What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Please review HijackThis log - tons of pop ups - than

8 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I cann't seem to stop the popups. I have removed 42 viruse/trohans/malware with many ot the main stream vrus scanners, but the pop ups continue. I also loaded a trial of Kaspsky. "Buzznet.com" is one of the popups. I am at a loss. The HijackThis log is below…If possible, could you tell me what has infected this pc and guide me through the fix?
If I didn't do this right, please accept my applogy. I am new to this and want to do it correct. Thank you very very much for you time.
——————
Logfile of HijackThis v1.99.1
Scan saved at 10:41:24 PM, on 11/21/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\DigitalPersona\Bin\DpHost.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://indirect.nextel.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O3 - Toolbar: (no name) - {11A69AE4-FBED-4832-A2BF-45AF82825583} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1189176782176
O16 - DPF: {B24F0664-7DDA-40B6-B38C-A4FD68DE8685} (CentraDownloaderCtl Class) - https://www.ueclassroom.sprint.com/SiteRoot…aDownloader.cab
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" -r (file missing)
O23 - Service: Biometric Authentication Service (DpHost) - Digital Persona, Inc. - C:\Program Files\DigitalPersona\Bin\DpHost.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

———————–
Post #2
Hello plusco and welcome to the What the Tech Forums

My name is Trevuren and I will be helping you with your problem.


A. Some trojans have a way of masking their presence from the HijackThis program when they recognise the name. I think that this is the case here because there are no 02 or 020 entries visible in your log.

Please locate the following file on your desktop: HijackThis.exe
Next, right click on the file and from the popup menu that appears, chose the RENAME option and rename the file Killer.exe.

From now on, when I ask you to start HijackThis, just click on the Killer.exe file.


B. Please download VundoFix.exe to your desktop.
  • Double-click VundoFix.exe to run it.
  • Click the Scan for Vundo button.
  • Once it's done scanning, click the Remove Vundo button.
  • You will receive a prompt asking if you want to remove the files, click YES
  • Once you click yes, your desktop will go blank as it starts removing Vundo.
  • When completed, it will prompt that it will reboot your computer, click OK.
  • Please post the contents of C:\vundofix.txt.
Note: It is possible that VundoFix encountered a file it could not remove.
In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot.



C. Download ComboFix from Here to your Desktop.
  • Double click combofix.exe and follow the prompts.
  • When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply
Note: Do not mouseclick combofix's window while its running. That may cause it to stall


D. Reports/Logs to post:
  • VundoFix.txt
  • ComboFix.txt
  • HijackThis log
Post #3
Thank you Trevuren. Below are the logs you requested:

———————————————————————-

VundoFix V6.6.2

Checking Java version…

Scan started at 12:34:26 AM 11/22/2007

Listing files found while scanning….

No infected files were found.


Beginning removal…

————————————————————————

ComboFix 07-11-19.3 - Amanda 2007-11-22 0:51:03.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.130 [GMT -6:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point
.

Unable to gain System Privileges

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users.WINDOWS\Start Menu\Live Safety Center.lnk
C:\Documents and Settings\All Users.WINDOWS\Start Menu\Online Security Guide.lnk
C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\Favorites\Online Security Guide.lnk
C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\awvvt.dll
C:\WINDOWS\system32\f02WtR
C:\WINDOWS\system32\ldinfo.ldr
C:\WINDOWS\system32\MabryObj.dll
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\system32\tvvwa.ini
C:\WINDOWS\system32\tvvwa.ini2

.
((((((((((((((((((((((((( Files Created from 2007-10-22 to 2007-11-22 )))))))))))))))))))))))))))))))
.

2007-11-22 00:34 d——– C:\VundoFix Backups
2007-11-21 21:30 28,672 –a—— C:\WINDOWS\system32\drivers\CO_Mon.sys
2007-11-20 19:35 84,544 –a—— C:\WINDOWS\system32\ugfmpxxp.dll
2007-11-20 10:16 d——– C:\Program Files\CCleaner
2007-11-20 10:03 d——– C:\WINDOWS\BDOSCAN8
2007-11-20 09:31 6,058,496 —–c— C:\WINDOWS\system32\dllcache\ieframe.dll
2007-11-20 09:31 2,455,488 —–c— C:\WINDOWS\system32\dllcache\ieapfltr.dat
2007-11-20 09:31 991,232 —–c— C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2007-11-20 09:31 459,264 —–c— C:\WINDOWS\system32\dllcache\msfeeds.dll
2007-11-20 09:31 383,488 —–c— C:\WINDOWS\system32\dllcache\ieapfltr.dll
2007-11-20 09:31 267,776 —–c— C:\WINDOWS\system32\dllcache\iertutil.dll
2007-11-20 09:31 63,488 —–c— C:\WINDOWS\system32\dllcache\icardie.dll
2007-11-20 09:31 52,224 —–c— C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2007-11-20 09:31 13,824 —–c— C:\WINDOWS\system32\dllcache\ieudinit.exe
2007-11-20 09:24 33,792 –a–c— C:\WINDOWS\system32\dllcache\custsat.dll
2007-11-19 17:03 d——– C:\Program Files\Enigma Software Group
2007-11-19 16:18 82,061 –a—— C:\WINDOWS\system32\drivers\klick.dat
2007-11-19 16:18 81,549 –a—— C:\WINDOWS\system32\drivers\klin.dat
2007-11-19 16:11 d——– C:\Program Files\Kaspersky Lab
2007-11-19 16:10 2,662,944 –ahs—- C:\WINDOWS\system32\drivers\fidbox.dat
2007-11-19 16:10 48,416 –ahs—- C:\WINDOWS\system32\drivers\fidbox2.dat
2007-11-19 16:10 36,428 –ahs—- C:\WINDOWS\system32\drivers\fidbox.idx
2007-11-19 16:10 5,588 –ahs—- C:\WINDOWS\system32\drivers\fidbox2.idx
2007-11-19 16:09 d——– C:\KAV
2007-11-19 15:29 d——– C:\WINDOWS\system32\Kaspersky Lab
2007-11-19 15:29 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\Kaspersky Lab
2007-11-17 17:17 d–h—– C:\WINDOWS\system32\GroupPolicy
2007-11-15 17:52 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\Grisoft
2007-11-15 17:30 2,304 –a—— C:\WINDOWS\system32\tmp.reg
2007-11-15 17:30 0 –a—— C:\WINDOWS\system32\tmp.txt
2007-11-15 17:29 289,144 –a—— C:\WINDOWS\system32\VCCLSID.exe
2007-11-15 17:29 288,417 –a—— C:\WINDOWS\system32\SrchSTS.exe
2007-11-15 17:29 53,248 –a—— C:\WINDOWS\system32\Process.exe
2007-11-15 17:29 25,600 –a—— C:\WINDOWS\system32\WS2Fix.exe
2007-11-15 16:49 d——– C:\Program Files\MSXML 6.0
2007-11-15 16:45 128,896 —–c— C:\WINDOWS\system32\dllcache\fltmgr.sys
2007-11-15 16:45 23,040 —–c— C:\WINDOWS\system32\dllcache\fltmc.exe
2007-11-15 16:45 16,896 —–c— C:\WINDOWS\system32\dllcache\fltlib.dll
2007-11-15 16:34 d——– C:\Program Files\XoftSpySE
2007-11-15 16:33 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\Rabio
2007-11-15 09:03 38,912 –a—— C:\WINDOWS\system32\rqrqnki.dll
2007-11-14 22:03 673,304 –ahs—- C:\WINDOWS\system32\okokwcta.ini
2007-11-12 09:32 d——– C:\WINDOWS\system32\rMa02yy
2007-11-12 09:12 90 –a—— C:\WINDOWS\system32\spupdwxp.log
2007-11-10 02:59 584,192 —–c— C:\WINDOWS\system32\dllcache\rpcrt4.dll
2007-11-09 15:38 d——– C:\WINDOWS\provisioning
2007-11-09 15:38 d——– C:\WINDOWS\peernet
2007-11-08 09:38 290,816 –a—— C:\WINDOWS\system32\WINHTTP5.DLL
2007-11-08 09:38 86,728 –a—— C:\WINDOWS\system32\msxml6r.dll
2007-11-08 09:38 84,512 –a—— C:\WINDOWS\system32\PICCLP32.OCX
2007-10-30 07:55 d——– C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\Application Data\Move Networks
2007-10-25 16:33 d–h-c— C:\WINDOWS\$SQLUninstallMDAC28-KB911562-x86-ENU$
2007-10-25 16:31 d——– C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-10-25 16:06 d——– C:\mcafee_mcpr
2007-10-25 15:48 d——– C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\Application Data\AOL
2007-10-25 15:47 237,568 –a—— C:\WINDOWS\system32\qasf.dll
2007-10-25 15:46 33,588 -ra—— C:\WINDOWS\system32\drivers\wanatw4.sys
2007-10-25 15:45 d——– C:\Program Files\AOL 9.0
2007-10-25 10:26 53,248 –a—— C:\WINDOWS\bdoscandel.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-22 03:00 ——— d—–w C:\Documents and Settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy
2007-11-20 15:03 ——— d—–w C:\Program Files\Lavasoft
2007-11-20 15:03 ——— d—–w C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\Application Data\Lavasoft
2007-11-19 23:21 ——— d—–w C:\Program Files\Common Files\AOL
2007-11-17 22:54 ——— d—–w C:\Program Files\Google
2007-11-08 16:26 ——— d—–w C:\Program Files\TeleTracker Online
2007-10-25 21:55 ——— d—–w C:\Documents and Settings\All Users.WINDOWS\Application Data\AOL
2007-10-25 21:47 ——— d—–w C:\Program Files\Common Files\Nullsoft
2007-10-25 21:47 ——— d—–w C:\Program Files\Common Files\aolshare
2007-10-25 21:43 ——— d—–w C:\Documents and Settings\All Users.WINDOWS\Application Data\AOL Downloads
2007-10-22 15:55 ——— d—–w C:\Program Files\CentraOne
2006-01-31 16:30 28,672 —-a-w C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\atwbxdet.dll
2006-01-17 17:05 78,384 —-a-w C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\Application Data\GDIPFONTCACHEV1.DAT
2004-12-21 23:34 25,214 —-a-w C:\Program Files\dplogo32.ico
2002-08-14 20:41 65,480 —-a-w C:\Documents and Settings\Amanda\Application Data\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0AF23420-6910-43CC-992D-8439759DBD0C}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{269ecebc-c287-4550-88d3-9b1c3a7d6437}]
2007-11-20 19:35 84544 –a—— C:\WINDOWS\system32\ugfmpxxp.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{37036D98-C854-4D7D-9A11-10BA9E6A697A}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4CB8F4B4-5F66-4D9E-BC3B-184596A58824}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FEBD7FF3-D97E-490E-A494-B4047861D094}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 10:24]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-04 01:56 C:\WINDOWS\system32\rundll32.exe]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-10-10 13:27]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2004-02-12 13:38]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 15:18]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" [2007-06-28 12:51]

C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-05-14 17:15:40]
HP Image Zone Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-05-14 17:51:12]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 00:01:04]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableCAD"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\jkkljkj]
C:\WINDOWS\system32\klogon.dll 2007-06-28 12:51 206088 C:\WINDOWS\system32\klogon.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\vudarnst]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\awvvt.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^America Online 7.0 Tray Icon.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\America Online 7.0 Tray Icon.lnk
backup=C:\WINDOWS\pss\America Online 7.0 Tray Icon.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^QuickBooks 2002 Delivery Agent.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\QuickBooks 2002 Delivery Agent.lnk
backup=C:\WINDOWS\pss\QuickBooks 2002 Delivery Agent.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Amanda.AMERICAN-9LPHPH^Start Menu^Programs^Startup^Cool - Auto Update.lnk]
path=C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\Start Menu\Programs\Startup\Cool - Auto Update.lnk
backup=C:\WINDOWS\pss\Cool - Auto Update.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Amanda.AMERICAN-9LPHPH^Start Menu^Programs^Startup^TA_Start.lnk]
path=C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\Start Menu\Programs\Startup\TA_Start.lnk
backup=C:\WINDOWS\pss\TA_Start.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\f4e9212d]
rundll32.exe C:\WINDOWS\system32\atcwkoko.dll,b

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
2006-09-25 18:52 50736 –a—— C:\Program Files\Common Files\AOL\1193348727\ee\AOLSoftware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCShield]
regsvr32 /s C:\WINDOWS\System32\sfg.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\zzzHPSETUP]
D:\Setup.exe /RESTART

R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys
S3 dpK00701;U.are.U Fingerprint Reader Upper Driver;C:\WINDOWS\system32\DRIVERS\dpK00701.sys
S3 RimSerPort;RIM Virtual Serial Port;C:\WINDOWS\system32\DRIVERS\RimSerial.sys
S3 UsbdpFP;U.are.U Fingerprint Reader Class Driver;C:\WINDOWS\system32\DRIVERS\UsbdpFP.sys

.
**************************************************************************

catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-22 01:05:51
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

**************************************************************************
.
Completion time: 2007-11-22 1:08:27 - machine was rebooted
.
— E O F —
—————————————————————————————————————–

Logfile of HijackThis v1.99.1
Scan saved at 1:11:25 AM, on 11/22/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\DigitalPersona\Bin\DpHost.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\Desktop\Killer.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://indirect.nextel.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {0AF23420-6910-43CC-992D-8439759DBD0C} - (no file)
O2 - BHO: {7346d7a3-c1b9-3d88-0554-782ccbece962} - {269ecebc-c287-4550-88d3-9b1c3a7d6437} - C:\WINDOWS\system32\ugfmpxxp.dll
O2 - BHO: (no name) - {37036D98-C854-4D7D-9A11-10BA9E6A697A} - (no file)
O2 - BHO: (no name) - {4CB8F4B4-5F66-4D9E-BC3B-184596A58824} - (no file)
O2 - BHO: (no name) - {FEBD7FF3-D97E-490E-A494-B4047861D094} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1189176782176
O16 - DPF: {B24F0664-7DDA-40B6-B38C-A4FD68DE8685} (CentraDownloaderCtl Class) - https://www.ueclassroom.sprint.com/SiteRoot…aDownloader.cab
O20 - Winlogon Notify: jkkljkj - C:\WINDOWS\
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O20 - Winlogon Notify: vudarnst - C:\WINDOWS\
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" -r (file missing)
O23 - Service: Biometric Authentication Service (DpHost) - Digital Persona, Inc. - C:\Program Files\DigitalPersona\Bin\DpHost.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

————————————————————————————————-
Post #4
1. Please open Notepad
  • Click Start , then Run
  • Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

KillAll::

File::
C:\WINDOWS\system32\ugfmpxxp.dll
C:\WINDOWS\system32\VCCLSID.exe
C:\WINDOWS\system32\WS2Fix.exe
C:\WINDOWS\system32\rqrqnki.dll
C:\WINDOWS\system32\okokwcta.ini
C:\WINDOWS\system32\atcwkoko.dll
C:\WINDOWS\System32\sfg.dll

Folder::
C:\WINDOWS\system32\rMa02yy

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0AF23420-6910-43CC-992D-8439759DBD0C}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{269ecebc-c287-4550-88d3-9b1c3a7d6437}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{37036D98-C854-4D7D-9A11-10BA9E6A697A}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4CB8F4B4-5F66-4D9E-BC3B-184596A58824}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FEBD7FF3-D97E-490E-A494-B4047861D094}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableCAD"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\jkkljkj]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\vudarnst]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\f4e9212d]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCShield]


3. Now physically disconnect from the internet and STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields)


4. Save the above as CFScript.txt

5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

[external image: Posted Image]


6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
  • Combofix.txt
  • A new HijackThis log.

6. When finished, it will produce a log. Please save that log to a Notepad File to post in your next reply along with a fresh HJT log.

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

* After you have saved the logs, restart your system to re-enable all the programs that were disabled during the running of ComboFix.

* Reconnect to the internet

* Post the following logs/Reports:
  • ComboFix.txt
  • Fresh HijackThis log run after all the other tools have performed their cleanup.
Post #5
Thank you Trevuren. Below are the logs you requested. Question: Was this Zlob?

———————————————————————-

ComboFix 07-11-19.3 - Amanda 2007-11-22 9:58:24.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.263 [GMT -6:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\Desktop\CFScript.txt
* Created a new restore point

FILE
C:\WINDOWS\system32\atcwkoko.dll
C:\WINDOWS\system32\okokwcta.ini
C:\WINDOWS\system32\rqrqnki.dll
C:\WINDOWS\System32\sfg.dll
C:\WINDOWS\system32\ugfmpxxp.dll
C:\WINDOWS\system32\VCCLSID.exe
C:\WINDOWS\system32\WS2Fix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\okokwcta.ini
C:\WINDOWS\system32\rMa02yy
C:\WINDOWS\system32\rqrqnki.dll
C:\WINDOWS\system32\ugfmpxxp.dll
C:\WINDOWS\system32\VCCLSID.exe
C:\WINDOWS\system32\WS2Fix.exe

.
((((((((((((((((((((((((( Files Created from 2007-10-22 to 2007-11-22 )))))))))))))))))))))))))))))))
.

2007-11-22 00:34 d——– C:\VundoFix Backups
2007-11-21 21:30 28,672 –a—— C:\WINDOWS\system32\drivers\CO_Mon.sys
2007-11-20 10:16 d——– C:\Program Files\CCleaner
2007-11-20 10:03 d——– C:\WINDOWS\BDOSCAN8
2007-11-20 09:31 6,058,496 —–c— C:\WINDOWS\system32\dllcache\ieframe.dll
2007-11-20 09:31 2,455,488 —–c— C:\WINDOWS\system32\dllcache\ieapfltr.dat
2007-11-20 09:31 991,232 —–c— C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2007-11-20 09:31 459,264 —–c— C:\WINDOWS\system32\dllcache\msfeeds.dll
2007-11-20 09:31 383,488 —–c— C:\WINDOWS\system32\dllcache\ieapfltr.dll
2007-11-20 09:31 267,776 —–c— C:\WINDOWS\system32\dllcache\iertutil.dll
2007-11-20 09:31 63,488 —–c— C:\WINDOWS\system32\dllcache\icardie.dll
2007-11-20 09:31 52,224 —–c— C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2007-11-20 09:31 13,824 —–c— C:\WINDOWS\system32\dllcache\ieudinit.exe
2007-11-20 09:24 33,792 –a–c— C:\WINDOWS\system32\dllcache\custsat.dll
2007-11-19 17:03 d——– C:\Program Files\Enigma Software Group
2007-11-19 16:18 82,061 –a—— C:\WINDOWS\system32\drivers\klick.dat
2007-11-19 16:18 81,549 –a—— C:\WINDOWS\system32\drivers\klin.dat
2007-11-19 16:11 d——– C:\Program Files\Kaspersky Lab
2007-11-19 16:10 2,768,672 –ahs—- C:\WINDOWS\system32\drivers\fidbox.dat
2007-11-19 16:10 50,976 –ahs—- C:\WINDOWS\system32\drivers\fidbox2.dat
2007-11-19 16:10 38,108 –ahs—- C:\WINDOWS\system32\drivers\fidbox.idx
2007-11-19 16:10 5,828 –ahs—- C:\WINDOWS\system32\drivers\fidbox2.idx
2007-11-19 16:09 d——– C:\KAV
2007-11-19 15:29 d——– C:\WINDOWS\system32\Kaspersky Lab
2007-11-19 15:29 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\Kaspersky Lab
2007-11-17 17:17 d–h—– C:\WINDOWS\system32\GroupPolicy
2007-11-15 17:52 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\Grisoft
2007-11-15 17:29 53,248 –a—— C:\WINDOWS\system32\Process.exe
2007-11-15 16:49 d——– C:\Program Files\MSXML 6.0
2007-11-15 16:45 128,896 —–c— C:\WINDOWS\system32\dllcache\fltmgr.sys
2007-11-15 16:45 23,040 —–c— C:\WINDOWS\system32\dllcache\fltmc.exe
2007-11-15 16:45 16,896 —–c— C:\WINDOWS\system32\dllcache\fltlib.dll
2007-11-15 16:34 d——– C:\Program Files\XoftSpySE
2007-11-15 16:33 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\Rabio
2007-11-10 02:59 584,192 —–c— C:\WINDOWS\system32\dllcache\rpcrt4.dll
2007-11-09 15:42 221,184 –a—— C:\WINDOWS\system32\wmpns.dll
2007-11-09 15:38 d——– C:\WINDOWS\provisioning
2007-11-09 15:38 d——– C:\WINDOWS\peernet
2007-11-08 09:38 86,728 –a—— C:\WINDOWS\system32\msxml6r.dll
2007-11-08 09:38 84,512 –a—— C:\WINDOWS\system32\PICCLP32.OCX
2007-10-30 07:55 d——– C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\Application Data\Move Networks
2007-10-25 16:33 d–h-c— C:\WINDOWS\$SQLUninstallMDAC28-KB911562-x86-ENU$
2007-10-25 16:31 d——– C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-10-25 16:06 d——– C:\mcafee_mcpr
2007-10-25 15:48 d——– C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\Application Data\AOL
2007-10-25 15:47 1,119,744 –a—— C:\WINDOWS\system32\wmsdmoe2.dll
2007-10-25 15:47 1,001,472 –a—— C:\WINDOWS\system32\wmvdmoe2.dll
2007-10-25 15:47 896,512 –a—— C:\WINDOWS\system32\wmspdmoe.dll
2007-10-25 15:47 809,984 –a—— C:\WINDOWS\system32\wmvdmod.dll
2007-10-25 15:47 759,296 –a—— C:\WINDOWS\system32\wmsdmod.dll
2007-10-25 15:46 33,588 -ra—— C:\WINDOWS\system32\drivers\wanatw4.sys
2007-10-25 15:45 d——– C:\Program Files\AOL 9.0
2007-10-25 10:26 53,248 –a—— C:\WINDOWS\bdoscandel.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-22 03:00 ——— d—–w C:\Documents and Settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy
2007-11-20 15:03 ——— d—–w C:\Program Files\Lavasoft
2007-11-20 15:03 ——— d—–w C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\Application Data\Lavasoft
2007-11-19 23:21 ——— d—–w C:\Program Files\Common Files\AOL
2007-11-17 22:54 ——— d—–w C:\Program Files\Google
2007-11-08 16:26 ——— d—–w C:\Program Files\TeleTracker Online
2007-10-25 21:55 ——— d—–w C:\Documents and Settings\All Users.WINDOWS\Application Data\AOL
2007-10-25 21:47 ——— d—–w C:\Program Files\Common Files\Nullsoft
2007-10-25 21:47 ——— d—–w C:\Program Files\Common Files\aolshare
2007-10-25 21:43 ——— d—–w C:\Documents and Settings\All Users.WINDOWS\Application Data\AOL Downloads
2007-10-22 15:55 ——— d—–w C:\Program Files\CentraOne
2006-01-31 16:30 28,672 —-a-w C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\atwbxdet.dll
2006-01-17 17:05 78,384 —-a-w C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\Application Data\GDIPFONTCACHEV1.DAT
2004-12-21 23:34 25,214 —-a-w C:\Program Files\dplogo32.ico
2002-08-14 20:41 65,480 —-a-w C:\Documents and Settings\Amanda\Application Data\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 10:24]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-04 01:56 C:\WINDOWS\system32\rundll32.exe]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-10-10 13:27]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2004-02-12 13:38]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 15:18]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" [2007-06-28 12:51]

C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-05-14 17:15:40]
HP Image Zone Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-05-14 17:51:12]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 00:01:04]
C:\WINDOWS\system32\klogon.dll 2007-06-28 12:51 206088 C:\WINDOWS\system32\klogon.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^America Online 7.0 Tray Icon.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\America Online 7.0 Tray Icon.lnk
backup=C:\WINDOWS\pss\America Online 7.0 Tray Icon.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^QuickBooks 2002 Delivery Agent.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\QuickBooks 2002 Delivery Agent.lnk
backup=C:\WINDOWS\pss\QuickBooks 2002 Delivery Agent.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Amanda.AMERICAN-9LPHPH^Start Menu^Programs^Startup^Cool - Auto Update.lnk]
path=C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\Start Menu\Programs\Startup\Cool - Auto Update.lnk
backup=C:\WINDOWS\pss\Cool - Auto Update.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Amanda.AMERICAN-9LPHPH^Start Menu^Programs^Startup^TA_Start.lnk]
path=C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\Start Menu\Programs\Startup\TA_Start.lnk
backup=C:\WINDOWS\pss\TA_Start.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
2006-09-25 18:52 50736 –a—— C:\Program Files\Common Files\AOL\1193348727\ee\AOLSoftware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCShield]
regsvr32 /s C:\WINDOWS\System32\sfg.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\zzzHPSETUP]
D:\Setup.exe /RESTART

R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys
S3 dpK00701;U.are.U Fingerprint Reader Upper Driver;C:\WINDOWS\system32\DRIVERS\dpK00701.sys
S3 RimSerPort;RIM Virtual Serial Port;C:\WINDOWS\system32\DRIVERS\RimSerial.sys
S3 UsbdpFP;U.are.U Fingerprint Reader Class Driver;C:\WINDOWS\system32\DRIVERS\UsbdpFP.sys

.
**************************************************************************

catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-22 10:03:33
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-22 10:05:59 - machine was rebooted
.
— E O F —

—————————————————————————————————-

Logfile of HijackThis v1.99.1
Scan saved at 10:10:19 AM, on 11/22/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\DigitalPersona\Bin\DpHost.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\Desktop\Killer.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://indirect.nextel.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1189176782176
O16 - DPF: {B24F0664-7DDA-40B6-B38C-A4FD68DE8685} (CentraDownloaderCtl Class) - https://www.ueclassroom.sprint.com/SiteRoot…aDownloader.cab
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" -r (file missing)
O23 - Service: Biometric Authentication Service (DpHost) - Digital Persona, Inc. - C:\Program Files\DigitalPersona\Bin\DpHost.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

——————————————————————————————————————–
Post #6 last edited
We apparently have one that does not want to leave peacefully:

Follow these steps to manually remove this adware from your computer.

A. Open Notepad (Start | Run, and type Notepad.exe, then OK) and copy everythin in the following codebox to the opened Notepad file:

@echo off	  
cd %WinDir%\system32
regsvr32 /u veevo.dll
regsvr32 /u sfg.dll
attrib -r -s -h C:\Windows\system32\veevo.dll
del C:\Windows\system32\veevo.dll
attrib -r -s -h C:\Windows\system32\sfg.dll
del C:\Windows\system32\sfg.dll
del delete.bat

Now close the Notepad file and when prompted, SAVE the file to your DESKTOP as "delete.bat" (The quote marks are important).

As a final step in this first procedure, please click on delete.bat


B. Launch Notepad, and copy/paste everything in the codebox below into the new document, including the word REGEDIT4. Go up to "File Save As" and click the drop-down box to change the "Save As Type" to "All Files" and save it to your desktop as fixme.reg.

REGEDIT4

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCShield]


3. Locate fixme.reg on your Desktop. It should look like this [external image: Posted Image]. Double-click on it. You will receive a prompt similar to: "Do you wish to merge the information into the registry?". Answer Yes and wait for a message to appear similar to Merged Successfully.

4. Restart your computer.



C. Please use the Internet Explorer browser, and do an online scan with Kaspersky Online Scanner
Click Yes, when prompted to install its ActiveX component.
(Note.. for Internet Explorer 7 users: If at any time you have trouble with the "Accept" button of the license, click on the "Zoom" tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license has been accepted, reset to 100%.)
The program launches and downloads the latest definition files.
  • Once the files are downloaded click on Next
  • Click on Scan Settings and configure as follows:
    • Scan using the following Anti-Virus database:
      • Extended
    • Scan Options:Scan Archives
      Scan Mail Bases
  • Click OK and, under select a target to scan, select My Computer
When the scan is done, in the Scan is completed window (below), any infection is displayed.
There is no option to clean/disinfect, however, we need to analyze the information on the report.
[external image: Posted Image]
[external image: Posted Image]
To obtain the report:
Click on: Save Report As (above - red blinking arrow)
Next, in the Save as prompt, Save in area, select: Desktop
In the File name area, use KScan, or something similar
In Save as type, click the drop arrow and select: Text file [*.txt]
Then, click: Save
Please post the Kaspersky Online Scanner Report in your reply, along with a fresh HijackThis log

Post edited for typos
Post #7
Thank you Trevuren. Below are the logs you requested.

——————————————————————————
——————————————————————————-
KASPERSKY ONLINE SCANNER REPORT
Thursday, November 22, 2007 7:03:20 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 22/11/2007
Kaspersky Anti-Virus database records: 464219
——————————————————————————-

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\

Scan Statistics:
Total number of scanned objects: 61371
Number of viruses found: 3
Number of infected objects: 22
Number of suspicious objects: 14
Duration of the scan process: 01:09:12

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\Kaspersky Lab\AVP7\Report\0134_File_Monitoring_eventlog.rpt Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\Kaspersky Lab\AVP7\Report\0135_Web_Monitoring_eventlog.rpt Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\Kaspersky Lab\AVP7\Report\detected.idx Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\Kaspersky Lab\AVP7\Report\detected.rpt Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\Kaspersky Lab\AVP7\Report\eventlog Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\Kaspersky Lab\AVP7\Report\report.rpt Object is locked skipped
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\0d78d4a676353e1f80490f305374168b_1e6ba0b2-39aa-476e-b66c-0e07c662b6aa Object is locked skipped
C:\Documents and Settings\Amanda\Local Settings\Application Data\Identities\{FBF3BD73-6D16-4727-BB34-CCA414852375}\Microsoft\Outlook Express\Deleted Items.dbx/[From falcon4u <[removed]>][Date Fri, 13 Sep 2002 09:58:13 -0400]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Amanda\Local Settings\Application Data\Identities\{FBF3BD73-6D16-4727-BB34-CCA414852375}\Microsoft\Outlook Express\Deleted Items.dbx/[From falcon4u <[removed]>][Date Fri, 13 Sep 2002 09:58:13 -0400]/UNNAMED/src.pif Infected: Email-Worm.Win32.Klez.h skipped
C:\Documents and Settings\Amanda\Local Settings\Application Data\Identities\{FBF3BD73-6D16-4727-BB34-CCA414852375}\Microsoft\Outlook Express\Deleted Items.dbx/[From falcon4u <[removed]>][Date Fri, 13 Sep 2002 09:58:13 -0400]/UNNAMED Infected: Email-Worm.Win32.Klez.h skipped
C:\Documents and Settings\Amanda\Local Settings\Application Data\Identities\{FBF3BD73-6D16-4727-BB34-CCA414852375}\Microsoft\Outlook Express\Deleted Items.dbx/[From RGV129 <[removed]>][Date Sat, 14 Sep 2002 10:01:36 -0400]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Amanda\Local Settings\Application Data\Identities\{FBF3BD73-6D16-4727-BB34-CCA414852375}\Microsoft\Outlook Express\Deleted Items.dbx/[From RGV129 <[removed]>][Date Sat, 14 Sep 2002 10:01:36 -0400]/UNNAMED/index[1].pif Infected: Email-Worm.Win32.Klez.h skipped
C:\Documents and Settings\Amanda\Local Settings\Application Data\Identities\{FBF3BD73-6D16-4727-BB34-CCA414852375}\Microsoft\Outlook Express\Deleted Items.dbx/[From RGV129 <[removed]>][Date Sat, 14 Sep 2002 10:01:36 -0400]/UNNAMED Infected: Email-Worm.Win32.Klez.h skipped
C:\Documents and Settings\Amanda\Local Settings\Application Data\Identities\{FBF3BD73-6D16-4727-BB34-CCA414852375}\Microsoft\Outlook Express\Deleted Items.dbx/[From "American Digital" <[removed]>][Date Fri, 16 Aug 2002 12:50:29 -0500]/UNNAMED/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Amanda\Local Settings\Application Data\Identities\{FBF3BD73-6D16-4727-BB34-CCA414852375}\Microsoft\Outlook Express\Deleted Items.dbx/[From "American Digital" <[removed]>][Date Fri, 16 Aug 2002 12:50:29 -0500]/UNNAMED/UNNAMED Suspicious: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Amanda\Local Settings\Application Data\Identities\{FBF3BD73-6D16-4727-BB34-CCA414852375}\Microsoft\Outlook Express\Deleted Items.dbx/[From "American Digital" <[removed]>][Date Fri, 16 Aug 2002 12:50:29 -0500]/UNNAMED/width.bat Infected: Email-Worm.Win32.Klez.h skipped
C:\Documents and Settings\Amanda\Local Settings\Application Data\Identities\{FBF3BD73-6D16-4727-BB34-CCA414852375}\Microsoft\Outlook Express\Deleted Items.dbx/[From "American Digital" <[removed]>][Date Fri, 16 Aug 2002 12:50:29 -0500]/UNNAMED Infected: Email-Worm.Win32.Klez.h skipped
C:\Documents and Settings\Amanda\Local Settings\Application Data\Identities\{FBF3BD73-6D16-4727-BB34-CCA414852375}\Microsoft\Outlook Express\Deleted Items.dbx Mail MS Outlook 5: infected - 6, suspicious - 4 skipped
C:\Documents and Settings\Amanda\Local Settings\Application Data\Identities\{FBF3BD73-6D16-4727-BB34-CCA414852375}\Microsoft\Outlook Express\Inbox.dbx/[From cwroddam <[removed]>][Date Mon, 12 Aug 2002 14:30:28 -0400]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Amanda\Local Settings\Application Data\Identities\{FBF3BD73-6D16-4727-BB34-CCA414852375}\Microsoft\Outlook Express\Inbox.dbx/[From cwroddam <[removed]>][Date Mon, 12 Aug 2002 14:30:28 -0400]/UNNAMED/photo_1[1].bat Infected: Email-Worm.Win32.Klez.h skipped
C:\Documents and Settings\Amanda\Local Settings\Application Data\Identities\{FBF3BD73-6D16-4727-BB34-CCA414852375}\Microsoft\Outlook Express\Inbox.dbx/[From cwroddam <[removed]>][Date Mon, 12 Aug 2002 14:30:28 -0400]/UNNAMED Infected: Email-Worm.Win32.Klez.h skipped
C:\Documents and Settings\Amanda\Local Settings\Application Data\Identities\{FBF3BD73-6D16-4727-BB34-CCA414852375}\Microsoft\Outlook Express\Inbox.dbx/[From Becky_Karlin <[removed]>][Date Sat, 10 Aug 2002 14:19:19 -0400]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Amanda\Local Settings\Application Data\Identities\{FBF3BD73-6D16-4727-BB34-CCA414852375}\Microsoft\Outlook Express\Inbox.dbx/[From Becky_Karlin <[removed]>][Date Sat, 10 Aug 2002 14:19:19 -0400]/UNNAMED/um.scr Infected: Email-Worm.Win32.Klez.h skipped
C:\Documents and Settings\Amanda\Local Settings\Application Data\Identities\{FBF3BD73-6D16-4727-BB34-CCA414852375}\Microsoft\Outlook Express\Inbox.dbx/[From Becky_Karlin <[removed]>][Date Sat, 10 Aug 2002 14:19:19 -0400]/UNNAMED Infected: Email-Worm.Win32.Klez.h skipped
C:\Documents and Settings\Amanda\Local Settings\Application Data\Identities\{FBF3BD73-6D16-4727-BB34-CCA414852375}\Microsoft\Outlook Express\Inbox.dbx/[From UpgradeProgram <[removed]>][Date Mon, 12 Aug 2002 09:00:08 -0400 (EDT)]/UNNAMED/html Suspicious: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Amanda\Local Settings\Application Data\Identities\{FBF3BD73-6D16-4727-BB34-CCA414852375}\Microsoft\Outlook Express\Inbox.dbx/[From UpgradeProgram <[removed]>][Date Mon, 12 Aug 2002 09:00:08 -0400 (EDT)]/UNNAMED/width.bat Infected: Email-Worm.Win32.Klez.h skipped
C:\Documents and Settings\Amanda\Local Settings\Application Data\Identities\{FBF3BD73-6D16-4727-BB34-CCA414852375}\Microsoft\Outlook Express\Inbox.dbx/[From UpgradeProgram <[removed]>][Date Mon, 12 Aug 2002 09:00:08 -0400 (EDT)]/UNNAMED Infected: Email-Worm.Win32.Klez.h skipped
C:\Documents and Settings\Amanda\Local Settings\Application Data\Identities\{FBF3BD73-6D16-4727-BB34-CCA414852375}\Microsoft\Outlook Express\Inbox.dbx/[From Mail Delivery Subsystem <[removed]>][Date Mon, 19 Aug 2002 12:41:08 -0400 (EDT)]/UNNAMED/[From logs-wa.proxy.aol.com [205.188.192.14]]/UNNAMED/[From adnextel <[removed]>][Date Mon, 19 Aug 2002 12:39:28 -0400 (EDT)]/picacu.exe Infected: Email-Worm.Win32.Klez.h skipped
C:\Documents and Settings\Amanda\Local Settings\Application Data\Identities\{FBF3BD73-6D16-4727-BB34-CCA414852375}\Microsoft\Outlook Express\Inbox.dbx/[From Mail Delivery Subsystem <[removed]>][Date Mon, 19 Aug 2002 12:41:08 -0400 (EDT)]/UNNAMED/[From logs-wa.proxy.aol.com [205.188.192.14]]/UNNAMED Infected: Email-Worm.Win32.Klez.h skipped
C:\Documents and Settings\Amanda\Local Settings\Application Data\Identities\{FBF3BD73-6D16-4727-BB34-CCA414852375}\Microsoft\Outlook Express\Inbox.dbx/[From Mail Delivery Subsystem <[removed]>][Date Mon, 19 Aug 2002 12:41:08 -0400 (EDT)]/UNNAMED Infected: Email-Worm.Win32.Klez.h skipped
C:\Documents and Settings\Amanda\Local Settings\Application Data\Identities\{FBF3BD73-6D16-4727-BB34-CCA414852375}\Microsoft\Outlook Express\Inbox.dbx Mail MS Outlook 5: infected - 9, suspicious - 3 skipped
C:\Documents and Settings\Amanda\Local Settings\Application Data\Microsoft\Outlook\Outlook.pst/Personal Folders/Deleted Items/16 Sep 2002 19:07 from American Digital:Fw: Happy Assumption.rtf Suspicious: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Amanda\Local Settings\Application Data\Microsoft\Outlook\Outlook.pst/Personal Folders/Deleted Items/16 Sep 2002 19:07 from American Digital:Fw: Happy Assumption/width.bat Infected: Email-Worm.Win32.Klez.h skipped
C:\Documents and Settings\Amanda\Local Settings\Application Data\Microsoft\Outlook\Outlook.pst/Personal Folders/Deleted Items/13 Sep 2002 13:58 to [removed]:Margingbottom.rtf Suspicious: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Amanda\Local Settings\Application Data\Microsoft\Outlook\Outlook.pst/Personal Folders/Deleted Items/14 Sep 2002 14:01 to [removed]:Marginwidth.rtf Suspicious: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Amanda\Local Settings\Application Data\Microsoft\Outlook\Outlook.pst/Personal Folders/Inbox/10 Aug 2002 18:19 to [removed]:Now.getFullYear()).rtf Suspicious: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Amanda\Local Settings\Application Data\Microsoft\Outlook\Outlook.pst/Personal Folders/Inbox/12 Aug 2002 13:04 from UpgradeProgram:Happy Assumption.rtf Suspicious: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Amanda\Local Settings\Application Data\Microsoft\Outlook\Outlook.pst/Personal Folders/Inbox/12 Aug 2002 18:30 to [removed]:Telephone number.rtf Suspicious: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Amanda\Local Settings\Application Data\Microsoft\Outlook\Outlook.pst/Personal Folders/Inbox/16 Sep 2002 18:58 from ann3wells:Boundary.rtf Suspicious: Exploit.HTML.Iframe.FileDownload skipped
C:\Documents and Settings\Amanda\Local Settings\Application Data\Microsoft\Outlook\Outlook.pst Mail MS Mail: infected - 1, suspicious - 7 skipped
C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\Desktop\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\Desktop\SmitfraudFix.zip/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\Desktop\SmitfraudFix.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\Local Settings\Application Data\ApplicationHistory\hpqgalry.exe.cf8dd223.ini.inuse Object is locked skipped
C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\Local Settings\Application Data\HP\Digital Imaging\db\administrativeInfo.dbf Object is locked skipped
C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\Local Settings\Application Data\HP\Digital Imaging\db\albumImagesTable.cdx Object is locked skipped
C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\Local Settings\Application Data\HP\Digital Imaging\db\albumImagesTable.dbf Object is locked skipped
C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\Local Settings\Application Data\HP\Digital Imaging\db\albumTable.cdx Object is locked skipped
C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\Local Settings\Application Data\HP\Digital Imaging\db\albumTable.dbf Object is locked skipped
C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\Local Settings\Application Data\HP\Digital Imaging\db\CB_Server_Errors.txt Object is locked skipped
C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\Local Settings\Application Data\HP\Digital Imaging\db\EXIFTable.cdx Object is locked skipped
C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\Local Settings\Application Data\HP\Digital Imaging\db\EXIFTable.dbf Object is locked skipped
C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.cdx Object is locked skipped
C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.dbf Object is locked skipped
C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.fpt Object is locked skipped
C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\Local Settings\Application Data\HP\Digital Imaging\db\keywordImagesTable.cdx Object is locked skipped
C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\Local Settings\Application Data\HP\Digital Imaging\db\keywordImagesTable.dbf Object is locked skipped
C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\Local Settings\Application Data\HP\Digital Imaging\db\keywordTable.cdx Object is locked skipped
C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\Local Settings\Application Data\HP\Digital Imaging\db\keywordTable.dbf Object is locked skipped
C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\Local Settings\Application Data\HP\Digital Imaging\db\managedFolderTable.dbf Object is locked skipped
C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\Local Settings\Application Data\HP\Digital Imaging\db\pathnameTable.cdx Object is locked skipped
C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\Local Settings\Application Data\HP\Digital Imaging\db\pathnameTable.dbf Object is locked skipped
C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\Local Settings\Application Data\HP\Digital Imaging\db\ROFImagesTable.cdx Object is locked skipped
C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\Local Settings\Application Data\HP\Digital Imaging\db\ROFImagesTable.dbf Object is locked skipped
C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\Local Settings\Application Data\HP\Digital Imaging\db\ROFTable.cdx Object is locked skipped
C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\Local Settings\Application Data\HP\Digital Imaging\db\ROFTable.dbf Object is locked skipped
C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped
C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\Local Settings\History\History.IE5\MSHist012007112220071123\index.dat Object is locked skipped
C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\Local Settings\Temp\~DF15E6.tmp Object is locked skipped
C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\Local Settings\Temp\~DF1E3.tmp Object is locked skipped
C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\Local Settings\Temp\~DF1F6.tmp Object is locked skipped
C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\ntuser.dat Object is locked skipped
C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\NTUSER.DAT.LOG Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService.NT AUTHORITY\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService.NT AUTHORITY\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService.NT AUTHORITY\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService.NT AUTHORITY\ntuser.dat.LOG Object is locked skipped
C:\Program Files\HP\hpcoretech\hpcmerr.log Object is locked skipped
C:\System Volume Information\_restore{5228273B-B49D-4F4A-B5B2-34540937F19A}\RP3\change.log Object is locked skipped
C:\WINDOWS\CSC\00000001 Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\DigitalPersonaProEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\drivers\fidbox.dat Object is locked skipped
C:\WINDOWS\system32\drivers\fidbox.idx Object is locked skipped
C:\WINDOWS\system32\drivers\fidbox2.dat Object is locked skipped
C:\WINDOWS\system32\drivers\fidbox2.idx Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.

——————————————————————————————————

Logfile of HijackThis v1.99.1
Scan saved at 7:05:55 PM, on 11/22/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\DigitalPersona\Bin\DpHost.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\Desktop\Killer.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://indirect.nextel.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1189176782176
O16 - DPF: {B24F0664-7DDA-40B6-B38C-A4FD68DE8685} (CentraDownloaderCtl Class) - https://www.ueclassroom.sprint.com/SiteRoot…aDownloader.cab
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" -r (file missing)
O23 - Service: Biometric Authentication Service (DpHost) - Digital Persona, Inc. - C:\Program Files\DigitalPersona\Bin\DpHost.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

—————————————————————————————————————–
Post #8
A. Please DELETE the following file and folder:

C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\Desktop\SmitfraudFix<==Folder and all its content
C:\Documents and Settings\Amanda.AMERICAN-9LPHPH\Desktop\SmitfraudFix.zip<==File


B. Your logs looks clean. If you have no more malware-related problems that you are aware of, just give me the OK and we can start the final but essential cleanup procedures and recommendations.

Trevuren
Post #10
Congratulations, your logs look CLEAN

There are a few things you must do once you system is completely clean:

Time for some housekeeping
  • Click START then RUN
  • Now type Combofix /u in the runbox and click OK


    • [external image: Posted Image]

  • When shown the disclaimer, Select "2"

The above procedure will:
  • Delete the following:
    • ComboFix and its associated files and folders.
    • VundoFix backups, if present
    • The C:\Deckard folder, if present
    • The C:_OtMoveIt folder, if present
  • Reset the clock settings.
  • Hide file extensions, if required.
  • Hide System/Hidden files, if required.
  • Reset System Restore.


Here are some tips to reduce the potential for spyware infection in the future:

1. Make sure you keep your Windows OS currentby visiting Windows update
regularly to download and install any critical updates and service packs. With out these you are leaving the backdoor open.

2. I strongly recommend installing the following applications:
  • Spywareblaster <= SpywareBlaster will prevent spyware from being installed.
  • Spywareguard <= SpywareGuard offers realtime protection from spyware installation attempts.
  • How to use Ad-Aware to remove Spyware <= If you suspect that you have spyware installed on your computer, here are instructions on how to download, install and then use Ad-Aware.
  • How to use Spybot to remove Spyware <= If you suspect that you have spyware installed on your computer, here are instructions on how to download, install and then use Spybot. Similar to Ad-Aware, I strongly recommend both to catch most spyware.
To protect yourself further:
  • Spyad <= IE/Spyad places over 4000 websites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites.
  • MVPS Hosts file <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your coputer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
And also see TonyKlein's good advice
So how did I get infected in the first place?

Regards,

Trevuren
Post #11
Thank you very much for your help Trevuren. I have a couple of more closing questions: 1) What infected this computer? 2) Is there any one or combination, paid or free, of software that provides the BEST virus/malware/trojan/adware/etc., protection? 3) Are any of these suites by Kaspersky or Symantec, or ZoneAlarm good enough or do I still need all of the software recommended above in combination with these? 4) If you were to recommend a virus software, what would it be? Thanks again for your help, you have been most kind and helpful. Plusco
Post #12
1. Essentially this: http://www.ca.com/us/securityadvisor/pest/…px?id=453082734

2. No. A layered approach is currently considered a safe way to go. Good Av/Firewall/with HIPS and some call for a sandbox or virtual type of browsing. Depends a lot on what you do and where you go while surfing. Also, you must look at the platform you want to run them on as well as how much tweaking you are prepared to put up with.

3. I usually do not like suites as in the past there has always been at least one weak link in the chain. Some are improving but can I recommend one right now that outranks the others in a noteworthy manner? NO. Some excellent firewalls are still not VISTA compatible. And sandboxie (A virtual environment) is not compatible either.

4. Free or paid? Free would probably be:

[*]Antivir PersonalEdition Classic .

[*]AVG Anti-Virus Free Edition



Paid: Probably Eset's NOD32 or Kaspersky's AV
Post #13
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI