What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Infected PC

254 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
C:\Documents and Settings\Annette.DAVIS-RATLIFF\Local Settings\Temporary Internet Files\Content.IE5\2Q284HJD\ComboFix[1].exe

I just noticed this.
You have combofix running from a temp folder.

You need to have it on your desktop or the fixes won't work. Please move it to your Desktop and run another scan.
Post #17
Hello, LDTate! Just wanted to take this time to let you know other things that is going on w/ my computer. For instance when I boot up, it seems that it takes my computer quite some time to boot all the way up. When I try to get on AOL it takes a while and in the middle of loading it stops loading and gives me a "Not Responding" message. Then then AOL screen goes to a completely white background. If I try to go to Yahoo it takes a while to load there as well. When I go to Yahoo Messenger it does the same thing. If I'm in Yahoo Messenger and trying to click on "My Profile" to edit it just seems to freezes up and/or run for the duration of the time I'm on my computer. Some times I just restart my computer to free up too much from running at one time. This is all I can think of for now. Please let me know if you need more information. I want to thank you for all of your help and patience for working diligently w/ me. I know you guy get a lot of frustrated people wanting quick answers. If I came off that way I want to apologize now. I love what you all do your members and non members. This is one of the best forums I've ever come across. To be honest it's one of the two I've ever really stuck with. I hope to be able to help out in these forums one day soon. Keep doing what you are doing and take all the praise in moderation for I know at times it gets hard working w/ us. LOL!!!
Post #20 last edited
I have tried to locate this temporary file and can't. Can you tell me how to locate it so I can send it to my desktop and promptly re-run the scan and forward it to you? Thanks, Denise9012
Post #21
Don't post your email address on any forums. The bad guys like to find them. :thumbup:

Do this:

  • Click START then RUN
  • Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.

    • [external image: Posted Image]


    Then:

    Download ComboFix from Here to your Desktop.

    **Note: In the event you already have Combofix, please delete it from your desktop and download this new version . It is important that it is saved directly to your desktop**
    ——————————————————————–
    • Close any open browsers and make sure you are disconnected from the net. Unplug the cable if need be before running combofix.
    • WARNING: IF you have not already done so Combofix will disconnect your machine from the Internet when it starts
    • Please do not re-connect your machine back to the Internet until Combofix has completely finished.
    ——————————————————————–

    Double click on combofix.exe & follow the prompts.
    When finished, it will produce a report for you.
    Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review

    ****Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze ****

    *If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.
Post #23

My computer says windows cannot find ComboFix /u.

OK. It must have been removed when we cleared the temp files.
Follow the download instructions :thumbup:
Post #24
ComboFix 08-01-11.3 - Annette 2008-01-12 10:03:05.2 - NTFSx86
Running from: C:\Documents and Settings\[removed]\Local Settings\Temporary Internet Files\Content.IE5\D7IPMJD7\ComboFix[1].exe
.

((((((((((((((((((((((((( Files Created from 2007-12-12 to 2008-01-12 )))))))))))))))))))))))))))))))
.

2008-01-10 20:05 . 2008-01-10 20:05 d——– C:\Logs
2008-01-10 18:37 . 2000-08-31 08:00 51,200 –a—— C:\WINDOWS\NirCmd.exe
2008-01-09 22:33 . 2008-01-09 22:33 d——– C:\Documents and Settings\Administrator\Application Data\Viewpoint
2008-01-07 21:09 . 2008-01-09 23:42 5,186 –a—— C:\WINDOWS\system32\tmp.reg
2008-01-07 20:22 . 2008-01-07 20:22 d——– C:\Documents and Settings\Annette.DAVIS-RATLIFF\Application Data\Grisoft
2008-01-07 20:19 . 2007-05-30 06:10 10,872 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-01-07 19:10 . 2007-09-05 23:22 289,144 –a—— C:\WINDOWS\system32\VCCLSID.exe
2008-01-07 19:10 . 2006-04-27 16:49 288,417 –a—— C:\WINDOWS\system32\SrchSTS.exe
2008-01-07 19:10 . 2007-12-20 23:11 81,920 –a—— C:\WINDOWS\system32\IEDFix.exe
2008-01-07 19:10 . 2003-06-05 20:13 53,248 –a—— C:\WINDOWS\system32\Process.exe
2008-01-07 19:10 . 2004-07-31 17:50 51,200 –a—— C:\WINDOWS\system32\dumphive.exe
2008-01-07 19:10 . 2007-10-03 23:36 25,600 –a—— C:\WINDOWS\system32\WS2Fix.exe
2008-01-07 12:36 . 2008-01-07 12:36 d——– C:\Documents and Settings\Annette.DAVIS-RATLIFF\Application Data\WeatherDPA
2008-01-07 12:36 . 2008-01-07 12:36 d——– C:\Documents and Settings\All Users\Application Data\2ACA5CC3-0F83-453D-A079-1076FE1A8B65
2007-12-24 01:09 . 2008-01-12 08:03 d——– C:\Documents and Settings\Annette.DAVIS-RATLIFF\Application Data\AVG7
2007-12-24 01:07 . 2007-12-25 08:00 d——– C:\Documents and Settings\LocalService\Application Data\AVG7
2007-12-24 01:05 . 2007-12-24 01:05 d——– C:\Documents and Settings\All Users\Application Data\Grisoft
2007-12-24 01:05 . 2007-12-24 06:10 d——– C:\Documents and Settings\All Users\Application Data\avg7

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-12 14:03 ——— d—–w C:\Documents and Settings\Annette.DAVIS-RATLIFF\Application Data\AOL Office
2008-01-12 13:53 ——— d—a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-01-12 04:34 ——— d—–w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-01-11 04:45 ——— d—–w C:\Program Files\Spyware Doctor
2008-01-01 15:30 ——— d—–w C:\Documents and Settings\All Users\Application Data\McAfee
2007-12-31 15:11 ——— d—–w C:\Documents and Settings\All Users\Application Data\AOL
2007-12-30 23:27 ——— d—–w C:\Documents and Settings\All Users\Application Data\AOL Downloads
2007-12-25 04:38 ——— d—–w C:\Program Files\lx_cats
2007-12-12 02:36 ——— d—–w C:\Program Files\XoftSpySE
2007-11-24 13:47 ——— d—–w C:\Program Files\America Online 9.0b
2007-11-20 06:27 ——— d—–w C:\Program Files\AOL Toolbar
2007-11-20 06:12 ——— d—–w C:\Program Files\AOL Deskbar
2007-11-20 06:10 ——— d—–w C:\Program Files\Common Files\AOL
2007-11-20 06:07 ——— d—–w C:\Program Files\Common Files\aolshare
2007-11-20 05:57 ——— d—–w C:\Program Files\AOL Office
2007-11-20 05:46 69,632 —-a-w C:\WINDOWS\uinst001.exe
2007-11-18 20:36 ——— d—–w C:\Documents and Settings\Annette.DAVIS-RATLIFF\Application Data\PC Tools
2007-11-18 16:51 ——— d—–w C:\Program Files\Picasa2
2007-11-18 14:02 ——— d—–w C:\Program Files\Google
2007-11-13 10:25 20,480 —-a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-07 09:26 721,920 —-a-w C:\WINDOWS\system32\lsasrv.dll
2007-11-07 09:26 721,920 —-a-w C:\WINDOWS\system32\dllcache\lsasrv.dll
2007-10-30 23:42 3,590,656 —-a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2007-10-30 17:20 360,064 —-a-w C:\WINDOWS\system32\dllcache\tcpip.sys
2007-10-29 22:43 1,287,680 —-a-w C:\WINDOWS\system32\quartz.dll
2007-10-29 22:43 1,287,680 —-a-w C:\WINDOWS\system32\dllcache\quartz.dll
2007-10-27 23:40 227,328 —-a-w C:\WINDOWS\system32\wmasf.dll
2007-10-27 23:40 227,328 —-a-w C:\WINDOWS\system32\dllcache\wmasf.dll
2007-10-26 03:34 8,460,288 —-a-w C:\WINDOWS\system32\dllcache\shell32.dll
.
Files Infected - Win32.Agent.zb
.

((((((((((((((((((((((((((((( snapshot@2008-01-10_20.20.37.48 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-01-11 00:50:13 241,664 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\NTUSER.DAT
+ 2008-01-12 15:51:05 241,664 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\NTUSER.DAT
- 2008-01-11 00:50:13 12,288 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
+ 2008-01-12 15:51:07 12,288 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
- 2008-01-11 00:50:13 241,664 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\NTUSER.DAT
+ 2008-01-12 15:51:13 241,664 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\NTUSER.DAT
- 2008-01-11 00:50:13 12,288 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
+ 2008-01-12 15:51:14 12,288 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
- 2008-01-11 00:50:14 3,485,696 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\ntuser.dat
+ 2008-01-12 15:51:54 3,493,888 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\ntuser.dat
- 2008-01-11 00:50:14 393,216 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
+ 2008-01-12 15:51:56 401,408 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Power2GoExpress"="" []
"AOLUpdate"="C:\Program Files\AOL Update\AolAgnt.exe" [2004-03-29 00:38 326656]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-03-27 14:22 4670968]
"googletalk"="C:\Program Files\Google\Google Talk\googletalk.exe" [2007-01-01 15:22 3739648]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:00 15360]
"AOL Pictures Screensaver"="C:\Program Files\AOL Pictures Screensaver\10_4_0_4\ygpsstra2.exe" [2006-10-19 16:28 177752]
"DW4"="C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe" [2007-03-16 06:51 715888]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2007-08-13 18:04 5562368]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-11-18 07:53 68856]
"AOL Fast Start"="C:\Program Files\America Online 9.0b\AOL.exe" [2005-07-12 06:17 50776]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2004-02-26 02:53 65024 C:\WINDOWS\SOUNDMAN.EXE]
"HostManager"="C:\Program Files\Common Files\AOL\1119719136\ee\AOLSoftware.exe" [2006-09-25 18:52 50736]
"AOLDialer"="C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" [2006-10-23 06:50 71216]
"AOL Spyware Protection"="C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe" [2004-10-18 15:42 79448]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-06-25 11:07 98304]
"Pure Networks Port Magic"="C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" [2004-04-05 15:33 99480]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 02:43 83608]
"AOLSPScheduler"="C:\Program Files\Common Files\AOL\1119719136\ee\services\sscAntiSpywarePlugin\ver1_10_3_1\AOLSP Scheduler.exe" [2005-11-30 09:40 8808]
"sscRun"="C:\Program Files\Common Files\AOL\1119719136\ee\services\sscFirewallPlugin\ver1_10_3_1\SSCRun.exe" [2005-11-30 09:40 136808]
"OASClnt"="C:\Program Files\mcafee.com\antivirus\oasclnt.exe" [ ]
"EmailScan"="C:\Program Files\mcafee.com\antivirus\mcvsescn.exe" [ ]
"googletalk"="C:\Program Files\Google\Google Talk\googletalk.exe" [2007-01-01 15:22 3739648]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 17:20 866584]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="C:\Program Files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 15:48 479232]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-07-21 16:33 185896]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 02:06 40048]
"lxcrmon.exe"="C:\Program Files\Lexmark 2400 Series\lxcrmon.exe" [2006-03-06 11:48 286720]
"EzPrint"="C:\Program Files\Lexmark 2400 Series\ezprint.exe" [2006-02-06 23:10 98304]
"FaxCenterServer"="C:\Program Files\Lexmark Fax Solutions\fm3032.exe" [2006-02-02 02:11 290816]
"LXCRCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCRtime.dll" [2006-02-24 05:54 65536]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-11-18 08:17 29744]
"SDTray"="C:\Program Files\Spyware Doctor\SDTrayApp.exe" [2007-10-02 16:27 1065288]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-12-25 03:13 579072]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 03:25 6731312]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2003-07-15 04:53 34880]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2007-08-13 18:04 5562368]

C:\Documents and Settings\Annette.DAVIS-RATLIFF\Start Menu\Programs\Startup\
AOL Office .lnk - C:\Program Files\AOL Office\program\quickstart.exe [2004-03-01 07:03:00]
Magnifier.lnk - C:\WINDOWS\system32\magnify.exe [2004-08-27 11:09:34]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2007-11-18 07:53:05]
Push Client.LNK - C:\Program Files\Interwise\Student\pull.exe [2005-06-25 11:23:07]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoInternetIcon"= 1 (0x1)


.
Contents of the 'Scheduled Tasks' folder
"2008-01-12 13:48:10 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
"2008-01-11 21:00:01 C:\WINDOWS\Tasks\Norton Security Scan.job"
- C:\Program Files\Norton Security Scan\Nss.exe
"2008-01-12 13:44:53 C:\WINDOWS\Tasks\XoftSpySE 2.job"
- C:\Program Files\XoftSpySE\XoftSpy.exe
"2007-12-25 14:32:18 C:\WINDOWS\Tasks\XoftSpySE.job"
- C:\Program Files\XoftSpySE\XoftSpy.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-12 10:57:41
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-12 11:20:41
ComboFix-quarantined-files.txt 2008-01-12 17:19:43
ComboFix2.txt 2008-01-11 02:23:32
.
2008-01-10 23:59:45 — E O F —
Post #25
C:\Documents and Settings\Annette.DAVIS-RATLIFF\Local Settings\Temporary Internet Files\Content.IE5\D7IPMJD7\ComboFix[1].exe

You saved it to Temporary Internet Files
Post #27

I don't know how it keep getting to TIF. It doesn't ask when where would i like for it to go. It just does it own thing.

OK. Go to where's it at now.
Right Click on Combofix.exe <–Select CUT
Go to your desktop and Right Click any open area and select Paste

Now you should see it on your desktop. It's a Red Circle with a White X
Post #28
HI, LDTate! Since I can't locate it now. I will run it again. Then go to settings in my Internet Options and Cut/Paste it to my desktop. Denise
Post #29
If you just Right Click on the Red HERE, chose save target as. You can direct it to the desktop.

Download ComboFix from Here to your Desktop.

**Note: In the event you already have Combofix, please delete it from your desktop and download this new version . It is important that it is saved directly to your desktop**
——————————————————————–
  • Close any open browsers and make sure you are disconnected from the net. Unplug the cable if need be before running combofix.
  • WARNING: IF you have not already done so Combofix will disconnect your machine from the Internet when it starts
  • Please do not re-connect your machine back to the Internet until Combofix has completely finished.
——————————————————————–

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review

****Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze ****

*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.
Post #30

HI, LDTate!

Since I can't locate it now. I will run it again. Then go to settings in my Internet Options and Cut/Paste it to my desktop.

Denise

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI