What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Antivirus 2008 infection -- Please Help

12 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
After reading about Antivirus 2008 on this forum, I am submitting what I think you need to help me. Below you will find the Anti-Malware log and the HJT log.

The "Virus Alert!" by the clock is now gone, the time is no longer in militray time, and my desktop icons are no longer disappearing. Please let me know what else I should do.

Do you know why this was not stopped by NOD32?

Thanks,
Frank




The Malwarebyte log file follows. I did insure all items were checked, and removed them.

Malwarebytes' Anti-Malware 1.23
Database version: 993
Windows 5.0.2195 Service Pack 4

10:57:45 PM 7/25/2008
mbam-log-7-25-2008 (22-57-45).txt

Scan type: Quick Scan
Objects scanned: 59709
Time elapsed: 13 minute(s), 56 second(s)

Memory Processes Infected: 1
Memory Modules Infected: 3
Registry Keys Infected: 21
Registry Values Infected: 4
Registry Data Items Infected: 18
Folders Infected: 30
Files Infected: 61

Memory Processes Infected:
C:\WINNT\system32:winsock32.exe (Rootkit.ADS) -> Unloaded process successfully.

Memory Modules Infected:
C:\WINNT\system32\nnnnNEuu.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINNT\system32\ddcBTNHW.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINNT\nfavxwdbafe.dll (Trojan.FakeAlert) -> Delete on reboot.

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{eb1c2dfd-5c78-48db-8acf-934c2212e919} (Trojan.Vundo) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{eb1c2dfd-5c78-48db-8acf-934c2212e919} (Trojan.Vundo) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{040ba7f9-cdc9-4f2a-bafd-5b13501b2dad} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{040ba7f9-cdc9-4f2a-bafd-5b13501b2dad} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ddcbtnhw (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\rhcv0qj0ecep (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\rhcv0qj0ecep (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WinCtrl32 (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{9bd922e5-c336-4a0d-865b-28dbf5f4a16b} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\webvideo (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{dc88f4fe-35f9-49dd-8f5a-4474935ac212} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{71373a59-1e23-4954-8e8d-4a7c68b07cb2} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{ae1a6b98-ddcc-4afb-9f0f-54e84916ea8f} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{0875fe2e-ec56-435b-81d3-fbf775e11228} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0875fe2e-ec56-435b-81d3-fbf775e11228} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{557d10db-799c-4d7d-987b-a4ae2e7dca21} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VSPlugin (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\fdkowvbp.brxv (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\fdkowvbp.toolbar.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\xprepairpro2007 (Rogue.XPRepairPro2007) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{040ba7f9-cdc9-4f2a-bafd-5b13501b2dad} (Trojan.Vundo) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\0\source (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\eqvwamkl (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\wnslvxtf (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo) -> Data: c:\winnt\system32\nnnnneuu -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\winnt\system32\nnnnneuu






Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:05:58 PM, on 7/25/2008
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\hidserv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\PROGRA~1\Fastream IQ Web FTP Server Engine\IQWebFTPServerEngine.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\igfxtray.exe
C:\WINNT\system32\hkcmd.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\SmartSync Pro\SmartSync.exe
C:\Program Files\XP Repair Pro 2007\XPRepairPro.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\WinEdt Team\WinEdt\WinEdt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {040BA7F9-CDC9-4F2A-BAFD-5B13501B2DAD} - C:\WINNT\system32\ddcBTNHW.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: (no name) - {EB1C2DFD-5C78-48DB-8ACF-934C2212E919} - C:\WINNT\system32\nnnnNEuu.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: fdkowvbp - {B6CDE539-A03C-484B-8FC0-B8A3775C5220} - C:\DOCUME~1\onyx\LOCALS~1\Temp\ac8zt2\fdkowvbp.dll (file missing)
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\system32\hkcmd.exe
O4 - HKLM\..\Run: [PDF Converter Registry Controller] "C:\Program Files\ScanSoft\PDF Converter\RegistryController.exe"
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - HKCU\..\Run: [SmartSync Pro] "C:\Program Files\SmartSync Pro\SmartSync.exe" /Logon
O4 - HKCU\..\Run: [XPRepairPro2007] C:\Program Files\XP Repair Pro 2007\XPRepairPro.exe /r
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Symantec Fax Starter Edition Port.lnk = C:\Program Files\Microsoft Office\Office\1033\OLFSNT40.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Open PDF in Word - res://C:\Program Files\ScanSoft\PDF Converter\IEShellExt.dll /100
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813
O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} (DjVuCtl Class) - http://www.lizardtech.com/download/files/w…ntrol_en_US.cab
O16 - DPF: {0FAA926E-2AF4-11D3-9995-00A0CC3A27A9} (Infragistics ComboBox Control) - http://tcapps.selu.edu/timecentre/Common/pvcombo.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {1EF9F042-C2EB-4293-8213-474CAEEF531D} (TmHcmsX Control) - http://www.trendsecure.com/framework/contr…vex/TmHcmsX.CAB
O16 - DPF: {2AF5BD25-90C5-4EEC-88C5-B44DC2905D8B} (DownloadManager Control) - http://dlm.tools.akamai.com/dlmanager/vers…vex-2.0.6.5.cab
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqaio/downloads/sysinfo.cab
O16 - DPF: {4CCA4E80-9259-11D9-AC6E-444553544200} - http://h30155.www3.hp.com/ediags/dd/instal…llMgr_v01_5.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1141603151927
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/inst…ctDetection.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1141603271729
O16 - DPF: {6F750202-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://www.kodakgallery.com/downloads/BUM/…_2/axofupld.cab
O16 - DPF: {7823A620-9DD9-11CF-A662-00AA00C066D2} (PopupMenu Object) - http://tcapps.selu.edu/timecentre/Common/iemenu.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx
O16 - DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} (SABScanProcesses Class) - http://www.superadblocker.com/activex/sabspx.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {C4847596-972C-11D0-9567-00A0C9273C2A} (Crystal Report Viewer Control) - http://tcapps.selu.edu/viewer/activeXViewe…tivexviewer.cab
O16 - DPF: {E9C9692E-F93C-11D1-ABB0-0040054FC6FB} (Infragistics DataTable Control 8.0 (OLEDB)) - http://tcapps.selu.edu/timecentre/Common/pvdt80.cab
O16 - DPF: {FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1} (DownloadManager Control) - http://dlm.tools.akamai.com/dlmanager/vers…vex-2.2.1.6.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = home.domain
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = home.domain
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = home.domain
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL C:\PROGRA~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll,C:\PROGRA~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll,
O20 - Winlogon Notify: ddcBTNHW - C:\WINNT\SYSTEM32\ddcBTNHW.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LiveUpdate\LuComServer_3_1.EXE
O23 - Service: Fastream IQ Web/FTP Server (NFService) - Fastream Technologies - C:\PROGRA~1\Fastream IQ Web FTP Server Engine\IQWebFTPServerEngine.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\system32\HPZipm12.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe
O24 - Desktop Component 0: Privacy Protection - (no file)

–
End of file - 9757 bytes
Post #2
Hello

Before we begin, you should save these instructions in Notepad to your desktop, or print them, for easy reference. Much of our fix will be done in Safe mode, and you will be unable to access this thread at that time. If you have questions at any point, or are unsure of the instructions, feel free to post here and ask for clarification before proceeding.


Please download SmitfraudFix (by S!Ri) to your Desktop.

Next, please reboot your computer in Safe Mode by doing the following :
  • Restart your computer
  • After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
  • Instead of Windows loading as normal, a menu with options should appear;
  • Select the first option, to run Windows in Safe Mode, then press "Enter".
  • Choose your usual account.
Once in Safe Mode, double-click on SmitfraudFix.exe
Select option #2 - Clean by typing 2 and press "Enter" to delete infected files.

You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing Y and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection.

The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing Y and press "Enter".

The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart it into Normal Windows.
A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report into your next reply.
The report can also be found at the root of the system drive, usually at C:\rapport.txt

Warning : running option #2 on a non infected computer will remove your Desktop background.



Please download Deckard's System Scanner (DSS) and save it to your Desktop.
  • Close all other windows before proceeding.
  • Double-click on dss.exe and follow the prompts.
  • If your anti-virus or firewall complains, please allow this script to run as it is not malicious.
  • When it has finished, dss will open two Notepads main.txt and extra.txt – please copy (CTRL+A and then CTRL+C) and paste (CTRL+V) the contents of main.txt and extra.txt in your next reply.
Post #3
OK. I downloaded and ran smitfraudfix.exe, and after selecting option 2 and waiting a while, the error "Cannot import cleanup reg: Error accessing the registry" The Log file follows: SmitFraudFix v2.331 Scan done at 18:55:44.75, Sat 07/26/2008 Run from C:\Documents and Settings\onyx\Desktop\SmitfraudFix OS: Microsoft Windows 2000 [Version 5.00.2195] - Windows_NT The filesystem type is NTFS Fix run in safe mode »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» Killing process »»»»»»»»»»»»»»»»»»»»»»»» hosts 127.0.0.1 localhost »»»»»»»»»»»»»»»»»»»»»»»» VACFix VACFix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix S!Ri's WS2Fix: LSP not Found. »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix GenericRenosFix by S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files »»»»»»»»»»»»»»»»»»»»»»»» IEDFix IEDFix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» 404Fix 404Fix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» DNS HKLM\SYSTEM\CCS\Services\Tcpip\..\{2AD0A78B-2FB7-4A5B-913A-0FAC62235579}: DhcpNameServer=[removed] [removed] HKLM\SYSTEM\CS1\Services\Tcpip\..\{2AD0A78B-2FB7-4A5B-913A-0FAC62235579}: DhcpNameServer=[removed] [removed] HKLM\SYSTEM\CS2\Services\Tcpip\..\{2AD0A78B-2FB7-4A5B-913A-0FAC62235579}: DhcpNameServer=[removed] [removed] HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=[removed] [removed] HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=[removed] [removed] HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=[removed] [removed] »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning Registry Cleaning done. »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» End I tried to run smitfraudfix again, and the second log file is below: SmitFraudFix v2.331 Scan done at 19:01:01.00, Sat 07/26/2008 Run from C:\Documents and Settings\onyx\Desktop\SmitfraudFix OS: Microsoft Windows 2000 [Version 5.00.2195] - Windows_NT The filesystem type is NTFS Fix run in safe mode »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» Killing process »»»»»»»»»»»»»»»»»»»»»»»» hosts 127.0.0.1 localhost »»»»»»»»»»»»»»»»»»»»»»»» VACFix VACFix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix S!Ri's WS2Fix: LSP not Found. »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix GenericRenosFix by S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files »»»»»»»»»»»»»»»»»»»»»»»» IEDFix IEDFix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» 404Fix 404Fix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» DNS HKLM\SYSTEM\CCS\Services\Tcpip\..\{2AD0A78B-2FB7-4A5B-913A-0FAC62235579}: DhcpNameServer=[removed] [removed] HKLM\SYSTEM\CS1\Services\Tcpip\..\{2AD0A78B-2FB7-4A5B-913A-0FAC62235579}: DhcpNameServer=[removed] [removed] HKLM\SYSTEM\CS2\Services\Tcpip\..\{2AD0A78B-2FB7-4A5B-913A-0FAC62235579}: DhcpNameServer=[removed] [removed] HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=[removed] [removed] HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=[removed] [removed] HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=[removed] [removed] »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning Registry Cleaning done. »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» End I did not try to run DSS since it was step 2 and step one did not complete properly. What should I do now? Thanks for your help, Frank
Post #5
The contents of the file 'main.txt' follows:

Deckard's System Scanner v20071014.68
Run by [removed] on 2008-07-28 00:59:26
Computer is in Normal Mode.
——————————————————————————–

Backed up registry hives.
Performed disk cleanup.

System Drive C: has 8.45 GiB (less than 15%) free.


– HijackThis (run as onyx.exe) ————————————————

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:02:54, on 7/28/2008
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\hidserv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\PROGRA~1\Fastream IQ Web FTP Server Engine\IQWebFTPServerEngine.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\SiteAdvisor\6261\SAService.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\igfxtray.exe
C:\WINNT\system32\hkcmd.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\SiteAdvisor\6261\SiteAdv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Microsoft Office\Office\1033\OLFSNT40.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\onyx\Desktop\software\DSS - Deckard's System Scanner\dss.exe
C:\PROGRA~1\Trend Micro\HijackThis\onyx.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.selu.edu/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: fdkowvbp - {B6CDE539-A03C-484B-8FC0-B8A3775C5220} - C:\DOCUME~1\onyx\LOCALS~1\Temp\ac8zt2\fdkowvbp.dll (file missing)
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\system32\hkcmd.exe
O4 - HKLM\..\Run: [PDF Converter Registry Controller] "C:\Program Files\ScanSoft\PDF Converter\RegistryController.exe"
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SiteAdvisor] "C:\Program Files\SiteAdvisor\6261\SiteAdv.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - HKCU\..\Run: [{9281A4FC-C581-3449-5FA6-456C6F7B9079}] C:\Documents and Settings\onyx\Application Data:winsock32.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Symantec Fax Starter Edition Port.lnk = C:\Program Files\Microsoft Office\Office\1033\OLFSNT40.EXE
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Open PDF in Word - res://C:\Program Files\ScanSoft\PDF Converter\IEShellExt.dll /100
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} (SABScanProcesses Class) - http://www.superadblocker.com/activex/sabspx.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = home.domain
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = home.domain
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = home.domain
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL,C:\PROGRA~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll,C:\PROGRA~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll,C:\PROGRA~1\Kaspersky Lab\Kaspersky Internet Security 7.0\adialhk.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LiveUpdate\LuComServer_3_1.EXE
O23 - Service: Fastream IQ Web/FTP Server (NFService) - Fastream Technologies - C:\PROGRA~1\Fastream IQ Web FTP Server Engine\IQWebFTPServerEngine.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\system32\HPZipm12.exe
O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6261\SAService.exe

–
End of file - 8961 bytes

– File Associations ———————————————————–

.js - JSFile - shell\open\command - NOTEPAD.EXE %1
.reg - regfile - shell\open\command - regedit.exe "%1" %*
.scr - scrfile - shell\open\command - "%1" %*
.txt - WinEdt.txt - DefaultIcon - C:\Program Files\WinEdt Team\WinEdt\WinShell\Icons\WinEdt.ico,0
.txt - WinEdt.txt - shell\open\command - "C:\Program Files\WinEdt Team\WinEdt\WinEdt.exe" "%1"
.vbs - VBSFile - shell\open\command - NOTEPAD.EXE %1


– Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ———————

R1 BANTExt (Belarc SMBios Access) - c:\winnt\system32\drivers\bantext.sys
R1 omci (OMCI WDM Device Driver) - c:\winnt\system32\drivers\omci.sys
Post #6
Hello

1. Please re-open HiJackThis and choose do a system scan only. Check the boxes next to ONLY the entries listed below(if present):

O3 - Toolbar: fdkowvbp - {B6CDE539-A03C-484B-8FC0-B8A3775C5220} - C:\DOCUME~1\onyx\LOCALS~1\Temp\ac8zt2\fdkowvbp.dll (file missing)
O4 - HKCU\..\Run: [{9281A4FC-C581-3449-5FA6-456C6F7B9079}] C:\Documents and Settings\onyx\Application Data:winsock32.exe


2. Now close all windows other than HiJackThis, including browsers, so that nothing other than HijackThis is open, then click Fix Checked. A box will pop up asking you if you wish to fix the selected items. Please choose YES. Once it has fixed them, please exit/close HijackThis.



Please download the OTMoveIt2 by OldTimer.
  • Save it to your desktop.
  • Please double-click OTMoveIt2.exe to run it.
  • Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

    [kill explorer]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wintb62.sys
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\advap32
C:\DOCUME~1\onyx\LOCALS~1\Temp\scksexde.exe
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lphcr0qj0ecep
C:\WINNT\system32\lphcr0qj0ecep.exe
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMrhcv0qj0ecep
C:\Program Files\rhcv0qj0ecep
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9281A4FC-C581-3449-5FA6-456C6F7B9079}
C:\WINNT\system32:winsock32.exe
HKEY_CLASSES_ROOT\CLSID\{9281A4FC-C581-3449-5FA6-456C6F7B9079}
purity 
EmptyTemp
[start explorer]
  • Return to OTMoveIt2, right click in the "Paste List of Files/Folders to Move" window (under the light Yellow bar) and choose Paste.
  • Click the red Moveit! button.
  • A log of files and folders moved will be created in the c:\_OTMoveIt\MovedFiles folder in the form of Date and Time (mmddyyyy_hhmmss.log). Please open this log in Notepad and post its contents in your next reply.
  • Close OTMoveIt2
If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.



Reboot and post a new DSS Log
Post #7
Thanks for your continued help.
The new DSS file follows:

Deckard's System Scanner v20071014.68
Run by [removed] on 2008-07-28 21:46:53
Computer is in Normal Mode.
——————————————————————————–

System Drive C: has 8.26 GiB (less than 15%) free.


– HijackThis (run as onyx.exe) ————————————————

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:47:18, on 7/28/2008
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\hidserv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\PROGRA~1\Fastream IQ Web FTP Server Engine\IQWebFTPServerEngine.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\SiteAdvisor\6261\SAService.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\igfxtray.exe
C:\WINNT\system32\hkcmd.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\SiteAdvisor\6261\SiteAdv.exe
C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Microsoft Office\Office\1033\OLFSNT40.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\onyx\Desktop\software\DSS - Deckard's System Scanner\dss.exe
C:\PROGRA~1\Trend Micro\HijackThis\onyx.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.selu.edu/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google; - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: &Radio; - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\system32\hkcmd.exe
O4 - HKLM\..\Run: [PDF Converter Registry Controller] "C:\Program Files\ScanSoft\PDF Converter\RegistryController.exe"
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SiteAdvisor] "C:\Program Files\SiteAdvisor\6261\SiteAdv.exe"
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe"
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Symantec Fax Starter Edition Port.lnk = C:\Program Files\Microsoft Office\Office\1033\OLFSNT40.EXE
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Open PDF in Word - res://C:\Program Files\ScanSoft\PDF Converter\IEShellExt.dll /100
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related; Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O16 - DPF: {0FAA926E-2AF4-11D3-9995-00A0CC3A27A9} (Infragistics ComboBox Control) - http://tcapps.selu.edu/timecentre/Common/pvcombo.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {7823A620-9DD9-11CF-A662-00AA00C066D2} (PopupMenu Object) - http://tcapps.selu.edu/timecentre/Common/iemenu.cab
O16 - DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} (SABScanProcesses Class) - http://www.superadblocker.com/activex/sabspx.cab
O16 - DPF: {E9C9692E-F93C-11D1-ABB0-0040054FC6FB} (Infragistics DataTable Control 8.0 (OLEDB)) - http://tcapps.selu.edu/timecentre/Common/pvdt80.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = home.domain
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = home.domain
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = home.domain
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL,C:\PROGRA~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll,C:\PROGRA~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LiveUpdate\LuComServer_3_1.EXE
O23 - Service: Fastream IQ Web/FTP Server (NFService) - Fastream Technologies - C:\PROGRA~1\Fastream IQ Web FTP Server Engine\IQWebFTPServerEngine.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\system32\HPZipm12.exe
O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6261\SAService.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S.R.L. - C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - BitDefender - C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe

–
End of file - 9464 bytes

– Files created between 2008-06-28 and 2008-07-28 —————————–

2008-07-28 13:43:58 81984 –a—— C:\WINNT\system32\bdod.bin
2008-07-28 12:10:48 0 d——– C:\Documents and Settings\onyx\Application Data\BitDefender
2008-07-28 12:09:50 0 d——– C:\Program Files\BitDefender
2008-07-28 12:09:50 0 d——– C:\Documents and Settings\All Users\Application Data\BitDefender
2008-07-27 13:50:58 0 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-07-27 13:09:48 0 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-07-27 12:18:29 1473600 —h—– C:\WINNT\ShellIconCache
2008-07-27 12:16:06 0 d——– C:\Documents and Settings\onyx\Application Data\Symantec
2008-07-27 01:57:39 0 d——– C:\Documents and Settings\onyx\DoctorWeb
2008-07-27 00:15:17 0 d——– C:\Documents and Settings\onyx\Application Data\SUPERAntiSpyware.com
2008-07-26 23:53:59 0 d——– C:\Documents and Settings\Default User\Application Data\SiteAdvisor
2008-07-26 23:53:48 0 d——– C:\Program Files\SiteAdvisor
2008-07-26 18:55:58 2158 –a—— C:\WINNT\system32\tmp.reg
2008-07-26 18:55:29 25600 –a—— C:\WINNT\system32\WS2Fix.exe
2008-07-26 18:55:29 289144 –a—— C:\WINNT\system32\VCCLSID.exe
Post #8
Hello

Please do an online scan with Kaspersky WebScanner

Make sure you are using Internet Explorer for this. Click on Kaspersky Online Scanner and click Accept

You will be prompted to install an ActiveX component from Kaspersky, Click Yes.
  • The program will launch and then begin downloading the latest definition files:
  • Once the files have been downloaded click on NEXT
  • Now click on Scan Settings
  • In the scan settings make that the following are selected:
    • Scan using the following Anti-Virus database:
    Extended (if available otherwise Standard)
    • Scan Options:
    Scan Archives
    Scan Mail Bases
  • Click OK
  • Now under select a target to scan:Select My Computer
  • This will program will start and scan your system.
  • The scan will take a while so be patient and let it run.
  • Once the scan is complete it will display if your system has been infected.
    • Now click on the Save as Text button:
  • Save the file to your desktop.
  • Copy and paste that information in your next post.
Post #9
The scan took quite a while, but the result follows: ——————————————————————————- KASPERSKY ONLINE SCANNER REPORT Wednesday, July 30, 2008 23:59:11 Operating System: Microsoft Windows 2000 Professional, Service Pack 4 (Build 2195) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 30/07/2008 Kaspersky Anti-Virus database records: 1026710 ——————————————————————————- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ Scan Statistics: Total number of scanned objects: 164902 Number of viruses found: 5 Number of infected objects: 12 Number of suspicious objects: 0 Duration of the scan process: 15:52:57 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\Default User\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Default User\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\fmeadmin\Desktop\fp2006-final-3.00-setup\fp2006-final-3.00-setup.exe/file1626 Infected: not-virus:BadJoke.JS.RJump skipped C:\Documents and Settings\fmeadmin\Desktop\fp2006-final-3.00-setup\fp2006-final-3.00-setup.exe Inno: infected - 1 skipped C:\Documents and Settings\fmeadmin\Desktop\fp2006-final-3.00-setup.zip/fp2006-final-3.00-setup.exe/file1626 Infected: not-virus:BadJoke.JS.RJump skipped C:\Documents and Settings\fmeadmin\Desktop\fp2006-final-3.00-setup.zip/fp2006-final-3.00-setup.exe Infected: not-virus:BadJoke.JS.RJump skipped C:\Documents and Settings\fmeadmin\Desktop\fp2006-final-3.00-setup.zip ZIP: infected - 2 skipped C:\Documents and Settings\fmeadmin.DELLOPTIPLEX\Local Settings\Temp\DRDld\mbam-setup.exe Infected: not-a-virus:FraudTool.Win32.SpyNoMore.g skipped C:\Documents and Settings\onyx\Application Data\BitDefender\Desktop\Profiles\asdict.dat Object is locked skipped C:\Documents and Settings\onyx\Cookies\index.dat Object is locked skipped C:\Documents and Settings\onyx\Desktop\SmitfraudFix\IEDFix.C.exe Infected: Hoax.Win32.Renos.vaoz skipped C:\Documents and Settings\onyx\Desktop\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped C:\Documents and Settings\onyx\Desktop\software\GeekSquad Service CD.ISO/???/?????/????????????????/file13 Infected: Trojan-Clicker.Win32.Small.to skipped C:\Documents and Settings\onyx\Desktop\software\GeekSquad Service CD.ISO/???/?????/???????????????? Infected: Trojan-Clicker.Win32.Small.to skipped C:\Documents and Settings\onyx\Desktop\software\GeekSquad Service CD.ISO ISOimage: infected - 2 skipped C:\Documents and Settings\onyx\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\onyx\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\onyx\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\onyx\Local Settings\History\History.IE5\MSHist012008072920080730\index.dat Object is locked skipped C:\Documents and Settings\onyx\Local Settings\Temp\hpodvd09.log Object is locked skipped C:\Documents and Settings\onyx\Local Settings\Temp\~DF4504.tmp Object is locked skipped C:\Documents and Settings\onyx\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\onyx\NTUSER.DAT Object is locked skipped C:\Documents and Settings\onyx\ntuser.dat.LOG Object is locked skipped C:\Program Files\BitDefender\BitDefender 2008\as2core\antispam_sig_13363\aspdict.dat Object is locked skipped C:\Program Files\BitDefender\BitDefender 2008\dbokf.db Object is locked skipped C:\Program Files\BitDefender\BitDefender 2008\dbokf.db-journal Object is locked skipped C:\WINNT\AdvPack.log Object is locked skipped C:\WINNT\CSC\00000001 Object is locked skipped C:\WINNT\Debug\PASSWD.LOG Object is locked skipped C:\WINNT\SchedLgU.Txt Object is locked skipped C:\WINNT\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINNT\Sti_Trace.log Object is locked skipped C:\WINNT\system32\config\AppEvent.Evt Object is locked skipped C:\WINNT\system32\config\default Object is locked skipped C:\WINNT\system32\config\default.LOG Object is locked skipped C:\WINNT\system32\config\SAM Object is locked skipped C:\WINNT\system32\config\SAM.LOG Object is locked skipped C:\WINNT\system32\config\SecEvent.Evt Object is locked skipped C:\WINNT\system32\config\SECURITY Object is locked skipped C:\WINNT\system32\config\SECURITY.LOG Object is locked skipped C:\WINNT\system32\config\software Object is locked skipped C:\WINNT\system32\config\software.LOG Object is locked skipped C:\WINNT\system32\config\SysEvent.Evt Object is locked skipped C:\WINNT\system32\config\system Object is locked skipped C:\WINNT\system32\config\SYSTEM.ALT Object is locked skipped C:\WINNT\system32\IEDFix.C.exe Infected: Hoax.Win32.Renos.vaoz skipped C:\WINNT\temp\tmp000023d9\tmp00000000 Object is locked skipped C:\WINNT\WindowsUpdate.log Object is locked skipped Scan process completed.
Post #10
Hello

Please download the OTMoveIt2 by OldTimer.
  • Save it to your desktop.
  • Please double-click OTMoveIt2.exe to run it.
  • Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

    [kill explorer]
C:\Documents and Settings\fmeadmin\Desktop\fp2006-final-3.00-setup
C:\Documents and Settings\onyx\Desktop\software\GeekSquad Service CD.ISO
C:\WINNT\system32\IEDFix.C.exe
purity 
EmptyTemp
[start explorer]
  • Return to OTMoveIt2, right click in the "Paste List of Files/Folders to Move" window (under the light Yellow bar) and choose Paste.
  • Click the red Moveit! button.
  • A log of files and folders moved will be created in the c:\_OTMoveIt\MovedFiles folder in the form of Date and Time (mmddyyyy_hhmmss.log). Please open this log in Notepad and post its contents in your next reply.
  • Close OTMoveIt2
If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.



Please download DirLook by jpshortstuff from here.
  • Double-click DirLook.exe to run it.
  • Copy the content of the following codebox into the textfield 

    C:\Documents and Settings\onyx\Desktop\software
  • Click the DirLook button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply. (Note: The log can also be found at C:\dl_log.txt)

Note: Scanning may take longer for large folders.
Post #11
DirLook output follows:

DirLook.exe by jpshortstuff
Log created at 8:03:06 on Thu 07/31/2008

==============================

Contents of C:\Documents and Settings\onyx\Desktop\software (inc. hidden/system files/folders)

—FOLDERS—

[Architecture Ebook] The Construction of Buildings (created: 04/24/08 09:26p) d——–
AdAware 2008 Free (created: 07/26/08 09:56p) d——–
Ad-Aware Pro 2007 crack and lifetime updates (created: 02/27/08 11:43p) d——–
Ad-Aware.Pro.2007.v7.0.16 (created: 02/18/08 07:04p) d——–
Adobe Acrobat 8 (created: 03/18/08 08:30p) d——–
Adobe Acrobat 9 Professional + New Working Patch-xxrazor (created: 07/07/08 10:41p) d——–
Adobe Acrobat Professional 9.6.4 Full + Crack (created: 03/18/08 08:19p) d——–
AdobeAcrobat8_1 (created: 03/18/08 08:53p) d——–
AdobeAcrobat9_6_4 (created: 03/18/08 08:22p) d——–
All Best Pocket PC Software (Total 60+ Apps) (created: 12/13/07 11:34p) d——–
avast BART CD (created: 02/15/08 10:44p) d——–
AVG Antivirus 8 (created: 07/26/08 11:01p) d——–
BitDefender Total Security trial (created: 07/28/08 11:36a) d——–
Books (created: 05/31/08 11:49p) d——–
Budget Setup (created: 07/26/08 11:09p) d——–
Building Design and Construction Handbook, 6th Edition (created: 04/24/08 09:25p) d——–
CCCleaner2_04 (created: 02/18/08 04:54p) d——–
ClamAntiVirus (created: 02/17/08 08:43p) d——–
ClarkConnect Server (created: 01/20/08 08:53p) d——–
CodeGear Delphi 2007 (created: 10/24/07 10:53p) d——–
Construction Handbook (created: 04/24/08 09:31p) d——–
Deep Freeze Enterprise 6.20.220.1692 Vista Compatible (created: 06/04/08 05:34p) d——–
Deep Freeze Enterprise Edition 5.70.220.1372 (created: 06/04/08 05:19p) d——–
Deep Freeze Standard 6.30.020.1818 (Retail) (created: 06/05/08 11:25p) d——–
Deep Freeze Standard v6.30.020.1875 (created: 06/04/08 05:21p) d——–
Delphi 2007 (created: 10/25/07 08:51p) d——–
Delphi_7 (created: 10/24/07 12:39a) d——–
Delphi2007 (created: 10/24/07 09:58p) d——–
Derive 6 (created: 04/29/08 10:23p) d——–
Derive v6.10 (created: 04/29/08 10:23p) d——–
Design.Science.MathType.v6.0B-ViALUK (created: 11/20/07 10:43p) d——–
DrWebCureMalware (created: 07/27/08 01:16a) d——–
DSS - Deckard's System Scanner (created: 07/28/08 12:08a) d——–
Easy Grade Pro (created: 10/02/07 09:16p) d——–
Essential Delphi (created: 10/24/07 08:20p) d——–
Essential Pascal (created: 10/24/07 09:22p) d——–
Excel.Hacks.2nd.Edition.Jun.2007.OReilly (created: 02/27/08 11:15p) d——–
FlexMail 2007 b1601 (created: 05/15/07 09:52p) d——–
Geek Squad CD (created: 04/29/08 04:39p) d——–
HijackThis_2_0_2 (created: 11/22/07 05:26p) d——–
How To Read A Person Like A Book From EbooksWide (created: 12/16/07 12:39p) d——–
IMSI Turbo Floorplan (created: 03/06/08 10:39p) d——–
Inside Delphi 2006 (created: 10/24/07 08:24p) d——–
Kaspersky Internet Security Suite 2009 Trial (created: 07/27/08 01:09p) d——–
Kaspersky Internet Suite 7 Trial (created: 07/27/08 12:52p) d——–
kbuntu6_06_1x386 (created: 01/26/08 08:37p) d——–
kubuntu7_10 (created: 01/23/08 11:39p) d——–
LINGO_8 (created: 05/31/08 10:55p) d——–
LinuxBooks (created: 07/27/08 12:00p) d——–
Maple 11 Portable (created: 05/13/08 10:17p) d——–
MathCad 14 (created: 05/01/08 11:01p) d——–
MathCAD 14 not iso (created: 05/15/08 09:40p) d——–
MathXpert3.02 (created: 05/03/08 10:41p) d——–
Microsoft Office 2007 Ultimate (created: 11/07/07 12:54a) d——–
Microsoft Windows Server 2003 R2 with SP2 Enterprise Edition VOL MUI (created: 01/10/08 11:48p) d——–
Microsoft.Windows.XP.Professional.Retail.SP3.RC2.Build.3300.Integrated-ETH0 (created: 02/14/08 04:02a) d——–
nLite SlipStream Software (created: 02/15/08 04:52p) d——–
NOD32 Antivirus System 2.70.39 for Windows NT20002003XPVista 3264 (created: 09/02/07 07:14p) d——–
NOD32.Antivirus.System.2.70.39.Incl.Fix-Emzky (created: 09/23/07 07:44p) d——–
Norton360 15day trial (created: 07/27/08 09:44a) d——–
nrgToISO (created: 02/15/08 12:51p) d——–
pclinuxos2008 (created: 01/19/08 07:22p) d——–
Phoenix.Recover.Pro.v6 + keygen [hd2k][dlb] (created: 05/21/08 10:59p) d——–
Predko - Programming and customizing PIC microcontrollers (created: 02/23/08 05:48a) d——–
Primavera.P6 (created: 06/10/08 09:15p) d——–
RemoveItPro (created: 07/26/08 12:52a) d——–
SME Server 7.2 (created: 11/23/07 01:54a) d——–
SMEServer (created: 11/23/07 02:29a) d——–
SPSS 15 (created: 05/07/08 12:08a) d——–
SPSS v16.0.1 + Crack (created: 06/25/08 10:40p) d——–
SPSS.v16-EQUiNOX (created: 06/04/08 09:48p) d——–
Spyware Doctor 5.5.0.178 - Final UPDATED (created: 05/13/08 08:54p) d——–
Super GOO (make your own faces or change your face) {MUST HAVE} [shahazharis] (created: 07/16/08 12:26a) d——–
SUPERAntiSpyware Free (created: 07/27/08 12:13a) d——–
TakeCommand (created: 02/17/08 09:10p) d——–
Taskbar Repair Tool (created: 02/17/08 08:27p) d——–
The Ultimate Troubleshooter v4.64 (created: 07/01/08 09:27p) d——–
TurboCAD Professional 15.1 (created: 06/18/08 11:12p) d——–
ubuntu 7.04 (created: 05/29/07 03:00p) d——–
Ubuntu 710 Desktop Live CD (created: 01/26/08 10:17p) d——–
Ubuntu Unleashed (created: 02/24/08 10:20p) d——–
ubuntu_6_06_1_server_i386 (created: 11/21/07 01:50a) d——–
ubuntu-5.10-live-i386 (created: 01/26/08 10:11p) d——–
ubuntu-7.10 (created: 01/24/08 09:02p) d——–
ubuntu-7.10-server-i386 (created: 11/25/07 10:37p) d——–
ubuntu-8.04.1-server-i386 (created: 07/25/08 01:05a) d——–
Ultimate Math Solver v5.0.1.3 (created: 05/28/07 09:34a) d——–
UltimateBootCD (created: 02/15/08 12:05a) d——–
UltraEdit_older_versions_collection (created: 05/28/07 11:39p) d——–
UltraEdit-32 13.00a+2 (created: 05/28/07 11:29p) d——–
VirtualIron VM (created: 05/29/07 11:16p) d——–
VMWare Player (created: 03/16/08 11:19p) d——–
VMware Workstation v6 0 0 45731 with Keygen (created: 05/29/07 12:04p) d——–
Wiley - Linux Bible 2007 Edition (created: 02/04/08 08:43p) d——–
Windows Home Server - Activates & Updates! (created: 07/23/08 10:36p) d——–
Windows Home Server - OEM - from UseNET to you - byFecalFingers (created: 07/22/08 09:56a) d——–
Windows Server 2003 R2 EE (created: 05/25/08 11:36p) d——–
Windows XP Home SP2 [OEM Edition] (created: 02/14/08 08:22p) d——–
Windows XP Professional SP3 For DELL (created: 07/08/08 12:57a) d——–
Windows XP SP2 Professional(Pre-Activated) (created: 06/17/08 05:07a) d——–
Windows XP Ultimate Edition (created: 02/25/08 09:45p) d——–
WinRAR 3.71 Business Edition (created: 07/23/08 10:23p) d——–
WinXP Pro (created: 02/15/08 12:47p) d——–
WinXP Pro Student Edition (created: 02/15/08 12:49p) d——–
WinZip112 exe (created: 07/23/08 10:38p) d——–
WOLFRAM.RESEARCH.MATHEMATICA.V6.0.3.WINDOWS.LINUX.MAC-EDGEISO (created: 07/12/08 01:28a) d——–
Woodworking manual (created: 04/24/08 09:36p) d——–
WRTG54G v6 firmware (created: 06/21/08 03:58p) d——–
XP PRO OEM SP3 IE7 WMP11 JUNE2008 (created: 06/22/08 04:19a) d——–
XP Pro Performance Edition April 2008 Multi (created: 04/29/08 10:59p) d——–

—FILES—

GeekSquad Service CD.ISO (535341056 bytes, created: 04/29/08 07:42p) –a——
m4tl2k8a.iso (4035084288 bytes, created: 06/17/08 10:40p) –a——
Mastering Delphi 7.pdf (9711 bytes, created: 10/24/07 10:25p) –a——
mtb15.zip (63411477 bytes, created: 06/14/08 09:58p) –a——
OP2007E_PB_CTFORUM.zip (287875503 bytes, created: 05/20/08 05:57p) –a——
pebuilder3110a.exe (3306678 bytes, created: 11/26/07 01:25a) –a——
QuickNEasyFTPserver3lite.zip (364195 bytes, created: 09/23/07 10:57p) –a——
RegCleaner.exe (553687 bytes, created: 03/24/08 12:00a) –a——
SDFixTROJAN.exe (1459431 bytes, created: 07/26/08 06:20p) –a——
SimplyMEPIS-CD_6.5.02_32.iso (715157504 bytes, created: 11/26/07 09:41p) –a——

==============================

=EOF=
Post #12
You got infected because you downloaded a load of cracks and keygens. These all contain malware. We are supposed to refuse help to people who download these. However I will finish up here with you in the hope that you will learn the damage these things do


If you download cracks/keygens again, you will have to reformat as you wont get help here



Please download the OTMoveIt2 by OldTimer.
  • Save it to your desktop.
  • Please double-click OTMoveIt2.exe to run it.
  • Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

    [kill explorer]
C:\Documents and Settings\onyx\Desktop\software\Ad-Aware Pro 2007 crack and lifetime updates
C:\Documents and Settings\onyx\Desktop\software\Adobe Acrobat 9 Professional + New Working Patch-xxrazor
C:\Documents and Settings\onyx\Desktop\software\Adobe Acrobat Professional 9.6.4 Full + Crack
C:\Documents and Settings\onyx\Desktop\software\NOD32.Antivirus.System.2.70.39.Incl.Fix-Emzky
C:\Documents and Settings\onyx\Desktop\software\Phoenix.Recover.Pro.v6 + keygen [hd2k][dlb]
C:\Documents and Settings\onyx\Desktop\software\SPSS v16.0.1 + Crack
C:\Documents and Settings\onyx\Desktop\software\Spyware Doctor 5.5.0.178 - Final UPDATED
purity 
EmptyTemp
[start explorer]
  • Return to OTMoveIt2, right click in the "Paste List of Files/Folders to Move" window (under the light Yellow bar) and choose Paste.
  • Click the red Moveit! button.
  • A log of files and folders moved will be created in the c:\_OTMoveIt\MovedFiles folder in the form of Date and Time (mmddyyyy_hhmmss.log). Please open this log in Notepad and post its contents in your next reply.
  • Close OTMoveIt2
If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.
Post #13
OTMoveIt2 results output after rebooting: Explorer killed successfully File/Folder C:\Documents and Settings\onyx\Desktop\software\Ad-Aware Pro 2007 crack and lifetime updates not found. C:\Documents and Settings\onyx\Desktop\software\Adobe Acrobat 9 Professional + New Working Patch-xxrazor\Adobe_9_pro_Solutions_by__O.S.GR Team moved successfully. C:\Documents and Settings\onyx\Desktop\software\Adobe Acrobat 9 Professional + New Working Patch-xxrazor moved successfully. C:\Documents and Settings\onyx\Desktop\software\Adobe Acrobat Professional 9.6.4 Full + Crack moved successfully. C:\Documents and Settings\onyx\Desktop\software\NOD32.Antivirus.System.2.70.39.Incl.Fix-Emzky moved successfully. < C:\Documents and Settings\onyx\Desktop\software\Phoenix.Recover.Pro.v6 + keygen [hd2k][dlb] > C:\Documents and Settings\onyx\Desktop\software\Phoenix.Recover.Pro.v6 + keygen [hd2k][dlb]\Phoenix_Recover_Pro_v6[1].0\Phoenix Recover Pro v6.0\install moved successfully. C:\Documents and Settings\onyx\Desktop\software\Phoenix.Recover.Pro.v6 + keygen [hd2k][dlb]\Phoenix_Recover_Pro_v6[1].0\Phoenix Recover Pro v6.0 moved successfully. C:\Documents and Settings\onyx\Desktop\software\Phoenix.Recover.Pro.v6 + keygen [hd2k][dlb]\Phoenix_Recover_Pro_v6[1].0 moved successfully. C:\Documents and Settings\onyx\Desktop\software\Phoenix.Recover.Pro.v6 + keygen [hd2k][dlb] moved successfully. C:\Documents and Settings\onyx\Desktop\software\SPSS v16.0.1 + Crack moved successfully. C:\Documents and Settings\onyx\Desktop\software\Spyware Doctor 5.5.0.178 - Final UPDATED moved successfully. < purity > < EmptyTemp > File delete failed. C:\DOCUME~1\onyx\LOCALS~1\Temp\hpodvd09.log scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\onyx\LOCALS~1\Temp\~DFA555.tmp scheduled to be deleted on reboot. File delete failed. C:\WINNT\temp\tmp00003a62\tmp00000000 scheduled to be deleted on reboot. Temp folders emptied. IE temp folders emptied. Explorer started successfully OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 07312008_173642 Files moved on Reboot… C:\DOCUME~1\onyx\LOCALS~1\Temp\hpodvd09.log moved successfully. C:\DOCUME~1\onyx\LOCALS~1\Temp\~DFA555.tmp moved successfully. C:\WINNT\temp\tmp00003a62\tmp00000000 moved successfully.
Post #14
Your logs are clean

You now need to update your Java and remove your older versions.

Please follow these steps to remove older version Java components.

* Click Start > Control Panel.
* Click Add/Remove Programs.
* Check any item with Java Runtime Environment (JRE) in the name.
* Click the Remove or Change/Remove button.

Download the latest version of Java Runtime Environment (JRE), and install it to your computer from
here



Now we need to create a new System Restore point.

Click Start Menu > Run > type (or copy and paste)

%SystemRoot%\System32\restore\rstrui.exe

Press OK. Choose Create a Restore Point then click Next. Name it and click Create, when the confirmation screen shows the restore point has been created click Close.

Next goto Start Menu > Run > type

cleanmgr

Click OK, Disk Cleanup will open and start calculating the amount of space that can be freed, Once thats finished it will open the Disk Cleanup options screen, click the More Options tab then click Clean up on the system restore area and choose Yes at the confirmation window which will remove all the restore points except the one we just created.

To close Disk Cleanup and remove the Temporary Internet Files detected in the initial scan click OK then choose Yes on the confirmation window.



  • Make sure you have an Internet Connection.
  • Double-click OTMoveIt2.exe to run it.
  • Click on the CleanUp! button
  • A list of tool components used in the Cleanup of malware will be downloaded.
  • If your Firewall or Real Time protection attempts to block OtMoveit2 to rech the Internet, please allow the application to do so.
  • Click Yes to beging the Cleanup process and remove these components, including this application.
  • You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.


Below I have included a number of recommendations for how to protect your computer against malware infections.

* Keep Windows updated by regularly checking their website at :
http://windowsupdate.microsoft.com/
This will ensure your computer has always the latest security updates available installed on your computer.

* To reduce re-infection for malware in the future, I strongly recommend installing these free programs:

SpywareBlaster protects against bad ActiveX
IE-SPYAD puts over 5000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all
Have a look at this tutorial for IE-Spyad here

* SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program or there will be a conflict.

Make Internet Explorer more secure
  • Click Start > Run
  • Type Inetcpl.cpl & click OK
  • Click on the Security tab
  • Click Reset all zones to default level
  • Make sure the Internet Zone is selected & Click Custom level
  • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
  • Next Click OK, then Apply button and then OK to exit the Internet Properties page.

* MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.

* Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more
secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in pop up
blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from
Here

* Take a good look at the following suggestions for malware prevention by reading Tony Klein’s article 'How Did I Get Infected In The First Place'
Here

Thank you for your patience, and performing all of the procedures requested.
Post #15
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI