What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] trapped in Virtumonde

17 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
A. Things are looking much better!!!. There are still some tidbits to clean up and I believe that your system will require some repairs before we are all done. If any of the following steps run into a glitch, please note the errors and report them to me in your next post. If there are errors, please continue with the other steps before contacting me.


B. Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

Updating Java:
  • Download the latest version of Java Runtime Environment (JRE) 6u4.
  • Scroll down to where it says "The Java SE Runtime Environment (JRE) allows end-users to run Java applications".
  • Click the "Download" button to the right.
  • In the pull down menu next to Platform select Windows
  • Check the box that says: "I agree to the Java SE Runtime Environment 6 License Agreement"
  • Click Continue
  • Click on the link to download Windows Offline Installation and save to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
  • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u4-windowsi586-p.exe to install the newest version.


Now to Clean out the Java cache:

Go into the Control Panel and double-click the Java Icon.
  • Under Temporary Internet Files, click the Delete Files button.
  • There are three options in the window to clear the cache - Leave ALL 3 Checked
    • Downloaded Applets
      Downloaded Applications
      Other Files
  • Click OK on Delete Temporary Files Window
    Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
  • Click OK to leave the Java Control Panel.

C. 1. Please open Notepad
  • Click Start , then Run
  • Type notepad .exe in the Run Box.
2. Now copy/paste the entire content of the codebox below into the Notepad window:

KillAll:

File::
C:\ae85e73bcb586e4ea3f127b48117a9

Driver::
VMnetAdapter

Registry::
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{EF99BD32-C1FB-11D2-892F-0090271D4F88}"=-
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="" 
[-HKEY_LOCAL_MACHINE\Software\CLASSES\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UnlockerAssistant"=-
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"=-
"swg"=-
[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Spyware Doctor"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Save the above as CFScript.txt

4. Now drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

5. All your monitoring programs (Antivirus/Antispyware, Guards and Shields) will be stopped.

[external image: Posted Image]

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

6. ComboFix will automatically REBOOT your machine when the KillAll:: switch is used..

7. Post the following logs/Reports:
  • ComboFix.txt


D. You don't appear to be running any anti-virus software

Anti-virus software are programs that detect, clean, and/or erase harmful virus files on a computer. Unchecked, virus files can unintentionally be forwarded to others, and thereby spread infection. Keeping your anti-virus updated is essential.

Please download a free anti-virus software from one these excellent vendors NOW:
It is strongly recommended that you run only one antivirus program at a time. Having more than one antivirus program active in memory uses additional resources and can result in program conflicts and false virus alerts.


You don't appear to have a software firewall running

It is important that you use a software firewall, to prevent unauthorized traffic both out of and into your computer.
If you have disabled it, please re-enable it.
If you do not have a firewall installed, please download and install one of these excellent (and free) products:
It is important to note that you should only have one firewall installed at a time.


E. When all the above is done, please run HijackThis and provide me with an updated log.
Post #17
Trevuren,


A. Thanks for the encouragement.

B. I removed the last old java, installed java 6u4 and cleaned out the java cache.

C. Ran the cfscript but it failed. i rebooted the system normally. but got a mesage "windows cannot find C:\windows\system32\home:=\combobatch.bat make sure you type name correctly then try again. To search click start button , then click search. it looks like the combobatch.bat is in C:\combofix \ Included the log below.

D. uninstalled spyware doctor, deleted files for pestpatrol, lavasoft adaware. installed AVG.

E. Installed Zonealarm. I thought there might be some kind of microsoft firewall already installed but not sure how to check that.

When the system boots up it opens a window trying to run c:\windows\system32\kmd.exe. according to zonealarm some hp modules want to access the internet. - hpzinw12.exe and HP discovery services and pml driver.

Thanks.



**************************************************** combofix log ***********************************************************************
ComboFix 08-02.05.3 - Hugh Smith 2008-02-09 9:18:08.5 - NTFSx86
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Hugh Smith\Desktop\CFscript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE
C:\ae85e73bcb586e4ea3f127b48117a9
.

******************************************************** end of combofix log ****************************************************************

******************************************************** HJT log ****************************************************************************
Logfile of HijackThis v1.99.1
Scan saved at 19:49, on 2008-02-09
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe
C:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe
C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
C:\Program Files\HPQ\SHARED\HPQWMI.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\HPZinw12.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [SynTPLpr] "C:\Program Files\Synaptics\SynTP\SynTPLpr.exe"
O4 - HKLM\..\Run: [SynTPEnh] "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
O4 - HKLM\..\Run: [eabconfg.cpl] "C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe" /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [MaxtorOneTouch] "C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe"
O4 - HKLM\..\Run: [mxomssmenu] "C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [eTrustPPAP] "C:\Program Files\CA\eTrust Internet Security Suite\eTrust PestPatrol Anti-Spyware\PPActiveDetection.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
O4 - HKLM\..\Run: [combofix] C:\WINDOWS\system32\kmd.exe /c C:\ComboFix\Combobatch.bat
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=pavilion&pf=laptop
O15 - Trusted Zone: http://www.vectorvest.com
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab
O16 - DPF: {E2BEA58F-B6DA-4D2A-8E05-CACBEA705A0D} - http://www.vectorvest.com/install/vvonlineusnew/install.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MaxBackServiceInt - Unknown owner - C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe
O23 - Service: MaxSyncService (NTService1) - - C:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

*************************************************************end HJT log ********************************************************************
Post #18
A. 1. Launch Notepad, and copy/paste everything in the codebox below into the new document, including the word REGEDIT4. Go up to "File Save As" and click the drop-down box to change the "Save As Type" to "All Files" and save it to your desktop as fixme.reg.

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{EF99BD32-C1FB-11D2-892F-0090271D4F88}"=-
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"=""

[-HKEY_LOCAL_MACHINE\Software\CLASSES\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UnlockerAssistant"=-

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"=-
"swg"=-

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Spyware Doctor"=-

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]


2. Locate fixme.reg on your Desktop. It should look like this [external image: Posted Image]. Double-click on it. You will receive a prompt similar to: "Do you wish to merge the information into the registry?". Answer Yes and wait for a message to appear similar to Merged Successfully.

3. Restart your computer.

4. Please run DSS again and post the "Main.txt" log.
Post #19
Trevuren,

(1) Done.
(2) Done.
(3))Done.
(4)Done. main.txt log posted below

************************************************ DSS.exe main.txt log *******************************************************************
Deckard's System Scanner v20071014.68
Run by [removed] on 2008-02-10 10:30:56
Computer is in Normal Mode.
——————————————————————————–

Percentage of Memory in Use: 76% (more than 75%).
Total Physical Memory: 223 MiB (512 MiB recommended).


– HijackThis (run as Hugh Smith.exe) ——————————————

Unable to find log (file not found); running clone.
– HijackThis Clone ————————————————————


Emulating logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2008-02-10 10:31:04
Platform: Windows XP Service Pack 2 (5.01.2600)
MSIE: Internet Explorer (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG7\avgamsvr.exe
C:\Program Files\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe
C:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Maxtor\OneTouch\Utils\Onetouch.exe
C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
C:\Program Files\HPQ\Shared\hpqwmi.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Hp\Digital Imaging\bin\hpqnrs08.exe
C:\Program Files\Hp\Digital Imaging\bin\hpqste08.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Grisoft\AVG7\avgwb.dat
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\HPZinw12.exe
C:\Documents and Settings\Hugh Smith\Desktop\dss.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/search?q=%s
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = iexplore
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [SynTPLpr] "C:\Program Files\Synaptics\SynTP\SynTPLpr.exe"
O4 - HKLM\..\Run: [SynTPEnh] "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
O4 - HKLM\..\Run: [eabconfg.cpl] "C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe" /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [MaxtorOneTouch] "C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe"
O4 - HKLM\..\Run: [mxomssmenu] "C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [eTrustPPAP] "C:\Program Files\CA\eTrust Internet Security Suite\eTrust PestPatrol Anti-Spyware\PPActiveDetection.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
O4 - HKLM\..\Run: [combofix] C:\WINDOWS\system32\kmd.exe /c C:\ComboFix\Combobatch.bat
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: https://www.travelocity.com (HKCU)
O15 - Trusted Zone: http://www.vectorvest.com (HKCU)
O15 - Trusted Zone: https://www.vectorvest.com (HKCU)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwa…director/sw.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa…ash/swflash.cab
O16 - DPF: {E2BEA58F-B6DA-4D2A-8E05-CACBEA705A0D} () - http://www.vectorvest.com/install/vvonlineusnew/install.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgemc.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\Shared\hpqwmi.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MaxBackServiceInt - Unknown owner - C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe
O23 - Service: MaxSyncService (NTService1) - Unknown owner - C:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe


–
End of file - 8789 bytes

– Files created between 2008-01-10 and 2008-02-10 —————————–

2008-02-10 09:31:44 0 d——– C:\Documents and Settings\Ana Maria\Application Data\AVG7
2008-02-09 18:36:13 2246688 –ahs—- C:\WINDOWS\system32\drivers\fidbox.dat
2008-02-09 18:33:14 0 d——– C:\Program Files\ZoneAlarmSB
2008-02-09 18:30:10 0 d——– C:\Documents and Settings\All Users\Application Data\MailFrontier
2008-02-09 18:29:44 4212 —h—– C:\WINDOWS\system32\zllictbl.dat
2008-02-09 18:29:19 11264 –a—— C:\WINDOWS\system32\SpOrder.dll
Post #20
A. I think we should check for damaged/missing critical system files about now. Those infections did a number on your system.

1. Please go to Start -> Run -> type cmd and press Enter.

2. At the command prompt type sfc /scannow, making sure to put a space between the "c" and the slash, and then press Enter. This will run the System File Checker.

3. Follow the prompts, and insert your Windows installation CD if requested.

4. Then please REBOOT your computer.


B. Please RUN HijackThis.
  • Click the SCAN button to produce a log.

  • Place a check mark beside each one of the following items:

    O15 - Trusted Zone: https://www.travelocity.com (HKCU)
    O15 - Trusted Zone: http://www.vectorvest.com (HKCU)
    O15 - Trusted Zone: https://www.vectorvest.com (HKCU)
    O16 - DPF: {E2BEA58F-B6DA-4D2A-8E05-CACBEA705A0D} () - http://www.vectorvest.com/install/vvonlineusnew/install.cab


  • Now with all the items selected, and all windows closed except for HJT, delete them by clicking the FIX checked button. Close the HijackThis window.

  • Reboot Your System
  • Using Windows Explorer (Windows Key + E), locate the following files, and DELETE them (if still present):

    C:\found.001<==File
    C:\ae85e73bcb586e4ea3f127b48117a9<==File

  • Exit Explorer, and REBOOT BACK INTO NORMAL MODE

  • Finally, RUN Hijackthis again and produce a new HJT log. Post it in the forum so we can check how everything looks now.


C. I need you to run the following scan: Eset Online Scanner
  • Place a check mark in the box YES, I accept the Terms Of Use
  • Click the Start button.
  • Now click the Install button.
  • Click Start. The scanner engine will initialize and update.
  • Do Not place a check mark in the box beside Remove found threats.
  • Click the Scan button. The scan will now run, please be patient.
  • When the scan finishes click the Details tab.
  • Copy and paste the contents of the C:\ProgramFiles\EsetOnlineScanner\log.txt into your next reply.
Post #21
Trevuren,

A. ran sfc /scannow. ran log time and I didnt see it end. I thought maybe it waited for me to enter the disk and then timed out. Ran it again and it never asked to enter the disk. Ran very slow. Looked in taskmanager and seemed to be mostly running winlogon. server busy messages still popping up periodically.

B. Ran HJT only one vectorvest.com and no travelocity message showed up. clicked on a 15 vectorvest.com and a 16 vector vest

didnt find a C:found.001 file
found a folder named ae85e73bcb586e4ea3f127b48117a9 with 3 files inside - deleted folder

Ran HJT again - log included below

very slow to look up files - shows flashlight symbol searching - perhaops explorer.exe still slow

Zonealarm constantly popping up because HP routrines want to connect to the internet (especially PML - HPZipm12.exe)
now I quit responding - I neither allow or deny. I dont know if maybe some of the HP routines (printer and image handling) are corrupted.

C. Ran the ESET online Scanner - log included below note VVQQ.exe appears on the desktop.

THANKS

*****************************************************************HJT log *****************************************************************


Logfile of HijackThis v1.99.1
Scan saved at 22:19, on 2008-02-10
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe
C:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HPQ\SHARED\HPQWMI.exe
C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe
C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\HPZinw12.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [SynTPLpr] "C:\Program Files\Synaptics\SynTP\SynTPLpr.exe"
O4 - HKLM\..\Run: [SynTPEnh] "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
O4 - HKLM\..\Run: [eabconfg.cpl] "C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe" /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [MaxtorOneTouch] "C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe"
O4 - HKLM\..\Run: [mxomssmenu] "C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [eTrustPPAP] "C:\Program Files\CA\eTrust Internet Security Suite\eTrust PestPatrol Anti-Spyware\PPActiveDetection.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
O4 - HKLM\..\Run: [combofix] C:\WINDOWS\system32\kmd.exe /c C:\ComboFix\Combobatch.bat
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=pavilion&pf=laptop
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MaxBackServiceInt - Unknown owner - C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe
O23 - Service: MaxSyncService (NTService1) - - C:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

************************************************************** end HJT log *****************************************************************

**************************************************** ESET LOG ******************************************************************************

# version=4
# OnlineScanner.ocx=1.0.0.635
# OnlineScannerDLLA.dll=1, 0, 0, 79
# OnlineScannerDLLW.dll=1, 0, 0, 78
# OnlineScannerUninstaller.exe=1, 0, 0, 49
# vers_standard_module=2864 (20080211)
# vers_arch_module=1.063 (20080117)
# vers_adv_heur_module=1.060 (20070601)
# EOSSerial=c22bc054eb8223499b36449acd088d08
# end=finished
# remove_checked=false
# unwanted_checked=false
# utc_time=2008-02-11 04:18:41
# local_time=2008-02-11 08:18:41 (-0800, Pacific Standard Time)
# country="United States"
# osver=5.1.2600 NT Service Pack 2
# scanned=295791
# found=2
# scan_time=5630
C:\Documents and Settings\Hugh Smith\Desktop\vvqq.exe Win32/Adware.ISM application 2D761CE20C8DA6C46BA87C7F31C55003
C:\Documents and Settings\Hugh Smith\Desktop\vvqq.exe »NSIS »QdrDrive9.dll Win32/Adware.ISM application 00000000000000000000000000000000

*********************************************************** end ESET LOG ****************************************************************
Post #22
1.

Zonealarm constantly popping up because HP routrines want to connect to the internet (especially PML - HPZipm12.exe)
now I quit responding - I neither allow or deny.


hpzipm12.exe is loaded by the Hewlett-Packard PSC 2100, 2200, 4100, and 6100 series printer drivers. They are essential for the smooth running of these devices


Try "Deny". If your printer does not work properly the use "Allow". I do not allow my printer to automatically connect to the internet. There is no valid reason for it to do so.


2. Please DELETE the following file:

C:\Documents and Settings\Hugh Smith\Desktop\vvqq.exe<==File


3. A. Download and scan with SUPERAntiSpyware Free for Home Users
  • Double-click SUPERAntiSpyware.exe and use the default settings for installation.
  • An icon will be created on your desktop. Double-click that icon to launch the program.
  • If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download and unzip them from here.)
  • Under "Configuration and Preferences", click the Preferences button.
  • Click the Scanning Control tab.
  • Under Scanner Options make sure the following are checked (leave all others unchecked):
    • Close browsers before scanning.
    • Scan for tracking cookies.
    • Terminate memory threats before quarantining.
  • Click the "Close" button to leave the control center screen.


B. Reboot into Safe Mode


How to use the F8 method to Start Your Computer in Safe Mode*Restart the computer.
*as soon as BIOS is loaded begin tapping the F8 key until the Advanced Options menu appears.
*Use the arrow keys to select the Safe mode menu item
*press Enter.

C. Double-click SUPERAntiSpyware.exe to start the tool again
  • Back on the main screen, under "Scan for Harmful Software" click Scan your computer.
  • On the left, make sure you check C:\Fixed Drive.
  • On the right, under "Complete Scan", choose Perform Complete Scan.
  • Click "Next" to start the scan. Please be patient while it scans your computer.
  • After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
  • Make sure everything has a checkmark next to it and click "Next".
  • A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
  • If asked if you want to reboot, click "Yes".
  • To retrieve the removal information after reboot, launch SUPERAntispyware again.
    • Click Preferences, then click the Statistics/Logs tab.
    • Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
    • If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
    • Please copy and paste the Scan Log results in your next reply along with a fresh HJT log.
  • Click Close to exit the program.


4. Once again, please tell me how everything is running (You may need to defrag your hard drive). If everything is running smoothly, we can proceed with the final cleanup procedures.
Post #23
I hope you are well and not experiencing any difficulties carrying out my last set of instructions. If you are, do not hesitate to ask for further explanations. If however, your problem has been solved or you no longer require our assistance, please advise us accordingly and we will archive your topic.

Trevuren
Post #24 last edited
Trevuren,

Sorry for the slow response. I got overwhelmed with other things. My printer was hung up so I thought maybe some of the messages were caused by windows trying to connect over a wireless network to the printer. I got the printer unjammmed by I still cant successfully print. The print job just queues up and a message says the print job will wait until connection established .

I deleted the vvqq.exe from the desktop.

I ran the superantispy. It seemed find lots of stuff. I included this as SAS log1. Over a period of a few days I used the internet a few times. So I ran the Superantispy again today. This time it found less problem files(just some cookies) so I guess it must have cleaned up the other stuff the first time. log included as SAS log2.

Then I ran HJT. Log included below


when the system boots up it is very slow to paint the icons. it seems explorer.exe and svchost mostly running. it opens a small window while running some program like ntvdm
then it opens another window to run a program like \HPQ\quickL~1\eabservr.exe
then it opens a window and runs windows\system32\kmd.exe - somewhat long then the superantispy logo appears in this window

I reply allow to Zonealarm for real player and several HP modules but they only come up once . The pml driver(hpzipm12.exe) keeps popping up even if I respond to allow it.

Thanks.

****************************************************** SAS log 1***************************************************************
SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 02/11/2008 at 11:32 PM

Application Version : 3.9.1008

Core Rules Database Version : 3399
Trace Rules Database Version: 1391

Scan type : Complete Scan
Total Scan Time : 03:50:08

Memory items scanned : 161
Memory threats detected : 0
Registry items scanned : 5579
Registry threats detected : 10
File items scanned : 61246
File threats detected : 148

Trojan.WinFixer
HKLM\Software\Classes\CLSID\{7821F767-4728-40DA-9F7A-22A53E517B52}
HKCR\CLSID\{7821F767-4728-40DA-9F7A-22A53E517B52}
HKCR\CLSID\{7821F767-4728-40DA-9F7A-22A53E517B52}\InprocServer32
HKCR\CLSID\{7821F767-4728-40DA-9F7A-22A53E517B52}\InprocServer32#ThreadingModel
C:\WINDOWS\SYSTEM32\JKHFC.DLL

Adware.Vundo Variant
HKLM\Software\Classes\CLSID\{F9850ADE-9827-4C16-8634-DE81C82E30F5}
HKCR\CLSID\{F9850ADE-9827-4C16-8634-DE81C82E30F5}
HKCR\CLSID\{F9850ADE-9827-4C16-8634-DE81C82E30F5}\InprocServer32
HKCR\CLSID\{F9850ADE-9827-4C16-8634-DE81C82E30F5}\InprocServer32#ThreadingModel
C:\WINDOWS\SYSTEM32\DDCCD.DLL

Adware.BusMaster/SafeSurfing
C:\WINDOWS\SYSTEM32\TCBLLDSX.DLL
HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\CommA
HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\CommA#Path

Adware.Tracking Cookie
C:\Documents and Settings\Hugh Smith\Cookies\[removed][5].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh_smith@atdmt[2].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh_smith@specificclick[2].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh_smith@casalemedia[2].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh_smith@nandomedia[1].txt
C:\Documents and Settings\Hugh Smith\Cookies\[removed][1].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh_smith@adinterax[5].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh_smith@hitbox[2].txt
C:\Documents and Settings\Hugh Smith\Cookies\[removed][2].txt
C:\Documents and Settings\Hugh Smith\Cookies\[removed][2].txt
C:\Documents and Settings\Hugh Smith\Cookies\[removed][1].txt
C:\Documents and Settings\Hugh Smith\Cookies\[removed][1].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh_smith@statcounter[1].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh_smith@tribalfusion[1].txt
C:\Documents and Settings\Hugh Smith\Cookies\[removed][1].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh_smith@revsci[1].txt
C:\Documents and Settings\Hugh Smith\Cookies\[removed][1].txt
C:\Documents and Settings\Hugh Smith\Cookies\[removed][1].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh_smith@mediaplex[2].txt
C:\Documents and Settings\Hugh Smith\Cookies\[removed]-sys[1].txt
C:\Documents and Settings\Hugh Smith\Cookies\[removed][3].txt
C:\Documents and Settings\Hugh Smith\Cookies\[removed][5].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh_smith@serving-sys[1].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh_smith@adrevolver[1].txt
C:\Documents and Settings\Hugh Smith\Cookies\[removed][1].txt
C:\Documents and Settings\Hugh Smith\Cookies\[removed][2].txt
C:\Documents and Settings\Hugh Smith\Cookies\[removed][1].txt
C:\Documents and Settings\Hugh Smith\Cookies\[removed][2].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh_smith@bluestreak[2].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh_smith@tacoda[5].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh_smith@2o7[1].txt
C:\Documents and Settings\Hugh Smith\Cookies\[removed][1].txt
C:\Documents and Settings\Hugh Smith\Cookies\[removed][2].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh_smith@doubleclick[2].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh_smith@advertising[2].txt
C:\Documents and Settings\Hugh Smith\Cookies\[removed][2].txt
C:\Documents and Settings\Hugh Smith\Cookies\[removed][1].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh_smith@revenue[2].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh_smith@questionmarket[1].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh_smith@overture[2].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh_smith@trafficmp[1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@aerialsexpress[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@belnk[1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@toplist[1].txt
C:\Documents and Settings\Ana Maria\Cookies\ana [removed][2].txt
C:\Documents and Settings\Ana Maria\Cookies\ana [removed][2].txt
C:\Documents and Settings\Ana Maria\Cookies\ana maria@adinterax[2].txt
C:\Documents and Settings\Ana Maria\Cookies\ana [removed][1].txt
C:\Documents and Settings\Ana Maria\Cookies\ana [removed][1].txt
C:\Documents and Settings\Ana Maria\Cookies\ana [removed][1].txt
C:\Documents and Settings\Ana Maria\Cookies\ana [removed][2].txt
C:\Documents and Settings\Ana Maria\Cookies\ana [removed][1].txt
C:\Documents and Settings\Ana Maria\Cookies\ana maria@adserver[1].txt
C:\Documents and Settings\Ana Maria\Cookies\ana [removed][1].txt
C:\Documents and Settings\Ana Maria\Cookies\ana maria@findarticles[1].txt
C:\Documents and Settings\Ana Maria\Cookies\ana maria@jamster[1].txt
C:\Documents and Settings\Ana Maria\Cookies\ana maria@kanoodle[2].txt
C:\Documents and Settings\Ana Maria\Cookies\ana maria@lynxtrack[1].txt
C:\Documents and Settings\Ana Maria\Cookies\ana [removed][2].txt
C:\Documents and Settings\Ana Maria\Cookies\ana maria@media6degrees[2].txt
C:\Documents and Settings\Ana Maria\Cookies\ana maria@partner2profit[1].txt
C:\Documents and Settings\Ana Maria\Cookies\ana maria@qnsr[1].txt
C:\Documents and Settings\Ana Maria\Cookies\ana maria@revsci[1].txt
C:\Documents and Settings\Ana Maria\Cookies\ana [removed][2].txt
C:\Documents and Settings\Ana Maria\Cookies\ana maria@toseeka[2].txt
C:\Documents and Settings\Ana Maria\Cookies\ana [removed][2].txt
C:\Documents and Settings\Ana Maria\Cookies\ana [removed][2].txt
C:\Documents and Settings\Ana Maria\Cookies\ana [removed][1].txt
C:\Documents and Settings\Ana Maria\Cookies\ana [removed][2].txt
C:\Documents and Settings\Ana Maria\Cookies\ana [removed][1].txt
C:\Documents and Settings\Ana Maria\Cookies\ana maria@www.traffic101[1].txt
C:\Documents and Settings\Ana Maria\Cookies\[removed][1].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh [removed][1].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh [removed][2].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh [removed][1].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh smith@adbrite[2].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh smith@adinterax[2].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh smith@adredired[1].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh [removed][2].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh [removed][2].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh [removed].e-planning[1].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh [removed][1].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh smith@adserver[1].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh smith@adserving[1].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh [removed][1].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh [removed][1].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh smith@collective-media[1].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh [removed][1].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh smith@eyewonder[2].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh smith@findarticles[2].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh smith@hornymatches[2].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh smith@lynxtrack[1].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh smith@media6degrees[1].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh smith@revsci[1].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh [removed][1].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh [removed][1].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh [removed][1].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh [removed][1].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh smith@trafficvenuedirect[2].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh [removed][1].txt
C:\Documents and Settings\Hugh Smith\Cookies\[removed][1].txt
C:\Documents and Settings\Hugh Smith\Cookies\[removed][2].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh_smith@adbrite[1].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh_smith@adinterax[2].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh_smith@adinterax[3].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh_smith@adinterax[4].txt
C:\Documents and Settings\Hugh Smith\Cookies\[removed][2].txt
C:\Documents and Settings\Hugh Smith\Cookies\[removed][3].txt
C:\Documents and Settings\Hugh Smith\Cookies\[removed][1].txt
C:\Documents and Settings\Hugh Smith\Cookies\[removed][2].txt
C:\Documents and Settings\Hugh Smith\Cookies\[removed][1].txt
C:\Documents and Settings\Hugh Smith\Cookies\[removed][2].txt
C:\Documents and Settings\Hugh Smith\Cookies\[removed][1].txt
C:\Documents and Settings\Hugh Smith\Cookies\[removed][1].txt
C:\Documents and Settings\Hugh Smith\Cookies\[removed][1].txt
C:\Documents and Settings\Hugh Smith\Cookies\[removed][1].txt
C:\Documents and Settings\Hugh Smith\Cookies\[removed][2].txt
C:\Documents and Settings\Hugh Smith\Cookies\[removed][3].txt
C:\Documents and Settings\Hugh Smith\Cookies\[removed][1].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh_smith@clickaider[1].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh_smith@clickaider[2].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh_smith@clickbank[1].txt
C:\Documents and Settings\Hugh Smith\Cookies\[removed][1].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh_smith@findology[1].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh_smith@hornymatches[1].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh_smith@hornymatches[2].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh_smith@precisionclick[2].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh_smith@revsci[2].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh_smith@revsci[3].txt
C:\Documents and Settings\Hugh Smith\Cookies\[removed][1].txt
C:\Documents and Settings\Hugh Smith\Cookies\[removed][2].txt
C:\Documents and Settings\Hugh Smith\Cookies\[removed][4].txt
C:\Documents and Settings\Hugh Smith\Cookies\[removed][2].txt
C:\Documents and Settings\Hugh Smith\Cookies\[removed][1].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh_smith@statsgod[1].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh_smith@tacoda[1].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh_smith@tacoda[2].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh_smith@tacoda[3].txt
C:\Documents and Settings\Hugh Smith\Cookies\[removed][1].txt
C:\Documents and Settings\Hugh Smith\Cookies\[removed][2].txt
C:\Documents and Settings\Hugh Smith\Cookies\[removed][3].txt
C:\Documents and Settings\Hugh Smith\Cookies\[removed][1].txt

*********************************************** END OF SAS LOG 1 *****************************************************************

****************************************************** SAS log 2 **************************************************************************

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 02/16/2008 at 07:55 PM

Application Version : 3.9.1008

Core Rules Database Version : 3399
Trace Rules Database Version: 1391

Scan type : Complete Scan
Total Scan Time : 04:07:41

Memory items scanned : 169
Memory threats detected : 0
Registry items scanned : 5579
Registry threats detected : 0
File items scanned : 58533
File threats detected : 34

Adware.Tracking Cookie
C:\Documents and Settings\Hugh Smith\Cookies\[removed][1].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh_smith@atdmt[2].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh_smith@specificclick[1].txt
C:\Documents and Settings\Hugh Smith\Cookies\[removed][1].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh_smith@atwola[2].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh_smith@adinterax[1].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh_smith@findarticles[1].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh_smith@spamblockerutility[2].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh_smith@hitbox[2].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh_smith@statcounter[1].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh_smith@tribalfusion[2].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh_smith@revsci[1].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh_smith@mediaplex[2].txt
C:\Documents and Settings\Hugh Smith\Cookies\[removed][2].txt
C:\Documents and Settings\Hugh Smith\Cookies\[removed][2].txt
C:\Documents and Settings\Hugh Smith\Cookies\[removed][1].txt
C:\Documents and Settings\Hugh Smith\Cookies\[removed][1].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh_smith@adrevolver[1].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh_smith@zedo[1].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh_smith@imrworldwide[2].txt
C:\Documents and Settings\Hugh Smith\Cookies\[removed][2].txt
C:\Documents and Settings\Hugh Smith\Cookies\[removed][1].txt
C:\Documents and Settings\Hugh Smith\Cookies\[removed][1].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh_smith@2o7[2].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh_smith@tacoda[2].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh_smith@fastclick[2].txt
C:\Documents and Settings\Hugh Smith\Cookies\[removed][2].txt
C:\Documents and Settings\Hugh Smith\Cookies\[removed][2].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh_smith@doubleclick[1].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh_smith@advertising[2].txt
C:\Documents and Settings\Hugh Smith\Cookies\[removed][2].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh_smith@questionmarket[1].txt
C:\Documents and Settings\Hugh Smith\Cookies\[removed][2].txt
C:\Documents and Settings\Hugh Smith\Cookies\hugh_smith@burstnet[1].txt

************************************************ END SAS LOG 2 **********************************************************************

************************************************* HJT LOG *****************************************************************************
Logfile of HijackThis v1.99.1
Scan saved at 20:34, on 2008-02-16
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe
C:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HPQ\SHARED\HPQWMI.exe
C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe
C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [SynTPLpr] "C:\Program Files\Synaptics\SynTP\SynTPLpr.exe"
O4 - HKLM\..\Run: [SynTPEnh] "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
O4 - HKLM\..\Run: [eabconfg.cpl] "C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe" /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [MaxtorOneTouch] "C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe"
O4 - HKLM\..\Run: [mxomssmenu] "C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [eTrustPPAP] "C:\Program Files\CA\eTrust Internet Security Suite\eTrust PestPatrol Anti-Spyware\PPActiveDetection.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
O4 - HKLM\..\Run: [combofix] C:\WINDOWS\system32\kmd.exe /c C:\ComboFix\Combobatch.bat
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=pavilion&pf=laptop
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MaxBackServiceInt - Unknown owner - C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe
O23 - Service: MaxSyncService (NTService1) - - C:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

************************************************************** end HJT ********************************************************************
Post #25 last edited
1. Try re-installing your printer software. 2. Then tell me how everything is now running before we proceed with the final cleanup procedures.
Post #26
I hope you are well and not experiencing any difficulties carrying out my last set of instructions. If you are, do not hesitate to ask for further explanations. If however, your problem has been solved or you no longer require our assistance, please advise us accordingly and we will archive your topic.

Trevuren
Post #27
Trevuren, Yes I definitely need to get to the final cleanup. i am just looking for my HP CDs. i think they are in one of the storage boxes from my last move. Will get back to you soon. Thanks.
Post #28
Often, you can find a copy of the software on the net through the manufacturer's site. Just make sure that you know the model and type of printer you are using.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI