[Resolved] csrssc.exe and other problems

Hi KathyB
Welcome to the What the tech Forums
My name is mschroe919 and I am going to read your log.
I would like to help you So if you would….
Please be patient and I will be back as soon as possible.

Please while I am gone do these step:

FIRST:

Important Read:
You are running HijackThis from Temp\Temporary Directory
This will not work you need it in a stand alone file.

Important: Create a folder on the C: drive called C:\HJT.
You can do this by going to My Computer (Windows key+e) then double click on C: then right click and select New then Folder and name it HJT.

Download HijackThis into this folder.

Link to Hijack This! v 1.99.1:
http://spywarewarrior.com/files/HijackThis.exe

Run it from that folder.

Click "Do a system scan and save a log file".
Post the new log here.

DO NOT "FIX" ANYTHING WITH IT YET!!!
FIXING THE WRONG THING COULD RENDER YOUR SYSTEM INOPERABLE!!!

NEXT:

Show hidden files, Here is how:

Windows XP

* Click Start.
* Open My Computer.
* Select the Tools menu and click Folder Options.
* Select the View Tab.
* Under the Hidden files and folders heading select Show hidden files and folders.
* Uncheck the Hide protected operating system files (recommended) option.
* Click Yes to confirm.
* Click OK.

NEXT:

Please download ATF Cleaner by Atribune.

Download it

HERE


This program is for XP and Windows 2000 only
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

NEXT:

Please download Malwarebytes' Anti-Malware to your desktop:

HERE

* Double-click mbam-setup.exe and follow the prompts to install the program.
* Be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform FULL SCAN, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad. Please save it to a convenient location. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt
post a new scanner{HJT] log and the Malwarebytes' Anti-Malware log

Be sure not to delete anything intill said ok to. also don't run any other cleanup programs till we
get done it may goof ours up.
Also if you have any questions feel fre to ask first.

When you post another rhjt log and the Malwarebytes' Anti-Malware log , let me know how your PC is behavuing

I will be waiting to see new logs
mschroe919

Is there a reason we are not using Trend Micro HijackThis v2.0.2?

Malwarebytes starts scanning and finds at least 71 infected objects. Then it stops and I get the following error message. "Malwarebytes' Anti-Malware has encountered a problem and needs to close." I'm still in Safe mode. Do I need to boot up regularly to do this scan? Kat

Hello Mschroe919! :-) I got a Malwarebyte log by doing a quick scan. Here's the bad news: Malwarebytes' Anti-Malware 1.12 Database version: 744 Scan type: Quick Scan Objects scanned: 40894 Time elapsed: 4 minute(s), 22 second(s) Memory Processes Infected: 1 Memory Modules Infected: 3 Registry Keys Infected: 48 Registry Values Infected: 17 Registry Data Items Infected: 3 Folders Infected: 10 Files Infected: 63 Memory Processes Infected: c:\WINDOWS\system32\drivers\spools.exe (Trojan.Agent) -> No action taken. Memory Modules Infected: C:\WINDOWS\system32\ssqOEXoM.dll (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\awttSLff.dll (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\nvrsma.dll (Trojan.Agent) -> No action taken. Registry Keys Infected: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\schedule (Trojan.Agent) -> No action taken. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\schedule (Trojan.Agent) -> No action taken. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\schedule (Trojan.Agent) -> No action taken. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\schedule (Trojan.Agent) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{440bf2a5-054b-4991-b3d8-e28dab4a88af} (Trojan.Vundo) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{440bf2a5-054b-4991-b3d8-e28dab4a88af} (Trojan.Vundo) -> No action taken. HKEY_CLASSES_ROOT\Interface\{e4e3e0f8-cd30-4380-8ce9-b96904bdefca} (Adware.PopCap) -> No action taken. HKEY_CLASSES_ROOT\Interface\{fe8a736f-4124-4d9c-b4b1-3b12381efabe} (Adware.PopCap) -> No action taken. HKEY_CLASSES_ROOT\Typelib\{c9c5deaf-0a1f-4660-8279-9edfad6fefe1} (Adware.PopCap) -> No action taken. HKEY_CLASSES_ROOT\popcaploader.popcaploaderctrl2 (Adware.PopCap) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{df780f87-ff2b-4df8-92d0-73db16a1543a} (Adware.PopCap) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{df780f87-ff2b-4df8-92d0-73db16a1543a} (Adware.PopCap) -> No action taken. HKEY_CLASSES_ROOT\popcaploader.popcaploaderctrl2.1 (Adware.PopCap) -> No action taken. HKEY_CLASSES_ROOT\Interface\{04a38f6b-006f-4247-ba4c-02a139d5531c} (Adware.Minibug) -> No action taken. HKEY_CLASSES_ROOT\Typelib\{3c2d2a1e-031f-4397-9614-87c932a848e0} (Adware.Minibug) -> No action taken. HKEY_CLASSES_ROOT\minibugtransporter.minibugtransporterx (Adware.Minibug) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{2b96d5cc-c5b5-49a5-a69d-cc0a30f9028c} (Adware.Minibug) -> No action taken. HKEY_CLASSES_ROOT\minibugtransporter.minibugtransporterx.1 (Adware.Minibug) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{c5af49a2-94f3-42bd-f434-2604812c897d} (Trojan.Agent) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c5af49a2-94f3-42bd-f434-2604812c897d} (Trojan.Agent) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{b9ab28fa-ed73-4e5e-ba11-0925d85120d1} (Trojan.Vundo) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b9ab28fa-ed73-4e5e-ba11-0925d85120d1} (Trojan.Vundo) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\awttslff (Trojan.Vundo) -> No action taken. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\pjsapdg (Backdoor.Rustock) -> No action taken. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\pjsapdg (Backdoor.Rustock) -> No action taken. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\pjsapdg (Backdoor.Rustock) -> No action taken. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pjsapdg (Backdoor.Rustock) -> No action taken. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\new_drv (Rootkit.Agent) -> No action taken. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\new_drv (Rootkit.Agent) -> No action taken. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\new_drv (Rootkit.Agent) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Malware.Trace) -> No action taken. HKEY_CURRENT_USER\Software\Adsl Software Limited (Rogue.MalWarrior) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{36be5ed1-916f-4448-b9c3-b8aaed979da9} (Trojan.FakeAlert) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{4b4aef35-a6ed-44f9-bab8-1a503f485c74} (Trojan.FakeAlert) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{2b99c85c-1a51-4117-b481-bea6f99d2bbf} (Trojan.FakeAlert) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{58a17a05-270c-4762-ab86-431018487cc5} (Trojan.FakeAlert) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\webvideo (Trojan.FakeAlert) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{8b010818-7705-4cdc-977a-5882ec214bdf} (Trojan.FakeAlert) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{a9a9b2a5-8a50-4c4f-a395-ad905d31a0b1} (Trojan.FakeAlert) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{631b47a3-474e-4850-97fb-9e7461efc4b2} (Trojan.FakeAlert) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{631b47a3-474e-4850-97fb-9e7461efc4b2} (Trojan.FakeAlert) -> No action taken. HKEY_CLASSES_ROOT\pvnsmfor.bvfx (Trojan.FakeAlert) -> No action taken. HKEY_CLASSES_ROOT\pvnsmfor.bwgs (Trojan.FakeAlert) -> No action taken. HKEY_CLASSES_ROOT\pvnsmfor.toolbar.1 (Trojan.FakeAlert) -> No action taken. HKEY_CLASSES_ROOT\MSVPS.MSVPSApp (Trojan.FakeAlert) -> No action taken. Registry Values Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ntuser (Trojan.Agent) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ntuser (Trojan.Agent) -> No action taken. HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ntuser (Trojan.Agent) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\73bc44f8 (Trojan.Vundo) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autoload (Trojan.Agent) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autoload (Trojan.Agent) -> No action taken. HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autoload (Trojan.Agent) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{c5af49a2-94f3-42bd-f434-2604812c897d} (Trojan.Agent) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{b9ab28fa-ed73-4e5e-ba11-0925d85120d1} (Trojan.Vundo) -> No action taken. HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\inetchk (Trojan.Agent) -> No action taken. HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\ttool (Trojan.Agent) -> No action taken. HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\jdgf894jrghoiiskd (Trojan.Agent) -> No action taken. HKEY_CLASSES_ROOT\TacOnlyOne\MalWarrior (Rogue.MalWarrior) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\vbksrofa (Trojan.FakeAlert) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{2b99c85c-1a51-4117-b481-bea6f99d2bbf} (Trojan.FakeAlert) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{58a17a05-270c-4762-ab86-431018487cc5} (Trojan.FakeAlert) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\mpfanvqg (Trojan.FakeAlert) -> No action taken. Registry Data Items Infected: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\ssqoexom -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\System (Rootkit.DNSChanger) -> Data: kdpvy.exe -> No action taken. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\ssqoexom -> No action taken. Folders Infected: C:\WINDOWS\privacy_danger (Trojan.FakeAlert) -> No action taken. C:\WINDOWS\privacy_danger\images (Trojan.FakeAlert) -> No action taken. C:\Program Files\Helper (Adware.BHO) -> No action taken. C:\Program Files\SpywareIsolator (Rogue.Spywareisolator) -> No action taken. C:\Documents and Settings\All Users\Application Data\Adsl Software Limited (Rogue.MalWarrior) -> No action taken. C:\Documents and Settings\All Users\Application Data\Adsl Software Limited\MalWarrior 2008 (Rogue.MalWarrior) -> No action taken. C:\Documents and Settings\All Users\Application Data\Adsl Software Limited\MalWarrior 2008\BASE (Rogue.MalWarrior) -> No action taken. C:\Documents and Settings\All Users\Application Data\Adsl Software Limited\MalWarrior 2008\DELETED (Rogue.MalWarrior) -> No action taken. C:\Documents and Settings\All Users\Application Data\Adsl Software Limited\MalWarrior 2008\LOG (Rogue.MalWarrior) -> No action taken. C:\Documents and Settings\All Users\Application Data\Adsl Software Limited\MalWarrior 2008\SAVED (Rogue.MalWarrior) -> No action taken. Files Infected: c:\WINDOWS\system32\drivers\spools.exe (Trojan.Agent) -> No action taken. C:\WINDOWS\system32\byXRKCRK.dll (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\KRCKRXyb.ini (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\KRCKRXyb.ini2 (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\hdbtaicj.dll (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\jciatbdh.ini (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\jkkJbxYr.dll (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\rYxbJkkj.ini (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\rYxbJkkj.ini2 (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\kklmxeqd.dll (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\dqexmlkk.ini (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\ssqOEXoM.dll (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\MoXEOqss.ini (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\MoXEOqss.ini2 (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\ytsvbixl.dll (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\lxibvsty.ini (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\kdpvy.exe (Rootkit.DNSChanger) -> No action taken. C:\Documents and Settings\Administrator\cftmon.exe (Trojan.Agent) -> No action taken. C:\Documents and Settings\LocalService\cftmon.exe (Trojan.Agent) -> No action taken. C:\WINDOWS\Downloaded Program Files\popcaploader.dll (Adware.PopCap) -> No action taken. C:\Program Files\Common Files\Real\WeatherBug\MiniBugTransporter.dll (Adware.Minibug) -> No action taken. C:\WINDOWS\system32\awttSLff.dll (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\ddcdbxu.dll (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\mlJCRjHa.dll (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\ntpl.bin (Trojan.Agent) -> No action taken. C:\WINDOWS\system32\pjsapdg.sys (Backdoor.Rustock) -> No action taken. C:\WINDOWS\new_drv.sys (Rootkit.Agent) -> No action taken. C:\ftklhae.exe (Backdoor.Rustock) -> No action taken. C:\syowpheg.exe (Trojan.Agent) -> No action taken. C:\Documents and Settings\Teresa Lee.YOUR-4DACD0EA75\Local Settings\Temp\csrssc.exe (Trojan.Downloader) -> No action taken. C:\Documents and Settings\Teresa Lee.YOUR-4DACD0EA75\cftmon.exe (Trojan.Agent) -> No action taken. C:\Documents and Settings\Kathleen Monique.YOUR-4DACD0EA75\cftmon.exe (Trojan.Agent) -> No action taken. C:\Documents and Settings\HP_Administrator\cftmon.exe (Trojan.Agent) -> No action taken. C:\WINDOWS\privacy_danger\index.htm (Trojan.FakeAlert) -> No action taken. C:\WINDOWS\privacy_danger\images\capt.gif (Trojan.FakeAlert) -> No action taken. C:\WINDOWS\privacy_danger\images\danger.jpg (Trojan.FakeAlert) -> No action taken. C:\WINDOWS\privacy_danger\images\down.gif (Trojan.FakeAlert) -> No action taken. C:\WINDOWS\privacy_danger\images\spacer.gif (Trojan.FakeAlert) -> No action taken. C:\Documents and Settings\All Users\Application Data\Adsl Software Limited\MalWarrior 2008\Malwarrior.exe (Rogue.MalWarrior) -> No action taken. C:\Documents and Settings\All Users\Application Data\Adsl Software Limited\MalWarrior 2008\LOG\20080510221107734.log (Rogue.MalWarrior) -> No action taken. C:\Documents and Settings\All Users\Application Data\Adsl Software Limited\MalWarrior 2008\LOG\20080510232511187.log (Rogue.MalWarrior) -> No action taken. C:\WINDOWS\9129837.exe (Trojan.Agent) -> No action taken. C:\WINDOWS\system32\nvrsma.dll (Trojan.Agent) -> No action taken. C:\WINDOWS\rs.txt (Malware.Trace) -> No action taken. C:\winxplogon.sys (Fake.Dropped.Malware) -> No action taken. C:\WINDOWS\system32\khfDwuSI.dll (Trojan.Vundo) -> No action taken. C:\WINDOWS\vbksrofa.dll (Trojan.FakeAlert) -> No action taken. C:\WINDOWS\pvnsmfor.dll (Trojan.FakeAlert) -> No action taken. C:\WINDOWS\oadkxrts.exe (Trojan.FakeAlert) -> No action taken. C:\WINDOWS\mpfanvqg.dll (Trojan.FakeAlert) -> No action taken. C:\WINDOWS\fvowketqsle.dll (Trojan.FakeAlert) -> No action taken. C:\Documents and Settings\Teresa Lee.YOUR-4DACD0EA75\Desktop\Spyware&Malware Protection.url (Rogue.Link) -> No action taken. C:\Documents and Settings\Kathleen Monique.YOUR-4DACD0EA75\Desktop\Spyware&Malware Protection.url (Rogue.Link) -> No action taken. C:\Documents and Settings\Teresa Lee.YOUR-4DACD0EA75\Desktop\Privacy Protector.url (Rogue.Link) -> No action taken. C:\Documents and Settings\Kathleen Monique.YOUR-4DACD0EA75\Desktop\Privacy Protector.url (Rogue.Link) -> No action taken. C:\Documents and Settings\Teresa Lee.YOUR-4DACD0EA75\Desktop\Error Cleaner.url (Rogue.Link) -> No action taken. C:\Documents and Settings\Kathleen Monique.YOUR-4DACD0EA75\Desktop\Error Cleaner.url (Rogue.Link) -> No action taken. C:\Documents and Settings\Teresa Lee.YOUR-4DACD0EA75\Favorites\Error Cleaner.url (Rogue.Link) -> No action taken. C:\Documents and Settings\Kathleen Monique.YOUR-4DACD0EA75\Favorites\Error Cleaner.url (Rogue.Link) -> No action taken. C:\Documents and Settings\Teresa Lee.YOUR-4DACD0EA75\Favorites\Privacy Protector.url (Rogue.Link) -> No action taken. C:\Documents and Settings\Kathleen Monique.YOUR-4DACD0EA75\Favorites\Privacy Protector.url (Rogue.Link) -> No action taken. C:\Documents and Settings\Teresa Lee.YOUR-4DACD0EA75\Favorites\Spyware&Malware Protection.url (Rogue.Link) -> No action taken. C:\Documents and Settings\Kathleen Monique.YOUR-4DACD0EA75\Favorites\Spyware&Malware Protection.url (Rogue.Link) -> No action taken.

Hi KathyB

Is there a reason we are not using Trend Micro HijackThis v2.0.2?

This is my fault my canned Download HijackThis into this folder.

Link to Hijack This! v 1.99.1
has the 199.1 should be 2.0.2
This won't present a problem, but you pc is loaded with viruses.
It mig be a good idea if you change and get the newer one. Sorry for the trouble.
NEXT

I'm still in Safe mode. Do I need to boot up regularly to do this scan? Kat

you should run both HJT and Malwarebytes' Anti-Malware in regular mode.
Did your pc start in safe mode or did you make it start there?
NEXT:
Is this the mname of you computer?

YOUR-4DACD0EA75

There is a lot odf work here so I will try to be around all day for you.
good luck mschroe919

When you ran the Malwarebytes' Anti-Malware
Did you do this:

When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.

if not please run again and please do it.
mschroe919

Good Morning Mschroe919! :-) Thanks so much for your help. :-) I was going into safe mode myself. Am in regular mode now and here is the newest Malware Log. Malwarebytes' Anti-Malware 1.12 Database version: 744 Scan type: Quick Scan Objects scanned: 42077 Time elapsed: 5 minute(s), 22 second(s) Memory Processes Infected: 0 Memory Modules Infected: 3 Registry Keys Infected: 5 Registry Values Infected: 1 Registry Data Items Infected: 1 Folders Infected: 0 Files Infected: 6 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: C:\WINDOWS\system32\ssqOEXoM.dll (Trojan.Vundo) -> Unloaded module successfully. C:\WINDOWS\system32\awttSLff.dll (Trojan.Vundo) -> Unloaded module successfully. C:\WINDOWS\system32\nvrsma.dll (Trojan.Agent) -> Unloaded module successfully. Registry Keys Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8d30116e-63f4-4da4-bf19-e078dd5706f4} (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{8d30116e-63f4-4da4-bf19-e078dd5706f4} (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{b9ab28fa-ed73-4e5e-ba11-0925d85120d1} (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b9ab28fa-ed73-4e5e-ba11-0925d85120d1} (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\awttslff (Trojan.Vundo) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{b9ab28fa-ed73-4e5e-ba11-0925d85120d1} (Trojan.Vundo) -> Quarantined and deleted successfully. Registry Data Items Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\System (Rootkit.DNSChanger) -> Data: kdpvy.exe -> Delete on reboot. Folders Infected: (No malicious items detected) Files Infected: C:\WINDOWS\system32\ssqOEXoM.dll (Trojan.Vundo) -> Delete on reboot. C:\WINDOWS\system32\MoXEOqss.ini (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\MoXEOqss.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\kdpvy.exe (Rootkit.DNSChanger) -> Delete on reboot. C:\WINDOWS\system32\awttSLff.dll (Trojan.Vundo) -> Delete on reboot. C:\WINDOWS\system32\nvrsma.dll (Trojan.Agent) -> Delete on reboot. +++++++++++++++ I am working on getting another hijack log for you. In answer to your question about computer name. No, that is not the correct name. The computer name should be TLB-KMB. Thanks, Kat

Hi KathyB

FIRST:

Make sure Internet Explorer isn't open

Run hijackthis again. Hit None of the above,
Click Do a System Scan Only.
Put a Check in the box on the left side on these: (Not to worry if not there)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.trendmicro.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O17 - HKLM\System\CCS\Services\Tcpip\..\{39353CF2-E306-4E98-908C-8583966C496D}: NameServer = 85.255.114.40,85.255.112.134
O17 - HKLM\System\CCS\Services\Tcpip\..\{892900FC-9814-4488-99C0-81491C1EE93D}: NameServer = 85.255.114.40,85.255.112.134
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.114.40 85.255.112.134
O17 - HKLM\System\CS1\Services\Tcpip\..\{34D4AE2D-0B75-4166-8727-548F8D517A49}: NameServer = 85.255.114.40,85.255.112.134

Close ALL windows and browsers except HijackThis and click []b]Fix checked
Then reboot

NEXT:
After reboot post aa new hjt log and let me know how your PC is behaving
good luck mschroe919

I have to go to work now, I will be back after 11PM and work on your instructions. Thank you very much. :-)

Hi KathyB
Hope you didn't work too hard.

NEXT:
Lets try something here to speed up your PC.

First:

Please download System Security Suite. here

.HERE:

Extract it from the zip file into a folder.
.
Run 3S under “Items To Clear” tab place a checkmark in all of them but the last.

then under autorun tasks just lock the ones you don't want to start. Your not deleteing them
just stopping them. You can start them manualy. You can use google to see what every auto run is.
Here are the ones I would lock If you seem like later you want them to start on boot up, you can go back and un lock them.
ARPWRMSG.EXE
HPWuSchd2.exe
realsched.exe
qttask.exe
iTunesHelper.exe
msmsgs.exe
GoogleToolbarNotifier.exe
GoogleUpdater.exe

These programs are not required to start automatically as you can run it when you need to. It is advised that you disable this program so that it does not take up necessary resources.

When you finish these let me know how your pc is doing now, when you post back I will post back to you one more good step to do.

good luck and good night mschroe919

Good Morning Mschroe919, After completing your last instructions the computer is working well. I know 10 kinds of wonderful things are comming your way for all the help you have given me. :-)