What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Red Circle White X Systray - Your system is infected

11 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Red Circle White X Systray - Your system is infected
I have scanned through the forum looking for something similar with no luck.

I've tried to remove this nasty by running the following in Safe Mode with Networking
ComboFix.exe
VundoFix
smitRem
Ran Firefox
Disabled the System Restore
Deleted these files if present
* bravesentry0.dll
* bravesentry1.dll
* bravesentry2.dll
* bravesentry3.dll
* comdlg64.dll
* msupdate32.dll
* tio[X1].dll
* winbixnkq32.dll
* zlbw.dll
* bravesentry.exe
* vxgamet[X2].exe
* vxh8jkdq[X2].exe
* win32.exe
* xpupdate.exe
* comdlg64.dll
* alg.exe
* kerneles8.exe
* maxd64.exe
* services.exe
* taskdir.exe
* voi[X1].exe
* vxgame[X2].exe
* desktop.html
Ran AVG Spyware and Adaware 2007 then deleted any of the items that were discovered
When I restart in Safe Mode with Networking the
C:\DOCUME~1\DRBOB~1\LOCALS~1\Temp\services.exe
[KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
c:\windows\system32\epknatsr.dll
C:\DOCUME~1\DRBOB~1\LOCALS~1\Temp\tllttlltppd
All return

Here is the Hijack this log
Logfile of HijackThis v1.99.1
Scan saved at 16:01, on 2008-03-12
Dell Dimension 2400
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\savedump.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Documents and Settings\Dr Bob\My Documents\rid redex\dl\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/…ch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/mywaybiz
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\DOCUME~1\DRBOB~1\LOCALS~1\Temp \services.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~2\mimboot.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\\vptray.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [taskmon] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [pdptlddl] rundll32.exe "C:\DOCUME~1\DRBOB~1\LOCALS~1\Temp\tllttlltppd.drv" WLEntryPoint
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [Streams Drivers] C:\DOCUME~1\DRBOB~1\LOCALS~1\Temp\services.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Open Picture in &Microsoft PhotoDraw - res://C:\PROGRA~1\MICROS~4\Office\1033\phdintl.dll/phdContext.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O10 - Unknown file in Winsock LSP: c:\windows\system32\epknatsr.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\epknatsr.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://support2.charter.com/sdccommo…ad/tgctlcm.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {9E58D78E-C5D3-DCF5-F38E-D1FBF76F5CBA} (MNPerformer Class) - http://www.charter.net/files/musicne…erSetup-sa.exe
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://symantec.webex.com/client/T2…rt/ieatgpc.cab
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Application Layer Gateway Service (ALG) - Unknown owner - C:\WINDOWS\System32\alg.exe (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

Please help if you can. I really don't want to reinstall everything jsut to get rid of this infection.

Thanks
Robert
Post #3
Yes, System Restore is turned off. My brother-in-law had some consultant come in to try to resolve the issue and I would guess that he turned it off. I made sure it was turned on when I installed the computer in his office 2 years ago. Sorry!
Post #4 last edited
You need to create a new restore point.

Note: This will remove all previous Restore Points

Click Start Menu > Run > copy and paste

%SystemRoot%\System32\restore\rstrui.exe

Press OK. Choose Create a Restore Point then click Next. Name it (something you'll remember) and click Create, when the confirmation screen shows the restore point has been created click Close.


After the above:

I suggest you do this:

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Clear "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Clear "Hide protected operating system files."
Click Apply, and then click OK.


Please do not delete anything unless instructed to.

Next:

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»

Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.


(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time.

Next:

Download ComboFix from Here or Here to your Desktop.
**Note: In the event you already have Combofix, please delete it from your desktop and download this new version . It is important that it is saved directly to your desktop**
——————————————————————–
  • Close any open browsers and make sure you are disconnected from the net. Unplug the cable if need be before running combofix.
  • WARNING: IF you have not already done so Combofix will disconnect your machine from the Internet when it starts
  • Please do not re-connect your machine back to the Internet until Combofix has completely finished.
——————————————————————–

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review

****Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze ****

*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.

Give it atleast 20-30 minutes to finish
Post #5
Sorry it took so long to reply. Here are the current combofix.txt and hijackthis.log files.

ComboFix 08-03-17.1 - Dr Bob 2008-03-18 17:45:59.4 - NTFSx86 MINIMAL
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.144 [GMT -7:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\inf\qwetab.inf
C:\WINDOWS\inf\wseqnx.inf
C:\WINDOWS\system\pcximg.pif
.
—- Previous Run ——-
.
C:\Documents and Settings\All Users\Application Data.\udydaluv.dll
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\Documents and Settings\Dr Bob\Application Data\microsoft\internet explorer\Desktop.htt
C:\Documents and Settings\Dr Bob\Local Settings\Application Data\cftmon.exe
C:\Documents and Settings\Dr Bob\Local Settings\Application Data\n.ini
C:\Documents and Settings\LocalService\Local Settings\Application Data\cftmon.exe
C:\Documents and Settings\Sandi\Application Data\install.dat
C:\Documents and Settings\Sandi\Application Data\microsoft\internet explorer\Desktop.htt
C:\Program Files\Internet Explorer\setupapi.dll
C:\WINDOWS\Downloaded Program Files\MyWebEx
C:\WINDOWS\Downloaded Program Files\MyWebEx\419\atarm.dll
C:\WINDOWS\Downloaded Program Files\MyWebEx\419\atas32.dll
C:\WINDOWS\Downloaded Program Files\MyWebEx\419\atasanot.exe
C:\WINDOWS\Downloaded Program Files\MyWebEx\419\atasctrl.dll
C:\WINDOWS\Downloaded Program Files\MyWebEx\419\atasnt40.dll
C:\WINDOWS\Downloaded Program Files\MyWebEx\419\atcarmcl.dll
C:\WINDOWS\Downloaded Program Files\MyWebEx\419\atdl2006.dll
C:\WINDOWS\Downloaded Program Files\MyWebEx\419\atjpeg60.dll
C:\WINDOWS\Downloaded Program Files\MyWebEx\419\atkbctl.dll
C:\WINDOWS\Downloaded Program Files\MyWebEx\419\atlchat.dll
C:\WINDOWS\Downloaded Program Files\MyWebEx\419\atmemmgr.dll
C:\WINDOWS\Downloaded Program Files\MyWebEx\419\atnetext.dll
C:\WINDOWS\Downloaded Program Files\MyWebEx\419\atpack.dll
C:\WINDOWS\Downloaded Program Files\MyWebEx\419\atres.dll
C:\WINDOWS\Downloaded Program Files\MyWebEx\419\attp.dll
C:\WINDOWS\Downloaded Program Files\MyWebEx\419\atwbxui6.dll
C:\WINDOWS\Downloaded Program Files\MyWebEx\419\h264dec.dll
C:\WINDOWS\Downloaded Program Files\MyWebEx\419\h264enc.dll
C:\WINDOWS\Downloaded Program Files\MyWebEx\419\ieatgpc.dll
C:\WINDOWS\Downloaded Program Files\MyWebEx\419\mmssl32.dll
C:\WINDOWS\Downloaded Program Files\MyWebEx\419\msess.dll
C:\WINDOWS\Downloaded Program Files\MyWebEx\419\mticket.dll
C:\WINDOWS\Downloaded Program Files\MyWebEx\419\mutiltpd.dll
C:\WINDOWS\Downloaded Program Files\MyWebEx\419\mvc.dll
C:\WINDOWS\Downloaded Program Files\MyWebEx\419\mwm.ini
C:\WINDOWS\Downloaded Program Files\MyWebEx\419\mwmcliun.exe
C:\WINDOWS\Downloaded Program Files\MyWebEx\419\mwmproxy.dll
C:\WINDOWS\Downloaded Program Files\MyWebEx\419\mwmres.dll
C:\WINDOWS\Downloaded Program Files\MyWebEx\419\mwmtrace.txt
C:\WINDOWS\Downloaded Program Files\MyWebEx\419\mwmupd.exe
C:\WINDOWS\Downloaded Program Files\MyWebEx\419\ratrace.dll
C:\WINDOWS\Downloaded Program Files\MyWebEx\419\raurl.dll
C:\WINDOWS\Downloaded Program Files\MyWebEx\419\uilibres.dll
C:\WINDOWS\Downloaded Program Files\MyWebEx\419\wbxcrypt.dll
C:\WINDOWS\Downloaded Program Files\MyWebEx\419\webexmgr.dll
C:\WINDOWS\inf\qwetab.inf
C:\WINDOWS\inf\wseqnx.inf
C:\WINDOWS\mrofinu27.exe
C:\WINDOWS\PerfInfo
C:\WINDOWS\system\pcximg.pif
C:\WINDOWS\system32\alt.exe.exe
C:\WINDOWS\system32\ctfmona.exe
C:\WINDOWS\system32\drivers\bjtbgilr.dat
C:\WINDOWS\system32\drivers\fad.sys
C:\WINDOWS\system32\drivers\Uae61.sys
C:\WINDOWS\system32\krmpgnqdgbqp.dll
C:\WINDOWS\system32\n.ini
C:\WINDOWS\system32\sys_2.dll
C:\WINDOWS\system32\vx.tll
C:\WINDOWS\system32\winivstr.exe
C:\WINDOWS\system32\wm05.dll
C:\WINDOWS\system32\wmldap.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\LEGACY_ICF
——-\LEGACY_NPF
——-\LEGACY_SVIRNDBM
——-\LEGACY_SYMAVC32
——-\LEGACY_UAE61
——-\ICF
——-\svirndbm
——-\symavc32
——-\Uae61
——-\Service_infoxmid
——-\Service_pcximg
——-\Service_qwetab


((((((((((((((((((((((((( Files Created from 2008-02-19 to 2008-03-19 )))))))))))))))))))))))))))))))
.

2008-03-18 17:45 . 2008-03-18 17:26 112,640 –a—— C:\WINDOWS\SYSTEM32\tptdtlhhldd.sys
2008-03-18 16:48 . 2008-03-18 16:47 112,640 –a—— C:\WINDOWS\SYSTEM32\tpthpdtdpp.dll
2008-03-17 17:34 . 2008-03-17 17:30 112,640 –a—— C:\WINDOWS\SYSTEM32\hddtplhppd.nls
2008-03-10 20:18 . 2008-03-10 20:18 112,640 –a—— C:\WINDOWS\SYSTEM32\thpltllldh.dll
2008-03-10 19:56 . 2008-03-10 19:56 112,640 –a—— C:\WINDOWS\SYSTEM32\ttdhlddh.drv
2008-03-10 19:44 . 2008-03-10 20:01 d——– C:\Program Files\Unlocker
2008-03-09 18:52 . 2008-03-09 18:52 32 –a-s—- C:\WINDOWS\SYSTEM32\3121637998.dat
2008-03-09 13:49 . 2008-03-09 13:49 d——– C:\Documents and Settings\Dr Bob\Application Data\Talkback
2008-03-09 12:48 . 2008-03-10 19:25 d——– C:\Program Files\Spyware Doctor
2008-03-09 12:48 . 2008-03-10 19:25 d-a—— C:\Documents and Settings\All Users\Application Data\TEMP
2008-03-09 12:31 . 2008-03-09 12:31 d——– C:\Program Files\CCleaner
2008-03-09 10:07 . 2008-03-09 10:07 108 –a—— C:\WINDOWS\SYSTEM32\delself.bat
2008-03-06 16:36 . 2008-03-06 16:36 38,400 -r-hs—- C:\WINDOWS\SYSTEM32\amstreamt.exe
2008-03-06 16:36 . 2008-03-06 16:36 38,400 -r-hs—- C:\WINDOWS\SYSTEM32\actmovieb.exe
2008-03-06 09:13 . 2008-03-06 09:12 38,400 -r-hs—- C:\WINDOWS\SYSTEM32\Adobeo.exe
2008-03-06 09:12 . 2008-03-06 09:12 d——– C:\Documents and Settings\Sandi\Application Data\Grisoft
2008-03-06 09:12 . 2008-03-06 09:12 38,400 -r-hs—- C:\WINDOWS\SYSTEM32\adsmsextp.exe
2008-03-06 09:12 . 2008-03-06 09:12 37,376 –a—— C:\WINDOWS\mrofinu27.exe.tmp
2008-03-04 21:25 . 2008-03-04 21:25 11 –a—— C:\WINDOWS\Topo3.ini
2008-03-04 20:10 . 2008-03-04 20:10 d——– C:\Documents and Settings\Dr Bob\Application Data\Grisoft
2008-03-04 20:08 . 2008-03-04 20:08 d——– C:\Documents and Settings\All Users\Application Data\Grisoft
2008-03-04 20:08 . 2007-05-30 05:10 10,872 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\AvgAsCln.sys
2008-03-02 13:19 . 2008-03-02 13:19 d——– C:\Program Files\Lavasoft
2008-03-02 13:19 . 2008-03-02 13:20 d——– C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-03-02 13:18 . 2008-03-10 16:21 d——– C:\Program Files\Common Files\Wise Installation Wizard
2008-03-02 13:08 . 2008-03-09 10:59 77,383 –a—— C:\WINDOWS\SYSTEM32\atasnt40.dll
2008-03-02 13:08 . 2008-03-02 13:08 51,304 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\atnt40k.sys
2008-03-02 12:22 . 2008-03-02 12:22 d——– C:\Documents and Settings\Dr Bob\Application Data\BrowserObjects
2008-03-02 12:22 . 2008-03-02 12:22 d——– C:\Documents and Settings\Dr Bob\Application Data\Autorun
2008-03-02 12:18 . 2008-03-02 12:18 d——– C:\Documents and Settings\Dr Bob\Application Data\EasySpywareCleaner.com
2008-03-02 12:16 . 2008-03-09 16:41 11,776 –a—— C:\WINDOWS\SYSTEM32\WLCtrl32.dl_
2008-03-02 12:05 . 2008-03-02 12:05 d——– C:\WINDOWS\noscavow
2008-03-02 12:00 . 2008-03-02 12:00 112,640 –a—— C:\WINDOWS\SYSTEM32\retgj.dll
2008-03-02 11:57 . 2008-03-09 16:40 11,776 –a—— C:\WINDOWS\SYSTEM32\WLCtrl32.dll
2008-03-01 11:10 . 2008-03-01 11:10 58,368 –a—— C:\kyjfu.exe
2008-03-01 11:10 . 2008-03-01 11:10 50,176 –a—— C:\muemoh.exe
2008-03-01 11:10 . 2008-03-01 11:10 16,384 –a—— C:\mtofsrip.exe
2008-03-01 11:10 . 2008-03-01 11:10 10,001 –a—— C:\WINDOWS\dnbq.exe
2008-03-01 11:06 . 2008-03-01 11:06 17,872 –a—— C:\WINDOWS\acs.exe
2008-02-25 14:39 . 2008-02-25 14:41 d——– C:\Rlisys pre-reinstall 02.28.08
2008-02-25 14:37 . 2008-02-25 14:37 60,968 –a—— C:\Documents and Settings\Dr Bob\GoToAssistDownloadHelper.exe
2008-02-25 10:51 . 2008-02-25 10:51 50,176 –a—— C:\sltbtpbr.exe
2008-02-25 10:51 . 2008-02-25 10:51 10,001 –a—— C:\WINDOWS\qkjc.exe
2008-02-25 10:47 . 2008-02-25 10:47 17,872 –a—— C:\WINDOWS\xszxy.exe~
2008-02-25 10:47 . 2008-02-25 10:47 17,872 –a—— C:\WINDOWS\SYSTEM32\wind32.exe
2008-02-23 13:57 . 2008-02-23 13:57 68,096 –a—— C:\WINDOWS\trashicon.exe
2008-02-23 13:57 . 2008-02-25 09:39 32,256 –a—— C:\WINDOWS\wndsk.dll
2008-02-23 13:57 . 2008-03-02 12:02 5,515 –a—— C:\WINDOWS\rules.dat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-05 04:25 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-03-03 19:01 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2008-03-03 15:34 ——— d—–w C:\Program Files\Symantec AntiVirus
2008-03-02 19:10 58,368 —-a-w C:\tlmnmae.exe
2008-03-02 19:10 50,176 —-a-w C:\euyh.exe
2008-03-02 19:10 22,634 –sh–w C:\WINDOWS\system32\drivers\spools.exe
2008-03-02 19:10 16,384 —-a-w C:\mbjuwp.exe
2004-07-26 18:46 520,192 —-a-w C:\Documents and Settings\Rosa\chatlnk.exe
.

——- Sigcheck ——-

2005-03-13 17:55 359808 0e66b538096a6529d1ac66e78eb0d5c8 C:\WINDOWS\$hf_mig$\KB893066\SP2GDR\tcpip.sys
2005-05-25 12:07 359936 63fdfea54eb53de2d863ee454937ce1e C:\WINDOWS\$hf_mig$\KB893066\SP2QFE\tcpip.sys
2006-01-13 10:07 360448 5562cc0a47b2aef06d3417b733f3c195 C:\WINDOWS\$hf_mig$\KB913446\SP2QFE\tcpip.sys
2006-04-20 05:18 360576 b2220c618b42a2212a59d91ebd6fc4b4 C:\WINDOWS\$hf_mig$\KB917953\SP2QFE\tcpip.sys
2007-10-30 09:53 360832 64798ecfa43d78c7178375fcdd16d8c8 C:\WINDOWS\$hf_mig$\KB941644\SP2QFE\tcpip.sys
2005-02-22 19:00 339968 466cbd4831e80729173654ab2b8c0fee C:\WINDOWS\$NtServicePackUninstall$\tcpip.sys
2004-08-03 23:14 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\$NtUninstallKB893066$\tcpip.sys
2004-03-19 15:43 332928 244a2f9816bc9b593957281ef577d976 C:\WINDOWS\$NtUninstallKB893066_0$\tcpip.sys
2005-05-25 12:04 359808 88763a98a4c26c409741b4aa162720c9 C:\WINDOWS\$NtUninstallKB913446$\tcpip.sys
2006-01-12 19:28 359808 583e063fdc888ca30d05c2724b0d7ef4 C:\WINDOWS\$NtUninstallKB917953$\tcpip.sys
2006-04-20 04:51 359808 1dbf125862891817f374f407626967f4 C:\WINDOWS\$NtUninstallKB941644$\tcpip.sys
2004-08-03 23:14 359040 1745b00fc1141404b28f4b94f69a8871 C:\WINDOWS\ServicePackFiles\i386\tcpip.sys
2007-10-30 10:20 360064 ecf02439fd31bbd0dbc2ec05600cf08a C:\WINDOWS\SYSTEM32\DLLCACHE\tcpip.sys
2007-10-30 10:20 360064 ecf02439fd31bbd0dbc2ec05600cf08a C:\WINDOWS\SYSTEM32\DRIVERS\tcpip.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [2004-04-27 16:23 1863680]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-10-19 09:59 126976]
"PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2004-04-11 18:15 290816]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2004-07-14 21:32 77824]
"MimBoot"="C:\PROGRA~1\MUSICM~1\MUSICM~2\mimboot.exe" [2006-01-19 12:06 11776]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-03-07 14:02 53408]
"vptray"="C:\PROGRA~1\SYMANT~1\\vptray.exe" [2006-03-17 06:34 124656]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 02:25 6731312]
"taskmon"="C:\WINDOWS\taskmon.exe" [ ]
"UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe" [2008-02-29 22:10 15872]
"ldhtlddd"="C:\DOCUME~1\DRBOB~1\LOCALS~1\Temp\dlthpththtp.dll" [2008-03-18 17:54 112640]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2000-01-21 01:15:54 65588]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]
"tppldldl"= rundll32.exe "C:\WINDOWS\system32\thpltllldh.dll" WLEntryPoint

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Yahoo!\\Yahoo! Music Jukebox\\YahooMusicEngine.exe"=
"C:\\DOCUME~1\\DRBOB~1\\LOCALS~1\\Temp\\services.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"44013:TCP"= 44013:TCP:@xpsp2res.dll,-22005
"7120:TCP"= 7120:TCP:@xpsp2res.dll,-22005
"36479:TCP"= 36479:TCP:@xpsp2res.dll,-22005
"19802:TCP"= 19802:TCP:@xpsp2res.dll,-22005

S2 PolicyAgentSpooler;IPSEC Services PolicyAgentSpooler;C:\WINDOWS\system32\actmovieb.exe [2008-03-06 16:36]
S2 SamSsRasMan;Security Accounts Manager SamSsRasMan;C:\WINDOWS\system32\Adobeo.exe [2008-03-06 09:12]
S2 SENSMSDTC;System Event Notification SENSMSDTC;C:\WINDOWS\system32\amstreamt.exe [2008-03-06 16:36]
S3 FILEMON;FILEMON;C:\WINDOWS\SYSTEM32\DRIVERS\FILEM.SYS []
S3 Mp3Drv;Music Box MP3 Player Control Driver;C:\WINDOWS\system32\Drivers\Mp3Drv.sys []

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-18 17:54:54
Windows 5.1.2600 Service Pack 2 NTFS

detected NTDLL code modification:
ZwEnumerateKey, ZwEnumerateValueKey, ZwQueryDirectoryFile, ZwQuerySystemInformation

scanning hidden processes …

C:\WINDOWS\system32\.e0c72f57\e0c72f57.exe [1736]
? [1808]
scanning hidden autostart entries …

scanning hidden files …

C:\WINDOWS\system32\.e0c72f57

scan completed successfully
hidden files: 1

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\e0c72f57]
"ImagePath"="C:\WINDOWS\system32\.e0c72f57\e0c72f57.exe"
.
——————— DLLs Loaded Under Running Processes ———————

PROCESS: C:\WINDOWS\explorer.exe [6.00.2900.3156]
-> C:\Program Files\Unlocker\UnlockerHook.dll
-> C:\WINDOWS\system32\.e0c72f57\e0c72f57.core.dll
.
———————— Other Running Processes ————————
.
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Windows Media Player\WMPNetwk.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mim.exe
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\MMDiag.exe
.
**************************************************************************
.
Completion time: 2008-03-18 18:05:10 - machine was rebooted [Dr Bob]
ComboFix-quarantined-files.txt 2008-03-19 01:04:58
.
2008-02-14 02:20:44 — E O F —


///////////////////////////////////////////////////////////////////////////////////////////////////////

Logfile of HijackThis v1.99.1
Scan saved at 6:14:18 PM, on 3/18/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mim.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\MMDiag.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Dr Bob\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/mywaybiz
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\DOCUME~1\DRBOB~1\LOCALS~1\Temp\services.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~2\mimboot.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\\vptray.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [taskmon] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [hdpphdll] rundll32.exe "C:\DOCUME~1\DRBOB~1\LOCALS~1\Temp\hhlthl.sys" WLEntryPoint
O4 - HKLM\..\Run: [Streams Drivers] C:\DOCUME~1\DRBOB~1\LOCALS~1\Temp\services.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Open Picture in &Microsoft; PhotoDraw - res://C:\PROGRA~1\MICROS~4\Office\1033\phdintl.dll/phdContext.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O10 - Unknown file in Winsock LSP: c:\windows\system32\epknatsr.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\epknatsr.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://support2.charter.com/sdccommon/download/tgctlcm.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {9E58D78E-C5D3-DCF5-F38E-D1FBF76F5CBA} (MNPerformer Class) - http://www.charter.net/files/musicnet/down…merSetup-sa.exe
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://symantec.webex.com/client/T23L/support/ieatgpc.cab
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Application Layer Gateway Service (ALG) - Unknown owner - C:\WINDOWS\System32\alg.exe (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: IPSEC Services PolicyAgentSpooler (PolicyAgentSpooler) - Unknown owner - C:\WINDOWS\system32\actmovieb.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

///////////////////////////////////////////////////////////////////////////////////////////////////////

Thank you for your help. I will be sure to get a contribution for your service from the good Doctor. :thumbup:

Robert
Post #6
Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\WINDOWS\SYSTEM32\tptdtlhhldd.sys
C:\WINDOWS\SYSTEM32\tpthpdtdpp.dll
C:\WINDOWS\SYSTEM32\hddtplhppd.nls
C:\WINDOWS\SYSTEM32\thpltllldh.dll
C:\WINDOWS\SYSTEM32\ttdhlddh.drv
C:\WINDOWS\SYSTEM32\3121637998.dat
C:\WINDOWS\SYSTEM32\delself.bat
C:\WINDOWS\SYSTEM32\amstreamt.exe
C:\WINDOWS\SYSTEM32\actmovieb.exe
C:\WINDOWS\SYSTEM32\Adobeo.exe
C:\WINDOWS\SYSTEM32\adsmsextp.exe
C:\WINDOWS\mrofinu27.exe.tmp
C:\WINDOWS\Topo3.ini
C:\WINDOWS\SYSTEM32\retgj.dll
C:\kyjfu.exe
C:\muemoh.exe
C:\mtofsrip.exe
C:\WINDOWS\dnbq.exe
C:\WINDOWS\acs.exe
C:\sltbtpbr.exe
C:\WINDOWS\qkjc.exe
C:\WINDOWS\xszxy.exe~
C:\WINDOWS\SYSTEM32\wind32.exe
C:\WINDOWS\trashicon.exe
C:\WINDOWS\wndsk.dll
C:\tlmnmae.exe
C:\euyh.exe
C:\WINDOWS\system32\drivers\spools.exe
C:\mbjuwp.exe
C:\DOCUME~1\DRBOB~1\LOCALS~1\Temp\dlthpththtp.dll
C:\DOCUME~1\DRBOB~1\LOCALS~1\Temp\services.exe
C:\WINDOWS\system32\.e0c72f57\e0c72f57.exe
C:\WINDOWS\system32\.e0c72f57\e0c72f57.core.dll

Folder::
C:\Documents and Settings\Dr Bob\Application Data\EasySpywareCleaner.com

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]
"tppldldl"=-

Save this as Save this as "CFScript"


[external image: Posted Image]

Drag CFScript.txt into ComboFix.exe

Then post the results log and a new HijackThis log.


Also please describe how your computer behaves at the moment.
Post #7 last edited
I just talked with my brother-in-law and here is the results hge gave to me. The PC is running slow but seems to boot up properly. There are no instances of errors. I saved the CFScript.txt as instructed. It was saved to the desktop of the infected PC. It was dragged and dropped onto the ComboFix.exe. The program started to run and hung at the handle.dll. The PC was left running overnight until about 8:30 AM this morning. When my brother-in-law returned to the office the PC was still hung at the handle.dll screen with a blinking cursor. He left the PC running and will not return to the office until Monday, March 24, 2008. Clueless in Oregon Robert
Post #8
It should only take 20-30 mins. It's hung-up so it needs restarted. If he hasn't unplug the internet connection he should do that. Then try it again.
Post #9
I will have him restart the PC and try again. I did make sure that he unplugged the network cable. I also informed him to move away from the PC once the program starts running and requires no other user intervention. :unsure: I will have him try this again on Monday. Thanks for your help. Robert
Post #11
If it still hangs: This time round, take a peek at task manager. When it hangs, see which process is running in task manager. Examples of such processes. * Any process with cfexe file extensions * FindStr.exe * Regsvr32.exe Note down the name of the process before ending task. CF should then be able to complete. Right Click on the running process and select end.
Post #14
The ComboFix finally ran to completion. A process was ended but as it would be the name of the process was not written down. Sorry about that. I will make note to record the processes ended if we need to run again. The PC was still running slow and now shows an error opening C:\DOCUME~1\DRBOB~1\LOCALS~1\Temp\rundll32.exe. The current ComboFix1 and HiJackThis logs follow.

ComboFix running the CFScript

ComboFix 08-03-17.1 - Dr Bob 2008-03-24 16:38:57.9 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.69 [GMT -7:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Dr Bob\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\DOCUME~1\DRBOB~1\LOCALS~1\Temp\dlthpththtp.dll
C:\DOCUME~1\DRBOB~1\LOCALS~1\Temp\services.exe
C:\euyh.exe
C:\kyjfu.exe
C:\mbjuwp.exe
C:\mtofsrip.exe
C:\muemoh.exe
C:\sltbtpbr.exe
C:\tlmnmae.exe
C:\WINDOWS\acs.exe
C:\WINDOWS\dnbq.exe
C:\WINDOWS\mrofinu27.exe.tmp
C:\WINDOWS\qkjc.exe
C:\WINDOWS\system32\.e0c72f57\e0c72f57.core.dll
C:\WINDOWS\system32\.e0c72f57\e0c72f57.exe
C:\WINDOWS\SYSTEM32\3121637998.dat
C:\WINDOWS\SYSTEM32\actmovieb.exe
C:\WINDOWS\SYSTEM32\Adobeo.exe
C:\WINDOWS\SYSTEM32\adsmsextp.exe
C:\WINDOWS\SYSTEM32\amstreamt.exe
C:\WINDOWS\SYSTEM32\delself.bat
C:\WINDOWS\system32\drivers\spools.exe
C:\WINDOWS\SYSTEM32\hddtplhppd.nls
C:\WINDOWS\SYSTEM32\retgj.dll
C:\WINDOWS\SYSTEM32\thpltllldh.dll
C:\WINDOWS\SYSTEM32\tptdtlhhldd.sys
C:\WINDOWS\SYSTEM32\tpthpdtdpp.dll
C:\WINDOWS\SYSTEM32\ttdhlddh.drv
C:\WINDOWS\SYSTEM32\wind32.exe
C:\WINDOWS\Topo3.ini
C:\WINDOWS\trashicon.exe
C:\WINDOWS\wndsk.dll
C:\WINDOWS\xszxy.exe~
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\DOCUME~1\DRBOB~1\LOCALS~1\Temp\services.exe
C:\WINDOWS\SYSTEM32\3121637998.dat
C:\WINDOWS\SYSTEM32\actmovieb.exe
.
—- Previous Run ——-
.
C:\DOCUME~1\DRBOB~1\LOCALS~1\Temp\services.exe
C:\Documents and Settings\Dr Bob\Application Data\EasySpywareCleaner.com
C:\euyh.exe
C:\kyjfu.exe
C:\mbjuwp.exe
C:\mtofsrip.exe
C:\muemoh.exe
C:\sltbtpbr.exe
C:\tlmnmae.exe
C:\WINDOWS\acs.exe
C:\WINDOWS\dnbq.exe
C:\WINDOWS\mrofinu27.exe.tmp
C:\WINDOWS\qkjc.exe
C:\WINDOWS\system32\.e0c72f57\e0c72f57.core.dll
C:\WINDOWS\system32\.e0c72f57\e0c72f57.exe
C:\WINDOWS\SYSTEM32\3121637998.dat
C:\WINDOWS\SYSTEM32\actmovieb.exe
C:\WINDOWS\SYSTEM32\Adobeo.exe
C:\WINDOWS\SYSTEM32\adsmsextp.exe
C:\WINDOWS\SYSTEM32\amstreamt.exe
C:\WINDOWS\SYSTEM32\delself.bat
C:\WINDOWS\system32\drivers\spools.exe
C:\WINDOWS\SYSTEM32\hddtplhppd.nls
C:\WINDOWS\SYSTEM32\retgj.dll
C:\WINDOWS\SYSTEM32\tptdtlhhldd.sys
C:\WINDOWS\SYSTEM32\tpthpdtdpp.dll
C:\WINDOWS\SYSTEM32\ttdhlddh.drv
C:\WINDOWS\SYSTEM32\wind32.exe
C:\WINDOWS\Topo3.ini
C:\WINDOWS\trashicon.exe
C:\WINDOWS\wndsk.dll
C:\WINDOWS\xszxy.exe~

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_PolicyAgentSpooler
——-\Legacy_SamSsRasMan
——-\Legacy_SENSMSDTC
——-\e0c72f57
——-\PolicyAgentSpooler
——-\SamSsRasMan
——-\SENSMSDTC


((((((((((((((((((((((((( Files Created from 2008-02-24 to 2008-03-24 )))))))))))))))))))))))))))))))
.

2008-03-24 16:44 . 2008-03-24 16:42 112,640 –a—— C:\WINDOWS\SYSTEM32\ttlplhhthl.dll
2008-03-21 08:15 . 2008-03-21 08:15 112,640 –a—— C:\WINDOWS\SYSTEM32\tpppphptltl.nls
2008-03-20 21:20 . 2008-03-20 21:20 112,640 –a—— C:\WINDOWS\SYSTEM32\thhplltlpdt.drv
2008-03-20 20:14 . 2008-03-20 17:06 112,640 –a—— C:\WINDOWS\SYSTEM32\pdlllldtpdl.sys
2008-03-20 17:06 . 2008-03-20 17:06 80,801 –a—— C:\catchme2008-03-20_201530.53.zip
2008-03-20 17:03 . 2008-03-20 16:57 112,640 –a—— C:\WINDOWS\SYSTEM32\tphltpldhp.sys
2008-03-20 17:03 . 2008-03-20 17:03 112,640 –a—— C:\WINDOWS\SYSTEM32\dtltttdptpd.drv
2008-03-20 17:01 . 2008-03-20 16:57 112,640 –a—— C:\WINDOWS\SYSTEM32\ldhtthhddll.nls
2008-03-20 16:57 . 2008-03-20 16:57 112,640 –a—— C:\WINDOWS\SYSTEM32\hthddphd.dll
2008-03-20 16:57 . 2008-03-20 16:57 127 –a—— C:\WINDOWS\SYSTEM32\MRT.INI
2008-03-18 18:38 . 2008-03-18 18:38 22,016 –ahs—- C:\WINDOWS\SYSTEM32\APCUPSn.dll
2008-03-10 19:44 . 2008-03-10 20:01 d——– C:\Program Files\Unlocker
2008-03-09 13:49 . 2008-03-09 13:49 d——– C:\Documents and Settings\Dr Bob\Application Data\Talkback
2008-03-09 12:48 . 2008-03-10 19:25 d——– C:\Program Files\Spyware Doctor
2008-03-09 12:48 . 2008-03-10 19:25 d-a—— C:\Documents and Settings\All Users\Application Data\TEMP
2008-03-09 12:31 . 2008-03-09 12:31 d——– C:\Program Files\CCleaner
2008-03-06 09:12 . 2008-03-06 09:12 d——– C:\Documents and Settings\Sandi\Application Data\Grisoft
2008-03-06 09:03 . 2008-03-20 17:02 d–h—– C:\WINDOWS\SYSTEM32\.e0c72f57
2008-03-04 20:10 . 2008-03-04 20:10 d——– C:\Documents and Settings\Dr Bob\Application Data\Grisoft
2008-03-04 20:08 . 2008-03-04 20:08 d——– C:\Documents and Settings\All Users\Application Data\Grisoft
2008-03-04 20:08 . 2007-05-30 05:10 10,872 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\AvgAsCln.sys
2008-03-02 13:19 . 2008-03-02 13:19 d——– C:\Program Files\Lavasoft
2008-03-02 13:19 . 2008-03-02 13:20 d——– C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-03-02 13:18 . 2008-03-10 16:21 d——– C:\Program Files\Common Files\Wise Installation Wizard
2008-03-02 13:08 . 2008-03-09 10:59 77,383 –a—— C:\WINDOWS\SYSTEM32\atasnt40.dll
2008-03-02 13:08 . 2008-03-02 13:08 51,304 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\atnt40k.sys
2008-03-02 12:22 . 2008-03-02 12:22 d——– C:\Documents and Settings\Dr Bob\Application Data\BrowserObjects
2008-03-02 12:22 . 2008-03-02 12:22 d——– C:\Documents and Settings\Dr Bob\Application Data\Autorun
2008-03-02 12:16 . 2008-03-09 16:41 11,776 –a—— C:\WINDOWS\SYSTEM32\WLCtrl32.dl_
2008-03-02 12:10 . 2008-03-02 12:10 80,627 –a—— C:\38.tmp
2008-03-02 12:10 . 2008-03-02 12:10 540 –a—— C:\39.tmp
2008-03-02 12:10 . 2008-03-02 12:10 0 –a—— C:\37.tmp
2008-03-02 12:10 . 2008-03-02 12:10 0 –a—— C:\36.tmp
2008-03-02 12:10 . 2008-03-02 12:10 0 –a—— C:\35.tmp
2008-03-02 12:10 . 2008-03-02 12:10 0 –a—— C:\34.tmp
2008-03-02 12:10 . 2008-03-02 12:10 0 –a—— C:\33.tmp
2008-03-02 12:10 . 2008-03-02 12:10 0 –a—— C:\32.tmp
2008-03-02 12:10 . 2008-03-02 12:10 0 –a—— C:\31.tmp
2008-03-02 12:10 . 2008-03-02 12:10 0 –a—— C:\30.tmp
2008-03-02 12:05 . 2008-03-02 12:05 d——– C:\WINDOWS\noscavow
2008-03-02 11:57 . 2008-03-09 16:40 11,776 –a—— C:\WINDOWS\SYSTEM32\WLCtrl32.dll
2008-02-25 14:39 . 2008-02-25 14:41 d——– C:\Rlisys pre-reinstall 02.28.08
2008-02-25 14:37 . 2008-02-25 14:37 60,968 –a—— C:\Documents and Settings\Dr Bob\GoToAssistDownloadHelper.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-05 04:25 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-03-03 19:01 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2008-03-03 15:34 ——— d—–w C:\Program Files\Symantec AntiVirus
2004-07-26 18:46 520,192 —-a-w C:\Documents and Settings\Rosa\chatlnk.exe
.

——- Sigcheck ——-

2005-03-13 17:55 359808 0e66b538096a6529d1ac66e78eb0d5c8 C:\WINDOWS\$hf_mig$\KB893066\SP2GDR\tcpip.sys
2005-05-25 12:07 359936 63fdfea54eb53de2d863ee454937ce1e C:\WINDOWS\$hf_mig$\KB893066\SP2QFE\tcpip.sys
2006-01-13 10:07 360448 5562cc0a47b2aef06d3417b733f3c195 C:\WINDOWS\$hf_mig$\KB913446\SP2QFE\tcpip.sys
2006-04-20 05:18 360576 b2220c618b42a2212a59d91ebd6fc4b4 C:\WINDOWS\$hf_mig$\KB917953\SP2QFE\tcpip.sys
2007-10-30 09:53 360832 64798ecfa43d78c7178375fcdd16d8c8 C:\WINDOWS\$hf_mig$\KB941644\SP2QFE\tcpip.sys
2005-02-22 19:00 339968 466cbd4831e80729173654ab2b8c0fee C:\WINDOWS\$NtServicePackUninstall$\tcpip.sys
2004-08-03 23:14 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\$NtUninstallKB893066$\tcpip.sys
2004-03-19 15:43 332928 244a2f9816bc9b593957281ef577d976 C:\WINDOWS\$NtUninstallKB893066_0$\tcpip.sys
2005-05-25 12:04 359808 88763a98a4c26c409741b4aa162720c9 C:\WINDOWS\$NtUninstallKB913446$\tcpip.sys
2006-01-12 19:28 359808 583e063fdc888ca30d05c2724b0d7ef4 C:\WINDOWS\$NtUninstallKB917953$\tcpip.sys
2006-04-20 04:51 359808 1dbf125862891817f374f407626967f4 C:\WINDOWS\$NtUninstallKB941644$\tcpip.sys
2004-08-03 23:14 359040 1745b00fc1141404b28f4b94f69a8871 C:\WINDOWS\ServicePackFiles\i386\tcpip.sys
2007-10-30 10:20 360064 ecf02439fd31bbd0dbc2ec05600cf08a C:\WINDOWS\SYSTEM32\DLLCACHE\tcpip.sys
2007-10-30 10:20 360064 ecf02439fd31bbd0dbc2ec05600cf08a C:\WINDOWS\SYSTEM32\DRIVERS\tcpip.sys
.
((((((((((((((((((((((((((((( snapshot@2008-03-18_18.04.11.59 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-02-04 23:09:46 18,214,008 —-a-w C:\WINDOWS\SYSTEM32\MRT.exe
+ 2008-03-05 16:30:54 19,148,408 —-a-w C:\WINDOWS\SYSTEM32\MRT.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [2004-04-27 16:23 1863680]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-10-19 09:59 126976]
"PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2004-04-11 18:15 290816]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2004-07-14 21:32 77824]
"MimBoot"="C:\PROGRA~1\MUSICM~1\MUSICM~2\mimboot.exe" [2006-01-19 12:06 11776]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-03-07 14:02 53408]
"vptray"="C:\PROGRA~1\SYMANT~1\\vptray.exe" [2006-03-17 06:34 124656]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 02:25 6731312]
"taskmon"="C:\WINDOWS\taskmon.exe" [ ]
"UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe" [2008-02-29 22:10 15872]
"tpplpdpd"="C:\DOCUME~1\DRBOB~1\LOCALS~1\Temp\dhddlt.nls WLEntryPoint" [ ]
"pllltptl"="C:\DOCUME~1\DRBOB~1\LOCALS~1\Temp\dhddlt.nls WLEntryPoint" [ ]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2000-01-21 01:15:54 65588]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]
"lthhddht"= rundll32.exe "C:\WINDOWS\system32\hthddphd.dll" WLEntryPoint

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Yahoo!\\Yahoo! Music Jukebox\\YahooMusicEngine.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"36089:TCP"= 36089:TCP:@xpsp2res.dll,-22005
"49900:TCP"= 49900:TCP:@xpsp2res.dll,-22005
"20763:TCP"= 20763:TCP:@xpsp2res.dll,-22005
"2694:TCP"= 2694:TCP:@xpsp2res.dll,-22005

S3 FILEMON;FILEMON;C:\WINDOWS\SYSTEM32\DRIVERS\FILEM.SYS []
S3 Mp3Drv;Music Box MP3 Player Control Driver;C:\WINDOWS\system32\Drivers\Mp3Drv.sys []

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-24 16:56:35
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

PROCESS: C:\WINDOWS\explorer.exe [6.00.2900.3156]
-> C:\Program Files\Unlocker\UnlockerHook.dll
.
———————— Other Running Processes ————————
.
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Windows Media Player\WMPNetwk.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mim.exe
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\MMDiag.exe
.
**************************************************************************
.
Completion time: 2008-03-24 17:03:14 - machine was rebooted [Dr Bob]
ComboFix-quarantined-files.txt 2008-03-25 00:03:08
ComboFix2.txt 2008-03-19 01:05:11
.
2008-03-20 23:57:13 — E O F —

////////////////////////

HiJackThis log

Logfile of HijackThis v1.99.1
Scan saved at 5:14:58 PM, on 3/24/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mim.exe
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\MMDiag.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Dr Bob\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/mywaybiz
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~2\mimboot.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\\vptray.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [taskmon] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [tpplpdpd] rundll32.exe "C:\DOCUME~1\DRBOB~1\LOCALS~1\Temp\dhddlt.nls" WLEntryPoint
O4 - HKLM\..\Run: [pllltptl] rundll32.exe "C:\DOCUME~1\DRBOB~1\LOCALS~1\Temp\hlltlhplthh.drv" WLEntryPoint
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Open Picture in &Microsoft PhotoDraw - res://C:\PROGRA~1\MICROS~4\Office\1033\phdintl.dll/phdContext.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O10 - Unknown file in Winsock LSP: c:\windows\system32\epknatsr.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\epknatsr.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://support2.charter.com/sdccommon/download/tgctlcm.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {9E58D78E-C5D3-DCF5-F38E-D1FBF76F5CBA} (MNPerformer Class) - http://www.charter.net/files/musicnet/down…merSetup-sa.exe
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://symantec.webex.com/client/T23L/support/ieatgpc.cab
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Application Layer Gateway Service (ALG) - Unknown owner - C:\WINDOWS\System32\alg.exe (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

////////////////////////

Thanks for your help
Robert
Post #15
The infection you have can cause you to lose your internet connection.
If you lose your internet connection, just run lspfix again.
Start the program and then check the I know what I'm doing box.


First:

Download LSPfix here: http://www.cexx.org/lspfix.htm

Start the program and then check the I know what I'm doing box.

Move all instances of 'epknatsr.dll' (and nothing else), to the Remove pane.
Click the Finish Button and reboot.

Find and delete the file c:\windows\system32\epknatsr.dll

Next:


Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\WINDOWS\SYSTEM32\ttlplhhthl.dll
C:\WINDOWS\SYSTEM32\tpppphptltl.nls
C:\WINDOWS\SYSTEM32\thhplltlpdt.drv
C:\WINDOWS\SYSTEM32\pdlllldtpdl.sys
C:\WINDOWS\SYSTEM32\tphltpldhp.sys
C:\WINDOWS\SYSTEM32\dtltttdptpd.drv
C:\WINDOWS\SYSTEM32\ldhtthhddll.nls
C:\WINDOWS\SYSTEM32\hthddphd.dll
C:\WINDOWS\SYSTEM32\APCUPSn.dll
C:\38.tmp
C:\39.tmp
C:\37.tmp
C:\36.tmp
C:\35.tmp
C:\34.tmp
C:\33.tmp
C:\32.tmp
C:\31.tmp
C:\30.tmp
C:\WINDOWS\taskmon.exe
C:\DOCUME~1\DRBOB~1\LOCALS~1\Temp\dhddlt.nls WLEntryPoint
C:\DOCUME~1\DRBOB~1\LOCALS~1\Temp\dhddlt.nls 

Folder::
C:\WINDOWS\SYSTEM32\.e0c72f57
C:\WINDOWS\noscavow

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"taskmon"=-
"tpplpdpd"=-
"pllltptl"=-
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]
"lthhddht"=-

Save this as Save this as "CFScript"


[external image: Posted Image]

Drag CFScript.txt into ComboFix.exe

Then post the results log and a new HijackThis log.


Also please describe how your computer behaves at the moment.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI