Spyware / Malware / Virus Removal

[Resolved] Help! Slow computer and constant popups

5 min read

Looking for the outcome? Ask AI

ja1983 Topic Starter

Post #1December 1, 2007, 3:07 PM UTC

My computer has definitely been attacked by something. It's been running quite slow and generating constant popups. More recently I've been experiencing desktop freezes. Please help me! Logs are below:

———————————————————
AVG Anti-Spyware - Scan Report
———————————————————

+ Created at: 12:23:30 AM 12/1/2007

+ Scan result:

C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP138\A0024418.exe -> Adware.Agent : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\WR -> Adware.Generic : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP141\A0026560.exe -> Downloader.Tiny.id : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP139\A0024475.exe -> Not-A-Virus.Downloader.Win32.DigStream : Cleaned with backup (quarantined).

::Report end

Logfile of HijackThis v1.99.1
Scan saved at 9:19:29 AM, on 12/1/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\WINDOWS\system32\dllhost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PccGuide.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\WINDOWS\system32\LXSUPMON.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\winshow.exe
C:\WINDOWS\io43mvuiw4kj.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Trend Micro\Internet Security 14\TMAS_OE\TMAS_OEMon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Palm\HOTSYNC.EXE
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\Jacquelyn\Desktop\HJT log\HJT.EXE.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {4A54500A-65FE-4F4A-B860-20EAE2F577F9} - C:\WINDOWS\system32\qomkijh.dll
O2 - BHO: (no name) - {5612A038-6621-4C56-821C-F6D7F4DAEA62} - C:\WINDOWS\system32\sstqp.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: {cb6ae38e-9983-f5da-c904-54564506853e} - {e3586054-6545-409c-ad5f-3899e83ea6bc} - C:\WINDOWS\system32\vdkfyiir.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [ShowLOMControl]
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\printray.exe
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\system32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [LexStart] lexstart.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe"
O4 - HKLM\..\Run: [winshow] "C:\WINDOWS\winshow.exe"
O4 - HKLM\..\Run: [io43mvuiw4kj] C:\WINDOWS\io43mvuiw4kj.exe
O4 - HKLM\..\Run: [84ac2c63] rundll32.exe "C:\WINDOWS\system32\llaletip.dll",b
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\RunOnce: [SpybotDeletingA8393] command /c del "C:\WINDOWS\system32\drivers\core.cache.dsk_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5073] cmd /c del "C:\WINDOWS\system32\drivers\core.cache.dsk_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingA8972] command /c del "C:\WINDOWS\system32\drivers\core.sys_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingC9984] cmd /c del "C:\WINDOWS\system32\drivers\core.sys_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKCU\..\Run: [OE_OEM] "C:\Program Files\Trend Micro\Internet Security 14\TMAS_OE\TMAS_OEMon.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE
O4 - Startup: TA_Start.lnk = C:\WINDOWS\system32\ksdsrngq.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www2.snapfish.com/SnapfishActivia.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: c:\windows\system32\ldcore.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: IntelWireless - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll
O20 - Winlogon Notify: qomkijh - C:\WINDOWS\SYSTEM32\qomkijh.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

IndiGenus

Post #2December 3, 2007, 10:34 PM UTC last edited December 3, 2007, 10:35 PM UTC

Hi ja1983 and welcome to the forums.

My name is Dave. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can sometimes take a while to research so please be patient and I'd be grateful if you would note the following:

I will working be on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for this issue on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.

You are quite infected with several nasties.

Please download SDFix and save it to your Desktop.

You should print out these instructions, or copy them to a NotePad file for reading while in Safe Mode, because you will not be able to connect to the Internet to read from this site.

Double click on SDFix.exe. It should automatically extract a folder called SDFix to your system drive (usually C:\). Please reboot your computer in Safe Mode by doing the following :

Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, a menu with options should appear;
Select the first option, to run Windows in Safe Mode, then press "Enter".
Choose your usual account.

Open the SDFix folder and double click on RunThis.bat to start the script.
Type Y and press Enter to begin the script.
It will start cleaning your PC and then prompt you to press any key to Reboot.
Press any key to restart the PC.
Your system will take longer than normal to restart as the fixtool will be removing files.
When the desktop loads the Fixtool will complete the removal and display Finished.
Press any key to end the script and to load your desktop icons.
A text file should automatically open, so please copy the contents and post them here. We also need you to post a new HijackThis log

————————————

Download and Run ComboFix

Download this file from below:
Here
Disable your Anti-virus and any real-time Anti-spyware monitors that are running.
Then double click Combofix.exe & follow the prompts.
When finished, it will produce a log for you. Post that log in your next reply with a new HijackThis log.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
Note 2: Remember to re-enable your Anti-virus and Anti-spyware.

NOTE: If you have issues connecting to your network or internet after running combofix you can either simply reboot, or do the following:
* Going to Control Panel > Network Connections.
* Right click on their Network icons & select "Repair"
or
Alternately, if the Network icon appears in the notification area in the lower right corner of Desktop, right-click it, and then click Repair from the shortcut menu.

ja1983

Post #3December 6, 2007, 4:09 AM UTC

Sorry for the delay. Work has been crazy. While waiting for a response to my initial post I've been searching for solutions and tried a couple. However, I was still getting lots of popups. When I run PC-cillin Adware_DigInk, Adware_EnBrowser, Troj_Vundo.WO, Troj_Agent keeps popping up even though I've deleted it previously. Still getting popups as I post this. I've run the things you suggested and the logs are below. Thanks for the help!! I really need it.

SDFix: Version 1.117

Run by [removed] on Wed 12/05/2007 at 10:38 PM

Microsoft Windows XP [Version 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:

Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting…

Normal Mode:
Checking Files:

No Trojan Files Found

Removing Temp Files…

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.

Final Check:

catchme 0.3.1262.1 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-05 22:45:37
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden services & system hive …

scanning hidden registry entries …

scanning hidden files …

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

Remaining Services:
——————

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\\Program Files\\Palm\\HOTSYNC.EXE"="C:\\Program Files\\Palm\\HOTSYNC.EXE:*:Disabled:HotSync® Manager Application"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

Remaining Files:
—————

Files with Hidden Attributes:

Tue 23 May 2006 88 A.SHR — "C:\i386\EB62764080.sys"
Tue 23 May 2006 2,828 A.SH. — "C:\i386\KGyGaAvL.sys"
Wed 20 Dec 2006 104 ..SHR — "C:\WINDOWS\system32\80407662EB.sys"
Fri 14 Sep 2007 88 ..SHR — "C:\WINDOWS\system32\EB62764080.sys"
Fri 14 Sep 2007 7,518 A.SH. — "C:\WINDOWS\system32\KGyGaAvL.sys"
Thu 29 Jun 2006 575,488 …H. — "C:\Documents and Settings\Jacquelyn\Desktop\~WRL1099.tmp"
Thu 15 Feb 2007 36,864 …H. — "C:\Documents and Settings\Jacquelyn\Desktop\~WRL1221.tmp"
Sat 20 Nov 2004 35,328 A..H. — "C:\Documents and Settings\Jacquelyn\Desktop\JOBS\~WRL2936.tmp"
Sun 12 Dec 2004 47,104 A..H. — "C:\Documents and Settings\Jacquelyn\Desktop\JOBS\~WRL3607.tmp"
Mon 26 Jun 2006 28,160 A..H. — "C:\Documents and Settings\Jacquelyn\Desktop\JOBS\Job Applications\2006\~WRL1930.tmp"
Mon 26 Jun 2006 19,968 A..H. — "C:\Documents and Settings\Jacquelyn\Desktop\JOBS\Job Applications\2006\~WRL3003.tmp"
Mon 26 Jun 2006 28,672 A..H. — "C:\Documents and Settings\Jacquelyn\Desktop\JOBS\Job Applications\2006\~WRL3933.tmp"
Tue 11 Apr 2006 27,648 A..H. — "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\DV421 HIV and emerging threats\~WRL0003.tmp"
Mon 22 May 2006 46,592 A..H. — "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\DV421 HIV and emerging threats\~WRL2303.tmp"
Mon 22 May 2006 34,816 A..H. — "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\DV421 HIV and emerging threats\~WRL2899.tmp"
Wed 8 Mar 2006 35,840 A..H. — "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\EH411 Epidemics\~WRL0752.tmp"
Thu 9 Mar 2006 44,544 A..H. — "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\EH411 Epidemics\~WRL1510.tmp"
Tue 2 May 2006 344,064 A..H. — "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\EH411 Epidemics\~WRL1530.tmp"
Tue 2 May 2006 288,768 A..H. — "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\EH411 Epidemics\~WRL1559.tmp"
Tue 2 May 2006 397,312 A..H. — "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\EH411 Epidemics\~WRL1663.tmp"
Tue 2 May 2006 296,960 A..H. — "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\EH411 Epidemics\~WRL1743.tmp"
Thu 9 Mar 2006 47,104 A..H. — "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\EH411 Epidemics\~WRL1786.tmp"
Tue 2 May 2006 296,448 A..H. — "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\EH411 Epidemics\~WRL1807.tmp"
Thu 9 Mar 2006 44,032 A..H. — "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\EH411 Epidemics\~WRL2319.tmp"
Thu 9 Mar 2006 46,592 A..H. — "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\EH411 Epidemics\~WRL2883.tmp"
Tue 2 May 2006 264,704 A..H. — "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\EH411 Epidemics\~WRL3375.tmp"
Thu 9 Mar 2006 43,520 A..H. — "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\EH411 Epidemics\~WRL3847.tmp"
Tue 2 May 2006 380,416 A..H. — "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\EH411 Epidemics\~WRL3937.tmp"
Wed 3 May 2006 74,240 A..H. — "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\Personal revision\~WRL1393.tmp"
Wed 3 May 2006 84,480 A..H. — "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\Personal revision\~WRL2253.tmp"
Tue 2 May 2006 78,848 A..H. — "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\Personal revision\~WRL2359.tmp"
Tue 2 May 2006 50,688 A..H. — "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\Personal revision\~WRL2398.tmp"
Wed 3 May 2006 104,448 A..H. — "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\Personal revision\~WRL2591.tmp"
Tue 2 May 2006 64,512 A..H. — "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\Personal revision\~WRL2872.tmp"
Wed 3 May 2006 89,088 A..H. — "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\Personal revision\~WRL3462.tmp"
Tue 2 May 2006 69,120 A..H. — "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\Personal revision\~WRL3558.tmp"
Tue 2 May 2006 69,120 A..H. — "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\Personal revision\~WRL3675.tmp"
Tue 2 May 2006 57,856 A..H. — "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\Personal revision\~WRL3759.tmp"
Wed 3 May 2006 102,400 A..H. — "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\Personal revision\~WRL4034.tmp"
Tue 25 Apr 2006 25,600 A..H. — "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\SO455 BIOS\~WRL0123.tmp"
Tue 25 Apr 2006 26,624 A..H. — "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\SO455 BIOS\~WRL0124.tmp"
Tue 25 Apr 2006 23,552 A..H. — "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\SO455 BIOS\~WRL0199.tmp"
Tue 25 Apr 2006 19,968 A..H. — "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\SO455 BIOS\~WRL0235.tmp"
Tue 25 Apr 2006 32,768 A..H. — "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\SO455 BIOS\~WRL1390.tmp"
Tue 25 Apr 2006 27,648 A..H. — "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\SO455 BIOS\~WRL1978.tmp"
Tue 25 Apr 2006 36,864 A..H. — "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\SO455 BIOS\~WRL2317.tmp"
Sat 15 Apr 2006 42,496 A..H. — "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\SO455 BIOS\~WRL2948.tmp"
Wed 19 Apr 2006 64,000 A..H. — "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\SO455 BIOS\~WRL3116.tmp"
Tue 25 Apr 2006 29,696 A..H. — "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\SO455 BIOS\~WRL3149.tmp"
Tue 25 Apr 2006 24,064 A..H. — "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\SO455 BIOS\~WRL3167.tmp"
Tue 25 Apr 2006 26,624 A..H. — "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\SO455 BIOS\~WRL3694.tmp"
Tue 25 Apr 2006 19,968 A..H. — "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\SO455 BIOS\~WRL3969.tmp"
Wed 14 Mar 2007 30,208 …H. — "C:\Documents and Settings\Jacquelyn\Desktop\JOBS\Job Applications\2007\Abt Associates\~WRL0005.tmp"
Tue 7 Dec 2004 27,136 A..H. — "C:\Documents and Settings\Jacquelyn\My Documents\School\BUCKNELL\Fall 2004\hinduism\~WRL0001.tmp"
Wed 3 May 2006 74,240 A..H. — "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\EH411 Epidemics\Personal revision\~WRL1393.tmp"
Wed 3 May 2006 84,480 A..H. — "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\EH411 Epidemics\Personal revision\~WRL2253.tmp"
Tue 2 May 2006 78,848 A..H. — "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\EH411 Epidemics\Personal revision\~WRL2359.tmp"
Tue 2 May 2006 50,688 A..H. — "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\EH411 Epidemics\Personal revision\~WRL2398.tmp"
Wed 3 May 2006 104,448 A..H. — "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\EH411 Epidemics\Personal revision\~WRL2591.tmp"
Tue 2 May 2006 64,512 A..H. — "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\EH411 Epidemics\Personal revision\~WRL2872.tmp"
Wed 3 May 2006 89,088 A..H. — "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\EH411 Epidemics\Personal revision\~WRL3462.tmp"
Tue 2 May 2006 69,120 A..H. — "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\EH411 Epidemics\Personal revision\~WRL3558.tmp"
Tue 2 May 2006 69,120 A..H. — "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\EH411 Epidemics\Personal revision\~WRL3675.tmp"
Tue 2 May 2006 57,856 A..H. — "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\EH411 Epidemics\Personal revision\~WRL3759.tmp"
Wed 3 May 2006 102,400 A..H. — "C:\Documents and Settings\Jacquelyn\My Documents\School\LSE\EH411 Epidemics\Personal revision\~WRL4034.tmp"
Sat 15 Sep 2007 8 A..H. — "C:\Documents and Settings\Daniel\Application Data\Gtek\GTUpdate\AUpdate\Channels\ch_u1\lock.tmp"
Sat 15 Sep 2007 8 A..H. — "C:\Documents and Settings\Daniel\Application Data\Gtek\GTUpdate\AUpdate\Channels\ch_u2\lock.tmp"
Sat 15 Sep 2007 8 A..H. — "C:\Documents and Settings\Daniel\Application Data\Gtek\GTUpdate\AUpdate\Channels\ch_u3\lock.tmp"
Sat 15 Sep 2007 8 A..H. — "C:\Documents and Settings\Daniel\Application Data\Gtek\GTUpdate\AUpdate\Channels\ch_u4\lock.tmp"
Fri 13 Apr 2007 8 A..H. — "C:\Documents and Settings\Jacquelyn\Application Data\Gtek\GTUpdate\AUpdate\Channels\ch_u1\lock.tmp"
Fri 13 Apr 2007 8 A..H. — "C:\Documents and Settings\Jacquelyn\Application Data\Gtek\GTUpdate\AUpdate\Channels\ch_u2\lock.tmp"
Sat 14 Apr 2007 8 A..H. — "C:\Documents and Settings\Jacquelyn\Application Data\Gtek\GTUpdate\AUpdate\Channels\ch_u3\lock.tmp"
Fri 20 Apr 2007 8 A..H. — "C:\Documents and Settings\Jacquelyn\Application Data\Gtek\GTUpdate\AUpdate\Channels\ch_u4\lock.tmp"

Finished!

——————————————————————-

ComboFix 07-12-02.6 - Jacquelyn 2007-12-05 22:50:54.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.92 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2007-11-06 to 2007-12-06 )))))))))))))))))))))))))))))))
.

2007-12-05 22:50 . 2007-12-05 22:50 268 –ah—– C:\sqmdata14.sqm
2007-12-05 22:50 . 2007-12-05 22:50 244 –ah—– C:\sqmnoopt14.sqm
2007-12-05 22:37 . 2007-12-05 22:38 d——– C:\WINDOWS\ERUNT
2007-12-05 21:56 . 2007-12-05 21:56 d——– C:\Documents and Settings\Administrator\Application Data\Grisoft
2007-12-05 20:25 . 2007-12-05 20:25 268 –ah—– C:\sqmdata13.sqm
2007-12-05 20:25 . 2007-12-05 20:25 244 –ah—– C:\sqmnoopt13.sqm
2007-12-03 06:49 . 2007-12-03 06:49 268 –ah—– C:\sqmdata12.sqm
2007-12-03 06:49 . 2007-12-03 06:49 244 –ah—– C:\sqmnoopt12.sqm
2007-12-02 21:08 . 2007-12-02 21:08 268 –ah—– C:\sqmdata11.sqm
2007-12-02 21:08 . 2007-12-02 21:08 244 –ah—– C:\sqmnoopt11.sqm
2007-12-02 18:40 . 2007-12-05 22:22 d——– C:\VundoFix Backups
2007-12-02 16:33 . 2007-12-02 17:28 d——– C:\Documents and Settings\Jacquelyn\.housecall6.6
2007-12-02 11:58 . 2007-12-02 11:58 268 –ah—– C:\sqmdata10.sqm
2007-12-02 11:58 . 2007-12-02 11:58 244 –ah—– C:\sqmnoopt10.sqm
2007-12-01 10:02 . 2007-12-01 10:02 268 –ah—– C:\sqmdata09.sqm
2007-12-01 10:02 . 2007-12-01 10:02 244 –ah—– C:\sqmnoopt09.sqm
2007-12-01 09:36 . 2007-12-01 09:36 268 –ah—– C:\sqmdata08.sqm
2007-12-01 09:36 . 2007-12-01 09:36 244 –ah—– C:\sqmnoopt08.sqm
2007-12-01 09:29 . 2007-12-01 09:29 268 –ah—– C:\sqmdata07.sqm
2007-12-01 09:29 . 2007-12-01 09:29 244 –ah—– C:\sqmnoopt07.sqm
2007-11-30 23:07 . 2007-11-30 23:07 d——– C:\Documents and Settings\Jacquelyn\Application Data\Grisoft
2007-11-30 23:06 . 2007-11-30 23:06 d——– C:\Documents and Settings\All Users\Application Data\Grisoft
2007-11-30 23:06 . 2007-05-30 07:10 10,872 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-11-30 22:18 . 2007-12-05 22:15 d——– C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-30 14:02 . 2007-11-30 14:03 d——– C:\Program Files\CCleaner
2007-11-30 13:34 . 2007-12-02 17:03 143 –a—— C:\WINDOWS\system32\mcrh.tmp
2007-11-30 13:07 . 2007-12-02 11:07 794,136 —hs—- C:\WINDOWS\system32\pitelall.ini
2007-11-30 12:39 . 2007-11-30 12:39 d——– C:\Documents and Settings\Jacquelyn\Application Data\Uniblue
2007-11-26 22:33 . 2007-11-26 23:36 d——– C:\Program Files\Enigma Software Group
2007-11-26 19:54 . 2007-11-30 22:52 d——– C:\Documents and Settings\All Users\Application Data\Rabio
2007-11-26 19:10 . 2007-12-02 21:08 d——– C:\Temp
2007-11-17 13:41 . 2007-11-17 13:41 d——– C:\Documents and Settings\All Users\Application Data\Apple
2007-11-17 13:39 . 2004-08-10 05:00 49,680 –a—— C:\WINDOWS\twunk_16.exe
2007-11-17 13:39 . 2004-08-10 05:00 49,680 –a—— C:\WINDOWS\system32\dllcache\twunk_16.exe
2007-11-16 12:20 . 2007-11-16 12:20 208,896 –a—— C:\WINDOWS\io43mvuiw4kj.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-17 18:41 ——— d—–w C:\Program Files\Apple Software Update
2007-11-06 01:22 ——— d–h–w C:\Documents and Settings\Jacquelyn\Application Data\Move Networks
2007-10-26 03:34 8,460,288 —-a-w C:\WINDOWS\system32\dllcache\shell32.dll
2007-09-14 22:33 7,518 –sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2007-09-12 18:52 53,248 —-a-w C:\WINDOWS\hg173.exe
2007-09-12 18:50 53,248 —-a-w C:\WINDOWS\df87173.exe
2006-07-28 13:21 251 —-a-w C:\Program Files\wt3d.ini
2006-06-16 14:27 44,608 —-a-w C:\Documents and Settings\Jacquelyn\Application Data\GDIPFONTCACHEV1.DAT
2003-08-05 15:41 53,248 —-a-w C:\WINDOWS\inf\ap561.exe
2002-11-26 20:24 32,768 —-a-w C:\WINDOWS\inf\Remove561.exe
2002-11-22 19:56 118,784 —-a-w C:\WINDOWS\inf\ShowBmp.exe
2002-10-29 22:07 36,864 —-a-w C:\WINDOWS\inf\Setup8a.exe
2002-10-01 18:43 119,798 —-a-w C:\WINDOWS\inf\spca561.sys
2006-12-20 18:50 104 –sh–r C:\WINDOWS\system32\80407662EB.sys
.

((((((((((((((((((((((((((((( snapshot@2007-12-02_21.14.04.82 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-12-06 01:19:42 163,328 —-a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
+ 2007-12-06 03:38:26 5,156,864 —-a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000001\NTUSER.DAT
+ 2007-12-06 03:38:27 143,360 —-a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000002\UsrClass.dat
+ 2007-12-06 01:19:42 163,328 —-a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2007-12-06 03:38:08 5,156,864 —-a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000001\NTUSER.DAT
+ 2007-12-06 03:38:08 143,360 —-a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000002\UsrClass.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OE_OEM"="C:\Program Files\Trend Micro\Internet Security 14\TMAS_OE\TMAS_OEMon.exe" [2006-11-01 10:08]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 05:00]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 11:54]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-09-29 14:01]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-10-14 20:49]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-10-14 20:46]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-10-14 20:50]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-11-29 04:56]
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2004-10-30 14:59]
"SigmatelSysTrayApp"="stsystra.exe" [2005-09-09 23:19 C:\WINDOWS\stsystra.exe]
"DMXLauncher"="C:\Program Files\Dell\Media Experience\DMXLauncher.exe" [2005-10-05 03:12]
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2005-12-15 10:44]
"ShowLOMControl"="1 (0x1)" []
"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 10:44]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 10:44]
"DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-09-08 05:20]
"PrinTray"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\printray.exe" [2000-06-07 12:32]
"LXSUPMON"="C:\WINDOWS\system32\LXSUPMON.exe" [2000-06-07 13:01]
"LexStart"="lexstart.exe" []
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 08:41]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-05-26 11:45]
"pccguide.exe"="C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe" [2006-12-15 17:51]
"io43mvuiw4kj"="C:\WINDOWS\io43mvuiw4kj.exe" [2007-11-16 12:20]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 21:05:26]
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2006-05-01 01:16:55]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-12 20:01:04]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
C:\Program Files\Intel\Wireless\Bin\LgNotify.dll 2004-09-07 16:08 110592 C:\Program Files\Intel\Wireless\Bin\LgNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"= c:\windows\system32\ldcore.dll

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}]
\Shell\AutoRun\command - E:\setup.exe

.
Contents of the 'Scheduled Tasks' folder
"2007-11-17 18:41:08 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-05 22:52:40
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-05 22:53:22
C:\ComboFix2.txt … 2007-12-02 21:14
.
— E O F —

Logfile of HijackThis v1.99.1
Scan saved at 10:54:20 PM, on 12/5/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\WINDOWS\system32\dllhost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PccGuide.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\WINDOWS\system32\LXSUPMON.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\io43mvuiw4kj.exe
C:\Program Files\Trend Micro\Internet Security 14\TMAS_OE\TMAS_OEMon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Jacquelyn\My Documents\HJT log\HJT.EXE.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [ShowLOMControl]
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\printray.exe
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\system32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [LexStart] lexstart.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe"
O4 - HKLM\..\Run: [io43mvuiw4kj] C:\WINDOWS\io43mvuiw4kj.exe
O4 - HKCU\..\Run: [OE_OEM] "C:\Program Files\Trend Micro\Internet Security 14\TMAS_OE\TMAS_OEMon.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www2.snapfish.com/SnapfishActivia.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: c:\windows\system32\ldcore.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: IntelWireless - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

IndiGenus

Post #4December 6, 2007, 7:24 PM UTC

1. Please open Notepad

Click Start , then Run
Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

File::
C:\sqmdata14.sqm
C:\sqmnoopt14.sqm
C:\sqmdata13.sqm
C:\sqmnoopt13.sqm
C:\sqmdata12.sqm
C:\sqmnoopt12.sqm
C:\sqmdata11.sqm
C:\sqmnoopt11.sqm
C:\sqmdata10.sqm
C:\sqmnoopt10.sqm
C:\sqmdata09.sqm
C:\sqmnoopt09.sqm
C:\sqmdata08.sqm
C:\sqmnoopt08.sqm
C:\sqmdata07.sqm
C:\sqmnoopt07.sqm
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\pitelall.ini
C:\WINDOWS\io43mvuiw4kj.exe
c:\windows\system32\ldcore.dll

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"io43mvuiw4kj"=-
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=-

3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

[external image: Posted Image]

5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

Combofix.txt
A new HijackThis log.

ja1983

Post #5December 7, 2007, 12:13 AM UTC

New logs!

ComboFix 07-12-02.6 - Jacquelyn 2007-12-06 18:52:35.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.78 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Jacquelyn\Desktop\CFScript.txt
* Created a new restore point

FILE
C:\sqmdata07.sqm
C:\sqmdata08.sqm
C:\sqmdata09.sqm
C:\sqmdata10.sqm
C:\sqmdata11.sqm
C:\sqmdata12.sqm
C:\sqmdata13.sqm
C:\sqmdata14.sqm
C:\sqmnoopt07.sqm
C:\sqmnoopt08.sqm
C:\sqmnoopt09.sqm
C:\sqmnoopt10.sqm
C:\sqmnoopt11.sqm
C:\sqmnoopt12.sqm
C:\sqmnoopt13.sqm
C:\sqmnoopt14.sqm
C:\WINDOWS\io43mvuiw4kj.exe
c:\windows\system32\ldcore.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\pitelall.ini
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\sqmdata07.sqm
C:\sqmdata08.sqm
C:\sqmdata09.sqm
C:\sqmdata10.sqm
C:\sqmdata11.sqm
C:\sqmdata12.sqm
C:\sqmdata13.sqm
C:\sqmdata14.sqm
C:\sqmnoopt07.sqm
C:\sqmnoopt08.sqm
C:\sqmnoopt09.sqm
C:\sqmnoopt10.sqm
C:\sqmnoopt11.sqm
C:\sqmnoopt12.sqm
C:\sqmnoopt13.sqm
C:\sqmnoopt14.sqm
C:\WINDOWS\io43mvuiw4kj.exe
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\pitelall.ini

.
((((((((((((((((((((((((( Files Created from 2007-11-06 to 2007-12-06 )))))))))))))))))))))))))))))))
.

2007-12-06 18:47 . 2007-12-06 18:47 268 –ah—– C:\sqmdata15.sqm
2007-12-06 18:47 . 2007-12-06 18:47 244 –ah—– C:\sqmnoopt15.sqm
2007-12-05 22:37 . 2007-12-05 22:38 d——– C:\WINDOWS\ERUNT
2007-12-05 21:56 . 2007-12-05 21:56 d——– C:\Documents and Settings\Administrator\Application Data\Grisoft
2007-12-02 18:40 . 2007-12-05 22:22 d——– C:\VundoFix Backups
2007-12-02 16:33 . 2007-12-02 17:28 d——– C:\Documents and Settings\Jacquelyn\.housecall6.6
2007-11-30 23:07 . 2007-11-30 23:07 d——– C:\Documents and Settings\Jacquelyn\Application Data\Grisoft
2007-11-30 23:06 . 2007-11-30 23:06 d——– C:\Documents and Settings\All Users\Application Data\Grisoft
2007-11-30 23:06 . 2007-05-30 07:10 10,872 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-11-30 22:18 . 2007-12-05 22:15 d——– C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-30 14:02 . 2007-11-30 14:03 d——– C:\Program Files\CCleaner
2007-11-30 12:39 . 2007-11-30 12:39 d——– C:\Documents and Settings\Jacquelyn\Application Data\Uniblue
2007-11-26 22:33 . 2007-11-26 23:36 d——– C:\Program Files\Enigma Software Group
2007-11-26 19:54 . 2007-11-30 22:52 d——– C:\Documents and Settings\All Users\Application Data\Rabio
2007-11-26 19:10 . 2007-12-02 21:08 d——– C:\Temp
2007-11-17 13:41 . 2007-11-17 13:41 d——– C:\Documents and Settings\All Users\Application Data\Apple
2007-11-17 13:39 . 2004-08-10 05:00 49,680 –a—— C:\WINDOWS\twunk_16.exe
2007-11-17 13:39 . 2004-08-10 05:00 49,680 –a—— C:\WINDOWS\system32\dllcache\twunk_16.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-17 18:41 ——— d—–w C:\Program Files\Apple Software Update
2007-11-06 01:22 ——— d–h–w C:\Documents and Settings\Jacquelyn\Application Data\Move Networks
2007-10-26 03:34 8,460,288 —-a-w C:\WINDOWS\system32\dllcache\shell32.dll
2007-09-14 22:33 7,518 –sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2007-09-12 18:52 53,248 —-a-w C:\WINDOWS\hg173.exe
2007-09-12 18:50 53,248 —-a-w C:\WINDOWS\df87173.exe
2006-07-28 13:21 251 —-a-w C:\Program Files\wt3d.ini
2006-06-16 14:27 44,608 —-a-w C:\Documents and Settings\Jacquelyn\Application Data\GDIPFONTCACHEV1.DAT
2003-08-05 15:41 53,248 —-a-w C:\WINDOWS\inf\ap561.exe
2002-11-26 20:24 32,768 —-a-w C:\WINDOWS\inf\Remove561.exe
2002-11-22 19:56 118,784 —-a-w C:\WINDOWS\inf\ShowBmp.exe
2002-10-29 22:07 36,864 —-a-w C:\WINDOWS\inf\Setup8a.exe
2002-10-01 18:43 119,798 —-a-w C:\WINDOWS\inf\spca561.sys
2006-12-20 18:50 104 –sh–r C:\WINDOWS\system32\80407662EB.sys
.

((((((((((((((((((((((((((((( snapshot@2007-12-02_21.14.04.82 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-12-06 01:19:42 163,328 —-a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
+ 2007-12-06 03:38:26 5,156,864 —-a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000001\NTUSER.DAT
+ 2007-12-06 03:38:27 143,360 —-a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000002\UsrClass.dat
+ 2007-12-06 01:19:42 163,328 —-a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2007-12-06 03:38:08 5,156,864 —-a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000001\NTUSER.DAT
+ 2007-12-06 03:38:08 143,360 —-a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000002\UsrClass.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OE_OEM"="C:\Program Files\Trend Micro\Internet Security 14\TMAS_OE\TMAS_OEMon.exe" [2006-11-01 10:08]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 05:00]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 11:54]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-09-29 14:01]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-10-14 20:49]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-10-14 20:46]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-10-14 20:50]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-11-29 04:56]
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2004-10-30 14:59]
"SigmatelSysTrayApp"="stsystra.exe" [2005-09-09 23:19 C:\WINDOWS\stsystra.exe]
"DMXLauncher"="C:\Program Files\Dell\Media Experience\DMXLauncher.exe" [2005-10-05 03:12]
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2005-12-15 10:44]
"ShowLOMControl"="1 (0x1)" []
"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 10:44]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 10:44]
"DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-09-08 05:20]
"PrinTray"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\printray.exe" [2000-06-07 12:32]
"LXSUPMON"="C:\WINDOWS\system32\LXSUPMON.exe" [2000-06-07 13:01]
"LexStart"="lexstart.exe" []
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 08:41]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-05-26 11:45]
"pccguide.exe"="C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe" [2006-12-15 17:51]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 21:05:26]
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2006-05-01 01:16:55]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-12 20:01:04]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
C:\Program Files\Intel\Wireless\Bin\LgNotify.dll 2004-09-07 16:08 110592 C:\Program Files\Intel\Wireless\Bin\LgNotify.dll

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}]
\Shell\AutoRun\command - E:\setup.exe

.
Contents of the 'Scheduled Tasks' folder
"2007-11-17 18:41:08 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-06 18:55:25
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-06 18:55:59
C:\ComboFix2.txt … 2007-12-05 22:53
C:\ComboFix3.txt … 2007-12-02 21:14
.
— E O F —

Logfile of HijackThis v1.99.1
Scan saved at 7:08:15 PM, on 12/6/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\WINDOWS\system32\LXSUPMON.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe
C:\Program Files\Trend Micro\Internet Security 14\TMAS_OE\TMAS_OEMon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Jacquelyn\My Documents\HJT log\HJT.EXE.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [ShowLOMControl]
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\printray.exe
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\system32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [LexStart] lexstart.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe"
O4 - HKCU\..\Run: [OE_OEM] "C:\Program Files\Trend Micro\Internet Security 14\TMAS_OE\TMAS_OEMon.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www2.snapfish.com/SnapfishActivia.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: IntelWireless - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

IndiGenus

Post #6December 7, 2007, 12:23 AM UTC

Looks good, how's it running? I would recommend you update and run full system scans with both your AVG AS and Trend Micro AV.

ja1983

Post #7December 7, 2007, 6:42 PM UTC

It seems to be running fine. I dont have popups anymore. I ran AV software and TrendMicro picked up Trojan.Downloader file in the qoobox/quarantine folder. I was reading that this is part of Combofix? If everything seems alright otherwise should I uninstall combofix or leave it? Thanks so much for all the help!!

IndiGenus

Post #8December 7, 2007, 7:09 PM UTC

Yes, qoobox is combofix quarantine. Combofix has a nice "self destruct" utility the does several things for us, see below.

Time for some housekeeping

Click START then RUN
Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.
- [external image: Posted Image]
When shown the disclaimer, Select "2"

The above procedure will:

Delete the following:
- ComboFix and its associated files and folders.
- VundoFix backups, if present
- The C:\Deckard folder, if present
- The C:_OtMoveIt folder, if present
Reset the clock settings.
Hide file extensions, if required.
Hide System/Hidden files, if required.
Reset System Restore.

————————————

Here are some other things to be aware of now that you are clean.

Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly or set your computer to receive automatic updates. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.
A tutorial on installing & using this product can be found here:
Using SpywareBlaster to protect your computer from Spyware and Malware

Install SpywareGuard - SpywareGuard provides a real-time protection solution against spyware that is a great addition to SpywareBlaster's protection method.
A tutorial on installing & using this product can be found here:
Using SpywareGuard to protect your computer from Spyware and Malware

Use IESpy-Ad -
IESpy-Ad will block access to malicious websites so you cannot be redirected to them from an infected site or email. Instructions for set up and use can be found at the website.

Update all of your Anti-Malware programs regularly - Make sure you update all the programs I have listed and the ones you are currently running regularly. Without regular updates you Will Not be protected when new malicious programs are released.

Here is a great link to a post here on securing your PC after an attack.
http://forums.tomcoyote.org/index.php?show…mp;#entry257163

Good luck,
Dave

IndiGenus

Post #9December 12, 2007, 4:53 PM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] Help! Slow computer and constant popups

✨ Ask AI

Ask AI