Spyware / Malware / Virus Removal

[Resolved] Baseline HijackThis, AVG scan, as sticky instructed.

9 min read

Looking for the outcome? Ask AI

tapher Topic Starter

Post #1November 29, 2007, 9:04 PM UTC last edited December 13, 2007, 11:39 AM UTC

http://forums.whatthetech.com/Before_Posti…elp_t57813.html

As per the above sticky instructions for a Win2000 os computer, here's my HJT log, followed by my AVG scan.

Logfile of HijackThis v1.99.1
Scan saved at 2:56:14 PM, on 11/29/2007
Platform: Windows 2000 SP4 (WinNT

5.00.2195)
MSIE: Internet Explorer v6.00 SP1

(6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Altiris\AClient\AClient.exe
C:\WINNT\System32\Ati2evxx.exe
C:\Program Files\Grisoft\AVG Anti-Spyware

7.5\guard.exe
C:\Program

Files\Yahoo!\Antivirus\ISafe.exe
C:\WINNT\System32\cisvc.exe
C:\Program Files\Compaq\Compaq Management

Agents\cpqalert.exe
C:\WINNT\Cpqdiag\Cpqdfwag.exe
C:\PROGRA~1\Compaq\COMPAQ~1\CPQWEB~1\WebD

mi.exe
C:\WINNT\system32\drivers\KodakCCS.exe
C:\Program Files\Kodak EasyShare

software\bin\ptssvc.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\Program

Files\Yahoo!\Antivirus\VetMsg.exe
C:\Program Files\Compaq\Compaq Management

Agents\Dmi\Win32\bin\Win32sl.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\PROGRA~1\Compaq\COMPAQ~1\cpqdmi.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\atiptaxx.exe
C:\WINNT\system32\mobsync.exe
C:\Program

Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program

Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Compaq\EAB\EabServr.exe
C:\PROGRA~1\Compaq\COMPAQ~1\CHKADMIN.EXE
C:\Program Files\SBC Yahoo!\Connection

Manager\IP InSight\IPMon32.exe
C:\Program

Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program

Files\Yahoo!\Antivirus\CAVTray.exe
C:\Program

Files\Yahoo!\Antivirus\CAVRID.exe
C:\Program Files\Common

Files\InstallShield\UpdateService\issch.e

xe
C:\Program Files\Linksys\Wireless-G

Notebook Adapter\OdHost.exe
C:\Program Files\Linksys\Wireless-G

Notebook Adapter\WPC54Cfg.exe
C:\Program Files\Internet

Explorer\IEXPLORE.EXE
C:\Documents and

Settings\Administrator\Desktop\spyware

tools\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet

Explorer\Main,Start Page =

http://softwarereferral.com/jump.php?wmid

=6010&mid=MjI6Ojg5&lid=2
R1 - HKLM\Software\Microsoft\Internet

Explorer\Main,Default_Page_URL =

http://yahoo.sbc.com/dsl
R0 - HKLM\Software\Microsoft\Internet

Explorer\Main,Start Page =

http://yahoo.sbc.com/dsl
O2 - BHO: (no name) -

{53707962-6F74-2D53-2644-206D7942484F} -

C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio -

{8E718888-423F-11D2-876E-00A0C9082467} -

C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization

Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [ATIModeChange]

Ati2mdxx.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program

Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program

Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [eabconfg.cpl]

C:\Program Files\Compaq\EAB\EabServr.exe

/Start
O4 - HKLM\..\Run: [Cpqset]

c:\compaq\cpqsetup\cpqset.exe
O4 - HKLM\..\Run: [ChkAdmin]

C:\PROGRA~1\Compaq\COMPAQ~1\CHKADMIN.EXE
O4 - HKLM\..\Run: [IPInSightMonitor 01]

"C:\Program Files\SBC Yahoo!\Connection

Manager\IP InSight\IPMon32.exe"
O4 - HKLM\..\Run: [sman]

C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\app2.t

mp
O4 - HKLM\..\Run: [SunJavaUpdateSched]

"C:\Program

Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [CaAvTray] "C:\Program

Files\Yahoo!\Antivirus\CAVTray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program

Files\Yahoo!\Antivirus\CAVRID.exe"
O4 - HKLM\..\Run: [YOP]

C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart
O4 - HKLM\..\Run: [ISUSPM Startup]

"C:\Program Files\Common

Files\InstallShield\UpdateService\ISUSPM.

exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler]

"C:\Program Files\Common

Files\InstallShield\UpdateService\issch.e

xe" -start
O4 - HKLM\..\Run: [!AVG Anti-Spyware]

"C:\Program Files\Grisoft\AVG

Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\RunServices: [CPQDFWAG]

C:\WINNT\Cpqdiag\CpqDfwAg.exe
O4 - HKCU\..\Run: [Yahoo! Pager]

"C:\Program

Files\Yahoo!\Messenger\YahooMessenger.exe

" -quiet
O4 - Global Startup: Microsoft Office.lnk

= C:\Program Files\Microsoft

Office\Office\OSA9.EXE
O4 - Global Startup: Wireless-G Notebook

Adapter Utility.lnk = C:\Program

Files\Linksys\Wireless-G Notebook

Adapter\Startup.exe
O12 - Plugin for .spop: C:\Program

Files\Internet

Explorer\Plugins\NPDocBox.dll
O16 - DPF:

{24D1BDCE-D835-11D6-BF84-0050047EA0E7}

(BlueStream_Flash Class) -

http://www.rovion.com/Controls/Rovion.cab
O16 - DPF:

{4C39376E-FA9D-4349-BACC-D305C1750EF3}

(EPUImageControl Class) -

http://tools.ebayimg.com/eps/wl/activex/e

Bay_Enhanced_Picture_Control_v1-0-3-48.ca

b
O16 - DPF:

{E504EE6E-47C6-11D5-B8AB-00D0B78F3D48}

(Yahoo! Webcam Viewer Wrapper) -

http://chat.yahoo.com/cab/yvwrctl.cab
O18 - Filter: text/html - (no CLSID) -

(no file)
O21 - SSODL: pmkret -

{716F5439-E52F-4623-9B89-0FE9ED672A65} -

C:\WINNT\pmkret.dll
O21 - SSODL: gormet -

{4A3324F7-8165-40E3-964F-BC4A0FCFCECB} -

C:\WINNT\gormet.dll
O23 - Service: Altiris Client Service

(AClient) - Altiris, Inc. -

C:\Altiris\AClient\AClient.exe
O23 - Service: Ati HotKey Poller -

Unknown owner -

C:\WINNT\System32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard -

GRISOFT s.r.o. - C:\Program

Files\Grisoft\AVG Anti-Spyware

7.5\guard.exe
O23 - Service: CAISafe - Computer

Associates International, Inc. -

C:\Program

Files\Yahoo!\Antivirus\ISafe.exe
O23 - Service: Compaq Local Alerter

(CPQALERT) - Compaq Computer Corporation

- C:\Program Files\Compaq\Compaq

Management Agents\cpqalert.exe
O23 - Service: Compaq Remote Diagnostics

Enabling Agent (CpqDfwWebAgent) - Compaq

Computer Corporation -

C:\WINNT\Cpqdiag\Cpqdfwag.exe
O23 - Service: cpqdmi - Compaq Computer

Corporation -

C:\PROGRA~1\Compaq\COMPAQ~1\cpqdmi.exe
O23 - Service: Compaq DMI Web Agent

(cpqWebDmi) - Compaq Computer Corporation

-

C:\PROGRA~1\Compaq\COMPAQ~1\CPQWEB~1\WebD

mi.exe
O23 - Service: Logical Disk Manager

Administrative Service (dmadmin) -

VERITAS Software Corp. -

C:\WINNT\System32\dmadmin.exe
O23 - Service: InstallDriver Table

Manager (IDriverT) - Macrovision

Corporation - C:\Program Files\Common

Files\InstallShield\Driver\11\Intel

32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc.

- C:\Program

Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection

Software (KodakCCS) - Eastman Kodak

Company -

C:\WINNT\system32\drivers\KodakCCS.exe
O23 - Service: NICSer_WPC54G - Unknown

owner - C:\Program

Files\Linksys\Wireless-G Notebook

Adapter\NICServ.exe
O23 - Service: ptssvc - KODAK -

C:\Program Files\Kodak EasyShare

software\bin\ptssvc.exe
O23 - Service: M-Audio Uno Installer

(UnoInstallerService) - Unknown owner -

C:\Program Files\M-Audio Uno\UnoInst.exe

(file missing)
O23 - Service: VET Message Service

(VETMSGNT) - Computer Associates

International, Inc. - C:\Program

Files\Yahoo!\Antivirus\VetMsg.exe
O23 - Service: Vongo Service - Unknown

owner - C:\Program

Files\Vongo\VongoService.exe (file

missing)
O23 - Service: Win32Sl (WIN32SL) - Intel

- C:\Program Files\Compaq\Compaq

Management

Agents\Dmi\Win32\bin\Win32sl.exe

——————————————————————————————————————————
———————————————————
AVG Anti-Spyware - Scan Report
———————————————————

+ Created at: 2:10:49 PM 11/29/2007

+ Scan result:

HKLM\SOFTWARE\Classes\CLSID\{24A66A2E-5AFE-E8EF-B293-C15F0CC19B46} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\CLSID\{4BD47B76-6228-8A54-BD88-41CA4875AF2D} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\CLSID\{C3678D25-D9D6-5E2A-DB00-F69BB636E16E} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\CLSID\{CB818168-3BCD-9A9D-913D-5395B818A142} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
HKU\S-1-5-21-1041172583-422271539-310789939-500\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{804DB5C7-31E6-4885-850A-F1941B58A4C7} -> Adware.Generic : Cleaned with backup (quarantined).
C:\WINNT\NDNuninstall4_88.exe -> Adware.NewDotNet : Cleaned with backup (quarantined).
C:\WINNT\NDNuninstall4_94.exe -> Adware.NewDotNet : Cleaned with backup (quarantined).
C:\WINNT\NDNuninstall5_40.exe -> Adware.NewDotNet : Cleaned with backup (quarantined).
C:\WINNT\NDNuninstall5_48.exe -> Adware.NewDotNet : Cleaned with backup (quarantined).
C:\WINNT\NDNuninstall5_64.exe -> Adware.NewDotNet : Cleaned with backup (quarantined).
C:\WINNT\SYSTEM32\btest4.scr -> Downloader.Agent.a : Cleaned with backup (quarantined).
C:\WINNT\$NtServicePackUninstall$\explorer.exe:izgmb -> Downloader.WinShow.ak : Cleaned with backup (quarantined).
C:\WINNT\FeatherTexture.bmp:nvtcf -> Downloader.WinShow.ak : Cleaned with backup (quarantined).
C:\WINNT\Greenstone.bmp:qgmkd -> Downloader.WinShow.ak : Cleaned with backup (quarantined).
C:\WINNT\WELCOME.INI:offut -> Downloader.WinShow.ak : Cleaned with backup (quarantined).
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq6E.tmp -> TrackingCookie.247realmedia : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqB.tmp -> TrackingCookie.247realmedia : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq153.tmp -> TrackingCookie.2o7 : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq154.tmp -> TrackingCookie.2o7 : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq182.tmp -> TrackingCookie.2o7 : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq183.tmp -> TrackingCookie.2o7 : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq18D.tmp -> TrackingCookie.2o7 : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq19B.tmp -> TrackingCookie.2o7 : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq27.tmp -> TrackingCookie.2o7 : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq42.tmp -> TrackingCookie.2o7 : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq56.tmp -> TrackingCookie.2o7 : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq58.tmp -> TrackingCookie.2o7 : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq5A.tmp -> TrackingCookie.2o7 : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq5C.tmp -> TrackingCookie.2o7 : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq6F.tmp -> TrackingCookie.2o7 : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqFD.tmp -> TrackingCookie.2o7 : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqFE.tmp -> TrackingCookie.2o7 : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq155.tmp -> TrackingCookie.Adbrite : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq60.tmp -> TrackingCookie.Adbrite : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq102.tmp -> TrackingCookie.Addynamix : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq62.tmp -> TrackingCookie.Addynamix : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq107.tmp -> TrackingCookie.Adrevolver : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq17A.tmp -> TrackingCookie.Adrevolver : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq19C.tmp -> TrackingCookie.Adrevolver : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq68.tmp -> TrackingCookie.Adrevolver : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq98.tmp -> TrackingCookie.Adserver : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq2.tmp -> TrackingCookie.Adtech : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq3.tmp -> TrackingCookie.Advertising : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq46.tmp -> TrackingCookie.Advertising : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq9B.tmp -> TrackingCookie.Adviva : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq47.tmp -> TrackingCookie.Atdmt : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq73.tmp -> TrackingCookie.Bfast : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqA1.tmp -> TrackingCookie.Bfast : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq159.tmp -> TrackingCookie.Bluestreak : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqA2.tmp -> TrackingCookie.Bluestreak : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq77.tmp -> TrackingCookie.Bridgetrack : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq10C.tmp -> TrackingCookie.Burstbeacon : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqA3.tmp -> TrackingCookie.Burstbeacon : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq10D.tmp -> TrackingCookie.Burstnet : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq76.tmp -> TrackingCookie.Burstnet : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqA4.tmp -> TrackingCookie.Burstnet : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq15B.tmp -> TrackingCookie.Casalemedia : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq48.tmp -> TrackingCookie.Casalemedia : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqA7.tmp -> TrackingCookie.Clickhype : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq110.tmp -> TrackingCookie.Clickzs : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq111.tmp -> TrackingCookie.Clickzs : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq17C.tmp -> TrackingCookie.Clickzs : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqA8.tmp -> TrackingCookie.Clickzs : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqAC.tmp -> TrackingCookie.Clickzs : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq79.tmp -> TrackingCookie.Commission-junction : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqAA.tmp -> TrackingCookie.Coremetrics : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqAD.tmp -> TrackingCookie.Coremetrics : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq115.tmp -> TrackingCookie.Cpvfeed : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq118.tmp -> TrackingCookie.Dealtime : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq119.tmp -> TrackingCookie.Dealtime : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqAE.tmp -> TrackingCookie.Dealtime : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqB0.tmp -> TrackingCookie.Doubleclick : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqB4.tmp -> TrackingCookie.Enhance : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq19F.tmp -> TrackingCookie.Euroclick : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqB6.tmp -> TrackingCookie.Euroclick : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq15F.tmp -> TrackingCookie.Falkag : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq9D.tmp -> TrackingCookie.Falkag : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqB7.tmp -> TrackingCookie.Falkag : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq160.tmp -> TrackingCookie.Fastclick : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4B.tmp -> TrackingCookie.Fastclick : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqB9.tmp -> TrackingCookie.Fortunecity : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqBB.tmp -> TrackingCookie.Goclick : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq162.tmp -> TrackingCookie.Hitbox : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq190.tmp -> TrackingCookie.Hitbox : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4.tmp -> TrackingCookie.Hitbox : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq5.tmp -> TrackingCookie.Hitbox : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq7B.tmp -> TrackingCookie.Hitbox : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq7C.tmp -> TrackingCookie.Hitbox : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq7D.tmp -> TrackingCookie.Hitbox : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq7E.tmp -> TrackingCookie.Hitbox : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq7F.tmp -> TrackingCookie.Hitbox : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq80.tmp -> TrackingCookie.Hitbox : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq81.tmp -> TrackingCookie.Hitbox : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqB1.tmp -> TrackingCookie.Hitbox : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqB2.tmp -> TrackingCookie.Hitbox : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqB3.tmp -> TrackingCookie.Hitbox : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqBD.tmp -> TrackingCookie.Hitbox : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqBE.tmp -> TrackingCookie.Hitbox : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqBF.tmp -> TrackingCookie.Hitbox : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqC0.tmp -> TrackingCookie.Hitbox : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqC1.tmp -> TrackingCookie.Hitbox : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq120.tmp -> TrackingCookie.Hitslink : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq121.tmp -> TrackingCookie.Hitslink : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq122.tmp -> TrackingCookie.Hotlog : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq82.tmp -> TrackingCookie.Hypertracker : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq124.tmp -> TrackingCookie.Information : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqC2.tmp -> TrackingCookie.Information : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqC4.tmp -> TrackingCookie.Intelli-direct : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq129.tmp -> TrackingCookie.Liveperson : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqCA.tmp -> TrackingCookie.Liveperson : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqCE.tmp -> TrackingCookie.Masterstats : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4C.tmp -> TrackingCookie.Mediaplex : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq6.tmp -> TrackingCookie.Mediaplex : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq1A2.tmp -> TrackingCookie.Netflame : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq146.tmp -> TrackingCookie.Onestat : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq85.tmp -> TrackingCookie.Paycounter : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq135.tmp -> TrackingCookie.Pointroll : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq86.tmp -> TrackingCookie.Pointroll : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqAB.tmp -> TrackingCookie.Pro-market : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq87.tmp -> TrackingCookie.Qksrv : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq88.tmp -> TrackingCookie.Questionmarket : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqD6.tmp -> TrackingCookie.Questionmarket : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4E.tmp -> TrackingCookie.Realmedia : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq89.tmp -> TrackingCookie.Realmedia : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq8A.tmp -> TrackingCookie.Realtracker : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq8B.tmp -> TrackingCookie.Revenue : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqD8.tmp -> TrackingCookie.Revenue : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq13C.tmp -> TrackingCookie.Revsci : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqD9.tmp -> TrackingCookie.Revsci : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4A.tmp -> TrackingCookie.Ru4 : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq7A.tmp -> TrackingCookie.Ru4 : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq15A.tmp -> TrackingCookie.Serving-sys : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq16D.tmp -> TrackingCookie.Serving-sys : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq75.tmp -> TrackingCookie.Serving-sys : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq8C.tmp -> TrackingCookie.Serving-sys : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqDC.tmp -> TrackingCookie.Sexcounter : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq8D.tmp -> TrackingCookie.Sexlist : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqDD.tmp -> TrackingCookie.Sexlist : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq13D.tmp -> TrackingCookie.Sextracker : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq13E.tmp -> TrackingCookie.Sextracker : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq13F.tmp -> TrackingCookie.Sextracker : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq140.tmp -> TrackingCookie.Sextracker : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq141.tmp -> TrackingCookie.Sextracker : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq16E.tmp -> TrackingCookie.Sextracker : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq1A4.tmp -> TrackingCookie.Sextracker : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq8E.tmp -> TrackingCookie.Sextracker : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq8F.tmp -> TrackingCookie.Sextracker : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq90.tmp -> TrackingCookie.Sextracker : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqDE.tmp -> TrackingCookie.Sextracker : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqDF.tmp -> TrackingCookie.Sextracker : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqE0.tmp -> TrackingCookie.Sextracker : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqE1.tmp -> TrackingCookie.Sextracker : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqE2.tmp -> TrackingCookie.Sextracker : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqE3.tmp -> TrackingCookie.Sextracker : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqE4.tmp -> TrackingCookie.Sextracker : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqE5.tmp -> TrackingCookie.Sextracker : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq145.tmp -> TrackingCookie.Spylog : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq176.tmp -> TrackingCookie.Statcounter : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq91.tmp -> TrackingCookie.Statcounter : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq14A.tmp -> TrackingCookie.Tacoda : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq177.tmp -> TrackingCookie.Tacoda : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq4F.tmp -> TrackingCookie.Tacoda : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqE7.tmp -> TrackingCookie.Tacoda : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqE8.tmp -> TrackingCookie.Tacoda : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq92.tmp -> TrackingCookie.Tradedoubler : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqEC.tmp -> TrackingCookie.Tradedoubler : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq93.tmp -> TrackingCookie.Trafficmp : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqEE.tmp -> TrackingCookie.Trafficmp : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq50.tmp -> TrackingCookie.Tribalfusion : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq7.tmp -> TrackingCookie.Tribalfusion : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq95.tmp -> TrackingCookie.Valueclick : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq14F.tmp -> TrackingCookie.Web-stat : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqF4.tmp -> TrackingCookie.Web-stat : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq171.tmp -> TrackingCookie.Weborama : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq17F.tmp -> TrackingCookie.Weborama : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqF5.tmp -> TrackingCookie.Webtrends : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq8.tmp -> TrackingCookie.Webtrendslive : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq96.tmp -> TrackingCookie.Webtrendslive : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq151.tmp -> TrackingCookie.Xxxcounter : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqFA.tmp -> TrackingCookie.Xxxcounter : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq97.tmp -> TrackingCookie.Xxxtoolbar : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq43.tmp -> TrackingCookie.Yieldmanager : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqFF.tmp -> TrackingCookie.Yieldmanager : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq9.tmp -> TrackingCookie.Zedo : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq99.tmp -> TrackingCookie.Zedo : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqFC.tmp -> TrackingCookie.Zedo : Cleaned.
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq52.tmp -> Trojan.Dialer.bh : Cleaned with backup (quarantined).
C:\WINNT\Downloaded Program Files\CONFLICT.1\on-line.exe -> Trojan.Dialer.bh : Cleaned with backup (quarantined).
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq11.tmp\mpp2pl.exe -> Trojan.MediaPipe.a : Cleaned with backup (quarantined).

::Report end

Thanks for any help, ye experts!

Scotty

Post #2December 2, 2007, 12:16 PM UTC

Hi! Welcome to the WTT forums.
My name is Scotty. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research.
Please be patient.

You have word wrap turned on, this is making your logs difficult to read
Run notepad
Goto Format and untick Word Wrap and post a new HijackThis log.

Please make a uninstall list using HijackThis
To access the Uninstall Manager you would do the following:

1. Start HijackThis
2. Click on the Config button
3. Click on the Misc Tools button
4. Click on the Open Uninstall Manager button.
5. Click on the Save list… button and specify where you would like to save this file. When you press Save button a notepad will open with the contents of that file. Simply copy and paste the contents of that notepad here in a reply.

tapher

Post #3December 3, 2007, 10:48 AM UTC

Thanks for the response; I bow to you!

In perusing many pages here, I see that the "Word Wrap" issue with notepad is common. Why not amend the sticky section's directions to include this step? Just a suggestion that might be helpful.

Below I've followed your instructions to the best of my abilities.

Symptoms of system problems were TrustedAntivirus, Worm.Win32.NetSky, xpantivirus, safenavweb, ucleaner, pcsecuresystem, softwarereferral… pop ups indicating these problems, or directing me to websites with these names. Generally, overall system functionality is very slow and processor resources often running at 100% capacity, according to Task Manager.

I've run only free versions of Ad-Aware SE, Spybot S&D, AVG anti-spyware, and the CA utilities included in sbc/yahoo dsl. When the problem is fixed, I would like to remove every frivolous program that might be bogging down the computer's resources.

Thanks for your help!

Logfile of HijackThis v1.99.1
Scan saved at 2:42:23 PM, on 11/29/2007
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Altiris\AClient\AClient.exe
C:\WINNT\System32\Ati2evxx.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Yahoo!\Antivirus\ISafe.exe
C:\WINNT\System32\cisvc.exe
C:\Program Files\Compaq\Compaq Management Agents\cpqalert.exe
C:\WINNT\Cpqdiag\Cpqdfwag.exe
C:\PROGRA~1\Compaq\COMPAQ~1\CPQWEB~1\WebDmi.exe
C:\WINNT\system32\drivers\KodakCCS.exe
C:\Program Files\Kodak EasyShare software\bin\ptssvc.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
C:\Program Files\Compaq\Compaq Management Agents\Dmi\Win32\bin\Win32sl.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\PROGRA~1\Compaq\COMPAQ~1\cpqdmi.exe
C:\WINNT\system32\atiptaxx.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Compaq\EAB\EabServr.exe
C:\PROGRA~1\Compaq\COMPAQ~1\CHKADMIN.EXE
C:\Program Files\SBC Yahoo!\Connection Manager\IP InSight\IPMon32.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Yahoo!\Antivirus\CAVTray.exe
C:\Program Files\Yahoo!\Antivirus\CAVRID.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\OdHost.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\WPC54Cfg.exe
C:\Documents and Settings\Administrator\Desktop\spyware tools\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=…6Ojg5&lid=2
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://yahoo.sbc.com/dsl
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\Compaq\EAB\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] c:\compaq\cpqsetup\cpqset.exe
O4 - HKLM\..\Run: [ChkAdmin] C:\PROGRA~1\Compaq\COMPAQ~1\CHKADMIN.EXE
O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\SBC Yahoo!\Connection Manager\IP InSight\IPMon32.exe"
O4 - HKLM\..\Run: [sman] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\app2.tmp
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\Yahoo!\Antivirus\CAVTray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\Yahoo!\Antivirus\CAVRID.exe"
O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\RunServices: [CPQDFWAG] C:\WINNT\Cpqdiag\CpqDfwAg.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Wireless-G Notebook Adapter Utility.lnk = C:\Program Files\Linksys\Wireless-G Notebook Adapter\Startup.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {24D1BDCE-D835-11D6-BF84-0050047EA0E7} (BlueStream_Flash Class) - http://www.rovion.com/Controls/Rovion.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eB…l_v1-0-3-48.cab
O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer Wrapper) - http://chat.yahoo.com/cab/yvwrctl.cab
O18 - Filter: text/html - (no CLSID) - (no file)
O21 - SSODL: pmkret - {716F5439-E52F-4623-9B89-0FE9ED672A65} - C:\WINNT\pmkret.dll
O21 - SSODL: gormet - {4A3324F7-8165-40E3-964F-BC4A0FCFCECB} - C:\WINNT\gormet.dll
O23 - Service: Altiris Client Service (AClient) - Altiris, Inc. - C:\Altiris\AClient\AClient.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\ISafe.exe
O23 - Service: Compaq Local Alerter (CPQALERT) - Compaq Computer Corporation - C:\Program Files\Compaq\Compaq Management Agents\cpqalert.exe
O23 - Service: Compaq Remote Diagnostics Enabling Agent (CpqDfwWebAgent) - Compaq Computer Corporation - C:\WINNT\Cpqdiag\Cpqdfwag.exe
O23 - Service: cpqdmi - Compaq Computer Corporation - C:\PROGRA~1\Compaq\COMPAQ~1\cpqdmi.exe
O23 - Service: Compaq DMI Web Agent (cpqWebDmi) - Compaq Computer Corporation - C:\PROGRA~1\Compaq\COMPAQ~1\CPQWEB~1\WebDmi.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINNT\system32\drivers\KodakCCS.exe
O23 - Service: NICSer_WPC54G - Unknown owner - C:\Program Files\Linksys\Wireless-G Notebook Adapter\NICServ.exe
O23 - Service: ptssvc - KODAK - C:\Program Files\Kodak EasyShare software\bin\ptssvc.exe
O23 - Service: M-Audio Uno Installer (UnoInstallerService) - Unknown owner - C:\Program Files\M-Audio Uno\UnoInst.exe (file missing)
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
O23 - Service: Vongo Service - Unknown owner - C:\Program Files\Vongo\VongoService.exe (file missing)
O23 - Service: Win32Sl (WIN32SL) - Intel - C:\Program Files\Compaq\Compaq Management Agents\Dmi\Win32\bin\Win32sl.exe

——————————————————————————————————————-
Uninstall list is below.

2Wire Wireless Client
Ad-Aware SE Personal
Adobe Acrobat 5.0
Adobe Flash Player 9 ActiveX
Adobe Reader 7.0.9
Adobe Shockwave Player
Apple Software Update
ATI Display Driver
AVG Anti-Spyware 7.5
CCHelp
CCScore
Compaq Diagnostics for Windows
Compaq Easy Access Buttons 3.00 B3
Compaq Management Agents
Compaq Remote Diagnostics Enabling Agent
Compaq Remote Services
DivX
DivX Player
ESSAdpt
ESSANUP
ESSBrwr
ESSCAM
ESSCDBK
ESScore
ESSCT
ESSgui
ESShelp
ESSini
ESSPCD
ESSSONIC
ESSTUTOR
ESSvpaht
ESSvpot
FreeZip
HijackThis 1.99.1
HLPCCTR
HLPIndex
HLPRFO
Hotfix for MDAC 2.53 (KB911562)
Hotfix for MDAC 2.53 (KB927779)
Intel® PRO Ethernet Adapter and Software
InterActual Player
Internet Explorer Q903235
iTunes
J2SE Runtime Environment 5.0 Update 10
J2SE Runtime Environment 5.0 Update 11
J2SE Runtime Environment 5.0 Update 6
J2SE Runtime Environment 5.0 Update 9
Java 2 Runtime Environment, SE v1.4.2_09
Java™ 6 Update 2
Java™ 6 Update 3
Java™ SE Runtime Environment 6 Update 1
Kodak EasyShare software
KSU
Logic VS
MGI PhotoSuite 8.1 (Remove Only)
Microsoft Office 2000 SR-1 Professional
MSXML 4.0 SP2 (KB936181)
Notifier
Odyssey Client
OTtBP
OTtBPSDK
Panda ActiveScan
PCDLNCH
QuickTime
SBC Yahoo! Applications
SBC Yahoo! DSL Home Networking Installer
Security Update for Windows 2000 (KB904706)
Security Update for Windows 2000 (KB923689)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB917734)
Security Update for Windows Media Player 9 (KB936782)
Setup Compaq Software
SFR
SFR2
SoundMAX
Spybot - Search & Destroy 1.4
Synaptics Pointing Device Driver
Turbo Lister 2
Uno
Update Rollup 1 for Windows 2000 SP4
VCAMCEN
VPRINTOL
Widcomm Bluetooth Software [removed]
Windows 2000 Hotfix - KB842773
Windows 2000 Hotfix - KB883939
Windows 2000 Hotfix - KB890046
Windows 2000 Hotfix - KB890923
Windows 2000 Hotfix - KB893756
Windows 2000 Hotfix - KB894320
Windows 2000 Hotfix - KB896358
Windows 2000 Hotfix - KB896422
Windows 2000 Hotfix - KB896423
Windows 2000 Hotfix - KB896424
Windows 2000 Hotfix - KB896688
Windows 2000 Hotfix - KB896727
Windows 2000 Hotfix - KB897715
Windows 2000 Hotfix - KB899587
Windows 2000 Hotfix - KB899588
Windows 2000 Hotfix - KB899589
Windows 2000 Hotfix - KB900725
Windows 2000 Hotfix - KB901017
Windows 2000 Hotfix - KB901214
Windows 2000 Hotfix - KB902400
Windows 2000 Hotfix - KB905414
Windows 2000 Hotfix - KB905495
Windows 2000 Hotfix - KB905749
Windows 2000 Hotfix - KB905915
Windows 2000 Hotfix - KB908519
Windows 2000 Hotfix - KB908523
Windows 2000 Hotfix - KB908531
Windows 2000 Hotfix - KB911280
Windows 2000 Hotfix - KB911567
Windows 2000 Hotfix - KB912812
Windows 2000 Hotfix - KB912919
Windows 2000 Hotfix - KB913580
Windows 2000 Hotfix - KB914388
Windows 2000 Hotfix - KB914389
Windows 2000 Hotfix - KB916281
Windows 2000 Hotfix - KB917008
Windows 2000 Hotfix - KB917159
Windows 2000 Hotfix - KB917422
Windows 2000 Hotfix - KB917537
Windows 2000 Hotfix - KB917736
Windows 2000 Hotfix - KB917953
Windows 2000 Hotfix - KB918118
Windows 2000 Hotfix - KB918899
Windows 2000 Hotfix - KB920213
Windows 2000 Hotfix - KB920670
Windows 2000 Hotfix - KB920683
Windows 2000 Hotfix - KB920685
Windows 2000 Hotfix - KB920958
Windows 2000 Hotfix - KB921398
Windows 2000 Hotfix - KB921503
Windows 2000 Hotfix - KB921883
Windows 2000 Hotfix - KB922582
Windows 2000 Hotfix - KB922616
Windows 2000 Hotfix - KB922760
Windows 2000 Hotfix - KB923191
Windows 2000 Hotfix - KB923414
Windows 2000 Hotfix - KB923694
Windows 2000 Hotfix - KB923810
Windows 2000 Hotfix - KB923980
Windows 2000 Hotfix - KB924191
Windows 2000 Hotfix - KB924270
Windows 2000 Hotfix - KB924667
Windows 2000 Hotfix - KB925454
Windows 2000 Hotfix - KB925486
Windows 2000 Hotfix - KB925902
Windows 2000 Hotfix - KB926122
Windows 2000 Hotfix - KB926436
Windows 2000 Hotfix - KB927891
Windows 2000 Hotfix - KB928090
Windows 2000 Hotfix - KB928843
Windows 2000 Hotfix - KB929969
Windows 2000 Hotfix - KB930178
Windows 2000 Hotfix - KB931768
Windows 2000 Hotfix - KB931784
Windows 2000 Hotfix - KB932168
Windows 2000 Hotfix - KB933566
Windows 2000 Hotfix - KB933729
Windows 2000 Hotfix - KB935839
Windows 2000 Hotfix - KB935840
Windows 2000 Hotfix - KB936021
Windows 2000 Hotfix - KB937143
Windows 2000 Hotfix - KB938127
Windows 2000 Hotfix - KB938827
Windows 2000 Hotfix - KB938829
Windows 2000 Hotfix - KB939653
Windows 2000 Hotfix - KB941202
Windows 2000 Service Pack 4
Windows Genuine Advantage v1.3.0254.0
Windows Installer 3.1 (KB893803)
Windows Installer 3.1 (KB893803)
Windows Media Player Hotfix [See Q828026 for more information]
Windows Media Player system update (9 Series)
Wireless-G Notebook Adapter
Yahoo! Photos Easy Upload Tool 1v3
Yahoo! Photos Easy Upload Tool 1v6

Scotty

Post #4December 3, 2007, 11:03 AM UTC

Hi

Download and Run SmitfraudFix
Please download SmitfraudFix (by S!Ri)
Extract the content (a folder named SmitfraudFix) to your Desktop.

Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply.

Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.

tapher

Post #5December 3, 2007, 2:50 PM UTC

SmitFraudFix v2.256 Scan done at 8:46:32.66, Mon 12/03/2007 Run from C:\Documents and Settings\Administrator\Desktop\spyware tools\SmitfraudFix OS: Microsoft Windows 2000 [Version 5.00.2195] - Windows_NT The filesystem type is NTFS Fix run in normal mode »»»»»»»»»»»»»»»»»»»»»»»» Process C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\Altiris\AClient\AClient.exe C:\WINNT\System32\Ati2evxx.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Yahoo!\Antivirus\ISafe.exe C:\WINNT\System32\cisvc.exe C:\Program Files\Compaq\Compaq Management Agents\cpqalert.exe C:\WINNT\Cpqdiag\Cpqdfwag.exe C:\PROGRA~1\Compaq\COMPAQ~1\CPQWEB~1\WebDmi.exe C:\WINNT\system32\drivers\KodakCCS.exe C:\Program Files\Kodak EasyShare software\bin\ptssvc.exe C:\WINNT\system32\regsvc.exe C:\WINNT\system32\MSTask.exe C:\Program Files\Yahoo!\Antivirus\VetMsg.exe C:\Program Files\Compaq\Compaq Management Agents\Dmi\Win32\bin\Win32sl.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\system32\mspmspsv.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\svchost.exe C:\PROGRA~1\Compaq\COMPAQ~1\cpqdmi.exe C:\WINNT\Explorer.EXE C:\WINNT\system32\mobsync.exe C:\WINNT\system32\atiptaxx.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Compaq\EAB\EabServr.exe C:\PROGRA~1\Compaq\COMPAQ~1\CHKADMIN.EXE C:\Program Files\SBC Yahoo!\Connection Manager\IP InSight\IPMon32.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Program Files\Yahoo!\Antivirus\CAVTray.exe C:\Program Files\Yahoo!\Antivirus\CAVRID.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Linksys\Wireless-G Notebook Adapter\OdHost.exe C:\Program Files\Linksys\Wireless-G Notebook Adapter\WPC54Cfg.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINNT\system32\cmd.exe »»»»»»»»»»»»»»»»»»»»»»»» hosts »»»»»»»»»»»»»»»»»»»»»»»» C:\ »»»»»»»»»»»»»»»»»»»»»»»» C:\WINNT »»»»»»»»»»»»»»»»»»»»»»»» C:\WINNT\system »»»»»»»»»»»»»»»»»»»»»»»» C:\WINNT\Web »»»»»»»»»»»»»»»»»»»»»»»» C:\WINNT\system32 »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Administrator »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Administrator\Application Data »»»»»»»»»»»»»»»»»»»»»»»» Start Menu »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\ADMINI~1\FAVORI~1 »»»»»»»»»»»»»»»»»»»»»»»» Desktop »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» Rustock »»»»»»»»»»»»»»»»»»»»»»»» DNS Description: Wireless-G Notebook Adapter with SpeedBooster DNS Server Search Order: 16.110.251.242 DNS Server Search Order: 16.103.131.242 DNS Server Search Order: 16.105.251.242 Description: Wireless-G Notebook Adapter with SpeedBooster DNS Server Search Order: 16.110.251.242 DNS Server Search Order: 16.103.131.242 DNS Server Search Order: 16.105.251.242 Description: Wireless-G Notebook Adapter with SpeedBooster DNS Server Search Order: 192.168.1.254 HKLM\SYSTEM\CCS\Services\Tcpip\..\{20F92E02-F716-4B9D-87C3-540D1D704E31}: DhcpNameServer=[removed] [removed] [removed] HKLM\SYSTEM\CCS\Services\Tcpip\..\{B5A011EE-2954-4985-850F-85412571510F}: DhcpNameServer=192.168.1.254 HKLM\SYSTEM\CCS\Services\Tcpip\..\{E4206544-A8D6-461A-AC9D-64B96529E2DC}: DhcpNameServer=[removed] [removed] [removed] HKLM\SYSTEM\CS1\Services\Tcpip\..\{20F92E02-F716-4B9D-87C3-540D1D704E31}: DhcpNameServer=[removed] [removed] [removed] HKLM\SYSTEM\CS1\Services\Tcpip\..\{B5A011EE-2954-4985-850F-85412571510F}: DhcpNameServer=192.168.1.254 HKLM\SYSTEM\CS1\Services\Tcpip\..\{E4206544-A8D6-461A-AC9D-64B96529E2DC}: DhcpNameServer=[removed] [removed] [removed] HKLM\SYSTEM\CS2\Services\Tcpip\..\{20F92E02-F716-4B9D-87C3-540D1D704E31}: DhcpNameServer=[removed] [removed] [removed] HKLM\SYSTEM\CS2\Services\Tcpip\..\{B5A011EE-2954-4985-850F-85412571510F}: DhcpNameServer=192.168.1.254 HKLM\SYSTEM\CS2\Services\Tcpip\..\{E4206544-A8D6-461A-AC9D-64B96529E2DC}: DhcpNameServer=[removed] [removed] [removed] HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.254 HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.254 HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.254 »»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection »»»»»»»»»»»»»»»»»»»»»»»» End

Scotty

Post #6December 3, 2007, 5:28 PM UTC

Hi

Download and Save ComboFix

Download this file from below:

Here
Save it to your Desktop.
Disconnect from the Internet, than disable your anti-virus and any real-time anti-spyware monitors that are running.
Click Start>Run copy/paste or type "%userprofile%\desktop\combofix.exe" /killall into the Run box and click OK.
When finished, it shall produce a log for you. Post that log in your next reply with a new HijackThis log.

Note 1: Do not mouseclick combofix's window whilst it's running. That may cause it to stall
Note 2:Remember to re-enable your anti-virus and anti-spyware before reconnecting to the Internet.

Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task-Manager use the Processes tab (press ctrl alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
If that happened we want to know, and also what process you had to end.

In your next reply post:
ComboFix.txt
New HijackThis log taken after the above scan has run

tapher

Post #7December 4, 2007, 4:55 AM UTC last edited December 4, 2007, 4:56 AM UTC

At first run of Combofix, upon reboot, Spybot S&D blocked a registry item called, "sman". Spybot, AVG, and Computer Associates yahoo anti-virus/anti-spyware programs start themselves as part of the booting up process. Their icons appear in the lower right corner of my bottom toolbar.

I uninstalled Spybot S&D, rebooted, and repeated your instructions. This time no interference or activity was apparent from the remaining anti-virus auto-booting processes (AVG, and the yahoo CA program).

Here is the HijackThis Log. Beneath it lies the Combofix report.

Thanks!

Logfile of HijackThis v1.99.1
Scan saved at 10:47:10 PM, on 12/03/2007
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Altiris\AClient\AClient.exe
C:\WINNT\System32\Ati2evxx.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Yahoo!\Antivirus\ISafe.exe
C:\WINNT\System32\cisvc.exe
C:\Program Files\Compaq\Compaq Management Agents\cpqalert.exe
C:\WINNT\Cpqdiag\Cpqdfwag.exe
C:\PROGRA~1\Compaq\COMPAQ~1\CPQWEB~1\WebDmi.exe
C:\WINNT\system32\drivers\KodakCCS.exe
C:\Program Files\Kodak EasyShare software\bin\ptssvc.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
C:\Program Files\Compaq\Compaq Management Agents\Dmi\Win32\bin\Win32sl.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\PROGRA~1\Compaq\COMPAQ~1\cpqdmi.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\atiptaxx.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Compaq\EAB\EabServr.exe
C:\PROGRA~1\Compaq\COMPAQ~1\CHKADMIN.EXE
C:\Program Files\SBC Yahoo!\Connection Manager\IP InSight\IPMon32.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Yahoo!\Antivirus\CAVTray.exe
C:\Program Files\Yahoo!\Antivirus\CAVRID.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\OdHost.exe
C:\Documents and Settings\Administrator\Desktop\spyware tools\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\Compaq\EAB\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] c:\compaq\cpqsetup\cpqset.exe
O4 - HKLM\..\Run: [ChkAdmin] C:\PROGRA~1\Compaq\COMPAQ~1\CHKADMIN.EXE
O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\SBC Yahoo!\Connection Manager\IP InSight\IPMon32.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\Yahoo!\Antivirus\CAVTray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\Yahoo!\Antivirus\CAVRID.exe"
O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\RunServices: [CPQDFWAG] C:\WINNT\Cpqdiag\CpqDfwAg.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Wireless-G Notebook Adapter Utility.lnk = C:\Program Files\Linksys\Wireless-G Notebook Adapter\Startup.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {24D1BDCE-D835-11D6-BF84-0050047EA0E7} (BlueStream_Flash Class) - http://www.rovion.com/Controls/Rovion.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eB…l_v1-0-3-48.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer Wrapper) - http://chat.yahoo.com/cab/yvwrctl.cab
O23 - Service: Altiris Client Service (AClient) - Altiris, Inc. - C:\Altiris\AClient\AClient.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\ISafe.exe
O23 - Service: Compaq Local Alerter (CPQALERT) - Compaq Computer Corporation - C:\Program Files\Compaq\Compaq Management Agents\cpqalert.exe
O23 - Service: Compaq Remote Diagnostics Enabling Agent (CpqDfwWebAgent) - Compaq Computer Corporation - C:\WINNT\Cpqdiag\Cpqdfwag.exe
O23 - Service: cpqdmi - Compaq Computer Corporation - C:\PROGRA~1\Compaq\COMPAQ~1\cpqdmi.exe
O23 - Service: Compaq DMI Web Agent (cpqWebDmi) - Compaq Computer Corporation - C:\PROGRA~1\Compaq\COMPAQ~1\CPQWEB~1\WebDmi.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINNT\system32\drivers\KodakCCS.exe
O23 - Service: NICSer_WPC54G - Unknown owner - C:\Program Files\Linksys\Wireless-G Notebook Adapter\NICServ.exe
O23 - Service: ptssvc - KODAK - C:\Program Files\Kodak EasyShare software\bin\ptssvc.exe
O23 - Service: M-Audio Uno Installer (UnoInstallerService) - Unknown owner - C:\Program Files\M-Audio Uno\UnoInst.exe (file missing)
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
O23 - Service: Win32Sl (WIN32SL) - Intel - C:\Program Files\Compaq\Compaq Management Agents\Dmi\Win32\bin\Win32sl.exe

————————————————————————————————————————————————-

ComboFix 07-12-02.7 - Administrator 12/03/2007 22:26:47.2 - NTFSx86
Running from: C:\Documents and Settings\[removed]\desktop\combofix.exe
Command switches used :: /killall
.

((((((((((((((((((((((((( Files Created from 2007-11-04 to 2007-12-04 )))))))))))))))))))))))))))))))
.

2007-12-03 02:46 . 07-12-03 11:33 554,176 —h—– C:\WINNT\ShellIconCache
2007-12-02 05:10 . 07-12-02 05:10 d——– C:\Deckard
2007-11-30 18:30 . 07-11-30 19:00 d——– C:\WINNT\SYSTEM32\ActiveScan
2007-11-30 18:30 . 07-11-30 18:30 30,590 –a—— C:\WINNT\SYSTEM32\pavas.ico
2007-11-30 18:30 . 07-11-30 18:30 2,550 –a—— C:\WINNT\SYSTEM32\Uninstall.ico
2007-11-30 18:30 . 07-11-30 18:30 1,406 –a—— C:\WINNT\SYSTEM32\Help.ico
2007-11-29 13:03 . 07-11-29 13:03 d——– C:\Documents and Settings\All Users\Application Data\Grisoft
2007-11-29 13:03 . 07-11-29 13:03 d——– C:\Documents and Settings\Administrator\Application Data\Grisoft
2007-11-29 13:03 . 07-05-30 04:10 10,872 –a—— C:\WINNT\SYSTEM32\DRIVERS\AvgAsCln.sys
2007-11-29 11:39 . 07-12-03 08:46 3,442 –a—— C:\WINNT\SYSTEM32\tmp.reg
2007-11-29 11:37 . 07-09-05 23:22 289,144 –a—— C:\WINNT\SYSTEM32\VCCLSID.exe
2007-11-29 11:37 . 06-04-27 16:49 288,417 –a—— C:\WINNT\SYSTEM32\SrchSTS.exe
2007-11-29 11:37 . 03-06-05 20:13 53,248 –a—— C:\WINNT\SYSTEM32\Process.exe
2007-11-29 11:37 . 04-07-31 17:50 51,200 –a—— C:\WINNT\SYSTEM32\dumphive.exe
2007-11-29 11:37 . 07-10-03 23:36 25,600 –a—— C:\WINNT\SYSTEM32\WS2Fix.exe
2007-11-28 10:32 . 07-11-28 10:32 22 –a—— C:\WINNT\kodakpcd.ini

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-04 06:09 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-28 21:15 ——— d—–w C:\Program Files\QuickTime
2007-11-28 17:05 ——— d—–w C:\Program Files\Common Files\Real
2007-11-28 17:00 ——— d–h–w C:\Documents and Settings\Administrator\Application Data\Move Networks
2007-11-21 05:47 ——— d—–w C:\Program Files\Kodak EasyShare software
2007-11-13 02:04 ——— d—a-w C:\Program Files\Java
2007-10-19 03:33 ——— d—–w C:\Program Files\MSXML 4.0
2007-10-18 07:15 ——— d—–w C:\Program Files\Kodak
2007-10-18 07:14 ——— d—–w C:\Program Files\Kodak Utilities
2007-10-18 07:14 ——— d—–w C:\Program Files\Common Files\Kodak
2007-10-18 07:07 ——— d—–w C:\Documents and Settings\All Users\Application Data\Kodak
2001-05-30 18:50 271 -c-ha-w C:\Program Files\DESKTOP.INI
2001-05-30 18:50 21,952 -c-ha-w C:\Program Files\FOLDER.HTT
2001-05-08 13:00 32,528 -c–a-w C:\WINNT\INF\WBFIRDMA.SYS
2004-08-11 18:27 0 -csha-w C:\WINNT\ktyam.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [06-11-30 21:49 ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"="mobsync.exe" [03-06-19 11:05 C:\WINNT\SYSTEM32\mobsync.exe]
"ATIModeChange"="Ati2mdxx.exe" [02-04-01 19:19 C:\WINNT\SYSTEM32\Ati2mdxx.exe]
"AtiPTA"="atiptaxx.exe" [02-04-01 19:19 C:\WINNT\SYSTEM32\atiptaxx.exe]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [03-05-22 20:10 ]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [03-05-22 21:06 ]
"eabconfg.cpl"="C:\Program Files\Compaq\EAB\EabServr.exe" [02-04-09 10:49 ]
"Cpqset"="c:\compaq\cpqsetup\cpqset.exe" [02-04-30 14:41 ]
"ChkAdmin"="C:\PROGRA~1\Compaq\COMPAQ~1\CHKADMIN.EXE" [02-01-24 17:03 ]
"windows auto update"="" []
"IPInSightMonitor 01"="C:\Program Files\SBC Yahoo!\Connection Manager\IP InSight\IPMon32.exe" [03-07-14 11:30 ]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [07-09-25 01:11 ]
"CaAvTray"="C:\Program Files\Yahoo!\Antivirus\CAVTray.exe" [06-07-07 13:47 ]
"CAVRID"="C:\Program Files\Yahoo!\Antivirus\CAVRID.exe" [06-07-07 13:47 ]
"YOP"="C:\PROGRA~1\Yahoo!\YOP\yop.exe" [05-04-22 18:49 ]
"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" []
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [05-08-11 15:30 ]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [07-06-11 01:25 ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"CPQDFWAG"="C:\WINNT\Cpqdiag\CpqDfwAg.exe" [01-11-19 07:12 ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"^SetupICWDesktop"="C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe" [03-06-19 11:05 ]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2000-01-21 00:15:54]
Wireless-G Notebook Adapter Utility.lnk - C:\Program Files\Linksys\Wireless-G Notebook Adapter\Startup.exe [2007-07-11 14:24:48]

.
Contents of the 'Scheduled Tasks' folder
"2007-12-01 01:50:46 C:\WINNT\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-12-02 06:05:18 C:\WINNT\Tasks\Disk Cleanup.job"
- C:\WINNT\System32\cleanmgr.exe
.
**************************************************************************

catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-03 22:34:42
Windows 5.0.2195 Service Pack 4 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

**************************************************************************
.
Completion time: 2007-12-03 22:42:43 - machine was rebooted
C:\ComboFix2.txt … 07-12-03 22:06
.
— E O F —

Scotty

Post #8December 4, 2007, 10:18 AM UTC

Hi

Remember to disconnect from the Internet and disable your anti-virus before carrying out the next instruction, and to reenable the anti-virus before reconnecting to the Internet

Open Notepad - it must be Notepad, not Wordpad.
Copy the text below in the code box by highlighting all the text with your mouse and pressing Ctrl+C

File::
C:\WINNT\SYSTEM32\pavas.ico 
C:\WINNT\SYSTEM32\Uninstall.ico
C:\WINNT\SYSTEM32\Help.ico
C:\WINNT\ktyam.dll

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"windows auto update"=-

Go to the Notepad window and click Edit > Paste
Then click File > Save
Name the file "CFScript.txt" (including the quotes)
Save the file to your Desktop

[external image: Posted Image]

Refering to the picture above, drag CFScript into ComboFix.exe

Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task-Manager use the Processes tab (press ctrl alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
If that happened we want to know, and also what process you had to end.

Please do an online scan with Kaspersky Online Scanner. You will be prompted to install an ActiveX component from Kaspersky, Click Yes.

The program will launch and then start to download the latest definition files.
Once the scanner is installed and the definitions downloaded, click Next.
Now click on Scan Settings
In the scan settings make sure that the following are selected:
- Scan using the following Anti-Virus database:
  
  + Extended(If available otherwise Standard)
- Scan Options:
  
  + Scan Archives
  + Scan Mail Bases
Click OK
Now under select a target to scan select My Computer
The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
Now click on the Save as Text button
Save the file to your desktop.
Copy and paste that information in your next post.

With the exception of Internet Explorer, which is needed for the Kaspersky Scan, keep ALL programs closed until the scan is complete.

In your next reply post:
Kaspersky report
ComboFix.txt
New HJT log taken after the above scan has run

tapher

Post #9December 5, 2007, 11:17 AM UTC

After I dragged the CFScript onto the ComboFix icon, the program ran. It did require me to type either "1" to continue, or "2" to do something else. I typed "1".

Just before ComboFix succeeded in shutting down the computer to begin the reboot process, a window "The application failed to…" flashed open, and closed before I could read it. Concurrent with that, and lasting a second or two longer, was a smaller window reading something about a "dbx client", I THINK. I didn't get a good read on it, but I think it had the same name as a window which opens for a while when I manually shut down the computer at times.

When ComboFix was running after rebooting, I did hit the 20 minute mark. At that time I opened the Task Manager and found a "sed.cfexe" file running, which I closed. I also found a "vfindcf.exe" (yes vfindcf.exe) file, which I did not close.

ComboFix finished and gave me a report at around 24 minutes.

I haven't thought to mention this before, but often when attempting to reboot OR shut down the computer, a process named "sw" will require manual stoppage. I don't know what that process is.

Also, Adobe Acrobat will need to be manually shut down often, even when I've not examined any PDF files during the session. It is strange!

Here are the 3 logs you're asked for. Thanks!! (incidentally, the Kaspersky program didn't have a "save as text" button, but I was able to save a webpage as a txt file. I hope this is what was intended.)

——————————————————————————-
KASPERSKY ONLINE SCANNER REPORT
Wednesday, December 05, 2007 5:02:06 AM
Operating System: Microsoft Windows 2000 Professional, Service Pack 4 (Build 2195)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 5/12/2007
Kaspersky Anti-Virus database records: 472897
——————————————————————————-

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\

Scan Statistics:
Total number of scanned objects: 47841
Number of viruses found: 14
Number of infected objects: 28
Number of suspicious objects: 2
Duration of the scan process: 01:12:53

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\6.0\2\7a3a8d42-5f298277/a.class Infected: Trojan.Java.ClassLoader.b skipped
C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\6.0\2\7a3a8d42-5f298277/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.a skipped
C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\6.0\2\7a3a8d42-5f298277/VerifierBug.class Infected: Trojan.Java.ClassLoader.u skipped
C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\6.0\2\7a3a8d42-5f298277 ZIP: infected - 3 skipped
C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\6.0\2\7a3a8d42-6d595cdb/a.class Infected: Trojan.Java.ClassLoader.b skipped
C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\6.0\2\7a3a8d42-6d595cdb/Dummy.class Infected: Trojan.Java.ClassLoader.Dummy.a skipped
C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\6.0\2\7a3a8d42-6d595cdb/VerifierBug.class Infected: Trojan.Java.ClassLoader.u skipped
C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\6.0\2\7a3a8d42-6d595cdb ZIP: infected - 3 skipped
C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\6.0\37\66a57ae5-4a5268c2/BaaaaBaa.class Infected: Trojan.Java.ClassLoader.ao skipped
C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\6.0\37\66a57ae5-4a5268c2/VaaaaaaaBaa.class Infected: Trojan.Java.ClassLoader.ao skipped
C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\6.0\37\66a57ae5-4a5268c2/Baaaaa.class Infected: Trojan.Java.ClassLoader.ao skipped
C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\6.0\37\66a57ae5-4a5268c2 ZIP: infected - 3 skipped
C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\6.0\56\43f905f8-5849c50f/BaaaaBaa.class Infected: Exploit.Java.Gimsh.a skipped
C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\6.0\56\43f905f8-5849c50f ZIP: infected - 1 skipped
C:\Documents and Settings\Administrator\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Administrator\Desktop\spyware tools\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\Administrator\Desktop\spyware tools\SmitfraudFix.exe/data.rar/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\Administrator\Desktop\spyware tools\SmitfraudFix.exe/data.rar Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\Administrator\Desktop\spyware tools\SmitfraudFix.exe RarSFX: infected - 2 skipped
C:\Documents and Settings\Administrator\Desktop\VideoAccessCodecInstall.exe/stream/data0004 Infected: Trojan-Downloader.Win32.Zlob.eoq skipped
C:\Documents and Settings\Administrator\Desktop\VideoAccessCodecInstall.exe/stream Infected: Trojan-Downloader.Win32.Zlob.eoq skipped
C:\Documents and Settings\Administrator\Desktop\VideoAccessCodecInstall.exe NSIS: infected - 2 skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\INDEX.DAT Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temp\jwehyrmr1.dll Infected: Trojan.Win32.Inject.mf skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Administrator\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Administrator\ntuser.dat.LOG Object is locked skipped
C:\My Downloads\newnet.exe Infected: not-a-virus:AdWare.Win32.NewDotNet skipped
C:\Program Files\COMPAQ\Compaq Management Agents\Dmi\Win32\mifdb\errors.log Object is locked skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\20071128062752.zip/au_.exe Suspicious: Password-protected-EXE skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\20071128062752.zip ZIP: suspicious - 1 skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq28.tmp\bar\1.bin\N2PLUGIN.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.l skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq28.tmp\bar\1.bin\ND2FNBAR.DLL Infected: not-a-virus:AdWare.Win32.MySearch.e skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq28.tmp\bar\1.bin\NPND2FN.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.o skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqF.tmp\api.exe/data0002 Infected: Backdoor.Win32.Agent.so skipped
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqF.tmp\api.exe NSIS: infected - 1 skipped
C:\WINNT\CSC\00000001 Object is locked skipped
C:\WINNT\Debug\ipsecpa.log Object is locked skipped
C:\WINNT\Debug\oakley.log Object is locked skipped
C:\WINNT\Debug\PASSWD.LOG Object is locked skipped
C:\WINNT\ModemLog_Bluetooth Null Modem.txt Object is locked skipped
C:\WINNT\ModemLog_Conexant HSFi V92 MiniPCI Modem.txt Object is locked skipped
C:\WINNT\SchedLgU.Txt Object is locked skipped
C:\WINNT\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINNT\SYSTEM32\CONFIG\AppEvent.Evt Object is locked skipped
C:\WINNT\SYSTEM32\CONFIG\DEFAULT Object is locked skipped
C:\WINNT\SYSTEM32\CONFIG\DEFAULT.LOG Object is locked skipped
C:\WINNT\SYSTEM32\CONFIG\SAM Object is locked skipped
C:\WINNT\SYSTEM32\CONFIG\SAM.LOG Object is locked skipped
C:\WINNT\SYSTEM32\CONFIG\SecEvent.Evt Object is locked skipped
C:\WINNT\SYSTEM32\CONFIG\SECURITY Object is locked skipped
C:\WINNT\SYSTEM32\CONFIG\SECURITY.LOG Object is locked skipped
C:\WINNT\SYSTEM32\CONFIG\SOFTWARE Object is locked skipped
C:\WINNT\SYSTEM32\CONFIG\SOFTWARE.LOG Object is locked skipped
C:\WINNT\SYSTEM32\CONFIG\SysEvent.Evt Object is locked skipped
C:\WINNT\SYSTEM32\CONFIG\SYSTEM Object is locked skipped
C:\WINNT\SYSTEM32\CONFIG\SYSTEM.ALT Object is locked skipped
C:\WINNT\SYSTEM32\IAS\dnary.ldb Object is locked skipped
C:\WINNT\SYSTEM32\IAS\IAS.ldb Object is locked skipped
C:\WINNT\SYSTEM32\IAS\IAS.MDB Object is locked skipped
C:\WINNT\SYSTEM32\WBEM\Repository\CIM.REP Object is locked skipped
C:\WINNT\Temp\JET51F7.tmp Object is locked skipped
C:\WINNT\Temp\JETA55D.tmp Object is locked skipped
C:\WINNT\WindowsUpdate.log Object is locked skipped

Scan process completed.

—————————————————————————————————————————————————————————

ComboFix 07-12-02.7 - Administrator 2007-12-05 2:53:39.3 - NTFSx86
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Administrator\Desktop\CFScript.txt

FILE
C:\WINNT\ktyam.dll
C:\WINNT\SYSTEM32\Help.ico
C:\WINNT\SYSTEM32\pavas.ico
C:\WINNT\SYSTEM32\Uninstall.ico
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINNT\ktyam.dll
C:\WINNT\SYSTEM32\Help.ico
C:\WINNT\SYSTEM32\pavas.ico
C:\WINNT\SYSTEM32\Uninstall.ico

.
((((((((((((((((((((((((( Files Created from 2007-11-05 to 2007-12-05 )))))))))))))))))))))))))))))))
.

2007-12-03 02:46 . 07-12-05 01:44 555,734 —h—– C:\WINNT\ShellIconCache
2007-12-02 05:10 . 07-12-02 05:10 d——– C:\Deckard
2007-11-30 18:30 . 07-11-30 19:00 d——– C:\WINNT\SYSTEM32\ActiveScan
2007-11-29 13:03 . 07-11-29 13:03 d——– C:\Documents and Settings\All Users\Application Data\Grisoft
2007-11-29 13:03 . 07-11-29 13:03 d——– C:\Documents and Settings\Administrator\Application Data\Grisoft
2007-11-29 13:03 . 07-05-30 04:10 10,872 –a—— C:\WINNT\SYSTEM32\DRIVERS\AvgAsCln.sys
2007-11-29 11:39 . 07-12-03 08:46 3,442 –a—— C:\WINNT\SYSTEM32\tmp.reg
2007-11-29 11:37 . 07-09-05 23:22 289,144 –a—— C:\WINNT\SYSTEM32\VCCLSID.exe
2007-11-29 11:37 . 06-04-27 16:49 288,417 –a—— C:\WINNT\SYSTEM32\SrchSTS.exe
2007-11-29 11:37 . 03-06-05 20:13 53,248 –a—— C:\WINNT\SYSTEM32\Process.exe
2007-11-29 11:37 . 04-07-31 17:50 51,200 –a—— C:\WINNT\SYSTEM32\dumphive.exe
2007-11-29 11:37 . 07-10-03 23:36 25,600 –a—— C:\WINNT\SYSTEM32\WS2Fix.exe
2007-11-28 10:32 . 07-11-28 10:32 22 –a—— C:\WINNT\kodakpcd.ini

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-04 06:09 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-28 21:15 ——— d—–w C:\Program Files\QuickTime
2007-11-28 17:05 ——— d—–w C:\Program Files\Common Files\Real
2007-11-28 17:00 ——— d–h–w C:\Documents and Settings\Administrator\Application Data\Move Networks
2007-11-21 05:47 ——— d—–w C:\Program Files\Kodak EasyShare software
2007-11-13 02:04 ——— d—a-w C:\Program Files\Java
2007-10-19 03:33 ——— d—–w C:\Program Files\MSXML 4.0
2007-10-18 07:15 ——— d—–w C:\Program Files\Kodak
2007-10-18 07:14 ——— d—–w C:\Program Files\Kodak Utilities
2007-10-18 07:14 ——— d—–w C:\Program Files\Common Files\Kodak
2007-10-18 07:07 ——— d—–w C:\Documents and Settings\All Users\Application Data\Kodak
2001-05-30 18:50 271 -c-ha-w C:\Program Files\DESKTOP.INI
2001-05-30 18:50 21,952 -c-ha-w C:\Program Files\FOLDER.HTT
2001-05-08 13:00 32,528 -c–a-w C:\WINNT\INF\WBFIRDMA.SYS
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [06-11-30 21:49 ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"="mobsync.exe" [03-06-19 11:05 C:\WINNT\SYSTEM32\mobsync.exe]
"ATIModeChange"="Ati2mdxx.exe" [02-04-01 19:19 C:\WINNT\SYSTEM32\Ati2mdxx.exe]
"AtiPTA"="atiptaxx.exe" [02-04-01 19:19 C:\WINNT\SYSTEM32\atiptaxx.exe]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [03-05-22 20:10 ]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [03-05-22 21:06 ]
"eabconfg.cpl"="C:\Program Files\Compaq\EAB\EabServr.exe" [02-04-09 10:49 ]
"Cpqset"="c:\compaq\cpqsetup\cpqset.exe" [02-04-30 14:41 ]
"ChkAdmin"="C:\PROGRA~1\Compaq\COMPAQ~1\CHKADMIN.EXE" [02-01-24 17:03 ]
"IPInSightMonitor 01"="C:\Program Files\SBC Yahoo!\Connection Manager\IP InSight\IPMon32.exe" [03-07-14 11:30 ]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [07-09-25 01:11 ]
"CaAvTray"="C:\Program Files\Yahoo!\Antivirus\CAVTray.exe" [06-07-07 13:47 ]
"CAVRID"="C:\Program Files\Yahoo!\Antivirus\CAVRID.exe" [06-07-07 13:47 ]
"YOP"="C:\PROGRA~1\Yahoo!\YOP\yop.exe" [05-04-22 18:49 ]
"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" []
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [05-08-11 15:30 ]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [07-06-11 01:25 ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"CPQDFWAG"="C:\WINNT\Cpqdiag\CpqDfwAg.exe" [01-11-19 07:12 ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"^SetupICWDesktop"="C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe" [03-06-19 11:05 ]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2000-01-21 00:15:54]
Wireless-G Notebook Adapter Utility.lnk - C:\Program Files\Linksys\Wireless-G Notebook Adapter\Startup.exe [2007-07-11 14:24:48]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"= 0 (0x0)

.
Contents of the 'Scheduled Tasks' folder
"2007-12-01 01:50:46 C:\WINNT\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-12-02 06:05:18 C:\WINNT\Tasks\Disk Cleanup.job"
- C:\WINNT\System32\cleanmgr.exe
.
**************************************************************************

catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-05 03:02:00
Windows 5.0.2195 Service Pack 4 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

**************************************************************************
.
Completion time: 2007-12-05 3:11:16 - machine was rebooted
C:\ComboFix2.txt … 07-12-03 22:42
C:\ComboFix3.txt … 07-12-03 22:06
.
— E O F —

—————————————————————————————————————————————————————————————-
Logfile of HijackThis v1.99.1
Scan saved at 5:03:13 AM, on 12/05/2007
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Altiris\AClient\AClient.exe
C:\WINNT\System32\Ati2evxx.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Yahoo!\Antivirus\ISafe.exe
C:\WINNT\System32\cisvc.exe
C:\Program Files\Compaq\Compaq Management Agents\cpqalert.exe
C:\WINNT\Cpqdiag\Cpqdfwag.exe
C:\PROGRA~1\Compaq\COMPAQ~1\CPQWEB~1\WebDmi.exe
C:\WINNT\system32\drivers\KodakCCS.exe
C:\Program Files\Kodak EasyShare software\bin\ptssvc.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Compaq\Compaq Management Agents\Dmi\Win32\bin\Win32sl.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\PROGRA~1\Compaq\COMPAQ~1\cpqdmi.exe
C:\WINNT\system32\atiptaxx.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Compaq\EAB\EabServr.exe
C:\PROGRA~1\Compaq\COMPAQ~1\CHKADMIN.EXE
C:\Program Files\SBC Yahoo!\Connection Manager\IP InSight\IPMon32.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Yahoo!\Antivirus\CAVTray.exe
C:\Program Files\Yahoo!\Antivirus\CAVRID.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\OdHost.exe
C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
C:\Documents and Settings\Administrator\Desktop\spyware tools\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.truthout.org/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\Compaq\EAB\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] c:\compaq\cpqsetup\cpqset.exe
O4 - HKLM\..\Run: [ChkAdmin] C:\PROGRA~1\Compaq\COMPAQ~1\CHKADMIN.EXE
O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\SBC Yahoo!\Connection Manager\IP InSight\IPMon32.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\Yahoo!\Antivirus\CAVTray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\Yahoo!\Antivirus\CAVRID.exe"
O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\RunServices: [CPQDFWAG] C:\WINNT\Cpqdiag\CpqDfwAg.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Wireless-G Notebook Adapter Utility.lnk = C:\Program Files\Linksys\Wireless-G Notebook Adapter\Startup.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {24D1BDCE-D835-11D6-BF84-0050047EA0E7} (BlueStream_Flash Class) - http://www.rovion.com/Controls/Rovion.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eB…l_v1-0-3-48.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer Wrapper) - http://chat.yahoo.com/cab/yvwrctl.cab
O23 - Service: Altiris Client Service (AClient) - Altiris, Inc. - C:\Altiris\AClient\AClient.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\ISafe.exe
O23 - Service: Compaq Local Alerter (CPQALERT) - Compaq Computer Corporation - C:\Program Files\Compaq\Compaq Management Agents\cpqalert.exe
O23 - Service: Compaq Remote Diagnostics Enabling Agent (CpqDfwWebAgent) - Compaq Computer Corporation - C:\WINNT\Cpqdiag\Cpqdfwag.exe
O23 - Service: cpqdmi - Compaq Computer Corporation - C:\PROGRA~1\Compaq\COMPAQ~1\cpqdmi.exe
O23 - Service: Compaq DMI Web Agent (cpqWebDmi) - Compaq Computer Corporation - C:\PROGRA~1\Compaq\COMPAQ~1\CPQWEB~1\WebDmi.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINNT\system32\drivers\KodakCCS.exe
O23 - Service: NICSer_WPC54G - Unknown owner - C:\Program Files\Linksys\Wireless-G Notebook Adapter\NICServ.exe
O23 - Service: ptssvc - KODAK - C:\Program Files\Kodak EasyShare software\bin\ptssvc.exe
O23 - Service: M-Audio Uno Installer (UnoInstallerService) - Unknown owner - C:\Program Files\M-Audio Uno\UnoInst.exe (file missing)
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
O23 - Service: Win32Sl (WIN32SL) - Intel - C:\Program Files\Compaq\Compaq Management Agents\Dmi\Win32\bin\Win32sl.exe

Scotty

Post #10December 5, 2007, 11:59 AM UTC last edited December 5, 2007, 11:59 AM UTC

Hi

Do you need a shortcut to the Internet Connection Wizard on your Desktop?

Remember to disconnect from the Internet and disable your anti-virus before carrying out the next instruction, and to reenable the anti-virus before reconnecting to the Internet

Open Notepad - it must be Notepad, not Wordpad.
Copy the text below in the code box by highlighting all the text with your mouse and pressing Ctrl+C

File::
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq28.tmp\bar\1.bin\NPND2FN.DLL
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq28.tmp\bar\1.bin\ND2FNBAR.DLL 
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq28.tmp\bar\1.bin\N2PLUGIN.DLL 
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqF.tmp\api.exe
C:\Documents and Settings\Administrator\Desktop\spyware tools\SmitfraudFix.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\jwehyrmr1.dll
C:\My Downloads\newnet.exe
C:\WINNT\SYSTEM32\VCCLSID.exe
C:\WINNT\SYSTEM32\SrchSTS.exe
C:\WINNT\SYSTEM32\Process.exe
C:\WINNT\SYSTEM32\dumphive.exe
C:\WINNT\SYSTEM32\WS2Fix.exe

Folder::
C:\Program Files\Yahoo!\YPSR\Quarantine\20071128062752.zip
C:\Documents and Settings\Administrator\Desktop\VideoAccessCodec
C:\Documents and Settings\Administrator\Desktop\spyware tools\SmitfraudFix
C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\6.0\56\43f905f8-5849c50f ZIP
C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\6.0\37\66a57ae5-4a5268c2 ZIP
C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\6.0\2\7a3a8d42-6d595cdb ZIP
C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\6.0\2\7a3a8d42-5f298277 ZIP

Go to the Notepad window and click Edit > Paste
Then click File > Save
Name the file "CFScript.txt" (including the quotes)
Save the file to your Desktop

[external image: Posted Image]

Refering to the picture above, drag CFScript into ComboFix.exe

Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task-Manager use the Processes tab (press ctrl alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
If that happened we want to know, and also what process you had to end.

In your next reply post:
ComboFix.txt
New HJT log taken after the above scan has run

Then we will look into the other problems.

tapher

Post #11December 8, 2007, 5:38 AM UTC

I don't know if a shortcut to the internet connection wizard is needed on the desktop. My guess is my mother has left it there as a remnant from her dial-up connection days. We needn't mess with it.

Here's the hijack this and combo fix logs, respectively. Thanks again! And I apologize for the delay in response, our DSL was out for a few days.

Logfile of HijackThis v1.99.1
Scan saved at 11:30:35 PM, on 12/07/2007
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Altiris\AClient\AClient.exe
C:\WINNT\System32\Ati2evxx.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Yahoo!\Antivirus\ISafe.exe
C:\WINNT\System32\cisvc.exe
C:\Program Files\Compaq\Compaq Management Agents\cpqalert.exe
C:\WINNT\Cpqdiag\Cpqdfwag.exe
C:\PROGRA~1\Compaq\COMPAQ~1\CPQWEB~1\WebDmi.exe
C:\WINNT\system32\drivers\KodakCCS.exe
C:\Program Files\Kodak EasyShare software\bin\ptssvc.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
C:\Program Files\Compaq\Compaq Management Agents\Dmi\Win32\bin\Win32sl.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\PROGRA~1\Compaq\COMPAQ~1\cpqdmi.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\atiptaxx.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Compaq\EAB\EabServr.exe
C:\PROGRA~1\Compaq\COMPAQ~1\CHKADMIN.EXE
C:\Program Files\SBC Yahoo!\Connection Manager\IP InSight\IPMon32.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Yahoo!\Antivirus\CAVTray.exe
C:\Program Files\Yahoo!\Antivirus\CAVRID.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\OdHost.exe
C:\Documents and Settings\Administrator\Desktop\spyware tools\Hijackthis\HijackThis.exe
C:\Program Files\Yahoo!\Antivirus\autodown.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.truthout.org/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\Compaq\EAB\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] c:\compaq\cpqsetup\cpqset.exe
O4 - HKLM\..\Run: [ChkAdmin] C:\PROGRA~1\Compaq\COMPAQ~1\CHKADMIN.EXE
O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\SBC Yahoo!\Connection Manager\IP InSight\IPMon32.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\Yahoo!\Antivirus\CAVTray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\Yahoo!\Antivirus\CAVRID.exe"
O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\RunServices: [CPQDFWAG] C:\WINNT\Cpqdiag\CpqDfwAg.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Wireless-G Notebook Adapter Utility.lnk = C:\Program Files\Linksys\Wireless-G Notebook Adapter\Startup.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {24D1BDCE-D835-11D6-BF84-0050047EA0E7} (BlueStream_Flash Class) - http://www.rovion.com/Controls/Rovion.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eB…l_v1-0-3-48.cab
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/Facebo…toUploader3.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer Wrapper) - http://chat.yahoo.com/cab/yvwrctl.cab
O23 - Service: Altiris Client Service (AClient) - Altiris, Inc. - C:\Altiris\AClient\AClient.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\ISafe.exe
O23 - Service: Compaq Local Alerter (CPQALERT) - Compaq Computer Corporation - C:\Program Files\Compaq\Compaq Management Agents\cpqalert.exe
O23 - Service: Compaq Remote Diagnostics Enabling Agent (CpqDfwWebAgent) - Compaq Computer Corporation - C:\WINNT\Cpqdiag\Cpqdfwag.exe
O23 - Service: cpqdmi - Compaq Computer Corporation - C:\PROGRA~1\Compaq\COMPAQ~1\cpqdmi.exe
O23 - Service: Compaq DMI Web Agent (cpqWebDmi) - Compaq Computer Corporation - C:\PROGRA~1\Compaq\COMPAQ~1\CPQWEB~1\WebDmi.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINNT\system32\drivers\KodakCCS.exe
O23 - Service: NICSer_WPC54G - Unknown owner - C:\Program Files\Linksys\Wireless-G Notebook Adapter\NICServ.exe
O23 - Service: ptssvc - KODAK - C:\Program Files\Kodak EasyShare software\bin\ptssvc.exe
O23 - Service: M-Audio Uno Installer (UnoInstallerService) - Unknown owner - C:\Program Files\M-Audio Uno\UnoInst.exe (file missing)
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
O23 - Service: Win32Sl (WIN32SL) - Intel - C:\Program Files\Compaq\Compaq Management Agents\Dmi\Win32\bin\Win32sl.exe
—————————————————————————————————————————————————————————————-

ComboFix 07-12-02.7 - Administrator 12/07/2007 23:02:04.4 - NTFSx86
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Administrator\Desktop\CFScript.txt

FILE
C:\Documents and Settings\Administrator\Desktop\spyware tools\SmitfraudFix.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\jwehyrmr1.dll
C:\My Downloads\newnet.exe
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq28.tmp\bar\1.bin\N2PLUGIN.DLL
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq28.tmp\bar\1.bin\ND2FNBAR.DLL
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq28.tmp\bar\1.bin\NPND2FN.DLL
C:\Program Files\Yahoo!\YPSR\Quarantine\ppqF.tmp\api.exe
C:\WINNT\SYSTEM32\dumphive.exe
C:\WINNT\SYSTEM32\Process.exe
C:\WINNT\SYSTEM32\SrchSTS.exe
C:\WINNT\SYSTEM32\VCCLSID.exe
C:\WINNT\SYSTEM32\WS2Fix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Administrator\Desktop\spyware tools\SmitfraudFix
C:\Documents and Settings\Administrator\Desktop\spyware tools\SmitfraudFix.exe
C:\Documents and Settings\Administrator\Desktop\spyware tools\SmitfraudFix\dumphive.exe
C:\Documents and Settings\Administrator\Desktop\spyware tools\SmitfraudFix\exit.exe
C:\Documents and Settings\Administrator\Desktop\spyware tools\SmitfraudFix\GenericRenosFix.exe
C:\Documents and Settings\Administrator\Desktop\spyware tools\SmitfraudFix\HostsChk.exe
C:\Documents and Settings\Administrator\Desktop\spyware tools\SmitfraudFix\Process.exe
C:\Documents and Settings\Administrator\Desktop\spyware tools\SmitfraudFix\Reboot.exe
C:\Documents and Settings\Administrator\Desktop\spyware tools\SmitfraudFix\restart.exe
C:\Documents and Settings\Administrator\Desktop\spyware tools\SmitfraudFix\SmitfraudFix.cmd
C:\Documents and Settings\Administrator\Desktop\spyware tools\SmitfraudFix\SmiUpdate.exe
C:\Documents and Settings\Administrator\Desktop\spyware tools\SmitfraudFix\SrchSTS.exe
C:\Documents and Settings\Administrator\Desktop\spyware tools\SmitfraudFix\swreg.exe
C:\Documents and Settings\Administrator\Desktop\spyware tools\SmitfraudFix\swsc.exe
C:\Documents and Settings\Administrator\Desktop\spyware tools\SmitfraudFix\swxcacls.exe
C:\Documents and Settings\Administrator\Desktop\spyware tools\SmitfraudFix\unzip.exe
C:\Documents and Settings\Administrator\Desktop\spyware tools\SmitfraudFix\VCCLSID.exe
C:\Documents and Settings\Administrator\Desktop\spyware tools\SmitfraudFix\WS2Fix.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\jwehyrmr1.dll
C:\My Downloads\newnet.exe
C:\WINNT\SYSTEM32\dumphive.exe
C:\WINNT\SYSTEM32\Process.exe
C:\WINNT\SYSTEM32\SrchSTS.exe
C:\WINNT\SYSTEM32\VCCLSID.exe
C:\WINNT\SYSTEM32\WS2Fix.exe

.
((((((((((((((((((((((((( Files Created from 2007-11-08 to 2007-12-08 )))))))))))))))))))))))))))))))
.

2007-12-05 03:17 . 07-12-05 03:17 d——– C:\WINNT\SYSTEM32\Kaspersky Lab
2007-12-05 03:17 . 07-12-05 03:17 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-12-03 02:46 . 07-12-07 01:08 643,040 —h—– C:\WINNT\ShellIconCache
2007-12-02 05:10 . 07-12-02 05:10 d——– C:\Deckard
2007-11-30 18:30 . 07-11-30 19:00 d——– C:\WINNT\SYSTEM32\ActiveScan
2007-11-29 13:03 . 07-11-29 13:03 d——– C:\Documents and Settings\All Users\Application Data\Grisoft
2007-11-29 13:03 . 07-11-29 13:03 d——– C:\Documents and Settings\Administrator\Application Data\Grisoft
2007-11-29 13:03 . 07-05-30 04:10 10,872 –a—— C:\WINNT\SYSTEM32\DRIVERS\AvgAsCln.sys
2007-11-29 11:39 . 07-12-03 08:46 3,442 –a—— C:\WINNT\SYSTEM32\tmp.reg
2007-11-28 10:32 . 07-11-28 10:32 22 –a—— C:\WINNT\kodakpcd.ini

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-04 06:09 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-28 21:15 ——— d—–w C:\Program Files\QuickTime
2007-11-28 17:05 ——— d—–w C:\Program Files\Common Files\Real
2007-11-28 17:00 ——— d–h–w C:\Documents and Settings\Administrator\Application Data\Move Networks
2007-11-21 05:47 ——— d—–w C:\Program Files\Kodak EasyShare software
2007-11-13 02:04 ——— d—a-w C:\Program Files\Java
2007-10-19 03:33 ——— d—–w C:\Program Files\MSXML 4.0
2007-10-18 07:15 ——— d—–w C:\Program Files\Kodak
2007-10-18 07:14 ——— d—–w C:\Program Files\Kodak Utilities
2007-10-18 07:14 ——— d—–w C:\Program Files\Common Files\Kodak
2007-10-18 07:07 ——— d—–w C:\Documents and Settings\All Users\Application Data\Kodak
2001-05-30 18:50 271 -c-ha-w C:\Program Files\DESKTOP.INI
2001-05-30 18:50 21,952 -c-ha-w C:\Program Files\FOLDER.HTT
2001-05-08 13:00 32,528 -c–a-w C:\WINNT\INF\WBFIRDMA.SYS
.

((((((((((((((((((((((((((((( snapshot@Mon 2007-12-03_22.02.36.70 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-05-24 20:27:16 213,048 —-a-w C:\WINNT\SYSTEM32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll
+ 2007-08-29 23:47:20 94,208 —-a-w C:\WINNT\SYSTEM32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
+ 2007-08-29 23:49:54 950,272 —-a-w C:\WINNT\SYSTEM32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [06-11-30 21:49 ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"="mobsync.exe" [03-06-19 11:05 C:\WINNT\SYSTEM32\mobsync.exe]
"ATIModeChange"="Ati2mdxx.exe" [02-04-01 19:19 C:\WINNT\SYSTEM32\Ati2mdxx.exe]
"AtiPTA"="atiptaxx.exe" [02-04-01 19:19 C:\WINNT\SYSTEM32\atiptaxx.exe]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [03-05-22 20:10 ]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [03-05-22 21:06 ]
"eabconfg.cpl"="C:\Program Files\Compaq\EAB\EabServr.exe" [02-04-09 10:49 ]
"Cpqset"="c:\compaq\cpqsetup\cpqset.exe" [02-04-30 14:41 ]
"ChkAdmin"="C:\PROGRA~1\Compaq\COMPAQ~1\CHKADMIN.EXE" [02-01-24 17:03 ]
"IPInSightMonitor 01"="C:\Program Files\SBC Yahoo!\Connection Manager\IP InSight\IPMon32.exe" [03-07-14 11:30 ]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [07-09-25 01:11 ]
"CaAvTray"="C:\Program Files\Yahoo!\Antivirus\CAVTray.exe" [06-07-07 13:47 ]
"CAVRID"="C:\Program Files\Yahoo!\Antivirus\CAVRID.exe" [06-07-07 13:47 ]
"YOP"="C:\PROGRA~1\Yahoo!\YOP\yop.exe" [05-04-22 18:49 ]
"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" []
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [05-08-11 15:30 ]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [07-06-11 01:25 ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"CPQDFWAG"="C:\WINNT\Cpqdiag\CpqDfwAg.exe" [01-11-19 07:12 ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"^SetupICWDesktop"="C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe" [03-06-19 11:05 ]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2000-01-21 00:15:54]
Wireless-G Notebook Adapter Utility.lnk - C:\Program Files\Linksys\Wireless-G Notebook Adapter\Startup.exe [2007-07-11 14:24:48]

R0 SONYPVM1;Sony Memory Stick Driver(SONYPVM1);C:\WINNT\system32\DRIVERS\SONYPVM1.SYS
R1 ClntMgmt;Compaq Client Management Driver;C:\WINNT\system32\Drivers\ClntMgmt.sys
R2 CpqDfwWebAgent;Compaq Remote Diagnostics Enabling Agent;C:\WINNT\Cpqdiag\Cpqdfwag.exe
R3 C4C_BSC2;C4C_BSC2;C:\WINNT\system32\DRIVERS\C4C_BSC2.sys
R3 odysseyIM3;Odyssey Network Services Miniport;C:\WINNT\system32\DRIVERS\odysseyIM3.sys
R3 openhci;Microsoft USB Open Host Controller Driver;C:\WINNT\system32\DRIVERS\openhci.sys
R3 usbhub20;USB 2.0 Root Hub Support;C:\WINNT\system32\DRIVERS\usbhub20.sys
S2 EmgicUsb;emagic USB kernel driver;C:\WINNT\system32\Drivers\EMGICUSB.sys
S3 CBTNDIS5;CBTNDIS5 NDIS Protocol Driver;\??\C:\WINNT\system32\CBTNDIS5.SYS
S3 ce3;Xircom CreditCard Ethernet Adapter 10/100 Driver;C:\WINNT\system32\DRIVERS\ce3n5.sys
S3 cirrus;cirrus;C:\WINNT\system32\DRIVERS\cirrus.sys
S3 EVOLUSB;%EVOL_USB.SvcDesc%;C:\WINNT\system32\drivers\maunousb.sys
S3 FBIKB_NT;FBIKB_NT;\??\C:\WINNT\System32\Drivers\FBIKB_NT.Sys
S3 N100;Compaq Ethernet or Fast Ethernet NIC NT Driver;C:\WINNT\system32\DRIVERS\n100nt5.sys

.
Contents of the 'Scheduled Tasks' folder
"2007-12-01 01:50:46 C:\WINNT\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-12-02 06:05:18 C:\WINNT\Tasks\Disk Cleanup.job"
- C:\WINNT\System32\cleanmgr.exe
.
**************************************************************************

catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-07 23:12:23
Windows 5.0.2195 Service Pack 4 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-07 23:17:37 - machine was rebooted
C:\ComboFix2.txt … 07-12-05 03:11
C:\ComboFix3.txt … 07-12-03 22:42
.
— E O F —

Scotty

Post #12December 8, 2007, 5:24 PM UTC

Hi

Congratulations, you appear to be malware free.

Time for some housekeeping

Click START then RUN
Now type Combofix /u in the runbox and click OK. Note the space between the x and the /u, it needs to be there.

[external image: Posted Image]
When shown the disclaimer, Select "2"

1 - Update Adobe Reader
Earlier versions of Adobe Reader have known security flaws so it is recommended that you update your copy

Go to Start > Control Panel > Add/Remove Programs
Remove ALL instances of Adobe Reader
Re-boot your computer as required.
Once ALL versions of Adobe Reader have been uninstalled, visit: www.adobe.com/uk/products/acrobat/readstep2.html and download the latest version of Adobe Reader

OR, after uninstalling Adobe Reader, you could try installing Foxit Reader from >here<
Foxit Reader has fewer add-ons therefore loads more quickly.

You need to open Add/Remove Programs and remove all instances of Java, Except Java™ 6 Update 3.

You may wish to keep hold of the Kaspersky Online Scan as an extra on-demand virus-scanner.
If not you can uninstall it through Start>Control Panel>Add/Remove Programs

Here are some free programs I recommend, although you will not need them all.

Spybot Search and Destroy
Download it from here . Just choose a mirror and off you go.
Find here the tutorial on how to use Spybot properly here

Install Spyware Guard
Download it from here
Find here the tutorial on how to use Spyware Guard here

Install SpyWare Blaster
Download it from here
Find here the tutorial on how to use Spyware Blaster here

Install WinPatrol
Download it from here
Here you can find information about how WinPatrol works here

Make sure your Windows is ALWAYS up to date!

An unpatched Windows is vulnerable and even with the "best" Antivirus and Firewall installed, malware will find its way through.
So visit http://windowsupdate.microsoft.com/ to download and install the latest updates.

Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.

Please check out Tony Klein's article "How did I get infected in the first place?"

Follow this list and your potential for being infected again will reduce dramatically.

I'd be grateful if you could reply to this post so that I know you have read it and, if you've no other questions, the thread can be closed.

Scotty

Post #13December 11, 2007, 5:09 PM UTC last edited December 13, 2007, 11:38 AM UTC

Reopened at request of topic starter.

Scotty

Post #14December 13, 2007, 11:41 AM UTC

Hello tapher Describe the problems you are currently having, please.

tapher

Post #15December 13, 2007, 8:40 PM UTC last edited December 14, 2007, 11:05 PM UTC

I began the prescribed steps, and whence removing Adobe Acrobat items via Control Panel's "add/remove programs" section, a final Adobe item would not or could not be removed. Upon rebooting numerous times, the Add/Remove programs window no longer populates; it just hangs open and does nothing, and doesn't allow me to close it either. Thanks again for your help, and for reopening this topic. UPDATE: At one boot, I had a "dr. watson" related error message, but it hasn't repeated itself. -Windows update icon appears in lower right, but progress remains at zero percent.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] Baseline HijackThis, AVG scan, as sticky instructed.

✨ Ask AI

Ask AI