[Resolved] Computer completely taken over (page 2)

stryvn

Post #16July 26, 2008, 10:52 AM UTC

File/Folder C:\WINDOWS\SYSTEM32\{89efd5a1-47bf-9a28-47f8-2a59398bc363}.dll-uninst.exe not found.

OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 07262008_054848

;*******************************************************************************
*********************************************************************************
*******************
ANALYSIS: 2008-07-25 18:26:30
PROTECTIONS: 1
MALWARE: 117
SUSPECTS: 1
;*******************************************************************************
*********************************************************************************
*******************
PROTECTIONS
Description Version Active Updated
;===============================================================================
=================================================================================
===================
Avira AntiVir PersonalEdition 8.0.1.15 No Yes
;===============================================================================
=================================================================================
===================
MALWARE
Id Description Type Active Severity Disinfectable Disinfected Location
;===============================================================================
=================================================================================
===================
00013869 adware/cydoor Adware No 0 Yes No hkey_local_machine\software\cydoor
00018331 adware/gator Adware No 0 Yes No c:\windows\gatorpdpsetup.log
00018331 adware/gator Adware No 0 Yes No c:\windows\gatoruninstaller_cme.log
00018331 adware/gator Adware No 0 Yes No c:\windows\gatoruninstaller_cme_u.log
00018331 adware/gator Adware No 0 Yes No c:\windows\gatoruninstaller_gator.log
00018331 adware/gator Adware No 0 Yes No c:\windows\gatoruninstaller_gator_u.log
00018331 adware/gator Adware No 0 Yes No c:\windows\gatoruninstaller_offers.log
00018331 adware/gator Adware No 0 Yes No c:\windows\gatoruninstaller_offers_u.log
00018331 adware/gator Adware No 0 Yes No HKEY_LOCAL_MACHINE\software\classes\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}
00018331 adware/gator Adware No 0 Yes No c:\windows\gatorpatch.log
00018331 adware/gator Adware No 0 Yes No hkey_local_machine\software\gator.com
00018331 adware/gator Adware No 0 Yes No hkey_local_machine\software\gatortest
00018331 adware/gator Adware No 0 Yes No hkey_classes_root\clsid\{21ffb6c0-0da1-11d5-a9d5-00500413153c}
00047660 adware/sqwire Adware No 0 Yes No hkey_local_machine\software\microsoft\windows\currentversion\app management\arpcache\tsa
00097438 adware/helpexpress Adware No 0 Yes No hkey_current_user\software\alset
00097984 Adware/Cydoor Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1770\A0088223.dll
00110532 spyware/clientman Spyware No 1 Yes No HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FCADDC14-BD46-408A-9842-CDBE1C6D37EB}
00120878 Spyware/New.net Spyware No 1 Yes No C:\QooBox\Quarantine\C\WINDOWS\NDNuninstall5_48.exe.vir
00120878 Spyware/New.net Spyware No 1 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1785\A0099683.exe
00123179 Spyware/New.net Spyware No 1 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1770\A0088214.exe
00125533 Adware/Sqwire Adware No 0 Yes No C:\QooBox\Quarantine\C\Program Files\Common Files\fzzi\fzzid\fzzic.dll.vir
00125533 Adware/Sqwire Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1785\A0099701.dll
00136461 Spyware/New.net Spyware No 1 Yes No C:\QooBox\Quarantine\C\WINDOWS\NDNuninstall4_88.exe.vir
00136461 Spyware/New.net Spyware No 1 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1785\A0099679.exe
00136462 Spyware/New.net Spyware No 1 Yes No C:\QooBox\Quarantine\C\WINDOWS\NDNuninstall4_94.exe.vir
00136462 Spyware/New.net Spyware No 1 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1785\A0099680.exe
00136463 Spyware/New.net Spyware No 1 Yes No C:\QooBox\Quarantine\C\WINDOWS\NDNuninstall5_40.exe.vir
00136463 Spyware/New.net Spyware No 1 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1785\A0099682.exe
00136464 Spyware/New.net Spyware No 1 Yes No C:\QooBox\Quarantine\C\WINDOWS\NDNuninstall5_20.exe.vir
00136464 Spyware/New.net Spyware No 1 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1785\A0099681.exe
00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No C:\Documents and Settings\Scott\Cookies\scott@casalemedia[1].txt
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Documents and Settings\Scott\Cookies\scott@doubleclick[1].txt
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Documents and Settings\Jodi\Cookies\jodi@doubleclick[1].txt
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Documents and Settings\Scott\Cookies\system@doubleclick[1].txt
00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\Jodi\Cookies\jodi@atdmt[2].txt
00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\Scott\Cookies\scott@atdmt[2].txt
00139535 Application/Processor HackTools No 0 Yes No C:\SDFix\apps\Process.exe
00139535 Application/Processor HackTools No 0 No No C:\Documents and Settings\Scott\Desktop\extract.exe.exe[SDFix\apps\Process.exe]
00139535 Application/Processor HackTools No 0 No No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1784\A0095449.exe[SDFix\apps\Process.exe]
00139535 Application/Processor HackTools No 0 No No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1785\A0099747.exe[SDFix\apps\Process.exe]
00145069 Spyware/New.net Spyware No 1 Yes No C:\QooBox\Quarantine\C\WINDOWS\NDNuninstall5_64.exe.vir
00145069 Spyware/New.net Spyware No 1 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1785\A0099684.exe
00145069 Spyware/New.net Spyware No 1 Yes No C:\QooBox\Quarantine\C\WINDOWS\NDNuninstall6_10.exe.vir
00145069 Spyware/New.net Spyware No 1 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1785\A0099685.exe
00145069 Spyware/New.net Spyware No 1 Yes No C:\QooBox\Quarantine\C\WINDOWS\NDNuninstall6_22.exe.vir
00145069 Spyware/New.net Spyware No 1 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1785\A0099686.exe
00145405 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Scott\Cookies\scott@247realmedia[1].txt
00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Documents and Settings\Scott\Cookies\scott@fastclick[1].txt
00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No C:\Documents and Settings\Scott\Cookies\scott@tribalfusion[2].txt
00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No C:\Documents and Settings\Scott\Cookies\scott@mediaplex[2].txt
00145807 Cookie/Linksynergy TrackingCookie No 0 Yes No C:\Documents and Settings\Scott\Cookies\scott@linksynergy[1].txt
00147516 Spyware/New.net Spyware No 1 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1785\A0099678.exe
00147516 Spyware/New.net Spyware No 1 Yes No C:\QooBox\Quarantine\C\WINDOWS\NDNuninstall4_80.exe.vir
00157998 Spyware/New.net Spyware No 1 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1785\A0099687.exe
00157998 Spyware/New.net Spyware No 1 Yes No C:\QooBox\Quarantine\C\WINDOWS\NDNuninstall6_30.exe.vir
00159564 Cookie/WUpd TrackingCookie No 0 Yes No C:\Documents and Settings\Scott\Cookies\scott@revenue[2].txt
00160284 Cookie/Findwhat TrackingCookie No 0 Yes No C:\Documents and Settings\Scott\Cookies\scott@findwhat[1].txt
00161854 Cookie/nCase TrackingCookie No 0 Yes No C:\Documents and Settings\Scott\Cookies\[removed][1].txt
00167647 Cookie/Yadro TrackingCookie No 0 Yes No C:\Documents and Settings\Scott\Cookies\scott@yadro[1].txt
00167704 Cookie/Xiti TrackingCookie No 0 Yes No C:\Documents and Settings\Scott\Cookies\scott@xiti[1].txt
00167747 Cookie/Azjmp TrackingCookie No 0 Yes No C:\Documents and Settings\Scott\Cookies\scott@azjmp[1].txt
00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Scott\Cookies\scott@statcounter[2].txt
00167765 Cookie/Hitbox TrackingCookie No 0 Yes No C:\Documents and Settings\Scott\Cookies\[removed][1].txt
00168061 Cookie/Apmebf TrackingCookie No 0 Yes No C:\Documents and Settings\Scott\Cookies\scott@apmebf[1].txt
00168076 Cookie/BurstNet TrackingCookie No 0 Yes No C:\Documents and Settings\Scott\Cookies\scott@burstnet[1].txt
00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\Scott\Cookies\scott@serving-sys[1].txt
00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\Scott\Cookies\[removed]-sys[1].txt
00168097 Cookie/BurstBeacon TrackingCookie No 0 Yes No C:\Documents and Settings\Scott\Cookies\[removed][2].txt
00168110 Cookie/Server.iad.Liveperson TrackingCookie No 0 Yes No C:\Documents and Settings\Scott\Cookies\[removed][1].txt
00168114 Cookie/onestat.com TrackingCookie No 0 Yes No C:\Documents and Settings\Scott\Cookies\[removed][2].txt
00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\Jodi\Cookies\jodi@advertising[1].txt
00169287 Cookie/Adrevolver TrackingCookie No 0 Yes No C:\Documents and Settings\Scott\Cookies\[removed][3].txt
00170304 Cookie/WebtrendsLive TrackingCookie No 0 Yes No C:\Documents and Settings\Scott\Cookies\[removed][2].txt
00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Scott\Cookies\[removed][1].txt
00170554 Cookie/Overture TrackingCookie No 0 Yes No C:\Documents and Settings\Jodi\Cookies\jodi@overture[1].txt
00170554 Cookie/Overture TrackingCookie No 0 Yes No C:\Documents and Settings\Scott\Cookies\scott@overture[2].txt
00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Scott\Cookies\scott@realmedia[2].txt
00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No C:\Documents and Settings\Scott\Cookies\scott@questionmarket[2].txt
00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Documents and Settings\Scott\Cookies\scott@zedo[1].txt
00172889 Spyware/New.net Spyware No 1 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1785\A0099677.exe
00173520 Cookie/Bluestreak TrackingCookie No 0 Yes No C:\Documents and Settings\Scott\Cookies\scott@bluestreak[2].txt
00173992 Cookie/Zedo TrackingCookie No 0 Yes No C:\Documents and Settings\Scott\Cookies\[removed][1].txt
00184846 Cookie/Adrevolver TrackingCookie No 0 Yes No C:\Documents and Settings\Scott\Cookies\scott@adrevolver[1].txt
00194327 Cookie/Go TrackingCookie No 0 Yes No C:\Documents and Settings\Scott\Cookies\scott@go[1].txt
00207338 Cookie/Target TrackingCookie No 0 Yes No C:\Documents and Settings\Scott\Cookies\scott@target[1].txt
00219235 Adware/CommAd Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1784\A0097543.dll
00219238 Adware/CommAd Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1784\A0097544.exe
00222376 Adware/Sqwire Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1785\A0099700.exe
00222387 Adware/Sqwire Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1785\A0099699.exe
00242884 Adware/SearchAid Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1784\A0097580.exe
00246643 Spyware/New.net Spyware No 1 Yes No C:\QooBox\Quarantine\C\WINDOWS\NDNuninstall4_34.exe.vir
00247982 Cookie/TargetSaver TrackingCookie No 0 Yes No C:\Documents and Settings\Scott\Cookies\scott@targetsaver[2].txt
00250251 Adware/ISearch Adware No 0 No No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1784\A0097568.exe[MTE3MTk6ODoxNg.exe]
00250251 Adware/ISearch Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1787\A0099841.exe
00251146 Adware/SearchAid Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1784\A0097628.vbs
00262020 Cookie/Atwola TrackingCookie No 0 Yes No C:\Documents and Settings\Jodi\Cookies\jodi@atwola[1].txt
00262020 Cookie/Atwola TrackingCookie No 0 Yes No C:\Documents and Settings\Scott\Cookies\scott@atwola[2].txt
00262492 Adware/CommAd Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1784\A0097545.vbs
00286739 Cookie/Hitbox TrackingCookie No 0 Yes No C:\Documents and Settings\Scott\Cookies\[removed][2].txt
00293517 Cookie/AdDynamix TrackingCookie No 0 Yes No C:\Documents and Settings\Scott\Cookies\[removed][2].txt
00302183 Adware/Sqwire Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1785\A0099696.exe
00302184 Adware/Sqwire Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1785\A0099697.exe
00302185 Adware/Sqwire Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1785\A0099666.exe
00302185 Adware/Sqwire Adware No 0 Yes No C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\tsuninst.exe.vir
00332832 Adware/DollarRevenue Adware No 1 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1784\A0097620.dll
00392623 Adware/ActiveSearch Adware No 0 No No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1784\A0097568.exe[²ÜÇ\Services.dll]
00463502 Generic Trojan Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1784\A0097568.exe
00514952 Adware/TTC Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1786\A0099806.exe
00514952 Adware/TTC Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1783\A0092268.exe
01185375 Application/Psexec.A HackTools No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1785\A0099749.EXE
01196325 Cookie/Enhance TrackingCookie No 0 Yes No C:\Documents and Settings\Scott\Cookies\scott@enhance[2].txt
01606636 Cookie/Adserver TrackingCookie No 0 Yes No C:\Documents and Settings\Scott\Cookies\[removed][1].txt
01692698 Generic Malware Virus/Trojan No 0 Yes No C:\Documents and Settings\Scott\Application Data\Macromedia\Shockwave Player\xtras\download\TheGrooveAlliance\3DGrooveXtrav181\Groove.x32
01723795 Generic Malware Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1784\A0097567.exe
02812088 Adware/WebHancer Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1782\A0092227.exe
02885963 Rootkit/Booto.C Virus/Worm No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1785\A0099729.sys
02888175 Adware/Zenosearch Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1785\A0099658.dll
02888175 Adware/Zenosearch Adware No 0 Yes No C:\QooBox\Quarantine\C\Program Files\Outerinfo\FF\components\FF.dll.vir
02891362 Adware/Yazzle Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1784\A0097564.exe
02898733 Trj/Downloader.SLD Virus/Trojan No 1 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1784\A0097569.exe
02906280 Adware/JavaCore Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1783\A0094266.exe
02909454 Adware/Insider Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1783\A0094267.exe
02913340 Adware/InternetSpeedMonitor Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1784\A0097555.exe
02913340 Adware/InternetSpeedMonitor Adware No 0 No No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1784\A0097578.exe[ism.exe]
02918606 Adware/WebHancer Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1782\A0092228.dll
02927481 Adware/Matcash Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1784\A0097574.exe
02927671 Adware/TTC Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1787\A0099842.exe
02927675 Adware/TTC Adware No 0 No No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1787\A0099842.exe[TTC.dll]
02927675 Adware/TTC Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1786\A0099803.dll
02927675 Adware/TTC Adware No 0 Yes No C:\QooBox\Quarantine\C\Program Files\Movie Maker\mepovy66225.dll.vir
02930075 Adware/WebHancer Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1782\A0092229.dll
02936201 Adware/SpeedRunner Adware No 0 Yes No C:\Documents and Settings\Scott\Application Data\Microsoft\Windows\dnqmm.exe
02938563 Adware/PurityScan Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1784\A0097563.exe
02938563 Adware/PurityScan Adware No 0 No No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1784\A0097577.exe[■ó1\Yazzle1552OinAdmin.exe]
02944473 Trj/Downloader.MDW Virus/Trojan No 1 Yes No C:\WINDOWS\SYSTEM32\inet2\xVXdll.exe
02966012 Trj/Downloader.MDW Virus/Trojan No 1 Yes No C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\drivers\serenumm.sys.zip[serenumm.sys]
02970623 Trj/BHO.AY Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1784\A0097625.dll
02970830 Trj/Downloader.MDW Virus/Trojan No 1 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1782\A0092226.dll
02970830 Trj/Downloader.MDW Virus/Trojan No 1 No No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1785\A0099692.exe[■%%\²¬Ç]
02970830 Trj/Downloader.MDW Virus/Trojan No 1 No No C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\g74.exe.vir[■%%\²¬Ç]
02975872 Adware/WebSearch Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1784\A0094273.exe
02984173 Adware/Zenosearch Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1785\A0099670.exe
02984173 Adware/Zenosearch Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1787\A0099839.exe
02984173 Adware/Zenosearch Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1787\A0099840.exe
02984173 Adware/Zenosearch Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1784\A0097624.exe
02993938 Adware/Popuper Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1784\A0097570.exe
03008302 Generic Malware Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1785\A0099661.exe
03008302 Generic Malware Virus/Trojan No 0 Yes No C:\QooBox\Quarantine\C\Program Files\webHancer\Programs\whagent.exe.vir
03020413 Adware/PurityScan Adware No 0 Yes No C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\wgnk.dll.vir
03020413 Adware/PurityScan Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1785\A0099691.dll
03052672 Trj/Downloader.MDW Virus/Trojan No 1 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1783\A0092266.exe
03052672 Trj/Downloader.MDW Virus/Trojan No 1 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1784\A0097576.exe
03053286 Adware/PurityScan Adware No 0 Yes No C:\QooBox\Quarantine\C\Documents and Settings\Scott\My Documents\FNTS~1\wіnspool.exe.vir
03065005 Generic Trojan Virus/Trojan No 0 Yes No C:\QooBox\Quarantine\C\WINDOWS\portsv.exe.vir
03065046 Trj/Downloader.MDW Virus/Trojan No 1 Yes No C:\QooBox\Quarantine\C\Documents and Settings\Scott\Application Data\Microsoft\dtsc\28872.exe.vir
03065046 Trj/Downloader.MDW Virus/Trojan No 1 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1785\A0099693.exe
03065317 Adware/SecuritySystem Adware No 0 Yes No C:\WINDOWS\444.0
03065318 Adware/SecuritySystem Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1785\A0099668.exe
03074422 Adware/Zenosearch Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1785\A0099690.exe
03074422 Adware/Zenosearch Adware No 0 Yes No C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\pcntlkdm.exe.vir
03074964 Trj/CI.A Virus/Trojan No 0 Yes No C:\QooBox\Quarantine\C\Documents and Settings\Scott\Application Data\Microsoft\dtsc\BricsCad Architecturals for AutoCAD v3.3.0009 by RENEGADE.zip.vir[crack.exe]
03139327 Generic Trojan Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1784\A0097575.exe
03194437 Trj/Downloader.UBT Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1784\A0097560.exe
03194438 Trj/Downloader.UBT Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1784\A0097573.exe
03267492 Trj/DNSChanger.NY Virus/Trojan No 1 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1787\A0099843.exe
03268474 Spyware/Virtumonde Spyware No 1 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1784\A0094292.exe
03310038 Trj/Monder.AE Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1784\A0097571.exe
;===============================================================================
=================================================================================
===================
SUSPECTS
Sent Location
;===============================================================================
=================================================================================
===================
No C:\QooBox\Quarantine\C\Program Files\MBOLS~1\winlogon.exe.vir
;===============================================================================
=================================================================================
===================
VULNERABILITIES
Id Severity Description
;===============================================================================
=================================================================================
===================
;===============================================================================
=================================================================================
===================

Logfile of HijackThis v1.99.1
Scan saved at 5:49:30 AM, on 7/26/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\System32\CTSvcCDA.EXE
C:\WINDOWS\System32\NMSSvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe
C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\mHotkey.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\GWMDMMSG.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file://c:/windows/homepage.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = file://c:/windows/homepage.html
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [GWMDMMSG] GWMDMMSG.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: BJ Status Monitor Canon S520.lnk = ?
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.bestbuy.msn.com
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1188962678274
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/4h/pla…0/Installer.exe
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shock…ash/swflash.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTSvcCDA.EXE
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ptssvc - Unknown owner - C:\Program Files\KODAK\KODAK Picture Transfer Software\PTSsvc.exe (file missing)
O23 - Service: WMP54Gv4SVC - Unknown owner - C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe" "WMP54Gv4.exe (file missing)

FencerGirl

Post #17July 28, 2008, 5:01 PM UTC

Hi stryvn,
Your log's looking good. Could you get me the Panda ActiveScan I asked for in my last post?

Run Panda's ActiveScan from here and perform a full system scan.
- Once you are on the Panda site click the "Scan your PC" button
- A new window will open…click the big "Check Now" button
- Enter your Country
- Enter your State/Province
- Enter your e-mail address and click send
- Select either Home User or Company
- Click the big Scan Now button
- If it wants to install an ActiveX component allow it
- It will start downloading the files it requires for the scan (Note: It will take a couple minutes)
- Click on "Local Disks" to start the scan
- Save the log file to your desktop

Please post back with the results of the Scan and (hopefully) one last HijackThis log.
Thanks,
FencerGirl

stryvn

Post #18July 28, 2008, 10:00 PM UTC

Hi Fencer…..I thought I posted the Panda report in last post. I will post again here, along with a new HJT log.

Thank you

;*******************************************************************************
*********************************************************************************
*******************
ANALYSIS: 2008-07-28 16:55:53
PROTECTIONS: 1
MALWARE: 83
SUSPECTS: 1
;*******************************************************************************
*********************************************************************************
*******************
PROTECTIONS
Description Version Active Updated
;===============================================================================
=================================================================================
===================
Avira AntiVir PersonalEdition 8.0.1.15 Yes Yes
;===============================================================================
=================================================================================
===================
MALWARE
Id Description Type Active Severity Disinfectable Disinfected Location
;===============================================================================
=================================================================================
===================
00013869 adware/cydoor Adware No 0 Yes No hkey_local_machine\software\cydoor
00018331 adware/gator Adware No 0 Yes No c:\windows\gatorpdpsetup.log
00018331 adware/gator Adware No 0 Yes No c:\windows\gatoruninstaller_cme.log
00018331 adware/gator Adware No 0 Yes No c:\windows\gatoruninstaller_cme_u.log
00018331 adware/gator Adware No 0 Yes No c:\windows\gatoruninstaller_gator.log
00018331 adware/gator Adware No 0 Yes No c:\windows\gatoruninstaller_gator_u.log
00018331 adware/gator Adware No 0 Yes No c:\windows\gatoruninstaller_offers.log
00018331 adware/gator Adware No 0 Yes No c:\windows\gatoruninstaller_offers_u.log
00018331 adware/gator Adware No 0 Yes No HKEY_LOCAL_MACHINE\software\classes\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}
00018331 adware/gator Adware No 0 Yes No c:\windows\gatorpatch.log
00018331 adware/gator Adware No 0 Yes No hkey_local_machine\software\gator.com
00018331 adware/gator Adware No 0 Yes No hkey_local_machine\software\gatortest
00018331 adware/gator Adware No 0 Yes No hkey_classes_root\clsid\{21ffb6c0-0da1-11d5-a9d5-00500413153c}
00047660 adware/sqwire Adware No 0 Yes No hkey_local_machine\software\microsoft\windows\currentversion\app management\arpcache\tsa
00097438 adware/helpexpress Adware No 0 Yes No hkey_current_user\software\alset
00097984 Adware/Cydoor Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1770\A0088223.dll
00110532 spyware/clientman Spyware No 1 Yes No HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FCADDC14-BD46-408A-9842-CDBE1C6D37EB}
00120878 Spyware/New.net Spyware No 1 Yes No C:\QooBox\Quarantine\C\WINDOWS\NDNuninstall5_48.exe.vir
00120878 Spyware/New.net Spyware No 1 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1785\A0099683.exe
00123179 Spyware/New.net Spyware No 1 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1770\A0088214.exe
00125533 Adware/Sqwire Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1785\A0099701.dll
00125533 Adware/Sqwire Adware No 0 Yes No C:\QooBox\Quarantine\C\Program Files\Common Files\fzzi\fzzid\fzzic.dll.vir
00136461 Spyware/New.net Spyware No 1 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1785\A0099679.exe
00136461 Spyware/New.net Spyware No 1 Yes No C:\QooBox\Quarantine\C\WINDOWS\NDNuninstall4_88.exe.vir
00136462 Spyware/New.net Spyware No 1 Yes No C:\QooBox\Quarantine\C\WINDOWS\NDNuninstall4_94.exe.vir
00136462 Spyware/New.net Spyware No 1 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1785\A0099680.exe
00136463 Spyware/New.net Spyware No 1 Yes No C:\QooBox\Quarantine\C\WINDOWS\NDNuninstall5_40.exe.vir
00136463 Spyware/New.net Spyware No 1 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1785\A0099682.exe
00136464 Spyware/New.net Spyware No 1 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1785\A0099681.exe
00136464 Spyware/New.net Spyware No 1 Yes No C:\QooBox\Quarantine\C\WINDOWS\NDNuninstall5_20.exe.vir
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Documents and Settings\Scott\Cookies\scott@doubleclick[1].txt
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Documents and Settings\Jodi\Cookies\jodi@doubleclick[1].txt
00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\Scott\Cookies\scott@atdmt[2].txt
00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\Jodi\Cookies\jodi@atdmt[2].txt
00139535 Application/Processor HackTools No 0 No No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1785\A0099747.exe[SDFix\apps\Process.exe]
00139535 Application/Processor HackTools No 0 No No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1784\A0095449.exe[SDFix\apps\Process.exe]
00139535 Application/Processor HackTools No 0 Yes No C:\SDFix\apps\Process.exe
00139535 Application/Processor HackTools No 0 No No C:\Documents and Settings\Scott\Desktop\extract.exe.exe[SDFix\apps\Process.exe]
00145069 Spyware/New.net Spyware No 1 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1785\A0099684.exe
00145069 Spyware/New.net Spyware No 1 Yes No C:\QooBox\Quarantine\C\WINDOWS\NDNuninstall5_64.exe.vir
00145069 Spyware/New.net Spyware No 1 Yes No C:\QooBox\Quarantine\C\WINDOWS\NDNuninstall6_10.exe.vir
00145069 Spyware/New.net Spyware No 1 Yes No C:\QooBox\Quarantine\C\WINDOWS\NDNuninstall6_22.exe.vir
00145069 Spyware/New.net Spyware No 1 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1785\A0099685.exe
00145069 Spyware/New.net Spyware No 1 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1785\A0099686.exe
00145405 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Scott\Cookies\scott@247realmedia[1].txt
00147516 Spyware/New.net Spyware No 1 Yes No C:\QooBox\Quarantine\C\WINDOWS\NDNuninstall4_80.exe.vir
00147516 Spyware/New.net Spyware No 1 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1785\A0099678.exe
00157998 Spyware/New.net Spyware No 1 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1785\A0099687.exe
00157998 Spyware/New.net Spyware No 1 Yes No C:\QooBox\Quarantine\C\WINDOWS\NDNuninstall6_30.exe.vir
00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\Jodi\Cookies\jodi@advertising[1].txt
00170554 Cookie/Overture TrackingCookie No 0 Yes No C:\Documents and Settings\Jodi\Cookies\jodi@overture[1].txt
00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Documents and Settings\Scott\Cookies\scott@zedo[2].txt
00172889 Spyware/New.net Spyware No 1 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1785\A0099677.exe
00219235 Adware/CommAd Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1784\A0097543.dll
00219238 Adware/CommAd Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1784\A0097544.exe
00222376 Adware/Sqwire Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1785\A0099700.exe
00222387 Adware/Sqwire Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1785\A0099699.exe
00242884 Adware/SearchAid Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1784\A0097580.exe
00246643 Spyware/New.net Spyware No 1 Yes No C:\QooBox\Quarantine\C\WINDOWS\NDNuninstall4_34.exe.vir
00250251 Adware/ISearch Adware No 0 No No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1784\A0097568.exe[MTE3MTk6ODoxNg.exe]
00250251 Adware/ISearch Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1787\A0099841.exe
00251146 Adware/SearchAid Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1784\A0097628.vbs
00262020 Cookie/Atwola TrackingCookie No 0 Yes No C:\Documents and Settings\Jodi\Cookies\jodi@atwola[1].txt
00262492 Adware/CommAd Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1784\A0097545.vbs
00302183 Adware/Sqwire Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1785\A0099696.exe
00302184 Adware/Sqwire Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1785\A0099697.exe
00302185 Adware/Sqwire Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1785\A0099666.exe
00302185 Adware/Sqwire Adware No 0 Yes No C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\tsuninst.exe.vir
00332832 Adware/DollarRevenue Adware No 1 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1784\A0097620.dll
00392623 Adware/ActiveSearch Adware No 0 No No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1784\A0097568.exe[²ÜÇ\Services.dll]
00463502 Generic Trojan Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1784\A0097568.exe
00514952 Adware/TTC Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1783\A0092268.exe
00514952 Adware/TTC Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1786\A0099806.exe
01185375 Application/Psexec.A HackTools No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1785\A0099749.EXE
01692698 Generic Malware Virus/Trojan No 0 Yes No C:\Documents and Settings\Scott\Application Data\Macromedia\Shockwave Player\xtras\download\TheGrooveAlliance\3DGrooveXtrav181\Groove.x32
01723795 Generic Malware Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1784\A0097567.exe
02812088 Adware/WebHancer Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1782\A0092227.exe
02885963 Rootkit/Booto.C Virus/Worm No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1785\A0099729.sys
02888175 Adware/Zenosearch Adware No 0 Yes No C:\QooBox\Quarantine\C\Program Files\Outerinfo\FF\components\FF.dll.vir
02888175 Adware/Zenosearch Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1785\A0099658.dll
02891362 Adware/Yazzle Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1784\A0097564.exe
02898733 Trj/Downloader.SLD Virus/Trojan No 1 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1784\A0097569.exe
02906280 Adware/JavaCore Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1783\A0094266.exe
02909454 Adware/Insider Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1783\A0094267.exe
02913340 Adware/InternetSpeedMonitor Adware No 0 No No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1784\A0097578.exe[ism.exe]
02913340 Adware/InternetSpeedMonitor Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1784\A0097555.exe
02918606 Adware/WebHancer Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1782\A0092228.dll
02927481 Adware/Matcash Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1784\A0097574.exe
02927671 Adware/TTC Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1787\A0099842.exe
02927675 Adware/TTC Adware No 0 Yes No C:\QooBox\Quarantine\C\Program Files\Movie Maker\mepovy66225.dll.vir
02927675 Adware/TTC Adware No 0 No No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1787\A0099842.exe[TTC.dll]
02927675 Adware/TTC Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1786\A0099803.dll
02930075 Adware/WebHancer Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1782\A0092229.dll
02936201 Adware/SpeedRunner Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1791\A0100053.exe
02938563 Adware/PurityScan Adware No 0 No No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1784\A0097577.exe[■ó1\Yazzle1552OinAdmin.exe]
02938563 Adware/PurityScan Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1784\A0097563.exe
02944473 Trj/Downloader.MDW Virus/Trojan No 1 Yes No C:\WINDOWS\SYSTEM32\inet2\xVXdll.exe
02966012 Trj/Downloader.MDW Virus/Trojan No 1 Yes No C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\drivers\serenumm.sys.zip[serenumm.sys]
02970623 Trj/BHO.AY Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1784\A0097625.dll
02970830 Trj/Downloader.MDW Virus/Trojan No 1 No No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1785\A0099692.exe[■%%\²¬Ç]
02970830 Trj/Downloader.MDW Virus/Trojan No 1 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1782\A0092226.dll
02970830 Trj/Downloader.MDW Virus/Trojan No 1 No No C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\g74.exe.vir[■%%\²¬Ç]
02975872 Adware/WebSearch Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1784\A0094273.exe
02984173 Adware/Zenosearch Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1785\A0099670.exe
02984173 Adware/Zenosearch Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1787\A0099839.exe
02984173 Adware/Zenosearch Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1784\A0097624.exe
02984173 Adware/Zenosearch Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1787\A0099840.exe
02993938 Adware/Popuper Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1784\A0097570.exe
03008302 Generic Malware Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1785\A0099661.exe
03008302 Generic Malware Virus/Trojan No 0 Yes No C:\QooBox\Quarantine\C\Program Files\webHancer\Programs\whagent.exe.vir
03020413 Adware/PurityScan Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1785\A0099691.dll
03020413 Adware/PurityScan Adware No 0 Yes No C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\wgnk.dll.vir
03052672 Trj/Downloader.MDW Virus/Trojan No 1 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1784\A0097576.exe
03052672 Trj/Downloader.MDW Virus/Trojan No 1 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1783\A0092266.exe
03053286 Adware/PurityScan Adware No 0 Yes No C:\QooBox\Quarantine\C\Documents and Settings\Scott\My Documents\FNTS~1\wіnspool.exe.vir
03065005 Generic Trojan Virus/Trojan No 0 Yes No C:\QooBox\Quarantine\C\WINDOWS\portsv.exe.vir
03065046 Trj/Downloader.MDW Virus/Trojan No 1 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1785\A0099693.exe
03065046 Trj/Downloader.MDW Virus/Trojan No 1 Yes No C:\QooBox\Quarantine\C\Documents and Settings\Scott\Application Data\Microsoft\dtsc\28872.exe.vir
03065317 Adware/SecuritySystem Adware No 0 Yes No C:\WINDOWS\444.0
03065318 Adware/SecuritySystem Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1785\A0099668.exe
03074422 Adware/Zenosearch Adware No 0 Yes No C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\pcntlkdm.exe.vir
03074422 Adware/Zenosearch Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1785\A0099690.exe
03074964 Trj/CI.A Virus/Trojan No 0 Yes No C:\QooBox\Quarantine\C\Documents and Settings\Scott\Application Data\Microsoft\dtsc\BricsCad Architecturals for AutoCAD v3.3.0009 by RENEGADE.zip.vir[crack.exe]
03139327 Generic Trojan Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1784\A0097575.exe
03194437 Trj/Downloader.UBT Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1784\A0097560.exe
03194438 Trj/Downloader.UBT Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1784\A0097573.exe
03267492 Trj/DNSChanger.NY Virus/Trojan No 1 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1787\A0099843.exe
03268474 Spyware/Virtumonde Spyware No 1 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1784\A0094292.exe
03310038 Trj/Monder.AE Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1784\A0097571.exe
03403390 Adware/AdRotator Adware No 0 Yes No C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\g74.exe.vir
03403390 Adware/AdRotator Adware No 0 Yes No C:\System Volume Information\_restore{1536FC13-E172-47EA-ABF3-40B443C9C015}\RP1785\A0099692.exe
;===============================================================================
=================================================================================
===================
SUSPECTS
Sent Location M
;===============================================================================
=================================================================================
===================
No C:\QooBox\Quarantine\C\Program Files\MBOLS~1\winlogon.exe.vir M
;===============================================================================
=================================================================================
===================
VULNERABILITIES
Id Severity Description M
;===============================================================================
=================================================================================
===================
;===============================================================================
=================================================================================
===================

Logfile of HijackThis v1.99.1
Scan saved at 4:58:43 PM, on 7/28/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\System32\CTSvcCDA.EXE
C:\WINDOWS\System32\NMSSvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe
C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\mHotkey.exe
C:\WINDOWS\GWMDMMSG.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://jsonline.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = file://c:/windows/homepage.html
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [GWMDMMSG] GWMDMMSG.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: BJ Status Monitor Canon S520.lnk = ?
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.bestbuy.msn.com
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1188962678274
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/4h/pla…0/Installer.exe
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shock…ash/swflash.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTSvcCDA.EXE
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ptssvc - Unknown owner - C:\Program Files\KODAK\KODAK Picture Transfer Software\PTSsvc.exe (file missing)
O23 - Service: WMP54Gv4SVC - Unknown owner - C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe" "WMP54Gv4.exe (file missing)

FencerGirl

Post #19July 29, 2008, 6:52 PM UTC

Hi stryvn,
Thanks for the new Panda Log.
There are just a couple little things I'd like to take care of before I declare you clean.

We're going to be removing some bad registry keys, so we need to back up your registry.

Please use the following link and scroll down to ERUNT and download it.
http://aumha.org/downloads/erunt-setup.exe
For version with the Installer:
Use the setup program to install ERUNT on your computer
For the zipped version:
Unzip all the files into a folder of your choice.

Click Erunt.exe to backup your registry to the folder of your choice.

Note: to restore your registry, go to the folder and start ERDNT.exe

Then, there some files I'd like to remove with OTMoveit2.

Double-click OTMoveIt2.exe.
Copy the lines in the codebox below.

C:\WINDOWS\444.0
C:\WINDOWS\SYSTEM32\inet2\xVXdll.exe
C:\Documents and Settings\Scott\Application Data\Macromedia\Shockwave Player\xtras\download\TheGrooveAlliance\3DGrooveXtrav181\Groove.x32
hkey_local_machine\software\cydoor
hkey_local_machine\software\microsoft\windows\currentversion\app management\arpcache\tsa
hkey_current_user\software\alset
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FCADDC14-BD46-408A-9842-CDBE1C6D37EB}
c:\windows\gatorpdpsetup.log
c:\windows\gatoruninstaller_cme.log
c:\windows\gatoruninstaller_cme_u.log
c:\windows\gatoruninstaller_gator.log
c:\windows\gatoruninstaller_gator_u.log
c:\windows\gatoruninstaller_offers.log
c:\windows\gatoruninstaller_offers_u.log
HKEY_LOCAL_MACHINE\software\classes\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}
c:\windows\gatorpatch.log
hkey_local_machine\software\gator.com
hkey_local_machine\software\gatortest
hkey_classes_root\clsid\{21ffb6c0-0da1-11d5-a9d5-00500413153c}

Return to OTMoveIt2, right click in the Paste List of Files/Folders to Move window (under the yellow bar) and choose Paste.
Click the red Moveit! button.
Copy everything in the Results window (under the green bar), and paste it in your next reply.
Close OTMoveIt2

Finally, let's reset system restore to clean out some of the baddies.
You will lose all previous restore points which are likely to be infected.
- Right-click My Computer, and then click Properties.
- On the System Restore tab, put a Check mark in the Turn Off System Restore check box.
- Click OK twice, and then click Yes when you are prompted to restart the computer.
If you are not prompted to reboot, do it on your own.
———————————————————–
After the Reboot,
- Right-click My Computer, and then click Properties.
- On the System Restore tab, Clear the Check mark beside the Turn Off System Restore check box.
- Click OK twice, and then click Yes when you are prompted to restart the computer.
The Disable/Re-enable System Restore sequence is not to be done regularly, but only once after the removal of malware.

After you've done all of the above, please post back with the results from OTMoveIt2 and if you were able to uninstall the programs listed above; also give me another HijackThis log.
Thanks,
FencerGirl

stryvn

Post #20July 30, 2008, 12:33 AM UTC

C:\WINDOWS\444.0 moved successfully.
File/Folder C:\WINDOWS\SYSTEM32\inet2\xVXdll.exe not found.
File/Folder C:\Documents and Settings\Scott\Application Data\Macromedia\Shockwave Player\xtras\download\TheGrooveAlliance\3DGrooveXtrav181\Groove.x32 not found.
< hkey_local_machine\software\cydoor >
Registry key hkey_local_machine\software\cydoor\\ not found.
< hkey_local_machine\software\microsoft\windows\currentversion\app management\arpcache\tsa >
Registry key hkey_local_machine\software\microsoft\windows\currentversion\app management\arpcache\tsa\\ not found.
< hkey_current_user\software\alset >
Registry key hkey_current_user\software\alset\\ not found.
< HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FCADDC14-BD46-408A-9842-CDBE1C6D37EB} >
Registry key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FCADDC14-BD46-408A-9842-CDBE1C6D37EB}\\ not found.
File/Folder c:\windows\gatorpdpsetup.log not found.
File/Folder c:\windows\gatoruninstaller_cme.log not found.
File/Folder c:\windows\gatoruninstaller_cme_u.log not found.
File/Folder c:\windows\gatoruninstaller_gator.log not found.
File/Folder c:\windows\gatoruninstaller_gator_u.log not found.
File/Folder c:\windows\gatoruninstaller_offers.log not found.
File/Folder c:\windows\gatoruninstaller_offers_u.log not found.
< HKEY_LOCAL_MACHINE\software\classes\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C} >
Registry key HKEY_LOCAL_MACHINE\software\classes\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\\ not found.
File/Folder c:\windows\gatorpatch.log not found.
< hkey_local_machine\software\gator.com >
Registry key hkey_local_machine\software\gator.com\\ not found.
< hkey_local_machine\software\gatortest >
Registry key hkey_local_machine\software\gatortest\\ not found.
< hkey_classes_root\clsid\{21ffb6c0-0da1-11d5-a9d5-00500413153c} >
Registry key hkey_classes_root\clsid\{21ffb6c0-0da1-11d5-a9d5-00500413153c}\\ not found.

OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 07292008_193047

Logfile of HijackThis v1.99.1
Scan saved at 7:31:41 PM, on 7/29/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\System32\CTSvcCDA.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe
C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\mHotkey.exe
C:\WINDOWS\GWMDMMSG.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://jsonline.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = file://c:/windows/homepage.html
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [GWMDMMSG] GWMDMMSG.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: BJ Status Monitor Canon S520.lnk = ?
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.bestbuy.msn.com
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1188962678274
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/4h/pla…0/Installer.exe
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shock…ash/swflash.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTSvcCDA.EXE
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ptssvc - Unknown owner - C:\Program Files\KODAK\KODAK Picture Transfer Software\PTSsvc.exe (file missing)
O23 - Service: WMP54Gv4SVC - Unknown owner - C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe" "WMP54Gv4.exe (file missing)

FencerGirl

Post #21July 31, 2008, 7:44 PM UTC

Hi stryvn,
Your log looks good!
Let's clear out the programs we've been using to clean up your computer, they are not suitable for general malware removal and could cause damage if used inappropriately.

First, I'd like you to go to Start, then click on Run…
Copy the following text into the Run box.

ComboFix /u

Click the OK button.

ComboFix will now uninstall itself.

Next, we'll use OTMoveIt to tidy up what's left.

Double click OTMoveIt.exe to launch the program.
Click on the CleanUp! button.
OTMoveIt will download a list from the Internet, if your firewall or other defensive programs alerts you, allow it access.
You will be prompted to allow the clean up procedure, click Yes
When finished exit out of OTMoveIt
Now delete OTMoveIt.exe

Your latest log looks clean! Great Job!
Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

Set correct settings for files that should be hidden in Windows XP
- Click Start > My Computer > Tools menu (at top of page) > Folder Options > View tab.
- Under "Hidden files and folders" if necessary select Do not show hidden files and folders.
- If unchecked please checkHide protected operating system files (Recommended)
- If necessary check "Display content of system folders"
- If necessary Uncheck Hide file extensions for known file types.
- Click OK
Make your Internet Explorer more secure - This can be done by following these simple instructions:
- From within Internet Explorer click on the Tools menu and then click on Options.
- Click once on the Security tab
- Click once on the Internet icon so it becomes highlighted.
- Click once on the Custom Level button.
  - Change the Download signed ActiveX controls to Prompt
  - Change the Download unsigned ActiveX controls to Disable
  - Change the Initialise and script ActiveX controls not marked as safe to Disable
  - Change the Installation of desktop items to Prompt
  - Change the Launching programs and files in an IFRAME to Prompt
  - Change the Navigate sub-frames across different domains to Prompt
  - When all these settings have been made, click on the OK button.
  - If it prompts you as to whether or not you want to save the settings, press the Yes button.
- Next press the Apply button and then the OK to exit the Internet Properties page.
Use an Anti Virus Software - You're using Antivir now, so keep up the good work!
Update your Anti Virus Software - It is imperitive that you update your Anti virus software at least once a week (Even more if you wish). If you do not update your anti virus software then it will not be able to catch any of the new variants that may come out.
Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. For an article on Firewalls and a listing of some available ones see the link below:
Computer Safety On line - Software Firewalls
Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option.
This will provide real-time spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an anti virus software. A tutorial on installing & using this product can be found here:
Instructions for - Spybot S & D and Ad-aware
Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs. A article on anti-malware products with links for this program and others can be found here:
Computer Safety on line - Anti-Malware
Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.

Follow this list and your potential for being infected again will reduce dramatically.

Please let me know if you have any questions.
Thanks,
FencerGirl

stryvn

Post #22July 31, 2008, 10:19 PM UTC last edited July 31, 2008, 10:20 PM UTC

Fencer, Thank you so much for all your help!! The service provided by the volunteers at this site is truly remarkable and invaluable. I have installed the recommended programs and I will follow your advice. Now all I have to do is click the "Donate" button at the top of the page. And hope that I never need your help again! Stryvn

Simon V.

Post #23August 3, 2008, 12:03 PM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

[Resolved] Computer completely taken over

✨ Ask AI

Ask AI