What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] [Closed] downloader problem - can't remove it

6 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Got a problem that I can't get rid of with my minimal scanning/removing skills. Looks like the problem is in the ativvax.dll file, didn't do anything with it myself because I figured it would just make things worse.

Here is the HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:41:36 AM, on 2/22/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\JulaPan.Exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Administrator\Desktop\spyware\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {FC523D5A-F5C8-48FF-B35B-E008E8F4F9B9} - C:\WINDOWS\system32\ativvax.dll
O4 - HKLM\..\Run: [JulaPan] JulaPan.Exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4A27027D-9371-47B2-A07A-1B5CC3A6F3B3}: NameServer = 192.168.1.1
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe

–
End of file - 2464 bytes

—–

Here is the definition from Virustotal:

http://www.virustotal.com/analisis/b1f3f87…08c72fa6d768989

Thanks for the help if anybody has the time!
Post #2
Hello

* I notice that you have no firewall on your PC, this is extremely dangerous and leaves your PC open to vulnerabilities, so please download and install one of the following programs : ZoneAlarm, Comodo, or
Outpost
Make sure you only use one firewall though. A tutorial on understanding and using firewalls may be found here.



Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
  • Please, never rename Combofix unless instructed.
  • Close any open browsers.
  • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

    ———————————————————–

    • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

      ———————————————————–

    • Close any open browsers.
    • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

    ———————————————————–

  • Double click on combofix.exe & follow the prompts.
  • When finished, it will produce a report for you.
  • Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.
**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**
Post #3
Here is the combofix log:

ComboFix 08-02-25.3 - Administrator 2008-02-27 13:33:35.20 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1650 [GMT 1:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\ATI\SUPPORT\5-11_xp-2k_dd_27345\_install.exe
C:\ATI\SUPPORT\5-9_xp-2k_dd_cp_wdm_26409\_install.exe
C:\ATI\SUPPORT\5-9_xp-2k_dd_cp_wdm_26409\BIN\_install.exe
C:\ATI\SUPPORT\5-9_xp-2k_dd_cp_wdm_26409\CPanel\_install.exe
C:\ATI\SUPPORT\5-9_xp-2k_dd_cp_wdm_26409\Driver\_install.exe
C:\ATI\SUPPORT\5-9_xp-2k_dd_cp_wdm_26409\WDM_ALL\_install.exe
C:\ATI\SUPPORT\wxp-w2k-catalyst-8-062-040929a-018115C\_install.exe
C:\ATI\SUPPORT\wxp-w2k-catalyst-8-062-040929a-018115C\BIN\_install.exe
C:\ATI\SUPPORT\wxp-w2k-catalyst-8-062-040929a-018115C\CPanel\_install.exe
C:\ATI\SUPPORT\wxp-w2k-catalyst-8-062-040929a-018115C\Driver\_install.exe
C:\ATI\SUPPORT\wxp-w2k-catalyst-8-062-040929a-018115C\WDM\_install.exe
C:\Documents and Settings\Administrator\.housecall6.6\_install.exe
C:\Documents and Settings\Administrator\Application Data\Adobe\Acrobat\7.0\Updater\_install.exe
C:\Documents and Settings\Administrator\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\_install.exe
C:\Documents and Settings\Administrator\Application Data\Microsoft\Installer\{8CC990CD-87C8-475C-AC32-8A7984E2FCFA}\_install.exe
C:\Documents and Settings\Administrator\Application Data\Microsoft\Installer\{9FE51DFE-D80F-447E-9F99-85BB273213AD}\_install.exe
C:\Documents and Settings\Administrator\Application Data\Microsoft\Installer\{C89C8D86-4423-4A58-AA40-DD259ACE07C1}\_install.exe
C:\Documents and Settings\Administrator\Application Data\Microsoft\Installer\{EEB97B65-667A-4D76-ABD4-441FB30D5CE6}\_install.exe
C:\Documents and Settings\Administrator\Application Data\Move Networks\ie_bin\_install.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\ApplicationHistory\_install.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\SRKX\ggpoClient.exe_Url_ogzo3ihle5bmw0bidhoc2savoftbqwdg\1.0.0.0\_install.exe
C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 7.0.0.125\English\_install.exe
C:\Program Files\Adobe\Adobe Bridge\_install.exe
C:\Program Files\Adobe\Adobe Help Center\_install.exe
C:\Program Files\Adobe\Adobe Help Viewer\1.0\_install.exe
C:\Program Files\Adobe\Adobe Utilities\ExtendScript Toolkit\_install.exe
C:\Program Files\AMD\Athlon 64 Processor Driver\_install.exe
C:\Program Files\Audio Ease\Altiverb 5\Uninstall\_install.exe
C:\Program Files\Autodesk\Autodesk DWF Viewer\_install.exe
C:\Program Files\backburner 2\_install.exe
C:\Program Files\Common Files\Adobe Systems Shared\Service\_install.exe
C:\Program Files\Common Files\Adobe\Calibration\_install.exe
C:\Program Files\Common Files\Adobe\SVG Viewer 3.0\Uninstall\_install.exe
C:\Program Files\Common Files\Adobe\Updater\_install.exe
C:\Program Files\Common Files\Adobe\Updater5\_install.exe
C:\Program Files\Common Files\Ahead\Lib\_install.exe
C:\Program Files\Common Files\Ahead\Nero Web\_install.exe
C:\Program Files\Common Files\Ahead\RemoteControl\_install.exe
C:\Program Files\Common Files\Autodesk Shared\_install.exe
C:\Program Files\Common Files\Autodesk Shared\AcDwgFilter\_install.exe
C:\Program Files\Common Files\Autodesk Shared\dwf common\_install.exe
C:\Program Files\Common Files\Autodesk Shared\Service\_install.exe
C:\Program Files\Common Files\InstallShield\Driver\10\Intel 32\_install.exe
C:\Program Files\Common Files\InstallShield\Driver\7\Intel 32\_install.exe
C:\Program Files\Common Files\InstallShield\Driver\9\Intel 32\_install.exe
C:\Program Files\Common Files\InstallShield\engine\6\Intel 32\_install.exe
C:\Program Files\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\_install.exe
C:\Program Files\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\_install.exe
C:\Program Files\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\_install.exe
C:\Program Files\Common Files\Intuit\Internet Client\_install.exe
C:\Program Files\Common Files\Java\Update\Base Images\jre1.6.0.b105\patch-jre1.6.0_02.b06\_install.exe
C:\Program Files\Common Files\Microsoft Shared\MSInfo\_install.exe
C:\Program Files\Common Files\Microsoft Shared\MSSearch\Bin\_install.exe
C:\Program Files\Common Files\Microsoft Shared\Speech\_install.exe
C:\Program Files\Common Files\Microsoft Shared\VBA\VBA6\_install.exe
C:\Program Files\Common Files\Raxco\_install.exe
C:\Program Files\DivX\Google\Firefox\_install.exe
C:\Program Files\Easy Video Splitter\_install.exe
C:\Program Files\InstallShield Installation Information\{43801800-CFEE-11D2-A41B-006097B55AD3}\_install.exe
C:\Program Files\InstallShield Installation Information\{5556E378-9A12-4236-9AD7-6F883389DE98}\_install.exe
C:\Program Files\InstallShield Installation Information\{98736A65-3C79-49EC-B7E9-A3C77774B0E6}\_install.exe
C:\Program Files\InstallShield Installation Information\{9B94BE6F-7CA3-4C40-A266-62667FF746CC}\_install.exe
C:\Program Files\InstallShield Installation Information\{B3D8B2F8-3C2C-45BC-933E-8B60E78F6684}\_install.exe
C:\Program Files\InstallShield Installation Information\{C151CE54-E7EA-4804-854B-F515368B0798}\_install.exe
C:\Program Files\InstallShield Installation Information\{FB08F381-6533-4108-B7DD-039E11FBC27E}\_install.exe
C:\Program Files\Internet Explorer\_install.exe
C:\Program Files\Internet Explorer\Connection Wizard\_install.exe
C:\Program Files\Java\jre1.6.0_02\bin\_install.exe
C:\Program Files\Movie Maker\_install.exe
C:\Program Files\Mozilla Firefox\_install.exe
C:\Program Files\Mozilla Firefox\extensions\[removed]\components\_install.exe
C:\Program Files\Mozilla Firefox\uninstall\_install.exe
C:\Program Files\MSN Messenger\_install.exe
C:\Program Files\MSN Messenger\Device Manager\_install.exe
C:\Program Files\NetMeeting\_install.exe
C:\Program Files\Outlook Express\_install.exe
C:\Program Files\Raxco\PerfectDisk\_install.exe
C:\Program Files\Windows Media Connect 2\_install.exe
C:\Program Files\Windows Media Player\_install.exe
C:\Program Files\Windows NT\Accessories\_install.exe
C:\Program Files\XviD\_install.exe
C:\QuickTax 2005\QT2005\_install.exe
C:\WINDOWS\$hf_mig$\KB893756\_install.exe
C:\WINDOWS\$hf_mig$\KB893756\update\_install.exe
C:\WINDOWS\$hf_mig$\KB896423\_install.exe
C:\WINDOWS\$hf_mig$\KB896423\SP2QFE\_install.exe
C:\WINDOWS\$hf_mig$\KB896423\update\_install.exe
C:\WINDOWS\$hf_mig$\KB898461\_install.exe
C:\WINDOWS\$hf_mig$\KB898461\update\_install.exe
C:\WINDOWS\$hf_mig$\KB899588\_install.exe
C:\WINDOWS\$hf_mig$\KB899588\update\_install.exe
C:\WINDOWS\$hf_mig$\KB899589\_install.exe
C:\WINDOWS\$hf_mig$\KB899589\update\_install.exe
C:\WINDOWS\$hf_mig$\KB899591\_install.exe
C:\WINDOWS\$hf_mig$\KB899591\update\_install.exe
C:\WINDOWS\$hf_mig$\KB901017\_install.exe
C:\WINDOWS\$hf_mig$\KB901017\update\_install.exe
C:\WINDOWS\$hf_mig$\KB901214\_install.exe
C:\WINDOWS\$hf_mig$\KB901214\update\_install.exe
C:\WINDOWS\$hf_mig$\KB905414\_install.exe
C:\WINDOWS\$hf_mig$\KB905414\update\_install.exe
C:\WINDOWS\$hf_mig$\KB905749\_install.exe
C:\WINDOWS\$hf_mig$\KB905749\update\_install.exe
C:\WINDOWS\$hf_mig$\KB910437\_install.exe
C:\WINDOWS\$hf_mig$\KB910437\update\_install.exe
C:\WINDOWS\$hf_mig$\KB915865\_install.exe
C:\WINDOWS\$hf_mig$\KB915865\update\_install.exe
C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\_install.exe
C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\_install.exe
C:\WINDOWS\$NtUninstallKB885884$\spuninst\_install.exe
C:\WINDOWS\$NtUninstallKB891122$\spuninst\_install.exe
C:\WINDOWS\$NtUninstallKB893756$\spuninst\_install.exe
C:\WINDOWS\$NtUninstallKB894391$\spuninst\_install.exe
C:\WINDOWS\$NtUninstallKB896344$\_install.exe
C:\WINDOWS\$NtUninstallKB896344$\spuninst\_install.exe
C:\WINDOWS\$NtUninstallKB896423$\_install.exe
C:\WINDOWS\$NtUninstallKB896423$\spuninst\_install.exe
C:\WINDOWS\$NtUninstallKB896424$\spuninst\_install.exe
C:\WINDOWS\$NtUninstallKB896688$\_install.exe
C:\WINDOWS\$NtUninstallKB896688$\spuninst\_install.exe
C:\WINDOWS\$NtUninstallKB896727$\_install.exe
C:\WINDOWS\$NtUninstallKB896727$\spuninst\_install.exe
C:\WINDOWS\$NtUninstallKB898461$\spuninst\_install.exe
C:\WINDOWS\$NtUninstallKB899587$\spuninst\_install.exe
C:\WINDOWS\$NtUninstallKB899588$\spuninst\_install.exe
C:\WINDOWS\$NtUninstallKB899589$\spuninst\_install.exe
C:\WINDOWS\$NtUninstallKB899591$\spuninst\_install.exe
C:\WINDOWS\$NtUninstallKB900725$\spuninst\_install.exe
C:\WINDOWS\$NtUninstallKB900930$\spuninst\_install.exe
C:\WINDOWS\$NtUninstallKB901017$\spuninst\_install.exe
C:\WINDOWS\$NtUninstallKB901214$\spuninst\_install.exe
C:\WINDOWS\$NtUninstallKB902400$\spuninst\_install.exe
C:\WINDOWS\$NtUninstallKB904706$\spuninst\_install.exe
C:\WINDOWS\$NtUninstallKB905414$\spuninst\_install.exe
C:\WINDOWS\$NtUninstallKB905749$\spuninst\_install.exe
C:\WINDOWS\$NtUninstallKB905915$\_install.exe
C:\WINDOWS\$NtUninstallKB905915$\spuninst\_install.exe
C:\WINDOWS\$NtUninstallKB910437$\spuninst\_install.exe
C:\WINDOWS\$NtUninstallKB911565$\spuninst\_install.exe
C:\WINDOWS\$NtUninstallKB912919$\spuninst\_install.exe
C:\WINDOWS\$NtUninstallKB915865$\spuninst\_install.exe
C:\WINDOWS\$NtUninstallKB926239$\spuninst\_install.exe
C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\_install.exe
C:\WINDOWS\$NtUninstallWdf01005$\spuninst\_install.exe
C:\WINDOWS\$NtUninstallWMFDist11$\_install.exe
C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\_install.exe
C:\WINDOWS\$NtUninstallwmp11$\_install.exe
C:\WINDOWS\$NtUninstallwmp11$\spuninst\_install.exe
C:\WINDOWS\$NtUninstallWudf01000$\spuninst\_install.exe
C:\WINDOWS\Downloaded Installations\Macromedia Dreamweaver 8\_install.exe
C:\WINDOWS\Downloaded Installations\Macromedia Fireworks 8\_install.exe
C:\WINDOWS\Downloaded Installations\Macromedia Flash 8\_install.exe
C:\WINDOWS\Downloaded Program Files\_install.exe
C:\WINDOWS\Installer\{0837A661-FEC3-48B3-876C-91E7D32048A9}\_install.exe
C:\WINDOWS\Installer\{212F5777-1190-4DEF-8E4D-6B2F313B45E7}\_install.exe
C:\WINDOWS\Installer\{21DBBDD6-93A5-4326-9A04-C9A5C9148502}\_install.exe
C:\WINDOWS\Installer\{236BB7C4-4419-42FD-0409-1E257A25E34D}\_install.exe
C:\WINDOWS\Installer\{2BD5C305-1B27-4D41-B690-7A61172D2FEB}\_install.exe
C:\WINDOWS\Installer\{49FC50FC-F965-40D9-89B4-CBFF80941033}\_install.exe
C:\WINDOWS\Installer\{4C24A8C1-7CFA-4650-AF15-732F5BD7B46D}\_install.exe
C:\WINDOWS\Installer\{513AEC24-3465-8C4F-87BA-652D6F491033}\_install.exe
C:\WINDOWS\Installer\{5546CDB5-2CE2-498B-B059-5B3BF81FC41F}\_install.exe
C:\WINDOWS\Installer\{5783F2D7-4001-0409-0002-0060B0CE6BBA}\_install.exe
C:\WINDOWS\Installer\{7451C9B5-3E10-4E59-AD37-AB7438D84288}\_install.exe
C:\WINDOWS\Installer\{7CCEBC24-62DB-4280-A8EC-BFA49F167920}\_install.exe
C:\WINDOWS\Installer\{8BF2C401-02CE-424D-BC26-6C4F9FB446B6}\_install.exe
C:\WINDOWS\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\_install.exe
C:\WINDOWS\Installer\{AC76BA86-0000-7EC8-7489-000000000702}\_install.exe
C:\WINDOWS\Installer\{AC76BA86-7AD7-1033-7B44-A80000000002}\_install.exe
C:\WINDOWS\Installer\{B2F5D08C-7E79-4FCD-AAF4-57AD35FF0601}\_install.exe
C:\WINDOWS\Installer\{B74D4E10-1033-0000-0000-000000000001}\_install.exe
C:\WINDOWS\Installer\{E9787678-1033-0000-8E67-000000000001}\_install.exe
C:\WINDOWS\Microsoft.NET\Framework\_install.exe
C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\_install.exe
C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\_install.exe
C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\_install.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\_install.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\_install.exe
C:\WINDOWS\msagent\_install.exe
C:\WINDOWS\mui\_install.exe
C:\WINDOWS\RegisteredPackages\{3FDF25EE-E592-4495-8391-6E9C504DAC2B}$BACKUP$\System\_install.exe
C:\WINDOWS\RegisteredPackages\{3FDF25EE-E592-4495-8391-6E9C504DAC2B}\_install.exe
C:\WINDOWS\RegisteredPackages\{60BFF50D-FB2C-4498-A577-C9548C390BB9}\_install.exe
C:\WINDOWS\RegisteredPackages\{981FB688-E76B-4246-987B-92083185B90A}$BACKUP$\System\_install.exe
C:\WINDOWS\RegisteredPackages\{981FB688-E76B-4246-987B-92083185B90A}\_install.exe
C:\WINDOWS\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}$BACKUP$\System\_install.exe
C:\WINDOWS\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}\_install.exe
C:\WINDOWS\RegisteredPackages\{DD90D410-1823-43EB-9A16-A2331BF08799}$BACKUP$\System\_install.exe
C:\WINDOWS\RegisteredPackages\{DD90D410-1823-43EB-9A16-A2331BF08799}\_install.exe
C:\WINDOWS\system32\alog.txt
C:\WINDOWS\system32\Com\_install.exe
C:\WINDOWS\system32\DRVSTORE\lfmouhid_FACDA2D2CAF5FF8A2DA6CD8B0212C3F89DFA31A2\_install.exe
C:\WINDOWS\system32\Macromed\Director\_install.exe
C:\WINDOWS\system32\Macromed\Flash\_install.exe
C:\WINDOWS\system32\Macromed\Shockwave 10\_install.exe
C:\WINDOWS\system32\npp\_install.exe
C:\WINDOWS\system32\oobe\_install.exe
C:\WINDOWS\system32\PreInstall\WinSE\wxp_x86_0409_v1\_install.exe
C:\WINDOWS\system32\ReinstallBackups\0000\DriverFiles\_install.exe
C:\WINDOWS\system32\Restore\_install.exe
C:\WINDOWS\system32\URTTemp\_install.exe
C:\WINDOWS\system32\usmt\_install.exe
C:\WINDOWS\system32\wbem\_install.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
——-\LEGACY_NDISWON


((((((((((((((((((((((((( Files Created from 2008-01-27 to 2008-02-27 )))))))))))))))))))))))))))))))
.

2008-02-27 13:00 . 2008-02-27 13:00 1 –a—— C:\WINDOWS\system32\rc.dat
2008-02-27 13:00 . 2008-02-27 13:00 1 –a—— C:\WINDOWS\system32\ps1.dat
2008-02-27 13:00 . 2008-02-27 13:00 1 –a—— C:\WINDOWS\system32\cs.dat
2008-02-27 12:58 . 2008-02-27 12:58 51,712 –a—— C:\WINDOWS\system32\bnsock.dll
2008-02-27 12:57 . 2008-02-27 12:57 5,404 –a—— C:\ns1ztp.exe
2008-02-22 08:19 . 2008-02-22 08:20 d——– C:\Program Files\Spybot - Search & Destroy
2008-02-22 08:19 . 2008-02-22 08:18 691,545 –a—— C:\WINDOWS\unins000.exe
2008-02-22 08:19 . 2008-02-22 08:19 2,548 –a—— C:\WINDOWS\unins000.dat
2008-02-22 07:57 . 2008-02-23 19:14 108,288 –a—— C:\WINDOWS\system32\ativvax.dll
2008-02-01 01:27 . 2008-02-15 01:44 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-02-01 01:27 . 2008-02-01 01:27 1,409 –a—— C:\WINDOWS\QTFont.for
2008-01-29 19:11 . 2008-01-29 19:11 d——– C:\Documents and Settings\Administrator\Application Data\InstallShield

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-27 12:38 ——— d—–w C:\Program Files\XviD
2008-02-27 12:38 ——— d—–w C:\Program Files\Windows Media Connect 2
2008-02-27 12:38 ——— d—–w C:\Program Files\MSN Messenger
2008-02-27 12:37 ——— d—–w C:\Program Files\Easy Video Splitter
2008-02-27 12:37 ——— d—–w C:\Program Files\Common Files\Raxco
2008-02-27 12:36 ——— d—–w C:\Program Files\Common Files\Autodesk Shared
2008-02-27 12:36 ——— d—–w C:\Program Files\backburner 2
2008-02-27 12:32 ——— d—–w C:\Documents and Settings\Administrator\Application Data\Azureus
2008-02-22 08:41 68,320 —-a-w C:\Documents and Settings\Administrator\Application Data\GDIPFONTCACHEV1.DAT
2008-02-22 07:20 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-16 10:48 ——— d—–w C:\Program Files\PartyGaming
2008-02-07 22:38 ——— d—–w C:\Program Files\ESET
2008-01-29 18:07 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-01-20 17:51 ——— d—–w C:\Program Files\Common Files\AnswerWorks 4.0
2008-01-19 17:59 ——— d—–w C:\Documents and Settings\All Users\Application Data\TVU Networks
2008-01-06 18:15 ——— d—–w C:\Documents and Settings\Administrator\Application Data\ATI
2008-01-06 17:30 ——— d—–w C:\Program Files\VIA
2007-12-05 13:17 593,920 ——w C:\WINDOWS\system32\ati2sgag.exe
2007-12-05 03:05 368,640 —-a-w C:\WINDOWS\system32\ATIDEMGX.dll
2007-12-05 03:04 269,312 ——w C:\WINDOWS\system32\ati2dvag.dll
2007-12-05 02:56 147,456 —-a-w C:\WINDOWS\system32\atipdlxx.dll
2007-12-05 02:55 43,520 —-a-w C:\WINDOWS\system32\ati2edxx.dll
2007-12-05 02:55 26,112 —-a-w C:\WINDOWS\system32\Ati2mdxx.exe
2007-12-05 02:55 122,880 —-a-w C:\WINDOWS\system32\Oemdspif.dll
2007-12-05 02:55 122,880 —-a-w C:\WINDOWS\system32\ati2evxx.dll
2007-12-05 02:54 307,200 —-a-w C:\WINDOWS\system32\atiiiexx.dll
2007-12-05 02:53 53,248 —-a-w C:\WINDOWS\system32\ATIDDC.DLL
2007-12-05 02:53 495,616 —-a-w C:\WINDOWS\system32\ati2evxx.exe
2007-12-05 02:48 9,535,488 —-a-w C:\WINDOWS\system32\atioglx2.dll
2007-12-05 02:44 3,175,584 ——w C:\WINDOWS\system32\ati3duag.dll
2007-12-05 02:33 1,640,192 ——w C:\WINDOWS\system32\ativvaxx.dll
2007-12-05 02:19 5,435,392 —-a-w C:\WINDOWS\system32\atioglxx.dll
2007-12-05 02:19 385,024 —-a-w C:\WINDOWS\system32\atikvmag.dll
2007-12-05 02:17 17,408 —-a-w C:\WINDOWS\system32\atitvo32.dll
2007-12-05 02:14 180,224 —-a-w C:\WINDOWS\system32\atiok3x2.dll
2007-12-05 02:11 499,712 ——w C:\WINDOWS\system32\ati2cqag.dll
2007-11-29 18:19 3,532 —-a-w C:\drmHeader.bin
.

——- Sigcheck ——-

8f078ae4ed187aaabc0a305146de6716 C:\WINDOWS\system32\svchost.exe
—-a-w 14,336 2007-11-24 14:23:34 C:\WINDOWS\system32\svchost.exe

1800f293bccc8ede8a70e12b88d80036 C:\WINDOWS\system32\user32.dll
—-a-w 577,024 2002-12-31 12:00:00 C:\WINDOWS\system32\user32.dll

2ed0b7f12a60f90092081c50fa0ec2b2 C:\WINDOWS\system32\ws2_32.dll
—-a-w 82,944 2002-12-31 12:00:00 C:\WINDOWS\system32\ws2_32.dll

63fdfea54eb53de2d863ee454937ce1e C:\WINDOWS\system32\drivers\tcpip.sys
—-a-w 359,936 2002-12-31 12:00:00 C:\WINDOWS\system32\drivers\tcpip.sys

b66dbc40d428fe1293041d621d836ac8 C:\WINDOWS\system32\winlogon.exe
—-a-w 502,784 2002-12-31 12:00:00 C:\WINDOWS\system32\winlogon.exe

558635d3af1c7546d26067d5d9b6959e C:\WINDOWS\system32\drivers\ndis.sys
—-a-w 182,912 2002-12-31 12:00:00 C:\WINDOWS\system32\drivers\ndis.sys

d8aba3eab509627e707a3b14f00fbb6b C:\WINDOWS\system32\ntkrnlpa.exe
—-a-w 2,056,832 2002-12-31 12:00:00 C:\WINDOWS\system32\ntkrnlpa.exe

28187802b7c368c0d3aef7d4c382aabb C:\WINDOWS\system32\ntoskrnl.exe
—-a-w 2,179,456 2002-12-31 12:00:00 C:\WINDOWS\system32\ntoskrnl.exe

98d45efddd1a67f90353be8d28ed72db C:\WINDOWS\explorer.exe
—-a-w 1,032,192 2002-12-31 12:00:00 C:\WINDOWS\explorer.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0CA10898-7F98-4709-A479-B8134AB3D9F3}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FC523D5A-F5C8-48FF-B35B-E008E8F4F9B9}]
2008-02-23 19:14 108288 –a—— C:\WINDOWS\system32\ativvax.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"JulaPan"="JulaPan.Exe" [2005-07-05 16:27 425984 C:\WINDOWS\system32\JulaPan.exe]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-11-24 15:39 949376]

[HKLM\~\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^Adobe Gamma Loader.exe]
path=C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\Adobe Gamma Loader.exe
backup=C:\WINDOWS\pss\Adobe Gamma Loader.exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^HDD temperature.lnk]
path=C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\HDD temperature.lnk
backup=C:\WINDOWS\pss\HDD temperature.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk
backup=C:\WINDOWS\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Synchronizer.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Synchronizer.lnk
backup=C:\WINDOWS\pss\Adobe Acrobat Synchronizer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AutoCAD Startup Accelerator.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\AutoCAD Startup Accelerator.lnk
backup=C:\WINDOWS\pss\AutoCAD Startup Accelerator.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^BTTray.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\BTTray.lnk
backup=C:\WINDOWS\pss\BTTray.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^m-trip Launcher.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\m-trip Launcher.lnk
backup=C:\WINDOWS\pss\m-trip Launcher.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^msn_0802_upd181826.exe]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\msn_0802_upd181826.exe
backup=C:\WINDOWS\pss\msn_0802_upd181826.exeCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Suitcase 11.0.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Suitcase 11.0.lnk
backup=C:\WINDOWS\pss\Suitcase 11.0.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ABIT uGuru]
d:\Program Files\ABIT\ABIT uGuru\uGuru.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 7.0]
D:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
–a—— 2002-12-31 13:00 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
–a—— 2005-12-10 15:57 133016 d:\Program Files\DAEMON Tools\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033]
D:\Program Files\D-Tools\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\gcasServ]
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GuruClock]
d:\Program Files\ABIT\ABIT uGuru\GuruClock.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H2O]
C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HDDHealth]
d:\Program Files\HDD Health\hddhealth.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\JulaPan]
–a—— 2005-07-05 16:27 425984 C:\WINDOWS\system32\JulaPan.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kernel and Hardware Abstraction Layer]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Windows System Kernel]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
–a—— 2001-07-09 10:50 155648 C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
D:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RaidTool]
–a—— 2005-06-20 18:53 1056768 C:\Program Files\VIA\RAID\raid_tool.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
–a—— 2005-01-10 03:36 77824 C:\WINDOWS\SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
-rahs—- 2008-01-28 11:43 2097488 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
–a—— 2007-07-12 03:00 132496 C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
D:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"PDSched"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

R3 ipgd;IC Plus IP1000 Family Gigabit Ethernet Adapter Driver;C:\WINDOWS\system32\DRIVERS\ipgdnd51.sys [2005-01-11 09:47]
R3 JULA_01;Service for Juli@ 1;C:\WINDOWS\system32\drivers\JulaWdm.sys [2005-07-05 16:27]
R3 JULA_AA;Service for Juli@ Audio Driver (EWDM);C:\WINDOWS\system32\drivers\Jula.sys [2005-07-05 16:27]
S3 MA_CMIDI;%EVOL_USB.SvcDesc%;C:\WINDOWS\system32\drivers\ma_cmidi.sys []

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-27 13:45:34
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\Program Files\Eset\nod32krn.exe
.
**************************************************************************
.
Completion time: 2008-02-27 13:47:19 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-27 12:47:16
ComboFix2.txt 2007-12-08 12:28:03
Post #4
Here is the HJT log, thanks for the help!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:49:07 PM, on 2/27/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\JulaPan.Exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Documents and Settings\Administrator\Desktop\spyware\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Gamburg provider - {0CA10898-7F98-4709-A479-B8134AB3D9F3} - bnsock.dll (file missing)
O2 - BHO: (no name) - {17B1664B-D5F9-43A1-8D79-548A6F58A7B3} - C:\WINDOWS\system32\ativvax.dll
O2 - BHO: (no name) - {21B44EBC-6680-4BBC-A113-662B822B17F3} - C:\WINDOWS\system32\ativvax.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {FC523D5A-F5C8-48FF-B35B-E008E8F4F9B9} - C:\WINDOWS\system32\ativvax.dll
O4 - HKLM\..\Run: [JulaPan] JulaPan.Exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4A27027D-9371-47B2-A07A-1B5CC3A6F3B3}: NameServer = 192.168.1.1
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe

–
End of file - 2737 bytes
Post #5
Hello

Now we need to reconfigure Windows XP to show hidden files:
Double-click the My Computer icon on the Windows desktop.
Select the Tools menu and click Folder Options. Select the View Tab.

Under the Hidden files and folders heading select "Show hidden files and folders".
Uncheck the "Hide protected operating system files (recommended)" option.
Uncheck the "Hide file extensions for known file types" option.
Click Yes to confirm. Click OK.


Go to this site:
http://www.virustotal.com/
On top you'll find 'Browse'
Click the browse button and browse to the file:

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\msn_0802_upd181826.exe

Click open.
Then click the 'Send' button next to it.
This will scan the file. Please be patient.
Once scanned, copy and paste the results as well in your next reply.


Repeat it for this file

C:\WINDOWS\system32\JulaPan.exe
C:\WINDOWS\system32\drivers\Jula.sys


CLICK THIS TO LINK TO BE SURE YOU CAN VIEW HIDDEN FILES

Please go here:
The Spy Killer Forum
  • Click on "New Topic"
  • Put your name, e-mail address, and this as the title: "C:\ns1ztp.exe"
  • Put a link to this topic in the description box.
  • Then next to the file box, at the bottom, click the browse button, then navigate to this file:


    • C:\ns1ztp.exe

  • Click Open.
  • Click Post.
Thank you!



1. Close any open browsers.

2. Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\WINDOWS\system32\bnsock.dll
C:\ns1ztp.exe
C:\WINDOWS\system32\ativvax.dll


Save this as CFScript.txt, in the same location as ComboFix.exe


[external image: Posted Image]

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at "C:\ComboFix.txt"

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall


Reboot and post a new HijackThis log
Post #6
The first file unfortunately didn't exist, the only file in that folder is desktop.ini . The other 2 files are clean, they are drivers for my soundcard.

I posted the filed you asked me to here:

http://thespykiller.co.uk/index.php?PHPSES…mp;topic=6045.0

Here is the new combofix log:

ComboFix 08-02-25.3 - Administrator 2008-02-28 8:58:57.21 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1212 [GMT 1:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Administrator\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\ns1ztp.exe
C:\WINDOWS\system32\ativvax.dll
C:\WINDOWS\system32\bnsock.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\ns1ztp.exe
C:\WINDOWS\system32\ativvax.dll
C:\WINDOWS\system32\bnsock.dll

.
((((((((((((((((((((((((( Files Created from 2008-01-28 to 2008-02-28 )))))))))))))))))))))))))))))))
.

2008-02-27 13:00 . 2008-02-27 13:00 1 –a—— C:\WINDOWS\system32\rc.dat
2008-02-27 13:00 . 2008-02-27 13:00 1 –a—— C:\WINDOWS\system32\ps1.dat
2008-02-27 13:00 . 2008-02-27 13:00 1 –a—— C:\WINDOWS\system32\cs.dat
2008-02-22 08:19 . 2008-02-22 08:20 d——– C:\Program Files\Spybot - Search & Destroy
2008-02-22 08:19 . 2008-02-22 08:18 691,545 –a—— C:\WINDOWS\unins000.exe
2008-02-22 08:19 . 2008-02-22 08:19 2,548 –a—— C:\WINDOWS\unins000.dat
2008-02-01 01:27 . 2008-02-15 01:44 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-02-01 01:27 . 2008-02-01 01:27 1,409 –a—— C:\WINDOWS\QTFont.for
2008-01-29 19:11 . 2008-01-29 19:11 d——– C:\Documents and Settings\Administrator\Application Data\InstallShield

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-28 08:00 ——— d—–w C:\Documents and Settings\Administrator\Application Data\Azureus
2008-02-27 12:38 ——— d—–w C:\Program Files\XviD
2008-02-27 12:38 ——— d—–w C:\Program Files\Windows Media Connect 2
2008-02-27 12:38 ——— d—–w C:\Program Files\MSN Messenger
2008-02-27 12:37 ——— d—–w C:\Program Files\Easy Video Splitter
2008-02-27 12:37 ——— d—–w C:\Program Files\Common Files\Raxco
2008-02-27 12:36 ——— d—–w C:\Program Files\Common Files\Autodesk Shared
2008-02-27 12:36 ——— d—–w C:\Program Files\backburner 2
2008-02-22 08:41 68,320 —-a-w C:\Documents and Settings\Administrator\Application Data\GDIPFONTCACHEV1.DAT
2008-02-22 07:20 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-16 10:48 ——— d—–w C:\Program Files\PartyGaming
2008-02-07 22:38 ——— d—–w C:\Program Files\ESET
2008-01-29 18:07 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-01-20 17:51 ——— d—–w C:\Program Files\Common Files\AnswerWorks 4.0
2008-01-19 17:59 ——— d—–w C:\Documents and Settings\All Users\Application Data\TVU Networks
2008-01-06 18:15 ——— d—–w C:\Documents and Settings\Administrator\Application Data\ATI
2008-01-06 17:30 ——— d—–w C:\Program Files\VIA
2007-11-29 18:19 3,532 —-a-w C:\drmHeader.bin
.

——- Sigcheck ——-

8f078ae4ed187aaabc0a305146de6716 C:\WINDOWS\system32\svchost.exe
—-a-w 14,336 2007-11-24 14:23:34 C:\WINDOWS\system32\svchost.exe

1800f293bccc8ede8a70e12b88d80036 C:\WINDOWS\system32\user32.dll
—-a-w 577,024 2002-12-31 12:00:00 C:\WINDOWS\system32\user32.dll

2ed0b7f12a60f90092081c50fa0ec2b2 C:\WINDOWS\system32\ws2_32.dll
—-a-w 82,944 2002-12-31 12:00:00 C:\WINDOWS\system32\ws2_32.dll

63fdfea54eb53de2d863ee454937ce1e C:\WINDOWS\system32\drivers\tcpip.sys
—-a-w 359,936 2002-12-31 12:00:00 C:\WINDOWS\system32\drivers\tcpip.sys

b66dbc40d428fe1293041d621d836ac8 C:\WINDOWS\system32\winlogon.exe
—-a-w 502,784 2002-12-31 12:00:00 C:\WINDOWS\system32\winlogon.exe

558635d3af1c7546d26067d5d9b6959e C:\WINDOWS\system32\drivers\ndis.sys
—-a-w 182,912 2002-12-31 12:00:00 C:\WINDOWS\system32\drivers\ndis.sys

d8aba3eab509627e707a3b14f00fbb6b C:\WINDOWS\system32\ntkrnlpa.exe
—-a-w 2,056,832 2002-12-31 12:00:00 C:\WINDOWS\system32\ntkrnlpa.exe

28187802b7c368c0d3aef7d4c382aabb C:\WINDOWS\system32\ntoskrnl.exe
—-a-w 2,179,456 2002-12-31 12:00:00 C:\WINDOWS\system32\ntoskrnl.exe

98d45efddd1a67f90353be8d28ed72db C:\WINDOWS\explorer.exe
—-a-w 1,032,192 2002-12-31 12:00:00 C:\WINDOWS\explorer.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0CA10898-7F98-4709-A479-B8134AB3D9F3}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"JulaPan"="JulaPan.Exe" [2005-07-05 16:27 425984 C:\WINDOWS\system32\JulaPan.exe]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-11-24 15:39 949376]

[HKLM\~\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^Adobe Gamma Loader.exe]
path=C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\Adobe Gamma Loader.exe
backup=C:\WINDOWS\pss\Adobe Gamma Loader.exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^HDD temperature.lnk]
path=C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\HDD temperature.lnk
backup=C:\WINDOWS\pss\HDD temperature.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk
backup=C:\WINDOWS\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Synchronizer.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Synchronizer.lnk
backup=C:\WINDOWS\pss\Adobe Acrobat Synchronizer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AutoCAD Startup Accelerator.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\AutoCAD Startup Accelerator.lnk
backup=C:\WINDOWS\pss\AutoCAD Startup Accelerator.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^BTTray.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\BTTray.lnk
backup=C:\WINDOWS\pss\BTTray.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^m-trip Launcher.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\m-trip Launcher.lnk
backup=C:\WINDOWS\pss\m-trip Launcher.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^msn_0802_upd181826.exe]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\msn_0802_upd181826.exe
backup=C:\WINDOWS\pss\msn_0802_upd181826.exeCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Suitcase 11.0.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Suitcase 11.0.lnk
backup=C:\WINDOWS\pss\Suitcase 11.0.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ABIT uGuru]
d:\Program Files\ABIT\ABIT uGuru\uGuru.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 7.0]
D:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
–a—— 2002-12-31 13:00 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
–a—— 2005-12-10 15:57 133016 d:\Program Files\DAEMON Tools\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033]
D:\Program Files\D-Tools\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\gcasServ]
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GuruClock]
d:\Program Files\ABIT\ABIT uGuru\GuruClock.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H2O]
C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HDDHealth]
d:\Program Files\HDD Health\hddhealth.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\JulaPan]
–a—— 2005-07-05 16:27 425984 C:\WINDOWS\system32\JulaPan.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kernel and Hardware Abstraction Layer]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Windows System Kernel]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
–a—— 2001-07-09 10:50 155648 C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
D:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RaidTool]
–a—— 2005-06-20 18:53 1056768 C:\Program Files\VIA\RAID\raid_tool.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
–a—— 2005-01-10 03:36 77824 C:\WINDOWS\SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
-rahs—- 2008-01-28 11:43 2097488 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
–a—— 2007-07-12 03:00 132496 C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
D:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"PDSched"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

R3 ipgd;IC Plus IP1000 Family Gigabit Ethernet Adapter Driver;C:\WINDOWS\system32\DRIVERS\ipgdnd51.sys [2005-01-11 09:47]
R3 JULA_01;Service for Juli@ 1;C:\WINDOWS\system32\drivers\JulaWdm.sys [2005-07-05 16:27]
R3 JULA_AA;Service for Juli@ Audio Driver (EWDM);C:\WINDOWS\system32\drivers\Jula.sys [2005-07-05 16:27]
S3 MA_CMIDI;%EVOL_USB.SvcDesc%;C:\WINDOWS\system32\drivers\ma_cmidi.sys []

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-28 09:01:57
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\Program Files\Eset\nod32krn.exe
.
**************************************************************************
.
Completion time: 2008-02-28 9:04:01 - machine was rebooted [Administrator]
ComboFix-quarantined-files.txt 2008-02-28 08:03:52
ComboFix2.txt 2008-02-27 12:47:20
ComboFix3.txt 2007-12-08 12:28:03

And the new HJT log! Thanks so much!!!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:12:28 AM, on 2/28/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\JulaPan.Exe
C:\Program Files\Eset\nod32kui.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Administrator\Desktop\spyware\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Gamburg provider - {0CA10898-7F98-4709-A479-B8134AB3D9F3} - bnsock.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O4 - HKLM\..\Run: [JulaPan] JulaPan.Exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4A27027D-9371-47B2-A07A-1B5CC3A6F3B3}: NameServer = 192.168.1.1
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe

–
End of file - 2482 bytes
Post #7
Hello

1. Close any open browsers.

2. Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\msn_0802_upd181826.exe


Save this as CFScript.txt, in the same location as ComboFix.exe


[external image: Posted Image]

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at "C:\ComboFix.txt"

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall



1. Please re-open HiJackThis and choose do a system scan only. Check the boxes next to ONLY the entries listed below(if present):

O2 - BHO: Gamburg provider - {0CA10898-7F98-4709-A479-B8134AB3D9F3} - bnsock.dll (file missing)

2. Now close all windows other than HiJackThis, including browsers, so that nothing other than HijackThis is open, then click Fix Checked. A box will pop up asking you if you wish to fix the selected items. Please choose YES. Once it has fixed them, please exit/close HijackThis.



Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Full Scan", then click Scan. Check all the boxes and click Start Scan
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.


Reboot and post a new HijackThis log and tell me how your PC is running
Post #10
Most recent HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:41:04 PM, on 3/5/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\JulaPan.Exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Documents and Settings\Administrator\Desktop\spyware\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O4 - HKLM\..\Run: [JulaPan] JulaPan.Exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4A27027D-9371-47B2-A07A-1B5CC3A6F3B3}: NameServer = 192.168.1.1
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe

–
End of file - 2318 bytes

————————

Combofix:

ComboFix 08-02-25.3 - Administrator 2008-02-28 15:36:59.22 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1553 [GMT 1:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Administrator\Desktop\cfscript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\msn_0802_upd181826.exe
.

((((((((((((((((((((((((( Files Created from 2008-01-28 to 2008-02-28 )))))))))))))))))))))))))))))))
.

2008-02-27 13:00 . 2008-02-27 13:00 1 –a—— C:\WINDOWS\system32\rc.dat
2008-02-27 13:00 . 2008-02-27 13:00 1 –a—— C:\WINDOWS\system32\ps1.dat
2008-02-27 13:00 . 2008-02-27 13:00 1 –a—— C:\WINDOWS\system32\cs.dat
2008-02-22 08:19 . 2008-02-22 08:20 d——– C:\Program Files\Spybot - Search & Destroy
2008-02-22 08:19 . 2008-02-22 08:18 691,545 –a—— C:\WINDOWS\unins000.exe
2008-02-22 08:19 . 2008-02-22 08:19 2,548 –a—— C:\WINDOWS\unins000.dat
2008-02-01 01:27 . 2008-02-15 01:44 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-02-01 01:27 . 2008-02-01 01:27 1,409 –a—— C:\WINDOWS\QTFont.for
2008-01-29 19:11 . 2008-01-29 19:11 d——– C:\Documents and Settings\Administrator\Application Data\InstallShield

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-28 08:00 ——— d—–w C:\Documents and Settings\Administrator\Application Data\Azureus
2008-02-27 12:38 ——— d—–w C:\Program Files\XviD
2008-02-27 12:38 ——— d—–w C:\Program Files\Windows Media Connect 2
2008-02-27 12:38 ——— d—–w C:\Program Files\MSN Messenger
2008-02-27 12:37 ——— d—–w C:\Program Files\Easy Video Splitter
2008-02-27 12:37 ——— d—–w C:\Program Files\Common Files\Raxco
2008-02-27 12:36 ——— d—–w C:\Program Files\Common Files\Autodesk Shared
2008-02-27 12:36 ——— d—–w C:\Program Files\backburner 2
2008-02-22 08:41 68,320 —-a-w C:\Documents and Settings\Administrator\Application Data\GDIPFONTCACHEV1.DAT
2008-02-22 07:20 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-07 22:38 ——— d—–w C:\Program Files\ESET
2008-01-29 18:07 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-01-20 17:51 ——— d—–w C:\Program Files\Common Files\AnswerWorks 4.0
2008-01-19 17:59 ——— d—–w C:\Documents and Settings\All Users\Application Data\TVU Networks
2008-01-06 18:15 ——— d—–w C:\Documents and Settings\Administrator\Application Data\ATI
2008-01-06 17:30 ——— d—–w C:\Program Files\VIA
2007-12-05 13:17 593,920 ——w C:\WINDOWS\system32\ati2sgag.exe
2007-12-05 03:05 368,640 —-a-w C:\WINDOWS\system32\ATIDEMGX.dll
2007-12-05 03:04 269,312 ——w C:\WINDOWS\system32\ati2dvag.dll
2007-12-05 02:56 147,456 —-a-w C:\WINDOWS\system32\atipdlxx.dll
2007-12-05 02:55 43,520 —-a-w C:\WINDOWS\system32\ati2edxx.dll
2007-12-05 02:55 26,112 —-a-w C:\WINDOWS\system32\Ati2mdxx.exe
2007-12-05 02:55 122,880 —-a-w C:\WINDOWS\system32\Oemdspif.dll
2007-12-05 02:55 122,880 —-a-w C:\WINDOWS\system32\ati2evxx.dll
2007-12-05 02:54 307,200 —-a-w C:\WINDOWS\system32\atiiiexx.dll
2007-12-05 02:53 53,248 —-a-w C:\WINDOWS\system32\ATIDDC.DLL
2007-12-05 02:53 495,616 —-a-w C:\WINDOWS\system32\ati2evxx.exe
2007-12-05 02:48 9,535,488 —-a-w C:\WINDOWS\system32\atioglx2.dll
2007-12-05 02:44 3,175,584 ——w C:\WINDOWS\system32\ati3duag.dll
2007-12-05 02:33 1,640,192 ——w C:\WINDOWS\system32\ativvaxx.dll
2007-12-05 02:19 5,435,392 —-a-w C:\WINDOWS\system32\atioglxx.dll
2007-12-05 02:19 385,024 —-a-w C:\WINDOWS\system32\atikvmag.dll
2007-12-05 02:17 17,408 —-a-w C:\WINDOWS\system32\atitvo32.dll
2007-12-05 02:14 180,224 —-a-w C:\WINDOWS\system32\atiok3x2.dll
2007-12-05 02:11 499,712 ——w C:\WINDOWS\system32\ati2cqag.dll
2007-11-29 18:19 3,532 —-a-w C:\drmHeader.bin
.

——- Sigcheck ——-

8f078ae4ed187aaabc0a305146de6716 C:\WINDOWS\system32\svchost.exe
—-a-w 14,336 2007-11-24 14:23:34 C:\WINDOWS\system32\svchost.exe

1800f293bccc8ede8a70e12b88d80036 C:\WINDOWS\system32\user32.dll
—-a-w 577,024 2002-12-31 12:00:00 C:\WINDOWS\system32\user32.dll

2ed0b7f12a60f90092081c50fa0ec2b2 C:\WINDOWS\system32\ws2_32.dll
—-a-w 82,944 2002-12-31 12:00:00 C:\WINDOWS\system32\ws2_32.dll

63fdfea54eb53de2d863ee454937ce1e C:\WINDOWS\system32\drivers\tcpip.sys
—-a-w 359,936 2002-12-31 12:00:00 C:\WINDOWS\system32\drivers\tcpip.sys

b66dbc40d428fe1293041d621d836ac8 C:\WINDOWS\system32\winlogon.exe
—-a-w 502,784 2002-12-31 12:00:00 C:\WINDOWS\system32\winlogon.exe

558635d3af1c7546d26067d5d9b6959e C:\WINDOWS\system32\drivers\ndis.sys
—-a-w 182,912 2002-12-31 12:00:00 C:\WINDOWS\system32\drivers\ndis.sys

d8aba3eab509627e707a3b14f00fbb6b C:\WINDOWS\system32\ntkrnlpa.exe
—-a-w 2,056,832 2002-12-31 12:00:00 C:\WINDOWS\system32\ntkrnlpa.exe

28187802b7c368c0d3aef7d4c382aabb C:\WINDOWS\system32\ntoskrnl.exe
—-a-w 2,179,456 2002-12-31 12:00:00 C:\WINDOWS\system32\ntoskrnl.exe

98d45efddd1a67f90353be8d28ed72db C:\WINDOWS\explorer.exe
—-a-w 1,032,192 2002-12-31 12:00:00 C:\WINDOWS\explorer.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0CA10898-7F98-4709-A479-B8134AB3D9F3}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"JulaPan"="JulaPan.Exe" [2005-07-05 16:27 425984 C:\WINDOWS\system32\JulaPan.exe]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-11-24 15:39 949376]

[HKLM\~\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^Adobe Gamma Loader.exe]
path=C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\Adobe Gamma Loader.exe
backup=C:\WINDOWS\pss\Adobe Gamma Loader.exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^HDD temperature.lnk]
path=C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\HDD temperature.lnk
backup=C:\WINDOWS\pss\HDD temperature.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk
backup=C:\WINDOWS\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Synchronizer.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Synchronizer.lnk
backup=C:\WINDOWS\pss\Adobe Acrobat Synchronizer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AutoCAD Startup Accelerator.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\AutoCAD Startup Accelerator.lnk
backup=C:\WINDOWS\pss\AutoCAD Startup Accelerator.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^BTTray.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\BTTray.lnk
backup=C:\WINDOWS\pss\BTTray.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^m-trip Launcher.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\m-trip Launcher.lnk
backup=C:\WINDOWS\pss\m-trip Launcher.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^msn_0802_upd181826.exe]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\msn_0802_upd181826.exe
backup=C:\WINDOWS\pss\msn_0802_upd181826.exeCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Suitcase 11.0.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Suitcase 11.0.lnk
backup=C:\WINDOWS\pss\Suitcase 11.0.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ABIT uGuru]
d:\Program Files\ABIT\ABIT uGuru\uGuru.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 7.0]
D:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
–a—— 2002-12-31 13:00 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
–a—— 2005-12-10 15:57 133016 d:\Program Files\DAEMON Tools\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033]
D:\Program Files\D-Tools\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\gcasServ]
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GuruClock]
d:\Program Files\ABIT\ABIT uGuru\GuruClock.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H2O]
C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HDDHealth]
d:\Program Files\HDD Health\hddhealth.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\JulaPan]
–a—— 2005-07-05 16:27 425984 C:\WINDOWS\system32\JulaPan.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kernel and Hardware Abstraction Layer]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Windows System Kernel]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
–a—— 2001-07-09 10:50 155648 C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
D:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RaidTool]
–a—— 2005-06-20 18:53 1056768 C:\Program Files\VIA\RAID\raid_tool.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
–a—— 2005-01-10 03:36 77824 C:\WINDOWS\SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
-rahs—- 2008-01-28 11:43 2097488 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
–a—— 2007-07-12 03:00 132496 C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
D:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"PDSched"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

R3 ipgd;IC Plus IP1000 Family Gigabit Ethernet Adapter Driver;C:\WINDOWS\system32\DRIVERS\ipgdnd51.sys [2005-01-11 09:47]
R3 JULA_01;Service for Juli@ 1;C:\WINDOWS\system32\drivers\JulaWdm.sys [2005-07-05 16:27]
R3 JULA_AA;Service for Juli@ Audio Driver (EWDM);C:\WINDOWS\system32\drivers\Jula.sys [2005-07-05 16:27]
S3 MA_CMIDI;%EVOL_USB.SvcDesc%;C:\WINDOWS\system32\drivers\ma_cmidi.sys []

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-28 15:38:21
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-28 15:39:00
ComboFix-quarantined-files.txt 2008-02-28 14:38:39
ComboFix2.txt 2008-02-28 08:04:01
ComboFix3.txt 2008-02-27 12:47:20
ComboFix4.txt 2007-12-08 12:28:03

———————

Malwaybytes:

Malwarebytes' Anti-Malware 1.05
Database version: 421

Scan type: Full Scan (A:\|C:\|D:\|E:\|F:\|)
Objects scanned: 253614
Time elapsed: 1 hour(s), 20 minute(s), 36 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 5

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\cs.dat (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\rc.dat (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ps1.dat (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\cmds.txt (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\inf\ultra.PNF (Malware.Trace) -> Quarantined and deleted successfully.

———–

Computer running OK, still some web problems that I didn't have before (multiple links not opening when I click on them in IE, have to go open new window). Another problem that has arisen is with HJT, see the following:

Please help us improve HijackThis by reporting this error

Click 'Yes' to submit

Error Details:

An unexpected error has occurred at procedure: modRegistry_IniGetString(sFile=system.ini, sSection=boot, sValue=Shell)
Error #5 - Invalid procedure call or argument

Windows version: Windows NT 5.01.2600
MSIE version: 6.0.2900.2180
HijackThis version: 2.0.2

———

Reinstalled, but problem still appeared. Scan ran with no issues though.
Post #11
Your logs are clean ! We need to do a few things

Now lets uninstall Combofix:
  • Click START then RUN
  • Now type Combofix /u in the runbox and click OK
The above procedure will do the following:
  • Delete ComboFix and its associated files and folders.
  • Delete VundoFix backups, if present
  • Delete the C:\Deckard folder, if present
  • Delete the C:_OtMoveIt folder, if present
  • Reset the clock settings.
  • Hide file extensions, if required.
  • Hide System/Hidden files, if required.
  • Reset System Restore.


Below I have included a number of recommendations for how to protect your computer against malware infections.

* Keep Windows updated by regularly checking their website at :
http://windowsupdate.microsoft.com/
This will ensure your computer has always the latest security updates available installed on your computer.

* To reduce re-infection for malware in the future, I strongly recommend installing these free programs:
SpywareBlaster protects against bad ActiveX
IE-SPYAD puts over 5000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all
Have a look at this tutorial for IE-Spyad here

* SpywareGuard offers realtime protection from spyware installation attempts.

Make Internet Explorer more secure
  • Click Start > Run
  • Type Inetcpl.cpl & click OK
  • Click on the Security tab
  • Click Reset all zones to default level
  • Make sure the Internet Zone is selected & Click Custom level
  • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
  • Next Click OK, then Apply button and then OK to exit the Internet Properties page.

* MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.

* Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more
secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in pop up
blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from
Here

* Take a good look at the following suggestions for malware prevention by reading Tony Klein’s article 'How Did I Get Infected In The First Place'
Here

Thank you for your patience, and performing all of the procedures requested.
Post #12
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI