What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] hijackthis log, norton can't fix?

27 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
My log.. Can't seem to shake it, norton antivirus 2008 can't remove it, only block it? Any help would be appreciated, please.


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:53:05 PM, on 2/17/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\QuickTime\qttask .exe
C:\WINDOWS\lsass.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\fior garcia\Desktop\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com/avcenter/fix_homepage/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: (no name) - {087429C0-F1EF-4DDB-AE48-701C2F52C8B3} - C:\Program Files\ComPlus Applications\menor83122.dll (file missing)
O2 - BHO: {bb122dbe-e960-6e9a-4db4-076343e91c64} - {46c19e34-3670-4bd4-a9e6-069eebd221bb} - C:\WINDOWS\System32\hjaigoia.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: BndVeano4 BHO Class - {8E4881AC-49E2-4761-9542-7E40C73CFB96} - C:\Program Files\QdrDrive\QdrDrive9.dll (file missing)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O2 - BHO: (no name) - {B6C59BFA-AD45-491A-BCD0-20B3207E3B78} - C:\WINDOWS\System32\ljjge.dll (file missing)
O2 - BHO: (no name) - {E2AB8F41-62FE-2F4D-DA2F-4AE6718508C4} - C:\WINDOWS\System32\mwjl.dll (file missing)
O2 - BHO: (no name) - {E3AB8F40-6280-284F-DA2F-3EE6078908C7} - C:\WINDOWS\System32\mwjl.dll (file missing)
O2 - BHO: (no name) - {FF64059D-4D2A-4D6B-AA0F-2EE4A2FE3856} - C:\WINDOWS\System32\ddcbyxv.dll (file missing)
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask .exe" -atboottime
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\Support.com\BellSouth\hcenter.exe" /starthidden /tgcmdwrapper
O4 - HKLM\..\Run: [lsass] C:\WINDOWS\lsass.exe
O4 - HKLM\..\Run: [009c641e] rundll32.exe "C:\WINDOWS\System32\mhyblxhk.dll",b
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKCU\..\Run: [Router] C:\Program Files\Router\Router.exe
O4 - HKCU\..\Run: [QdrPack12] "C:\Program Files\QdrPack\QdrPack12.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Rabio - Auto Update.lnk = C:\Program Files\Rabio\se.exe
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/…?p=ZKxdm021YYUS
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/f…p1.0.0.15-3.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1188597418891
O16 - DPF: {74C861A1-D548-4916-BC8A-FDE92EDFF62C} - http://mediaplayer.walmart.com/installer/install.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A9B5FA7C-2755-4D1F-B69C-D00421001E55}: Domain = broward.k12.fl.us
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = broward.k12.fl.us
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = broward.k12.fl.us
O20 - AppInit_DLLs: C:\WINDOWS\system32\wowfx.dll
O20 - Winlogon Notify: bbjlwesm - bbjlwesm.dll (file missing)
O20 - Winlogon Notify: ddcbyxv - ddcbyxv.dll (file missing)
O21 - SSODL: RamDrv - {16b66887-823a-41e3-ad94-01407d4c0a4d} - C:\WINDOWS\Installer\{16b66887-823a-41e3-ad94-01407d4c0a4d}\RamDrv.dll
O21 - SSODL: AvpRom - {1c4d71fa-8393-4e82-85b3-0e81c1244e0e} - C:\WINDOWS\Installer\{1c4d71fa-8393-4e82-85b3-0e81c1244e0e}\AvpRom.dll
O21 - SSODL: UnknownAvp - {86e87156-8ae6-48f4-8604-cb0738e770eb} - C:\WINDOWS\Installer\{86e87156-8ae6-48f4-8604-cb0738e770eb}\UnknownAvp.dll
O21 - SSODL: zip - {9d7ddbce-52fa-4f06-91da-9b91975f5614} - C:\WINDOWS\Installer\{9d7ddbce-52fa-4f06-91da-9b91975f5614}\zip.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AOL Antivirus Update Service (aolavupd) - Unknown owner - C:\Program Files\Common Files\AOL\1182399618\ee\services\safetyCore\ver210_5_4_1\aolavupd.exe (file missing)
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE (file missing)
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: WLTRYSVC - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE (file missing)
O24 - Desktop Component 0: (no name) - C:\Program Files\MSN Gaming Zone\rtejezas.html

–
End of file - 9065 bytes
Post #2
Hello Juggy1028 and welcome to the What the Tech Forums

My name is Trevuren and I will be helping you with your problem.


Please download ComboFix by sUBs from HERE or HERE directly to your Desktop.

Note: If you already have ComboFix on your machine, please DELETE it from your desktop before downloading the newest version.

Go to [external image: Posted Image] -> Run -> copy/paste the following single line command in the runbox & click OK

"%userprofile%\desktop\combofix.exe" /killall

[external image: Posted Image]
  • ComboFix will automatically start. Any monitoring programs will be shut down like your antivirus, antispyware programs for example.
  • ComboFix may restart your computer, this is normal.
  • When finished, it will produce a log, ComboFix.txt.
  • Please post ComboFix.txt in your next reply along with a new HijackThis log.


Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
Post #3
Thanks for your quick response! I did as you said, but.. After combofix created the log file (after reboot) it never fully got back to windows, just a log file and a blank windows screen with my wallpaper in the background. I let it stay for 20mins, but it never recovered so I just logged off and back on. Here is the combofix log file and newly created hijackthis log file. Again, I appreciate the help.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:46, on 2008-02-18
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\fxssvc.exe
C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\QuickTime\qttask .exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\fior garcia\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: (no name) - {087429C0-F1EF-4DDB-AE48-701C2F52C8B3} - C:\Program Files\ComPlus Applications\menor83122.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: BndVeano4 BHO Class - {8E4881AC-49E2-4761-9542-7E40C73CFB96} - C:\Program Files\QdrDrive\QdrDrive9.dll (file missing)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O2 - BHO: (no name) - {B6C59BFA-AD45-491A-BCD0-20B3207E3B78} - C:\WINDOWS\System32\ljjge.dll (file missing)
O2 - BHO: (no name) - {E2AB8F41-62FE-2F4D-DA2F-4AE6718508C4} - C:\WINDOWS\System32\mwjl.dll (file missing)
O2 - BHO: (no name) - {E3AB8F40-6280-284F-DA2F-3EE6078908C7} - C:\WINDOWS\System32\mwjl.dll (file missing)
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask .exe" -atboottime
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\Support.com\BellSouth\hcenter.exe" /starthidden /tgcmdwrapper
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKCU\..\Run: [Router] C:\Program Files\Router\Router.exe
O4 - HKCU\..\Run: [QdrPack12] "C:\Program Files\QdrPack\QdrPack12.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O8 - Extra context menu item: &Search - ?p=ZKxdm021YYUS
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1188597418891
O16 - DPF: {74C861A1-D548-4916-BC8A-FDE92EDFF62C} - http://mediaplayer.walmart.com/installer/install.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A9B5FA7C-2755-4D1F-B69C-D00421001E55}: Domain = broward.k12.fl.us
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = broward.k12.fl.us
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = broward.k12.fl.us
O20 - Winlogon Notify: bbjlwesm - bbjlwesm.dll (file missing)
O20 - Winlogon Notify: ddcbyxv - ddcbyxv.dll (file missing)
O21 - SSODL: RamDrv - {16b66887-823a-41e3-ad94-01407d4c0a4d} - C:\WINDOWS\Installer\{16b66887-823a-41e3-ad94-01407d4c0a4d}\RamDrv.dll
O21 - SSODL: AvpRom - {1c4d71fa-8393-4e82-85b3-0e81c1244e0e} - C:\WINDOWS\Installer\{1c4d71fa-8393-4e82-85b3-0e81c1244e0e}\AvpRom.dll
O21 - SSODL: UnknownAvp - {86e87156-8ae6-48f4-8604-cb0738e770eb} - C:\WINDOWS\Installer\{86e87156-8ae6-48f4-8604-cb0738e770eb}\UnknownAvp.dll
O21 - SSODL: zip - {4d0b304c-e4be-4a8b-846d-bcae722dbe62} - C:\WINDOWS\Installer\{4d0b304c-e4be-4a8b-846d-bcae722dbe62}\zip.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AOL Antivirus Update Service (aolavupd) - Unknown owner - C:\Program Files\Common Files\AOL\1182399618\ee\services\safetyCore\ver210_5_4_1\aolavupd.exe (file missing)
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE (file missing)
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: WLTRYSVC - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE (file missing)

–
End of file - 8521 bytes



ComboFix 08-02-18.1 - fior garcia 2008-02-18 15:21:07.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.197 [GMT -6:00]
Running from: C:\Documents and Settings\[removed]\desktop\combofix.exe
Command switches used :: /killall
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\fior garcia\Application Data\SEMBLY~1
C:\Documents and Settings\fior garcia\Application Data\SEMBLY~1\??sembly\
C:\Documents and Settings\fior garcia\Start Menu\Programs\Internet Speed Monitor
C:\Documents and Settings\fior garcia\Start Menu\Programs\Internet Speed Monitor\Check Now.lnk
C:\Documents and Settings\fior garcia\Start Menu\Programs\Internet Speed Monitor\Uninstall.lnk
C:\Program Files\dobe~1
C:\Program Files\MSN Gaming Zone\rtejezas.html
C:\Program Files\WinAble
C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\bbjlwesm.dllbox
C:\WINDOWS\system32\drivers\fad.sys
C:\WINDOWS\SYSTEM32\egjjl.ini
C:\WINDOWS\SYSTEM32\egjjl.ini2
C:\WINDOWS\system32\hjaigoia.dll
C:\WINDOWS\system32\ineWc01
C:\WINDOWS\SYSTEM32\khxlbyhm.ini
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mhyblxhk.dll
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\system32\wcpicomsv.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
——-\LEGACY_NETWORK_MONITOR


((((((((((((((((((((((((( Files Created from 2008-01-18 to 2008-02-18 )))))))))))))))))))))))))))))))
.

2008-02-18 15:24 . 2008-02-18 15:24 6,736 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\PROCEXP90.SYS
2008-02-18 15:15 . 2008-02-18 15:15 15,872 –a—— C:\Program Files\tmp11198742.exe
2008-02-18 08:16 . 2008-02-18 08:16 d——– C:\Program Files\Spybot - Search & Destroy
2008-02-18 08:16 . 2008-02-18 09:18 d——– C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-17 15:02 . 2008-02-17 15:02 d——– C:\Program Files\Windows Sidebar
2008-02-17 15:02 . 2008-02-17 22:11 d——– C:\Program Files\Norton AntiVirus
2008-02-17 15:01 . 2008-02-17 22:07 123,952 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\SYMEVENT.SYS
2008-02-17 15:01 . 2008-02-17 22:07 60,800 –a—— C:\WINDOWS\SYSTEM32\S32EVNT1.DLL
2008-02-17 15:01 . 2008-02-17 22:07 10,740 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\SYMEVENT.CAT
2008-02-17 15:01 . 2008-02-17 22:07 805 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\SYMEVENT.INF
2008-02-17 15:00 . 2008-02-17 22:07 d——– C:\Program Files\Symantec
2008-02-17 14:42 . 2008-02-17 22:01 d——– C:\Program Files\Common Files\Symantec Shared
2008-02-17 12:58 . 2008-02-17 14:00 d——– C:\Documents and Settings\Administrator\Application Data\AOL
2008-02-17 12:43 . 2008-02-17 14:57 174,592 –a—— C:\WINDOWS\SYSTEM32\lexpps .exe
2008-02-17 12:25 . 2008-02-17 14:03 15,360 –a—— C:\WINDOWS\SYSTEM32\ctfmon .exe
2008-02-17 12:09 . 2007-12-06 20:21 6,066,176 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\ieframe.dll
2008-02-17 12:09 . 2007-06-30 21:31 2,455,488 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\ieapfltr.dat
2008-02-17 12:09 . 2007-06-30 21:36 991,232 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\ieframe.dll.mui
2008-02-17 12:09 . 2007-12-06 20:21 459,264 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\msfeeds.dll
2008-02-17 12:09 . 2007-12-06 20:21 383,488 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\ieapfltr.dll
2008-02-17 12:09 . 2007-12-06 20:21 267,776 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\iertutil.dll
2008-02-17 12:09 . 2007-12-06 20:21 63,488 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\icardie.dll
2008-02-17 12:09 . 2007-12-06 20:21 52,224 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\msfeedsbs.dll
2008-02-17 12:09 . 2007-12-06 05:00 13,824 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\ieudinit.exe
2008-02-17 11:54 . 2007-08-13 18:54 33,792 –a—— C:\WINDOWS\SYSTEM32\DLLCACHE\custsat.dll
2008-02-17 11:38 . 2006-08-21 03:14 128,896 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\fltmgr.sys
2008-02-17 11:38 . 2006-08-21 03:14 23,040 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\fltmc.exe
2008-02-17 11:38 . 2006-08-21 06:21 16,896 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\fltlib.dll
2008-02-17 11:23 . 2007-07-09 07:09 584,192 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\rpcrt4.dll
2008-02-16 21:01 . 2004-08-21 02:31 d——– C:\Documents and Settings\Administrator\Application Data\Symantec
2008-02-16 21:01 . 2004-08-21 02:27 d——– C:\Documents and Settings\Administrator\Application Data\Sonic
2008-02-16 21:01 . 2004-08-21 02:30 d——– C:\Documents and Settings\Administrator\Application Data\Jasc Software Inc
2008-02-16 20:22 . 2008-02-16 20:22 d——– C:\Program Files\Lavasoft
2008-02-16 20:22 . 2008-02-16 20:27 d——– C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-02-16 18:51 . 2004-08-04 01:56 221,184 –a—— C:\WINDOWS\SYSTEM32\wmpns.dll
2008-02-16 18:46 . 2008-02-16 18:46 d——– C:\WINDOWS\provisioning
2008-02-16 18:46 . 2008-02-16 18:46 d——– C:\WINDOWS\peernet
2008-02-16 18:42 . 2008-02-16 18:42 d——– C:\WINDOWS\ServicePackFiles
2008-02-16 18:30 . 2008-02-16 18:30 d——– C:\WINDOWS\EHome

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-18 15:17 ——— d—–w C:\Documents and Settings\All Users\Application Data\Rabio
2008-02-18 03:48 ——— d—–w C:\Documents and Settings\All Users\Application Data\Symantec
2008-02-18 03:14 ——— d—–w C:\Program Files\Google
2008-02-17 22:25 ——— d—–w C:\Program Files\QuickTime
2008-02-17 22:25 ——— d—–w C:\Program Files\DellSupport
2008-02-17 21:19 ——— d—–w C:\Documents and Settings\juan moronta\Application Data\Symantec
2008-02-17 20:00 ——— d—–w C:\Program Files\Common Files\AOL
2008-02-17 19:12 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-02-17 18:58 ——— d—–w C:\Documents and Settings\All Users\Application Data\AOL
2008-02-17 18:57 ——— d—–w C:\Program Files\Common Files\aolshare
2008-02-17 18:56 ——— d—–w C:\Program Files\Dell
2008-02-17 02:20 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2008-02-17 00:16 ——— d—–w C:\Documents and Settings\fior garcia\Application Data\MSN6
2008-01-15 15:54 10,537 —-a-w C:\WINDOWS\system32\drivers\coh_mon.cat
2008-01-15 11:28 706 —-a-w C:\WINDOWS\system32\drivers\COH_Mon.inf
2008-01-13 02:22 ——— d—–w C:\Program Files\Wal-Mart Music Downloads Store
2008-01-13 01:43 ——— d—–w C:\Program Files\Citrix
2008-01-13 01:35 ——— d—–w C:\Documents and Settings\juan moronta\Application Data\Viewpoint
2008-01-13 01:02 ——— d—–w C:\Documents and Settings\juan moronta\Application Data\MSN6
2008-01-13 00:52 ——— d—–w C:\Documents and Settings\juan moronta\Application Data\BLSTOOLBAR
2008-01-13 00:32 23,904 —-a-w C:\WINDOWS\system32\drivers\COH_Mon.sys
2007-12-23 17:25 ——— d—–w C:\Documents and Settings\fior garcia\Application Data\BLSTOOLBAR
2007-12-23 14:48 ——— d—–w C:\Documents and Settings\All Users\Application Data\McAfee
2007-12-23 06:01 ——— d—–w C:\Documents and Settings\LocalService\Application Data\BLSTOOLBAR
2007-12-20 22:54 13,918 —-a-w C:\Documents and Settings\juan moronta\Application Data\wklnhst.dat
2007-12-20 03:55 80,704 —-a-w C:\Documents and Settings\juan moronta\Application Data\GDIPFONTCACHEV1.DAT
2007-12-18 09:51 179,584 —-a-w C:\WINDOWS\system32\drivers\mrxdav.sys
2007-11-08 00:26 720 —-a-w C:\Documents and Settings\Giancarlo\Application Data\wklnhst.dat
2007-08-31 21:36 60,968 —-a-w C:\Documents and Settings\juan moronta\GoToAssistDownloadHelper.exe
2007-08-17 22:38 6,947,971 —-a-w C:\Documents and Settings\juan moronta\HC4Installer.exe
2007-07-28 09:06 135 —-a-w C:\Program Files\page.html
2007-05-05 19:22 774,144 —-a-w C:\Program Files\RngInterstitial.dll
2007-02-22 19:26 66,792 —-a-w C:\Documents and Settings\Giancarlo\Application Data\GDIPFONTCACHEV1.DAT
2007-02-21 01:32 66,269 —-a-w C:\Program Files\INSTALL.LOG
2006-12-03 01:05 2,522 —-a-w C:\Program Files\func.js
2006-11-25 07:57 482 —-a-w C:\Program Files\Del.js
2006-07-08 01:29 580 —-a-w C:\Documents and Settings\fior garcia\Application Data\wklnhst.dat
.
—-a-w		 1,896,448 2008-02-17 20:58:44  C:\Program Files\BellSouth\Alert Manager\BellSouthAlertManager .exe
—-a-w		   487,424 2008-02-17 23:19:06  C:\Program Files\Dell\QuickSet\quickset  .exe
—-a-w		   487,424 2008-02-17 00:08:44  C:\Program Files\Dell\QuickSet\quickset .exe
—-a-w			68,856 2008-02-17 20:59:40  C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier .exe
—-a-w		 1,694,208 2008-02-17 20:59:44  C:\Program Files\Messenger\msmsgs .exe
—-a-w		   200,704 2008-02-17 20:59:26  C:\Program Files\Microsoft Money\System\mnyexpr .exe
—-a-w		   131,072 2008-02-17 20:58:42  C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray .exe
—-a-w		   282,624 2008-02-17 22:32:45  C:\Program Files\QuickTime\qttask				.exe
—-a-w		   282,624 2008-02-17 23:11:56  C:\Program Files\QuickTime\qttask			   .exe
—-a-w		   282,624 2008-02-17 23:11:57  C:\Program Files\QuickTime\qttask			  .exe
—-a-w		   282,624 2008-02-17 23:11:58  C:\Program Files\QuickTime\qttask			 .exe
—-a-w		   282,624 2008-02-17 23:11:59  C:\Program Files\QuickTime\qttask			.exe
—-a-w		   282,624 2008-02-17 23:12:00  C:\Program Files\QuickTime\qttask		   .exe
—-a-w		   282,624 2008-02-17 23:12:01  C:\Program Files\QuickTime\qttask		  .exe
—-a-w		   282,624 2008-02-17 23:12:02  C:\Program Files\QuickTime\qttask		 .exe
—-a-w		   282,624 2008-02-17 23:12:03  C:\Program Files\QuickTime\qttask		.exe
—-a-w		   282,624 2008-02-17 23:12:04  C:\Program Files\QuickTime\qttask	   .exe
—-a-w		   282,624 2008-02-17 23:12:05  C:\Program Files\QuickTime\qttask	  .exe
—-a-w		   282,624 2008-02-17 23:12:06  C:\Program Files\QuickTime\qttask	 .exe
—-a-w		   282,624 2008-02-17 23:12:07  C:\Program Files\QuickTime\qttask	.exe
—-a-w		   282,624 2008-02-17 23:12:08  C:\Program Files\QuickTime\qttask   .exe
—-a-w		   282,624 2008-02-17 23:11:30  C:\Program Files\QuickTime\qttask  .exe
—-a-w		   282,624 2008-02-17 23:11:31  C:\Program Files\QuickTime\qttask .exe
—-a-w			15,360 2008-02-17 20:03:29  C:\WINDOWS\SYSTEM32\ctfmon .exe
—-a-w		   174,592 2008-02-17 20:57:30  C:\WINDOWS\SYSTEM32\lexpps .exe


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{087429C0-F1EF-4DDB-AE48-701C2F52C8B3}]
C:\Program Files\ComPlus Applications\menor83122.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}]
2008-02-17 18:20 116088 –a—— C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8E4881AC-49E2-4761-9542-7E40C73CFB96}]
C:\Program Files\QdrDrive\QdrDrive9.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B6C59BFA-AD45-491A-BCD0-20B3207E3B78}]
C:\WINDOWS\System32\ljjge.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E2AB8F41-62FE-2F4D-DA2F-4AE6718508C4}]
C:\WINDOWS\System32\mwjl.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E3AB8F40-6280-284F-DA2F-3EE6078908C7}]
C:\WINDOWS\System32\mwjl.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Router"="C:\Program Files\Router\Router.exe" [ ]
"QdrPack12"="C:\Program Files\QdrPack\QdrPack12.exe" [ ]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-02-17 16:32 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="C:\Program Files\QuickTime\qttask .exe" [2008-02-17 16:32 282624]
"tgcmd"="C:\Program Files\Support.com\BellSouth\hcenter.exe" [ ]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-02-17 16:32 51048]
"osCheck"="C:\Program Files\Norton AntiVirus\osCheck.exe" [2008-02-17 16:32 714608]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{88485281-8b4b-4f8d-9ede-82e29a064277}"= C:\PROGRA~1\MarkAny\CONTEN~1\MACSMA~1.DLL [2004-11-23 15:51 192512]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"RamDrv"= {16b66887-823a-41e3-ad94-01407d4c0a4d} - C:\WINDOWS\Installer\{16b66887-823a-41e3-ad94-01407d4c0a4d}\RamDrv.dll [2008-02-16 18:39 13862]
"AvpRom"= {1c4d71fa-8393-4e82-85b3-0e81c1244e0e} - C:\WINDOWS\Installer\{1c4d71fa-8393-4e82-85b3-0e81c1244e0e}\AvpRom.dll [2008-02-16 18:39 13862]
"UnknownAvp"= {86e87156-8ae6-48f4-8604-cb0738e770eb} - C:\WINDOWS\Installer\{86e87156-8ae6-48f4-8604-cb0738e770eb}\UnknownAvp.dll [2008-02-16 18:39 13862]
"zip"= {4d0b304c-e4be-4a8b-846d-bcae722dbe62} - C:\WINDOWS\Installer\{4d0b304c-e4be-4a8b-846d-bcae722dbe62}\zip.dll [2008-02-18 15:15 24102]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\bbjlwesm]
bbjlwesm.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ddcbyxv]
ddcbyxv.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup=C:\WINDOWS\pss\Kodak EasyShare software.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak software updater.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak software updater.lnk
backup=C:\WINDOWS\pss\Kodak software updater.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^juan moronta^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
path=C:\Documents and Settings\juan moronta\Start Menu\Programs\Startup\LimeWire On Startup.lnk
backup=C:\WINDOWS\pss\LimeWire On Startup.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCMSMMSG]
–a—— 2003-08-29 04:59 122880 C:\WINDOWS\BCMSMMSG.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ContraVirus]
C:\Program Files\ContraVirus\ContraVirusPro.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DadApp]
C:\Program Files\Dell\AccessDirect\dadapp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell AIO Printer A920]
–a—— 2004-04-15 02:32 270336 C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
–a—— 2008-02-17 16:32 460784 C:\Program Files\DellSupport\DSAgnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dla]
C:\WINDOWS\system32\dla\tfswctrl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
——— 2004-04-11 10:43 53248 C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EmailScan]
C:\Program Files\mcafee.com\antivirus\mcvsescn.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HelpCenter]
–a—— 2006-10-30 11:00 192512 C:\Program Files\Bellsouth\HelpCenter\bin\sprtcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
C:\WINDOWS\system32\dumprep 0 -k

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark 1200 Series]
–a—— 2006-07-12 23:22 57344 C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Keyboard Enhance V2.0]
C:\WINDOWS\iasrecst.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Plus V7.1]
C:\WINDOWS\igfxunit32.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
——— 2003-12-05 21:08 50688 C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask]
–a—— 2004-04-19 13:45 53248 c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray]
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MoneyAgent]
C:\Program Files\Microsoft Money\System\mnyexpr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MPFExe]
C:\Program Files\mcafee.com\personal firewall\MPfTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
–a—— 2004-01-08 14:26 4866048 C:\WINDOWS\System32\NvCpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
–a—— 2004-01-08 14:26 323584 C:\WINDOWS\SYSTEM32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OASClnt]
C:\Program Files\mcafee.com\antivirus\oasclnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OM2_Monitor]
–a—— 2006-12-01 20:28 95800 C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService]
——— 2004-04-11 19:15 290816 C:\Program Files\Dell\Media Experience\PCMService.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
–a—— 2004-08-21 02:22 26112 C:\Program Files\Real\RealPlayer\RealPlay.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSTray]
–a—— 2007-09-20 08:23 132624 C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
–a—— 2005-04-13 02:48 36975 C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateManager]
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Updater Servc]
C:\WINDOWS\System32\xpuupdate.exe

R2 LiveUpdate Notice;LiveUpdate Notice;"C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" [2007-08-24 23:07]
R3 SymIMMP;SymIMMP;C:\WINDOWS\system32\DRIVERS\SymIM.sys [2007-08-09 18:27]
S3 COH_Mon;COH_Mon;C:\WINDOWS\system32\Drivers\COH_Mon.sys [2008-01-12 18:32]
S3 SymIM;Symantec Network Security Intermediate Filter Service;C:\WINDOWS\system32\DRIVERS\SymIM.sys [2007-08-09 18:27]
S3 USB_RNDIS_XP;Westell WireSpeed Dual Connect Modem;C:\WINDOWS\system32\DRIVERS\usb8023.sys [2004-08-04 00:04]


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\Microsoft Keyboard Enhance V2.0]
C:\WINDOWS\iasrecst.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\Microsoft Plus V7.1]
C:\WINDOWS\igfxunit32.exe
.
Contents of the 'Scheduled Tasks' folder
"2008-02-17 21:17:06 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - juan moronta.job"
- C:\Program Files\Norton AntiVirus\Navw32.exe
"2008-01-13 00:47:52 C:\WINDOWS\Tasks\RegCure.job"
- C:\Program Files\RegCure\RegCure.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-18 15:26:53
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\fxssvc.exe
.
**************************************************************************
.
Completion time: 2008-02-18 15:30:44 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-18 21:30:40
.
2008-02-18 18:07:49 — E O F —
Post #4
Your system is infected with a Vundo trojan File infector. This infection renames executable files that run at startup and replaces them with infected copies. We will try to reverse the process. Be advised that there is a possibility that you may have to reinstall certain programs where a legitimate replacement file can not be found.


A. 1. Please open Notepad
  • Click Start , then Run
  • Type notepad .exe in the Run Box.
2. Now copy/paste the entire content of the codebox below into the Notepad window:

KillAll::

File::
C:\Program Files\tmp11198742.exe
C:\Program Files\page.html
C:\Program Files\func.js
C:\Program Files\Del.js
C:\WINDOWS\Installer\{16b66887-823a-41e3-ad94-01407d4c0a4d}
C:\WINDOWS\Installer\{1c4d71fa-8393-4e82-85b3-0e81c1244e0e}
C:\WINDOWS\Installer\{86e87156-8ae6-48f4-8604-cb0738e770eb}
C:\WINDOWS\Installer\{4d0b304c-e4be-4a8b-846d-bcae722dbe62}

RenV::
—-a-w		 1,896,448 2008-02-17 20:58:44  C:\Program Files\BellSouth\Alert Manager\BellSouthAlertManager .exe
—-a-w		   487,424 2008-02-17 23:19:06  C:\Program Files\Dell\QuickSet\quickset  .exe
—-a-w		   487,424 2008-02-17 00:08:44  C:\Program Files\Dell\QuickSet\quickset .exe
—-a-w			68,856 2008-02-17 20:59:40  C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier .exe
—-a-w		 1,694,208 2008-02-17 20:59:44  C:\Program Files\Messenger\msmsgs .exe
—-a-w		   200,704 2008-02-17 20:59:26  C:\Program Files\Microsoft Money\System\mnyexpr .exe
—-a-w		   131,072 2008-02-17 20:58:42  C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray .exe
—-a-w		   282,624 2008-02-17 22:32:45  C:\Program Files\QuickTime\qttask				.exe
—-a-w		   282,624 2008-02-17 23:11:56  C:\Program Files\QuickTime\qttask			   .exe
—-a-w		   282,624 2008-02-17 23:11:57  C:\Program Files\QuickTime\qttask			  .exe
—-a-w		   282,624 2008-02-17 23:11:58  C:\Program Files\QuickTime\qttask			 .exe
—-a-w		   282,624 2008-02-17 23:11:59  C:\Program Files\QuickTime\qttask			.exe
—-a-w		   282,624 2008-02-17 23:12:00  C:\Program Files\QuickTime\qttask		   .exe
—-a-w		   282,624 2008-02-17 23:12:01  C:\Program Files\QuickTime\qttask		  .exe
—-a-w		   282,624 2008-02-17 23:12:02  C:\Program Files\QuickTime\qttask		 .exe
—-a-w		   282,624 2008-02-17 23:12:03  C:\Program Files\QuickTime\qttask		.exe
—-a-w		   282,624 2008-02-17 23:12:04  C:\Program Files\QuickTime\qttask	   .exe
—-a-w		   282,624 2008-02-17 23:12:05  C:\Program Files\QuickTime\qttask	  .exe
—-a-w		   282,624 2008-02-17 23:12:06  C:\Program Files\QuickTime\qttask	 .exe
—-a-w		   282,624 2008-02-17 23:12:07  C:\Program Files\QuickTime\qttask	.exe
—-a-w		   282,624 2008-02-17 23:12:08  C:\Program Files\QuickTime\qttask   .exe
—-a-w		   282,624 2008-02-17 23:11:30  C:\Program Files\QuickTime\qttask  .exe
—-a-w		   282,624 2008-02-17 23:11:31  C:\Program Files\QuickTime\qttask .exe
—-a-w			15,360 2008-02-17 20:03:29  C:\WINDOWS\SYSTEM32\ctfmon .exe
—-a-w		   174,592 2008-02-17 20:57:30  C:\WINDOWS\SYSTEM32\lexpps .exe

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8E4881AC-49E2-4761-9542-7E40C73CFB96}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{087429C0-F1EF-4DDB-AE48-701C2F52C8B3}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B6C59BFA-AD45-491A-BCD0-20B3207E3B78}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E2AB8F41-62FE-2F4D-DA2F-4AE6718508C4}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E3AB8F40-6280-284F-DA2F-3EE6078908C7}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QdrPack12"=-
"Router"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ContraVirus]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DadApp]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dla]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Keyboard Enhance V2.0]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Plus V7.1]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MoneyAgent]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MPFExe]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OASClnt]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateManager]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Updater Servc]
[-HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\Microsoft Keyboard Enhance V2.0]
[-HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\Microsoft Plus V7.1]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"RamDrv"=-
"AvpRom"=-
"UnknownAvp"=-
"zip"=-
Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Save the above as CFScript.txt

4. Now drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

5. All your monitoring programs (Antivirus/Antispyware, Guards and Shields) will be stopped.

[external image: Posted Image]

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

6. ComboFix will automatically REBOOT your machine when the KillAll:: switch is used..

7. Post the following logs/Reports:
  • ComboFix.txt
  • Fresh HijackThis log run after all the other tools have performed their cleanup.
CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.



C. Using Internet Explorer, please do a Kaspersky Online Scan

Answer Yes, when prompted to install an ActiveX component.
  • The program will then begin downloading the latest definition files.
  • Once the files have been downloaded click on NEXT
  • Locate the Scan Settings button & configure as follows:
    • Scan using the following Anti-Virus database:
      • Extended
    • Scan Options:
      • Scan Archives
      • Scan Mail Bases
  • Click OK & have it scan My Computer
  • Once the scan is complete, it will provide a report if your system is infected. It does not provide an option to clean/disinfect. We only require a report from it.

    [external image: Posted Image]

  • Click the Save as Text button to save the file to your desktop and post it in your next reply
* Turn off the real time scanner of any existing antivirus program while performing the online scan
Post #5
Ok, combofix and hijackthis log copied below, I'm doing the kaspersky online scan after this post (as I am following your instructions in the order you've given them to the T ;) )

I'll let you know the results of the kaspersky scan when it's done. Thanks!


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:55, on 2008-02-18
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\fior garcia\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: Spybot-S&D; IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask .exe" -atboottime
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\Support.com\BellSouth\hcenter.exe" /starthidden /tgcmdwrapper
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O8 - Extra context menu item: &Search; - ?p=ZKxdm021YYUS
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1188597418891
O16 - DPF: {74C861A1-D548-4916-BC8A-FDE92EDFF62C} - http://mediaplayer.walmart.com/installer/install.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A9B5FA7C-2755-4D1F-B69C-D00421001E55}: Domain = broward.k12.fl.us
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = broward.k12.fl.us
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = broward.k12.fl.us
O20 - Winlogon Notify: bbjlwesm - bbjlwesm.dll (file missing)
O20 - Winlogon Notify: ddcbyxv - ddcbyxv.dll (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AOL Antivirus Update Service (aolavupd) - Unknown owner - C:\Program Files\Common Files\AOL\1182399618\ee\services\safetyCore\ver210_5_4_1\aolavupd.exe (file missing)
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE (file missing)
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: WLTRYSVC - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE (file missing)

–
End of file - 7156 bytes


ComboFix 08-02-18.1 - fior garcia 2008-02-18 19:40:33.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.226 [GMT -6:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\fior garcia\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\Program Files\Del.js
C:\Program Files\func.js
C:\Program Files\page.html
C:\Program Files\tmp11198742.exe
C:\WINDOWS\Installer\{16b66887-823a-41e3-ad94-01407d4c0a4d}
C:\WINDOWS\Installer\{1c4d71fa-8393-4e82-85b3-0e81c1244e0e}
C:\WINDOWS\Installer\{4d0b304c-e4be-4a8b-846d-bcae722dbe62}
C:\WINDOWS\Installer\{86e87156-8ae6-48f4-8604-cb0738e770eb}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\Del.js
C:\Program Files\func.js
C:\Program Files\page.html
C:\Program Files\tmp11198742.exe

.
((((((((((((((((((((((((( Files Created from 2008-01-19 to 2008-02-19 )))))))))))))))))))))))))))))))
.

2008-02-18 08:16 . 2008-02-18 08:16 d——– C:\Program Files\Spybot - Search & Destroy
2008-02-18 08:16 . 2008-02-18 09:18 d——– C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-17 15:02 . 2008-02-17 15:02 d——– C:\Program Files\Windows Sidebar
2008-02-17 15:02 . 2008-02-17 22:11 d——– C:\Program Files\Norton AntiVirus
2008-02-17 15:01 . 2008-02-17 22:07 123,952 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\SYMEVENT.SYS
2008-02-17 15:01 . 2008-02-17 22:07 60,800 –a—— C:\WINDOWS\SYSTEM32\S32EVNT1.DLL
2008-02-17 15:01 . 2008-02-17 22:07 10,740 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\SYMEVENT.CAT
2008-02-17 15:01 . 2008-02-17 22:07 805 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\SYMEVENT.INF
2008-02-17 15:00 . 2008-02-17 22:07 d——– C:\Program Files\Symantec
2008-02-17 14:42 . 2008-02-17 22:01 d——– C:\Program Files\Common Files\Symantec Shared
2008-02-17 12:58 . 2008-02-17 14:00 d——– C:\Documents and Settings\Administrator\Application Data\AOL
2008-02-17 12:43 . 2008-02-17 14:57 174,592 –a—— C:\WINDOWS\SYSTEM32\lexpps .exe
2008-02-17 12:25 . 2008-02-17 14:03 15,360 –a—— C:\WINDOWS\SYSTEM32\ctfmon .exe
2008-02-17 12:09 . 2007-12-06 20:21 6,066,176 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\ieframe.dll
2008-02-17 12:09 . 2007-06-30 21:31 2,455,488 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\ieapfltr.dat
2008-02-17 12:09 . 2007-06-30 21:36 991,232 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\ieframe.dll.mui
2008-02-17 12:09 . 2007-12-06 20:21 459,264 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\msfeeds.dll
2008-02-17 12:09 . 2007-12-06 20:21 383,488 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\ieapfltr.dll
2008-02-17 12:09 . 2007-12-06 20:21 267,776 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\iertutil.dll
2008-02-17 12:09 . 2007-12-06 20:21 63,488 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\icardie.dll
2008-02-17 12:09 . 2007-12-06 20:21 52,224 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\msfeedsbs.dll
2008-02-17 12:09 . 2007-12-06 05:00 13,824 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\ieudinit.exe
2008-02-17 11:54 . 2007-08-13 18:54 33,792 –a—— C:\WINDOWS\SYSTEM32\DLLCACHE\custsat.dll
2008-02-17 11:38 . 2006-08-21 03:14 128,896 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\fltmgr.sys
2008-02-17 11:38 . 2006-08-21 03:14 23,040 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\fltmc.exe
2008-02-17 11:38 . 2006-08-21 06:21 16,896 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\fltlib.dll
2008-02-17 11:23 . 2007-07-09 07:09 584,192 ——— C:\WINDOWS\SYSTEM32\DLLCACHE\rpcrt4.dll
2008-02-16 21:01 . 2004-08-21 02:31 d——– C:\Documents and Settings\Administrator\Application Data\Symantec
2008-02-16 21:01 . 2004-08-21 02:27 d——– C:\Documents and Settings\Administrator\Application Data\Sonic
2008-02-16 21:01 . 2004-08-21 02:30 d——– C:\Documents and Settings\Administrator\Application Data\Jasc Software Inc
2008-02-16 20:22 . 2008-02-16 20:22 d——– C:\Program Files\Lavasoft
2008-02-16 20:22 . 2008-02-16 20:27 d——– C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-02-16 18:51 . 2004-08-04 01:56 221,184 –a—— C:\WINDOWS\SYSTEM32\wmpns.dll
2008-02-16 18:46 . 2008-02-16 18:46 d——– C:\WINDOWS\provisioning
2008-02-16 18:46 . 2008-02-16 18:46 d——– C:\WINDOWS\peernet
2008-02-16 18:42 . 2008-02-16 18:42 d——– C:\WINDOWS\ServicePackFiles
2008-02-16 18:30 . 2008-02-16 18:30 d——– C:\WINDOWS\EHome

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-18 15:17 ——— d—–w C:\Documents and Settings\All Users\Application Data\Rabio
2008-02-18 03:48 ——— d—–w C:\Documents and Settings\All Users\Application Data\Symantec
2008-02-18 03:14 ——— d—–w C:\Program Files\Google
2008-02-17 22:25 ——— d—–w C:\Program Files\QuickTime
2008-02-17 22:25 ——— d—–w C:\Program Files\DellSupport
2008-02-17 21:19 ——— d—–w C:\Documents and Settings\juan moronta\Application Data\Symantec
2008-02-17 20:00 ——— d—–w C:\Program Files\Common Files\AOL
2008-02-17 19:12 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-02-17 18:58 ——— d—–w C:\Documents and Settings\All Users\Application Data\AOL
2008-02-17 18:57 ——— d—–w C:\Program Files\Common Files\aolshare
2008-02-17 18:56 ——— d—–w C:\Program Files\Dell
2008-02-17 02:20 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2008-02-17 00:16 ——— d—–w C:\Documents and Settings\fior garcia\Application Data\MSN6
2008-01-15 15:54 10,537 —-a-w C:\WINDOWS\system32\drivers\coh_mon.cat
2008-01-15 11:28 706 —-a-w C:\WINDOWS\system32\drivers\COH_Mon.inf
2008-01-13 02:22 ——— d—–w C:\Program Files\Wal-Mart Music Downloads Store
2008-01-13 01:43 ——— d—–w C:\Program Files\Citrix
2008-01-13 01:35 ——— d—–w C:\Documents and Settings\juan moronta\Application Data\Viewpoint
2008-01-13 01:02 ——— d—–w C:\Documents and Settings\juan moronta\Application Data\MSN6
2008-01-13 00:52 ——— d—–w C:\Documents and Settings\juan moronta\Application Data\BLSTOOLBAR
2008-01-13 00:32 23,904 —-a-w C:\WINDOWS\system32\drivers\COH_Mon.sys
2007-12-23 17:25 ——— d—–w C:\Documents and Settings\fior garcia\Application Data\BLSTOOLBAR
2007-12-23 14:48 ——— d—–w C:\Documents and Settings\All Users\Application Data\McAfee
2007-12-23 06:01 ——— d—–w C:\Documents and Settings\LocalService\Application Data\BLSTOOLBAR
2007-12-20 22:54 13,918 —-a-w C:\Documents and Settings\juan moronta\Application Data\wklnhst.dat
2007-12-20 03:55 80,704 —-a-w C:\Documents and Settings\juan moronta\Application Data\GDIPFONTCACHEV1.DAT
2007-11-08 00:26 720 —-a-w C:\Documents and Settings\Giancarlo\Application Data\wklnhst.dat
2007-08-31 21:36 60,968 —-a-w C:\Documents and Settings\juan moronta\GoToAssistDownloadHelper.exe
2007-08-17 22:38 6,947,971 —-a-w C:\Documents and Settings\juan moronta\HC4Installer.exe
2007-05-05 19:22 774,144 —-a-w C:\Program Files\RngInterstitial.dll
2007-02-22 19:26 66,792 —-a-w C:\Documents and Settings\Giancarlo\Application Data\GDIPFONTCACHEV1.DAT
2007-02-21 01:32 66,269 —-a-w C:\Program Files\INSTALL.LOG
2006-07-08 01:29 580 —-a-w C:\Documents and Settings\fior garcia\Application Data\wklnhst.dat
.
—-a-w		   487,424 2008-02-17 23:19:06  C:\Program Files\Dell\QuickSet\quickset  .exe
—-a-w		   487,424 2008-02-17 00:08:44  C:\Program Files\Dell\QuickSet\quickset .exe
—-a-w			68,856 2008-02-17 20:59:40  C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier .exe
—-a-w		 1,694,208 2008-02-17 20:59:44  C:\Program Files\Messenger\msmsgs .exe
—-a-w		   200,704 2008-02-17 20:59:26  C:\Program Files\Microsoft Money\System\mnyexpr .exe
—-a-w		   131,072 2008-02-17 20:58:42  C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray .exe
—-a-w		   282,624 2008-02-17 22:32:45  C:\Program Files\QuickTime\qttask				.exe
—-a-w		   282,624 2008-02-17 23:11:56  C:\Program Files\QuickTime\qttask			   .exe
—-a-w		   282,624 2008-02-17 23:11:57  C:\Program Files\QuickTime\qttask			  .exe
—-a-w		   282,624 2008-02-17 23:11:58  C:\Program Files\QuickTime\qttask			 .exe
—-a-w		   282,624 2008-02-17 23:11:59  C:\Program Files\QuickTime\qttask			.exe
—-a-w		   282,624 2008-02-17 23:12:00  C:\Program Files\QuickTime\qttask		   .exe
—-a-w		   282,624 2008-02-17 23:12:01  C:\Program Files\QuickTime\qttask		  .exe
—-a-w		   282,624 2008-02-17 23:12:02  C:\Program Files\QuickTime\qttask		 .exe
—-a-w		   282,624 2008-02-17 23:12:03  C:\Program Files\QuickTime\qttask		.exe
—-a-w		   282,624 2008-02-17 23:12:04  C:\Program Files\QuickTime\qttask	   .exe
—-a-w		   282,624 2008-02-17 23:12:05  C:\Program Files\QuickTime\qttask	  .exe
—-a-w		   282,624 2008-02-17 23:12:06  C:\Program Files\QuickTime\qttask	 .exe
—-a-w		   282,624 2008-02-17 23:12:07  C:\Program Files\QuickTime\qttask	.exe
—-a-w		   282,624 2008-02-17 23:12:08  C:\Program Files\QuickTime\qttask   .exe
—-a-w		   282,624 2008-02-17 23:11:30  C:\Program Files\QuickTime\qttask  .exe
—-a-w		   282,624 2008-02-17 23:11:31  C:\Program Files\QuickTime\qttask .exe
—-a-w			15,360 2008-02-17 20:03:29  C:\WINDOWS\SYSTEM32\ctfmon .exe
—-a-w		   174,592 2008-02-17 20:57:30  C:\WINDOWS\SYSTEM32\lexpps .exe


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}]
2008-02-17 18:20 116088 –a—— C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-02-17 16:32 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="C:\Program Files\QuickTime\qttask .exe" [2008-02-17 16:32 282624]
"tgcmd"="C:\Program Files\Support.com\BellSouth\hcenter.exe" [ ]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-02-17 16:32 51048]
"osCheck"="C:\Program Files\Norton AntiVirus\osCheck.exe" [2008-02-17 16:32 714608]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{88485281-8b4b-4f8d-9ede-82e29a064277}"= C:\PROGRA~1\MarkAny\CONTEN~1\MACSMA~1.DLL [2004-11-23 15:51 192512]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\bbjlwesm]
bbjlwesm.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ddcbyxv]
ddcbyxv.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup=C:\WINDOWS\pss\Kodak EasyShare software.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak software updater.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak software updater.lnk
backup=C:\WINDOWS\pss\Kodak software updater.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^juan moronta^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
path=C:\Documents and Settings\juan moronta\Start Menu\Programs\Startup\LimeWire On Startup.lnk
backup=C:\WINDOWS\pss\LimeWire On Startup.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCMSMMSG]
–a—— 2003-08-29 04:59 122880 C:\WINDOWS\BCMSMMSG.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell AIO Printer A920]
–a—— 2004-04-15 02:32 270336 C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
–a—— 2008-02-17 16:32 460784 C:\Program Files\DellSupport\DSAgnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
——— 2004-04-11 10:43 53248 C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EmailScan]
C:\Program Files\mcafee.com\antivirus\mcvsescn.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HelpCenter]
–a—— 2006-10-30 11:00 192512 C:\Program Files\Bellsouth\HelpCenter\bin\sprtcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark 1200 Series]
–a—— 2006-07-12 23:22 57344 C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
——— 2003-12-05 21:08 50688 C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask]
–a—— 2004-04-19 13:45 53248 c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
–a—— 2004-01-08 14:26 4866048 C:\WINDOWS\System32\NvCpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
–a—— 2004-01-08 14:26 323584 C:\WINDOWS\SYSTEM32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OM2_Monitor]
–a—— 2006-12-01 20:28 95800 C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService]
——— 2004-04-11 19:15 290816 C:\Program Files\Dell\Media Experience\PCMService.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
–a—— 2004-08-21 02:22 26112 C:\Program Files\Real\RealPlayer\RealPlay.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSTray]
–a—— 2007-09-20 08:23 132624 C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
–a—— 2005-04-13 02:48 36975 C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe

R2 LiveUpdate Notice;LiveUpdate Notice;"C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" [2007-08-24 23:07]
R3 SymIMMP;SymIMMP;C:\WINDOWS\system32\DRIVERS\SymIM.sys [2007-08-09 18:27]
S3 COH_Mon;COH_Mon;C:\WINDOWS\system32\Drivers\COH_Mon.sys [2008-01-12 18:32]
S3 SymIM;Symantec Network Security Intermediate Filter Service;C:\WINDOWS\system32\DRIVERS\SymIM.sys [2007-08-09 18:27]
S3 USB_RNDIS_XP;Westell WireSpeed Dual Connect Modem;C:\WINDOWS\system32\DRIVERS\usb8023.sys [2004-08-04 00:04]

.
Contents of the 'Scheduled Tasks' folder
"2008-02-17 21:17:06 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - juan moronta.job"
- C:\Program Files\Norton AntiVirus\Navw32.exeh/TASK:
"2008-01-13 00:47:52 C:\WINDOWS\Tasks\RegCure.job"
- C:\Program Files\RegCure\RegCure.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-18 19:46:42
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\fxssvc.exe
.
**************************************************************************
.
Completion time: 2008-02-18 19:51:02 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-19 01:50:58
ComboFix2.txt 2008-02-18 21:30:45
.
2008-02-18 18:07:49 — E O F —
Post #6
I tried Kaspersky online scan, but at the accept/decline button at the very start, hitting the accept button has no results while hitting the decline button does work. I don't know if this is the result of the viruses or because of limited authority to run this scan; I noticed it said I needed to run as an admin and I know I had to do some work to get the control panel to reappear due to these viruses. Should I run this scan in safemode instead?
Post #8
No luck, even in safemode using admin user login it gives me an error on page (little yellow ! at bottom left of IE browser) I am using IE 7.0, and I know it's not the website because my other computer can run it fine. The infected computer is a laptop that is not mine but a friend's that I am trying to help as this would be beyond her (and for the most part my) abilities ;)
Post #9
Try this one:

I need you to run the following scan: Eset Online Scanner
  • Place a check mark in the box YES, I accept the Terms Of Use
  • Click the Start button.
  • Now click the Install button.
  • Click Start. The scanner engine will initialize and update.
  • Do Not place a check mark in the box beside Remove found threats.
  • Click the Scan button. The scan will now run, please be patient.
  • When the scan finishes click the Details tab.
  • Copy and paste the contents of the C:\ProgramFiles\EsetOnlineScanner\log.txt into your next reply.
Post #10
Same issue, just doesn't let me run it.. I am not seeing active x prompts requesting to download this.. Just nothing happening after I hit start.. It brings me to a screen where the scan should commence, but there is no activity at that screen.. No java script window, no active x prompts.. I tried setting security to basicly off and allow for all active x activity but still no go.,. (i returned it afterwards)
Post #11
Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform full scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.

Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.
Post #12
Ok, this I can do =) Here is the log of that scan and disinfection: Malwarebytes' Anti-Malware 1.04 Database version: 381 Scan type: Full Scan (C:\|) Objects scanned: 98494 Time elapsed: 44 minute(s), 56 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 6 Registry Values Infected: 1 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 7 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\Software\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{ea038ddd-0fe0-41f5-ba60-fc3660529e71} (Rogue.ContraVirus) -> Quarantined and deleted successfully. Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: C:\QooBox\Quarantine\C\Program Files\tmp11198742.exe.vir (Trojan.Dropper) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP3\A0000237.exe (Trojan.Dropper) -> Quarantined and deleted successfully. C:\WINDOWS\INF\ultra.PNF (Malware.Trace) -> Quarantined and deleted successfully. C:\Documents and Settings\Administrator\Desktop\Help and Support Center.lnk (Rogue.Link) -> Quarantined and deleted successfully. C:\WINDOWS\SYSTEM\ext32inc.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\Documents and Settings\juan moronta\Desktop\Help and Support Center.lnk (Rogue.Link) -> Quarantined and deleted successfully. C:\Documents and Settings\fior garcia\Desktop\Help and Support Center.lnk (Rogue.Link) -> Quarantined and deleted successfully.
Post #13
Well that did not produce the results that I was hoping for. This is our next route. We will try to see what is stopping some of our tools.

Please download Deckard's System Scanner (DSS) to your desktop.
  • Close all applications and windows.
  • Double-click on dss.exe to run it, and follow the prompts.
  • When the scan is complete, a text file will open - Main.txt
  • Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of Main.txt in your thread in the HijackThis Log Help Forum.
  • An additional text file, Extra.txt,will also be available (by default) in the following FOLDER, C:\Deckard\System Scanner.
  • Please go to that FOLDER and also copy the contents of Extra.txt to your post as well.
Note: some firewalls may warn that sigcheck.exe is trying to access the internet - please ensure that you allow sigcheck.exe permission to do so.

What DSS will do:

  • Create a new System Restore point in Windows XP and Vista.
  • Clean your Temporary Files, Downloaded Program Files, and Internet Cache Files, and also empty the Recycle Bin on all drives.
  • Check some important areas of your system and produce a report for your analyst to review. DSS automatically runs HijackThis for you, but it will also install and place a shortcut to HijackThis on your desktop if you do not already have it installed.

Post Logs:
  • DSS Scan Results: contents of 1) Main.txt and 2) Extra.txt
Post #14
Ok, here are the two logs:

Deckard's System Scanner v20071014.68
Run by [removed] on 2008-02-19 18:53:44
Computer is in Normal Mode.
——————————————————————————–

– System Restore ————————————————————–

Successfully created a Deckard's System Scanner Restore Point.


– Last 5 Restore Point(s) –
5: 2008-02-20 00:53:54 UTC - RP5 - Deckard's System Scanner Restore Point
4: 2008-02-19 02:26:13 UTC - RP4 - Removed Get High Speed Internet!
3: 2008-02-19 01:39:56 UTC - RP3 - ComboFix created restore point
2: 2008-02-18 21:20:34 UTC - RP2 - ComboFix created restore point
1: 2008-02-18 21:13:25 UTC - RP1 - System Checkpoint


Backed up registry hives.
Performed disk cleanup.



– HijackThis (run as fior garcia.exe) —————————————–

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:54, on 2008-02-19
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
C:\Documents and Settings\fior garcia\Desktop\dss.exe
C:\DOCUME~1\FIORGA~1\Desktop\fior garcia.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask .exe" -atboottime
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\Support.com\BellSouth\hcenter.exe" /starthidden /tgcmdwrapper
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O8 - Extra context menu item: &Search - ?p=ZKxdm021YYUS
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1188597418891
O16 - DPF: {74C861A1-D548-4916-BC8A-FDE92EDFF62C} - http://mediaplayer.walmart.com/installer/install.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A9B5FA7C-2755-4D1F-B69C-D00421001E55}: Domain = broward.k12.fl.us
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = broward.k12.fl.us
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = broward.k12.fl.us
O20 - Winlogon Notify: bbjlwesm - bbjlwesm.dll (file missing)
O20 - Winlogon Notify: ddcbyxv - ddcbyxv.dll (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AOL Antivirus Update Service (aolavupd) - Unknown owner - C:\Program Files\Common Files\AOL\1182399618\ee\services\safetyCore\ver210_5_4_1\aolavupd.exe (file missing)
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE (file missing)
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: WLTRYSVC - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE (file missing)

–
End of file - 7193 bytes

– File Associations ———————————————————–

All associations okay.


– Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ———————

R1 omci (OMCI WDM Device Driver) - c:\windows\system32\drivers\omci.sys
Post #15
I think that you may also have some essential elements missing from the system. We will get rid of as many conflicts as possible as well as the malware before tackling the reat.


A. Using the Add/Remove Program module in your Control Panel, please UNINSTALL the following program (If present)

Router
All McAfee products


B. Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

Updating Java:
  • Download the latest version of Java Runtime Environment (JRE) 6u4.
  • Scroll down to where it says "The Java SE Runtime Environment (JRE) allows end-users to run Java applications".
  • Click the "Download" button to the right.
  • In the pull down menu next to Platform select Windows
  • Check the box that says: "I agree to the Java SE Runtime Environment 6 License Agreement"
  • Click Continue
  • Click on the link to download Windows Offline Installation and save to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
  • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u4-windowsi586-p.exe to install the newest version.


Now to Clean out the Java cache:

Go into the Control Panel and double-click the Java Icon.
  • Under Temporary Internet Files, click the Delete Files button.
  • There are three options in the window to clear the cache - Leave ALL 3 Checked
    • Downloaded Applets
      Downloaded Applications
      Other Files
  • Click OK on Delete Temporary Files Window
    Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
  • Click OK to leave the Java Control Panel.


C. 1. Please open Notepad
  • Click Start , then Run
  • Type notepad .exe in the Run Box.
2. Now copy/paste the entire content of the codebox below into the Notepad window:

KillAll::

RenV::
—-a-w		   487,424 2008-02-17 23:19:06  C:\Program Files\Dell\QuickSet\quickset  .exe
—-a-w		   487,424 2008-02-17 00:08:44  C:\Program Files\Dell\QuickSet\quickset .exe
—-a-w			68,856 2008-02-17 20:59:40  C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier .exe
—-a-w		 1,694,208 2008-02-17 20:59:44  C:\Program Files\Messenger\msmsgs .exe
—-a-w		   200,704 2008-02-17 20:59:26  C:\Program Files\Microsoft Money\System\mnyexpr .exe
—-a-w		   131,072 2008-02-17 20:58:42  C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray .exe
—-a-w		   282,624 2008-02-17 22:32:45  C:\Program Files\QuickTime\qttask				.exe
—-a-w		   282,624 2008-02-17 23:11:56  C:\Program Files\QuickTime\qttask			   .exe
—-a-w		   282,624 2008-02-17 23:11:57  C:\Program Files\QuickTime\qttask			  .exe
—-a-w		   282,624 2008-02-17 23:11:58  C:\Program Files\QuickTime\qttask			 .exe
—-a-w		   282,624 2008-02-17 23:11:59  C:\Program Files\QuickTime\qttask			.exe
—-a-w		   282,624 2008-02-17 23:12:00  C:\Program Files\QuickTime\qttask		   .exe
—-a-w		   282,624 2008-02-17 23:12:01  C:\Program Files\QuickTime\qttask		  .exe
—-a-w		   282,624 2008-02-17 23:12:02  C:\Program Files\QuickTime\qttask		 .exe
—-a-w		   282,624 2008-02-17 23:12:03  C:\Program Files\QuickTime\qttask		.exe
—-a-w		   282,624 2008-02-17 23:12:04  C:\Program Files\QuickTime\qttask	   .exe
—-a-w		   282,624 2008-02-17 23:12:05  C:\Program Files\QuickTime\qttask	  .exe
—-a-w		   282,624 2008-02-17 23:12:06  C:\Program Files\QuickTime\qttask	 .exe
—-a-w		   282,624 2008-02-17 23:12:07  C:\Program Files\QuickTime\qttask	.exe
—-a-w		   282,624 2008-02-17 23:12:08  C:\Program Files\QuickTime\qttask   .exe
—-a-w		   282,624 2008-02-17 23:11:30  C:\Program Files\QuickTime\qttask  .exe
—-a-w		   282,624 2008-02-17 23:11:31  C:\Program Files\QuickTime\qttask .exe
—-a-w			15,360 2008-02-17 20:03:29  C:\WINDOWS\SYSTEM32\ctfmon .exe
—-a-w		   174,592 2008-02-17 20:57:30  C:\WINDOWS\SYSTEM32\lexpps .exe


Folder::
C:\Program Files\Router

Driver::
iAimTV2
aolavupd
ScsiAccess
WLTRYSVC

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\bbjlwesm]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ddcbyxv]
Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Save the above as CFScript.txt

4. Now drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

5. All your monitoring programs (Antivirus/Antispyware, Guards and Shields) will be stopped.

[external image: Posted Image]

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

6. ComboFix will automatically REBOOT your machine when the KillAll:: switch is used..

7. Post the following logs/Reports:
  • ComboFix.txt
  • Fresh HijackThis log run after all the other tools have performed their cleanup.
CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.


D. Now give Norton AvtiVirus a run and see if it picks anything up.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI