What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Help with Tojan.Virtumonde

7 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
Hi and thanks for being here…..

I have not been able to rid my OS of Tojan.Virtumonde….PC Tools and Spybot find it, remove whats resident but it always recreates itself. Its installing more badware as it runs or I have some other badware I dont even know about.

Most recently I have run:
ATF Cleaner
SpyBot 1.4
AVG Spyware 7.5
PC Tools Spyware Doctor 5.1


Prior to above I ran:
Kaspersky Online Scanner version: 5.0.98.0
SD Fix 1.5
VundoFix 6.6.2
cwshredder 2.15

Installing AVG Internet Security causes a REGISTRY_ERROR and I have to restore my OS to boot again. So I need some help disabling this thing so I can delete its remains before it recreates itself.

Thanks,Adrian






Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:03, on 2007-11-28
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\ISS\BlackICE\blackd.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Tablet.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\MICROS~2\wcescomm.exe
C:\Program Files\ISS\BlackICE\blackice.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Silicon Image\SiISATARaid\SATARaid.exe
C:\WINDOWS\system32\WTablet\TabUserW.exe
C:\Program Files\BHODemon 2\BHODemon.exe
C:\PROGRA~1\MICROS~2\rapimgr.exe
C:\Documents and Settings\aUser\Desktop\source\hijackthis\HiJackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKLM\..\Run: [SecureWeb] C:\WINDOWS\system32\67i16MN0.exe
O4 - HKLM\..\Run: [809b7573] rundll32.exe "C:\WINDOWS\system32\mscgwcrv.dll",b
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\PROGRA~1\MICROS~2\wcescomm.exe"
O4 - Startup: BHODemon 2.0.lnk = C:\Program Files\BHODemon 2\BHODemon.exe
O4 - Global Startup: BlackICE PC Protection.lnk = C:\Program Files\ISS\BlackICE\blackice.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: SATARaid.lnk = ?
O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\WTablet\TabUserW.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: BlackICE - Internet Security Systems, Inc. - C:\Program Files\ISS\BlackICE\blackd.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: IAA Event Monitor (IAANTMon) - Intel - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe

–
End of file - 6035 bytes


———————————————————
AVG Anti-Spyware - Scan Report
———————————————————

+ Created at: 22:00 2007-11-28

+ Scan result:



:mozilla.117:C:\Documents and Settings\aUser\Application Data\Mozilla\Firefox\Profiles\cpz2nt5t.default\cookies.txt -> TrackingCookie.Safer-networking : No action taken.
:mozilla.70:C:\Documents and Settings\aUser\Application Data\Mozilla\Firefox\Profiles\cpz2nt5t.default\cookies.txt -> TrackingCookie.Tacoda : No action taken.
:mozilla.76:C:\Documents and Settings\aUser\Application Data\Mozilla\Firefox\Profiles\cpz2nt5t.default\cookies.txt -> TrackingCookie.Tacoda : No action taken.


::Report end
Post #2
Hello Adrian,

Welcome to the forum, I am still seeing a marker on your log for Vundo, lets do a few things.

AVG Internet Security <– I am not looking at this on your log, I just see Symantec as your Anti Virus program.

AVG Anti Spyware <– This is fine

I do see two firewalls installed, Black Ice and Symantec, you need to uninstall one of them ( Black Ice ) as two will conflict and cause you problems.

You should never have more than One AV and One Firewall, more is overkill and will cause many problems.

Download ComboFix from Here or Here to your Desktop.
  • Double click combofix.exe and follow the prompts.
  • When finished, it shall produce a log for you. Post the Combofix log and a HiJackthis log in your next reply
Note: Do not mouseclick combofix's window while its running. That may cause it to stall



This is important , do this and post a new Hijackthis log
C:\Documents and Settings\Adrian\Desktop\source\hijackthis\HiJackThis.exe<– Right click on Hijackthis.exe ( looks like a man with a spyglass ) and rename it to Adrian.exe



Let me see the Combofix log and a new HJT log with it renamed please
Post #3 last edited
Ken,

I have been trying to switch to AVG Internet Security but receive a REGISTRY_ERROR, I thought the Symantec Anti Virus was not running. I have since uninstalled it (Symantec Anti Virus) as its out of date and I own the AVG.

So I have:
Uninstalled Symantec
Run ComboFIx
Renamed HJT executable, and run

I want to try and install AVG~IS now that it appears Symantec is uninstalled, perhaps that is why it would bomb out…?

Also many of those items in the startup are disabled. Are you able to see that from the new logs?

Thanks,Adrian




ComboFix 07-11-19.4C - Assist 2007-11-30 16:41:34.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.639 [GMT -8:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\bold.log
C:\WINDOWS\cookies.ini
C:\WINDOWS\pp.exe
C:\WINDOWS\system32\67i16MN0.exe
C:\WINDOWS\system32\awtsr.dll
C:\WINDOWS\system32\rstwa.bak1
C:\WINDOWS\system32\rstwa.bak2
C:\WINDOWS\system32\rstwa.ini
C:\WINDOWS\system32\W000t32w.dll
C:\WINDOWS\Tasks.\At1.job
C:\WINDOWS\Tasks.\At10.job
C:\WINDOWS\Tasks.\At11.job
C:\WINDOWS\Tasks.\At12.job
C:\WINDOWS\Tasks.\At14.job
C:\WINDOWS\Tasks.\At15.job
C:\WINDOWS\Tasks.\At16.job
C:\WINDOWS\Tasks.\At17.job
C:\WINDOWS\Tasks.\At18.job
C:\WINDOWS\Tasks.\At19.job
C:\WINDOWS\Tasks.\At2.job
C:\WINDOWS\Tasks.\At20.job
C:\WINDOWS\Tasks.\At21.job
C:\WINDOWS\Tasks.\At22.job
C:\WINDOWS\Tasks.\At23.job
C:\WINDOWS\Tasks.\At24.job
C:\WINDOWS\Tasks.\At3.job
C:\WINDOWS\Tasks.\At6.job
C:\WINDOWS\Tasks.\At7.job
C:\WINDOWS\Tasks.\At8.job
C:\WINDOWS\Tasks.\At9.job
C:\WINDOWS\xhelper.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
——-\LEGACY_DOMAINSERVICE
——-\DomainService
——-\nm


((((((((((((((((((((((((( Files Created from 2007-11-01 to 2007-12-01 )))))))))))))))))))))))))))))))
.

2007-11-29 19:59 800,454 —hs—- C:\WINDOWS\system32\advsangf.ini
2007-11-29 19:59 84,032 –a—— C:\WINDOWS\system32\fgnasvda.dll
2007-11-29 19:56 77,888 –a—— C:\WINDOWS\system32\firlruun.dll
2007-11-28 19:57 71,232 –a—— C:\WINDOWS\system32\sotcabfm.exe
2007-11-27 23:36 184,320 –a—— C:\WINDOWS\system32\4RRUE748.dll
2007-11-27 21:35 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-11-26 11:25 784,605 –ahs—- C:\WINDOWS\system32\iodtainy.ini
2007-11-26 11:19 80,960 –a—— C:\WINDOWS\system32\kmyuqdod.dll
2007-11-26 11:14 71,232 –a—— C:\WINDOWS\system32\crphepes.exe
2007-11-25 22:20 84,032 –a—— C:\WINDOWS\system32\bxblwerh.dll
2007-11-25 22:14 80,960 –a—— C:\WINDOWS\system32\brjxtaqm.dll
2007-11-22 01:48 d——– C:\VundoFix Backups
2007-11-21 23:38 71,232 –a—— C:\WINDOWS\system32\qfrbsgse.exe
2007-11-21 23:06 79,688 –a—— C:\WINDOWS\system32\drivers\iksyssec.sys
2007-11-21 23:06 62,280 –a—— C:\WINDOWS\system32\drivers\iksysflt.sys
2007-11-21 23:06 41,288 –a—— C:\WINDOWS\system32\drivers\ikfilesec.sys
2007-11-21 23:06 29,000 –a—— C:\WINDOWS\system32\drivers\kcom.sys
2007-11-21 23:05 626,688 –a—— C:\WINDOWS\system32\msvcr80.dll
2007-11-21 23:04 d——– C:\Documents and Settings\All Users\Application Data\Google Updater
2007-11-21 22:23 717,371 –ahs—- C:\WINDOWS\system32\mscurbto.ini
2007-11-21 22:23 84,032 –a—— C:\WINDOWS\system32\otbrucsm.dll
2007-11-21 22:18 79,936 –a—— C:\WINDOWS\system32\oalrffil.dll
2007-11-21 09:52 d——– C:\Documents and Settings\All Users\Application Data\avg7(3)
2007-11-20 11:10 36,864 –a—— C:\WINDOWS\system32\ddccdcb.dll
2007-11-06 22:24 d——– C:\Documents and Settings\All Users\Application Data\avg7(2)
2007-11-06 22:24 d——– C:\Documents and Settings\aUser\Application Data\AVG7
2007-11-06 21:16 0 –a—— C:\WINDOWS\system32\drivers\ak2k3wrf.SYS

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-01 00:37 ——— d—–w C:\Program Files\Norton AntiVirus
2007-12-01 00:37 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2007-12-01 00:35 ——— d—–w C:\Program Files\Symantec
2007-12-01 00:35 ——— d—–w C:\Documents and Settings\All Users\Application Data\Symantec
2007-11-29 08:47 ——— d—a-w C:\Documents and Settings\All Users\Application Data\TEMP
2007-11-28 00:56 ——— d—–w C:\Program Files\BHODemon 2
2007-11-27 21:14 ——— d—–w C:\Program Files\Spyware Doctor
2007-11-27 20:54 78,912 —-a-w C:\WINDOWS\system32\yxauxbny.dll
2007-11-26 19:29 71,232 —-a-w C:\WINDOWS\system32\teofblvx.exe
2007-11-26 19:25 84,032 —-a-w C:\WINDOWS\system32\yniatdoi.dll
2007-11-26 08:31 ——— d—–w C:\Program Files\WebTrend
2007-11-22 07:37 ——— d—a-w C:\Program Files\Lycos
2007-11-22 07:37 ——— d—–w C:\Documents and Settings\aUser\Application Data\Lycos
2007-11-22 07:08 ——— d—–w C:\Program Files\Common Files\Adobe
2007-11-22 07:04 ——— d—–w C:\Program Files\Google
2007-11-22 06:55 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-12 05:35 ——— d—–w C:\Documents and Settings\aUser\Application Data\AdobeUM
2007-11-07 06:24 ——— d—–w C:\Documents and Settings\All Users\Application Data\Grisoft
2007-11-03 02:26 ——— d—–w C:\Program Files\Cleaner 5 EZ
2006-10-26 04:32 195,053 —-a-w C:\Documents and Settings\aUser\bhcftp.exe
2004-06-07 07:22 55 —-a-w C:\Documents and Settings\aUser\Application Data\tvmuknwrd.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4A54500A-65FE-4F4A-B860-20EAE2F577F9}]
2007-11-20 11:10 36864 –a—— C:\WINDOWS\system32\ddccdcb.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{b0f031bf-837b-436b-995d-08626bfc59dc}]
2007-11-29 19:56 77888 –a—— C:\WINDOWS\system32\firlruun.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:56]
"H/PC Connection Agent"="C:\PROGRA~1\MICROS~2\wcescomm.exe" [2006-06-20 21:36]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe" [2003-08-18 23:00]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-03 23:56 C:\WINDOWS\system32\bthprops.cpl]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-24 02:24]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-07-01 12:07]
"809b7573"="C:\WINDOWS\system32\fgnasvda.dll" [2007-11-29 19:59]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
BlackICE PC Protection.lnk - C:\Program Files\ISS\BlackICE\blackice.exe [2003-08-12 17:02:54]
BTTray.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2003-09-15 15:53:06]
SATARaid.lnk - C:\Program Files\Silicon Image\SiISATARaid\SATARaid.exe [2003-05-15 21:27:31]
TabUserW.exe.lnk - C:\WINDOWS\system32\WTablet\TabUserW.exe [2007-09-23 20:18:36]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"= 0 (0x0)

[hklm\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{4A54500A-65FE-4F4A-B860-20EAE2F577F9}"= C:\WINDOWS\system32\ddccdcb.dll [2007-11-20 11:10 36864]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ddccdcb]
ddccdcb.dll 2007-11-20 11:10 36864 C:\WINDOWS\system32\ddccdcb.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\awtsr.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk
backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\2ZA5J7Z24P6S7H]
C:\WINDOWS\System32\PcwbliJQ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\6GeOpZl.exe]
C:\documents and settings\adrian\local settings\temp\6GeOpZl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\809b7573]
rundll32.exe C:\WINDOWS\system32\otbrucsm.dll,b

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2007-05-11 03:06 40048 –a—— C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AutoUpdater]
C:\Program Files\AutoUpdate\AutoUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BA.tmp]
C:\DOCUME~1\aUser\LOCALS~1\Temp\BA.tmp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BA.tmp.exe]
C:\DOCUME~1\aUser\LOCALS~1\Temp\BA.tmp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Bakra]
C:\WINDOWS\System32\IEHost.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Bargains]
C:\Program Files\Bargain Buddy\bin\bargains.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\bxxs5]
RunDLL32.EXE C:\WINDOWS\bxxs5.dll,DllRun

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ClockSync]
C:\PROGRA~1\CLOCKS~1\Sync.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ClrSchLoader]
C:\PROGRA~1\Lycos\IEagent\Loader.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2004-08-03 23:56 15360 –a—— C:\WINDOWS\System32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DownloadWare]
C:\Program Files\DownloadWare\dw.exe /H

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dsi]
C:\WINDOWS\System32\dp-him.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eBBgxIuG.exe]
C:\documents and settings\adrian\local settings\temp\eBBgxIuG.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hwhedyn]
C:\WINDOWS\hwhedyn.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\infamous.exe]
2004-08-03 23:56 73728 –a—— C:\Program Files\Windows Media Player\wmplayer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2006-09-25 13:54 229952 –a—— C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LimeShop]
wjview /cp:p C:\Program Files\LimeShop\System\Code Main lp: C:\Program Files\LimeShop

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lusapic]
C:\WINDOWS\System32\lusapic.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask]
2004-01-26 10:46 53248 –a—— C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray]
2002-09-11 15:35 90112 –a—— C:\Program Files\MusicMatch\MusicMatch Jukebox\mm_tray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msbb]
c:\program files\180solutions\msbb.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mswspl]
2004-08-03 23:56 73728 –a—— C:\Program Files\Windows Media Player\wmplayer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PNAgent]
2003-09-23 23:03 40960 –a—— C:\Program Files\PhatNoise Music Manager\PNAgent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\qhtrax]
C:\WINDOWS\System32\xkxxod.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SearchEnhancement]
C:\Program Files\scbar\v9\scbar.exe /H

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SecureWeb]
C:\WINDOWS\system32\67i16MN0.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\sefbzm]
C:\WINDOWS\qtjhdxffk.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\stcinstaller]
c:\installer\id53.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TB_setup]
C:\DOCUME~1\aUser\LOCALS~1\Temp\tb_setup.exe /dcheck

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TotalRecorderScheduler]
2006-12-05 20:49 114688 –a—— C:\Program Files\HighCriteria\TotalRecorder\TotRecSched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TV Media]
C:\Program Files\TV Media\Tvm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\webHancer Agent]
C:\Program Files\webHancer\Programs\whAgent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\webHancer Survey Companion]
C:\Program Files\webHancer\Programs\whSurvey.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinTools]
C:\Program Files\Common files\WinTools\WToolsA.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\x7Fj34T]
espcont.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"RapApp"=3 (0x3)
"GEARSecurity"=2 (0x2)
"RichVideo"=2 (0x2)
"RemoteRegistry"=2 (0x2)
"RDSessMgr"=3 (0x3)
"RasMan"=3 (0x3)
"RasAuto"=3 (0x3)

R0 SI3112r;Silicon Image SiI 3112 SATARaid Controller;C:\WINDOWS\system32\DRIVERS\si3112r.sys
R1 DVDVRRdr_xp;DVDVRRdr_xp;C:\WINDOWS\system32\drivers\DVDVRRdr_xp.sys
R1 lstone;Pinnacle DC1000 Overlay;C:\WINDOWS\system32\DRIVERS\LStone.sys
R1 MemAlloc;MemAlloc;C:\WINDOWS\system32\DRIVERS\MemAlloc.sys
R1 UDFReadr;UDFReadr;C:\WINDOWS\system32\drivers\UDFReadr.sys
R2 MicroGuard;MicroGuard Copy Protection;\??\C:\WINDOWS\system32\drivers\mgnt.sys
R2 V7;V7;C:\WINDOWS\system32\drivers\V7.sys
R3 PxHelper;PxHelper;\??\C:\WINDOWS\System32\drivers\PxHelper.sys
S2 KDXHFVMN;KDXHFVMN;\??\C:\WINDOWS\system32\kdxhfvmn.mvd
S3 Memctl;Memctl;\??\C:\Program Files\ABIT\FlashMenu\Memctl.sys
S3 RapDrv;RapDrv;\??\C:\WINDOWS\System32\drivers\RapDrv.sys
S3 RapFile;RapFile;\??\C:\WINDOWS\System32\drivers\RapFile.sys
S3 RapNet;RapNet;\??\C:\WINDOWS\System32\drivers\RapNet.sys
S3 TD3004F60v;TD3004F60v;C:\WINDOWS\system32\DRIVERS\TD3004F60v.sys

.
Contents of the 'Scheduled Tasks' folder
"2007-09-12 13:24:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-11-26 20:01:42 C:\WINDOWS\Tasks\At13.job"
"2007-11-26 11:00:30 C:\WINDOWS\Tasks\At4.job"
"2007-11-26 12:00:30 C:\WINDOWS\Tasks\At5.job"
"2005-05-16 06:54:11 C:\WINDOWS\Tasks\sendlog.job"
- C:\bat\sendlog.cmd
"2007-11-30 06:46:23 C:\WINDOWS\Tasks\Symantec NetDetect.job"
- C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE
.
**************************************************************************

catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-30 16:47:46
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-30 16:48:26 - machine was rebooted
.
— E O F —









Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:56:08 PM, on 11/30/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\ISS\BlackICE\blackd.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Tablet.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\MICROS~2\wcescomm.exe
C:\Program Files\ISS\BlackICE\blackice.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Silicon Image\SiISATARaid\SATARaid.exe
C:\WINDOWS\system32\WTablet\TabUserW.exe
C:\Program Files\BHODemon 2\BHODemon.exe
C:\PROGRA~1\MICROS~2\rapimgr.exe
C:\Program Files\TextPad 4\TextPad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\aUser\Desktop\source\hijackthis\scanner.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {4A54500A-65FE-4F4A-B860-20EAE2F577F9} - C:\WINDOWS\system32\ddccdcb.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll (file missing)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O2 - BHO: {cd95cfb6-2680-d599-b634-b738fb130f0b} - {b0f031bf-837b-436b-995d-08626bfc59dc} - C:\WINDOWS\system32\firlruun.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll (file missing)
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [809b7573] rundll32.exe "C:\WINDOWS\system32\fgnasvda.dll",b
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\PROGRA~1\MICROS~2\wcescomm.exe"
O4 - Startup: BHODemon 2.0.lnk = C:\Program Files\BHODemon 2\BHODemon.exe
O4 - Global Startup: BlackICE PC Protection.lnk = C:\Program Files\ISS\BlackICE\blackice.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: SATARaid.lnk = ?
O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\WTablet\TabUserW.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O20 - Winlogon Notify: ddccdcb - C:\WINDOWS\SYSTEM32\ddccdcb.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: BlackICE - Internet Security Systems, Inc. - C:\Program Files\ISS\BlackICE\blackd.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: IAA Event Monitor (IAANTMon) - Intel - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe

–
End of file - 5299 bytes
Post #4
Adrian,

You have so many bad entries on your Combofix log that it will take me a month to sort through it. You have entries for every bad piece of malware that has come along .


We need to take this a little at a time.


Please download ATF Cleaner by Atribune to your desktop.
  • This program is for XP and Windows 2000 only
  • Double-click ATF-Cleaner.exe to run the program.
  • Under Main choose: Select All
  • Click the Empty Selected button.

Your system may start up slower after running ATF Cleaner, this is expected but will be back to normal after the first or second boot up



Open HijackThis > Do a System Scan Only, close your browser and all open windows including this one, the only program or window you should have open is HijackThis, check the following entries and click on Fix Checked.

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

O2 - BHO: (no name) - {4A54500A-65FE-4F4A-B860-20EAE2F577F9} - C:\WINDOWS\system32\ddccdcb.dll
O2 - BHO: {cd95cfb6-2680-d599-b634-b738fb130f0b} - {b0f031bf-837b-436b-995d-08626bfc59dc} - C:\WINDOWS\system32\firlruun.dll

O20 - Winlogon Notify: ddccdcb - C:\WINDOWS\SYSTEM32\ddccdcb.dll



Please download SuperAntiSpyware
Install the program
  • Run SuperAntiSpyware and click: Check for updates
  • Once the update is finished, on the main screen, click: Scan your computer
  • Check: Perform Complete Scan
  • Click Next to start the scan.
Superantispyware scans the computer, and when finished, lists all the infections found.
Make sure everything found has a check next to it, and press: Next
Then, click Finish

It is possible that the program asks to reboot in order to delete some files.

Obtain the SuperAntiSpyware log as follows:
  • Click: Preferences
  • Click the Statistics/Logs tab
  • Under Scanner Logs, double-click SuperAntiSpyware Scan Log
It opens in your default text editor (such as Notepad)

Please provide the SuperAntiSpyware log in your reply, as well as a new HijackThis log.



Then do this..

Open Notepad and copy all the text inside the quote box by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad, make sure there is no space before and above File::

File::
C:\WINDOWS\Tasks\At13.job
C:\WINDOWS\Tasks\At4.job
C:\WINDOWS\Tasks\At5.job
C:\WINDOWS\SYSTEM32\ddccdcb.dll
C:\WINDOWS\system32\advsangf.ini
C:\WINDOWS\system32\fgnasvda.dll
C:\WINDOWS\system32\firlruun.dll
C:\WINDOWS\system32\sotcabfm.exe
C:\WINDOWS\system32\4RRUE748.dll
C:\WINDOWS\system32\iodtainy.ini
C:\WINDOWS\system32\kmyuqdod.dll
C:\WINDOWS\system32\crphepes.exe
C:\WINDOWS\system32\bxblwerh.dll
C:\WINDOWS\system32\brjxtaqm.dll
C:\WINDOWS\system32\mscurbto.ini
C:\WINDOWS\system32\otbrucsm.dll
C:\WINDOWS\system32\oalrffil.dll
C:\WINDOWS\system32\ddccdcb.dll
C:\WINDOWS\system32\yxauxbny.dll
C:\WINDOWS\system32\teofblvx.exe
C:\WINDOWS\system32\yniatdoi.dll
C:\WINDOWS\system32\awtsr.dll
C:\Documents and Settings\Adrian\bhcftp.exe
C:\Documents and Settings\Adrian\Application Data\tvmuknwrd.dll


Save this as CFScript to your desktop.

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

[external image: Posted Image]


This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log. There is going to be a lot more to do, you are pretty heavily infected.


I need to see….

1. Super Anti Spyware log
2. New Combofix log
3. New HJT log
Post #5 last edited
I had to chuckle when I read your responce, just my luck. Makes sense though, Ive cleaned this machine over and over since it was built a few years ago and even though the scanners came back clean in the end I always thought I had something lurking.

Anyhow, is it ok to post my log like this: http://ascc.com/whatthetech_1.txt


Thanks,Adrian
Post #6
These programs are not present on your HJT log and maybe just leftover entries, so lets get rid of them.

Do this First
Backup Your Registry with ERUNT:
  • Download erunt.zip to your Desktop from here:
    http://aumha.org/downloads/erunt.zip
  • Right-click erunt.zip, select Extract All… and follow the prompts to extract ERUNT to a new folder on your Desktop
  • Inside the new folder, double-click ERUNT.exe to start the program
  • OK all the prompts to back up your registry to the default location.
Note: to restore your registry, go to the backup folder and start ERDNT.exe

Open Notepad and copy all the text inside the quote box by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad, make sure there is no space before and above File::

File::
C:\WINDOWS\System32\PcwbliJQ.exe
C:\documents and settings\aUser\local settings\temp\6GeOpZl.exe
C:\WINDOWS\system32\otbrucsm.dll
C:\DOCUME~1\aUser\LOCALS~1\Temp\BA.tmp.exe
C:\WINDOWS\System32\IEHost.exe
C:\WINDOWS\hwhedyn.exe
C:\WINDOWS\System32\lusapic.exe
C:\WINDOWS\System32\xkxxod.exe
C:\WINDOWS\system32\67i16MN0.exe
C:\WINDOWS\qtjhdxffk.exe
C:\WINDOWS\bxxs5.dll
C:\WINDOWS\System32\dp-him.exe
C:\documents and settings\aUser\local settings\temp\eBBgxIuG.exe
C:\DOCUME~1\aUser\LOCALS~1\Temp\tb_setup.exe /dcheck
C:\installer\id53.exe
C:\Program Files\Common files\WinTools

Folder::
C:\Program Files\Bargain Buddy
C:\PROGRA~1\CLOCKS~1
C:\Program Files\scbar
C:\Program Files\DownloadWare
C:\program files\180solutions
C:\Program Files\TV Media
C:\Program Files\webHancer

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\2ZA5J7Z24P6S7H]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\6GeOpZl.exe]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\809b7573]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BA.tmp]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BA.tmp.exe]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Bakra]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Bargains]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\bxxs5]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ClockSync]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DownloadWare]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dsi]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eBBgxIuG.exe]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hwhedyn]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lusapic]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msbb]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\qhtrax]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SearchEnhancement]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SecureWeb]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\sefbzm]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\stcinstaller]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TB_setup]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TV Media]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\webHancer Agent]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\webHancer Survey Companion]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinTools]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\x7Fj34T]


Save this as CFScript to your desktop.

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

[external image: Posted Image]


This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.

Post the Combofix log and a new HJT log normally please, its easier for me to read.
Post #7
Thanks Ken,

Here you go:



ComboFix 07-11-19.4C - Assist 2007-12-01 9:27:52.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.641 [GMT -8:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\aUser\Desktop\CFscript.txt
* Created a new restore point

FILE
C:\DOCUME~1\aUser\LOCALS~1\Temp\BA.tmp.exe
C:\DOCUME~1\aUser\LOCALS~1\Temp\tb_setup.exe /dcheck
C:\documents and settings\aUser\local settings\temp\6GeOpZl.exe
C:\documents and settings\aUser\local settings\temp\eBBgxIuG.exe
C:\installer\id53.exe
C:\Program Files\Common files\WinTools
C:\WINDOWS\bxxs5.dll
C:\WINDOWS\hwhedyn.exe
C:\WINDOWS\qtjhdxffk.exe
C:\WINDOWS\system32\67i16MN0.exe
C:\WINDOWS\System32\dp-him.exe
C:\WINDOWS\System32\IEHost.exe
C:\WINDOWS\System32\lusapic.exe
C:\WINDOWS\system32\otbrucsm.dll
C:\WINDOWS\System32\PcwbliJQ.exe
C:\WINDOWS\System32\xkxxod.exe
.

((((((((((((((((((((((((( Files Created from 2007-11-01 to 2007-12-01 )))))))))))))))))))))))))))))))
.

2007-11-30 20:28 d——– C:\Program Files\SUPERAntiSpyware
2007-11-30 20:28 d——– C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2007-11-30 20:28 d——– C:\Documents and Settings\aUser\Application Data\SUPERAntiSpyware.com
2007-11-27 21:35 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-11-22 01:48 d——– C:\VundoFix Backups
2007-11-21 23:06 79,688 –a—— C:\WINDOWS\system32\drivers\iksyssec.sys
2007-11-21 23:06 62,280 –a—— C:\WINDOWS\system32\drivers\iksysflt.sys
2007-11-21 23:06 41,288 –a—— C:\WINDOWS\system32\drivers\ikfilesec.sys
2007-11-21 23:06 29,000 –a—— C:\WINDOWS\system32\drivers\kcom.sys
2007-11-21 23:05 626,688 –a—— C:\WINDOWS\system32\msvcr80.dll
2007-11-21 23:04 d——– C:\Documents and Settings\All Users\Application Data\Google Updater
2007-11-21 09:52 d——– C:\Documents and Settings\All Users\Application Data\avg7(3)
2007-11-06 22:24 d——– C:\Documents and Settings\All Users\Application Data\avg7(2)
2007-11-06 22:24 d——– C:\Documents and Settings\aUser\Application Data\AVG7
2007-11-06 21:16 0 –a—— C:\WINDOWS\system32\drivers\ak2k3wrf.SYS

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-01 04:28 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2007-12-01 00:37 ——— d—–w C:\Program Files\Norton AntiVirus
2007-12-01 00:37 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2007-12-01 00:35 ——— d—–w C:\Program Files\Symantec
2007-12-01 00:35 ——— d—–w C:\Documents and Settings\All Users\Application Data\Symantec
2007-11-29 08:47 ——— d—a-w C:\Documents and Settings\All Users\Application Data\TEMP
2007-11-28 00:56 ——— d—–w C:\Program Files\BHODemon 2
2007-11-27 21:14 ——— d—–w C:\Program Files\Spyware Doctor
2007-11-26 08:31 ——— d—–w C:\Program Files\WebTrend
2007-11-22 07:37 ——— d—a-w C:\Program Files\Lycos
2007-11-22 07:37 ——— d—–w C:\Documents and Settings\aUser\Application Data\Lycos
2007-11-22 07:08 ——— d—–w C:\Program Files\Common Files\Adobe
2007-11-22 07:04 ——— d—–w C:\Program Files\Google
2007-11-22 06:55 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-12 05:35 ——— d—–w C:\Documents and Settings\aUser\Application Data\AdobeUM
2007-11-07 06:24 ——— d—–w C:\Documents and Settings\All Users\Application Data\Grisoft
2007-11-03 02:26 ——— d—–w C:\Program Files\Cleaner 5 EZ
.

((((((((((((((((((((((((((((( snapshot@2007-11-30_16.47.56.68 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-10-20 20:02:28 163,328 —-a-w C:\WINDOWS\erdnt\12-1-2007\ERDNT.EXE
+ 2007-12-01 17:25:42 6,463,488 —-a-w C:\WINDOWS\erdnt\12-1-2007\Users\00000001\ntuser.dat
+ 2007-12-01 17:25:42 24,576 —-a-w C:\WINDOWS\erdnt\12-1-2007\Users\00000002\UsrClass.dat
+ 2007-12-01 04:28:42 34,304 —-a-r C:\WINDOWS\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF1.exe
+ 2007-12-01 04:28:42 29,696 —-a-r C:\WINDOWS\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF11.exe
- 2007-12-01 00:46:24 12,629 —-a-w C:\WINDOWS\system32\tablet.dat
+ 2007-12-01 17:08:10 12,629 —-a-w C:\WINDOWS\system32\tablet.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:56]
"H/PC Connection Agent"="C:\PROGRA~1\MICROS~2\wcescomm.exe" [2006-06-20 21:36]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-06-21 14:06]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe" [2003-08-18 23:00]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-03 23:56 C:\WINDOWS\system32\bthprops.cpl]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-24 02:24]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-12-01 02:14]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
BlackICE PC Protection.lnk - C:\Program Files\ISS\BlackICE\blackice.exe [2003-08-12 17:02:54]
BTTray.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2003-09-15 15:53:06]
SATARaid.lnk - C:\Program Files\Silicon Image\SiISATARaid\SATARaid.exe [2003-05-15 21:27:31]
TabUserW.exe.lnk - C:\WINDOWS\system32\WTablet\TabUserW.exe [2007-09-23 20:18:36]

[hklm\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk
backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2007-05-11 03:06 40048 –a—— C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AutoUpdater]
C:\Program Files\AutoUpdate\AutoUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ClrSchLoader]
C:\PROGRA~1\Lycos\IEagent\Loader.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2004-08-03 23:56 15360 –a—— C:\WINDOWS\System32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\infamous.exe]
2004-08-03 23:56 73728 –a—— C:\Program Files\Windows Media Player\wmplayer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2006-09-25 13:54 229952 –a—— C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LimeShop]
wjview /cp:p C:\Program Files\LimeShop\System\Code Main lp: C:\Program Files\LimeShop

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask]
2004-01-26 10:46 53248 –a—— C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray]
2002-09-11 15:35 90112 –a—— C:\Program Files\MusicMatch\MusicMatch Jukebox\mm_tray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mswspl]
2004-08-03 23:56 73728 –a—— C:\Program Files\Windows Media Player\wmplayer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PNAgent]
2003-09-23 23:03 40960 –a—— C:\Program Files\PhatNoise Music Manager\PNAgent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TotalRecorderScheduler]
2006-12-05 20:49 114688 –a—— C:\Program Files\HighCriteria\TotalRecorder\TotRecSched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"RapApp"=3 (0x3)
"GEARSecurity"=2 (0x2)
"RichVideo"=2 (0x2)
"RemoteRegistry"=2 (0x2)
"RDSessMgr"=3 (0x3)
"RasMan"=3 (0x3)
"RasAuto"=3 (0x3)

R0 SI3112r;Silicon Image SiI 3112 SATARaid Controller;C:\WINDOWS\system32\DRIVERS\si3112r.sys
R1 DVDVRRdr_xp;DVDVRRdr_xp;C:\WINDOWS\system32\drivers\DVDVRRdr_xp.sys
R1 lstone;Pinnacle DC1000 Overlay;C:\WINDOWS\system32\DRIVERS\LStone.sys
R1 MemAlloc;MemAlloc;C:\WINDOWS\system32\DRIVERS\MemAlloc.sys
R1 UDFReadr;UDFReadr;C:\WINDOWS\system32\drivers\UDFReadr.sys
R2 MicroGuard;MicroGuard Copy Protection;\??\C:\WINDOWS\system32\drivers\mgnt.sys
R2 V7;V7;C:\WINDOWS\system32\drivers\V7.sys
R3 PxHelper;PxHelper;\??\C:\WINDOWS\System32\drivers\PxHelper.sys
S2 KDXHFVMN;KDXHFVMN;\??\C:\WINDOWS\system32\kdxhfvmn.mvd
S3 Memctl;Memctl;\??\C:\Program Files\ABIT\FlashMenu\Memctl.sys
S3 RapDrv;RapDrv;\??\C:\WINDOWS\System32\drivers\RapDrv.sys
S3 RapFile;RapFile;\??\C:\WINDOWS\System32\drivers\RapFile.sys
S3 RapNet;RapNet;\??\C:\WINDOWS\System32\drivers\RapNet.sys
S3 TD3004F60v;TD3004F60v;C:\WINDOWS\system32\DRIVERS\TD3004F60v.sys

.
Contents of the 'Scheduled Tasks' folder
"2007-09-12 13:24:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2005-05-16 06:54:11 C:\WINDOWS\Tasks\sendlog.job"
- C:\bat\sendlog.cmd
"2007-12-01 06:46:11 C:\WINDOWS\Tasks\Symantec NetDetect.job"
- C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE
.
**************************************************************************

catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-01 09:30:39
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-01 9:31:03
C:\ComboFix2.txt … 2007-11-30 21:16
C:\ComboFix3.txt … 2007-11-30 16:48
.
— E O F —





Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:33:19 AM, on 12/1/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\ISS\BlackICE\blackd.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Tablet.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\MICROS~2\wcescomm.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\ISS\BlackICE\blackice.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Silicon Image\SiISATARaid\SATARaid.exe
C:\PROGRA~1\MICROS~2\rapimgr.exe
C:\WINDOWS\system32\WTablet\TabUserW.exe
C:\Program Files\BHODemon 2\BHODemon.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\WINDOWS\explorer.exe
C:\Documents and Settings\aUser\Desktop\source\hijackthis\scanner.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll (file missing)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll (file missing)
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\PROGRA~1\MICROS~2\wcescomm.exe"
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Startup: BHODemon 2.0.lnk = C:\Program Files\BHODemon 2\BHODemon.exe
O4 - Global Startup: BlackICE PC Protection.lnk = C:\Program Files\ISS\BlackICE\blackice.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: SATARaid.lnk = ?
O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\WTablet\TabUserW.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: BlackICE - Internet Security Systems, Inc. - C:\Program Files\ISS\BlackICE\blackd.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: IAA Event Monitor (IAANTMon) - Intel - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe

–
End of file - 5035 bytes
Post #8 last edited
:thumbup: Does Black Ice include Anti Virus , if not I can link you to some free programs ?? How is your system behaving now ??
Post #9
Defintely much better, thanks. This verision of BlackIce does not. I was hoping to run the AVG antivirus as I already own it. I would be very interested in the links. Thanks again! Adrian
Post #10
Adrian,

I am looking at AVG Anti Spyware but no Anti Virus program. Here are two free ones if you like, just install one.




Malware Complaints
Are you mad ? I mean really mad, seething mad, so mad your ready to spit, mad that you have taken your hard earned dollars to buy a computer only to have some Miscredents, Dirt Bags and Cyber Criminals install a malicious program on your computer without your knowledge or consent. You can post your complaint at the above site. If you live in the U.S.A. you can also report your grievance to your State Attorney Generals Office and the Federal Trade Commission's Bureau of Consumer Protection.


  • How did I get infected in the first place ? Read these links and find out how to prevent getting infected again.
  • Tutorial for System Restore <– Do this first to prevent yourself from being reinfected.
  • WhattheTech
  • TonyKlein CastleCops
  • Grinler BleepingComputer
  • Geeks To Go
  • Dslreports



Here are some free programs to install, these are must haves to help keep you secure. Keep in mind that you only need One Anti Virus Program and only One Firewall, more is overkill and will cause you problems.

  • Spybot Search and Destroy 1.5
    Check for Updates/ Immunize and run a Full System Scan on a regular basis.
  • Spyware Blaster It will prevent most spyware from ever being installed.
  • Spyware Guard It offers realtime protection from spyware installation attempts.
  • Win Patrol This program will warn you when any changes are being made to your system and give
    you the option to deny the change.
  • IE-Spyad
    IE-Spyad places over 4000 web sites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads
    (cookies etc) from the sites listed, although you will still be able to connect to the sites.
  • Firefox 2.0 It has more features and is a lot more secure than IE. It is a very easy and
    painless download and install, it will no way interfere with IE, you can use them both.
  • Zone Alarm Here is a free Firewall from Zone Labs, I
    wouldn't access the internet without it.


Glad we could help

Safe Surfn
Ken
Post #11
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI