What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Please, help.

17 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
Well, the problem is:

When I load up Mozilla Fox and type in a site. When I hit enter, sometimes (well, most of the time) it ends up with a white or black plain page. I look at the bottom of my internet window, and it says Done, but nothing seems to come out. Unfortunately, this started happening about a week or two ago. Also, when I'm in a process of downloading "something", it freezes after a minute or two. This also never happened to me long ago. None of my anti-viruses detect any viruses, so my computer seems clean (Spybot and KasperSky Internet Security with Key).

My Hijackthis Report:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:19:42 AM, on 3/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\taskswitch.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\CBS Software\SpeedConnect Internet Accelerator\SpeedConnectStartUp.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O1 - Hosts: 208.69.57.87 game01.us.segaonline.jp
O1 - Hosts: 208.69.57.87 patch01.us.segaonline.jp
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: WebAssist - {85589B5D-D53D-4237-A677-46B82EA275F3} - (no file)
O3 - Toolbar: (no name) - {C5AF4D9B-0B55-4BAC-9486-218EA2C6BC3E} - (no file)
O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\system32\taskswitch.exe
O4 - HKLM\..\Run: [Win Base 4 Download] C:\Documents and Settings\All Users\Application Data\Browse Dent Win Base\Real Keep.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKCU\..\Run: [Barb Soft] C:\DOCUME~1\Loan\APPLIC~1\THIRDW~1\curbflap.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-21-343818398-963894560-725345543-1003\..\Run: [Barb Soft] C:\DOCUME~1\Loan\APPLIC~1\THIRDW~1\curbflap.exe (User '?')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {85e1f530-48f4-11d9-9629-08ff2ffc9f67} - (no file)
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Loan\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {02ECD07A-22D0-4AF0-BA0A-3F6B06086D08} (GamesCampus Control) - http://xiah.gamescampus.com/luncher/GamesCampus.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} (ijjiPlugin2 Class) - http://gamedownload.ijjimax.com/gamedownlo…Plugin11USA.cab
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedownlo…GPlugin9USA.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\__c00FF119.dat,C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
O20 - Winlogon Notify: vturopq - C:\WINDOWS\
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - Unknown owner - C:\Program Files\Spyware Doctor\svcntaux.exe (file missing)
O23 - Service: PC Tools Security Service (sdCoreService) - Unknown owner - C:\Program Files\Spyware Doctor\swdsvc.exe (file missing)
O23 - Service: PC Tools Spyware Doctor (SDhelper) - Unknown owner - C:\Program Files\Revolution\Spyware Doctor\sdhelp.exe (file missing)
O23 - Service: Messenger Sharing Folders USN Journal Reader service (usnjsvc) - Unknown owner - C:\Program Files\Windows Live\Messenger\usnsvc.exe (file missing)
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe (file missing)

–
End of file - 6460 bytes

Thanks, for taking your time reading. ~ REN-GEKI
:wacko:

Please, I need a reply.

Thanks, REN-GEKI.
Post #3
I've asked ingames and on forums, but no-one replied to them. The thing is I couldn't download anything, apart from short downloads 1 minute - 30 seconds, is all I could download. Any longer it freezes. The download freezes of course, it stays at 0:06 seconds left when I tried to download Ad-Ware 2007.

I'm assuming I have an ad-ware called download.exe or downloader.exe
Post #4
REN-GEKI,

Welcome to the forum, please reply to this thread only by using the Add Reply and not start any new topics or we wont be able to keep track of you.

It looks like your infected with the Lop and Vundo Trojans You need to run these three programs in order please

Please Download No Lop to your desktop

  • First close any other programs you have running as this will require a reboot
  • Double click NoLop.exe to run it
  • Now click the button labeled "Search and Destroy"
    <>
  • When scanning is finished you will be prompted to reboot only if infected, Click OK
  • Now click the "REBOOT" Button.
  • A Message should pop-up from NoLop. If not, double click the program again and it will finish Please Post the contents of C:\NoLop.log after completing the next steps.
–If you receive an error, "mscomctl.ocx or one of its dependencies are not correctly registered," please download mscomctl.ocx to your system32 folder then rerun the program.




Please download SuperAntiSpyware Free
Install the program
  • Run SuperAntiSpyware and click: Check for updates
  • Once the update is finished, on the main screen, click: Scan your computer
  • Check: Perform Complete Scan
  • Click Next to start the scan.
Superantispyware scans the computer, and when finished, lists all the infections found.
Make sure everything found has a check next to it, and press: Next <– Important
Then, click Finish

It is possible that the program asks to reboot in order to delete some files.

Obtain the SuperAntiSpyware log as follows:
  • Click: Preferences
  • Click the Statistics/Logs tab
  • Under Scanner Logs, double-click SuperAntiSpyware Scan Log
It opens in your default text editor (such as Notepad)

Please provide the SuperAntiSpyware log in your reply, as well as a new HijackThis log.






Download ComboFix from Here or Here to your Desktop.

In the event you already have Combofix, this is a new version that I need you to download.
It must be saved directly to your desktop.


1. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

  • Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan.
  • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
  • Remember to re enable the protection again afterwards before connecting to the net


2. Close any open browsers and make sure you are disconnected from the net. Unplug the cable if need be before running combofix.
  • IF you have not already done so Combofix will disconnect your machine from the Internet when it starts.
  • If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.

3. Now double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review


Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze.



I need to see the Lop report, the SAS report, the Combofix report and a new HJT log please
Post #5 last edited
Thanks for not making it difficult for me to read. I will try what you have wrote out.

Okay, I have done this;

Please Download No Lop to your desktop

* First close any other programs you have running as this will require a reboot
* Double click NoLop.exe to run it
* Now click the button labeled "Search and Destroy"
<>
* When scanning is finished you will be prompted to reboot only if infected, Click OK
* Now click the "REBOOT" Button.
* A Message should pop-up from NoLop. If not, double click the program again and it will finish Please Post the contents of C:\NoLop.log after completing the next steps.


No error occurred when I rebooted my comp. I can't download SuperAntiSpyware Free, because my download stopped again… it starts off with an estimation of 5 minutes, and slowly increased. As it was increasing, it stopped at 7 minutes.
:pullhair:

Here's my new HijackThis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:04:39 PM, on 17/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\taskswitch.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O1 - Hosts: 208.69.57.87 game01.us.segaonline.jp
O1 - Hosts: 208.69.57.87 patch01.us.segaonline.jp
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: WebAssist - {85589B5D-D53D-4237-A677-46B82EA275F3} - (no file)
O3 - Toolbar: (no name) - {C5AF4D9B-0B55-4BAC-9486-218EA2C6BC3E} - (no file)
O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\system32\taskswitch.exe
O4 - HKLM\..\Run: [Win Base 4 Download] C:\Documents and Settings\All Users\Application Data\Browse Dent Win Base\Real Keep.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKCU\..\Run: [Barb Soft] C:\DOCUME~1\Loan\APPLIC~1\THIRDW~1\curbflap.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-21-343818398-963894560-725345543-1003\..\Run: [Barb Soft] C:\DOCUME~1\Loan\APPLIC~1\THIRDW~1\curbflap.exe (User '?')
O4 - HKUS\S-1-5-21-343818398-963894560-725345543-1003\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet (User '?')
O4 - HKUS\S-1-5-21-343818398-963894560-725345543-1003\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User '?')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {85e1f530-48f4-11d9-9629-08ff2ffc9f67} - (no file)
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Loan\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {02ECD07A-22D0-4AF0-BA0A-3F6B06086D08} (GamesCampus Control) - http://xiah.gamescampus.com/luncher/GamesCampus.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} (ijjiPlugin2 Class) - http://gamedownload.ijjimax.com/gamedownlo…Plugin11USA.cab
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedownlo…GPlugin9USA.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\__c00FF119.dat,C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
O20 - Winlogon Notify: vturopq - C:\WINDOWS\
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - Unknown owner - C:\Program Files\Spyware Doctor\svcntaux.exe (file missing)
O23 - Service: PC Tools Security Service (sdCoreService) - Unknown owner - C:\Program Files\Spyware Doctor\swdsvc.exe (file missing)
O23 - Service: PC Tools Spyware Doctor (SDhelper) - Unknown owner - C:\Program Files\Revolution\Spyware Doctor\sdhelp.exe (file missing)
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe (file missing)

–
End of file - 7155 bytes
Post #6 last edited
Hello,

Post the contents of C:\NoLop.log after completing the next steps.
I need to see reports that I ask for please otherwise I am working in the dark.



Disable the TeaTimer, you can re enable it when were done if you wish
  • Run Spybot-S&D in Advanced Mode.
  • If it is not already set to do this Go to the Mode menu select "Advanced Mode"
  • On the left hand side, Click on Tools
  • Then click on the Resident Icon in the List
  • Uncheck "Resident TeaTimer" and OK any prompts.
  • Restart your computer. <– Important



Bypass Super Anti Spyware for the time being and do this.

We need to make sure all hidden files are showing :
  • Click Start.
  • Open My Computer.
  • Select the Tools menu and click Folder Options.
  • Select the View tab.
  • Under the Hidden files and folders heading select Show hidden files and folders.
  • Uncheck the Hide file extensions for known types option.
  • Uncheck the Hide protected operating system files (recommended) option.
  • Click Yes to confirm.
  • Click OK.
Once your system is clean, we suggest that you reverse this to keep critical windows files from accidentally being deleted.




Open HijackThis > Do a System Scan Only, close your browser and all open windows including this one, the only program or window you should have open is HijackThis, check the following entries and click on Fix Checked.

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

O2 - BHO: WebAssist - {85589B5D-D53D-4237-A677-46B82EA275F3} - (no file)

O4 - HKLM\..\Run: [Win Base 4 Download] C:\Documents and Settings\All Users\Application Data\Browse Dent Win Base\Real Keep.exe
O4 - HKCU\..\Run: [Barb Soft] C:\DOCUME~1\Loan\APPLIC~1\THIRDW~1\curbflap.exe
O4 - HKUS\S-1-5-21-343818398-963894560-725345543-1003\..\Run: [Barb Soft] C:\DOCUME~1\Loan\APPLIC~1\THIRDW~1\curbflap.exe (User '?')

O9 - Extra button: (no name) - {85e1f530-48f4-11d9-9629-08ff2ffc9f67} - (no file)

O20 - Winlogon Notify: vturopq - C:\WINDOWS\



Delete the files in Red

C:\Documents and Settings\All Users\Application Data\Browse Dent Win Base
C:\Documents and Settings\Loan\Application Data\THIRDW~1




Now run Combofix. Its a very small and brief download

Download ComboFix from Here or Here to your Desktop. <– Important
  • Double click combofix.exe and follow the prompts.
  • When finished, it shall produce a log for you. Post the Combofix log and a HiJackthis log in your next reply
Note: Do not mouseclick combofix's window while its running. That may cause it to stall


I need to see the following, just copy and paste the reports in, do not QUOTE them please

1. No Lop report
2. Combofix Report
3. New HJT log
Post #7 last edited
Yet, another problem…
I unchecked Resident "Tea Timer" (Protection of over-all system settings) active. and about 20-30 seconds later, a message pop up from the bottom right (message from Spybot Search & Destroy). It says something about denying the change I did (which is unchecking Resident "Tea Timer"), I reopened Spybot Search & Destroy, went back to the tools and the Resident "Tea Timer" is checked again (it automatically checks it later on, I've tried a few times).

I scanned with NoLop! again, and found this under Path & File: C:\WINDOWS\tasks\A2A16EB4906AEA3C.job and File Size is: 266
I didn't go further on with your tutorial.
Post #9 last edited
I can't delete C:\Documents and Settings\All Users\Application Data\Browse Dent Win Base, it gives me an error.
Here's the error:

[external image: Posted Image]

I have WINDOWS XP Service Pack 2, it's just a theme I'm using called Simple Life Theme

I've done:

Bypass Super Anti Spyware for the time being and do this.

We need to make sure all hidden files are showing :

* Click Start.
* Open My Computer.
* Select the Tools menu and click Folder Options.
* Select the View tab.
* Under the Hidden files and folders heading select Show hidden files and folders.
* Uncheck the Hide file extensions for known types option.
* Uncheck the Hide protected operatingDelete the files in Red

C:\Documents and Settings\All Users\Application Data\Browse Dent Win Base
C:\Documents and Settings\Loan\Application Data\THIRDW~1 system files (recommended) option.
* Click Yes to confirm.
* Click OK.


Once your system is clean, we suggest that you reverse this to keep critical windows files from accidentally being deleted.




Open HijackThis > Do a System Scan Only, close your browser and all open windows including this one, the only program or window you should have open is HijackThis, check the following entries and click on Fix Checked.

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

O2 - BHO: WebAssist - {85589B5D-D53D-4237-A677-46B82EA275F3} - (no file)

O4 - HKLM\..\Run: [Win Base 4 Download] C:\Documents and Settings\All Users\Application Data\Browse Dent Win Base\Real Keep.exe
O4 - HKCU\..\Run: [Barb Soft] C:\DOCUME~1\Loan\APPLIC~1\THIRDW~1\curbflap.exe
O4 - HKUS\S-1-5-21-343818398-963894560-725345543-1003\..\Run: [Barb Soft] C:\DOCUME~1\Loan\APPLIC~1\THIRDW~1\curbflap.exe (User '?')

O9 - Extra button: (no name) - {85e1f530-48f4-11d9-9629-08ff2ffc9f67} - (no file)

O20 - Winlogon Notify: vturopq - C:\WINDOWS\


I also, didn't go further on then the 4th step, which is this:

Delete the files in Red

C:\Documents and Settings\All Users\Application Data\Browse Dent Win Base
C:\Documents and Settings\Loan\Application Data\THIRDW~1


~ Question:
What is this message?
Why is it in my Startup bar?
Here's the message:

[external image: Posted Image]

I have WINDOWS XP Service Pack 2, it's just a theme I'm using called Simple Life Theme

~Question:
How come my MSN uninstalled automatically?
When I install MSN it just uninstalls again.
When I try installing Xfire, my computer freezes and when I restart my computer, it startup slowly.
When I try logging on Yahoo, it stops.
When I try logging on Runescape (to contact my friend, cause I can't use MSN, Yahoo, Xfire, etc…) it doesn't let me connect (it needs JAVA, I've got Java already…)

I got a few questions about a program.
My questions about Intel® GMA Driver:

What does Intel® GMA Driver do?
What is it use for?
Can it help my computer?
How do I use it?

~ Another question:

I've lost my volume files due to a virus, I found it perm deleted.
How did I found it perm deleted?
I downloaded PC Inspector File Recovery (need to research on this program. I don't know how to use it, how to restore deleted files from the past, so I need help with this too)

~ Another question:

While online gaming, would the Latency (A.K.A Ping, MS) reduce if I turn off my anti-virus (KasperSky Internet Security)?
And if I turn it off, will my computer can be easily infected while playing?

~ Thanks for reading, I'll be on everyday to read your reply.

- PS: I have changed my display name to KIRA
Post #10
You have an abundance of Malware on this system, your HJT log is the heartbeat of it all, whenever you run a scan that we post or remove entries with HJT or delete files, I always need to see a new HJT log so I can see what was removed and what was not, so without me even asking, always post a new HJT log AFTER your run a scan.


We are getting no place fast , all the questions your asking may not be malware related, don't know, we can tell after your system is clean, and if your still having those issues after your clean than I will direct you to some windows support sites that deal with issues like that. The amount of malware on your system may or may not be causing those issues.

Lets start from the beginning. I need you to run both these programs and post the reports along with a new HJT log.


Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy and Paste the entire report in your next reply along with a Hijackthis log.




Download ComboFix from Here or Here to your Desktop.

In the event you already have Combofix, this is a new version that I need you to download.
It must be saved directly to your desktop.


1. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

  • Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan.
  • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
  • Remember to re enable the protection again afterwards before connecting to the net


2. Close any open browsers and make sure you are disconnected from the net. Unplug the cable if need be before running combofix.
  • IF you have not already done so Combofix will disconnect your machine from the Internet when it starts.
  • If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.

3. Now double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review

Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze.
Post #11 last edited
I've closed all my anti-virus and scanned my comp with Malwarebytes and did your steps. I can't give you the ComboFix report because it wouldn't show, just after the reboot I turn on my cable, and double clicked ComboFix.exe, the blue box appeared and a few seconds later, I can't go on the net (but I restarted..). I tried 3 more times, same thing happened to me. But here are the reports you asked for:

Malwarebytes Report:

Malwarebytes' Anti-Malware 1.04
Database version: 376

Scan type: Quick Scan
Objects scanned: 30949
Time elapsed: 2 minute(s), 19 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 13
Registry Values Infected: 2
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\bho_adw.bhoad (Unknown.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\bho_adw.bhoad.1 (Unknown.Malware) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{85589b5d-d53d-4237-a677-46b82ea275f3} (Unknown.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{9ca1536d-5689-40ca-b92a-f646301517d7} (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{09dc28c6-bce2-42b1-b3ea-8ab82f0f3b0a} (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\jkwslist (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Juan (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\CAC (Malware.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\New Windows\Allow\host-domain-lookup.com (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\New Windows\Allow\www.host-domain-lookup.com (Malware.Trace) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

________________________________________________________________________________
________________________________________________________________________________
______________

New Hijackthis Log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:29, on 2008-02-19
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\taskswitch.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {85589B5D-D53D-4237-A677-46B82EA275F3} - (no file)
O3 - Toolbar: (no name) - {C5AF4D9B-0B55-4BAC-9486-218EA2C6BC3E} - (no file)
O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\system32\taskswitch.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Barb Soft] C:\DOCUME~1\Loan\APPLIC~1\THIRDW~1\curbflap.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-21-343818398-963894560-725345543-1003\..\Run: [SpeedConnectStartUp] (User '?')
O4 - HKUS\S-1-5-21-343818398-963894560-725345543-1003\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (User '?')
O4 - HKUS\S-1-5-21-343818398-963894560-725345543-1003\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User '?')
O4 - HKUS\S-1-5-21-343818398-963894560-725345543-1003\..\Run: [Barb Soft] C:\DOCUME~1\Loan\APPLIC~1\THIRDW~1\curbflap.exe (User '?')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Loan\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {02ECD07A-22D0-4AF0-BA0A-3F6B06086D08} (GamesCampus Control) - http://xiah.gamescampus.com/luncher/GamesCampus.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} (ijjiPlugin2 Class) - http://gamedownload.ijjimax.com/gamedownlo…Plugin11USA.cab
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedownlo…GPlugin9USA.cab
O20 - Winlogon Notify: vturopq - C:\WINDOWS\
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - Unknown owner - C:\Program Files\Spyware Doctor\svcntaux.exe (file missing)
O23 - Service: PC Tools Security Service (sdCoreService) - Unknown owner - C:\Program Files\Spyware Doctor\swdsvc.exe (file missing)
O23 - Service: PC Tools Spyware Doctor (SDhelper) - Unknown owner - C:\Program Files\Revolution\Spyware Doctor\sdhelp.exe (file missing)
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe (file missing)

–
End of file - 6911 bytes

________________________________________________________________________________
________________________________________________________________________________
______________

Actually, I think it's fixed, but I'll stay tuned incase it happens again, and tips for extra protection.
Post #12

Actually, I think it's fixed, but I'll stay tuned incase it happens again, and tips for extra protection.

Actually its quite the opposite, your still infected.


Follow all the steps in order, if one won't work, don't stop, move on to the next one.

C:\Rapport <– You can find the Combofix log here, post it please.

Try disabling the TeaTimer again, if it still won't disable than go to your Add Remove Programs in the Control Panel and uninstall Spybot Search and Destroy, we can always re install it when where done.


Disable the TeaTimer, you can re enable it when were done if you wish
  • Run Spybot-S&D in Advanced Mode.
  • If it is not already set to do this Go to the Mode menu select "Advanced Mode"
  • On the left hand side, Click on Tools
  • Then click on the Resident Icon in the List
  • Uncheck "Resident TeaTimer" and OK any prompts.
  • Restart your computer. <– Important



Open HijackThis > Do a System Scan Only, close your browser and all open windows including this one, the only program or window you should have open is HijackThis, check the following entries and click on Fix Checked.

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

O2 - BHO: (no name) - {85589B5D-D53D-4237-A677-46B82EA275F3} - (no file)
O4 - HKCU\..\Run: [Barb Soft] C:\DOCUME~1\Loan\APPLIC~1\THIRDW~1\curbflap.exe
O4 - HKUS\S-1-5-21-343818398-963894560-725345543-1003\..\Run: [Barb Soft] C:\DOCUME~1\Loan\APPLIC~1\THIRDW~1\curbflap.exe (User '?')

O20 - Winlogon Notify: vturopq - C:\WINDOWS\



Please download OTMoveIt2 by OldTimer.
  • Save it to your desktop.
  • Please double-click OTMoveIt.exe to run it.
  • Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

    C:\Documents and Settings\All Users\Application Data\Browse Dent Win Base
    C:\Documents and Settings\Loan\Application Data\THIRDW~1

  • Return to OTMoveIt, right click on the "Paste List of Files/Folders to be moved" window and choose Paste.
  • Click the red Moveit! button.
  • Copy everything on the Results window to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it on your next reply.
  • Close OTMoveIt
If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.


Now its imperative that we run SuperAntiSpyware, try downloading it again, with some of the garbage that Malwarebytes removed it may let you download it now, if you still can't download it then you need to go to a known clean computer, a friends or family member and download the program to your desktop and copy the program to a thumb drive or a CD and transfer it to your infected computer, install it and run it and post the log.

You can also try downloading it in Safemode with Network Support
To Enter Safemode

  • Go to Start> Shut off your Computer> Restart
  • As the computer starts to boot-up, Tap the F8 KEY somewhat rapidly,
    this will bring up a menu.
  • Use the Up and Down Arrow Keys to scroll up to Safemode with Network Support
  • Then press the Enter Key on your Keyboard
Tutorial if you need it How to boot into Safemode



This is what you need to do in order

1. Disable the TeaTimer or uninstall Spybot
2. Post the Combofix log
3. Remove those entries with HJT.
4. Delete those files with OtMoveIt.
5. One way or another run SuperAnti Spyware.


This is what I need to see, can't help you if I don't see them.

1. Combofix log
2. OtMoveIt log
3. SAS log
4. New HJT log
Post #13 last edited
I downloaded successfully with safe mode on.
Okay, i could install SAS now.
and sorry for making you repeat.
Here's some of the logs you requested:

ComboFix Log:
ComboFix 08-02-19.2 - Loan 2008-02-22 0:05:57.4 - NTFSx86

Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-01-21 to 2008-02-21 )))))))))))))))))))))))))))))))
.

2008-02-22 00:03 . 2008-02-22 00:03 d——– C:\_OTMoveIt
2008-02-20 17:59 . 2008-02-20 17:59 d——– C:\Documents and Settings\All Users\Application Data\IJJIGame
2008-02-20 17:37 . 2008-02-20 17:37 d–hs—- C:\found.000
2008-02-20 07:47 . 2008-02-20 07:47 d——– C:\Program Files\Common Files\INCA Shared
2008-02-20 07:25 . 2008-02-20 07:25 d——– C:\ijji
2008-02-19 20:28 . 2008-02-19 20:28 d——– C:\Program Files\MSN Messenger
2008-02-19 20:24 . 2008-02-19 20:24 268 –ah—– C:\sqmdata00.sqm
2008-02-19 20:24 . 2008-02-19 20:24 244 –ah—– C:\sqmnoopt00.sqm
2008-02-19 15:54 . 2008-02-19 15:54 d——– C:\Program Files\Malwarebytes' Anti-Malware
2008-02-19 15:54 . 2008-02-19 15:54 d——– C:\Documents and Settings\Loan\Application Data\Malwarebytes
2008-02-19 15:54 . 2008-02-19 15:54 d——– C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-02-17 20:54 . 2008-02-21 23:29 d——– C:\NoLopBackups
2008-02-14 21:18 . 2008-02-14 21:18 1,374 –a—— C:\WINDOWS\imsins.BAK
2008-02-14 11:36 . 2008-02-14 11:36 d——– C:\WINDOWS\.silabclient_store_32
2008-02-10 00:15 . 2008-02-10 00:15 d——– C:\Program Files\PC Inspector File Recovery
2008-02-10 00:15 . 2002-02-18 18:40 6,200 –a—— C:\WINDOWS\system32\INT13EXT.VXD
2008-02-09 21:50 . 2008-02-09 21:50 d——– C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-02-09 17:07 . 2008-02-09 17:07 d——– C:\Temp
2008-02-07 19:27 . 2008-02-07 19:27 14 –a—— C:\WINDOWS\ASSE.dat
2008-01-31 19:13 . 2008-01-31 20:41 d——– C:\Documents and Settings\Loan\Application Data\DMCache
2008-01-31 11:27 . 2008-01-31 11:27 d——– C:\Program Files\CleanUp!
2008-01-31 11:24 . 2008-01-31 11:24 d——– C:\Program Files\CCleaner
2008-01-31 10:24 . 2008-01-31 10:24 d——– C:\Program Files\Trend Micro
2008-01-31 09:37 . 2007-10-26 14:36 12,867,072 –a–c— C:\WINDOWS\system32\dllcache\nst7A.tmp
2008-01-31 09:11 . 2008-01-31 09:11 d——– C:\WINDOWS\DED53B0BB67C4244AE6AD6FD3C28D1EF.TMP
2008-01-31 09:11 . 2008-01-31 09:11 d——– C:\Program Files\Common Files\Wise Installation Wizard
2008-01-30 16:00 . 2008-01-30 16:00 d——– C:\Program Files\NVIDIA Corporation
2008-01-30 16:00 . 2002-01-05 03:40 487,424 -ra—— C:\WINDOWS\system32\msvcp70.dll
2008-01-30 16:00 . 2002-08-15 10:11 344,064 -ra—— C:\WINDOWS\system32\msvcr70.dll
2008-01-21 13:07 . 2008-01-21 13:07 d–hs—- C:\Diskeeper
2008-01-21 11:35 . 2008-02-19 20:24 d——– C:\Documents and Settings\Loan\Tracing
2008-01-21 10:59 . 2008-01-21 10:59 d——– C:\Documents and Settings\All Users\Application Data\Diskeeper Corporation
2008-01-21 10:58 . 2008-01-21 10:58 d——– C:\Program Files\Diskeeper Corporation
2008-01-21 09:00 . 2007-05-16 16:41 29,704 –a—— C:\WINDOWS\system32\uxtuneup.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-21 12:30 ——— d—–w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-02-21 12:28 67,928 –sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-02-21 12:28 4,942,368 –sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-02-21 12:28 14,960 –sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-02-21 12:28 138,784 –sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-02-21 11:42 ——— d—–w C:\Documents and Settings\Loan\Application Data\gtk-2.0
2008-02-21 02:11 ——— d–h–w C:\Documents and Settings\Loan\Application Data\ijjigame
2008-02-19 20:41 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-02-14 09:11 ——— d—–w C:\Program Files\Daemons Ring GunZ
2008-01-31 22:40 ——— d—–w C:\Program Files\GIMP-2.0
2008-01-31 18:23 91,700 —-a-w C:\WINDOWS\system32\drivers\klin.dat
2008-01-31 00:34 ——— d—–w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-01-31 00:24 ——— d—–r C:\Program Files\Yahoo!
2008-01-29 09:08 ——— d—–w C:\Documents and Settings\Loan\Application Data\Azureus
2008-01-29 09:07 ——— d—–w C:\Program Files\Cheat Engine
2008-01-20 07:32 85,860 —-a-w C:\WINDOWS\system32\drivers\klick.dat
2008-01-20 07:32 ——— d—–w C:\Program Files\Kaspersky Lab
2008-01-19 23:39 ——— d—–w C:\Documents and Settings\All Users\Application Data\Avg7
2008-01-19 11:15 ——— d—–w C:\Program Files\DDS Converter 2
2008-01-18 23:27 ——— d—–w C:\Program Files\GtkRadiant 1.5.0
2008-01-17 21:41 ——— d—–w C:\Program Files\HashTab Shell Extension
2008-01-17 06:06 ——— d—–w C:\Program Files\Azureus
2008-01-16 05:50 ——— d—–w C:\Program Files\Thirdwaiteq
2008-01-15 11:16 ——— d—–w C:\Documents and Settings\Loan\Application Data\RadiantSettings
2008-01-14 23:08 ——— d—–w C:\Documents and Settings\Loan\Application Data\Someplayer
2008-01-14 23:07 ——— d—–w C:\Documents and Settings\All Users\Application Data\Someplayer
2008-01-12 14:34 ——— d—–w C:\Program Files\SEGA
2008-01-08 13:44 ——— d—–w C:\Documents and Settings\All Users\Application Data\Azureus
2008-01-06 21:36 ——— d—–w C:\Program Files\Circle Developement
2007-12-31 21:04 ——— d—–w C:\Program Files\Covey Inc
2007-12-31 12:09 ——— d—–w C:\Program Files\Common Files\Adobe
2007-12-31 09:02 ——— d—–w C:\Documents and Settings\All Users\Application Data\Adobe Systems
2007-12-27 13:23 ——— d—–w C:\Program Files\Windows Journal Viewer
2007-12-27 12:14 ——— dcsh–w C:\Program Files\Common Files\WindowsLiveInstaller
2007-12-27 00:30 ——— d—–w C:\Program Files\Samsung
2007-12-26 13:27 ——— d—–w C:\Program Files\Mugen
2007-12-26 11:12 65,170 —-a-w C:\WINDOWS\BricoPackUninst.cmd
2007-12-26 11:12 6,112 —-a-w C:\WINDOWS\BricoPackFoldersDelete.cmd
2007-12-25 14:35 ——— d—–w C:\Documents and Settings\Loan\Application Data\ViStart
2007-12-24 10:39 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-12-24 10:38 ——— d—–w C:\Program Files\Spybot - Search & Destroy
2007-12-17 13:44 219,664 —-a-w C:\WINDOWS\system32\klogon.dll
2007-12-08 22:53 274,432 —-a-w C:\WINDOWS\system32\imon.dll
2007-12-07 02:21 824,832 —-a-w C:\WINDOWS\system32\wininet.dll
2007-12-04 18:38 550,912 —-a-w C:\WINDOWS\system32\oleaut32.dll
2007-12-01 13:29 7,650,416 —-a-w C:\WINDOWS\98910.exe
2006-09-17 21:58 141 —-a-w C:\Program Files\credits.txt
2004-03-11 03:27 40,960 —-a-w C:\Program Files\Uninstall_CDS.exe
2007-10-22 15:27 363,679 –sh–w C:\WINDOWS\system32\cbadd.bak1
2007-10-22 06:23 363,934 –sh–w C:\WINDOWS\system32\hhhkj.bak1
2007-09-24 04:10 693,481 –sha-w C:\WINDOWS\system32\lypnbvde.ini2
2007-10-21 09:09 363,894 –sh–w C:\WINDOWS\system32\nqtss.bak1
2007-09-23 14:06 693,592 –sha-w C:\WINDOWS\system32\oqdxvgen.ini2
2007-10-21 16:49 363,934 –sh–w C:\WINDOWS\system32\orqss.bak1
2007-10-21 08:00 363,974 –sh–w C:\WINDOWS\system32\rtvwa.bak1
2007-10-23 18:47 364,067 –sh–w C:\WINDOWS\system32\ttstv.bak1
2007-09-26 08:57 710,381 –sha-w C:\WINDOWS\system32\wvvwa.bak1
2007-10-21 07:15 478,568 –sha-w C:\WINDOWS\system32\wvvwa.bak2
2007-10-21 07:59 475,380 –sha-w C:\WINDOWS\system32\wvvwa.ini2
2007-09-20 08:25 694,016 –sha-w C:\WINDOWS\system32\xkwfmddr.ini2
.

——- Sigcheck ——-

"C:\WINDOWS\system32\user32.dll"
—-a-w 577,024 2005-03-02 18:19:56 C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\user32.dll
—-a-w 578,048 2007-03-08 15:48:36 C:\WINDOWS\$hf_mig$\KB925902\SP2QFE\user32.dll
-c—-w 577,024 2004-08-04 12:00:00 C:\WINDOWS\$NtUninstallKB890859$\user32.dll
-c—-w 577,024 2005-03-02 18:09:30 C:\WINDOWS\$NtUninstallKB925902$\user32.dll
—-a-w 577,024 2007-03-08 15:36:28 C:\WINDOWS\system32\user32.dll
-c–a-w 577,024 2007-03-08 15:36:28 C:\WINDOWS\system32\dllcache\user32.dll

"C:\WINDOWS\explorer.exe"
—-a-w 975,360 2007-06-13 10:23:07 C:\WINDOWS\explorer.exe
—-a-w 1,033,216 2007-06-13 11:26:03 C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
-c—-w 1,032,192 2004-08-04 12:00:00 C:\WINDOWS\$NtUninstallKB938828$\explorer.exe
-c–a-w 975,360 2007-06-13 10:23:07 C:\WINDOWS\system32\dllcache\explorer.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 23:00 15360]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-06-07 15:08 4670968]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648]
"CoolSwitch"="C:\WINDOWS\system32\taskswitch.exe" [2002-03-19 17:30 45632]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" [2007-12-18 00:43 227856]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 23:00 15360]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:54 5674352]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"RunStartupScriptSync"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoChangeAnimation"= 0 (0x0)
"NoStrCmpLogical"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoInstrumentation"= 1 (0x1)
"MemCheckBoxInRunDlg"= 0 (0x0)
"NoStrCmpLogical"= 0 (0x0)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe .MS32DLL.dll.vbs

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-22 00:06:56
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
"ImagePath"="\??\C:\Documents and Settings\Loan\Desktop\Kiki Engine 1.41
[Unpacked]\kiki.sys"

.
Completion time: 2008-02-22 0:07:55
ComboFix-quarantined-files.txt 2008-02-21 13:07:53
ComboFix2.txt 2008-02-21 12:54:00
ComboFix3.txt 2008-02-21 12:51:56

OtMoveIt Log:
[Custom Input]
< C:\Documents and Settings\All Users\Application Data\Browse Dent Win Base >
File/Folder C:\Documents and Settings\All Users\Application Data\Browse Dent Win Base not found.
< C:\Documents and Settings\Loan\Application Data\THIRDW~1 >
File/Folder C:\Documents and Settings\Loan\Application Data\THIRDW~1 not found.

OTMoveIt2 v1.0.20 log created on 02222008_001904

SAS Log:
SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 02/22/2008 at 00:38 AM

Application Version : 3.9.1008

Core Rules Database Version : 3407
Trace Rules Database Version: 1399

Scan type : Complete Scan
Total Scan Time : 00:08:42

Memory items scanned : 325
Memory threats detected : 0
Registry items scanned : 4453
Registry threats detected : 0
File items scanned : 34776
File threats detected : 0

New Hijackthis Log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:40:11 AM, on 22/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\taskswitch.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O3 - Toolbar: (no name) - {C5AF4D9B-0B55-4BAC-9486-218EA2C6BC3E} - (no file)
O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\system32\taskswitch.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-21-343818398-963894560-725345543-1003\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User '?')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Loan\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {02ECD07A-22D0-4AF0-BA0A-3F6B06086D08} (GamesCampus Control) - http://xiah.gamescampus.com/luncher/GamesCampus.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - Unknown owner - C:\Program Files\Spyware Doctor\svcntaux.exe (file missing)
O23 - Service: PC Tools Security Service (sdCoreService) - Unknown owner - C:\Program Files\Spyware Doctor\swdsvc.exe (file missing)
O23 - Service: PC Tools Spyware Doctor (SDhelper) - Unknown owner - C:\Program Files\Revolution\Spyware Doctor\sdhelp.exe (file missing)
O23 - Service: Messenger Sharing Folders USN Journal Reader service (usnjsvc) - Unknown owner - C:\Program Files\Windows Live\Messenger\usnsvc.exe (file missing)
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe (file missing)

–
End of file - 5984 bytes

Good night, I'll be checking in the morning.
(: Kira
Post #14
Hello Kira,

You did very well :thumbup: Just a little clean up to do

You can by pass the download if you still have this program on your desktop
Please download OTMoveIt2 by OldTimer.
  • Save it to your desktop.
  • Please double-click OTMoveIt.exe to run it.
  • Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

    C:\NoLopBackups
    C:\WINDOWS\system32\cbadd.bak1
    C:\WINDOWS\system32\hhhkj.bak1
    C:\WINDOWS\system32\lypnbvde.ini2
    C:\WINDOWS\system32\nqtss.bak1
    C:\WINDOWS\system32\oqdxvgen.ini2
    C:\WINDOWS\system32\orqss.bak1
    C:\WINDOWS\system32\rtvwa.bak1
    C:\WINDOWS\system32\ttstv.bak1
    C:\WINDOWS\system32\wvvwa.bak1
    C:\WINDOWS\system32\wvvwa.bak2
    C:\WINDOWS\system32\wvvwa.ini2
    C:\WINDOWS\system32\xkwfmddr.ini2

  • Return to OTMoveIt, right click on the "Paste List of Files/Folders to be moved" window and choose Paste.
  • Click the red Moveit! button.
  • Copy everything on the Results window to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it on your next reply.
  • Close OTMoveIt
If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.




Please download ATF Cleaner by Atribune to your desktop.
  • This program is for XP and Windows 2000 only
  • Double-click ATF-Cleaner.exe to run the program.
  • Under Main choose: Select All
  • Click the Empty Selected button.

Your system may start up slower after running ATF Cleaner, this is expected but will be back to normal after the first or second boot up





I need some info from you.
C:\Program Files\Thirdwaiteq <– Is this something you installed and know about ??



There is also a file on your system I am not sure about, so do this please.

Do this first so it will show up.

You need to enable windows to show all files and folders, instructions Here

Go to VirusTotal and submit this file for analysis, just use the browse feature and then subit them , you will get a report back, post the report into this thread for me to see.
C:\WINDOWS\98910.exe




Just let me know about that program, post the report from VirusTotal and the OtMoveIt log, the rest of your HJT log looks fine :thumbup: How would you say your system is running now???
Post #15 last edited
AWESOME! :notworthy: I don't know about Thirdwaiteq, it was probably installed WITH this computer when I bought it. Heres my OTMoveIt2 log no problems doing this step: [Custom Input] < C:\NoLopBackups > C:\NoLopBackups moved successfully. < C:\WINDOWS\system32\cbadd.bak1 > C:\WINDOWS\system32\cbadd.bak1 moved successfully. < C:\WINDOWS\system32\hhhkj.bak1 > C:\WINDOWS\system32\hhhkj.bak1 moved successfully. < C:\WINDOWS\system32\lypnbvde.ini2 > C:\WINDOWS\system32\lypnbvde.ini2 moved successfully. < C:\WINDOWS\system32\nqtss.bak1 > C:\WINDOWS\system32\nqtss.bak1 moved successfully. < C:\WINDOWS\system32\oqdxvgen.ini2 > C:\WINDOWS\system32\oqdxvgen.ini2 moved successfully. < C:\WINDOWS\system32\orqss.bak1 > C:\WINDOWS\system32\orqss.bak1 moved successfully. < C:\WINDOWS\system32\rtvwa.bak1 > C:\WINDOWS\system32\rtvwa.bak1 moved successfully. < C:\WINDOWS\system32\ttstv.bak1 > C:\WINDOWS\system32\ttstv.bak1 moved successfully. < C:\WINDOWS\system32\wvvwa.bak1 > C:\WINDOWS\system32\wvvwa.bak1 moved successfully. < C:\WINDOWS\system32\wvvwa.bak2 > C:\WINDOWS\system32\wvvwa.bak2 moved successfully. < C:\WINDOWS\system32\wvvwa.ini2 > C:\WINDOWS\system32\wvvwa.ini2 moved successfully. < C:\WINDOWS\system32\xkwfmddr.ini2 > C:\WINDOWS\system32\xkwfmddr.ini2 moved successfully. OTMoveIt2 v1.0.20 log created on 02222008_105143

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI