What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] MY COMPUTER MESSED

16 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #17
i don't think it matters wot scanner i use becoz i got quite alot of files on my pc….. i don't know why but there is this random .tmp file. it just generated on my pc and theres about 2000 copies of the file. the files called pos1a.tmp and another thing is my msn program won't start up. it says the shortcuts invalid and i need to locate it.
Post #18
heres the eset scan log: # version=4 # OnlineScanner.ocx=1.0.0.56 # OnlineScannerDLLA.dll=1, 0, 0, 51 # OnlineScannerDLLW.dll=1, 0, 0, 51 # OnlineScannerUninstaller.exe=1, 0, 0, 49 # vers_standard_module=2787 (20080112) # vers_arch_module=1.061 (20080110) # vers_adv_heur_module=1.064 (20070717) # EOSSerial=3ac9e426c4c6ed41bd7ce292ac032ee5 # end=finished # remove_checked=false # unwanted_checked=false # utc_time=2008-01-13 03:11:11 # local_time=2008-01-13 03:11:11 (+0000, GMT Standard Time) # country="United Kingdom" # osver=5.1.2600 NT Service Pack 2 # scanned=464355 # found=2 # scan_time=4840 C:\QooBox\Quarantine\C\WINDOWS\system32\geebc.exe.vir Win32/TrojanDropper.Agent.DGO virus 00000000000000000000000000000000 C:\QooBox\Quarantine\C\WINDOWS\system32\ssttt.exe.vir Win32/TrojanDropper.Agent.DGO virus 00000000000000000000000000000000 ive got alot more viruses in my avg vault……
Post #19
Those files are all infected files. Please do as follows


A. Empty your AVG Quarantine

B. UNINSTALL ComboFix:

Click START then RUN
Now type Combofix /u in the runbox and click OK


  • [external image: Posted Image]


C. Next download and run an updated of ComboFix from the links previously provided. Now post the log and do not disconnect your computer or use it until all of this is cleaned up.


Trevuren
Post #21
combofix log:

ComboFix 08-01-13.1 - Z.ALI 2008-01-13 19:59:37.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.575 [GMT 0:00]
Running from: C:\Documents and Settings\[removed]\Desktop\comp\ComboFix.exe
Command switches used :: and Settings\Z.ALI\Desktop\comp\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier .exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\ssttt.dll
C:\WINDOWS\system32\ssttt.exe
C:\WINDOWS\system32\tttss.ini
C:\WINDOWS\system32\tttss.ini2

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier .exe —> QooBox
.
.
((((((((((((((((((((((((( Files Created from 2007-12-13 to 2008-01-13 )))))))))))))))))))))))))))))))
.

2008-01-13 19:58 . 2000-08-31 08:00 51,200 –a—— C:\WINDOWS\NirCmd.exe
2008-01-13 19:43 . 2008-01-13 19:52 d——– C:\Program Files\Password Door
2008-01-13 19:43 . 2008-01-13 20:03 70,824 –a—— C:\WINDOWS\system32\PDoor.dat
2008-01-13 15:54 . 2008-01-13 15:54 d——– C:\WINDOWS\system32\Samsung_USB_Drivers
2008-01-13 15:54 . 2005-08-30 01:49 94,000 –a—— C:\WINDOWS\system32\drivers\ssm_mdm.sys
2008-01-13 15:54 . 2005-08-30 01:47 58,320 –a—— C:\WINDOWS\system32\drivers\ssm_bus.sys
2008-01-13 15:54 . 2005-08-13 05:06 22,486 -ra—— C:\WINDOWS\system32\UnInstall_Driver.ico
2008-01-13 15:54 . 2005-08-30 01:49 8,336 –a—— C:\WINDOWS\system32\drivers\ssm_mdfl.sys
2008-01-13 15:54 . 2005-08-30 01:49 6,176 –a—— C:\WINDOWS\system32\drivers\ssm_cmnt.sys
2008-01-13 15:54 . 2005-08-30 01:49 6,176 –a—— C:\WINDOWS\system32\drivers\ssm_cm.sys
2008-01-13 15:54 . 2005-08-30 01:47 5,840 –a—— C:\WINDOWS\system32\drivers\ssm_whnt.sys
2008-01-13 15:54 . 2005-08-30 01:47 5,840 –a—— C:\WINDOWS\system32\drivers\ssm_wh.sys
2008-01-13 15:53 . 2008-01-13 15:53 d——– C:\Program Files\Samsung
2008-01-13 15:53 . 2006-03-21 15:49 2,729,472 –a—— C:\WINDOWS\system32\fun_avcodec.dll
2008-01-13 15:53 . 2006-04-18 16:32 684,032 –a—— C:\WINDOWS\system32\fun_mp4_enc.dll
2008-01-13 15:53 . 2006-04-11 16:49 671,744 –a—— C:\WINDOWS\system32\FunDecFilter.ax
2008-01-13 15:53 . 2006-04-11 13:13 532,480 –a—— C:\WINDOWS\system32\FunEncFilter.ax
2008-01-13 15:53 . 2006-04-06 11:28 77,824 –a—— C:\WINDOWS\system32\fun_mp4_dec.dll
2008-01-13 13:49 . 2008-01-13 15:11 d——– C:\Program Files\EsetOnlineScanner
2008-01-12 23:15 . 2008-01-12 23:15 d——– C:\WINDOWS\system32\Kaspersky Lab
2008-01-12 23:15 . 2008-01-12 23:15 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-01-12 21:42 . 2008-01-12 21:42 92 –a—— C:\WINDOWS\wininit.ini
2008-01-12 20:52 . 2008-01-12 20:52 d——– C:\Program Files\Enigma Software Group
2008-01-12 16:44 . 2008-01-12 16:44 d——– C:\WINDOWS\ERUNT
2008-01-12 16:40 . 2008-01-12 16:40 15,360 –a–c— C:\WINDOWS\system32\dllcache\ctfmon.exe
2008-01-12 16:40 . 2008-01-12 16:40 15,360 –a—— C:\WINDOWS\system32\ctfmon.exe
2008-01-08 00:28 . 2008-01-08 19:50 d——– C:\Documents and Settings\Z.ALI\Application Data\Ahead
2008-01-07 23:39 . 2008-01-11 22:32 d——– C:\Program Files\QuickTime
2008-01-07 23:35 . 2008-01-11 22:32 d——– C:\Program Files\iTunes
2008-01-07 23:28 . 2008-01-07 23:28 d——– C:\Program Files\Windows Installer Clean Up
2008-01-07 23:26 . 2008-01-07 23:28 d——– C:\Program Files\MSECACHE
2007-12-28 17:56 . 2007-12-28 17:56 d——– C:\WINDOWS\system32\undefined
2007-12-28 17:42 . 2007-12-28 17:46 d–hsc— C:\Program Files\Common Files\WindowsLiveInstaller
2007-12-28 17:42 . 2007-12-28 17:42 d——– C:\Documents and Settings\All Users\Application Data\WLInstaller
2007-12-25 02:03 . 2008-01-07 21:16 d——– C:\Documents and Settings\Z.ALI\Application Data\DivX
2007-12-19 00:02 . 2007-12-19 00:19 d——– C:\Program Files\Navilog1
2007-12-18 22:19 . 2007-12-18 22:19 d——– C:\Documents and Settings\Z.ALI\Application Data\The Labyrinth Plus! Edition
2007-12-18 22:02 . 2007-12-18 22:02 d——– C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2007-12-18 22:01 . 2007-12-18 23:25 d——– C:\Program Files\SUPERAntiSpyware

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-13 20:07 17,408 —-a-w C:\WINDOWS\system32\drivers\USBCRFT.SYS
2008-01-13 20:03 16,655 —-a-w C:\WINDOWS\system32\drivers\PDoor.sys
2008-01-13 15:54 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-01-13 01:08 ——— d—–w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-01-12 21:49 ——— d—–w C:\Documents and Settings\All Users\Application Data\Avg7
2008-01-12 21:42 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-01-12 20:48 ——— d—a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-01-12 20:48 ——— d—–w C:\Program Files\Spyware Doctor
2008-01-11 15:00 ——— d—–w C:\Program Files\Norton Security Scan
2008-01-10 17:13 ——— d—–w C:\Documents and Settings\Z.ALI\Application Data\AVG7
2008-01-10 17:11 ——— d—–w C:\Documents and Settings\All Users\Application Data\Grisoft
2008-01-10 16:49 ——— d—–w C:\Documents and Settings\Guest\Application Data\AVG7
2008-01-09 23:55 ——— d—–w C:\Documents and Settings\Z.ALI\Application Data\U3
2008-01-09 17:59 ——— d—–w C:\Program Files\Lx_cats
2008-01-07 23:35 ——— d—–w C:\Program Files\iPod
2008-01-07 23:34 ——— d—–w C:\Program Files\Apple Software Update
2008-01-07 22:33 ——— d—–w C:\Program Files\NCH Swift Sound
2008-01-07 22:31 ——— d—–w C:\Program Files\Sony
2008-01-07 21:49 ——— d—–w C:\Program Files\DivX
2007-12-28 17:47 ——— d—–w C:\Program Files\MSN Messenger
2007-12-28 17:42 ——— d—–w C:\Program Files\Windows Live
2007-12-28 15:57 ——— d—–w C:\Program Files\Windows Live Safety Center
2007-12-23 00:02 ——— d—–w C:\Documents and Settings\All Users\Application Data\DVD Shrink
2007-12-22 17:14 ——— d—–w C:\Program Files\Messenger Plus! Live
2007-12-18 23:25 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2007-12-05 16:27 ——— d—–w C:\Documents and Settings\Z.ALI\Application Data\FLV Extract
2007-11-30 23:42 ——— d—–w C:\Documents and Settings\Z.ALI\Application Data\Virgin Broadband
2007-11-30 23:35 ——— d—–w C:\Program Files\Common Files\Scanner
2007-11-30 23:24 ——— d—–w C:\Program Files\Raxco
2007-11-30 23:24 ——— d—–w C:\Program Files\Common Files\Authentium
2007-11-30 23:24 ——— d—–w C:\Program Files\CA
2007-11-30 23:24 ——— d—–w C:\Documents and Settings\All Users\Application Data\Raxco
2007-11-30 23:23 ——— d—–w C:\Program Files\Virgin Broadband
2007-11-30 23:23 ——— d—–w C:\Documents and Settings\All Users\Application Data\Virgin Broadband
2007-11-30 23:20 ——— d—–w C:\Documents and Settings\Z.ALI\Application Data\InstallShield
2007-11-30 23:14 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2007-11-30 23:12 ——— d—–w C:\Documents and Settings\Guest\Application Data\Virgin Broadband
2007-11-30 18:30 ——— d—–w C:\Program Files\Common Files\DVDVideoSoft
2007-11-24 17:57 ——— d—–w C:\Documents and Settings\Z.ALI\Application Data\Nokia
2007-11-16 17:37 ——— d—–w C:\Documents and Settings\Z.ALI\Application Data\Talkback
2007-11-13 10:25 20,480 —-a-w C:\WINDOWS\system32\drivers\secdrv.sys
2006-10-15 18:19 63,352 —-a-w C:\Documents and Settings\Z.ALI\Application Data\GDIPFONTCACHEV1.DAT
2006-04-01 16:39 284 -c–a-w C:\Documents and Settings\Z.ALI\Application Data\ViewerApp.dat
2005-02-09 14:13 5,224 –sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2007-09-13 17:35 16,384 –sha-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
2007-09-13 17:35 16,384 –sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
2007-09-13 17:35 32,768 –sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-01-12 16:40 15360]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2008-01-13 19:52 748032]
"AGRSMMSG"="AGRSMMSG.exe" [2005-03-04 11:01 88209 C:\WINDOWS\AGRSMMSG.exe]
"Dit"="Dit.exe" [2004-07-20 18:18 90112 C:\WINDOWS\Dit.exe]
"LXBUCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBUtime.dll" [2004-09-10 11:55 69632]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-01-13 19:52 1110016]
"Password Door Loader"="C:\PROGRA~1\PASSWO~1\tlpd.exe" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-01-12 16:40 15360]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2005-04-25 13:45 36040]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-01-10 17:11 219136]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, zwebauth.dll
path=
backup=

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\-FreedomNeedsReboot]
–a—— 2007-09-05 14:10 13552 C:\Program Files\Virgin Broadband\PCguard\ZkRunOnceR.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
–a—— 2005-06-06 22:46 57344 C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
–a—— 2007-10-10 19:51 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Broadbandadvisor.exe]
–a—— 2007-08-07 18:49 2061552 C:\Program Files\Virgin Broadband\advisor\Broadbandadvisor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EzPrint]
–a—— 2004-09-17 13:24 61440 C:\Program Files\Lexmark 6200 Series\ezprint.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FaxCenterServer]
–a—— 2004-09-22 10:18 299008 C:\Program Files\Lexmark Fax Solutions\fm3032.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechGalleryRepair]
–a—— 2002-06-20 11:26 155648 C:\Program Files\Logitech\ImageStudio\ISStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechImageStudioTray]
–a—— 2002-06-20 11:25 45056 C:\Program Files\Logitech\ImageStudio\LogiTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoRepair]
–a—— 2005-06-08 14:24 458752 C:\Program Files\Logitech\Video\ISStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoTray]
–a—— 2005-06-08 14:14 217088 C:\Program Files\Logitech\Video\LogiTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lxbumon.exe]
–a—— 2004-09-22 10:43 188416 C:\Program Files\Lexmark 6200 Series\lxbumon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
–a—— 2001-07-09 10:50 155648 C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCguard]
–a—— 2007-09-05 14:10 310000 C:\Program Files\Virgin Broadband\PCguard\Rps.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService]
–a—— 2005-02-04 11:48 118926 C:\Program Files\Home Cinema\PowerCinema\PCMService.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
–a—— 2004-11-02 20:24 32768 C:\Program Files\Home Cinema\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
–a—— 2008-01-11 22:32 430080 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Wireless Manager]
–a—— 2007-09-07 12:06 585728 C:\Program Files\Virgin Broadband Wireless\Wireless Manager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
C:\Program Files\Windows Media Player\WMPNSCFG.exe

R1 PasswordDoor;PasswordDoor;C:\WINDOWS\system32\drivers\PDoor.sys [2008-01-13 20:03]
R2 AffinegyService;AffinegyService;"C:\Program Files\Virgin Broadband Wireless\AffinegyService.exe" [2007-09-07 11:58]
R3 3xHybrid;3xHybrid service;C:\WINDOWS\system32\DRIVERS\3xHybrid.sys [2005-02-01 00:33]
R3 cmudax;C-Media High Definition Audio Interface;C:\WINDOWS\system32\drivers\cmudax.sys [2005-05-12 13:39]
R3 wbscr;Winbond Smartcard Reader for I/O;C:\WINDOWS\system32\drivers\wbscr.sys [2002-04-24 12:07]
S3 AFGSp50;AFGSp50 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\AFGSp50.sys [2007-05-22 12:27]
S3 BTNetFilter;Bluetooth Network Filter;C:\WINDOWS\system32\drivers\BTNetFilter.sys [2004-12-16 16:32]
S3 CardReaderFilter;Card Reader Filter;C:\WINDOWS\system32\Drivers\USBCRFT.SYS [2008-01-13 20:07]
S3 PhilCam8116;Logitech QuickCam Pro 3000(PID_08B0);C:\WINDOWS\system32\DRIVERS\CamDrL21.sys [2002-06-10 13:16]
S3 Radialpoint Security Services;Virgin Broadband PCguard;C:\WINDOWS\system32\dllhost.exe [2004-08-04 12:00]

.
Contents of the 'Scheduled Tasks' folder
"2008-01-07 23:34:48 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-02-12 17:25:48 C:\WINDOWS\Tasks\MP Scheduled Quick Scan.job"
- C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MpCmdRun.exe%Scan -RestrictPrivileges -ScanType 1
"2008-01-11 15:04:34 C:\WINDOWS\Tasks\Norton Security Scan.job"
- C:\Program Files\Norton Security Scan\Nss.exe
"2008-01-13 20:05:06 C:\WINDOWS\Tasks\RegCure Program Check.job"
- C:\Program Files\RegCure\RegCure.exe
"2007-12-25 21:03:43 C:\WINDOWS\Tasks\RegCure.job"
- C:\Program Files\RegCure\RegCure.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-13 20:06:36
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-13 20:11:43 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-13 20:11:39
.
2008-01-09 20:07:13 — E O F —
Post #22
A. Empty all Quarantines on your system.

B.
1. Please open Notepad
  • Click Start , then Run
  • Type notepad .exe in the Run Box.
2. Now copy/paste the entire content of the codebox below into the Notepad window:

KillAll::

File::
C:\WINDOWS\pss\Google Updater.lnkCommon Startup

Driver::
PasswordDoor

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WMPNSCFG"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Password Door Loader"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
[-HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Save the above as CFScript.txt

4. Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.

5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

[external image: Posted Image]

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

6. ComboFix will automatically REBOOT your machine when the KillAll:: switch is used..

7. Next, re-enable all the programs that you disabled prior to running ComboFix.

8. Post the following logs/Reports:
  • ComboFix.txt
  • Fresh HijackThis log run after all the other tools have performed their cleanup.
CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.


C. Please rerun the following online Antivirus program. This time we will have it remove everything suspicious.

Please use the Eset NOD32 Online Anti-Virus scanner and Removal Tool

Note: This tool requires the use of Internet Explorer and is Vista compatible

Please click HERE to start the process
  • Place a checkmark in the box beside "Terms of Service", then click "Start".
  • On the next scree, "Click" where prompted to install the required ActiveX Control.
  • Acknowledge the Security Warning in the next window by Clicking the "Install" button.
  • Press the "START" button on the Welcome Screen.
  • A download progress bar will then inform you on the status of your download.
  • Once the initialization is complete, place a checkmark beside "Remove found threats", then click "Scan".
  • When the tool has finished, under the Details Tab, you will find a list of items found and deleted.
  • No log will be made available for posting in your reply.


D. Please post back the new ComboFix log, the report from Eset and a fresh HijackThis log.


Note: You will have to UNINSTALL then reinstall the following programs:

GoogleToolbarNotifier
Windows Media Player
Password Door
Post #25
combofix log:


ComboFix 08-01-13.1 - Z.ALI 2008-01-13 22:12:58.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.544 [GMT 0:00]
Running from: C:\Documents and Settings\[removed]\Desktop\comp\ComboFix.exe
Command switches used :: C:\Documents and Settings\Z.ALI\Desktop\comp\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE
C:\WINDOWS\pss\Google Updater.lnkCommon Startup
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\pss\Google Updater.lnkCommon Startup

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
——-\LEGACY_PASSWORDDOOR
——-\PasswordDoor


((((((((((((((((((((((((( Files Created from 2007-12-13 to 2008-01-13 )))))))))))))))))))))))))))))))
.

2008-01-13 20:47 . 2008-01-13 20:47 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-01-13 20:47 . 2008-01-13 20:47 1,409 –a—— C:\WINDOWS\QTFont.for
2008-01-13 19:58 . 2000-08-31 08:00 51,200 –a—— C:\WINDOWS\NirCmd.exe
2008-01-13 19:43 . 2008-01-13 19:52 d——– C:\Program Files\Password Door
2008-01-13 19:43 . 2008-01-13 22:18 70,824 –a—— C:\WINDOWS\system32\PDoor.dat
2008-01-13 15:54 . 2008-01-13 15:54 d——– C:\WINDOWS\system32\Samsung_USB_Drivers
2008-01-13 15:54 . 2005-08-30 01:49 94,000 –a—— C:\WINDOWS\system32\drivers\ssm_mdm.sys
2008-01-13 15:54 . 2005-08-30 01:47 58,320 –a—— C:\WINDOWS\system32\drivers\ssm_bus.sys
2008-01-13 15:54 . 2005-08-13 05:06 22,486 -ra—— C:\WINDOWS\system32\UnInstall_Driver.ico
2008-01-13 15:54 . 2005-08-30 01:49 8,336 –a—— C:\WINDOWS\system32\drivers\ssm_mdfl.sys
2008-01-13 15:54 . 2005-08-30 01:49 6,176 –a—— C:\WINDOWS\system32\drivers\ssm_cmnt.sys
2008-01-13 15:54 . 2005-08-30 01:49 6,176 –a—— C:\WINDOWS\system32\drivers\ssm_cm.sys
2008-01-13 15:54 . 2005-08-30 01:47 5,840 –a—— C:\WINDOWS\system32\drivers\ssm_whnt.sys
2008-01-13 15:54 . 2005-08-30 01:47 5,840 –a—— C:\WINDOWS\system32\drivers\ssm_wh.sys
2008-01-13 15:53 . 2008-01-13 15:53 d——– C:\Program Files\Samsung
2008-01-13 15:53 . 2006-03-21 15:49 2,729,472 –a—— C:\WINDOWS\system32\fun_avcodec.dll
2008-01-13 15:53 . 2006-04-18 16:32 684,032 –a—— C:\WINDOWS\system32\fun_mp4_enc.dll
2008-01-13 15:53 . 2006-04-11 16:49 671,744 –a—— C:\WINDOWS\system32\FunDecFilter.ax
2008-01-13 15:53 . 2006-04-11 13:13 532,480 –a—— C:\WINDOWS\system32\FunEncFilter.ax
2008-01-13 15:53 . 2006-04-06 11:28 77,824 –a—— C:\WINDOWS\system32\fun_mp4_dec.dll
2008-01-13 13:49 . 2008-01-13 15:11 d——– C:\Program Files\EsetOnlineScanner
2008-01-12 23:15 . 2008-01-12 23:15 d——– C:\WINDOWS\system32\Kaspersky Lab
2008-01-12 23:15 . 2008-01-12 23:15 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-01-12 21:42 . 2008-01-12 21:42 92 –a—— C:\WINDOWS\wininit.ini
2008-01-12 20:52 . 2008-01-12 20:52 d——– C:\Program Files\Enigma Software Group
2008-01-12 16:44 . 2008-01-12 16:44 d——– C:\WINDOWS\ERUNT
2008-01-12 16:40 . 2008-01-12 16:40 15,360 –a–c— C:\WINDOWS\system32\dllcache\ctfmon.exe
2008-01-12 16:40 . 2008-01-12 16:40 15,360 –a—— C:\WINDOWS\system32\ctfmon.exe
2008-01-08 00:28 . 2008-01-08 19:50 d——– C:\Documents and Settings\Z.ALI\Application Data\Ahead
2008-01-07 23:39 . 2008-01-11 22:32 d——– C:\Program Files\QuickTime
2008-01-07 23:35 . 2008-01-11 22:32 d——– C:\Program Files\iTunes
2008-01-07 23:28 . 2008-01-07 23:28 d——– C:\Program Files\Windows Installer Clean Up
2008-01-07 23:26 . 2008-01-07 23:28 d——– C:\Program Files\MSECACHE
2007-12-28 17:56 . 2007-12-28 17:56 d——– C:\WINDOWS\system32\undefined
2007-12-28 17:42 . 2007-12-28 17:46 d–hsc— C:\Program Files\Common Files\WindowsLiveInstaller
2007-12-28 17:42 . 2007-12-28 17:42 d——– C:\Documents and Settings\All Users\Application Data\WLInstaller
2007-12-25 02:03 . 2008-01-07 21:16 d——– C:\Documents and Settings\Z.ALI\Application Data\DivX
2007-12-19 00:02 . 2007-12-19 00:19 d——– C:\Program Files\Navilog1
2007-12-18 22:19 . 2007-12-18 22:19 d——– C:\Documents and Settings\Z.ALI\Application Data\The Labyrinth Plus! Edition
2007-12-18 22:02 . 2007-12-18 22:02 d——– C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2007-12-18 22:01 . 2007-12-18 23:25 d——– C:\Program Files\SUPERAntiSpyware

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-13 22:21 17,408 —-a-w C:\WINDOWS\system32\drivers\USBCRFT.SYS
2008-01-13 22:18 16,655 —-a-w C:\WINDOWS\system32\drivers\PDoor.sys
2008-01-13 15:54 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-01-13 01:08 ——— d—–w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-01-12 21:49 ——— d—–w C:\Documents and Settings\All Users\Application Data\Avg7
2008-01-12 21:42 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-01-12 20:48 ——— d—a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-01-12 20:48 ——— d—–w C:\Program Files\Spyware Doctor
2008-01-11 15:00 ——— d—–w C:\Program Files\Norton Security Scan
2008-01-10 17:13 ——— d—–w C:\Documents and Settings\Z.ALI\Application Data\AVG7
2008-01-10 17:11 ——— d—–w C:\Documents and Settings\All Users\Application Data\Grisoft
2008-01-10 16:49 ——— d—–w C:\Documents and Settings\Guest\Application Data\AVG7
2008-01-09 23:55 ——— d—–w C:\Documents and Settings\Z.ALI\Application Data\U3
2008-01-09 17:59 ——— d—–w C:\Program Files\Lx_cats
2008-01-07 23:35 ——— d—–w C:\Program Files\iPod
2008-01-07 23:34 ——— d—–w C:\Program Files\Apple Software Update
2008-01-07 22:33 ——— d—–w C:\Program Files\NCH Swift Sound
2008-01-07 22:31 ——— d—–w C:\Program Files\Sony
2008-01-07 21:49 ——— d—–w C:\Program Files\DivX
2007-12-28 17:47 ——— d—–w C:\Program Files\MSN Messenger
2007-12-28 17:42 ——— d—–w C:\Program Files\Windows Live
2007-12-28 15:57 ——— d—–w C:\Program Files\Windows Live Safety Center
2007-12-23 00:02 ——— d—–w C:\Documents and Settings\All Users\Application Data\DVD Shrink
2007-12-22 17:14 ——— d—–w C:\Program Files\Messenger Plus! Live
2007-12-18 23:25 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2007-12-05 16:27 ——— d—–w C:\Documents and Settings\Z.ALI\Application Data\FLV Extract
2007-11-30 23:42 ——— d—–w C:\Documents and Settings\Z.ALI\Application Data\Virgin Broadband
2007-11-30 23:35 ——— d—–w C:\Program Files\Common Files\Scanner
2007-11-30 23:24 ——— d—–w C:\Program Files\Raxco
2007-11-30 23:24 ——— d—–w C:\Program Files\Common Files\Authentium
2007-11-30 23:24 ——— d—–w C:\Program Files\CA
2007-11-30 23:24 ——— d—–w C:\Documents and Settings\All Users\Application Data\Raxco
2007-11-30 23:23 ——— d—–w C:\Program Files\Virgin Broadband
2007-11-30 23:23 ——— d—–w C:\Documents and Settings\All Users\Application Data\Virgin Broadband
2007-11-30 23:20 ——— d—–w C:\Documents and Settings\Z.ALI\Application Data\InstallShield
2007-11-30 23:14 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2007-11-30 23:12 ——— d—–w C:\Documents and Settings\Guest\Application Data\Virgin Broadband
2007-11-30 18:30 ——— d—–w C:\Program Files\Common Files\DVDVideoSoft
2007-11-24 17:57 ——— d—–w C:\Documents and Settings\Z.ALI\Application Data\Nokia
2007-11-16 17:37 ——— d—–w C:\Documents and Settings\Z.ALI\Application Data\Talkback
2007-11-13 10:25 20,480 —-a-w C:\WINDOWS\system32\drivers\secdrv.sys
2006-10-15 18:19 63,352 —-a-w C:\Documents and Settings\Z.ALI\Application Data\GDIPFONTCACHEV1.DAT
2006-04-01 16:39 284 -c–a-w C:\Documents and Settings\Z.ALI\Application Data\ViewerApp.dat
2005-02-09 14:13 5,224 –sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2007-09-13 17:35 16,384 –sha-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
2007-09-13 17:35 16,384 –sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
2007-09-13 17:35 32,768 –sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
.

((((((((((((((((((((((((((((( snapshot@2008-01-13_20.11.17.46 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-01-13 19:58:27 696,320 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\NTUSER.DAT
+ 2008-01-13 22:12:49 696,320 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\NTUSER.DAT
- 2008-01-13 19:58:27 8,192 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
+ 2008-01-13 22:12:49 8,192 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
- 2008-01-13 19:58:27 675,840 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\ntuser.dat
+ 2008-01-13 22:12:49 675,840 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\ntuser.dat
- 2008-01-13 19:58:27 8,192 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
+ 2008-01-13 22:12:49 8,192 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
- 2008-01-13 19:58:28 6,451,200 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\NTUSER.DAT
+ 2008-01-13 22:12:49 6,451,200 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\NTUSER.DAT
- 2008-01-13 19:58:28 155,648 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
+ 2008-01-13 22:12:49 151,552 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-01-12 16:40 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2008-01-13 19:52 748032]
"AGRSMMSG"="AGRSMMSG.exe" [2005-03-04 11:01 88209 C:\WINDOWS\AGRSMMSG.exe]
"Dit"="Dit.exe" [2004-07-20 18:18 90112 C:\WINDOWS\Dit.exe]
"LXBUCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBUtime.dll" [2004-09-10 11:55 69632]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-01-13 19:52 1110016]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-01-12 16:40 15360]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2005-04-25 13:45 36040]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-01-10 17:11 219136]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, zwebauth.dll
path=
backup=

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\-FreedomNeedsReboot]
–a—— 2007-09-05 14:10 13552 C:\Program Files\Virgin Broadband\PCguard\ZkRunOnceR.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
–a—— 2005-06-06 22:46 57344 C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
–a—— 2007-10-10 19:51 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Broadbandadvisor.exe]
–a—— 2007-08-07 18:49 2061552 C:\Program Files\Virgin Broadband\advisor\Broadbandadvisor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EzPrint]
–a—— 2004-09-17 13:24 61440 C:\Program Files\Lexmark 6200 Series\ezprint.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FaxCenterServer]
–a—— 2004-09-22 10:18 299008 C:\Program Files\Lexmark Fax Solutions\fm3032.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechGalleryRepair]
–a—— 2002-06-20 11:26 155648 C:\Program Files\Logitech\ImageStudio\ISStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechImageStudioTray]
–a—— 2002-06-20 11:25 45056 C:\Program Files\Logitech\ImageStudio\LogiTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoRepair]
–a—— 2005-06-08 14:24 458752 C:\Program Files\Logitech\Video\ISStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoTray]
–a—— 2005-06-08 14:14 217088 C:\Program Files\Logitech\Video\LogiTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lxbumon.exe]
–a—— 2004-09-22 10:43 188416 C:\Program Files\Lexmark 6200 Series\lxbumon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
–a—— 2001-07-09 10:50 155648 C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCguard]
–a—— 2007-09-05 14:10 310000 C:\Program Files\Virgin Broadband\PCguard\Rps.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService]
–a—— 2005-02-04 11:48 118926 C:\Program Files\Home Cinema\PowerCinema\PCMService.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
–a—— 2004-11-02 20:24 32768 C:\Program Files\Home Cinema\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
–a—— 2008-01-11 22:32 430080 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Wireless Manager]
–a—— 2007-09-07 12:06 585728 C:\Program Files\Virgin Broadband Wireless\Wireless Manager.exe

R2 AffinegyService;AffinegyService;"C:\Program Files\Virgin Broadband Wireless\AffinegyService.exe" [2007-09-07 11:58]
R3 3xHybrid;3xHybrid service;C:\WINDOWS\system32\DRIVERS\3xHybrid.sys [2005-02-01 00:33]
R3 cmudax;C-Media High Definition Audio Interface;C:\WINDOWS\system32\drivers\cmudax.sys [2005-05-12 13:39]
R3 wbscr;Winbond Smartcard Reader for I/O;C:\WINDOWS\system32\drivers\wbscr.sys [2002-04-24 12:07]
S3 AFGSp50;AFGSp50 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\AFGSp50.sys [2007-05-22 12:27]
S3 BTNetFilter;Bluetooth Network Filter;C:\WINDOWS\system32\drivers\BTNetFilter.sys [2004-12-16 16:32]
S3 CardReaderFilter;Card Reader Filter;C:\WINDOWS\system32\Drivers\USBCRFT.SYS [2008-01-13 22:21]
S3 PhilCam8116;Logitech QuickCam Pro 3000(PID_08B0);C:\WINDOWS\system32\DRIVERS\CamDrL21.sys [2002-06-10 13:16]
S3 Radialpoint Security Services;Virgin Broadband PCguard;C:\WINDOWS\system32\dllhost.exe [2004-08-04 12:00]

.
Contents of the 'Scheduled Tasks' folder
"2008-01-07 23:34:48 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-02-12 17:25:48 C:\WINDOWS\Tasks\MP Scheduled Quick Scan.job"
- C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MpCmdRun.exe%Scan -RestrictPrivileges -ScanType 1
"2008-01-11 15:04:34 C:\WINDOWS\Tasks\Norton Security Scan.job"
- C:\Program Files\Norton Security Scan\Nss.exe
"2008-01-13 22:19:49 C:\WINDOWS\Tasks\RegCure Program Check.job"
- C:\Program Files\RegCure\RegCure.exe
"2007-12-25 21:03:43 C:\WINDOWS\Tasks\RegCure.job"
- C:\Program Files\RegCure\RegCure.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-13 22:20:56
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2900.3156]
-> C:\Program Files\Avi2Dvd\Programs\Filters\Haali media splitter\mmfinfo.dll
-> C:\Program Files\Avi2Dvd\Programs\Filters\Haali media splitter\mkunicode.dll
.
Completion time: 2008-01-13 22:24:33 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-13 22:24:31
ComboFix2.txt 2008-01-13 20:11:43
.
2008-01-13 20:12:12 — E O F —
Post #26 last edited
What I was trying to explain to you is that program has been damaged by the infection so it needs to be removed (after saving data) and then reinstalled so your copy will function properly. I did not mean to infer that the program was malware. Please continue with the AntiVirus scan.
Post #28

C. Please rerun the following online Antivirus program. This time we will have it remove everything suspicious.

Please use the Eset NOD32 Online Anti-Virus scanner and Removal Tool

Note: This tool requires the use of Internet Explorer and is Vista compatible

Please click HERE to start the process

  • Place a checkmark in the box beside "Terms of Service", then click "Start".
  • On the next scree, "Click" where prompted to install the required ActiveX Control.
  • Acknowledge the Security Warning in the next window by Clicking the "Install" button.
  • Press the "START" button on the Welcome Screen.
  • A download progress bar will then inform you on the status of your download.
  • Once the initialization is complete, place a checkmark beside "Remove found threats", then click "Scan".
  • When the tool has finished, under the Details Tab, you will find a list of items found and deleted.
  • No log will be made available for posting in your reply.


D. Please post back …, the report from Eset and a fresh HijackThis log.


Note: You will have to UNINSTALL then reinstall the following programs:

GoogleToolbarNotifier
Windows Media Player
Password Door

Post #29
no virus found
Eset online scan log:


# version=4
# OnlineScanner.ocx=[removed]
# OnlineScannerDLLA.dll=1, 0, 0, 51
# OnlineScannerDLLW.dll=1, 0, 0, 51
# OnlineScannerUninstaller.exe=1, 0, 0, 49
# vers_standard_module=2790 (20080114)
# vers_arch_module=1.061 (20080110)
# vers_adv_heur_module=1.064 (20070717)
# EOSSerial=3ac9e426c4c6ed41bd7ce292ac032ee5
# end=finished
# remove_checked=true
# unwanted_checked=false
# utc_time=2008-01-14 06:19:21
# local_time=2008-01-14 06:19:21 (+0000, GMT Standard Time)
# country="United Kingdom"
# osver=5.1.2600 NT Service Pack 2
# scanned=486221
# found=0
# scan_time=5302




hjt log:


Logfile of HijackThis v1.99.1
Scan saved at 18:29:32, on 14/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Virgin Broadband\PCguard\Fws.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Virgin Broadband Wireless\AffinegyService.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\Dit.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\DllHost.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\dwwin.exe
C:\Program Files\Samsung\Samsung PC Studio 3\Launcher.exe
C:\Program Files\Samsung\Samsung PC Studio 3\ConMgr.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.blueyonder.co.uk/welcome
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://uk.red.clientapps.yahoo.com/customi…fo/bt_side.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.excid.com/medion/index.jsp?language=en
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
F3 - REG:win.ini: load=C:\WINDOWS\system32\ssttt.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Pop-Up Blocker BHO - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} - C:\Program Files\Virgin Broadband\PCguard\pkR.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: (no name) - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [LXBUCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBUtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Password Door Loader] C:\Program Files\Password Door\tlpd.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://www.aldi.com/
O15 - Trusted Zone: *.musicmatch.com
O15 - Trusted Zone: *.musicmatch.com (HKLM)
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {13EC55CF-D993-475B-9ACA-F4A384957956} (Controller Class) - https://www.windowsonecare.com/install/cli/…nSSWebAgent.CAB
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - http://a516.g.akamai.net/f/516/25175/7d/ru…cat-no-eula.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} - http://us.chat1.yimg.com/us.yimg.com/i/cha…v45/yacscom.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.mail.live.com/mail/w1/resources/MSNPUpld.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/…lscbase8300.cab
O16 - DPF: {639658F3-B141-4D6B-B936-226F75A5EAC3} (CPlayFirstDinerDash2Control Object) - http://www.shockwave.com/content/dinerdash…h2.1.0.0.53.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O16 - DPF: {C45B1500-7B63-47C2-AB25-C28CB46AFDEE} (MSN Music Mediabar) - http://sib1.pvw.od2.com/common/musicmanage…nagerPlugin.CAB
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/vir…l/installer.exe
O16 - DPF: {DA80E089-4648-43D5-93B4-7F37917084E6} (CacheManager.CacheManagerCtrl) - http://www.candystand.com/games/gtauto/act…acheManager.CAB
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AffinegyService - Affinegy LLC - C:\Program Files\Virgin Broadband Wireless\AffinegyService.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: DvpApi (dvpapi) - Authentium, Inc. - C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
O23 - Service: lxbu_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxbucoms.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Virgin Broadband PCguard Update Service (RPSUpdaterR) - Radialpoint Inc. - C:\Program Files\Virgin Broadband\PCguard\rpsupdaterR.exe
O23 - Service: PCguard Firewall (RP_FWS) - Virgin Media - C:\Program Files\Virgin Broadband\PCguard\Fws.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
Post #30 last edited
ive uninstalled and then reinstalled the programs again……

im not sure if ive mentioned this to you or not …
whenever i start my pc up it does a disk check for drive d which is labeled backup. it says it is doing it for consistency and i don't know how to stop it

second problem is the 2 random shortcut files. look at the link for the screenshots

http://img406.imageshack.us/my.php?image=s…cutfilesvn4.png

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI