What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Hijack This Log - Can you help?

9 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
:wall: Maybe I will get it right this time.

Good Afternoon,

Here are my log files of Combofix, VundoFix, and Hijackthis. I used info from my last session since problems were similar - (http://forums.whatthetech.com/Hijack_This_Log_t82333.html&hl;=lori).

I would appreciate your expertise.

I think that the infection on this computer was further complicated because there were three Login ID's (KIDS :) ), and a lot of files that shouldn't be moved were moved.

So.. what I did was set up a new Login ID, consolidated files and put them into a new Account. Then I deleted one of the extra accounts. I will be deleting the other account as soon as I am sure that I removed everything I needed. I also stopped the Automatic Updates that I think was slowing computer down and got rid of a lot of unnessesary files and programs.

The new account is running pretty well but is still not 100%. It takes long too load at times and is freezing periodically. At shut down the following programs usually have error messages that they are not responding: ccApp, and explorer.exe.

Also, the previous account that I deleted had a recent error message that showed that also showed that it was not responding at shut down. This file name had unrecognizable symbols that were possible Chinese or Japanese?

Thanks in advance,
Lori


ComboFix 07-11-08.1 - NEW ACCOUNT 2007-11-15 16:37:16.6 - NTFSx86
Running from: C:\Documents and Settings\[removed]\Local Settings\Temporary Internet Files\Content.IE5\OPEB95DX\ComboFix[1].exe
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2007-10-15 to 2007-11-15 )))))))))))))))))))))))))))))))
.

2007-11-15 16:38 117,248 –a—— C:\Program Files\VundoFix.exe
2007-11-15 01:34 d——– C:\Program Files\Microsoft Silverlight
2007-11-15 01:31 d——– C:\Program Files\IEForge
2007-11-15 01:06 d——– C:\Documents and Settings\NEW ACCOUNT\Application Data\ArcSoft
2007-11-14 23:52 d——– C:\Documents and Settings\NEW ACCOUNT\Application Data\AdobeUM
2007-11-14 23:50 d——– C:\Documents and Settings\NEW ACCOUNT\Application Data\Leadertech
2007-11-14 22:59 d——– C:\Documents and Settings\NEW ACCOUNT\Application Data\Template
2007-11-14 21:50 d——– C:\Documents and Settings\NEW ACCOUNT\Application Data\DivX
2007-11-14 15:43 d—s—- C:\Documents and Settings\Application Data\SystemCertificates
2007-11-14 15:43 d—s—- C:\Documents and Settings\Application Data\Credentials
2007-11-14 13:28 d——– C:\Documents and Settings\NEW ACCOUNT\WINDOWS
2007-11-14 13:28 d——– C:\Documents and Settings\NEW ACCOUNT\Application Data\InterTrust
2007-11-10 12:02 d——– C:\Documents and Settings\Application Data\LimeWire
2007-11-10 11:49 d——– C:\Program Files\Common Files\Java
2007-11-07 14:47 1,224,769 –a—— C:\Documents and Settings\XkeyTempFolder\ExmpSrv.exe
2007-11-07 14:47 401,462 –a—— C:\Documents and Settings\XkeyTempFolder\msvcp60.dll
2007-11-07 14:47 114,688 –a—— C:\Documents and Settings\XkeyTempFolder\Aux_Logging.dll
2007-11-07 14:47 98,304 –a—— C:\Documents and Settings\XkeyTempFolder\ExmpGUIFramework.dll
2007-11-06 09:04 22,112 -ra—— C:\WINDOWS\system32\drivers\COH_Mon.sys
2007-10-30 19:55 625,032 –a—— C:\WINDOWS\system32\SymNeti.dll
2007-10-30 19:55 242,056 –a—— C:\WINDOWS\system32\SymRedir.dll
2007-10-30 19:55 191,536 –a—— C:\WINDOWS\system32\drivers\symtdi.sys
2007-10-30 19:55 145,968 –a—— C:\WINDOWS\system32\drivers\symfw.sys
2007-10-30 19:55 39,856 –a—— C:\WINDOWS\system32\drivers\symids.sys
2007-10-30 19:55 37,936 –a—— C:\WINDOWS\system32\drivers\symndisv.sys
2007-10-30 19:55 35,120 –a—— C:\WINDOWS\system32\drivers\symndis.sys
2007-10-30 19:55 27,696 –a—— C:\WINDOWS\system32\drivers\symredrv.sys
2007-10-30 19:55 12,848 –a—— C:\WINDOWS\system32\drivers\symdns.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-15 21:23 ——— d—–w C:\Documents and Settings\All Users\Start Menu\Application Data\Symantec
2007-11-15 06:36 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2007-11-14 23:50 ——— d—–w C:\Documents and Settings\All Users\Start Menu\Application Data\Spybot - Search & Destroy
2007-11-14 19:25 ——— d—–w C:\Program Files\limewire
2007-11-14 19:25 ——— d—–w C:\Program Files\Image-Line
2007-11-14 19:25 ——— d—–w C:\Program Files\ICQ
2007-11-14 17:16 ——— d—–w C:\Program Files\.limewire
2007-11-10 16:57 ——— d—–w C:\Program Files\Java
2007-11-09 05:55 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-11-07 18:42 ——— d—–w C:\Program Files\Sony
2007-11-07 18:09 ——— d—–w C:\Program Files\Changes
2007-11-07 18:06 ——— d—–w C:\Program Files\HTMLValidatorLite2
2007-11-06 13:56 ——— d—–w C:\Program Files\Symantec
2007-11-06 13:55 805 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2007-11-06 13:55 123,952 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2007-11-06 13:55 10,740 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2007-11-06 13:53 ——— d—–w C:\Program Files\Norton Internet Security
2007-10-31 00:24 12,963 —-a-w C:\WINDOWS\system32\drivers\SymRedir.cat
2007-10-31 00:24 1,358 —-a-w C:\WINDOWS\system32\drivers\SymRedir.inf
2007-10-04 08:59 1,159,340 —-a-w C:\SDFix.exe
2007-09-18 19:44 10,662 —-a-w C:\WINDOWS\system32\drivers\srtspx.cat
2007-09-18 19:44 10,662 —-a-w C:\WINDOWS\system32\drivers\srtspl.cat
2007-09-18 19:44 10,658 —-a-w C:\WINDOWS\system32\drivers\srtsp.cat
2007-09-18 19:44 1,430 —-a-w C:\WINDOWS\system32\drivers\srtspl.inf
2007-09-18 19:44 1,421 —-a-w C:\WINDOWS\system32\drivers\srtspx.inf
2007-09-18 19:44 1,415 —-a-w C:\WINDOWS\system32\drivers\srtsp.inf
2007-09-18 19:43 43,696 —-a-w C:\WINDOWS\system32\drivers\srtspx.sys
2007-09-18 19:43 317,616 —-a-w C:\WINDOWS\system32\drivers\srtspl.sys
2007-09-18 19:43 278,576 —-a-w C:\WINDOWS\system32\drivers\srtsp.sys
2007-06-07 14:06 3,798,528 —-a-w C:\Program Files\SymADataWeb.msi
2007-03-10 05:25 788 —-a-w C:\Program Files\Windows Media Player.lnk
2006-12-19 00:58 796,332 —-a-w C:\Program Files\flashcreate!.exe
2006-12-18 21:48 1,771,096 —-a-w C:\Program Files\MP3-Audio-Mixer.exe
2006-11-21 22:55 15,926,792 —-a-w C:\Program Files\DivXInstaller.exe
2006-10-15 15:50 71,816 —-a-w C:\Documents and Settings\Application Data\GDIPFONTCACHEV1.DAT
2006-10-14 20:59 4,322,816 —-a-w C:\Program Files\mstudioZ.exe
2007-03-31 02:41:24 1,244,148 –sha-w C:\WINDOWS\system32\aybeg.bak1
2007-04-02 22:52:17 1,244,876 –sha-w C:\WINDOWS\system32\aybeg.bak2
2007-04-03 18:58:43 1,265,813 –sha-w C:\WINDOWS\system32\aybeg.ini2
2007-04-04 15:33:32 1,205,743 –sha-w C:\WINDOWS\system32\bbadd.bak1
2007-04-15 20:14:01 1,370,049 –sha-w C:\WINDOWS\system32\bbadd.bak2
2007-04-16 18:36:39 1,230,198 –sha-w C:\WINDOWS\system32\bbadd.ini2
2007-03-17 22:33:50 1,135,627 –sha-w C:\WINDOWS\system32\ihhkj.bak1
2007-03-18 22:34:02 1,164,395 –sha-w C:\WINDOWS\system32\ihhkj.bak2
2007-03-30 23:32:13 1,224,588 –sha-w C:\WINDOWS\system32\ihhkj.ini2
2007-04-18 00:45:54 1,364,490 –sha-w C:\WINDOWS\system32\jjkmp.bak1
2007-04-19 04:46:35 1,365,947 –sha-w C:\WINDOWS\system32\jjkmp.bak2
2007-04-28 01:22:04 1,436,648 –sha-w C:\WINDOWS\system32\jjkmp.ini2
2007-04-03 23:28:51 1,241,880 –sha-w C:\WINDOWS\system32\kjkkj.bak1
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"type32"="C:\Program Files\Microsoft IntelliType Pro\type32.exe" [2004-06-03 03:51]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\point32.exe" [2004-06-03 03:50]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 17:30]
"UserFaultCheck"="C:\WINDOWS\system32\dumprep 0 -u" []
"osCheck"="C:\Program Files\Norton Internet Security\osCheck.exe" [2007-06-26 00:00]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-06-04 21:05]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HijackThis startup scan"="C:\Program Files\Hijackthis\HijackThis.exe" []
"Microsoft Works Update Detection"="C:\Program Files\Microsoft Works\WkDetect.exe" []

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

S3 LMImirr;LMImirr;C:\WINDOWS\system32\DRIVERS\LMImirr.sys
S3 p2pgasvc;Peer Networking Group Authentication;C:\WINDOWS\System32\svchost.exe -k p2psvc
S3 p2pimsvc;Peer Networking Identity Manager;C:\WINDOWS\System32\svchost.exe -k p2psvc
S3 p2psvc;Peer Networking;C:\WINDOWS\System32\svchost.exe -k p2psvc
S3 PNRPSvc;Peer Name Resolution Protocol;C:\WINDOWS\System32\svchost.exe -k p2psvc
S3 STVqx3;Intel Play QX3 Microscope;C:\WINDOWS\system32\drivers\STVqx3.sys

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc p2psvc p2pimsvc p2pgasvc PNRPSvc

*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
"2007-04-05 16:04:17 C:\WINDOWS\Tasks\MP Scheduled Quick Scan.job"
"2007-11-13 04:13:10 C:\WINDOWS\Tasks\Norton Internet Security - Run Full System Scan - WebSites.job"
- C:\Program Files\Norton Internet Security\Norton AntiVirus\Navw32.exe
.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-15 16:56:33
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

**************************************************************************
.
Completion time: 2007-11-15 16:59:25 - machine was rebooted
.
— E O F —

********************************************************************************
*************************************

ran VUNDOFIX :
got back two seperate files

1. I am not sure if orgram finished:

VundoFix V6.6.1

Checking Java version…

Java version is 1.5.0.8
Old versions of java are exploitable and should be removed.

Scan started at 5:26:54 PM 11/15/2007

Listing files found while scanning….

No infected files were found.


Beginning removal…

********************************************************************************
*************************************
2.

Symantec Trojan.Vundo Removal Tool 1.5.0
The process "iexplore.exe" might be affected by the threat. It cannot be terminated.
The process "iexplore.exe" might be affected by the threat. It has been terminated.

C:\Documents and Settings\Lindsay: (not scanned)
C:\RECYCLER\S-1-5-21-1599254297-3440934647-1614824940-1005\Dc17714.zip: (not scanned)
C:\RECYCLER\S-1-5-21-1599254297-3440934647-1614824940-1005\Dc17715.zip: (not scanned)
C:\RECYCLER\S-1-5-21-1599254297-3440934647-1614824940-1005\Dc17716.ZIP: (not scanned)
C:\RECYCLER\S-1-5-21-1599254297-3440934647-1614824940-1005\Dc17717.ZIP: (not scanned)
C:\RECYCLER\S-1-5-21-1599254297-3440934647-1614824940-1005\Dc17718.ZIP: (not scanned)
C:\RECYCLER\S-1-5-21-1599254297-3440934647-1614824940-1005\Dc17719.zip: (not scanned)
C:\RECYCLER\S-1-5-21-1599254297-3440934647-1614824940-1005\Dc17720.ZIP: (not scanned)
C:\RECYCLER\S-1-5-21-1599254297-3440934647-1614824940-1005\Dc17721.ZIP: (not scanned)
C:\RECYCLER\S-1-5-21-1599254297-3440934647-1614824940-1005\Dc18340: (not scanned)
C:\RECYCLER\S-1-5-21-1599254297-3440934647-1614824940-1005\Dc18552: (not scanned)
C:\RECYCLER\S-1-5-21-1599254297-3440934647-1614824940-1005\Dc18564: (not scanned)
C:\RECYCLER\S-1-5-21-1599254297-3440934647-1614824940-1005\Dc18607: (not scanned)
C:\RECYCLER\S-1-5-21-1599254297-3440934647-1614824940-1005\Dc18786: (not scanned)
C:\RECYCLER\S-1-5-21-1599254297-3440934647-1614824940-1005\Dc18789: (not scanned)
C:\RECYCLER\S-1-5-21-1599254297-3440934647-1614824940-1005\Dc18790: (not scanned)
C:\RECYCLER\S-1-5-21-1599254297-3440934647-1614824940-1005\Dc18791: (not scanned)
C:\RECYCLER\S-1-5-21-1599254297-3440934647-1614824940-1005\Dc18792: (not scanned)
C:\RECYCLER\S-1-5-21-1599254297-3440934647-1614824940-1005\Dc18793: (not scanned)
C:\RECYCLER\S-1-5-21-1599254297-3440934647-1614824940-1005\Dc18796: (not scanned)
C:\RECYCLER\S-1-5-21-1599254297-3440934647-1614824940-1005\Dc18797: (not scanned)
C:\RECYCLER\S-1-5-21-1599254297-3440934647-1614824940-1005\Dc18798: (not scanned)
C:\RECYCLER\S-1-5-21-1599254297-3440934647-1614824940-1005\Dc18817: (not scanned)
C:\RECYCLER\S-1-5-21-1599254297-3440934647-1614824940-1005\Dc18818: (not scanned)
C:\RECYCLER\S-1-5-21-1599254297-3440934647-1614824940-1005\Dc18819: (not scanned)
C:\RECYCLER\S-1-5-21-1599254297-3440934647-1614824940-1005\Dc18820: (not scanned)
C:\RECYCLER\S-1-5-21-1599254297-3440934647-1614824940-1005\Dc18821: (not scanned)
C:\RECYCLER\S-1-5-21-1599254297-3440934647-1614824940-1005\Dc18824: (not scanned)
C:\RECYCLER\S-1-5-21-1599254297-3440934647-1614824940-1005\Dc18825: (not scanned)
C:\RECYCLER\S-1-5-21-1599254297-3440934647-1614824940-1005\Dc18831: (not scanned)
C:\RECYCLER\S-1-5-21-1599254297-3440934647-1614824940-1005\Dc18834: (not scanned)
C:\RECYCLER\S-1-5-21-1599254297-3440934647-1614824940-1005\Dc18867: (not scanned)
C:\RECYCLER\S-1-5-21-1599254297-3440934647-1614824940-1005\Dc18868: (not scanned)
C:\RECYCLER\S-1-5-21-1599254297-3440934647-1614824940-1005\Dc18869: (not scanned)
C:\RECYCLER\S-1-5-21-1599254297-3440934647-1614824940-1005\Dc18870: (not scanned)
C:\RECYCLER\S-1-5-21-1599254297-3440934647-1614824940-1005\Dc18876: (not scanned)
C:\RECYCLER\S-1-5-21-1599254297-3440934647-1614824940-1005\Dc19117: (not scanned)
C:\System Volume Information: (not scanned)
C:\WINDOWS\$NtUninstallKB833330$\Blastcln: (not scanned)

Trojan.Vundo has been successfully removed from your computer!

Here is the report:

The total number of the scanned files: 73313
The number of deleted files: 0
The number of viral processes terminated: 1
The number of viral threads terminated: 0
The number of registry entries fixed: 0



**************************************************************************
*******************************************


Logfile of HijackThis v1.99.1
Scan saved at 1:39:25 AM, on 11/16/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Hijackthis\SCANNER.EXE.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.7\NppBho.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.7\UIBHO.dll
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe
O4 - HKCU\..\Run: [HijackThis startup scan] C:\Program Files\Hijackthis\HijackThis.exe /startupscan
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
Post #2
Hello Lori,

This is Ken, hope you had a nice Thanksgiving.

Your HJT log looks fine although the Combofix log is showing some leftover Vundo files, do this please. Drag Combofix to the trash and download a new copy TO YOUR DESKTOP and run it and then also post a new HJT log as your current one is a little old.

Download ComboFix from Here or Here to your Desktop.
  • Double click combofix.exe and follow the prompts.
  • When finished, it shall produce a log for you. Post the Combofix log and a HiJackthis log in your next reply
Note: Do not mouseclick combofix's window while its running. That may cause it to stall
Post #3
Thanks Ken, good to hear from you. Before I reload Combofix I have a question:
While I was doing a search for combofix files to delete, I found a combofix quarantine file. Do I need to do anything with this first? Lori

2007-11-15 16:43	  1016	–a——	C:\Qoobox\Quarantine\Registry_backups\LEGACY_IPRIP.reg.dat
2007-11-15 16:43	  3674	–a——	C:\Qoobox\Quarantine\Registry_backups\services_Iprip.reg.dat


Folder PATH listing
Volume serial number is 3CEE-EE05
C:\QOOBOX\QUARANTINE
\—Registry_backups
		LEGACY_IPRIP.reg.dat
		services_Iprip.reg.dat
Post #4
Hi Lori,

Why don't we start from scratch.

  • Go to Start > Run and copy and paste ComboFix /u into the box
  • Make sure there's a space between Combofix and /
  • Then hit enter.

This will uninstall Combofix, delete its related folders and files, reset your clock settings, hide file extensions, hide the system/hidden files and resets System Restore again.




Download ComboFix from Here or Here to your Desktop.
  • Double click combofix.exe and follow the prompts.
  • When finished, it shall produce a log for you. Post the Combofix log and a HiJackthis log in your next reply
Note: Do not mouseclick combofix's window while its running. That may cause it to stall
Post #5
:thumbup: OK Ken, here it is:

ComboFix 07-11-19.3 - NEW ACCOUNT 2007-11-25 22:12:09.7 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.61 [GMT -5:00]
Running from: C:\WINDOWS\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2007-10-26 to 2007-11-26 )))))))))))))))))))))))))))))))
.

2007-11-25 14:36 1,545,623 –a—— C:\WINDOWS\ComboFix.exe
2007-11-19 14:24 1,163,264 –a—— C:\WINDOWS\system32\SSCSDK80.DLL
2007-11-19 14:24 100,352 –a—— C:\WINDOWS\system32\PG32CONV.DLL
2007-11-19 14:22 671,801 –a—— C:\WINDOWS\system32\EXLATE32.dll
2007-11-19 14:20 307,200 –a—— C:\WINDOWS\system32\Exportmodeller.DLL
2007-11-19 14:19 d——– C:\WINDOWS\CRYSTAL
2007-11-19 14:19 368,912 –a—— C:\WINDOWS\system32\vbar332.dll
2007-11-18 22:40 885,728 –a—— C:\WINDOWS\system32\ssdw3b32.ocx
2007-11-18 22:40 497,352 –a—— C:\WINDOWS\system32\SSCALA32.OCX
2007-11-18 22:40 475,168 –a—— C:\WINDOWS\system32\sstabs32.ocx
2007-11-18 22:40 344,064 –a—— C:\WINDOWS\system32\ssa3d30.ocx
2007-11-18 22:40 194,248 –a—— C:\WINDOWS\system32\ssscrl30.ocx
2007-11-18 22:40 184,320 –a—— C:\WINDOWS\system32\QHTMLight.dll
2007-11-18 22:40 72,192 –a—— C:\WINDOWS\system32\ssprn32.dll
2007-11-18 22:40 30,720 –a—— C:\WINDOWS\system32\ffJmpWeb.dll
2007-11-18 22:40 12,288 –a—— C:\WINDOWS\system32\httperr.dll
2007-11-17 13:23 d——– C:\Documents and Settings\NEW ACCOUNT\Application Data\Nova Development
2007-11-17 02:26 d——– C:\Program Files\Google
2007-11-15 17:26 d——– C:\VundoFix Backups
2007-11-15 17:24 d——– C:\Program Files\qoobox
2007-11-15 16:38 117,248 –a—— C:\Program Files\VundoFix.exe
2007-11-15 01:34 d——– C:\Program Files\Microsoft Silverlight
2007-11-15 01:31 d——– C:\Program Files\IEForge
2007-11-15 01:06 d——– C:\Documents and Settings\NEW ACCOUNT\Application Data\ArcSoft
2007-11-14 23:52 d——– C:\Documents and Settings\NEW ACCOUNT\Application Data\AdobeUM
2007-11-14 23:50 d——– C:\Documents and Settings\NEW ACCOUNT\Application Data\Leadertech
2007-11-14 22:59 d——– C:\Documents and Settings\NEW ACCOUNT\Application Data\Template
2007-11-14 21:50 d——– C:\Documents and Settings\NEW ACCOUNT\Application Data\DivX
2007-11-14 15:43 d—s—- C:\Documents and Settings\Application Data\SystemCertificates
2007-11-14 15:43 d—s—- C:\Documents and Settings\Application Data\Credentials
2007-11-14 13:28 d——– C:\Documents and Settings\NEW ACCOUNT\WINDOWS
2007-11-14 13:28 d——– C:\Documents and Settings\NEW ACCOUNT\Application Data\InterTrust
2007-11-10 12:02 d——– C:\Documents and Settings\Application Data\LimeWire
2007-11-10 11:49 d——– C:\Program Files\Common Files\Java
2007-11-07 14:47 1,224,769 –a—— C:\Documents and Settings\XkeyTempFolder\ExmpSrv.exe
2007-11-07 14:47 401,462 –a—— C:\Documents and Settings\XkeyTempFolder\msvcp60.dll
2007-11-07 14:47 114,688 –a—— C:\Documents and Settings\XkeyTempFolder\Aux_Logging.dll
2007-11-07 14:47 98,304 –a—— C:\Documents and Settings\XkeyTempFolder\ExmpGUIFramework.dll
2007-11-06 09:04 22,112 -ra—— C:\WINDOWS\system32\drivers\COH_Mon.sys
2007-11-06 09:04 10,592 -ra—— C:\WINDOWS\system32\drivers\COH_Mon.cat
2007-11-06 09:04 705 -ra—— C:\WINDOWS\system32\drivers\COH_Mon.inf
2007-10-30 19:55 625,032 –a—— C:\WINDOWS\system32\SymNeti.dll
2007-10-30 19:55 242,056 –a—— C:\WINDOWS\system32\SymRedir.dll
2007-10-30 19:55 191,536 –a—— C:\WINDOWS\system32\drivers\symtdi.sys
2007-10-30 19:55 145,968 –a—— C:\WINDOWS\system32\drivers\symfw.sys
2007-10-30 19:55 39,856 –a—— C:\WINDOWS\system32\drivers\symids.sys
2007-10-30 19:55 37,936 –a—— C:\WINDOWS\system32\drivers\symndisv.sys
2007-10-30 19:55 35,120 –a—— C:\WINDOWS\system32\drivers\symndis.sys
2007-10-30 19:55 27,696 –a—— C:\WINDOWS\system32\drivers\symredrv.sys
2007-10-30 19:55 12,848 –a—— C:\WINDOWS\system32\drivers\symdns.sys
2007-10-30 19:24 12,963 –a—— C:\WINDOWS\system32\drivers\SymRedir.cat
2007-10-30 19:24 1,358 –a—— C:\WINDOWS\system32\drivers\SymRedir.inf

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-25 21:05 ——— d—–w C:\Documents and Settings\All Users\Start Menu\Application Data\Symantec
2007-11-25 20:29 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2007-11-21 18:35 ——— d—–w C:\Program Files\ICQ
2007-11-20 23:28 ——— d—–w C:\Program Files\Microsoft Works
2007-11-19 21:37 ——— d—–w C:\Program Files\Common Files\Adobe
2007-11-16 05:35 ——— d—–w C:\Program Files\Norton Internet Security
2007-11-14 23:50 ——— d—–w C:\Documents and Settings\All Users\Start Menu\Application Data\Spybot - Search & Destroy
2007-11-14 19:25 ——— d—–w C:\Program Files\limewire
2007-11-14 19:25 ——— d—–w C:\Program Files\Image-Line
2007-11-14 17:16 ——— d—–w C:\Program Files\.limewire
2007-11-10 16:57 ——— d—–w C:\Program Files\Java
2007-11-09 05:55 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-11-07 18:42 ——— d—–w C:\Program Files\Sony
2007-11-07 18:09 ——— d—–w C:\Program Files\Changes
2007-11-07 18:06 ——— d—–w C:\Program Files\HTMLValidatorLite2
2007-11-06 13:56 ——— d—–w C:\Program Files\Symantec
2007-11-06 13:55 805 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2007-11-06 13:55 60,800 —-a-w C:\WINDOWS\system32\S32EVNT1.DLL
2007-11-06 13:55 123,952 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2007-11-06 13:55 10,740 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2007-10-04 08:59 1,159,340 —-a-w C:\Program Files\SDFix.exe
2007-09-02 03:09 817,664 —h–w C:\WINDOWS\system32\wodfamoh.dll
2007-06-07 14:06 3,798,528 —-a-w C:\Program Files\SymADataWeb.msi
2007-03-10 05:25 788 —-a-w C:\Program Files\Windows Media Player.lnk
2006-12-19 00:58 796,332 —-a-w C:\Program Files\flashcreate!.exe
2006-12-18 21:48 1,771,096 —-a-w C:\Program Files\MP3-Audio-Mixer.exe
2006-11-21 22:55 15,926,792 —-a-w C:\Program Files\DivXInstaller.exe
2006-10-15 15:50 71,816 —-a-w C:\Documents and Settings\Application Data\GDIPFONTCACHEV1.DAT
2006-10-14 20:59 4,322,816 —-a-w C:\Program Files\mstudioZ.exe
2007-03-31 02:41 1,244,148 –sha-w C:\WINDOWS\system32\aybeg.bak1
2007-04-02 22:52 1,244,876 –sha-w C:\WINDOWS\system32\aybeg.bak2
2007-04-03 18:58 1,265,813 –sha-w C:\WINDOWS\system32\aybeg.ini2
2007-04-04 15:33 1,205,743 –sha-w C:\WINDOWS\system32\bbadd.bak1
2007-04-15 20:14 1,370,049 –sha-w C:\WINDOWS\system32\bbadd.bak2
2007-04-16 18:36 1,230,198 –sha-w C:\WINDOWS\system32\bbadd.ini2
2007-03-17 22:33 1,135,627 –sha-w C:\WINDOWS\system32\ihhkj.bak1
2007-03-18 22:34 1,164,395 –sha-w C:\WINDOWS\system32\ihhkj.bak2
2007-03-30 23:32 1,224,588 –sha-w C:\WINDOWS\system32\ihhkj.ini2
2007-04-18 00:45 1,364,490 –sha-w C:\WINDOWS\system32\jjkmp.bak1
2007-04-19 04:46 1,365,947 –sha-w C:\WINDOWS\system32\jjkmp.bak2
2007-04-28 01:22 1,436,648 –sha-w C:\WINDOWS\system32\jjkmp.ini2
2007-04-03 23:28 1,241,880 –sha-w C:\WINDOWS\system32\kjkkj.bak1
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HijackThis startup scan"="C:\Program Files\Hijackthis\HijackThis.exe" []
"Microsoft Works Update Detection"="C:\Program Files\Microsoft Works\WkDetect.exe" []
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"type32"="C:\Program Files\Microsoft IntelliType Pro\type32.exe" [2004-06-03 03:51]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\point32.exe" [2004-06-03 03:50]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 17:30]
"UserFaultCheck"="C:\WINDOWS\system32\dumprep 0 -u" []
"osCheck"="C:\Program Files\Norton Internet Security\osCheck.exe" [2007-06-26 00:00]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-06-04 21:05]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-10-25 18:58]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2005-04-25 12:45]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

S3 LMImirr;LMImirr;C:\WINDOWS\system32\DRIVERS\LMImirr.sys
S3 p2pgasvc;Peer Networking Group Authentication;C:\WINDOWS\System32\svchost.exe -k p2psvc
S3 p2pimsvc;Peer Networking Identity Manager;C:\WINDOWS\System32\svchost.exe -k p2psvc
S3 p2psvc;Peer Networking;C:\WINDOWS\System32\svchost.exe -k p2psvc
S3 PNRPSvc;Peer Name Resolution Protocol;C:\WINDOWS\System32\svchost.exe -k p2psvc
S3 STVqx3;Intel Play QX3 Microscope;C:\WINDOWS\system32\drivers\STVqx3.sys

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc p2psvc p2pimsvc p2pgasvc PNRPSvc

*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
"2007-04-05 16:04:17 C:\WINDOWS\Tasks\MP Scheduled Quick Scan.job"
- C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MpCmdRun.exe%Scan -RestrictPrivileges -ScanType 1
"2007-11-18 08:02:41 C:\WINDOWS\Tasks\Norton Internet Security - Run Full System Scan - NEW ACCOUNT.job"
- C:\Program Files\Norton Internet Security\Norton AntiVirus\Navw32.exe
"2007-11-20 01:00:00 C:\WINDOWS\Tasks\Norton Internet Security - Run Full System Scan - WebSites.job"
- C:\Program Files\Norton Internet Security\Norton AntiVirus\Navw32.exe
.
**************************************************************************

catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-25 22:18:50
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

**************************************************************************
.
Completion time: 2007-11-25 22:21:01
.
— E O F —
Post #6
Hello Lori,

I need you to do a few things for me please.

Open Notepad and copy all the text inside the quote box by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad

File::
C:\WINDOWS\system32\aybeg.bak1
C:\WINDOWS\system32\aybeg.bak2
C:\WINDOWS\system32\aybeg.ini2
C:\WINDOWS\system32\bbadd.bak1
C:\WINDOWS\system32\bbadd.bak2
C:\WINDOWS\system32\bbadd.ini2
C:\WINDOWS\system32\ihhkj.bak1
C:\WINDOWS\system32\ihhkj.bak2
C:\WINDOWS\system32\ihhkj.ini2
C:\WINDOWS\system32\jjkmp.bak1
C:\WINDOWS\system32\jjkmp.bak2
C:\WINDOWS\system32\jjkmp.ini2
C:\WINDOWS\system32\kjkkj.bak1

Folder::
C:\VundoFix Backups


Save this as CFScript to your desktop.

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

[external image: Posted Image]



This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.



We need to make sure all hidden files are showing :
  • Click Start.
  • Open My Computer.
  • Select the Tools menu and click Folder Options.
  • Select the View tab.
  • Under the Hidden files and folders heading select Show hidden files and folders.
  • Uncheck the Hide file extensions for known types option.
  • Uncheck the Hide protected operating system files (recommended) option.
  • Click Yes to confirm.
  • Click OK.
Once your system is clean, we suggest that you reverse this to keep critical windows files from accidently being deleted.




Go to this site Jotti Upload and under the browse feature, browse to these files.

C:\WINDOWS\system32\ffJmpWeb.dll
C:\WINDOWS\system32\wodfamoh.dll

Then click on Submit and it will give you a report for each file , post the reports in your next reply.



Lori, after each scan we run of fix we do I always need to see a new Hijackthis log . So post the new Combofix log, the reports from those two files from Jotti and a New HJT log please
Post #7 last edited
DId New combofix of CFScript :thumbup:

all hidden files are showing :thumbup:

new combofix log :thumbup: :

ComboFix 07-11-19.3 - NEW ACCOUNT 2007-11-26 14:05:33.8 - NTFSx86
Running from: C:\WINDOWS\ComboFix.exe
Command switches used :: C:\Documents and Settings\NEW ACCOUNT\Desktop\CFScript.txt
* Created a new restore point

FILE
C:\WINDOWS\system32\aybeg.bak1
C:\WINDOWS\system32\aybeg.bak2
C:\WINDOWS\system32\aybeg.ini2
C:\WINDOWS\system32\bbadd.bak1
C:\WINDOWS\system32\bbadd.bak2
C:\WINDOWS\system32\bbadd.ini2
C:\WINDOWS\system32\ihhkj.bak1
C:\WINDOWS\system32\ihhkj.bak2
C:\WINDOWS\system32\ihhkj.ini2
C:\WINDOWS\system32\jjkmp.bak1
C:\WINDOWS\system32\jjkmp.bak2
C:\WINDOWS\system32\jjkmp.ini2
C:\WINDOWS\system32\kjkkj.bak1
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\VundoFix Backups
C:\WINDOWS\system32\aybeg.bak1
C:\WINDOWS\system32\aybeg.bak2
C:\WINDOWS\system32\aybeg.ini2
C:\WINDOWS\system32\bbadd.bak1
C:\WINDOWS\system32\bbadd.bak2
C:\WINDOWS\system32\bbadd.ini2
C:\WINDOWS\system32\ihhkj.bak1
C:\WINDOWS\system32\ihhkj.bak2
C:\WINDOWS\system32\ihhkj.ini2
C:\WINDOWS\system32\jjkmp.bak1
C:\WINDOWS\system32\jjkmp.bak2
C:\WINDOWS\system32\jjkmp.ini2
C:\WINDOWS\system32\kjkkj.bak1

.
((((((((((((((((((((((((( Files Created from 2007-10-26 to 2007-11-26 )))))))))))))))))))))))))))))))
.

2007-11-25 14:36 1,545,623 –a—— C:\WINDOWS\ComboFix.exe
2007-11-19 14:24 1,163,264 –a—— C:\WINDOWS\system32\SSCSDK80.DLL
2007-11-19 14:24 100,352 –a—— C:\WINDOWS\system32\PG32CONV.DLL
2007-11-19 14:22 671,801 –a—— C:\WINDOWS\system32\EXLATE32.dll
2007-11-19 14:20 307,200 –a—— C:\WINDOWS\system32\Exportmodeller.DLL
2007-11-19 14:19 d——– C:\WINDOWS\CRYSTAL
2007-11-19 14:19 368,912 –a—— C:\WINDOWS\system32\vbar332.dll
2007-11-18 22:40 885,728 –a—— C:\WINDOWS\system32\ssdw3b32.ocx
2007-11-18 22:40 497,352 –a—— C:\WINDOWS\system32\SSCALA32.OCX
2007-11-18 22:40 475,168 –a—— C:\WINDOWS\system32\sstabs32.ocx
2007-11-18 22:40 344,064 –a—— C:\WINDOWS\system32\ssa3d30.ocx
2007-11-18 22:40 194,248 –a—— C:\WINDOWS\system32\ssscrl30.ocx
2007-11-18 22:40 184,320 –a—— C:\WINDOWS\system32\QHTMLight.dll
2007-11-18 22:40 72,192 –a—— C:\WINDOWS\system32\ssprn32.dll
2007-11-18 22:40 30,720 –a—— C:\WINDOWS\system32\ffJmpWeb.dll
2007-11-18 22:40 12,288 –a—— C:\WINDOWS\system32\httperr.dll
2007-11-17 13:23 d——– C:\Documents and Settings\NEW ACCOUNT\Application Data\Nova Development
2007-11-17 02:26 d——– C:\Program Files\Google
2007-11-15 17:24 d——– C:\Program Files\qoobox
2007-11-15 16:38 117,248 –a—— C:\Program Files\VundoFix.exe
2007-11-15 01:34 d——– C:\Program Files\Microsoft Silverlight
2007-11-15 01:31 d——– C:\Program Files\IEForge
2007-11-15 01:06 d——– C:\Documents and Settings\NEW ACCOUNT\Application Data\ArcSoft
2007-11-14 23:52 d——– C:\Documents and Settings\NEW ACCOUNT\Application Data\AdobeUM
2007-11-14 23:50 d——– C:\Documents and Settings\NEW ACCOUNT\Application Data\Leadertech
2007-11-14 22:59 d——– C:\Documents and Settings\NEW ACCOUNT\Application Data\Template
2007-11-14 21:50 d——– C:\Documents and Settings\NEW ACCOUNT\Application Data\DivX
2007-11-14 15:43 d—s—- C:\Documents and Settings\Application Data\SystemCertificates
2007-11-14 15:43 d—s—- C:\Documents and Settings\Application Data\Credentials
2007-11-14 13:28 d——– C:\Documents and Settings\NEW ACCOUNT\WINDOWS
2007-11-14 13:28 d——– C:\Documents and Settings\NEW ACCOUNT\Application Data\InterTrust
2007-11-10 12:02 d——– C:\Documents and Settings\Application Data\LimeWire
2007-11-10 11:49 d——– C:\Program Files\Common Files\Java
2007-11-07 14:47 1,224,769 –a—— C:\Documents and Settings\XkeyTempFolder\ExmpSrv.exe
2007-11-07 14:47 401,462 –a—— C:\Documents and Settings\XkeyTempFolder\msvcp60.dll
2007-11-07 14:47 114,688 –a—— C:\Documents and Settings\XkeyTempFolder\Aux_Logging.dll
2007-11-07 14:47 98,304 –a—— C:\Documents and Settings\XkeyTempFolder\ExmpGUIFramework.dll
2007-11-06 09:04 22,112 -ra—— C:\WINDOWS\system32\drivers\COH_Mon.sys
2007-11-06 09:04 10,592 -ra—— C:\WINDOWS\system32\drivers\COH_Mon.cat
2007-11-06 09:04 705 -ra—— C:\WINDOWS\system32\drivers\COH_Mon.inf
2007-10-30 19:55 625,032 –a—— C:\WINDOWS\system32\SymNeti.dll
2007-10-30 19:55 242,056 –a—— C:\WINDOWS\system32\SymRedir.dll
2007-10-30 19:55 191,536 –a—— C:\WINDOWS\system32\drivers\symtdi.sys
2007-10-30 19:55 145,968 –a—— C:\WINDOWS\system32\drivers\symfw.sys
2007-10-30 19:55 39,856 –a—— C:\WINDOWS\system32\drivers\symids.sys
2007-10-30 19:55 37,936 –a—— C:\WINDOWS\system32\drivers\symndisv.sys
2007-10-30 19:55 35,120 –a—— C:\WINDOWS\system32\drivers\symndis.sys
2007-10-30 19:55 27,696 –a—— C:\WINDOWS\system32\drivers\symredrv.sys
2007-10-30 19:55 12,848 –a—— C:\WINDOWS\system32\drivers\symdns.sys
2007-10-30 19:24 12,963 –a—— C:\WINDOWS\system32\drivers\SymRedir.cat
2007-10-30 19:24 1,358 –a—— C:\WINDOWS\system32\drivers\SymRedir.inf

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-26 19:00 ——— d—–w C:\Documents and Settings\All Users\Start Menu\Application Data\Symantec
2007-11-25 20:29 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2007-11-21 18:35 ——— d—–w C:\Program Files\ICQ
2007-11-20 23:28 ——— d—–w C:\Program Files\Microsoft Works
2007-11-19 21:37 ——— d—–w C:\Program Files\Common Files\Adobe
2007-11-16 05:35 ——— d—–w C:\Program Files\Norton Internet Security
2007-11-14 23:50 ——— d—–w C:\Documents and Settings\All Users\Start Menu\Application Data\Spybot - Search & Destroy
2007-11-14 19:25 ——— d—–w C:\Program Files\limewire
2007-11-14 19:25 ——— d—–w C:\Program Files\Image-Line
2007-11-14 17:16 ——— d—–w C:\Program Files\.limewire
2007-11-10 16:57 ——— d—–w C:\Program Files\Java
2007-11-09 05:55 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-11-07 18:42 ——— d—–w C:\Program Files\Sony
2007-11-07 18:09 ——— d—–w C:\Program Files\Changes
2007-11-07 18:06 ——— d—–w C:\Program Files\HTMLValidatorLite2
2007-11-06 13:56 ——— d—–w C:\Program Files\Symantec
2007-11-06 13:55 805 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2007-11-06 13:55 60,800 —-a-w C:\WINDOWS\system32\S32EVNT1.DLL
2007-11-06 13:55 123,952 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2007-11-06 13:55 10,740 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2007-10-04 08:59 1,159,340 —-a-w C:\Program Files\SDFix.exe
2007-09-02 03:09 817,664 —h–w C:\WINDOWS\system32\wodfamoh.dll
2007-06-07 14:06 3,798,528 —-a-w C:\Program Files\SymADataWeb.msi
2007-03-10 05:25 788 —-a-w C:\Program Files\Windows Media Player.lnk
2006-12-19 00:58 796,332 —-a-w C:\Program Files\flashcreate!.exe
2006-12-18 21:48 1,771,096 —-a-w C:\Program Files\MP3-Audio-Mixer.exe
2006-11-21 22:55 15,926,792 —-a-w C:\Program Files\DivXInstaller.exe
2006-10-15 15:50 71,816 —-a-w C:\Documents and Settings\Application Data\GDIPFONTCACHEV1.DAT
2006-10-14 20:59 4,322,816 —-a-w C:\Program Files\mstudioZ.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HijackThis startup scan"="C:\Program Files\Hijackthis\HijackThis.exe" []
"Microsoft Works Update Detection"="C:\Program Files\Microsoft Works\WkDetect.exe" []
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"type32"="C:\Program Files\Microsoft IntelliType Pro\type32.exe" [2004-06-03 03:51]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\point32.exe" [2004-06-03 03:50]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 17:30]
"UserFaultCheck"="C:\WINDOWS\system32\dumprep 0 -u" []
"osCheck"="C:\Program Files\Norton Internet Security\osCheck.exe" [2007-06-26 00:00]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-06-04 21:05]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-10-25 18:58]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2005-04-25 12:45]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

S3 LMImirr;LMImirr;C:\WINDOWS\system32\DRIVERS\LMImirr.sys
S3 p2pgasvc;Peer Networking Group Authentication;C:\WINDOWS\System32\svchost.exe -k p2psvc
S3 p2pimsvc;Peer Networking Identity Manager;C:\WINDOWS\System32\svchost.exe -k p2psvc
S3 p2psvc;Peer Networking;C:\WINDOWS\System32\svchost.exe -k p2psvc
S3 PNRPSvc;Peer Name Resolution Protocol;C:\WINDOWS\System32\svchost.exe -k p2psvc
S3 STVqx3;Intel Play QX3 Microscope;C:\WINDOWS\system32\drivers\STVqx3.sys

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc p2psvc p2pimsvc p2pgasvc PNRPSvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{79c74ce6-712d-11dc-96d4-00121785ecd1}]
\Shell\AutoRun\command - F:\DTE_Privacy_launcher.exe

*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
"2007-04-05 16:04:17 C:\WINDOWS\Tasks\MP Scheduled Quick Scan.job"
"2007-11-18 08:02:41 C:\WINDOWS\Tasks\Norton Internet Security - Run Full System Scan - NEW ACCOUNT.job"
- C:\Program Files\Norton Internet Security\Norton AntiVirus\Navw32.exe
"2007-11-20 01:00:00 C:\WINDOWS\Tasks\Norton Internet Security - Run Full System Scan - WebSites.job"
- C:\Program Files\Norton Internet Security\Norton AntiVirus\Navw32.exe
.
**************************************************************************

catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-26 14:13:07
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-26 14:14:31
C:\ComboFix2.txt … 2007-11-25 22:21
.
— E O F —



:thumbup: Jotti upload coming soon. Thanks again Ken.


:thumbup: NEW HIGHJACK THIS LOG:


Logfile of HijackThis v1.99.1
Scan saved at 2:58:52 PM, on 11/26/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis\SCANNER.EXE.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.7\NppBho.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.7\UIBHO.dll
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [HijackThis startup scan] C:\Program Files\Hijackthis\HijackThis.exe /startupscan
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe


:thumbup: Jotti
Service load: 0% 100% File: ffJmpWeb.dll Status: OK MD5: 954aaf35d7e0c406594a1fdb8650862a Packers detected: -Bit9 reports: No threat detected (more info)

Post #8
Lori,

Your log looks good :thumbup: But lets do a few things to clean you up.

You have Spybot Search and Destroy installed, go to Help> About and make sure its version 1.5.1, if not you can download the newer version here, set it up this way , check for updates and run the scan, it wont take long. Do not be alarmed if it finds Vundo as there are most likely leftover registry entries on your system it will find and remove. After the scan, have it remove it all…REBOOT and run it again until its clean.

Download and install Spybot Search and Destroy 1.5.1

If you have the older version 1.4, remove it via the Add-Remove Programs in the Control Panel.

  • During Installation, just follow all the defaults.
  • Go to Mode and click on Advanced Mode
  • Then to Updates Search for Updates
  • If you get a Bad Checksum Error, just choose a different download location.
  • Then to Settings/ File Sets and take the checkmark out of Usage Tracks
  • Then to Tools/ Hosts Files click on Add Spybot S&D Hosts Files.
  • Then to Tools/ IE Tweeks and put a checkmark in Lock the Hosts Files
  • Then to Immunize. Up at the top by the GREEN SIGN, click on Immunize.
  • Then to Search and Destroy/ Check for Problems
  • Let it scan your system
  • Then to Fix Problems and fix all it finds.
  • Reboot your computer.




Download CCleaner from here to clean temp files from your computer.
  • Double click on the file to start the installation of the program.
  • Select your language and click OK, then next.
  • Read the license agreement and click I Agree.
  • Click next to use the default install location. Click Install then finish to complete installation.
  • Double click the CCleaner shortcut on the desktop to start the program.
  • On the "Windows" tab, under "Internet Explorer," uncheck "Cookies" if you do not want them deleted. (If deleted, you will likely need to reenter your passwords at all sites where a cookie is used to recognize you when you visit).
  • If you use either the Firefox or Mozilla browsers, the box to uncheck for "Cookies" is on the Applications tab, under Firefox/Mozilla.
  • Click on the "Options" icon at the left side of the window, then click on "Advanced."
    deselect "Only delete files in Windows Temp folders older than 48 hours."
  • Click on the "Cleaner" icon on the left side of the window, then click Run Cleaner to run the program.
  • Caution: It is not recommended that you use the "Issues" feature unless you are very familiar with the registry as it has been known to find legitimate items.
  • After CCleaner has completed its process, click Exit.

*NOTE* CCleaner deletes EVERYTHING out of temp/temporary folders. If you have anything in a temp folder, back it up or move it to a permanent folder prior to running CCleaner!




  • Your Java is out of date and leaving your system vulnerable.
  • Go to your Add-Remove Programs in the Control Panel and uninstall any previous versions of Java (J2SE Runtime Environment)
  • It should have an icon next to it:
    [external image: Posted Image]
    Select it and click Remove.
  • Reboot your system.
  • Then go to the Sun Microsystems and install the update
  • Java Runtime Environment Version 6 Update 3 <–This is what you need to download and install.
  • If you chose the online installation, it will prompt you to run the program.
  • If you chose the offline installation, you will be prompted to save the file and you can run it from wherever you saved it.
  • Then after install you can verify your installation here Sun Java Verify
I like to to do the offline installation and save the setup file in case I may need it in the future



Post a new HJT log and lets make sure nothing has come back and let me know how your system is running now??
Post #9
Hi Ken,
Thanks for your patience. Computer doing better, however still pretty slow at times (windows freeze often). I think that the Tea Timer may be part of it. Any suggestions?

If you feel I took care of everything I could here, can you recommend another "WhatTheTech" Forum that will help me figure out the rest? Thanks again, Lori

:thumbup:
Downloaded new version spybot, ran, and rebooted
Ran CC Cleaner
uninstalled old Java Version
Searched for Java and deleted old Java file folders(SHould I have done this? everthing seems to be working)

Installed New Java Version
Sun Java Verify OK.
I also unchecked automatic updates.

Does Java install Yahoo with program? I have Yahoo on toolbar now.
Also, getting teatimer registry changes since installation - wants to chang IT Bar - I keep denying
how do I know whethet to accept?
I did accept the first initial requests since it was right after I installed Java.

HIJACK THIS LOG:
Logfile of HijackThis v1.99.1
Scan saved at 5:44:21 PM, on 11/28/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis\SCANNER.EXE.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Surfing Around
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.7\NppBho.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.7\UIBHO.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKCU\..\Run: [HijackThis startup scan] C:\Program Files\Hijackthis\HijackThis.exe /startupscan
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
Post #10 last edited
Hi Lori,

When you installed CCleaner if you did not read each step as you installed it , it installed the Yahoo Toolbar, no biggie, you can uninstall it via the Add Remove Programs in the Control Panel.

You have HJT set to start when windows starts and its really not needed, instead of changing it, why dont you uninstall it via Add Remove also and download and install the newer version by Trendmicro. After you install it open HJT and go to Misc. Tools> Main and make sure its not checked to run at startup.

Download Trendmicros Hijackthis to your desktop.
Double click it to install
Follow the prompts and by default it will install in C:\Program Files\Trendmicro\Hijackthis\Highjackthis.exe


You can also disable the TeaTimer in Spybot . It will take a reboot for it to take effect.

1. Run Spybot-S&D in Advanced Mode.
2. If it is not already set to do this Go to the Mode menu select "Advanced Mode"
3. On the left hand side, Click on Tools
4. Then click on the Resident Icon in the List
5. Uncheck "Resident TeaTimer" and OK any prompts.
6. Restart your computer.




  • Go to Start > Run and copy and paste ComboFix /u into the box
  • Make sure there's a space between Combofix and /
  • Then hit enter.
This will uninstall Combofix, delete its related folders and files, reset your clock settings, hide file extensions, hide the system/hidden files and resets System Restore again.



You can also drag Vundofix to the trash as its updated on a regular basis.



The rest of you log looks fine :thumbup: But you can run Super Anti Spyware and lets see if it picks anything up, if not than I can direct you to some great support sites for windows that deal with slow computers.

Please download SuperAntiSpyware
Install the program
  • Run SuperAntiSpyware and click: Check for updates
  • Once the update is finished, on the main screen, click: Scan your computer
  • Check: Perform Complete Scan
  • Click Next to start the scan.
Superantispyware scans the computer, and when finished, lists all the infections found.
Make sure everything found has a check next to it, and press: Next
Then, click Finish

It is possible that the program asks to reboot in order to delete some files.

Obtain the SuperAntiSpyware log as follows:
  • Click: Preferences
  • Click the Statistics/Logs tab
  • Under Scanner Logs, double-click SuperAntiSpyware Scan Log
It opens in your default text editor (such as Notepad)

Please provide the SuperAntiSpyware log in your reply, as well as a new HijackThis log.


Let me see the SAS log and go back and rename Trendmicros HJT to Lori.exe post a new log please
Post #11
Hi Ken,
The tea timer is still running even though it does not show in report (I ended it in task menu). I forgot to mention to you that I tried to follow Spybot steps and had a problem with step 4: "Then click on the Resident Icon in the List….and uncheck tea timer". I unchecked the Resident Icon, however the "Resident TeaTimer" icon was missing, so I was unable to uncheck. Should I uninstall Spybot altogether since I installed Superspybot, or can I delete the teatimer.exe file? I also uninstalled Yahoo, but noticed some Yahoo stuff in Trend Micro HiJACK This log.

Hope you are having a nice weekend,
Lori

Here are my two logs:

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 11/30/2007 at 11:43 PM

Application Version : 3.9.1008

Core Rules Database Version : 3259
Trace Rules Database Version: 1352

Scan type : Complete Scan
Total Scan Time : 01:32:13

Memory items scanned : 467
Memory threats detected : 0
Registry items scanned : 5740
Registry threats detected : 8
File items scanned : 40118
File threats detected : 53

Adware.Vundo Variant
HKLM\Software\Classes\CLSID\{0528706E-177B-48F2-803D-88D44A8A9514}
HKCR\CLSID\{0528706E-177B-48F2-803D-88D44A8A9514}
HKCR\CLSID\{0528706E-177B-48F2-803D-88D44A8A9514}\InprocServer32
HKCR\CLSID\{0528706E-177B-48F2-803D-88D44A8A9514}\InprocServer32#ThreadingModel
C:\WINDOWS\SYSTEM32\AWTQQ.DLL
HKLM\Software\Classes\CLSID\{FD43C522-4A74-4800-9FF4-DEE93F9A1694}
HKCR\CLSID\{FD43C522-4A74-4800-9FF4-DEE93F9A1694}
HKCR\CLSID\{FD43C522-4A74-4800-9FF4-DEE93F9A1694}\InprocServer32
HKCR\CLSID\{FD43C522-4A74-4800-9FF4-DEE93F9A1694}\InprocServer32#ThreadingModel
C:\WINDOWS\SYSTEM32\DDABB.DLL

Adware.Tracking Cookie
C:\Documents and Settings\NEW ACCOUNT\Cookies\new_account@revsci[2].txt
C:\Documents and Settings\NEW ACCOUNT\Cookies\new_account@atdmt[3].txt
C:\Documents and Settings\NEW ACCOUNT\Cookies\new_account@atwola[2].txt
C:\Documents and Settings\NEW ACCOUNT\Cookies\[removed][2].txt
C:\Documents and Settings\NEW ACCOUNT\Cookies\[removed][1].txt
C:\Documents and Settings\NEW ACCOUNT\Cookies\[removed][2].txt
C:\Documents and Settings\NEW ACCOUNT\Cookies\[removed][1].txt
C:\Documents and Settings\NEW ACCOUNT\Cookies\new_account@tribalfusion[1].txt
C:\Documents and Settings\NEW ACCOUNT\Cookies\[removed][1].txt
C:\Documents and Settings\NEW ACCOUNT\Cookies\new_account@alllaw.112.2o7[1].txt
C:\Documents and Settings\NEW ACCOUNT\Cookies\[removed][2].txt
C:\Documents and Settings\NEW ACCOUNT\Cookies\new_account@2o7[1].txt
C:\Documents and Settings\NEW ACCOUNT\Cookies\[removed][2].txt
C:\Documents and Settings\NEW ACCOUNT\Cookies\new_account@tacoda[2].txt
C:\Documents and Settings\NEW ACCOUNT\Cookies\[removed][1].txt
C:\Documents and Settings\NEW ACCOUNT\Cookies\[removed][1].txt
C:\Documents and Settings\NEW ACCOUNT\Cookies\new_account@adbrite[1].txt
C:\Documents and Settings\NEW ACCOUNT\Cookies\[removed][2].txt
C:\Documents and Settings\NEW ACCOUNT\Cookies\new_account@realmedia[2].txt
C:\Documents and Settings\NEW ACCOUNT\Cookies\new_account@specificclick[2].txt
C:\Documents and Settings\NEW ACCOUNT\Cookies\new_account@advertising[1].txt
C:\Documents and Settings\NEW ACCOUNT\Cookies\[removed][1].txt
C:\Documents and Settings\NEW ACCOUNT\Cookies\[removed][1].txt
C:\Documents and Settings\NEW ACCOUNT\Cookies\new_account@edge.ru4[1].txt
C:\Documents and Settings\NEW ACCOUNT\Cookies\[removed][2].txt
C:\Documents and Settings\NEW ACCOUNT\Cookies\[removed][3].txt
C:\Documents and Settings\Lindsay\Cookies\lindsay@2o7[1].txt
C:\Documents and Settings\Lindsay\Cookies\lindsay@67.15.239[1].txt
C:\Documents and Settings\Lindsay\Cookies\lindsay@67.15.239[2].txt
C:\Documents and Settings\Lindsay\Cookies\lindsay@adknowledge[2].txt
C:\Documents and Settings\Lindsay\Cookies\lindsay@advertising[1].txt
C:\Documents and Settings\Lindsay\Cookies\[removed][1].txt
C:\Documents and Settings\Lindsay\Cookies\lindsay@atwola[1].txt
C:\Documents and Settings\Lindsay\Cookies\lindsay@countercentral[2].txt
C:\Documents and Settings\Lindsay\Cookies\lindsay@doubleclick[1].txt
C:\Documents and Settings\Lindsay\Cookies\lindsay@interclick[2].txt
C:\Documents and Settings\Lindsay\Cookies\[removed][1].txt
C:\Documents and Settings\Lindsay\Cookies\lindsay@revsci[2].txt
C:\Documents and Settings\Lindsay\Cookies\lindsay@seventeen[1].txt
C:\Documents and Settings\Lindsay\Cookies\[removed][1].txt
C:\Documents and Settings\Lindsay\Cookies\[removed][1].txt
C:\Documents and Settings\NEW ACCOUNT\Cookies\new_account@2o7[2].txt
C:\Documents and Settings\NEW ACCOUNT\Cookies\[removed][2].txt
C:\Documents and Settings\NEW ACCOUNT\Cookies\new_account@advertising[2].txt
C:\Documents and Settings\NEW ACCOUNT\Cookies\[removed][1].txt
C:\Documents and Settings\NEW ACCOUNT\Cookies\[removed][1].txt
C:\Documents and Settings\NEW ACCOUNT\Cookies\new_account@atdmt[2].txt
C:\Documents and Settings\NEW ACCOUNT\Cookies\new_account@atwola[1].txt
C:\Documents and Settings\NEW ACCOUNT\Cookies\new_account@edge.ru4[2].txt
C:\Documents and Settings\NEW ACCOUNT\Cookies\new_account@revsci[1].txt




Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:21:01 PM, on 12/1/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\Lori.exe.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Surfing Around
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.7\NppBho.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.7\UIBHO.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [HijackThis startup scan] C:\Program Files\Hijackthis\HijackThis.exe /startupscan
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

–
End of file - 6987 bytes
Post #12
Lori,

Your Tea Timer is disabled.

Remove these with HJT.

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)

Spybot Search and Destroy has an immunization feature that will help prevent some bad things from installing, Super Anti Spyware is just a scanner and a good one I might add, you can keep them both.

The rest of your log looks fine :thumbup:

How are things running now??
Post #13
:wacko: Would you believe that there was a power outage which surged past my "surge protector" and into my computer and disabled it??? I heard the buzzing first :o and knew there was going to be a problem. After about an hour the power came back on, but computer wouldn't. At first I cried :( then had to laugh :lol: .

At this point I don't think this computer is going to come out of it's coma, however if you don't mind keeping this open for a week until I have it checked I would appreciate it. Thank you Ken my computer friend :thumbup: . Lori
Post #15
"What am I going to do with you. You need a good Surge Protector, not the cheap ones at K-Mart. " :lol: LOL - very funny and true! thanks for the advice. Who knew? This would make a good television commercial :D .

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI