Spyware / Malware / Virus Removal

[Resolved] PE_TRATS.A andADW_VIRTUMONDO.H

135 min read

Looking for the outcome? Ask AI

doe-head Topic Starter

Post #1February 24, 2008, 12:51 AM UTC

Here is my log. I hope some one can help
Logfile of HijackThis v1.99.1
Scan saved at 3:58:52 PM, on 2/23/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AVANQU~1\SYSTEM~1\MXTask.exe
C:\WINDOWS\system32\0C11091014100.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\AVANQU~1\SYSTEM~1\mxtask.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2 .exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\ctfmon .exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://news.google.com/nwshp?hl=en&gl=us
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
F3 - REG:win.ini: load=C:\WINDOWS\system32\geebb.exe
F2 - REG:system.ini: UserInit=userinit.exe
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [0308FF070B07050] 0C11091014100.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [e0851338] rundll32.exe "C:\WINDOWS\system32\yqfiaaxg.dll",b
O4 - HKLM\..\Run: [BMe3b620a4] Rundll32.exe "C:\WINDOWS\system32\ryklukqe.dll",s
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\WINDOWS\System32\shdocvw.dll
O10 - Unknown file in Winsock LSP: c:\progra~1\avanqu~1\system~1\ufilter.dll
O10 - Unknown file in Winsock LSP: c:\progra~1\avanqu~1\system~1\ufilter.dll
O10 - Unknown file in Winsock LSP: c:\progra~1\avanqu~1\system~1\ufilter.dll
O10 - Unknown file in Winsock LSP: c:\progra~1\avanqu~1\system~1\ufilter.dll
O15 - Trusted Zone: *.doginhispen.com
O15 - Trusted Zone: *.whataboutadog.com
O15 - Trusted Zone: *.whataboutarabit.com
O16 - DPF: {127CE7BA-AD89-4108-A913-C52EFC037C36} -
O16 - DPF: {2776DDE9-D4B2-4BF7-9F98-ADC1A1B80AF5} -
O16 - DPF: {90051A81-3018-4826-8B38-DD60B6B53F9C} (Snapfish File Upload ActiveX Control) - http://www.costcophotocenter.com/CostcoUpload.cab
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SystemSuite Task Manager - Avanquest Software USA, Inc. - C:\PROGRA~1\AVANQU~1\SYSTEM~1\MXTask.exe

Thanks Sean

IndiGenus

Post #2February 26, 2008, 1:24 AM UTC

Hi doe-head and welcome to the forums.

My name is Dave. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can sometimes take a while to research so please be patient and I'd be grateful if you would note the following:

I will working be on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for this issue on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.
I recommend you make a backup of any data that you have created, such as documents, pictures, music, ect… before we begin the fix.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Yes, pretty heavily infected machine here. Part of the reason is it appears you have absolutely NO security software in place. No Antivirus, Antispyware, ect…with all of the free-for-home-use ones out there's no excuse not to have some in place. But I'll get off my soapbox now and we'll start cleaning. You may have problems if you try to install anything now any way, so we'll wait till after we get things somewhat clean, then I'll advise some programs.

Please download SDFix and save it to your Desktop.

You should print out these instructions, or copy them to a NotePad file for reading while in Safe Mode, because you will not be able to connect to the Internet to read from this site.

Double click on SDFix.exe. It should automatically extract a folder called SDFix to your system drive (usually C:\). Please reboot your computer in Safe Mode by doing the following :

Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, a menu with options should appear;
Select the first option, to run Windows in Safe Mode, then press "Enter".
Choose your usual account.

Open the SDFix folder and double click on RunThis.bat to start the script.
Type Y and press Enter to begin the script.
It will start cleaning your PC and then prompt you to press any key to Reboot.
Press any key to restart the PC.
Your system will take longer than normal to restart as the fixtool will be removing files.
When the desktop loads the Fixtool will complete the removal and display Finished.
Press any key to end the script and to load your desktop icons.
A text file should automatically open, so please copy the contents and post them here

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Please download ComboFix by sUBs from HERE or HERE

You must download it to and run it from your Desktop
Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
Double click combofix.exe & follow the prompts.
When finished, it will produce a log. Please save that log to post in your next reply along with a fresh HJT log
Re-enable all the programs that were disabled during the running of ComboFix..

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

doe-head

Post #3February 27, 2008, 5:13 AM UTC

Here is my sdfix log
SDFix: Version 1.147

Run by [removed] on Tue 02/26/2008 at 08:39 PM

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix

Checking Services :

Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting

Checking Files :

Trojan Files Found:

C:\WINDOWS\SYSTEM32\0C1109~1.EXE - Deleted
C:\Program Files\Dot1XCfg\Dot1XCfg .exe - Deleted
C:\Program Files\Temporary\kernInst.exe - Deleted
C:\WINDOWS\b122.exe - Deleted
C:\WINDOWS\b149.exe - Deleted
C:\WINDOWS\mrofinu72.exe - Deleted
C:\WINDOWS\system32\drivers\ntndis.exe - Deleted

Folder C:\Program Files\Dot1XCfg - Removed
Folder C:\Program Files\Temporary - Removed

Removing Temp Files

ADS Check :

Final Check :

catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-26 21:01:58
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden services & system hive …

scanning hidden registry entries …

scanning hidden files …

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

Remaining Services :

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\Internet Explorer\\iexplore.exe"="C:\\Program Files\\Internet Explorer\\iexplore.exe:*:Enabled:Internet Explorer"
"C:\\Program Files\\backburner 2\\manager.exe"="C:\\Program Files\\backburner 2\\manager.exe:*:Disabled:backburner Manager Application"
"C:\\Program Files\\backburner 2\\server.exe"="C:\\Program Files\\backburner 2\\server.exe:*:Disabled:backburner Server Application"
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe:*:Enabled:Yahoo! FT Server"
"C:\\WINDOWS\\system32\\spoolsv.exe"="C:\\WINDOWS\\system32\\spoolsv.exe:*:Enabled:Spooler SubSystem App"
"C:\\Program Files\\kontiki\\KService.exe"="C:\\Program Files\\kontiki\\KService.exe:*:Enabled:Delivery Manager Service"
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"="C:\\Program Files\\Mozilla Firefox\\firefox.exe:*:Enabled:Firefox"
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"="C:\\Program Files\\Real\\RealPlayer\\realplay.exe:*:Disabled:RealPlayer"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\WINDOWS\\system32\\guqrlqsb.exe"="C:\\WINDOWS\\system32\\guq"
"C:\\WINDOWS\\system32\\ouodtejc.exe"="C:\\WINDOWS\\system32\\ouo"
"C:\\WINDOWS\\system32\\qcqhybjq.exe"="C:\\WINDOWS\\system32\\qcq"
"D:\\setup\\HPZnet01.exe"="D:\\setup\\HPZnet01.exe:*:Enabled:hpznet01.exe"
"D:\\setup\\HPONICIFS01.EXE"="D:\\setup\\HPONICIFS01.EXE:*:Enabled:hponicifs01.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe:*:Enabled:hpqtra08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe:*:Enabled:hpqste08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe:*:Enabled:hpofxm08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe:*:Enabled:hposfx08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe:*:Enabled:hposid01.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe:*:Enabled:hpqcopy.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe:*:Enabled:hpfccopy.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"="C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"="C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe:*:Enabled:hpqdia.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe:*:Enabled:hpoews01.exe"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

Remaining Files :

File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes :

Sun 6 Mar 2005 3,112,968 …H. — "C:\Program Files\Picasa2\setup.exe"
Mon 28 Jan 2008 230,400 ..SHR — "C:\Program Files\T?sks\w?nlogon.exe"
Tue 8 Nov 2005 28,173 A.SH. — "C:\WINDOWS\system32\gebyv.dll"
Wed 19 Oct 2005 28,173 A.SH. — "C:\WINDOWS\system32\mllmj.dll"
Sun 11 Sep 2005 176,478 A.SH. — "C:\WINDOWS\system32\qqtss.bak1"
Sat 10 Dec 2005 446,998 ..SH. — "C:\WINDOWS\system32\rtutv.bak1"
Wed 26 Jan 2005 4,348 ..SH. — "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Sun 20 Jan 2008 72,704 A.SHR — "C:\Documents and Settings\Courtney\Local Settings\Temp\TMP129E.tmp"
Sun 17 Feb 2008 70,656 A.SHR — "C:\Documents and Settings\Courtney\Local Settings\Temp\TMP3E.tmp"
Fri 12 Nov 2004 37,376 …H. — "C:\Program Files\Common Files\Adobe\ESD\DLMCleanup.exe"

Finished!

doe-head

Post #4February 27, 2008, 6:11 AM UTC

Here is a copy of the latest HJT log
I could not find a copy of the combo fix log after I ran it and it rebooted my computer
Logfile of HijackThis v1.99.1
Scan saved at 22:06, on 2008-02-26
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\AVANQU~1\SYSTEM~1\MXTask.exe
C:\PROGRA~1\AVANQU~1\SYSTEM~1\mxtask.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\DOCUME~1\Sean\LOCALS~1\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://news.google.com/nwshp?hl=en&gl=us
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\Avanquest\SystemSuite\LinkScannerIE.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [combofix] C:\WINDOWS\system32\kmd.exe /c C:\ComboFix(2)\Combobatch.bat
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\WINDOWS\System32\shdocvw.dll
O10 - Unknown file in Winsock LSP: c:\progra~1\avanqu~1\system~1\ufilter.dll
O10 - Unknown file in Winsock LSP: c:\progra~1\avanqu~1\system~1\ufilter.dll
O10 - Unknown file in Winsock LSP: c:\progra~1\avanqu~1\system~1\ufilter.dll
O10 - Unknown file in Winsock LSP: c:\progra~1\avanqu~1\system~1\ufilter.dll
O15 - Trusted Zone: *.doginhispen.com
O15 - Trusted Zone: *.whataboutarabit.com
O16 - DPF: {127CE7BA-AD89-4108-A913-C52EFC037C36} -
O16 - DPF: {2776DDE9-D4B2-4BF7-9F98-ADC1A1B80AF5} -
O16 - DPF: {90051A81-3018-4826-8B38-DD60B6B53F9C} (Snapfish File Upload ActiveX Control) - http://www.costcophotocenter.com/CostcoUpload.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SystemSuite Task Manager - Avanquest Software USA, Inc. - C:\PROGRA~1\AVANQU~1\SYSTEM~1\MXTask.exe

IndiGenus

Post #5February 27, 2008, 11:59 AM UTC

Hi, Looking better, would still like a combofix log. Please try running combofix again. Make sure you are running it from your desktop and do not mouseclick on the window while it running. Thanks, Dave

doe-head

Post #6February 28, 2008, 1:38 AM UTC

I had to reload combo fix then it gave me the file so here it is
Thanks for all the help
Sean
ComboFix 08-02-25.3 - Sean 2008-02-27 17:24:04.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.105 [GMT -8:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
—- Previous Run ——-
.
C:\Documents and Settings\Courtney\Start Menu\Programs\Outerinfo
C:\Documents and Settings\Courtney\Start Menu\Programs\Outerinfo\Terms.lnk
C:\Documents and Settings\Courtney\Start Menu\Programs\Outerinfo\Uninstall.lnk
C:\Program Files\outerinfo
C:\Program Files\outerinfo\FF\chrome.manifest
C:\Program Files\outerinfo\FF\components\FF.dll
C:\Program Files\outerinfo\FF\components\OuterinfoAds.xpt
C:\Program Files\outerinfo\FF\install.rdf
C:\Program Files\outerinfo\OiUninstaller.exe
C:\Program Files\outerinfo\outerinfo.ico
C:\Program Files\outerinfo\Terms.rtf
C:\Program Files\tsks~1
C:\Program Files\tsks~1\w?nlogon.exe
C:\Program Files\WinBudget
C:\Program Files\WinBudget\bin\carp**.1191374245.old
C:\Program Files\WinBudget\bin\carp**.1193856329.old
C:\Program Files\WinBudget\bin\carp**.1195089791.old
C:\Program Files\WinBudget\bin\carp**.1195939206.old
C:\Program Files\WinBudget\bin\matrix.dat
C:\Program Files\WinBudget\bin\matrix.dll
C:\Program Files\WinBudget\bin\matrix.dll.1193856328.old
C:\Program Files\WinBudget\bin\matrix.dll.1195089790.old
C:\Program Files\WinBudget\bin\matrix.dll.1195939205.old
C:\WINDOWS\cookies.ini
C:\WINDOWS\sepru.dat
C:\WINDOWS\system32\ablds.dat
C:\WINDOWS\system32\abrndsrf.dll
C:\WINDOWS\system32\abyvwdcr.ini
C:\WINDOWS\system32\aifvuaae.dll
C:\WINDOWS\system32\ajvencgv.dll
C:\WINDOWS\system32\bbeeg.ini
C:\WINDOWS\system32\bbeeg.ini2
C:\WINDOWS\system32\bctqtjgm.dll
C:\WINDOWS\system32\bctvhxtu.ini
C:\WINDOWS\system32\benfujiw.ini
C:\WINDOWS\system32\bnpbuvea.ini
C:\WINDOWS\system32\bqshuusc.ini
C:\WINDOWS\system32\bwmmwork.dll
C:\WINDOWS\system32\ciuexgja.dll
C:\WINDOWS\system32\crosof~1.net
C:\WINDOWS\system32\crqhwijm.dll
C:\WINDOWS\system32\csuxiulp.dll
C:\WINDOWS\system32\ctfmon.exe.tmp
C:\WINDOWS\system32\dbjmrvcf.dll
C:\WINDOWS\system32\djisutev.dll
C:\WINDOWS\system32\dolc.dll
C:\WINDOWS\system32\dqhlngis.ini
C:\WINDOWS\system32\dywoxvnh.ini
C:\WINDOWS\system32\ebisjlcr.dll
C:\WINDOWS\system32\eelwwivn.dll
C:\WINDOWS\system32\eeopkuoi.dll
C:\WINDOWS\system32\eochsyur.dll
C:\WINDOWS\system32\epbkrudq.ini
C:\WINDOWS\system32\eqdcxfca.dll
C:\WINDOWS\system32\fkyxbvpb.dll
C:\WINDOWS\system32\gdhvytsd.dll
C:\WINDOWS\system32\gebyv.dll
C:\WINDOWS\system32\geeba.exe
C:\WINDOWS\system32\geebb.exe
C:\WINDOWS\system32\goblhsob.dll
C:\WINDOWS\system32\godlpouu.dll
C:\WINDOWS\system32\gqkfwjqc.ini
C:\WINDOWS\system32\gqlucico.ini
C:\WINDOWS\system32\gsrjprxm.ini
C:\WINDOWS\system32\gxaaifqy.ini
C:\WINDOWS\system32\hjwlqctt.ini
C:\WINDOWS\system32\hmnrpfos.dll
C:\WINDOWS\system32\hokakhws.dll
C:\WINDOWS\system32\hopgwenk.ini
C:\WINDOWS\system32\howefjsh.ini
C:\WINDOWS\system32\iepkaovf.dll
C:\WINDOWS\system32\ietsmtwy.ini
C:\WINDOWS\system32\ifbxrhxq.dll
C:\WINDOWS\system32\ihjipoyu.dll
C:\WINDOWS\system32\insghftm.ini
C:\WINDOWS\system32\iutpbrcs.ini
C:\WINDOWS\system32\ivsewuvj.dll
C:\WINDOWS\system32\iwkyyyqm.ini
C:\WINDOWS\system32\iwwglytp.dll
C:\WINDOWS\system32\iyeykvmu.dll
C:\WINDOWS\system32\iymofjij.dll
C:\WINDOWS\system32\jgwqidyb.dll
C:\WINDOWS\system32\jsklsdfa.ini
C:\WINDOWS\system32\jvuwesvi.ini
C:\WINDOWS\system32\jwjijavs.dll
C:\WINDOWS\system32\jyklchdt.dll
C:\WINDOWS\system32\kglnomql.ini
C:\WINDOWS\system32\kitlxhmq.ini
C:\WINDOWS\system32\kqrtegkj.dll
C:\WINDOWS\system32\lacovned.dll
C:\WINDOWS\system32\ljcdvwdg.dll
C:\WINDOWS\system32\ljnunahm.dll
C:\WINDOWS\system32\ltdiyhxk.dll
C:\WINDOWS\system32\lukixoke.ini
C:\WINDOWS\system32\lvhjpohl.dll
C:\WINDOWS\system32\mcroso~1.net
C:\WINDOWS\system32\mcroso~1.net\M?crosoft.NET\
C:\WINDOWS\system32\mcroso~1.net\msdtc .exe
C:\WINDOWS\system32\mcroso~1.net\msdtc.exe
C:\WINDOWS\system32\mgrwumsg.dll
C:\WINDOWS\system32\mkjfqkai.dll
C:\WINDOWS\system32\mosbfgys.ini
C:\WINDOWS\system32\mosqxcyr.ini
C:\WINDOWS\system32\nhuyvhyb.dll
C:\WINDOWS\system32\njkcwnug.dll
C:\WINDOWS\system32\nmewjiny.ini
C:\WINDOWS\system32\ntyyykfd.dll
C:\WINDOWS\system32\nwvbkmog.dll
C:\WINDOWS\system32\obvbvjph.dll
C:\WINDOWS\system32\oddcvdtq.ini
C:\WINDOWS\system32\pdtiotdr.ini
C:\WINDOWS\system32\pdvqcxlx.dll
C:\WINDOWS\system32\pihimvib.dll
C:\WINDOWS\system32\poackskp.ini
C:\WINDOWS\system32\powyqguf.dll
C:\WINDOWS\system32\prajdwll.dll
C:\WINDOWS\system32\ptylgwwi.ini
C:\WINDOWS\system32\puhlpgay.dll
C:\WINDOWS\system32\pvkesvja.dll
C:\WINDOWS\system32\pvnikard.dll
C:\WINDOWS\system32\pxbdqhdj.ini
C:\WINDOWS\system32\qbymqpvk.dll
C:\WINDOWS\system32\qjxqiyly.dll
C:\WINDOWS\system32\qpiakfpn.dll
C:\WINDOWS\system32\qrbaocsh.dll
C:\WINDOWS\system32\qtdvcddo.dll
C:\WINDOWS\system32\qvyfaunc.dll
C:\WINDOWS\system32\rcljsibe.ini
C:\WINDOWS\system32\rdgyrkep.dll
C:\WINDOWS\system32\rmifbeip.ini
C:\WINDOWS\system32\rsugnllo.ini
C:\WINDOWS\system32\rvbnlija.ini
C:\WINDOWS\system32\rxkxvjdr.dll
C:\WINDOWS\system32\rycxqsom.dll
C:\WINDOWS\system32\ryklukqe.dll
C:\WINDOWS\system32\scuhiedt.dll
C:\WINDOWS\system32\sghjnvfj.ini
C:\WINDOWS\system32\tdhclkyj.ini
C:\WINDOWS\system32\tejxdnrl.dll
C:\WINDOWS\system32\tkmyieuw.dll
C:\WINDOWS\system32\tlidhuhv.ini
C:\WINDOWS\system32\tlnalspi.dll
C:\WINDOWS\system32\tpjkhhqj.dll
C:\WINDOWS\system32\trrfkwbv.ini
C:\WINDOWS\system32\ttcqlwjh.dll
C:\WINDOWS\system32\tybwcanm.ini
C:\WINDOWS\system32\ucndcvft.ini
C:\WINDOWS\system32\ucpmcchi.ini
C:\WINDOWS\system32\ufnquloe.dll
C:\WINDOWS\system32\ukxovalo.ini
C:\WINDOWS\system32\unhjwmxy.dll
C:\WINDOWS\system32\utxhvtcb.dll
C:\WINDOWS\system32\vbwkfrrt.dll
C:\WINDOWS\system32\vgqhknva.dll
C:\WINDOWS\system32\vkmlystu.ini
C:\WINDOWS\system32\vvpqrbof.dll
C:\WINDOWS\system32\wayqhjdr.ini
C:\WINDOWS\system32\wdbvsvpo.ini
C:\WINDOWS\system32\whrrfuue.ini
C:\WINDOWS\system32\wljjfbuj.dll
C:\WINDOWS\system32\wmmtwmay.dll
C:\WINDOWS\system32\wyshpfkx.ini
C:\WINDOWS\system32\xeseqywq.ini
C:\WINDOWS\system32\xxjtrhup.dll
C:\WINDOWS\system32\xyyntyse.ini
C:\WINDOWS\uxvhl.dat
C:\WINDOWS\yhjpf.dat

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
——-\LEGACY_CMDSERVICE
——-\LEGACY_DOMAINSERVICE
——-\LEGACY_NETWORK_MONITOR
——-\LEGACY_NTNDIS
——-\cmdService

((((((((((((((((((((((((( Files Created from 2008-01-28 to 2008-02-28 )))))))))))))))))))))))))))))))
.

2008-02-26 20:34 . 2008-02-26 20:34 d——– C:\WINDOWS\ERUNT
2008-02-26 19:22 . 2008-02-26 21:07 d——– C:\SDFix
2008-02-14 20:11 . 2008-02-26 21:12 67,102 –a—— C:\WINDOWS\BMe3b620a4.xml
2008-02-14 20:11 . 2008-02-26 21:25 21 –a—— C:\WINDOWS\pskt.ini
2008-02-14 09:15 . 2008-02-14 09:15 18,214,008 –a—— C:\WINDOWS\system32\MRT .exe
2008-02-12 20:35 . 2008-02-12 20:36 d——– C:\Documents and Settings\Sean\Application Data\AdwareAlert
2008-02-12 19:29 . 2008-02-12 19:29 3,584 –a—— C:\WINDOWS\system32\vturq.exe
2008-02-10 12:39 . 2008-02-10 12:39 d——– C:\Program Files\Common Files\HP
2008-02-10 12:29 . 2008-02-10 12:30 691 –a—— C:\WINDOWS\hpntwksetup.ini
2008-02-10 12:24 . 2008-02-10 13:01 89,277 –a—— C:\WINDOWS\hpoins06.dat
2008-02-10 12:24 . 2005-06-02 19:31 5,389 ——— C:\WINDOWS\hpomdl06.dat
2008-02-09 13:44 . 2008-02-09 13:44 d——– C:\Documents and Settings\LocalService\Application Data\Avanquest
2008-02-09 13:43 . 2008-02-09 13:43 d——– C:\Documents and Settings\All Users\Application Data\BVRP Software
2008-02-09 13:42 . 2008-02-09 13:42 dr-hs—- C:\_Backup.RC
2008-02-09 13:42 . 2008-02-09 14:35 d–h—– C:\_Backup
2008-02-09 13:39 . 2008-02-09 13:39 d——– C:\Documents and Settings\Sean\Application Data\Avanquest
2008-02-09 13:38 . 2008-02-09 13:38 d——– C:\Program Files\Avanquest
2008-02-09 13:33 . 2008-02-09 13:33 d——– C:\Program Files\Common Files\Wise Installation Wizard
2008-02-05 08:19 . 2008-02-05 08:19 90,688 –a—— C:\WINDOWS\system32\piebfimr.dll
2008-02-02 11:07 . 2008-02-09 20:23 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-02-02 11:07 . 2008-02-02 11:07 1,409 –a—— C:\WINDOWS\QTFont.for

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-10 20:39 ——— d—–w C:\Program Files\HP
2008-02-10 19:33 ——— d—–w C:\Program Files\iTunes
2008-02-10 04:20 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-02-10 04:18 ——— d—–w C:\Program Files\Common Files\Real
2008-02-10 04:11 ——— d—–w C:\Program Files\Common Files\Adobe
2008-02-09 21:26 ——— d—–w C:\Program Files\Mozilla Thunderbird
2008-02-09 21:24 ——— d—–w C:\Program Files\Microsoft MapPoint
2008-02-09 17:41 ——— d—–w C:\Program Files\MoviePod
2008-02-01 04:07 ——— d—–w C:\Program Files\EA GAMES
2008-01-16 03:31 ——— d—–w C:\Program Files\Microsoft Silverlight
2008-01-08 21:44 ——— d—–w C:\Program Files\Apple Software Update
2008-01-08 21:44 ——— d—–w C:\Documents and Settings\All Users\Application Data\Apple
2008-01-08 20:57 ——— d—–w C:\Program Files\Spybot - Search & Destroy
2008-01-01 16:40 ——— d—–w C:\Program Files\MySpace
2006-12-03 00:26 8 —-a-w C:\Documents and Settings\Sean\Application Data\usb.dat.bin
2000-01-02 20:22 310 —-a-w C:\Program Files\The Oregon Trail CD-ROM.lnk
2005-11-12 14:57 303 –sha-w C:\WINDOWS\system32\edeeg.ini2
2005-10-20 00:07 28,173 –sha-w C:\WINDOWS\system32\mllmj.dll
2005-09-11 14:56 176,478 –sha-w C:\WINDOWS\system32\qqtss.bak1
2005-12-10 14:56 446,998 –sh–w C:\WINDOWS\system32\rtutv.bak1
2005-12-10 16:05 447,325 –sh–w C:\WINDOWS\system32\rtutv.ini2
2005-07-30 00:24 472 –sha-r C:\WINDOWS\UG93ZXIgVXNlcg\o36atrK0prh5w0.vbs
.

—-a-w		   173,312 2008-02-09 22:49:57  C:\Program Files\Avanquest\SystemSuite\MemCheck .exe
—-a-w			49,152 2008-02-25 21:45:50  C:\Program Files\HP\HP Software Update\HPWuSchd2 .exe
—-a-w		   256,576 2008-02-09 22:49:54  C:\Program Files\iTunes\iTunesHelper .exe
—-a-w		 1,694,208 2008-02-07 16:36:08  C:\Program Files\Messenger\msmsgs .exe
—-a-w		   282,624 2008-02-10 19:36:13  C:\Program Files\QuickTime\bak\bak\qttask												   .exe
—-a-w		   282,624 2008-02-10 19:36:16  C:\Program Files\QuickTime\bak\bak\qttask												  .exe
—-a-w		   282,624 2008-02-10 19:36:17  C:\Program Files\QuickTime\bak\bak\qttask												 .exe
—-a-w		   282,624 2008-02-10 19:36:20  C:\Program Files\QuickTime\bak\bak\qttask												.exe
—-a-w		   282,624 2008-02-10 19:36:22  C:\Program Files\QuickTime\bak\bak\qttask											   .exe
—-a-w		   282,624 2008-02-10 19:36:26  C:\Program Files\QuickTime\bak\bak\qttask											  .exe
—-a-w		   282,624 2008-02-10 19:36:30  C:\Program Files\QuickTime\bak\bak\qttask											 .exe
—-a-w		   282,624 2008-02-10 19:36:33  C:\Program Files\QuickTime\bak\bak\qttask											.exe
—-a-w		   282,624 2008-02-10 19:36:35  C:\Program Files\QuickTime\bak\bak\qttask										   .exe
—-a-w		   282,624 2008-02-10 19:36:39  C:\Program Files\QuickTime\bak\bak\qttask										  .exe
—-a-w		   282,624 2008-02-10 19:36:41  C:\Program Files\QuickTime\bak\bak\qttask										 .exe
—-a-w		   282,624 2008-02-10 19:36:44  C:\Program Files\QuickTime\bak\bak\qttask										.exe
—-a-w		   282,624 2008-02-10 19:36:46  C:\Program Files\QuickTime\bak\bak\qttask									   .exe
—-a-w		   282,624 2008-02-10 19:36:50  C:\Program Files\QuickTime\bak\bak\qttask									  .exe
—-a-w		   282,624 2008-02-10 19:36:53  C:\Program Files\QuickTime\bak\bak\qttask									 .exe
—-a-w		   282,624 2008-02-10 19:36:55  C:\Program Files\QuickTime\bak\bak\qttask									.exe
—-a-w		   282,624 2008-02-10 19:36:58  C:\Program Files\QuickTime\bak\bak\qttask								   .exe
—-a-w		   282,624 2008-02-10 19:37:01  C:\Program Files\QuickTime\bak\bak\qttask								  .exe
—-a-w		   282,624 2008-02-10 19:37:03  C:\Program Files\QuickTime\bak\bak\qttask								 .exe
—-a-w		   282,624 2008-02-10 19:37:07  C:\Program Files\QuickTime\bak\bak\qttask								.exe
—-a-w		   282,624 2008-02-10 19:37:09  C:\Program Files\QuickTime\bak\bak\qttask							   .exe
—-a-w		   282,624 2008-02-10 19:37:12  C:\Program Files\QuickTime\bak\bak\qttask							  .exe
—-a-w		   282,624 2008-02-10 19:37:15  C:\Program Files\QuickTime\bak\bak\qttask							 .exe
—-a-w		   282,624 2008-02-10 19:37:18  C:\Program Files\QuickTime\bak\bak\qttask							.exe
—-a-w		   282,624 2008-02-10 19:37:20  C:\Program Files\QuickTime\bak\bak\qttask						   .exe
—-a-w		   282,624 2008-02-10 19:37:23  C:\Program Files\QuickTime\bak\bak\qttask						  .exe
—-a-w		   282,624 2008-02-10 19:37:27  C:\Program Files\QuickTime\bak\bak\qttask						 .exe
—-a-w		   282,624 2008-02-10 19:37:29  C:\Program Files\QuickTime\bak\bak\qttask						.exe
—-a-w		   282,624 2008-02-10 19:37:33  C:\Program Files\QuickTime\bak\bak\qttask					   .exe
—-a-w		   282,624 2008-02-10 19:37:36  C:\Program Files\QuickTime\bak\bak\qttask					  .exe
—-a-w		   282,624 2008-02-10 19:37:39  C:\Program Files\QuickTime\bak\bak\qttask					 .exe
—-a-w		   282,624 2008-02-10 19:37:41  C:\Program Files\QuickTime\bak\bak\qttask					.exe
—-a-w		   282,624 2008-02-10 19:37:44  C:\Program Files\QuickTime\bak\bak\qttask				   .exe
—-a-w		   282,624 2008-02-10 19:37:47  C:\Program Files\QuickTime\bak\bak\qttask				  .exe
—-a-w		   282,624 2008-02-10 19:37:51  C:\Program Files\QuickTime\bak\bak\qttask				 .exe
—-a-w		   282,624 2008-02-10 19:37:53  C:\Program Files\QuickTime\bak\bak\qttask				.exe
—-a-w		   282,624 2008-02-10 19:37:56  C:\Program Files\QuickTime\bak\bak\qttask			   .exe
—-a-w		   282,624 2008-02-10 19:37:59  C:\Program Files\QuickTime\bak\bak\qttask			  .exe
—-a-w		   282,624 2008-02-10 19:38:02  C:\Program Files\QuickTime\bak\bak\qttask			 .exe
—-a-w		   282,624 2008-02-10 19:38:05  C:\Program Files\QuickTime\bak\bak\qttask			.exe
—-a-w		   282,624 2008-02-10 19:38:08  C:\Program Files\QuickTime\bak\bak\qttask		   .exe
—-a-w		   282,624 2008-02-10 19:38:11  C:\Program Files\QuickTime\bak\bak\qttask		  .exe
—-a-w		   282,624 2008-02-10 19:38:15  C:\Program Files\QuickTime\bak\bak\qttask		 .exe
—-a-w		   282,624 2008-02-10 19:38:17  C:\Program Files\QuickTime\bak\bak\qttask		.exe
—-a-w		   282,624 2008-02-10 19:38:20  C:\Program Files\QuickTime\bak\bak\qttask	   .exe
—-a-w		   282,624 2008-02-10 19:38:23  C:\Program Files\QuickTime\bak\bak\qttask	  .exe
—-a-w		   282,624 2008-02-10 19:38:25  C:\Program Files\QuickTime\bak\bak\qttask	 .exe
—-a-w		   282,624 2008-02-10 19:38:28  C:\Program Files\QuickTime\bak\bak\qttask	.exe
—-a-w		   282,624 2008-02-10 19:38:31  C:\Program Files\QuickTime\bak\bak\qttask   .exe
—-a-w		   282,624 2008-02-10 19:38:33  C:\Program Files\QuickTime\bak\bak\qttask  .exe
—-a-w		   282,624 2008-02-10 19:38:36  C:\Program Files\QuickTime\bak\bak\qttask .exe
—-a-w			15,360 2008-02-27 04:30:03  C:\WINDOWS\system32\ctfmon .exe
—-a-w		18,214,008 2008-02-14 17:15:47  C:\WINDOWS\system32\MRT .exe

– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
—-a-w 180,269 2004-09-26 02:46:34 C:\Program Files\Common Files\Real\Update_OB\bak\realsched.exe

—-a-w 68,856 2007-06-30 15:09:05 C:\Program Files\Google\GoogleToolbarNotifier\bak\GoogleToolbarNotifier.exe

—-a-w 49,152 2005-05-12 07:12:54 C:\Program Files\HP\HP Software Update\bak\HPWuSchd2.exe
—-a-w 49,152 2005-05-12 07:12:54 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe

—-a-w 256,576 2006-10-30 17:36:36 C:\Program Files\iTunes\bak\iTunesHelper.exe
—-a-w 256,576 2008-02-10 19:33:55 C:\Program Files\iTunes\iTunesHelper.exe

—-a-w 36,975 2005-11-10 21:03:52 C:\Program Files\Java\jre1.5.0_06\bin\bak\jusched.exe

—-a-w 389,120 2006-04-03 04:07:44 C:\Program Files\Linksys EasyLink Advisor\bak\LinksysAgent.exe

—-a-w 28,176 2007-10-03 01:09:51 C:\Program Files\QuickTime\bak\qttask.exe
—-a-w 24,080 2007-07-17 02:08:31 C:\Program Files\QuickTime\qttask.exe

—-a-w 282,624 2008-02-10 19:36:13 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:36:16 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:36:17 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:36:20 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:36:22 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:36:26 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:36:30 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:36:33 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:36:35 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:36:39 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:36:41 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:36:44 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:36:46 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:36:50 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:36:53 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:36:55 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:36:58 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:37:01 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:37:03 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:37:07 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:37:09 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:37:12 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:37:15 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:37:18 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:37:20 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:37:23 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:37:27 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:37:29 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:37:33 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:37:36 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:37:39 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:37:41 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:37:44 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:37:47 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:37:51 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:37:53 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:37:56 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:37:59 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:38:02 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:38:05 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:38:08 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:38:11 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:38:15 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:38:17 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:38:20 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:38:23 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:38:25 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:38:28 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:38:31 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:38:33 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:38:36 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:38:39 C:\Program Files\QuickTime\bak\bak\qttask.exe
—-a-w 24,080 2007-07-17 02:08:31 C:\Program Files\QuickTime\qttask.exe

—-a-w 282,624 2008-02-10 19:36:13 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:36:16 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:36:17 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:36:20 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:36:22 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:36:26 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:36:30 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:36:33 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:36:35 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:36:39 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:36:41 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:36:44 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:36:46 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:36:50 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:36:53 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:36:55 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:36:58 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:37:01 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:37:03 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:37:07 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:37:09 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:37:12 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:37:15 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:37:18 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:37:20 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:37:23 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:37:27 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:37:29 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:37:33 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:37:36 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:37:39 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:37:41 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:37:44 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:37:47 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:37:51 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:37:53 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:37:56 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:37:59 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:38:02 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:38:05 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:38:08 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:38:11 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:38:15 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:38:17 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:38:20 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:38:23 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:38:25 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:38:28 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:38:31 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:38:33 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:38:36 C:\Program Files\QuickTime\bak\bak\qttask .exe

—-a-w 282,624 2008-02-10 19:38:39 C:\Program Files\QuickTime\bak\bak\qttask.exe
—-a-w 28,176 2007-10-03 01:09:51 C:\Program Files\QuickTime\bak\qttask.exe

—-a-w 15,360 2004-08-04 07:56:48 C:\WINDOWS\system32\bak\ctfmon.exe
—-a-w 15,360 2004-08-04 07:56:48 C:\WINDOWS\system32\ctfmon.exe

—-a-w 77,824 2005-09-20 18:32:24 C:\WINDOWS\system32\bak\hkcmd.exe

—-a-w 114,688 2005-09-20 18:36:20 C:\WINDOWS\system32\bak\igfxpers.exe

—-a-w 94,208 2005-09-20 18:35:40 C:\WINDOWS\system32\bak\igfxtray.exe

—-a-w 155,648 2001-07-09 19:50:42 C:\WINDOWS\system32\bak\NeroCheck.exe

.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:56 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 23:12 49152]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 03:44:06 29696]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-11 23:23:26 282624]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Internet Explorer\\iexplore.exe"=
"C:\\Program Files\\backburner 2\\manager.exe"=
"C:\\Program Files\\backburner 2\\server.exe"=
"C:\\WINDOWS\\system32\\spoolsv.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"D:\\setup\\HPZnet01.exe"=
"D:\\setup\\HPONICIFS01.EXE"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=

S3 Dmistam;Dmistam;C:\WINDOWS\system32\drivers\irenum.sys [2004-08-03 22:00]
S3 KFilter;KFilter;C:\PROGRA~1\AVANQU~1\SYSTEM~1\KFilter.sys [2007-09-05 08:54]
S3 MailScan;MailScan;C:\PROGRA~1\AVANQU~1\SYSTEM~1\MailScan.sys [2007-09-11 00:32]
S3 usbprint;Microsoft USB PRINTER Class;C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 22:01]

.
Contents of the 'Scheduled Tasks' folder
"2008-02-17 11:00:00 C:\WINDOWS\Tasks\AdwareAlert Scheduled Scan.job"
- C:\Program Files\AdwareAlert\AdwareAlert.ex
- C:\Program Files\AdwareAlert
"2008-02-23 20:53:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-27 17:29:55
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\HPZipm12.exe
C:\PROGRA~1\AVANQU~1\SYSTEM~1\MXTask.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\PROGRA~1\AVANQU~1\SYSTEM~1\mxtask.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\HPZinw12.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
.
**************************************************************************
.
Completion time: 2008-02-27 17:34:07 - machine was rebooted [Sean]
ComboFix-quarantined-files.txt 2008-02-28 01:34:04
.
2008-02-13 04:16:21 — E O F —

IndiGenus

Post #7February 28, 2008, 2:57 AM UTC

1. Please open Notepad

Click Start , then Run
Type notepad.exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

RenV:
C:\Program Files\Avanquest\SystemSuite\MemCheck .exe
C:\Program Files\HP\HP Software Update\HPWuSchd2 .exe
C:\Program Files\iTunes\iTunesHelper .exe
C:\Program Files\Messenger\msmsgs .exe
C:\Program Files\QuickTime\bak\bak\qttask												   .exe
C:\Program Files\QuickTime\bak\bak\qttask												  .exe
C:\Program Files\QuickTime\bak\bak\qttask												 .exe
C:\Program Files\QuickTime\bak\bak\qttask												.exe
C:\Program Files\QuickTime\bak\bak\qttask											   .exe
C:\Program Files\QuickTime\bak\bak\qttask											  .exe
C:\Program Files\QuickTime\bak\bak\qttask											 .exe
C:\Program Files\QuickTime\bak\bak\qttask											.exe
C:\Program Files\QuickTime\bak\bak\qttask										   .exe
C:\Program Files\QuickTime\bak\bak\qttask										  .exe
C:\Program Files\QuickTime\bak\bak\qttask										 .exe
C:\Program Files\QuickTime\bak\bak\qttask										.exe
C:\Program Files\QuickTime\bak\bak\qttask									   .exe
C:\Program Files\QuickTime\bak\bak\qttask									  .exe
C:\Program Files\QuickTime\bak\bak\qttask									 .exe
C:\Program Files\QuickTime\bak\bak\qttask									.exe
C:\Program Files\QuickTime\bak\bak\qttask								   .exe
C:\Program Files\QuickTime\bak\bak\qttask								  .exe
C:\Program Files\QuickTime\bak\bak\qttask								 .exe
C:\Program Files\QuickTime\bak\bak\qttask								.exe
C:\Program Files\QuickTime\bak\bak\qttask							   .exe
C:\Program Files\QuickTime\bak\bak\qttask							  .exe
C:\Program Files\QuickTime\bak\bak\qttask							 .exe
C:\Program Files\QuickTime\bak\bak\qttask							.exe
C:\Program Files\QuickTime\bak\bak\qttask						   .exe
C:\Program Files\QuickTime\bak\bak\qttask						  .exe
C:\Program Files\QuickTime\bak\bak\qttask						 .exe
C:\Program Files\QuickTime\bak\bak\qttask						.exe
C:\Program Files\QuickTime\bak\bak\qttask					   .exe
C:\Program Files\QuickTime\bak\bak\qttask					  .exe
C:\Program Files\QuickTime\bak\bak\qttask					 .exe
C:\Program Files\QuickTime\bak\bak\qttask					.exe
C:\Program Files\QuickTime\bak\bak\qttask				   .exe
C:\Program Files\QuickTime\bak\bak\qttask				  .exe
C:\Program Files\QuickTime\bak\bak\qttask				 .exe
C:\Program Files\QuickTime\bak\bak\qttask				.exe
C:\Program Files\QuickTime\bak\bak\qttask			   .exe
C:\Program Files\QuickTime\bak\bak\qttask			  .exe
C:\Program Files\QuickTime\bak\bak\qttask			 .exe
C:\Program Files\QuickTime\bak\bak\qttask			.exe
C:\Program Files\QuickTime\bak\bak\qttask		   .exe
C:\Program Files\QuickTime\bak\bak\qttask		  .exe
C:\Program Files\QuickTime\bak\bak\qttask		 .exe
C:\Program Files\QuickTime\bak\bak\qttask		.exe
C:\Program Files\QuickTime\bak\bak\qttask	   .exe
C:\Program Files\QuickTime\bak\bak\qttask	  .exe
C:\Program Files\QuickTime\bak\bak\qttask	 .exe
C:\Program Files\QuickTime\bak\bak\qttask	.exe
C:\Program Files\QuickTime\bak\bak\qttask   .exe
C:\Program Files\QuickTime\bak\bak\qttask  .exe
C:\Program Files\QuickTime\bak\bak\qttask .exe
C:\WINDOWS\system32\ctfmon .exe
C:\WINDOWS\system32\MRT .exe

File::
C:\WINDOWS\BMe3b620a4.xml
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\vturq.exe
C:\WINDOWS\system32\edeeg.ini2
C:\WINDOWS\system32\mllmj.dll
C:\WINDOWS\system32\qqtss.bak1
C:\WINDOWS\system32\rtutv.bak1
C:\WINDOWS\system32\rtutv.ini2

3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

[external image: Posted Image]

5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

Combofix.txt
A new HijackThis log.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Also, please run this tool.

Download FindAWF:

Save the file to the Desktop
Double-click the FindAWF icon.

If a Security Alert shows, allow the program to run.
As instructed, press any key to continue.
Use the following option: Press 1 then Enter to scan for bak folders
The scan may take a while, please be patient.

When done, a text file, Find AWF report is produced that we need to look at.
Please post it in your reply.

doe-head

Post #8February 28, 2008, 5:25 AM UTC

Here is the latest combofix log
ComboFix 08-02-25.3 - Sean 2008-02-27 21:15:00.5 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.164 [GMT -8:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Sean\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\WINDOWS\BMe3b620a4.xml
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\edeeg.ini2
C:\WINDOWS\system32\mllmj.dll
C:\WINDOWS\system32\qqtss.bak1
C:\WINDOWS\system32\rtutv.bak1
C:\WINDOWS\system32\rtutv.ini2
C:\WINDOWS\system32\vturq.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\BMe3b620a4.xml
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\edeeg.ini2
C:\WINDOWS\system32\mllmj.dll
C:\WINDOWS\system32\qqtss.bak1
C:\WINDOWS\system32\rtutv.bak1
C:\WINDOWS\system32\rtutv.ini2
C:\WINDOWS\system32\vturq.exe

.
((((((((((((((((((((((((( Files Created from 2008-01-28 to 2008-02-28 )))))))))))))))))))))))))))))))
.

2008-02-26 20:34 . 2008-02-26 20:34 d——– C:\WINDOWS\ERUNT
2008-02-26 19:22 . 2008-02-26 21:07 d——– C:\SDFix
2008-02-12 20:35 . 2008-02-12 20:36 d——– C:\Documents and Settings\Sean\Application Data\AdwareAlert
2008-02-10 12:39 . 2008-02-10 12:39 d——– C:\Program Files\Common Files\HP
2008-02-10 12:29 . 2008-02-10 12:30 691 –a—— C:\WINDOWS\hpntwksetup.ini
2008-02-10 12:24 . 2008-02-10 13:01 89,277 –a—— C:\WINDOWS\hpoins06.dat
2008-02-10 12:24 . 2005-06-02 19:31 5,389 ——— C:\WINDOWS\hpomdl06.dat
2008-02-09 13:44 . 2008-02-09 13:44 d——– C:\Documents and Settings\LocalService\Application Data\Avanquest
2008-02-09 13:43 . 2008-02-09 13:43 d——– C:\Documents and Settings\All Users\Application Data\BVRP Software
2008-02-09 13:42 . 2008-02-09 13:42 dr-hs—- C:\_Backup.RC
2008-02-09 13:42 . 2008-02-27 18:01 d–h—– C:\_Backup
2008-02-09 13:39 . 2008-02-09 13:39 d——– C:\Documents and Settings\Sean\Application Data\Avanquest
2008-02-09 13:38 . 2008-02-09 13:38 d——– C:\Program Files\Avanquest
2008-02-09 13:33 . 2008-02-09 13:33 d——– C:\Program Files\Common Files\Wise Installation Wizard
2008-02-05 08:19 . 2008-02-05 08:19 90,688 –a—— C:\WINDOWS\system32\piebfimr.dll
2008-02-02 11:07 . 2008-02-09 20:23 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-02-02 11:07 . 2008-02-02 11:07 1,409 –a—— C:\WINDOWS\QTFont.for

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-28 05:13 ——— d—–w C:\Program Files\iTunes
2008-02-28 02:11 ——— d—–w C:\Program Files\Ahead
2008-02-28 02:10 ——— d—–w C:\Program Files\Common Files\Adobe
2008-02-28 01:53 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-02-10 20:39 ——— d—–w C:\Program Files\HP
2008-02-10 04:18 ——— d—–w C:\Program Files\Common Files\Real
2008-02-09 21:26 ——— d—–w C:\Program Files\Mozilla Thunderbird
2008-02-09 21:24 ——— d—–w C:\Program Files\Microsoft MapPoint
2008-02-09 17:41 ——— d—–w C:\Program Files\MoviePod
2008-02-01 04:07 ——— d—–w C:\Program Files\EA GAMES
2008-01-16 03:31 ——— d—–w C:\Program Files\Microsoft Silverlight
2008-01-08 21:44 ——— d—–w C:\Program Files\Apple Software Update
2008-01-08 21:44 ——— d—–w C:\Documents and Settings\All Users\Application Data\Apple
2008-01-08 20:57 ——— d—–w C:\Program Files\Spybot - Search & Destroy
2008-01-01 16:40 ——— d—–w C:\Program Files\MySpace
2006-12-03 00:26 8 —-a-w C:\Documents and Settings\Sean\Application Data\usb.dat.bin
2000-01-02 20:22 310 —-a-w C:\Program Files\The Oregon Trail CD-ROM.lnk
2005-07-30 00:24 472 –sha-r C:\WINDOWS\UG93ZXIgVXNlcg\o36atrK0prh5w0.vbs
.

((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
—-a-w 180,269 2004-09-26 02:46:34 C:\Program Files\Common Files\Real\Update_OB\bak\realsched.exe

—-a-w 68,856 2007-06-30 15:09:05 C:\Program Files\Google\GoogleToolbarNotifier\bak\GoogleToolbarNotifier.exe

—-a-w 49,152 2005-05-12 07:12:54 C:\Program Files\HP\HP Software Update\bak\HPWuSchd2.exe
—-a-w 49,152 2008-02-25 21:45:50 C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

—-a-w 256,576 2006-10-30 17:36:36 C:\Program Files\iTunes\bak\iTunesHelper.exe
—-a-w 256,576 2008-02-09 22:49:54 C:\Program Files\iTunes\iTunesHelper.exe

—-a-w 36,975 2005-11-10 21:03:52 C:\Program Files\Java\jre1.5.0_06\bin\bak\jusched.exe

—-a-w 389,120 2006-04-03 04:07:44 C:\Program Files\Linksys EasyLink Advisor\bak\LinksysAgent.exe

—-a-w 28,176 2007-10-03 01:09:51 C:\Program Files\QuickTime\bak\qttask.exe
—-a-w 24,080 2007-07-17 02:08:31 C:\Program Files\QuickTime\qttask.exe

—-a-w 282,624 2008-02-10 19:38:36 C:\Program Files\QuickTime\bak\bak\qttask.exe
—-a-w 24,080 2007-07-17 02:08:31 C:\Program Files\QuickTime\qttask.exe

—-a-w 282,624 2008-02-10 19:38:36 C:\Program Files\QuickTime\bak\bak\qttask.exe
—-a-w 28,176 2007-10-03 01:09:51 C:\Program Files\QuickTime\bak\qttask.exe

—-a-w 15,360 2004-08-04 07:56:48 C:\WINDOWS\system32\bak\ctfmon.exe
—-a-w 15,360 2004-08-04 07:56:48 C:\WINDOWS\system32\ctfmon.exe

—-a-w 77,824 2005-09-20 18:32:24 C:\WINDOWS\system32\bak\hkcmd.exe

—-a-w 114,688 2005-09-20 18:36:20 C:\WINDOWS\system32\bak\igfxpers.exe

—-a-w 94,208 2005-09-20 18:35:40 C:\WINDOWS\system32\bak\igfxtray.exe

—-a-w 155,648 2001-07-09 19:50:42 C:\WINDOWS\system32\bak\NeroCheck.exe

.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:56 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2008-02-25 13:45 49152]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-11 23:23:26 282624]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Internet Explorer\\iexplore.exe"=
"C:\\Program Files\\backburner 2\\manager.exe"=
"C:\\Program Files\\backburner 2\\server.exe"=
"C:\\WINDOWS\\system32\\spoolsv.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=

S3 Dmistam;Dmistam;C:\WINDOWS\system32\drivers\irenum.sys [2004-08-03 22:00]
S3 KFilter;KFilter;C:\PROGRA~1\AVANQU~1\SYSTEM~1\KFilter.sys [2007-09-05 08:54]
S3 MailScan;MailScan;C:\PROGRA~1\AVANQU~1\SYSTEM~1\MailScan.sys [2007-09-11 00:32]
S3 usbprint;Microsoft USB PRINTER Class;C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 22:01]

.
Contents of the 'Scheduled Tasks' folder
"2008-02-17 11:00:00 C:\WINDOWS\Tasks\AdwareAlert Scheduled Scan.job"
- C:\Program Files\AdwareAlert\AdwareAlert.exe
- C:\Program Files\AdwareAlert
"2008-02-23 20:53:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-27 21:19:03
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\HPZipm12.exe
C:\PROGRA~1\AVANQU~1\SYSTEM~1\MXTask.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\PROGRA~1\AVANQU~1\SYSTEM~1\mxtask.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\HPZinw12.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
.
**************************************************************************
.
Completion time: 2008-02-27 21:23:26 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-28 05:23:22
ComboFix2.txt 2008-02-28 01:34:08
.
2008-02-13 04:16:21 — E O F —

doe-head

Post #9February 28, 2008, 5:28 AM UTC

Here is the HJT Log
Logfile of HijackThis v1.99.1
Scan saved at 9:27:22 PM, on 2/27/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\AVANQU~1\SYSTEM~1\MXTask.exe
C:\PROGRA~1\AVANQU~1\SYSTEM~1\mxtask.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\HPZinw12.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Documents and Settings\Sean\Desktop\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://news.google.com/nwshp?hl=en&gl=us
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\Avanquest\SystemSuite\LinkScannerIE.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O10 - Unknown file in Winsock LSP: c:\progra~1\avanqu~1\system~1\ufilter.dll
O10 - Unknown file in Winsock LSP: c:\progra~1\avanqu~1\system~1\ufilter.dll
O10 - Unknown file in Winsock LSP: c:\progra~1\avanqu~1\system~1\ufilter.dll
O10 - Unknown file in Winsock LSP: c:\progra~1\avanqu~1\system~1\ufilter.dll
O15 - Trusted Zone: *.doginhispen.com
O15 - Trusted Zone: *.whataboutarabit.com
O16 - DPF: {127CE7BA-AD89-4108-A913-C52EFC037C36} -
O16 - DPF: {2776DDE9-D4B2-4BF7-9F98-ADC1A1B80AF5} -
O16 - DPF: {90051A81-3018-4826-8B38-DD60B6B53F9C} (Snapfish File Upload ActiveX Control) - http://www.costcophotocenter.com/CostcoUpload.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SystemSuite Task Manager - Avanquest Software USA, Inc. - C:\PROGRA~1\AVANQU~1\SYSTEM~1\MXTask.exe

doe-head

Post #10February 28, 2008, 5:40 AM UTC

Here is the AWF Report Find AWF report by noahdfear ©2006 Version 1.40 The current date is: Wed 02/27/2008 The current time is: 21:31:03.09 bak folders found ~~~~~~~~~~~ Directory of C:\PROGRA~1\ITUNES\BAK 10/30/2006 09:36 AM 256,576 iTunesHelper.exe 1 File(s) 256,576 bytes Directory of C:\PROGRA~1\LINKSY~1\BAK 04/02/2006 08:07 PM 389,120 LinksysAgent.exe 1 File(s) 389,120 bytes Directory of C:\PROGRA~1\MESSEN~1\BAK 0 File(s) 0 bytes Directory of C:\PROGRA~1\QUICKT~1\BAK 10/02/2007 05:09 PM 28,176 qttask.exe 1 File(s) 28,176 bytes Directory of C:\WINDOWS\SYSTEM32\BAK 08/03/2004 11:56 PM 15,360 ctfmon.exe 09/20/2005 10:32 AM 77,824 hkcmd.exe 09/20/2005 10:36 AM 114,688 igfxpers.exe 09/20/2005 10:35 AM 94,208 igfxtray.exe 07/09/2001 11:50 AM 155,648 NeroCheck.exe 5 File(s) 457,728 bytes Directory of C:\PROGRA~1\GOOGLE\GOOGLE~1\BAK 06/30/2007 07:09 AM 68,856 GoogleToolbarNotifier.exe 1 File(s) 68,856 bytes Directory of C:\PROGRA~1\HP\HPSOFT~1\BAK 05/11/2005 11:12 PM 49,152 HPWuSchd2.exe 1 File(s) 49,152 bytes Directory of C:\PROGRA~1\QUICKT~1\BAK\BAK 02/10/2008 11:38 AM 282,624 qttask.exe 1 File(s) 282,624 bytes Directory of C:\PROGRA~1\COMMON~1\REAL\UPDATE~1\BAK 09/25/2004 06:46 PM 180,269 realsched.exe 1 File(s) 180,269 bytes Directory of C:\PROGRA~1\JAVA\JRE15~1.0_0\BIN\BAK 11/10/2005 01:03 PM 36,975 jusched.exe 1 File(s) 36,975 bytes Duplicate files of bak directory contents ~~~~~~~~~~~~~~~~~~~~~~~ 256576 Feb 9 2008 "C:\Program Files\iTunes\iTunesHelper.exe" 256576 Oct 30 2006 "C:\Program Files\iTunes\bak\iTunesHelper.exe" 102400 Jan 13 2008 "C:\WINDOWS\Installer\{446DBFFA-4088-48E3-8932-74316BA4CAE4}\iTunesIco.exe" 108096 Oct 30 2006 "C:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 7.0.2.16\iTunesSetupAdmin.exe" 389632 Apr 2 2006 "C:\Program Files\Linksys EasyLink Advisor\LinksysAdvisor.exe" 389120 Apr 2 2006 "C:\Program Files\Linksys EasyLink Advisor\bak\LinksysAgent.exe" 24080 Jul 16 2007 "C:\Program Files\QuickTime\qttask.exe" 28176 Oct 2 2007 "C:\Program Files\QuickTime\bak\qttask.exe" 282624 Feb 10 2008 "C:\Program Files\QuickTime\bak\bak\qttask.exe" 24080 Jul 16 2007 "C:\Program Files\QuickTime\qttask.exe" 28176 Oct 2 2007 "C:\Program Files\QuickTime\bak\qttask.exe" 282624 Feb 10 2008 "C:\Program Files\QuickTime\bak\bak\qttask.exe" 15360 Aug 3 2004 "C:\WINDOWS\system32\ctfmon.exe" 15360 Aug 3 2004 "C:\WINDOWS\system32\bak\ctfmon.exe" 77824 Sep 20 2005 "C:\WINDOWS\system32\bak\hkcmd.exe" 114688 Apr 6 2003 "C:\WINDOWS\system32\ReinstallBackups\0013\DriverFiles\hkcmd.exe" 114688 Sep 20 2005 "C:\WINDOWS\system32\bak\igfxpers.exe" 94208 Sep 20 2005 "C:\WINDOWS\system32\bak\igfxtray.exe" 155648 Apr 6 2003 "C:\WINDOWS\system32\ReinstallBackups\0013\DriverFiles\igfxtray.exe" 155648 Jul 9 2001 "C:\WINDOWS\system32\bak\NeroCheck.exe" 52272 Jan 24 2007 "C:\Program Files\Google\googletoolbar4user.exe" 138168 Jan 24 2007 "C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe" 68856 Jun 30 2007 "C:\Program Files\Google\GoogleToolbarNotifier\bak\GoogleToolbarNotifier.exe" 49152 Feb 25 2008 "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" 49152 May 11 2005 "C:\Program Files\HP\HP Software Update\bak\HPWuSchd2.exe" 24080 Jul 16 2007 "C:\Program Files\QuickTime\qttask.exe" 28176 Oct 2 2007 "C:\Program Files\QuickTime\bak\qttask.exe" 282624 Feb 10 2008 "C:\Program Files\QuickTime\bak\bak\qttask.exe" 180269 Sep 25 2004 "C:\Program Files\Common Files\Real\Update_OB\bak\realsched.exe" 36975 Nov 10 2005 "C:\Program Files\Java\jre1.5.0_06\bin\bak\jusched.exe" end of report

IndiGenus

Post #11February 28, 2008, 6:15 PM UTC

Please double-click the FindAWF icon once again.

If a Security Alert shows, allow the program to run.
As instructed, press any key to continue.
Use the following option: Press 2 then Enter to restore files from bak folders

A text file opens called: files.txt
Copy and paste the following list of files from in the code box to be restored:

"C:\Program Files\iTunes\bak\iTunesHelper.exe"
"C:\Program Files\Linksys EasyLink Advisor\bak\LinksysAgent.exe"
"C:\Program Files\QuickTime\bak\qttask.exe"
"C:\Program Files\QuickTime\bak\bak\qttask.exe"
"C:\Program Files\QuickTime\bak\qttask.exe"
"C:\Program Files\QuickTime\bak\bak\qttask.exe"
"C:\WINDOWS\system32\bak\ctfmon.exe"
"C:\WINDOWS\system32\bak\hkcmd.exe"
"C:\WINDOWS\system32\bak\igfxpers.exe"
"C:\WINDOWS\system32\bak\igfxtray.exe"
"C:\WINDOWS\system32\bak\NeroCheck.exe"
"C:\Program Files\Google\GoogleToolbarNotifier\bak\GoogleToolbarNotifier.exe"
"C:\Program Files\HP\HP Software Update\bak\HPWuSchd2.exe"
"C:\Program Files\QuickTime\bak\qttask.exe"
"C:\Program Files\QuickTime\bak\bak\qttask.exe"
"C:\Program Files\Common Files\Real\Update_OB\bak\realsched.exe"
"C:\Program Files\Java\jre1.5.0_06\bin\bak\jusched.exe"

Next, close and click Yes to save the changes.

Once files.txt is saved, FindAWF does the following:
-It attempts to terminate the process represented by each filename on the list, if running
-Deletes the rogue file from the parent folder, if present
-Copies the original file to the parent folder

When done with the above, it automatically runs a new scan and opens a new log.
Please provide the new FindAWF log in your reply.

doe-head

Post #12March 3, 2008, 2:35 AM UTC

The new AWF log Find AWF report by noahdfear ©2006 Version 1.40 Option 2 run successfully The current date is: Sun 03/02/2008 The current time is: 18:20:59.45 bak folders found ~~~~~~~~~~~ Directory of C:\PROGRA~1\ITUNES\BAK 10/30/2006 09:36 AM 256,576 iTunesHelper.exe 1 File(s) 256,576 bytes Directory of C:\PROGRA~1\LINKSY~1\BAK 04/02/2006 08:07 PM 389,120 LinksysAgent.exe 1 File(s) 389,120 bytes Directory of C:\PROGRA~1\MESSEN~1\BAK 0 File(s) 0 bytes Directory of C:\PROGRA~1\QUICKT~1\BAK 02/10/2008 11:38 AM 282,624 qttask.exe 1 File(s) 282,624 bytes Directory of C:\WINDOWS\SYSTEM32\BAK 08/03/2004 11:56 PM 15,360 ctfmon.exe 09/20/2005 10:32 AM 77,824 hkcmd.exe 09/20/2005 10:36 AM 114,688 igfxpers.exe 09/20/2005 10:35 AM 94,208 igfxtray.exe 07/09/2001 11:50 AM 155,648 NeroCheck.exe 5 File(s) 457,728 bytes Directory of C:\PROGRA~1\GOOGLE\GOOGLE~1\BAK 06/30/2007 07:09 AM 68,856 GoogleToolbarNotifier.exe 1 File(s) 68,856 bytes Directory of C:\PROGRA~1\HP\HPSOFT~1\BAK 05/11/2005 11:12 PM 49,152 HPWuSchd2.exe 1 File(s) 49,152 bytes Directory of C:\PROGRA~1\QUICKT~1\BAK\BAK 02/10/2008 11:38 AM 282,624 qttask.exe 1 File(s) 282,624 bytes Directory of C:\PROGRA~1\COMMON~1\REAL\UPDATE~1\BAK 09/25/2004 06:46 PM 180,269 realsched.exe 1 File(s) 180,269 bytes Directory of C:\PROGRA~1\JAVA\JRE15~1.0_0\BIN\BAK 11/10/2005 01:03 PM 36,975 jusched.exe 1 File(s) 36,975 bytes Duplicate files of bak directory contents ~~~~~~~~~~~~~~~~~~~~~~~ 256576 Oct 30 2006 "C:\Program Files\iTunes\iTunesHelper.exe" 256576 Oct 30 2006 "C:\Program Files\iTunes\bak\iTunesHelper.exe" 102400 Jan 13 2008 "C:\WINDOWS\Installer\{446DBFFA-4088-48E3-8932-74316BA4CAE4}\iTunesIco.exe" 108096 Oct 30 2006 "C:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 7.0.2.16\iTunesSetupAdmin.exe" 389632 Apr 2 2006 "C:\Program Files\Linksys EasyLink Advisor\LinksysAdvisor.exe" 389120 Apr 2 2006 "C:\Program Files\Linksys EasyLink Advisor\bak\LinksysAgent.exe" 282624 Feb 10 2008 "C:\Program Files\QuickTime\qttask.exe" 282624 Feb 10 2008 "C:\Program Files\QuickTime\bak\qttask.exe" 282624 Feb 10 2008 "C:\Program Files\QuickTime\bak\bak\qttask.exe" 282624 Feb 10 2008 "C:\Program Files\QuickTime\qttask.exe" 282624 Feb 10 2008 "C:\Program Files\QuickTime\bak\qttask.exe" 282624 Feb 10 2008 "C:\Program Files\QuickTime\bak\bak\qttask.exe" 15360 Aug 3 2004 "C:\WINDOWS\system32\ctfmon.exe" 15360 Aug 3 2004 "C:\WINDOWS\system32\bak\ctfmon.exe" 77824 Sep 20 2005 "C:\WINDOWS\system32\hkcmd.exe" 77824 Sep 20 2005 "C:\WINDOWS\system32\bak\hkcmd.exe" 114688 Apr 6 2003 "C:\WINDOWS\system32\ReinstallBackups\0013\DriverFiles\hkcmd.exe" 114688 Sep 20 2005 "C:\WINDOWS\system32\igfxpers.exe" 114688 Sep 20 2005 "C:\WINDOWS\system32\bak\igfxpers.exe" 94208 Sep 20 2005 "C:\WINDOWS\system32\igfxtray.exe" 94208 Sep 20 2005 "C:\WINDOWS\system32\bak\igfxtray.exe" 155648 Apr 6 2003 "C:\WINDOWS\system32\ReinstallBackups\0013\DriverFiles\igfxtray.exe" 155648 Jul 9 2001 "C:\WINDOWS\system32\NeroCheck.exe" 155648 Jul 9 2001 "C:\WINDOWS\system32\bak\NeroCheck.exe" 52272 Jan 24 2007 "C:\Program Files\Google\googletoolbar4user.exe" 68856 Jun 30 2007 "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" 138168 Jan 24 2007 "C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe" 68856 Jun 30 2007 "C:\Program Files\Google\GoogleToolbarNotifier\bak\GoogleToolbarNotifier.exe" 49152 May 11 2005 "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" 49152 May 11 2005 "C:\Program Files\HP\HP Software Update\bak\HPWuSchd2.exe" 282624 Feb 10 2008 "C:\Program Files\QuickTime\qttask.exe" 282624 Feb 10 2008 "C:\Program Files\QuickTime\bak\qttask.exe" 282624 Feb 10 2008 "C:\Program Files\QuickTime\bak\bak\qttask.exe" 180269 Sep 25 2004 "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" 180269 Sep 25 2004 "C:\Program Files\Common Files\Real\Update_OB\bak\realsched.exe" 36975 Nov 10 2005 "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" 36975 Nov 10 2005 "C:\Program Files\Java\jre1.5.0_06\bin\bak\jusched.exe" end of report Thanks Sean

IndiGenus

Post #13March 3, 2008, 3:09 AM UTC

Please double-click the FindAWF icon once again
This time we are going to remove some folders.

If a Security Alert shows, allow the program to run.
As instructed, press any key to continue.
Use the following option: Press 3 then Enter to remove bak folders

A text file opens called: folders.txt
Click below the line and paste the following list of folders in the code box to be removed:

C:\Program Files\iTunes\bak
C:\Program Files\Linksys EasyLink Advisor\bak
C:\Program Files\QuickTime\bak
C:\Program Files\QuickTime\bak
C:\WINDOWS\system32\bak
C:\Program Files\Google\GoogleToolbarNotifier\bak
C:\Program Files\HP\HP Software Update\bak
C:\Program Files\Common Files\Real\Update_OB\bak
C:\Program Files\Java\jre1.5.0_06\bin\bak

Next, close and click Yes to save the changes.

When done with the above, FindAWF automatically runs a new scan and opens a new log that you need to post.
Please provide the new FindAWF log in your reply.

doe-head

Post #14March 3, 2008, 3:23 AM UTC

Mew AWF log Find AWF report by noahdfear ©2006 Version 1.40 Option 3 run successfully The current date is: Sun 03/02/2008 The current time is: 19:17:46.29 bak folders found ~~~~~~~~~~~ Directory of C:\PROGRA~1\MESSEN~1\BAK 0 File(s) 0 bytes Directory of C:\PROGRA~1\QUICKT~1\BAK 0 File(s) 0 bytes Directory of C:\PROGRA~1\QUICKT~1\BAK\BAK 02/10/2008 11:38 AM 282,624 qttask.exe 1 File(s) 282,624 bytes Duplicate files of bak directory contents ~~~~~~~~~~~~~~~~~~~~~~~ 282624 Feb 10 2008 "C:\Program Files\QuickTime\qttask.exe" 282624 Feb 10 2008 "C:\Program Files\QuickTime\bak\bak\qttask.exe" 282624 Feb 10 2008 "C:\Program Files\QuickTime\qttask.exe" 282624 Feb 10 2008 "C:\Program Files\QuickTime\bak\bak\qttask.exe" end of report

IndiGenus

Post #15March 3, 2008, 3:37 AM UTC

Hi,

This one is a little strange with the double bak folders. You may need to re-install quicktime if it's not working properly.

Run the option 3 again with the following:

C:\Program Files\QuickTime\bak\bak
C:\Program Files\QuickTime\bak\bak\

Post the resulting log.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] PE_TRATS.A andADW_VIRTUMONDO.H

✨ Ask AI

Ask AI