Spyware / Malware / Virus Removal

[Resolved] Windows/system32/Vtutt.exe start-up problem

7 min read

Looking for the outcome? Ask AI

helpdesktech Topic Starter

Post #1March 14, 2008, 11:52 PM UTC

I do believe I have received a trojan and do not know enough to remove this one, please help. When I start windows I get the C:/Windows/system32/vtutt.exe error that says It can't be found and should be deleted.

IndiGenus

Post #2March 17, 2008, 12:55 AM UTC

Hi and welcome to the forums.

We need a HijackThis log to analyze your issue. Please read through and follow the instructions in the "Welcome New Members" post here.

http://forums.whatthetech.com/Welcome_New_…ers_t34502.html

Then post your HijackThis log back here.

IndiGenus

Post #3March 19, 2008, 9:16 PM UTC

Hi, Still need help here? Please let me know. Thanks, Dave

helpdesktech

Post #4March 20, 2008, 12:24 AM UTC last edited March 20, 2008, 12:30 AM UTC

Dear Dave,

Thank you very much for your patience, I appreciate all that you gentleman and women do at WhattheTech.com and realize you work on a volunteer basis. The computer with this problem is actualy an off site computer and I was not able to get to the hijackthis log file immediatley. But with no further delay : My Hijack this file… :

Logfile of HijackThis v1.99.1
Scan saved at 8:23:35 PM, on 3/19/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\PROGRA~1\Grisoft\AVG7\avgw.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.myspace.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us
R3 - URLSearchHook: (no name) - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - (no file)
F3 - REG:win.ini: load=C:\WINDOWS\system32\vtutt.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {2D5796A2-44E0-4E50-A5A0-80BF1EE3EA73} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\DOCUME~1\CRAZYC~1\Desktop\Sys\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: (no name) - {6157302D-9229-482E-B62E-8DAC51BD3983} - (no file)
O2 - BHO: (no name) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - (no file)
O2 - BHO: {91048996-78a7-3b3a-e794-6e4573f2346b} - {b6432f37-54e6-497e-a3b3-7a8769984019} - (no file)
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O4 - HKLM\..\Run: [DLCFCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCFtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier .exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\DOCUME~1\CRAZYC~1\Desktop\Sys\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\DOCUME~1\CRAZYC~1\Desktop\Sys\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O11 - Options group: [INTERNATIONAL] International*
O15 - Trusted Zone: *.gomyhit.com
O15 - Trusted Zone: *.imageservr.com
O15 - Trusted Zone: *.imagesrvr.com
O15 - Trusted Zone: *.storageguardsoft.com
O15 - Trusted Zone: *.gomyhit.com (HKLM)
O15 - Trusted Zone: *.imageservr.com (HKLM)
O15 - Trusted Zone: *.imagesrvr.com (HKLM)
O15 - Trusted Zone: *.storageguardsoft.com (HKLM)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O18 - Filter: text/html - {07851C6A-1C43-41d9-8319-BC89154A8C00} - C:\Program Files\RcvSystem\httpdchk.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: yayxuvv - yayxuvv.dll (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: dlcf_device - - C:\WINDOWS\system32\dlcfcoms.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Zonealarm (free version) , Spybot S&D and AVG are running as you can tell. Also Ad-aware removed a mass of malware. CCleaner cleared a few more. I do not feel like I am experience enough to regedit so I am turning to you for advice.

(any chance Vtutt.exe actually just got accidently deleted and I only have to repair windows?(fingers crossed))

Thank you in advanced Dave !

IndiGenus

Post #5March 20, 2008, 1:09 AM UTC

No problem on the delay…just like to check in to make sure. With the right tools I should be able to guide you through this without doing any direct reg edits.

Please download ComboFix by sUBs from HERE or HERE

You must download it to and run it from your Desktop
Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
Double click combofix.exe & follow the prompts.
When finished, it will produce a log. Please save that log to post in your next reply along with a fresh HJT log
Re-enable all the programs that were disabled during the running of ComboFix..

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

helpdesktech

Post #6March 22, 2008, 1:14 AM UTC

Hello Dave,
Few things, After downlaoding Combofix, I was able to run it but it stalled (without me clicking anything). Restarted , re-ran got further, but when it went to create the .Log file it errored saying , " no file name found ; would you like to create a new one?" So I did, and the log came back EMPTY. So I can Combofix one last time and it produced a log. Just incase you have others that have this same problem, you just have to keep running Combofix untill it does what you want. =D :

ComboFix 08-03-21.1 - crazycena99 2008-03-21 20:53:30.2 - NTFSx86
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-02-22 to 2008-03-22 )))))))))))))))))))))))))))))))
.

2008-03-21 20:53 . 2008-03-21 20:53 3,631 –a—— C:\6.tmp
2008-03-21 20:36 . 2008-03-21 20:36 3,631 –a—— C:\3.tmp
2008-03-21 20:25 . 2008-03-21 20:25 3,631 –a—— C:\4.tmp
2008-03-14 20:53 . 2008-03-14 20:53 d——– C:\VundoFix Backups
2008-03-14 19:56 . 2008-03-14 20:26 d——– C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-03-14 19:08 . 2008-03-14 19:08 d——– C:\Program Files\Lavasoft
2008-03-14 19:08 . 2008-03-14 19:09 d——– C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-03-14 19:07 . 2008-03-14 19:07 d——– C:\Program Files\Common Files\Wise Installation Wizard

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-22 00:42 86,912 –sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-03-22 00:42 8,138,784 –sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-03-21 23:29 ——— d—–w C:\Documents and Settings\Papadukes247\Application Data\AVG7
2008-03-21 16:45 ——— d—–w C:\Documents and Settings\crazycena99\Application Data\AVG7
2008-03-21 02:55 33,280 —-a-w C:\WINDOWS\Internet Logs\xDB46.tmp
2008-03-21 02:55 1,447,424 —-a-w C:\WINDOWS\Internet Logs\xDB47.tmp
2008-03-16 17:18 72,192 —-a-w C:\WINDOWS\Internet Logs\xDB45.tmp
2008-03-14 02:49 103,936 —-a-w C:\WINDOWS\Internet Logs\xDB43.tmp
2008-03-14 02:49 1,413,632 —-a-w C:\WINDOWS\Internet Logs\xDB44.tmp
2008-03-12 01:10 ——— d—–w C:\Program Files\Dl_cats
2008-03-08 04:12 28,672 —-a-w C:\WINDOWS\Internet Logs\xDB41.tmp
2008-03-08 04:12 1,402,368 —-a-w C:\WINDOWS\Internet Logs\xDB42.tmp
2008-03-07 04:18 40,960 —-a-w C:\WINDOWS\Internet Logs\xDB3F.tmp
2008-03-07 04:18 1,401,344 —-a-w C:\WINDOWS\Internet Logs\xDB40.tmp
2008-03-06 11:37 1,399,296 —-a-w C:\WINDOWS\Internet Logs\xDB3E.tmp
2008-03-05 03:42 16,384 —-a-w C:\WINDOWS\Internet Logs\xDB3C.tmp
2008-03-05 03:42 1,398,272 —-a-w C:\WINDOWS\Internet Logs\xDB3D.tmp
2008-03-04 21:01 48,128 —-a-w C:\WINDOWS\Internet Logs\xDB3A.tmp
2008-03-04 21:01 1,398,272 —-a-w C:\WINDOWS\Internet Logs\xDB3B.tmp
2008-03-03 12:12 20,992 —-a-w C:\WINDOWS\Internet Logs\xDB38.tmp
2008-03-03 12:12 1,395,712 —-a-w C:\WINDOWS\Internet Logs\xDB39.tmp
2008-03-02 21:17 25,600 —-a-w C:\WINDOWS\Internet Logs\xDB36.tmp
2008-03-02 21:17 1,395,200 —-a-w C:\WINDOWS\Internet Logs\xDB37.tmp
2008-03-02 04:02 20,480 —-a-w C:\WINDOWS\Internet Logs\xDB34.tmp
2008-03-02 04:02 1,394,688 —-a-w C:\WINDOWS\Internet Logs\xDB35.tmp
2008-03-02 00:53 37,376 —-a-w C:\WINDOWS\Internet Logs\xDB32.tmp
2008-03-02 00:53 1,394,176 —-a-w C:\WINDOWS\Internet Logs\xDB33.tmp
2008-02-29 11:34 16,384 —-a-w C:\WINDOWS\Internet Logs\xDB30.tmp
2008-02-29 11:34 1,393,152 —-a-w C:\WINDOWS\Internet Logs\xDB31.tmp
2008-02-29 11:29 46,080 —-a-w C:\WINDOWS\Internet Logs\xDB2E.tmp
2008-02-29 11:29 1,392,640 —-a-w C:\WINDOWS\Internet Logs\xDB2F.tmp
2008-02-28 11:44 1,391,616 —-a-w C:\WINDOWS\Internet Logs\xDB2D.tmp
2008-02-27 11:46 48,128 —-a-w C:\WINDOWS\Internet Logs\xDB2B.tmp
2008-02-27 11:46 1,391,104 —-a-w C:\WINDOWS\Internet Logs\xDB2C.tmp
2008-02-24 23:57 89,600 —-a-w C:\WINDOWS\Internet Logs\xDB29.tmp
2008-02-24 23:57 1,388,544 —-a-w C:\WINDOWS\Internet Logs\xDB2A.tmp
2008-02-22 04:28 1,376,768 —-a-w C:\WINDOWS\Internet Logs\xDB28.tmp
2008-02-21 17:25 ——— d—–w C:\Documents and Settings\crazycena99\Application Data\AdobeUM
2008-02-21 04:07 28,672 —-a-w C:\WINDOWS\Internet Logs\xDB26.tmp
2008-02-21 04:07 1,375,744 —-a-w C:\WINDOWS\Internet Logs\xDB27.tmp
2008-02-21 00:06 ——— d—–w C:\Documents and Settings\Papadukes247\Application Data\AdobeUM
2008-02-20 12:15 18,944 —-a-w C:\WINDOWS\Internet Logs\xDB24.tmp
2008-02-20 12:15 1,374,720 —-a-w C:\WINDOWS\Internet Logs\xDB25.tmp
2008-02-20 11:25 22,528 —-a-w C:\WINDOWS\Internet Logs\xDB22.tmp
2008-02-20 11:25 1,374,208 —-a-w C:\WINDOWS\Internet Logs\xDB23.tmp
2008-02-20 03:30 36,352 —-a-w C:\WINDOWS\Internet Logs\xDB20.tmp
2008-02-20 03:30 1,373,696 —-a-w C:\WINDOWS\Internet Logs\xDB21.tmp
2008-02-19 11:47 1,372,672 —-a-w C:\WINDOWS\Internet Logs\xDB1F.tmp
2008-02-18 20:36 40,448 —-a-w C:\WINDOWS\Internet Logs\xDB1D.tmp
2008-02-18 20:36 1,371,648 —-a-w C:\WINDOWS\Internet Logs\xDB1E.tmp
2008-02-18 16:27 1,371,136 —-a-w C:\WINDOWS\Internet Logs\xDB1C.tmp
2008-02-18 00:25 1,370,112 —-a-w C:\WINDOWS\Internet Logs\xDB1B.tmp
2008-02-17 03:14 46,592 —-a-w C:\WINDOWS\Internet Logs\xDB19.tmp
2008-02-17 03:14 1,369,088 —-a-w C:\WINDOWS\Internet Logs\xDB1A.tmp
2008-02-16 11:46 1,368,576 —-a-w C:\WINDOWS\Internet Logs\xDB18.tmp
2008-02-15 11:35 40,960 —-a-w C:\WINDOWS\Internet Logs\xDB16.tmp
2008-02-15 11:35 1,367,040 —-a-w C:\WINDOWS\Internet Logs\xDB17.tmp
2008-02-14 03:48 66,048 —-a-w C:\WINDOWS\Internet Logs\xDB14.tmp
2008-02-14 03:48 1,365,504 —-a-w C:\WINDOWS\Internet Logs\xDB15.tmp
2008-02-11 02:52 54,784 —-a-w C:\WINDOWS\Internet Logs\xDB12.tmp
2008-02-11 02:52 1,359,360 —-a-w C:\WINDOWS\Internet Logs\xDB13.tmp
2008-02-08 11:43 24,576 —-a-w C:\WINDOWS\Internet Logs\xDB10.tmp
2008-02-08 11:43 1,357,824 —-a-w C:\WINDOWS\Internet Logs\xDB11.tmp
2008-02-07 15:07 60,928 —-a-w C:\WINDOWS\Internet Logs\xDBE.tmp
2008-02-07 15:07 1,356,800 —-a-w C:\WINDOWS\Internet Logs\xDBF.tmp
2008-02-07 03:56 1,356,288 —-a-w C:\WINDOWS\Internet Logs\xDBD.tmp
2008-02-05 11:48 28,160 —-a-w C:\WINDOWS\Internet Logs\xDBB.tmp
2008-02-05 11:48 1,354,240 —-a-w C:\WINDOWS\Internet Logs\xDBC.tmp
2008-02-04 23:00 1,353,728 —-a-w C:\WINDOWS\Internet Logs\xDBA.tmp
2008-02-04 04:42 26,112 —-a-w C:\WINDOWS\Internet Logs\xDB8.tmp
2008-02-04 04:42 1,353,216 —-a-w C:\WINDOWS\Internet Logs\xDB9.tmp
2008-02-03 03:12 217,600 —-a-w C:\WINDOWS\Internet Logs\xDB6.tmp
2008-02-03 03:12 1,352,704 —-a-w C:\WINDOWS\Internet Logs\xDB7.tmp
2008-01-11 11:41 27,136 —-a-w C:\WINDOWS\Internet Logs\xDB4.tmp
2008-01-11 11:41 1,341,440 —-a-w C:\WINDOWS\Internet Logs\xDB5.tmp
2008-01-10 11:48 29,184 —-a-w C:\WINDOWS\Internet Logs\xDB2.tmp
2008-01-10 11:48 1,340,416 —-a-w C:\WINDOWS\Internet Logs\xDB3.tmp
2008-01-09 11:44 78,336 —-a-w C:\WINDOWS\Internet Logs\xDB1.tmp
2008-01-05 23:57 15,360 —-a-w C:\WINDOWS\system32\ctfmon .exe
2008-01-05 23:56 94,208 —-a-w C:\WINDOWS\system32\igfxtray .exe
2008-01-05 23:56 77,824 —-a-w C:\WINDOWS\system32\hkcmd .exe
2008-01-05 23:56 114,688 —-a-w C:\WINDOWS\system32\igfxpers .exe
2007-12-29 22:22 4,184 –sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2007-05-28 18:54 88 –sh–r C:\WINDOWS\system32\4AFC2103E2.sys
.

—-a-w			50,528 2008-01-05 23:57:50  C:\Program Files\AIM6\aim6 .exe
—-a-w		 1,404,928 2008-01-05 23:56:41  C:\Program Files\Analog Devices\Core\smax4pnp .exe
—-a-w			81,920 2008-01-05 23:56:42  C:\Program Files\Common Files\InstallShield\UpdateService\issch .exe
—-a-w		   249,856 2008-01-05 23:56:41  C:\Program Files\Common Files\InstallShield\UpdateService\isuspm	 .exe
—-a-w		   249,856 2008-01-01 03:25:41  C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
—-a-w			58,992 2008-01-05 23:56:37  C:\Program Files\Common Files\Symantec Shared\ccApp .exe
—-a-w			94,208 2008-01-05 23:56:36  C:\Program Files\Dell\Media Experience\DMXLauncher .exe
—-a-w		   460,784 2008-01-05 23:57:41  C:\Program Files\DellSupport\DSAgnt .exe
—-a-w			68,856 2008-01-05 23:57:38  C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier .exe
—-a-w		   110,592 2008-01-05 23:57:01  C:\Program Files\McAfee\SpamKiller\MSKAGE~2 .EXE
—-a-w		 1,117,184 2008-01-05 23:56:56  C:\Program Files\McAfee\SpamKiller\MSKDetct .exe
—-a-w		   368,714 2008-01-05 23:57:12  C:\Program Files\McAfee.com\Agent\MCABBE~1 .EXE
—-a-w		   303,104 2008-01-05 23:56:50  C:\Program Files\McAfee.com\Agent\mcagent .exe
—-a-w		   212,992 2008-01-01 02:47:38  C:\Program Files\McAfee.com\Agent\mcupdate  .exe
—-a-w		   212,992 2008-01-06 00:04:43  C:\Program Files\McAfee.com\Agent\mcupdate .exe
—-a-w		   212,992 2008-01-05 23:56:51  C:\Program Files\McAfee.com\Agent\MCUPDA~1 .EXE
—-a-w		   999,424 2008-01-05 23:57:03  C:\Program Files\McAfee.com\Personal Firewall\MpfTray .exe
—-a-w		 1,694,208 2008-01-05 23:57:49  C:\Program Files\Messenger\msmsgs .exe
—-a-w			98,304 2008-01-05 23:57:07  C:\Program Files\QuickTime\qttask   .exe
—-a-w			15,360 2008-01-05 23:57:56  C:\WINDOWS\system32\ctfmon .exe
—-a-w			77,824 2008-01-05 23:56:34  C:\WINDOWS\system32\hkcmd .exe
—-a-w		   114,688 2008-01-05 23:56:34  C:\WINDOWS\system32\igfxpers .exe
—-a-w			94,208 2008-01-05 23:56:34  C:\WINDOWS\system32\igfxtray .exe
—-a-w		   122,940 2008-01-05 23:56:54  C:\WINDOWS\system32\DLA\DLACTRLW .EXE

——- Sigcheck ——-

2004-08-04 06:00 14336 8f078ae4ed187aaabc0a305146de6716 C:\WINDOWS\system32\svchost.exe

2004-08-04 06:00 82944 2ed0b7f12a60f90092081c50fa0ec2b2 C:\WINDOWS\system32\ws2_32.dll

2004-08-04 06:00 502272 01c3346c241652f43aed8e2149881bfe C:\WINDOWS\system32\winlogon.exe

2004-08-04 06:00 182912 558635d3af1c7546d26067d5d9b6959e C:\WINDOWS\system32\drivers\ndis.sys

2004-08-04 06:00 29056 4448006b6bc60e6c027932cfc38d6855 C:\WINDOWS\system32\drivers\ip6fw.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6157302D-9229-482E-B62E-8DAC51BD3983}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{b6432f37-54e6-497e-a3b3-7a8769984019}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA}]
2008-01-07 17:34 262144 –a—— C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}"= "C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL" [2008-01-07 17:34 262144]

[HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}"= C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL [2008-01-07 17:34 262144]

[HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier .exe" [2008-01-05 19:57 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DLCFCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCFtime.dll" [2005-09-08 07:55 73728]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-01-05 20:53 579072]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-11-14 17:05 919016]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-01-05 20:53 219136]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2006-08-09 01:37:35 24576]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\yayxuvv]
yayxuvv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
–a—— 2008-01-05 19:56 249856 C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]
C:\WINDOWS\system32\vtutt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=

R2 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" [2007-01-04 17:38]

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-21 20:57:02
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-03-21 20:58:26
ComboFix-quarantined-files.txt 2008-03-22 00:58:20
ComboFix2.txt 2008-03-22 00:48:57
.
2008-03-11 23:54:20 — E O F —

<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

Logfile of HijackThis v1.99.1
Scan saved at 9:05:28 PM, on 3/21/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\WINDOWS\explorer.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.myspace.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us
R3 - URLSearchHook: (no name) - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\DOCUME~1\CRAZYC~1\Desktop\Sys\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: (no name) - {6157302D-9229-482E-B62E-8DAC51BD3983} - (no file)
O2 - BHO: (no name) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - (no file)
O2 - BHO: {91048996-78a7-3b3a-e794-6e4573f2346b} - {b6432f37-54e6-497e-a3b3-7a8769984019} - (no file)
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O4 - HKLM\..\Run: [DLCFCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCFtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier .exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\DOCUME~1\CRAZYC~1\Desktop\Sys\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\DOCUME~1\CRAZYC~1\Desktop\Sys\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O11 - Options group: [INTERNATIONAL] International*
O15 - Trusted Zone: *.gomyhit.com
O15 - Trusted Zone: *.imageservr.com
O15 - Trusted Zone: *.imagesrvr.com
O15 - Trusted Zone: *.storageguardsoft.com
O15 - Trusted Zone: *.gomyhit.com (HKLM)
O15 - Trusted Zone: *.imageservr.com (HKLM)
O15 - Trusted Zone: *.imagesrvr.com (HKLM)
O15 - Trusted Zone: *.storageguardsoft.com (HKLM)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: yayxuvv - yayxuvv.dll (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: dlcf_device - - C:\WINDOWS\system32\dlcfcoms.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

IndiGenus

Post #7March 22, 2008, 10:10 PM UTC

Run HijackThis. Click Do a System Scan Only. Put a Check in the box on the left side on these:

O15 - Trusted Zone: *.gomyhit.com
O15 - Trusted Zone: *.imageservr.com
O15 - Trusted Zone: *.imagesrvr.com
O15 - Trusted Zone: *.storageguardsoft.com
O15 - Trusted Zone: *.gomyhit.com (HKLM)
O15 - Trusted Zone: *.imageservr.com (HKLM)
O15 - Trusted Zone: *.imagesrvr.com (HKLM)
O15 - Trusted Zone: *.storageguardsoft.com (HKLM)

Then close all windows except HijackThis and press Fix checked.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Next:

1. Please open Notepad

Click Start , then Run
Type notepad.exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

RenV:
—-a-w			50,528 2008-01-05 23:57:50  C:\Program Files\AIM6\aim6 .exe
—-a-w		 1,404,928 2008-01-05 23:56:41  C:\Program Files\Analog Devices\Core\smax4pnp .exe
—-a-w			81,920 2008-01-05 23:56:42  C:\Program Files\Common Files\InstallShield\UpdateService\issch .exe
—-a-w		   249,856 2008-01-05 23:56:41  C:\Program Files\Common Files\InstallShield\UpdateService\isuspm	 .exe
—-a-w		   249,856 2008-01-01 03:25:41  C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
—-a-w			58,992 2008-01-05 23:56:37  C:\Program Files\Common Files\Symantec Shared\ccApp .exe
—-a-w			94,208 2008-01-05 23:56:36  C:\Program Files\Dell\Media Experience\DMXLauncher .exe
—-a-w		   460,784 2008-01-05 23:57:41  C:\Program Files\DellSupport\DSAgnt .exe
—-a-w			68,856 2008-01-05 23:57:38  C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier .exe
—-a-w		   110,592 2008-01-05 23:57:01  C:\Program Files\McAfee\SpamKiller\MSKAGE~2 .EXE
—-a-w		 1,117,184 2008-01-05 23:56:56  C:\Program Files\McAfee\SpamKiller\MSKDetct .exe
—-a-w		   368,714 2008-01-05 23:57:12  C:\Program Files\McAfee.com\Agent\MCABBE~1 .EXE
—-a-w		   303,104 2008-01-05 23:56:50  C:\Program Files\McAfee.com\Agent\mcagent .exe
—-a-w		   212,992 2008-01-01 02:47:38  C:\Program Files\McAfee.com\Agent\mcupdate  .exe
—-a-w		   212,992 2008-01-06 00:04:43  C:\Program Files\McAfee.com\Agent\mcupdate .exe
—-a-w		   212,992 2008-01-05 23:56:51  C:\Program Files\McAfee.com\Agent\MCUPDA~1 .EXE
—-a-w		   999,424 2008-01-05 23:57:03  C:\Program Files\McAfee.com\Personal Firewall\MpfTray .exe
—-a-w		 1,694,208 2008-01-05 23:57:49  C:\Program Files\Messenger\msmsgs .exe
—-a-w			98,304 2008-01-05 23:57:07  C:\Program Files\QuickTime\qttask   .exe
—-a-w			15,360 2008-01-05 23:57:56  C:\WINDOWS\system32\ctfmon .exe
—-a-w			77,824 2008-01-05 23:56:34  C:\WINDOWS\system32\hkcmd .exe
—-a-w		   114,688 2008-01-05 23:56:34  C:\WINDOWS\system32\igfxpers .exe
—-a-w			94,208 2008-01-05 23:56:34  C:\WINDOWS\system32\igfxtray .exe
—-a-w		   122,940 2008-01-05 23:56:54  C:\WINDOWS\system32\DLA\DLACTRLW .EXE

File::
C:\WINDOWS\system32\vtutt.exe

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6157302D-9229-482E-B62E-8DAC51BD3983}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{b6432f37-54e6-497e-a3b3-7a8769984019}]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\yayxuvv]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]

3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

[external image: Posted Image]

5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

Combofix.txt
A new HijackThis log.

helpdesktech

Post #8March 27, 2008, 11:56 PM UTC

Hello dave,

Sorry again for the delay ! and thank you for your time. here are the logs after performing the last steps.

ComboFix 08-03-21.1 - crazycena99 2008-03-27 19:38:56.3 - NTFSx86
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\crazycena99\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\WINDOWS\system32\vtutt.exe
.

((((((((((((((((((((((((( Files Created from 2008-02-27 to 2008-03-27 )))))))))))))))))))))))))))))))
.

2008-03-27 19:37 . 2008-03-27 19:37 3,631 –a—— C:\58.tmp
2008-03-27 19:32 . 2008-03-27 19:32 d——– C:\WINDOWS\LastGood
2008-03-21 20:53 . 2008-03-21 20:53 3,631 –a—— C:\6.tmp
2008-03-21 20:36 . 2008-03-21 20:36 3,631 –a—— C:\3.tmp
2008-03-21 20:25 . 2008-03-21 20:25 3,631 –a—— C:\4.tmp
2008-03-14 20:53 . 2008-03-14 20:53 d——– C:\VundoFix Backups
2008-03-14 19:56 . 2008-03-14 20:26 d——– C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-03-14 19:08 . 2008-03-14 19:08 d——– C:\Program Files\Lavasoft
2008-03-14 19:08 . 2008-03-14 19:09 d——– C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-03-14 19:07 . 2008-03-14 19:07 d——– C:\Program Files\Common Files\Wise Installation Wizard

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-27 23:38 ——— d—–w C:\Program Files\QuickTime
2008-03-27 23:38 ——— d—–w C:\Program Files\DellSupport
2008-03-27 23:38 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2008-03-27 23:38 ——— d—–w C:\Program Files\AIM6
2008-03-27 23:26 ——— d—–w C:\Documents and Settings\crazycena99\Application Data\AVG7
2008-03-27 03:16 1,457,152 —-a-w C:\WINDOWS\Internet Logs\xDB4F.tmp
2008-03-26 23:40 ——— d—–w C:\Documents and Settings\Papadukes247\Application Data\AVG7
2008-03-25 03:08 23,040 —-a-w C:\WINDOWS\Internet Logs\xDB4D.tmp
2008-03-25 03:08 1,456,128 —-a-w C:\WINDOWS\Internet Logs\xDB4E.tmp
2008-03-23 17:06 1,455,104 —-a-w C:\WINDOWS\Internet Logs\xDB4C.tmp
2008-03-23 16:42 18,432 —-a-w C:\WINDOWS\Internet Logs\xDB4B.tmp
2008-03-23 01:03 22,016 —-a-w C:\WINDOWS\Internet Logs\xDB4A.tmp
2008-03-22 02:55 29,696 —-a-w C:\WINDOWS\Internet Logs\xDB48.tmp
2008-03-22 02:55 1,453,056 —-a-w C:\WINDOWS\Internet Logs\xDB49.tmp
2008-03-22 00:42 86,912 –sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-03-22 00:42 8,138,784 –sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-03-21 02:55 33,280 —-a-w C:\WINDOWS\Internet Logs\xDB46.tmp
2008-03-21 02:55 1,447,424 —-a-w C:\WINDOWS\Internet Logs\xDB47.tmp
2008-03-16 17:18 72,192 —-a-w C:\WINDOWS\Internet Logs\xDB45.tmp
2008-03-14 02:49 103,936 —-a-w C:\WINDOWS\Internet Logs\xDB43.tmp
2008-03-14 02:49 1,413,632 —-a-w C:\WINDOWS\Internet Logs\xDB44.tmp
2008-03-12 01:10 ——— d—–w C:\Program Files\Dl_cats
2008-03-08 04:12 28,672 —-a-w C:\WINDOWS\Internet Logs\xDB41.tmp
2008-03-08 04:12 1,402,368 —-a-w C:\WINDOWS\Internet Logs\xDB42.tmp
2008-03-07 04:18 40,960 —-a-w C:\WINDOWS\Internet Logs\xDB3F.tmp
2008-03-07 04:18 1,401,344 —-a-w C:\WINDOWS\Internet Logs\xDB40.tmp
2008-03-06 11:37 1,399,296 —-a-w C:\WINDOWS\Internet Logs\xDB3E.tmp
2008-03-05 03:42 16,384 —-a-w C:\WINDOWS\Internet Logs\xDB3C.tmp
2008-03-05 03:42 1,398,272 —-a-w C:\WINDOWS\Internet Logs\xDB3D.tmp
2008-03-04 21:01 48,128 —-a-w C:\WINDOWS\Internet Logs\xDB3A.tmp
2008-03-04 21:01 1,398,272 —-a-w C:\WINDOWS\Internet Logs\xDB3B.tmp
2008-03-03 12:12 20,992 —-a-w C:\WINDOWS\Internet Logs\xDB38.tmp
2008-03-03 12:12 1,395,712 —-a-w C:\WINDOWS\Internet Logs\xDB39.tmp
2008-03-02 21:17 25,600 —-a-w C:\WINDOWS\Internet Logs\xDB36.tmp
2008-03-02 21:17 1,395,200 —-a-w C:\WINDOWS\Internet Logs\xDB37.tmp
2008-03-02 04:02 20,480 —-a-w C:\WINDOWS\Internet Logs\xDB34.tmp
2008-03-02 04:02 1,394,688 —-a-w C:\WINDOWS\Internet Logs\xDB35.tmp
2008-03-02 00:53 37,376 —-a-w C:\WINDOWS\Internet Logs\xDB32.tmp
2008-03-02 00:53 1,394,176 —-a-w C:\WINDOWS\Internet Logs\xDB33.tmp
2008-02-29 11:34 16,384 —-a-w C:\WINDOWS\Internet Logs\xDB30.tmp
2008-02-29 11:34 1,393,152 —-a-w C:\WINDOWS\Internet Logs\xDB31.tmp
2008-02-29 11:29 46,080 —-a-w C:\WINDOWS\Internet Logs\xDB2E.tmp
2008-02-29 11:29 1,392,640 —-a-w C:\WINDOWS\Internet Logs\xDB2F.tmp
2008-02-28 11:44 1,391,616 —-a-w C:\WINDOWS\Internet Logs\xDB2D.tmp
2008-02-27 11:46 48,128 —-a-w C:\WINDOWS\Internet Logs\xDB2B.tmp
2008-02-27 11:46 1,391,104 —-a-w C:\WINDOWS\Internet Logs\xDB2C.tmp
2008-02-24 23:57 89,600 —-a-w C:\WINDOWS\Internet Logs\xDB29.tmp
2008-02-24 23:57 1,388,544 —-a-w C:\WINDOWS\Internet Logs\xDB2A.tmp
2008-02-22 04:28 1,376,768 —-a-w C:\WINDOWS\Internet Logs\xDB28.tmp
2008-02-21 17:25 ——— d—–w C:\Documents and Settings\crazycena99\Application Data\AdobeUM
2008-02-21 04:07 28,672 —-a-w C:\WINDOWS\Internet Logs\xDB26.tmp
2008-02-21 04:07 1,375,744 —-a-w C:\WINDOWS\Internet Logs\xDB27.tmp
2008-02-21 00:06 ——— d—–w C:\Documents and Settings\Papadukes247\Application Data\AdobeUM
2008-02-20 12:15 18,944 —-a-w C:\WINDOWS\Internet Logs\xDB24.tmp
2008-02-20 12:15 1,374,720 —-a-w C:\WINDOWS\Internet Logs\xDB25.tmp
2008-02-20 11:25 22,528 —-a-w C:\WINDOWS\Internet Logs\xDB22.tmp
2008-02-20 11:25 1,374,208 —-a-w C:\WINDOWS\Internet Logs\xDB23.tmp
2008-02-20 03:30 36,352 —-a-w C:\WINDOWS\Internet Logs\xDB20.tmp
2008-02-20 03:30 1,373,696 —-a-w C:\WINDOWS\Internet Logs\xDB21.tmp
2008-02-19 11:47 1,372,672 —-a-w C:\WINDOWS\Internet Logs\xDB1F.tmp
2008-02-18 20:36 40,448 —-a-w C:\WINDOWS\Internet Logs\xDB1D.tmp
2008-02-18 20:36 1,371,648 —-a-w C:\WINDOWS\Internet Logs\xDB1E.tmp
2008-02-18 16:27 1,371,136 —-a-w C:\WINDOWS\Internet Logs\xDB1C.tmp
2008-02-18 00:25 1,370,112 —-a-w C:\WINDOWS\Internet Logs\xDB1B.tmp
2008-02-17 03:14 46,592 —-a-w C:\WINDOWS\Internet Logs\xDB19.tmp
2008-02-17 03:14 1,369,088 —-a-w C:\WINDOWS\Internet Logs\xDB1A.tmp
2008-02-16 11:46 1,368,576 —-a-w C:\WINDOWS\Internet Logs\xDB18.tmp
2008-02-15 11:35 40,960 —-a-w C:\WINDOWS\Internet Logs\xDB16.tmp
2008-02-15 11:35 1,367,040 —-a-w C:\WINDOWS\Internet Logs\xDB17.tmp
2008-02-14 03:48 66,048 —-a-w C:\WINDOWS\Internet Logs\xDB14.tmp
2008-02-14 03:48 1,365,504 —-a-w C:\WINDOWS\Internet Logs\xDB15.tmp
2008-02-11 02:52 54,784 —-a-w C:\WINDOWS\Internet Logs\xDB12.tmp
2008-02-11 02:52 1,359,360 —-a-w C:\WINDOWS\Internet Logs\xDB13.tmp
2008-02-08 11:43 24,576 —-a-w C:\WINDOWS\Internet Logs\xDB10.tmp
2008-02-08 11:43 1,357,824 —-a-w C:\WINDOWS\Internet Logs\xDB11.tmp
2008-02-07 15:07 60,928 —-a-w C:\WINDOWS\Internet Logs\xDBE.tmp
2008-02-07 15:07 1,356,800 —-a-w C:\WINDOWS\Internet Logs\xDBF.tmp
2008-02-07 03:56 1,356,288 —-a-w C:\WINDOWS\Internet Logs\xDBD.tmp
2008-02-05 11:48 28,160 —-a-w C:\WINDOWS\Internet Logs\xDBB.tmp
2008-02-05 11:48 1,354,240 —-a-w C:\WINDOWS\Internet Logs\xDBC.tmp
2008-02-04 23:00 1,353,728 —-a-w C:\WINDOWS\Internet Logs\xDBA.tmp
2008-02-04 04:42 26,112 —-a-w C:\WINDOWS\Internet Logs\xDB8.tmp
2008-02-04 04:42 1,353,216 —-a-w C:\WINDOWS\Internet Logs\xDB9.tmp
2008-02-03 03:12 217,600 —-a-w C:\WINDOWS\Internet Logs\xDB6.tmp
2008-02-03 03:12 1,352,704 —-a-w C:\WINDOWS\Internet Logs\xDB7.tmp
2008-01-11 11:41 27,136 —-a-w C:\WINDOWS\Internet Logs\xDB4.tmp
2008-01-11 11:41 1,341,440 —-a-w C:\WINDOWS\Internet Logs\xDB5.tmp
2008-01-10 11:48 29,184 —-a-w C:\WINDOWS\Internet Logs\xDB2.tmp
2008-01-10 11:48 1,340,416 —-a-w C:\WINDOWS\Internet Logs\xDB3.tmp
2008-01-09 11:44 78,336 —-a-w C:\WINDOWS\Internet Logs\xDB1.tmp
2008-01-05 23:57 15,360 —-a-w C:\WINDOWS\system32\ctfmon.exe
2008-01-05 23:56 94,208 —-a-w C:\WINDOWS\system32\igfxtray.exe
2008-01-05 23:56 77,824 —-a-w C:\WINDOWS\system32\hkcmd.exe
2008-01-05 23:56 114,688 —-a-w C:\WINDOWS\system32\igfxpers.exe
2007-12-29 22:22 4,184 –sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2007-05-28 18:54 88 –sh–r C:\WINDOWS\system32\4AFC2103E2.sys
.

——- Sigcheck ——-

2004-08-04 06:00 14336 8f078ae4ed187aaabc0a305146de6716 C:\WINDOWS\system32\svchost.exe

2004-08-04 06:00 82944 2ed0b7f12a60f90092081c50fa0ec2b2 C:\WINDOWS\system32\ws2_32.dll

2004-08-04 06:00 502272 01c3346c241652f43aed8e2149881bfe C:\WINDOWS\system32\winlogon.exe

2004-08-04 06:00 182912 558635d3af1c7546d26067d5d9b6959e C:\WINDOWS\system32\drivers\ndis.sys

2004-08-04 06:00 29056 4448006b6bc60e6c027932cfc38d6855 C:\WINDOWS\system32\drivers\ip6fw.sys
.
((((((((((((((((((((((((((((( snapshot@2008-03-21_20.48.19.99 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-01-05 23:56:54 122,940 —-a-w C:\WINDOWS\system32\DLA\DLACTRLW.EXE
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA}]
2008-01-07 17:34 262144 –a—— C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}"= "C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL" [2008-01-07 17:34 262144]

[HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}"= C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL [2008-01-07 17:34 262144]

[HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier .exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DLCFCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCFtime.dll" [2005-09-08 07:55 73728]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-01-05 20:53 579072]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-11-14 17:05 919016]
"MCUpdateExe"="C:\PROGRA~1\mcafee.com\agent\mcupdate.exe" [2007-12-31 22:47 212992]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-01-05 20:53 219136]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2006-08-09 01:37:35 24576]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=

R2 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" [2007-01-04 17:38]

.
**************************************************************************
scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-03-27 19:45:02
ComboFix-quarantined-files.txt 2008-03-27 23:44:55
ComboFix2.txt 2008-03-22 00:58:27
ComboFix3.txt 2008-03-22 00:48:57
.
2008-03-11 23:54:20 — E O F —

==========================================HJT log.===================================
Logfile of HijackThis v1.99.1
Scan saved at 7:52:45 PM, on 3/27/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.myspace.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us
R3 - URLSearchHook: (no name) - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\DOCUME~1\CRAZYC~1\Desktop\Sys\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: (no name) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - (no file)
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O4 - HKLM\..\Run: [DLCFCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCFtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier .exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\DOCUME~1\CRAZYC~1\Desktop\Sys\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\DOCUME~1\CRAZYC~1\Desktop\Sys\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: dlcf_device - - C:\WINDOWS\system32\dlcfcoms.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

IndiGenus

Post #9March 28, 2008, 12:40 AM UTC

Hi,

Looks like it's getting better but more work to do and some questions.

Update Java Runtime:

You are using an old version of Java. Sun's Java is sometimes updated in order to eliminate the exploitation of vulnerabilities in an existing version. For this reason, it's extremely important that you keep the program up to date, and also remove the older more vulnerable versions from your system. The most current version of Sun Java is: Java Runtime Environment Version 6 Update 5.

Go to the Sun Java Website
Click on the download button next to Java Runtime Environment (JRE) 6 Update 5
Check the circle next to I agree to the Java SE Runtime Environment 6 License Agreement.
Click on the link Windows Offline Installation, Multi-language and save the downloaded file to your hard disk.
Go to Start => Control Panel => Add or Remove Programs
Uninstall all old versions of Java (Java 2 Runtime Environment, JRE or JSE)
Reboot your computer
Delete the folder C:\Program Files\Java if present
Install the new version by running the newly-downloaded file, and follow the on-screen instructions.
Reboot your computer

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

It also appears you have 2 antivirus programs running here, AVG and McAfee. You only want and need to have one running real time protection. Having more than one can cause system slowdown, conflicts, errors, false positives, ect…. This also applies to Firewalls, but I only see ZA running there so you're OK.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Please download ATF Cleaner by Atribune.
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

Next:

Please download Malwarebytes' Anti-Malware to your desktop.

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. Please save it to a convenient location and post the results.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Please do an online scan with Kaspersky WebScanner

You need to use Internet Explorer for this scan.

Click on Kaspersky Online Scanner and click Accept

You will be prompted to install an ActiveX component from Kaspersky, Click Yes.

The program will launch and then begin downloading the latest definition files:
Once the files have been downloaded click on NEXT
Now click on Scan Settings
In the scan settings make that the following are selected:
- Scan using the following Anti-Virus database:
Extended (if available otherwise Standard)
- Scan Options:
Scan Archives
Scan Mail Bases
Click OK
Now under select a target to scan:Select My Computer
This will program will start and scan your system.
The scan will take a while so be patient and let it run.
Once the scan is complete it will display if your system has been infected.
- Now click on the Save as Text button:
Save the file to your desktop.
Copy and paste that information in your next post.

Reboot and post a fresh HJT log, please also let me know how its' running.

helpdesktech

Post #10April 1, 2008, 2:12 AM UTC

Sorry for delay ! New logs my friend …

HJT log ! >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

Logfile of HijackThis v1.99.1
Scan saved at 10:05:45 PM, on 3/31/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us
R3 - URLSearchHook: (no name) - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\DOCUME~1\CRAZYC~1\Desktop\Sys\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - (no file)
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O4 - HKLM\..\Run: [DLCFCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCFtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [CleanUp] C:\PROGRA~1\McAfee.com\Shared\mcappins.exe /v=3 /cleanup
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier .exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\DOCUME~1\CRAZYC~1\Desktop\Sys\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\DOCUME~1\CRAZYC~1\Desktop\Sys\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O15 - Trusted Zone: http://*.mcafee.com
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: dlcf_device - - C:\WINDOWS\system32\dlcfcoms.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Kasper Log ! >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
——————————————————————————-
KASPERSKY ONLINE SCANNER REPORT
Monday, March 31, 2008 9:50:28 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 31/03/2008
Kaspersky Anti-Virus database records: 675122
——————————————————————————-

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\
E:\

Scan Statistics:
Total number of scanned objects: 49124
Number of viruses found: 5
Number of infected objects: 8
Number of suspicious objects: 2
Duration of the scan process: 00:52:29

Infected Object Name / Virus Name / Last Action
C:\34.tmp/stream/data0002 Infected: not-a-virus:Downloader.Win32.Agent.q skipped
C:\34.tmp/stream/data0003 Infected: not-a-virus:AdWare.Win32.AdBand.c skipped
C:\34.tmp/stream/data0004 Infected: not-a-virus:AdWare.Win32.Agent.apq skipped
C:\34.tmp/stream Infected: not-a-virus:AdWare.Win32.Agent.apq skipped
C:\34.tmp NSIS: infected - 4 skipped
C:\Documents and Settings\All Users\Application Data\avg7\Log\emc.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Yazzle.zip/Yazzle1552OinUninstaller.exe Suspicious: Password-protected-EXE skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Yazzle.zip ZIP: suspicious - 1 skipped
C:\Documents and Settings\crazycena99\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\crazycena99\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\crazycena99\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\crazycena99\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\crazycena99\Local Settings\History\History.IE5\MSHist012008033120080401\index.dat Object is locked skipped
C:\Documents and Settings\crazycena99\Local Settings\temp\~DF22C.tmp Object is locked skipped
C:\Documents and Settings\crazycena99\Local Settings\temp\~DF25E.tmp Object is locked skipped
C:\Documents and Settings\crazycena99\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\crazycena99\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\crazycena99\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\crazycena99\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141474.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141475.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141476.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141477.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141478.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141479.dll Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141480.dll Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141481.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141482.dll Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141483.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141484.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141485.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141487.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141513.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141514.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141515.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141516.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141517.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141518.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141519.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141520.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141521.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141522.EXE Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141523.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141524.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141525.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141526.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141527.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141528.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141529.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141530.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141531.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141532.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141533.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141534.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141535.EXE Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141536.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141537.EXE Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141538.EXE Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141539.EXE Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141540.EXE Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141541.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141542.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141543.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141544.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141545.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141546.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141547.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141548.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141549.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141550.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141551.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141552.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141553.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141554.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141555.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141556.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141557.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141558.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141559.dll Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141560.dll Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141561.dll Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141562.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141563.dll Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141564.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141565.dll Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141566.dll Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141567.dll Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141568.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141569.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141570.dll Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141571.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141572.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP410\A0141573.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP412\A0141698.dll Infected: not-a-virus:AdWare.Win32.AdBand.c skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP474\A0233839.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP474\A0233840.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP474\A0233841.exe Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP476\A0233915.exe/data0001 Infected: not-a-virus:AdWare.Win32.PurityScan.gp skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP476\A0233915.exe NSIS: infected - 1 skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP491\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\Internet Logs\fwdbglog.txt Object is locked skipped
C:\WINDOWS\Internet Logs\fwpktlog.txt Object is locked skipped
C:\WINDOWS\Internet Logs\IAMDB.RDB Object is locked skipped
C:\WINDOWS\Internet Logs\PAT.ldb Object is locked skipped
C:\WINDOWS\Internet Logs\tvDebug.log Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{87D116A1-BE1D-42D9-B717-E5FEC5867919}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\DEFAULT Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SYSTEM Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\drivers\fidbox.dat Object is locked skipped
C:\WINDOWS\system32\drivers\fidbox.idx Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\TEMP\ZLT03dac.TMP Object is locked skipped
C:\WINDOWS\TEMP\ZLT03daf.TMP Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
D:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP491\change.log Object is locked skipped

Scan process completed.

Malware Log ! >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
Malwarebytes' Anti-Malware 1.09
Database version: 576

Scan type: Quick Scan
Objects scanned: 26953
Time elapsed: 5 minute(s), 10 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 3
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\xpre (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\33.tmp (Adware.Purityscan) -> Quarantined and deleted successfully.

Take your time, alot of info there !

IndiGenus

Post #11April 1, 2008, 1:46 PM UTC

Okay I think we're pretty much there….

Run HijackThis. Click Do a System Scan Only. Put a Check in the box on the left side on this:

O2 - BHO: (no name) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - (no file)

Then close all windows except HijackThis and press Fix checked.

~~~~~~~~~~~~~~~~~~~~~~~~

Using Windows Explorer delete the following file:

C:\34.tmp

~~~~~~~~~~~~~~~~~~~~~~~~

Time for some housekeeping

Click START then RUN
Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.
[external image: Posted Image]

The above procedure will:

Delete the following:
- ComboFix and its associated files and folders.
- VundoFix backups, if present
- The C:\Deckard folder, if present
- The C:_OtMoveIt folder, if present
Reset the clock settings.
Hide file extensions, if required.
Hide System/Hidden files, if required.
Reset System Restore.

Let me know how it's running and if there are any other questions.

IndiGenus

Post #12April 3, 2008, 2:19 PM UTC

Now that you are clean here are some suggestions.

How do I protect myself from infection?
Can you tell me how I got infected?

IndiGenus

Post #13April 3, 2008, 2:19 PM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] Windows/system32/Vtutt.exe start-up problem

✨ Ask AI

Ask AI