143)
Security Update for Windows XP (KB938127)
Security Update for Windows XP (KB938829)
Security Update for Windows XP (KB939653)
Security Update for Windows XP (KB941202)
Spybot - Search & Destroy 1.4
SubViewer
Texas Discovery
Texas Pattern Jury Charges - Business
Texas Pattern Jury Charges - General Negligence
Time Matters 6.0 - Legal Series Remote
TimeMap 3 - InstallShield Wizard
TurboTax ItsDeductible 2005
TurboTax Premier 2004
TurboTax Premier 2005
TurboTax Premier Home & Business 2003
Update for Windows XP (KB894391)
Update for Windows XP (KB896727)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB900930)
Update for Windows XP (KB904942)
Update for Windows XP (KB910437)
Update for Windows XP (KB912945)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB927891)
Update for Windows XP (KB929338)
Update for Windows XP (KB930916)
Update for Windows XP (KB931836)
Update for Windows XP (KB933360)
Update for Windows XP (KB936357)
Update for Windows XP (KB938828)
Viewpoint Manager (Remove Only)
WebFldrs XP
WexTech AnswerWorks
Windows Defender
Windows Defender Signatures
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage v1.3.0254.0
Windows Genuine Advantage Validation Tool (KB892130)
Windows Installer 3.1 (KB893803)
Windows Media Format 11 runtime
Windows Media Player 11
Windows XP Hotfix - KB834707
Windows XP Hotfix - KB867282
Windows XP Hotfix - KB873333
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB887742
Windows XP Hotfix - KB887797
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890047
Windows XP Hotfix - KB890175
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB890923
Windows XP Hotfix - KB891781
Windows XP Hotfix - KB893066
Windows XP Hotfix - KB893086
Windows XP Service Pack 2
WinRAR archiver
WordPerfect Office 2002 OEM
WPOHotFix_atl
Yahoo! Toolbar
Post #11 last edited
Hi :)

Step 1

Be sure that you are set to see hidden files and folders:
  • Close all programs so that you are at your desktop.
  • Double-click on the My Computer icon.
  • Select the Tools menu and click Folder Options.
  • After the new window appears select the View tab.
  • Put a checkmark in the checkbox labelled Display the contents of system folders.
  • Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.
  • Remove the checkmark from the checkbox labelled Hide file extensions for known file types.
  • Remove the checkmark from the checkbox labelled Hide protected operating system files. Answer Yes to the prompt.
  • Press the Apply button and then the OK button and shutdown My Computer.
Step 2

Please visit Virustotal
  • Click the Browse… button.
  • Navigate to the file C:\Program Files\tmapp6.dll
  • Click the Open button.
  • Click the Send button.
Also do this for:
  • C:\Program Files\DivXPlay codec.exe
  • C:\Program Files\XviD-1.0.3-20122004 Codec.exe
Copy and paste the results in Notepad, and save them to your desktop, so you can post them in your next reply.

Step 3

Please download ATF Cleaner. Double-click on ATF-Cleaner.exe to start the program.
  • Under the Main tab, put a check next to Select All.
    Click the Empty Selected button. (Note: if you remove cookies, automated login at forums and sites will be disabled. If you do not want this, uncheck Cookies)
  • If you use the Firefox browser:
    Click on Firefox at the top and put a check next to Select All.
    If you would like to keep your saved passwords, click No at the prompt.
    Click the Empty Selected button. (Note: if you remove cookies, automated login at forums and sites will be disabled. If you do not want this, uncheck Cookies)
  • If you use the Opera browser:
    Click on Opera at the top and put a check next to Select All.
    If you would like to keep your saved passwords, click No at the prompt.
    Click the Empty Selected button. (Note: if you remove cookies, automated login at forums and sites will be disabled. If you do not want this, uncheck Cookies)
Step 4

Open Notepad (Go to Start > Run, type Notepad and hit Enter), and copy/paste the text in the quotebox below into it:

File::

C:\WINDOWS\SYSTEM32\wwtfboxc.dll
C:\WINDOWS\SYSTEM32\gpbmwprd.dll
C:\WINDOWS\SYSTEM32\kehkjpos.dll
C:\WINDOWS\mrofinu1000106.exe
C:\WINDOWS\SYSTEM32\pmnmjgh.dll

Folder::

C:\VundoFix Backups
C:\WINDOWS\SYSTEM32\Mz02r

Registry::

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{50920958-4679-44ed-a327-9872f004bf84}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ccf45a8b-f273-421d-872c-0dce8118d2a9}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"a8ae757d"=-
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"=hex(7):6d,73,76,31,5f,30,00,00
Save this as "CFScript".

[external image: Posted Image]

Referring to the picture above, drag CFScript into ComboFix.exe.
It will create a log. Be sure to save it to a convenient location.

Step 5

Please download SmitfraudFix (by S!ri).
  • Double-click on SmitfraudFix.exe. A screen will pop up. Select Option 1 (Search) by typing 1 and hit Enter. A text file will appear, which will list the infected files. Save it to a convenient location.
  • The log will also be saved here: C:\rapport.txt
Note: process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.

Step 6

In your next reply, please post:
  • the Virustotal results
  • the Combofix log (C:\Combofix.txt)
  • the SmitfraudFix log (C:\rapport.txt)
Post #12
I was not able to run the first two files because of size.

Message for c:\Program Files\tmapp6.dll is "bigger than max permited size."
Message for c:\Program Files\DivXPlay codec.exe is "bigger than max permited size."

————————-
File XviD-1.0.3-20122004_Codec.exe received on 11.04.2007 05:10:52 (CET)
Current status: finished
Result: 1/32 (3.13%)
Antivirus Version Last Update Result
AhnLab-V3 2007.11.3.0 2007.11.02 -
AntiVir 7.6.0.30 2007.11.02 -
Authentium 4.93.8 2007.11.03 -
Avast 4.7.1074.0 2007.11.03 -
AVG 7.5.0.503 2007.11.03 -
BitDefender 7.2 2007.11.04 -
CAT-QuickHeal 9.00 2007.11.03 -
ClamAV 0.91.2 2007.11.04 -
DrWeb 4.44.0.09170 2007.11.03 -
eSafe 7.0.15.0 2007.10.28 -
eTrust-Vet 31.2.5264 2007.11.02 -
Ewido 4.0 2007.11.03 -
FileAdvisor 1 2007.11.04 -
Fortinet 3.11.0.0 2007.10.19 -
F-Prot 4.4.2.54 2007.11.03 -
F-Secure 6.70.13030.0 2007.11.04 -
Ikarus T3.1.1.12 2007.11.04 -
Kaspersky 7.0.0.125 2007.11.04 -
McAfee 5155 2007.11.02 -
Microsoft 1.2908 2007.11.03 -
NOD32v2 2636 2007.11.03 -
Norman 5.80.02 2007.11.02 -
Panda 9.0.0.4 2007.11.03 -
Prevx1 V2 2007.11.04 Heuristic: Suspicious Self Modifying File
Rising 20.16.60.00 2007.11.04 -
Sophos 4.23.0 2007.11.04 -
Sunbelt 2.2.907.0 2007.11.02 -
Symantec 10 2007.11.04 -
TheHacker 6.2.9.110 2007.10.27 -
VBA32 3.12.2.4 2007.11.03 -
VirusBuster 4.3.26:9 2007.11.03 -
Webwasher-Gateway 6.6.1 2007.11.02 -

Additional information
File size: 210224 bytes
MD5: 58ff65c02dc96d0c0a247ebe641e3f7e
SHA1: 6e438dc604b6ee2c5c1813d8e260ecbe85d8b91e
Prevx info: http://fileinfo.prevx.com/fileinfo.asp?PX5…ACF720077BC31BA
—————————–
Post #13
I don't know if you got too far ahead of yourself but you lost me. Once I paste the necessary info into Notepad, where does the CFScript come in. I didn't find it in the Notepad sosftware nor anywhere else on my desktop, etc. What do I do next?
Post #14
Once you have pasted the text in the Notepad window, go to File > Save and call the file CFScript. There's nothing fancy about it, it's just a plain text file ;) Please wait with the CFScript for now. First answer my question, so I can change the script to take out everything in one go :)

For these files:

C:\Program Files\tmapp6.dll
C:\Program Files\DivXPlay codec.exe
C:\Program Files\XviD-1.0.3-20122004 Codec.exe

Do you know what they are?
Post #15
Regarding your inquiry as to these three files:
I believe this file is part of TimeMatters software: C:\Program Files\tmapp6.dll
I don't know what either of these two files relate to:
C:\Program Files\DivXPlay codec.exe
C:\Program Files\XviD-1.0.3-20122004 Codec.exe

——————————————————————————————————————
Message for c:\Program Files\tmapp6.dll is "bigger than max permited size."

Message for c:\Program Files\DivXPlay codec.exe is "bigger than max permited size."
————————-
File XviD-1.0.3-20122004_Codec.exe received on 11.04.2007 05:10:52 (CET)
Current status: finished
Result: 1/32 (3.13%)
Antivirus Version Last Update Result
AhnLab-V3 2007.11.3.0 2007.11.02 -
AntiVir 7.6.0.30 2007.11.02 -
Authentium 4.93.8 2007.11.03 -
Avast 4.7.1074.0 2007.11.03 -
AVG 7.5.0.503 2007.11.03 -
BitDefender 7.2 2007.11.04 -
CAT-QuickHeal 9.00 2007.11.03 -
ClamAV 0.91.2 2007.11.04 -
DrWeb 4.44.0.09170 2007.11.03 -
eSafe 7.0.15.0 2007.10.28 -
eTrust-Vet 31.2.5264 2007.11.02 -
Ewido 4.0 2007.11.03 -
FileAdvisor 1 2007.11.04 -
Fortinet 3.11.0.0 2007.10.19 -
F-Prot 4.4.2.54 2007.11.03 -
F-Secure 6.70.13030.0 2007.11.04 -
Ikarus T3.1.1.12 2007.11.04 -
Kaspersky 7.0.0.125 2007.11.04 -
McAfee 5155 2007.11.02 -
Microsoft 1.2908 2007.11.03 -
NOD32v2 2636 2007.11.03 -
Norman 5.80.02 2007.11.02 -
Panda 9.0.0.4 2007.11.03 -
Prevx1 V2 2007.11.04 Heuristic: Suspicious Self Modifying File
Rising 20.16.60.00 2007.11.04 -
Sophos 4.23.0 2007.11.04 -
Sunbelt 2.2.907.0 2007.11.02 -
Symantec 10 2007.11.04 -
TheHacker 6.2.9.110 2007.10.27 -
VBA32 3.12.2.4 2007.11.03 -
VirusBuster 4.3.26:9 2007.11.03 -
Webwasher-Gateway 6.6.1 2007.11.02 -

Additional information
File size: 210224 bytes
MD5: 58ff65c02dc96d0c0a247ebe641e3f7e
SHA1: 6e438dc604b6ee2c5c1813d8e260ecbe85d8b91e
Prevx info: http://fileinfo.prevx.com/fileinfo.asp?PX5…ACF720077BC31BA
—————————————————————————-

ComboFix 07-11-01.1** - Andy 2007-11-05 1:12:51.2 - NTFSx86
Running from: C:\My Downloads\ComboFix.exe
Command switches used :: C:\Documents and Settings\Andy\Desktop\CFScript.txt
* Created a new restore point

FILE::
C:\WINDOWS\mrofinu1000106.exe
C:\WINDOWS\SYSTEM32\gpbmwprd.dll
C:\WINDOWS\SYSTEM32\kehkjpos.dll
C:\WINDOWS\SYSTEM32\pmnmjgh.dll
C:\WINDOWS\SYSTEM32\wwtfboxc.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\VundoFix Backups
C:\VundoFix Backups\addmorefiles.txt
C:\VundoFix Backups\coovdhoi.dll.bad
C:\VundoFix Backups\pmnmjgh.dll.bad
C:\VundoFix Backups\rfdchjjs.dll.bad
C:\VundoFix Backups\uilmatmp.dll.bad
C:\WINDOWS\mrofinu1000106.exe
C:\WINDOWS\SYSTEM32\gpbmwprd.dll
C:\WINDOWS\SYSTEM32\kehkjpos.dll
C:\WINDOWS\SYSTEM32\Mz02r
C:\WINDOWS\SYSTEM32\Mz02r\Mz02r1065.exe
C:\WINDOWS\SYSTEM32\pmnmjgh.dll
C:\WINDOWS\SYSTEM32\wwtfboxc.dll

.
((((((((((((((((((((((((( Files Created from 2007-10-05 to 2007-11-05 )))))))))))))))))))))))))))))))
.

2007-11-03 13:40 51,200 –a—— C:\WINDOWS\NirCmd.exe
2007-11-03 13:29 d——– C:\Program Files\CCleaner
2007-11-01 14:40 d——– C:\Program Files\Trend Micro
2007-11-01 14:39 812,344 –a—— C:\Program Files\HJTInstall.exe
2007-10-31 19:25 d——– C:\WINDOWS\SYSTEM32\Kaspersky Lab
2007-10-31 19:25 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-10-30 19:58 d——– C:\Temp\mZOr
2007-10-09 22:19 584,192 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\rpcrt4.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-25 08:20 ——— d—–w C:\Program Files\Spybot - Search & Destroy 1.4
2007-10-16 15:20 ——— d—–w C:\Documents and Settings\Andy\Application Data\AdobeUM
2007-10-03 23:10 ——— d—–w C:\Program Files\DivX
2007-09-28 16:08 156,992 —-a-w C:\WINDOWS\SYSTEM32\DivXCodecVersionChecker.exe
2007-09-28 16:07 524,288 —-a-w C:\WINDOWS\SYSTEM32\DivXsm.exe
2007-09-28 16:07 3,596,288 —-a-w C:\WINDOWS\SYSTEM32\qt-dx331.dll
2007-09-28 16:07 200,704 —-a-w C:\WINDOWS\SYSTEM32\ssldivx.dll
2007-09-28 16:07 1,044,480 —-a-w C:\WINDOWS\SYSTEM32\libdivx.dll
2007-09-28 16:05 823,296 —-a-w C:\WINDOWS\SYSTEM32\divx_xx0c.dll
2007-09-28 16:05 823,296 —-a-w C:\WINDOWS\SYSTEM32\divx_xx07.dll
2007-09-28 16:05 81,920 —-a-w C:\WINDOWS\SYSTEM32\dpl100.dll
2007-09-28 16:05 802,816 —-a-w C:\WINDOWS\SYSTEM32\divx_xx11.dll
2007-09-28 16:05 739,840 —-a-w C:\WINDOWS\SYSTEM32\DivX.dll
2007-09-28 16:05 593,920 —-a-w C:\WINDOWS\SYSTEM32\dpuGUI11.dll
2007-09-28 16:05 57,344 —-a-w C:\WINDOWS\SYSTEM32\dpv11.dll
2007-09-28 16:05 53,248 —-a-w C:\WINDOWS\SYSTEM32\dpuGUI10.dll
2007-09-28 16:05 344,064 —-a-w C:\WINDOWS\SYSTEM32\dpus11.dll
2007-09-28 16:05 294,912 —-a-w C:\WINDOWS\SYSTEM32\dpu11.dll
2007-09-28 16:05 294,912 —-a-w C:\WINDOWS\SYSTEM32\dpu10.dll
2007-09-28 16:05 196,608 —-a-w C:\WINDOWS\SYSTEM32\dtu100.dll
2007-09-28 16:05 12,288 —-a-w C:\WINDOWS\SYSTEM32\DivXWMPExtType.dll
2007-08-22 12:55 96,256 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\inseng.dll
2007-08-22 12:55 665,600 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wininet.dll
2007-08-22 12:55 617,984 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\urlmon.dll
2007-08-22 12:55 55,808 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\extmgr.dll
2007-08-22 12:55 532,480 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\mstime.dll
2007-08-22 12:55 474,112 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\shlwapi.dll
2007-08-22 12:55 449,024 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\mshtmled.dll
2007-08-22 12:55 39,424 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\pngfilt.dll
2007-08-22 12:55 357,888 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\dxtmsft.dll
2007-08-22 12:55 3,064,832 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\mshtml.dll
2007-08-22 12:55 251,904 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\iepeers.dll
2007-08-22 12:55 205,824 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\dxtrans.dll
2007-08-22 12:55 16,384 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\jsproxy.dll
2007-08-22 12:55 151,040 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\cdfview.dll
2007-08-22 12:55 146,432 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\msrating.dll
2007-08-22 12:55 1,498,112 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\shdocvw.dll
2007-08-22 12:55 1,054,208 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\danim.dll
2007-08-22 12:55 1,022,976 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\browseui.dll
2007-08-21 10:19 18,432 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\iedw.exe
2007-08-21 06:15 683,520 —-a-w C:\WINDOWS\SYSTEM32\inetcomm.dll
2007-08-21 06:15 683,520 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\inetcomm.dll
2007-02-03 09:46 14,993,976 ——w C:\Program Files\GoogleEarthWin.exe
2006-03-16 20:32 720 —-a-w C:\Program Files\TMW.CFG
2006-03-16 20:12 720 —-a-w C:\Program Files\TMLAP.CFG
2006-03-09 17:48 93,944 —-a-w C:\Program Files\install.log
2006-03-09 17:47 13,708,800 —-a-w C:\Program Files\tmapp6.dll
2006-03-04 07:52 15,489,256 ——w C:\Program Files\DivXPlay.exe
2006-02-18 22:02 3,735,480 ——w C:\Program Files\setup_mj.exe
2006-02-08 12:23 486,912 ——w C:\Program Files\CalcPlus.msi
2006-02-01 05:13 5,037,072 ——w C:\Program Files\spybotsd14.exe
2006-02-01 05:08 532,480 ——w C:\Program Files\cwshredder.exe
2006-02-01 04:46 6,910,088 ——w C:\Program Files\MicrosoftAntiSpywareInstall.exe
2006-01-27 07:24 3,762,269 ——w C:\Program Files\WinAvi7[1].0.zip
2006-01-16 11:18 1,014,477 ——w C:\Program Files\WinRAR3.51.exe
2005-12-02 10:56 1,416,944 ——w C:\Program Files\WM9Codecs.exe
2005-12-02 10:46 11,590,784 ——w C:\Program Files\DivXPlay codec.exe
2005-12-02 10:44 210,224 ——w C:\Program Files\XviD-1.0.3-20122004 Codec.exe
2005-11-26 05:10 5,529,600 —-a-w C:\Program Files\MediaPlayerClassic.exe
2005-11-09 13:38 98,304 —-a-w C:\Program Files\qwinet.dll
2005-11-09 13:38 860,160 —-a-w C:\Program Files\qreports.dll
2005-11-09 13:38 86,016 —-a-w C:\Program Files\lbtmngr.dll
2005-11-09 13:38 81,920 —-a-w C:\Program Files\qindex.dll
2005-11-09 13:38 81,920 —-a-w C:\Program Files\graphs.dll
2005-11-09 13:38 8,192 —-a-w C:\Program Files\custprof.dll
2005-11-09 13:38 73,728 —-a-w C:\Program Files\mvmc14n.dll
2005-11-09 13:38 73,728 —-a-w C:\Program Files\atwork_xprint.dll
2005-11-09 13:38 69,632 —-a-w C:\Program Files\qwinver.dll
2005-11-09 13:38 68,608 —-a-w C:\Program Files\mvix14n.dll
2005-11-09 13:38 65,536 —-a-w C:\Program Files\helptl.dll
2005-11-09 13:38 65,536 —-a-w C:\Program Files\dllapps_dedfnd.dll
2005-11-09 13:38 61,440 —-a-w C:\Program Files\qwsnap.dll
2005-11-09 13:38 585,728 —-a-w C:\Program Files\qvault.dll
2005-11-09 13:38 56,320 —-a-w C:\Program Files\mvfs14n.dll
2005-11-09 13:38 55,808 —-a-w C:\Program Files\ltfil70n.dll
2005-11-09 13:38 528,384 —-a-w C:\Program Files\qaccess.dll
2005-11-09 13:38 51,200 —-a-w C:\Program Files\mvsr14n.dll
2005-11-09 13:38 50,688 —-a-w C:\Program Files\mvtl14n.dll
2005-11-09 13:38 484,864 —-a-w C:\Program Files\alrtint8.dll
2005-11-09 13:38 475,136 —-a-w C:\Program Files\qdb.dll
2005-11-09 13:38 47,616 —-a-w C:\Program Files\qsac.dll
2005-11-09 13:38 45,568 —-a-w C:\Program Files\qwcntr.dll
2005-11-09 13:38 44,544 —-a-w C:\Program Files\xmlparse_tok.dll
2005-11-09 13:38 43,008 —-a-w C:\Program Files\dllapps_savgol.dll
2005-11-09 13:38 42,496 —-a-w C:\Program Files\QShowHelp.dll
2005-11-09 13:38 413,696 —-a-w C:\Program Files\pfpro.dll
2005-11-09 13:38 40,960 —-a-w C:\Program Files\QWVER.DLL
2005-11-09 13:38 349,696 —-a-w C:\Program Files\ltkrn70n.dll
2005-11-09 13:38 339,968 —-a-w C:\Program Files\qcomutil.dll
2005-11-09 13:38 33,792 —-a-w C:\Program Files\qdapp.dll
2005-11-09 13:38 33,280 —-a-w C:\Program Files\imveng.dll
2005-11-09 13:38 32,768 —-a-w C:\Program Files\mvmg14n.dll
2005-11-09 13:38 315,392 —-a-w C:\Program Files\qtax.dll
2005-11-09 13:38 28,672 —-a-w C:\Program Files\cipher.dll
2005-11-09 13:38 278,528 —-a-w C:\Program Files\qwpr.dll
2005-11-09 13:38 258,048 —-a-w C:\Program Files\qwwin.dll
2005-11-09 13:38 25,600 —-a-w C:\Program Files\onlncall.dll
2005-11-09 13:38 25,600 —-a-w C:\Program Files\mvbk14n.dll
2005-11-09 13:38 24,576 —-a-w C:\Program Files\lfbmp70n.dll
2005-11-09 13:38 225,280 —-a-w C:\Program Files\lfcmp70n.dll
.

((((((((((((((((((((((((((((( snapshot@2007-11-03_15.15.23.63 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-10-29 23:56:19 136,192 —-a-w C:\WINDOWS\catchme.exe
+ 2007-10-30 00:56:19 136,192 —-a-w C:\WINDOWS\catchme.exe
- 2007-10-21 17:04:59 79,664 —-a-w C:\WINDOWS\SYSTEM32\PERFC009.DAT
+ 2007-11-05 00:17:29 79,664 —-a-w C:\WINDOWS\SYSTEM32\PERFC009.DAT
- 2007-10-21 17:04:59 441,538 —-a-w C:\WINDOWS\SYSTEM32\PERFH009.DAT
+ 2007-11-05 00:17:29 441,538 —-a-w C:\WINDOWS\SYSTEM32\PERFH009.DAT
- 2007-04-02 19:21:27 139,776 —-a-w C:\WINDOWS\SYSTEM32\swreg.exe
+ 2007-04-02 20:21:27 139,776 —-a-w C:\WINDOWS\SYSTEM32\swreg.exe
+ 2007-11-05 07:22:23 16,384 —-atw C:\WINDOWS\Temp\Perflib_Perfdata_5b0.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2004-10-26 12:01]
"nwiz"="nwiz.exe" [2004-10-26 12:01 C:\WINDOWS\SYSTEM32\nwiz.exe]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2004-02-02 14:32]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe" [2006-11-09 15:07]
"bascstray"="BascsTray.exe" []
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2004-03-04 19:59]
"DVDSentry"="C:\WINDOWS\System32\DSentry.exe" [2002-07-17 09:18]
"AdaptecDirectCD"="C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" [2002-12-17 11:28]
"HPDJ Taskbar Utility"="C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe" [2002-04-22 16:49]
"QuickFinder Scheduler"="C:\Program Files\Corel\WordPerfect Office 2002\Programs\QFSCHD100.EXE" [2002-08-15 03:54]
"YBrowser"="C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe" [2003-12-09 11:03]
"BJCFD"="C:\Program Files\BroadJump\Client Foundation\CFD.exe" [2002-09-10 20:26]
"Motive SmartBridge"="C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe" [2007-02-05 08:16]
"CaAvTray"="C:\Program Files\Yahoo!\Antivirus\CAVTray.exe" [2005-08-05 20:25]
"CAVRID"="C:\Program Files\Yahoo!\Antivirus\CAVRID.exe" [2005-08-05 20:25]
"YOP"="C:\PROGRA~1\Yahoo!\YOP\yop.exe" [2005-04-22 18:49]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 17:20]
"Share-to-Web Namespace Daemon"="C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [2002-04-11 03:19]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 08:41]
"Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY.exe" [2006-11-01 19:48]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 10:24]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:56]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 20:05]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"ALUAlert"=C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t

C:\Documents and Settings\Andy\Start Menu\Programs\Startup\
Weekly Compass.lnk - C:\Program Files\Franklin Covey\Planner\Compass.exe [2004-11-24 18:21:41]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Acrobat Assistant.lnk - C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-10-23 22:37:56]
AT&T Self Support Tool.lnk - C:\Program Files\SBC Self Support Tool\bin\matcli.exe [2005-07-01 09:33:35]
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2004-06-19 01:19:24]
hp psc 2000 Series.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe [2002-06-27 00:20:58]
officejet 6100.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe [2002-06-27 00:21:30]
Service Manager.lnk - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2005-05-03 21:07:32]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^officejet 6100.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\officejet 6100.lnk
backup=C:\WINDOWS\pss\officejet 6100.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Picasa Media Detector]
C:\Program Files\Picasa2\PicasaMediaDetector.exe

R2 BASFND;BASFND;\??\C:\WINDOWS\System32\Drivers\BASFND.sys
R3 GTICARD;GTICARD;C:\WINDOWS\system32\DRIVERS\gticard.sys
.
Contents of the 'Scheduled Tasks' folder
"2007-10-31 20:48:12 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
"2007-06-25 00:28:07 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 2100 series#1174774917.job"
- C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe
"2004-12-17 17:52:59 C:\WINDOWS\Tasks\Low Battery Alarm Program.job"
"2007-11-05 07:25:27 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-05 01:24:27
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-05 1:28:47 - machine was rebooted
C:\ComboFix2.txt … 2007-11-03 14:16
.
— E O F —
————————————————————
SmitFraudFix v2.248

Scan done at 2:00:46.57, Mon 11/05/2007
Run from C:\My Downloads\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\basfipm.exe
C:\Program Files\Yahoo!\Antivirus\ISafe.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Yahoo!\Antivirus\CAVTray.exe
C:\Program Files\Yahoo!\Antivirus\CAVRID.exe
C:\PROGRA~1\Yahoo!\YOP\yop.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Apoint\Apntex.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Franklin Covey\Planner\Compass.exe
C:\Program Files\SBC Self Support Tool\bin\mpbtn.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\Java\jre1.5.0_10\bin\jucheck.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Andy

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Andy\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Start Menu

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Andy\FAVORI~1

»»»»»»»»»»»»»»»»»»»»»»»» Desktop

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys

»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» Rustock

»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Dell Wireless WLAN 1350 WLAN Mini-PCI Card - Packet Scheduler Miniport
DNS Server Search Order: 68.94.156.1
DNS Server Search Order: 68.94.157.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{F9A3A39A-0761-486C-AD40-3A5693CA4B96}: DhcpNameServer=[removed] [removed]
HKLM\SYSTEM\CS1\Services\Tcpip\..\{F9A3A39A-0761-486C-AD40-3A5693CA4B96}: DhcpNameServer=[removed] [removed]
HKLM\SYSTEM\CS2\Services\Tcpip\..\{F9A3A39A-0761-486C-AD40-3A5693CA4B96}: DhcpNameServer=[removed] [removed]
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=[removed] [removed]
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=[removed] [removed]
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=[removed] [removed]

»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection

»»»»»»»»»»»»»»»»»»»»»»»» End

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI