What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Thinkpad A31p w spontaneous browser windows

10 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
My browser started going crazy a few days ago when I accidentally clicked on something I shouldn't have. Numerous windows open by themselves and they're all advertisements. Closing some or all of them doesn't help, and after awhile my taskbar disappears and the laptop freezes. Websites that I go to on purpose no longer work right. I attempted to bring my windows updates current as per your instructions but failed. Below is my log.


Monique



Logfile of HijackThis v1.99.1
Scan saved at 10:59:35, on 8/10/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SUJNIFVTRVI\command.exe
C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\Program Files\Network Monitor\netmon.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Program Files\FastAccessDSL\HelpCenter43\bin\sprtcmd.exe
C:\Program Files\BellSouthWCC\McciTrayApp.exe
C:\Program Files\CyberLink\PowerDVD SE\PDVDServ.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
C:\WINDOWS\mrofinu572.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Motive\BellSouthBrowser.exe
C:\WINDOWS\System32\Rundll32.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skra\Skra.exe
C:\Documents and Settings\Monique\Application Data\SpeedRunner\SpeedRunner.exe
C:\Documents and Settings\Monique\Application Data\Microsoft\Windows\spcukk.exe
C:\DOCUME~1\Monique\MYDOCU~1\SMBOLS~1\spoolsv.exe
C:\WINDOWS\system32\?asks\r?ndll32.exe
C:\PROGRA~1\COMMON~1\ozmz\ozmzm.exe
C:\Program Files\GetPack\GetPack20.exe
C:\Program Files\MSOffice2000\Office\1033\OLFSNT40.EXE
C:\Program Files\MSWorks45a\Calendar\WKCALREM.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\PROGRA~1\COMMON~1\ozmz\ozmza.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O3 - Toolbar: AT&T Toolbar - {4E7BD74F-2B8D-469E-8CBD-FD60BB9AAE2E} - C:\PROGRA~1\BLSTOO~1\BLSTOO~1.DLL
O4 - HKLM\..\Run: [HelpCenter4.1] C:\Program Files\FastAccessDSL\HelpCenter43\bin\sprtcmd.exe /P HelpCenter4.1
O4 - HKLM\..\Run: [MotiveReportAgent] "C:\Program Files\Common Files\Motive\McciBootStrapper.exe" /url="-url=file://C:\Program Files\Common Files\Motive\ReportAgent.html" /browsertype=CustomMSIE /browserpath="C:\Program Files\Common Files\Motive\BellSouthBrowser.exe" /hidden
O4 - HKLM\..\Run: [BellSouthWCC_McciTrayApp] C:\Program Files\BellSouthWCC\McciTrayApp.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD SE\PDVDServ.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime750\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\Scansoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\mrofinu572.exe 61A847B5BBF728173599284503996897C881250221C8670836AC4FA7C88332017491394661A64DB7
C8F0287E55E246220D9E728F9FC17D446BC57D5375FB0FB68AD6
O4 - HKLM\..\Run: [34401059] rundll32.exe "C:\WINDOWS\system32\wathqybw.dll",b
O4 - HKLM\..\Run: [{fc08d908-5d2e-ce30-adbd-b010252acf8e}] C:\WINDOWS\System32\Rundll32.exe "C:\WINDOWS\system32\azxhorvziqwb.dll" DllStart
O4 - HKLM\..\Run: [BM377323c5] Rundll32.exe "C:\WINDOWS\system32\miplslib.dll",s
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skra] C:\Program Files\Skra\Skra.exe
O4 - HKCU\..\Run: [SpeedRunner] C:\Documents and Settings\Monique\Application Data\SpeedRunner\SpeedRunner.exe
O4 - HKCU\..\Run: [SfKg6wIP] C:\Documents and Settings\Monique\Application Data\Microsoft\Windows\spcukk.exe
O4 - HKCU\..\Run: [Uahe] "C:\DOCUME~1\Monique\MYDOCU~1\SMBOLS~1\spoolsv.exe" -vt yazb
O4 - HKCU\..\Run: [Avdpi] C:\WINDOWS\system32\?asks\r?ndll32.exe
O4 - HKCU\..\Run: [ozmz] C:\PROGRA~1\COMMON~1\ozmz\ozmzm.exe
O4 - HKCU\..\Run: [GetPack20] "C:\Program Files\GetPack\GetPack20.exe"
O4 - Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\MSWorks45a\Calendar\WKCALREM.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\MSOffice2000\Office\OSA9.EXE
O4 - Global Startup: Symantec Fax Starter Edition Port.lnk = C:\Program Files\MSOffice2000\Office\1033\OLFSNT40.EXE
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://support.att.net/sdccommon/download/tgctlcm.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://pcpitstop.com/betapit/PCPitStop.CAB
O16 - DPF: {2DAD3559-2923-4935-AD49-B673D2539944} (IASRunner Class) - http://www-307.ibm.com/pc/support/acpir.cab
O16 - DPF: {321FB770-1FBE-4BFE-BDC1-6F622D4FA499} - https://pbells.broadjump.com/wizlet/iw60/st…aller_4-0-0.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1210984409787
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1210990980218
O16 - DPF: {9BFC2253-B9D9-477E-9488-CA450232620D} (BinAg1 Class) - https://pbells.broadjump.com/wizlet/iw60/st…flowActiveX.CAB
O16 - DPF: {EA7F451B-94DD-4009-A8BF-8F977B0B2696} - http://pbells.broadjump.com/wizlet/Standar…aller_4-2-0.cab
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\SUJNIFVTRVI\command.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
O23 - Service: McciCMService - Unknown owner - C:\Program Files\Common Files\Motive\McciCMService.exe (file missing)
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
Post #2
Hello Monique6ft

Welcome to the Whatthetech Malware Removal Forum, sorry about the delay, but the amount of people posting with infected computers is through the roof and sometimes we can't get to logs as fast as we would like to.

Your infected with the SDBot Worm :blush:


This tool needs to be run from Safemode to be effective so download it to your desktop then boot to Safemode to run it

To Enter Safemode

  • Go to Start> Shut off your Computer> Restart
  • As the computer starts to boot-up, Tap the F8 KEY somewhat rapidly,
    this will bring up a menu.
  • Use the Up and Down Arrow Keys to scroll up to Safemode
  • Then press the Enter Key on your Keyboard
Tutorial if you need it How to boot into Safemode


Download SDFix and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer in Safe Mode by doing the following :
  • Restart your computer
  • After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
  • Instead of Windows loading as normal, the Advanced Options Menu should appear;
  • Select the first option, to run Windows in Safe Mode, then press Enter.
  • Choose your usual account.
  • Open the extracted SDFix folder and double click RunThis.bat to start the script.
  • Type Y to begin the cleanup process.
  • It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
  • Press any Key and it will restart the PC.
  • When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
  • Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
    (Report.txt will also be copied to Clipboard ready for posting back on the forum).
  • Finally paste the contents of the Report.txt back on the forum with a new HijackThis log
Post #3
OK, a few strange things happened. I'm posting here on a 2nd computer because the infected one won't load the forum pages. So I downloaded SDFix to this 2nd computer then transferred it to the infected computer, then attempted to install it but got this error:

"CRC failed in SDFix\apps\ERUNT.EXE
Unexpected end of archive"

So I downloaded it again, this time straight to the infected machine, and it installed and ran as per your instructions. Upon the last bootup I immediately got a Windows error box titled RUNDLL that had an OK button and the red X-button. It said this:

"Error loading C:\WINDOWS\system32\azxhorvziqwb.dll
The specified module could not be found."

I clicked on OK, then got another error box right away. This one was titled Internet Explorer and had buttons for yes, no and the red X. It said this:

"Do you want to allow software such as ActiveX controls and plug-ins to run?"

I clicked the red X but that box re-appeared over and over again. Closing it with ALT-F4 several times makes it disappear for a few minutes but then it pops up again over and over. The laptop went back to opening advertising come-on sites on its own. Below are the logs.

Btw, may I ask which lines in the original log told you I had this worm? Just curious…


Monique

P.S. How do I insert bitmaps into a post? I took screenshots of the error msgs and pasted them into Paint to be saved as bmp files. Trying to copy and paste from Paint into this post failed.



************************************



SDFix: Version 1.216
Run by [removed] on Fri 08/15/2008 at 00:06

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix

Checking Services :

Name :
cmdService
Network Monitor

Path :
C:\WINDOWS\SUJNIFVTRVI\command.exe
C:\Program Files\Network Monitor\netmon.exe service

cmdService - Deleted
Network Monitor - Deleted



Restoring Default Security Values
Restoring Default Hosts File

Rebooting


Checking Files :

Trojan Files Found:

C:\WINDOWS\system32\mlJCUKeE.dll - Deleted
C:\WINDOWS\system32\azxhorvziqwb.dll - Deleted
C:\WINDOWS\SUJNIFVTRVI\asappsrv.dll - Deleted
C:\WINDOWS\SUJNIFVTRVI\command.exe - Deleted
C:\WINDOWS\SUJNIFVTRVI\moLhKIpnlpK.vbs - Deleted
C:\Documents and Settings\Monique\Application Data\SpeedRunner\config.cfg - Deleted
C:\Documents and Settings\Monique\Application Data\SpeedRunner\SRUninstall.exe - Deleted
C:\Documents and Settings\Monique\Application Data\SpeedRunner\SpeedRunner.exe - Deleted
C:\Documents and Settings\LocalService\Application Data\NetMon\log.txt - Deleted
C:\Documents and Settings\LocalService\Application Data\NetMon\domains.txt - Deleted
C:\Program Files\BChanger\data.dat - Deleted
C:\Program Files\BChanger\bchanger.dll - Deleted
C:\Program Files\BChanger\Uninstall.exe - Deleted
C:\Program Files\GetPack\GetPack20.exe - Deleted
C:\Program Files\GetPack\trgtame.gz - Deleted
C:\Program Files\GetPack\dictame.gz - Deleted
C:\Program Files\iCheck\iCheck.exe - Deleted
C:\Program Files\iCheck\Uninstall.exe - Deleted
C:\Program Files\Mjcore\Mjcore.dll - Deleted
C:\Program Files\QdrDrive\QdrDrive20.dll - Deleted
C:\Program Files\QdrDrive\qdrloader.exe - Deleted
C:\Program Files\Skra\Skra.exe - Deleted
C:\Program Files\VnrBlock\VnrBlock20.exe - Deleted
C:\Program Files\VnrBlock\xtarga.gz - Deleted
C:\Program Files\Webtools\webtools.dll - Deleted
C:\Program Files\Common Files\Yazzle1560OinAdmin.exe - Deleted
C:\Program Files\Common Files\Yazzle1560OinUninstaller.exe - Deleted
C:\DOCUME~1\Monique\LOCALS~1\Temp\gettpa420.exe - Deleted
C:\DOCUME~1\Monique\LOCALS~1\Temp\tmp8D.tmp - Deleted
C:\WINDOWS\b103.exe - Deleted
C:\WINDOWS\b104.exe - Deleted
C:\WINDOWS\b116.exe - Deleted
C:\WINDOWS\b152.exe - Deleted
C:\WINDOWS\b155.exe - Deleted
C:\WINDOWS\b156.exe - Deleted
C:\WINDOWS\b158.exe - Deleted
C:\WINDOWS\b157.exe - Deleted
C:\WINDOWS\mrofinu572.exe - Deleted
C:\WINDOWS\mrofinu_upx.exe - Deleted
C:\Program Files\Network Monitor\netmon.exe - Deleted
C:\DOCUME~1\Monique\LOCALS~1\Temp\removalfile.bat - Deleted
C:\WINDOWS\system32\atmtd.dll - Deleted
C:\WINDOWS\system32\atmtd.dll._ - Deleted
C:\WINDOWS\uninstall_nmon.vbs - Deleted



Folder C:\Documents and Settings\Monique\Application Data\SpeedRunner - Removed
Folder C:\Program Files\BChanger - Removed
Folder C:\Program Files\GetPack - Removed
Folder C:\Program Files\iCheck - Removed
Folder C:\Program Files\InetGet2 - Removed
Folder C:\Program Files\Mjcore - Removed
Folder C:\Program Files\Network Monitor - Removed
Folder C:\Program Files\QdrDrive - Removed
Folder C:\Program Files\Skra - Removed
Folder C:\Program Files\VnrBlock - Removed
Folder C:\Program Files\Webtools - Removed
Folder C:\Documents and Settings\LocalService\Application Data\NetMon - Removed


Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-15 00:13:59
Windows 5.1.2600 Service Pack 3 FAT NTAPI

scanning hidden processes …

scanning hidden services …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"="C:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe:*:Disabled:@xpsp3res.dll,-20000"
"C:\\WINDOWS\\system32\\sessmgr.exe"="C:\\WINDOWS\\system32\\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\TurboTax\\Home & Business 2007\\32bit\\ttax.exe"="C:\\Program Files\\TurboTax\\Home & Business 2007\\32bit\\ttax.exe:LocalSubNet:Enabled:TurboTax"
"C:\\Program Files\\TurboTax\\Home & Business 2007\\32bit\\updatemgr.exe"="C:\\Program Files\\TurboTax\\Home & Business 2007\\32bit\\updatemgr.exe:LocalSubNet:Enabled:TurboTax Update Manager"
"C:\\Program Files\\TurboTax\\Home & Business 2006\\32bit\\Ttax.exe"="C:\\Program Files\\TurboTax\\Home & Business 2006\\32bit\\Ttax.exe:LocalSubNet:Enabled:TurboTax"
"C:\\Program Files\\TurboTax\\Home & Business 2006\\32bit\\updatemgr.exe"="C:\\Program Files\\TurboTax\\Home & Business 2006\\32bit\\updatemgr.exe:LocalSubNet:Enabled:TurboTax Update Manager"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

Remaining Files :


File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes :

Thu 8 Jun 2000 92,992 ..SH. — "C:\COMMAND.COM"
Thu 29 May 2008 230,400 ..SHR — "C:\WINDOWS\system32\?asks\r?ndll32.exe"
Fri 23 May 2008 0 A.SH. — "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Sat 9 Aug 2008 68,608 ..SHR — "C:\Documents and Settings\Monique\My Documents\s?mbols\spoolsv.exe"

Finished!



**************************************



Logfile of HijackThis v1.99.1
Scan saved at 00:20:02, on 8/15/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\FastAccessDSL\HelpCenter43\bin\sprtcmd.exe
C:\Program Files\BellSouthWCC\McciTrayApp.exe
C:\Program Files\CyberLink\PowerDVD SE\PDVDServ.exe
C:\Program Files\Common Files\Motive\BellSouthBrowser.exe
C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\DOCUME~1\Monique\MYDOCU~1\SMBOLS~1\spoolsv.exe
C:\WINDOWS\system32\?asks\r?ndll32.exe
C:\PROGRA~1\COMMON~1\ozmz\ozmzm.exe
C:\Program Files\MSOffice2000\Office\1033\OLFSNT40.EXE
C:\Program Files\MSWorks45a\Calendar\WKCALREM.EXE
C:\PROGRA~1\COMMON~1\ozmz\ozmza.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O3 - Toolbar: AT&T; Toolbar - {4E7BD74F-2B8D-469E-8CBD-FD60BB9AAE2E} - C:\PROGRA~1\BLSTOO~1\BLSTOO~1.DLL
O4 - HKLM\..\Run: [HelpCenter4.1] C:\Program Files\FastAccessDSL\HelpCenter43\bin\sprtcmd.exe /P HelpCenter4.1
O4 - HKLM\..\Run: [MotiveReportAgent] "C:\Program Files\Common Files\Motive\McciBootStrapper.exe" /url="-url=file://C:\Program Files\Common Files\Motive\ReportAgent.html" /browsertype=CustomMSIE /browserpath="C:\Program Files\Common Files\Motive\BellSouthBrowser.exe" /hidden
O4 - HKLM\..\Run: [BellSouthWCC_McciTrayApp] C:\Program Files\BellSouthWCC\McciTrayApp.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD SE\PDVDServ.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime750\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\Scansoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [{fc08d908-5d2e-ce30-adbd-b010252acf8e}] C:\WINDOWS\System32\Rundll32.exe "C:\WINDOWS\system32\azxhorvziqwb.dll" DllStart
O4 - HKLM\..\Run: [34401059] rundll32.exe "C:\WINDOWS\system32\wejbuekh.dll",b
O4 - HKLM\..\Run: [BM377323c5] Rundll32.exe "C:\WINDOWS\system32\gxquviph.dll",s
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Uahe] "C:\DOCUME~1\Monique\MYDOCU~1\SMBOLS~1\spoolsv.exe" -vt yazb
O4 - HKCU\..\Run: [Avdpi] C:\WINDOWS\system32\?asks\r?ndll32.exe
O4 - HKCU\..\Run: [ozmz] C:\PROGRA~1\COMMON~1\ozmz\ozmzm.exe
O4 - Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\MSWorks45a\Calendar\WKCALREM.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\MSOffice2000\Office\OSA9.EXE
O4 - Global Startup: Symantec Fax Starter Edition Port.lnk = C:\Program Files\MSOffice2000\Office\1033\OLFSNT40.EXE
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://support.att.net/sdccommon/download/tgctlcm.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://pcpitstop.com/betapit/PCPitStop.CAB
O16 - DPF: {2DAD3559-2923-4935-AD49-B673D2539944} (IASRunner Class) - http://www-307.ibm.com/pc/support/acpir.cab
O16 - DPF: {321FB770-1FBE-4BFE-BDC1-6F622D4FA499} - https://pbells.broadjump.com/wizlet/iw60/st…aller_4-0-0.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1210984409787
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1210990980218
O16 - DPF: {9BFC2253-B9D9-477E-9488-CA450232620D} (BinAg1 Class) - https://pbells.broadjump.com/wizlet/iw60/st…flowActiveX.CAB
O16 - DPF: {EA7F451B-94DD-4009-A8BF-8F977B0B2696} - http://pbells.broadjump.com/wizlet/Standar…aller_4-2-0.cab
O20 - AppInit_DLLs: rndmxf.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
O23 - Service: McciCMService - Unknown owner - C:\Program Files\Common Files\Motive\McciCMService.exe (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
Post #4
Good Morning Monique,

You have a few issues going on and sometimes removing this garbage does not go smoothly, but your doing fine :thumbup:

SDBot worm, these mainly
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\SUJNIFVTRVI\command.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe


Your still infected with some other garbage including the Vundo Trojan so we are not done yet

This will also fix that error your getting
Open HijackThis > Do a System Scan Only, close your browser and all open windows including this one, the only program or window you should have open is HijackThis, check the following entries and click on Fix Checked.

O4 - HKLM\..\Run: [{fc08d908-5d2e-ce30-adbd-b010252acf8e}] C:\WINDOWS\System32\Rundll32.exe "C:\WINDOWS\system32\azxhorvziqwb.dll" DllStart
O4 - HKLM\..\Run: [34401059] rundll32.exe "C:\WINDOWS\system32\wejbuekh.dll",b
O4 - HKLM\..\Run: [BM377323c5] Rundll32.exe "C:\WINDOWS\system32\gxquviph.dll",s
O4 - HKCU\..\Run: [Avdpi] C:\WINDOWS\system32\?asks\r?ndll32.exe
O4 - HKCU\..\Run: [ozmz] C:\PROGRA~1\COMMON~1\ozmz\ozmzm.exe

O20 - AppInit_DLLs: rndmxf.dll




Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.<– Don't forget this
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy and Paste the entire report in your next reply along with a New Hijackthis log.
Post #5
Hmm, for the 2nd and 3d entries my scan results do not match yours. The filenames at the end are different like so: O4-HKLM\…\Run: [34401059] rundll32.exe "C:\Windows\system32\gxmrjjcj.dll",b O4-HKLM\…\Run: [BM377323c5] Rundll32.exe "C:\Windows\system32\sutkjdxo.dll",s Also my scan doesn't show an O20 entry – it goes from O16 to O21 So do I still check off my version of those lines? I'm going to hold off until I hear from you just to be safe. Monique
Post #6
These infections have a way of changing file names so remove what I posted including these, if the ones I posted are no longer there than don't worry about it, but do run Malwarebytes and post the log along with a new HJT log
O4-HKLM\…\Run: [34401059] rundll32.exe "C:\Windows\system32\gxmrjjcj.dll",b
O4-HKLM\…\Run: [BM377323c5] Rundll32.exe "C:\Windows\system32\sutkjdxo.dll",s <—Remove these also
Post #7
Thanks for the clarification. Below are the new logs. The date on the mbam log is wrong – it was taken on 8/17.

I'm still getting the same behavior on the computer, although it seems a little less frantic now.


Monique



************************************



bMalwarebytes' Anti-Malware 1.24
Database version: 1061
Windows 5.1.2600 Service Pack 3

1:42:47 PM 8/16/2008
mbam-log-8-16-2008 (13-42-47).txt

Scan type: Quick Scan
Objects scanned: 48707
Time elapsed: 3 minute(s), 44 second(s)

Memory Processes Infected: 2
Memory Modules Infected: 6
Registry Keys Infected: 27
Registry Values Infected: 3
Registry Data Items Infected: 2
Folders Infected: 3
Files Infected: 42

Memory Processes Infected:
C:\Documents and Settings\Monique\My Documents\s?mbols\spoolsv.exe (Adware.ClickSpring) -> Unloaded process successfully.
C:\Program Files\Common Files\ozmz\ozmza.exe (Trojan.Downloader) -> Unloaded process successfully.

Memory Modules Infected:
C:\WINDOWS\system32\urqRIxvW.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\gxmrjjcj.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\fhqcismt.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\oyxhjjvr.dll (Trojan.Vundo) -> Delete on reboot.
C:\Program Files\Common Files\ozmz\ozmzd\ozmzc.dll (Adware.TargetServer) -> Delete on reboot.
C:\WINDOWS\system32\aagpmj.dll (Trojan.Vundo) -> Delete on reboot.

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30fd3f64-bea6-42a5-bff3-4d3e7bd20186} (Trojan.Vundo) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{30fd3f64-bea6-42a5-bff3-4d3e7bd20186} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{98a68d4f-5932-41ea-9565-8b0e336b01bf} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{98a68d4f-5932-41ea-9565-8b0e336b01bf} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{fa35ef4b-27dd-2d05-ff38-0ca2ed981ac5} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{fa35ef4b-27dd-2d05-ff38-0ca2ed981ac5} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{17e44256-51e0-4d46-a0c8-44e80ab4ba5b} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{e0f01490-dcf3-4357-95aa-169a8c2b2190} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{ff46f4ab-a85f-487e-b399-3f191ac0fe23} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{2e4a04a1-a24d-45ae-aca4-949778400813} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{63334394-3da3-4b29-a041-03535909d361} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\testcpv6.bho (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\testcpv6.bho.1 (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\bannerstyle (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Webtools (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\SpeedRunner (Adware.SurfAccuracy) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\testCPV6.DLL (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\TSA (Adware.TargetSaver) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IProxyProvider (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\34401059 (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\Extensions\{59a40ac9-e67d-4155-b31d-4b7330fcd2d6} (Adware.PurityScan) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bm377323c5 (Trojan.Agent) -> Delete on reboot.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo) -> Data: c:\windows\system32\urqrixvw -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\urqrixvw -> Delete on reboot.

Folders Infected:
C:\Program Files\Outerinfo (Adware.Outerinfo) -> Quarantined and deleted successfully.
C:\Program Files\Outerinfo\FF (Adware.Outerinfo) -> Quarantined and deleted successfully.
C:\Program Files\Outerinfo\FF\components (Adware.Outerinfo) -> Quarantined and deleted successfully.

Files Infected:
C:\WINDOWS\system32\urqRIxvW.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\WvxIRqru.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\WvxIRqru.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\aagpmj.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\wmaamyou.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\uoymaamw.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\gxmrjjcj.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\jcjjrmxg.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\fhqcismt.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\tmsicqhf.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\oyxhjjvr.dll (Trojan.Vundo) -> Delete on reboot.
C:\Documents and Settings\Monique\My Documents\s?mbols\spoolsv.exe (Adware.ClickSpring) -> Quarantined and deleted successfully.
C:\Program Files\Common Files\ozmz\ozmza.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Program Files\Common Files\ozmz\ozmzd\ozmzc.dll (Adware.TargetServer) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\rpmfm.dll (Trojan.BHO) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mlmxxgia.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\cagojw.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\jvpmjhyj.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\tsuninst.exe (Spyware.TargetSaver) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\xdemelds.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ganncltfsrclgf.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\fjslpeyq.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\tliqfhpe.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\lhyfjryg.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ttlpdjhh.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Monique\Local Settings\Temporary Internet Files\Content.IE5\EW5MAXHZ\kb65666[1] (Trojan.Vundo) -> Delete on reboot.
C:\Documents and Settings\Monique\Local Settings\Temporary Internet Files\Content.IE5\EW5MAXHZ\kb767887[1] (Trojan.Vundo) -> Delete on reboot.
C:\Documents and Settings\Monique\Local Settings\Temporary Internet Files\Content.IE5\EW5MAXHZ\kb456456[1] (Trojan.Vundo) -> Delete on reboot.
C:\Documents and Settings\Monique\Application Data\Microsoft\Windows\spcukk.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Program Files\Outerinfo\FF\install.rdf (Adware.Outerinfo) -> Quarantined and deleted successfully.
C:\Program Files\Outerinfo\FF\chrome.manifest (Adware.Outerinfo) -> Quarantined and deleted successfully.
C:\Program Files\Outerinfo\FF\components\FF.dll (Adware.Outerinfo) -> Quarantined and deleted successfully.
C:\Program Files\Outerinfo\FF\components\OuterinfoAds.xpt (Adware.Outerinfo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mcrh.tmp (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\cookies.ini (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\lcdocqeh.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\pskt.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\opnnmKeC.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\rqRJDtSj.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\urqQghfE.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\BM377323c5.xml (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\BM377323c5.txt (Trojan.Vundo) -> Quarantined and deleted successfully.



*****************************************************



Logfile of HijackThis v1.99.1
Scan saved at 13:53:34, on 8/17/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Program Files\FastAccessDSL\HelpCenter43\bin\sprtcmd.exe
C:\Program Files\BellSouthWCC\McciTrayApp.exe
C:\Program Files\CyberLink\PowerDVD SE\PDVDServ.exe
C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
C:\Program Files\Common Files\Motive\BellSouthBrowser.exe
C:\WINDOWS\system32\ctfmon.exe
C:\DOCUME~1\Monique\MYDOCU~1\SMBOLS~1\spoolsv.exe
C:\Program Files\MSOffice2000\Office\1033\OLFSNT40.EXE
C:\Program Files\MSWorks45a\Calendar\WKCALREM.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\rundll32.exe
C:\Documents and Settings\Monique\Application Data\??mantec\w?nspool.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O3 - Toolbar: AT&T Toolbar - {4E7BD74F-2B8D-469E-8CBD-FD60BB9AAE2E} - C:\PROGRA~1\BLSTOO~1\BLSTOO~1.DLL
O4 - HKLM\..\Run: [HelpCenter4.1] C:\Program Files\FastAccessDSL\HelpCenter43\bin\sprtcmd.exe /P HelpCenter4.1
O4 - HKLM\..\Run: [MotiveReportAgent] "C:\Program Files\Common Files\Motive\McciBootStrapper.exe" /url="-url=file://C:\Program Files\Common Files\Motive\ReportAgent.html" /browsertype=CustomMSIE /browserpath="C:\Program Files\Common Files\Motive\BellSouthBrowser.exe" /hidden
O4 - HKLM\..\Run: [BellSouthWCC_McciTrayApp] C:\Program Files\BellSouthWCC\McciTrayApp.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD SE\PDVDServ.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime750\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\Scansoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [BM377323c5] Rundll32.exe "C:\WINDOWS\system32\dhgmylej.dll",s
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Uahe] "C:\DOCUME~1\Monique\MYDOCU~1\SMBOLS~1\spoolsv.exe" -vt yazb
O4 - HKCU\..\Run: [Dqefb] "C:\Documents and Settings\Monique\Application Data\??mantec\w?nspool.exe"
O4 - Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\MSWorks45a\Calendar\WKCALREM.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\MSOffice2000\Office\OSA9.EXE
O4 - Global Startup: Symantec Fax Starter Edition Port.lnk = C:\Program Files\MSOffice2000\Office\1033\OLFSNT40.EXE
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://support.att.net/sdccommon/download/tgctlcm.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://pcpitstop.com/betapit/PCPitStop.CAB
O16 - DPF: {2DAD3559-2923-4935-AD49-B673D2539944} (IASRunner Class) - http://www-307.ibm.com/pc/support/acpir.cab
O16 - DPF: {321FB770-1FBE-4BFE-BDC1-6F622D4FA499} - https://pbells.broadjump.com/wizlet/iw60/st…aller_4-0-0.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1210984409787
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1210990980218
O16 - DPF: {9BFC2253-B9D9-477E-9488-CA450232620D} (BinAg1 Class) - https://pbells.broadjump.com/wizlet/iw60/st…flowActiveX.CAB
O16 - DPF: {EA7F451B-94DD-4009-A8BF-8F977B0B2696} - http://pbells.broadjump.com/wizlet/Standar…aller_4-2-0.cab
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
O23 - Service: McciCMService - Unknown owner - C:\Program Files\Common Files\Motive\McciCMService.exe (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
Post #8
Hello Monique,

Keep in mind like I posted earlier, you have had some major infections on this system and most need some work to get your system back to normal. Before we proceed any further I would like you to drag Hijackthis to the trash as its out dated and download and install the latest version by Trendmicro.

Download Trendmicros Hijackthis to your desktop.
  • Double click it to install
  • Follow the prompts and by default it will install in C:\Program Files\Trendmicro\Hijackthis\Highjackthis.exe



Please download ATF Cleaner by Atribune to your desktop.
  • This program is for XP and Windows 2000 only
  • Double-click ATF-Cleaner.exe to run the program.
  • Under Main choose: Select All
  • Click the Empty Selected button.
Your system may start up slower after running ATF Cleaner, this is expected but will be back to normal after the first or second boot up
Please note: If you use online banking or are registered online with any other organizations, ensure you have memorized password and other personal information as removing cookies will temporarily disable the auto-login facility.







Download ComboFix from Here or Here to your Desktop.

In the event you already have Combofix, this is a new version that I need you to download.
It must be saved directly to your desktop.


1. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

  • Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan.
  • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
  • Remember to re enable the protection again afterwards before connecting to the net


2. Close any open browsers and make sure you are disconnected from the net. Unplug the cable if need be before running combofix.
  • IF you have not already done so Combofix will disconnect your machine from the Internet when it starts.
  • If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.

3. Now double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review

Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze.




  • Open HJT Scan and Save a Log File, it will open in Notepad
  • Go to Format and make sure Wordwrap is Unchecked
  • Go to Edit> Select All…..Edit > Copy and Paste the new log into this thread by using the Post Reply and not start a New Thread.
Post #9
I ran into a couple of problems with your instructions, hopefully minor. As I said I have to access this thread on a 2nd computer because the infected one won't load it. Meaning I had no links to click to get combofix on the infected machine. Typing out the URLs in order to "download directly to my desktop" failed also, because the 1st link gave me a 404 error, and the 2nd link gave me an "internal webserver error". In the end I had to download combofix to my 2nd computer, then transfer it to the infected one. It did seem to work without a hitch.

I had no antivirus or malware detection programs to disable because I had none installed. After running combofix and while I was still disconnected from the net I installed Avast and Comodo so that should help for the future.


Monique



**************************************************



ComboFix 08-08-18.01 - Monique 2008-08-18 21:05:31.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.689 [GMT -4:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Administrator\UserData
C:\Documents and Settings\Administrator\UserData\144NPTOX\oWindowsUpdate[1].xml
C:\Documents and Settings\Administrator\UserData\index.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\CPV.stt
C:\Documents and Settings\Monique\Application Data\macromedia\Flash Player\#SharedObjects\2JTSFLV2\interclick.com
C:\Documents and Settings\Monique\Application Data\macromedia\Flash Player\#SharedObjects\2JTSFLV2\interclick.com\ud.sol
C:\Documents and Settings\Monique\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com
C:\Documents and Settings\Monique\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol
C:\Documents and Settings\Monique\Application Data\MANTEC~1
C:\Documents and Settings\Monique\Application Data\MANTEC~1\w?nspool.exe
C:\Documents and Settings\Monique\Local Settings\Temporary Internet Files\bestwiner.stt
C:\Documents and Settings\Monique\Local Settings\Temporary Internet Files\CPV.stt
C:\Documents and Settings\Monique\My Documents\SMBOLS~1
C:\Documents and Settings\Monique\My Documents\SMBOLS~1\s?mbols\
C:\Documents and Settings\Monique\My Documents\SMBOLS~1\spoolsv.exe
C:\Program Files\Common Files\ozmz
C:\Program Files\Common Files\ozmz\ozmza.lck
C:\Program Files\Common Files\ozmz\ozmzd\class-barrel
C:\Program Files\Common Files\ozmz\ozmzd\vocabulary
C:\Program Files\Common Files\ozmz\ozmzh
C:\Program Files\Common Files\ozmz\ozmzl.exe
C:\Program Files\Common Files\ozmz\ozmzl.lck
C:\Program Files\Common Files\ozmz\ozmzm.exe
C:\Program Files\Common Files\ozmz\ozmzm.lck
C:\Program Files\Common Files\ozmz\ozmzp.exe
C:\Program Files\outerinfo
C:\Program Files\outerinfo\FF\chrome.manifest
C:\Program Files\outerinfo\FF\components\FF.dll
C:\Program Files\outerinfo\FF\components\OuterinfoAds.xpt
C:\Program Files\outerinfo\FF\install.rdf
C:\Program Files\outerinfo\OiUninstaller.exe
C:\Program Files\outerinfo\outerinfo.ico
C:\WINDOWS\BM377323c5.txt
C:\WINDOWS\BM377323c5.xml
C:\WINDOWS\cookies.ini
C:\WINDOWS\ozmz
C:\WINDOWS\ozmz\ozmz.dat
C:\WINDOWS\ozmz\wu
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\abygdvrh.ini
C:\WINDOWS\system32\aerjhz.dll
C:\WINDOWS\system32\asks~1
C:\WINDOWS\system32\bfbpep.dll
C:\WINDOWS\system32\bsmogltl.ini
C:\WINDOWS\system32\dcvhpjho.dll
C:\WINDOWS\system32\dhgmylej.dll
C:\WINDOWS\system32\emlmbrok.dll
C:\WINDOWS\system32\fecygibx.dll
C:\WINDOWS\system32\fgjevegc.exe
C:\WINDOWS\system32\fmyenmjs.dll
C:\WINDOWS\system32\gwkgqx.dll
C:\WINDOWS\system32\gxquviph.dll
C:\WINDOWS\system32\hkeubjew.ini
C:\WINDOWS\system32\itxwdyjn.dll
C:\WINDOWS\system32\ltrkyncm.dll
C:\WINDOWS\system32\mbhcawim.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mdm.exe
C:\WINDOWS\system32\miplslib.dll
C:\WINDOWS\system32\miwachbm.ini
C:\WINDOWS\system32\mngilbkc.ini
C:\WINDOWS\system32\munhblfr.exe
C:\WINDOWS\system32\oceslz.dll
C:\WINDOWS\system32\omsaaqpy.dll
C:\WINDOWS\system32\ovuguo.dll
C:\WINDOWS\system32\pofotsbx.dll
C:\WINDOWS\system32\ppkpvj.dll
C:\WINDOWS\system32\qblsthdt.dll
C:\WINDOWS\system32\REGOBJ.DLL
C:\WINDOWS\system32\rndmxf.dll
C:\WINDOWS\system32\ssnncq.dll
C:\WINDOWS\system32\sutkjdxo.dll
C:\WINDOWS\system32\tszb.dll
C:\WINDOWS\system32\vcoovilf.ini
C:\WINDOWS\system32\vtqbueex.dll
C:\WINDOWS\system32\vtxclffl.dll
C:\WINDOWS\system32\wbyqhtaw.ini
C:\WINDOWS\system32\WvxIRqru.ini
C:\WINDOWS\system32\WvxIRqru.ini2
C:\WINDOWS\system32\xmxhjonh.dll

—– BITS: Possible infected sites —–

http://dna65.fastaccess.com
.
((((((((((((((((((((((((( Files Created from 2008-07-19 to 2008-08-19 )))))))))))))))))))))))))))))))
.

2008-08-18 21:10 . 2008-08-18 21:11 347 –ahs—- C:\WINDOWS\system32\WvxIRqru.ini
2008-08-18 20:20 . 2008-08-18 20:20 d——– C:\Program Files\Trend Micro
2008-08-16 13:34 . 2008-08-16 13:34 d——– C:\Program Files\Malwarebytes
2008-08-16 13:34 . 2008-08-16 13:34 d——– C:\Documents and Settings\Monique\Application Data\Malwarebytes
2008-08-16 13:34 . 2008-08-16 13:34 d——– C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-16 13:34 . 2008-07-30 20:07 38,472 –a—— C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-16 13:34 . 2008-07-30 20:07 17,144 –a—— C:\WINDOWS\system32\drivers\mbam.sys
2008-08-15 00:05 . 2008-08-15 00:05 578,560 –a—— C:\WINDOWS\system32\dllcache\user32.dll
2008-08-15 00:00 . 2008-08-15 00:00 d——– C:\WINDOWS\ERUNT
2008-08-14 23:27 . 2008-08-15 21:15 d——– C:\SDFix
2008-08-13 19:46 . 2008-08-13 19:46 2,238 –a—— C:\WINDOWS\system32\GClogo_32x32.ico
2008-08-13 00:19 . 2008-08-13 00:19 4,286 –a—— C:\WINDOWS\system32\Jamster.ico
2008-08-09 19:21 . 2008-08-09 19:21 d——– C:\Documents and Settings\LocalService\Application Data\BLSTOOLBAR
2008-08-09 19:13 . 2008-08-09 19:13 d——– C:\WINDOWS\SUJNIFVTRVI
2008-08-09 19:08 . 2008-08-09 19:08 9,662 –a—— C:\WINDOWS\system32\ZoneAlarmIconUS.ico
2008-08-05 16:22 . 2008-08-05 16:31 3,246 –a—— C:\WINDOWS\system32\tmp.reg
2008-08-05 02:28 . 2008-08-05 02:28 314,880 ——— C:\WINDOWS\system32\urqRIxvW.dll
2008-07-29 11:15 . 2008-07-29 11:15 1,409 –a—— C:\WINDOWS\system\arnari.FOT
2008-07-29 11:15 . 2008-07-29 11:15 1,409 –a—— C:\WINDOWS\system\arnar.FOT
2008-07-29 11:14 . 2008-07-29 11:14 d——– C:\Program Files\MSWorks45a
2008-07-29 10:55 . 2008-07-29 10:55 d——– C:\Program Files\Microsoft Works 4.5
2008-07-29 10:17 . 2008-07-29 10:17 d——– C:\Documents and Settings\All Users\Application Data\SBT
2008-07-29 10:16 . 2008-07-29 10:16 d——– C:\WINDOWS\Twain32
2008-07-29 10:16 . 2008-07-29 10:16 d——– C:\Documents and Settings\Monique\Application Data\Microsoft Web Folders
2008-07-21 01:58 . 2008-07-21 01:58 d——– C:\Documents and Settings\All Users\Application Data\ScanSoft
2008-07-20 22:00 . 2008-06-13 07:05 272,128 ——— C:\WINDOWS\system32\dllcache\bthport.sys
2008-07-20 21:55 . 2008-05-08 10:02 203,136 ——— C:\WINDOWS\system32\dllcache\rmcast.sys
2008-07-20 11:35 . 2008-07-20 11:35 50 –a—— C:\WINDOWS\BRQIKMON.INI
2008-07-20 11:14 . 2008-07-20 11:14 d——– C:\INSTALLDIR
2008-07-20 09:05 . 2008-07-21 01:58 812 –a—— C:\WINDOWS\maxlink.ini
2008-07-20 09:04 . 2008-07-20 09:04 d——– C:\Program Files\Scansoft
2008-07-20 09:04 . 2008-07-20 09:04 d——– C:\Program Files\Common Files\scansoft shared

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-22 06:02 4,724 —-a-w C:\WINDOWS\system32\PerfStringBackup.TMP
2008-07-19 00:09 ——— d—–w C:\Documents and Settings\Monique\Application Data\Apple Computer
2008-07-17 13:38 ——— d—–w C:\Program Files\ItsDeductible2005
2008-07-17 09:16 ——— d—–w C:\Documents and Settings\Monique\Application Data\Intuit
2008-07-17 09:07 ——— d—–w C:\Program Files\ItsDeductible2006
2008-07-17 09:06 ——— d—–w C:\Program Files\Common Files\AnswerWorks 4.0
2008-07-17 09:06 ——— d—–w C:\Documents and Settings\All Users\Application Data\Intuit
2008-07-17 09:05 ——— d—–w C:\Program Files\Common Files\Intuit
2008-07-17 09:04 ——— d—–w C:\Program Files\TurboTax
2008-07-17 09:03 ——— d—–w C:\Documents and Settings\Monique\Application Data\InstallShield
2008-07-15 07:29 ——— d—–w C:\Documents and Settings\Monique\Application Data\Uniblue
2008-07-15 07:09 ——— d—–w C:\Program Files\Snapshot Viewer
2008-07-15 07:07 ——— d—–w C:\Program Files\MSOffice2000
2008-05-24 08:44 524,437 —-a-w C:\Program Files\INSTALL.LOG
2008-05-24 03:55 43,487,426 —-a-w C:\REGISTRYBKUP.reg
2007-05-13 11:35 479,360 ——w C:\WINDOWS\inf\rt61.sys
2002-06-04 04:06 65,536 ——w C:\WINDOWS\inf\copyinf.exe
1998-12-09 02:53 99,840 —-a-w C:\Program Files\Common Files\IRAABOUT.DLL
1998-12-09 02:53 70,144 —-a-w C:\Program Files\Common Files\IRAMDMTR.DLL
1998-12-09 02:53 48,640 —-a-w C:\Program Files\Common Files\IRALPTTR.DLL
1998-12-09 02:53 31,744 —-a-w C:\Program Files\Common Files\IRAWEBTR.DLL
1998-12-09 02:53 186,368 —-a-w C:\Program Files\Common Files\IRAREG.DLL
1998-12-09 02:53 17,920 —-a-w C:\Program Files\Common Files\IRASRIAL.DLL
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7D216F3F-9F32-4924-AD8D-E896D078DD26}]
2008-08-05 02:28 314880 ——— C:\WINDOWS\system32\urqRIxvW.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Dqefb"="C:\Documents and Settings\Monique\Application Data\??mantec\w?nspool.exe" [?]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 17:12 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HelpCenter4.1"="C:\Program Files\FastAccessDSL\HelpCenter43\bin\sprtcmd.exe" [2007-04-12 20:59 198184]
"MotiveReportAgent"="C:\Program Files\Common Files\Motive\McciBootStrapper.exe" [2004-06-25 11:14 204800]
"BellSouthWCC_McciTrayApp"="C:\Program Files\BellSouthWCC\McciTrayApp.exe" [2006-03-10 11:01 543232]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD SE\PDVDServ.exe" [2004-07-15 01:07 32768]
"QuickTime Task"="C:\Program Files\QuickTime750\qttask.exe" [2008-05-27 10:50 413696]
"PaperPort PTD"="C:\Program Files\Scansoft\PaperPort\pptd40nt.exe" [2002-08-12 09:33 45108]
"IndexSearch"="C:\Program Files\Scansoft\PaperPort\IndexSearch.exe" [2002-08-12 10:07 36864]

C:\Documents and Settings\Monique\Start Menu\Programs\Startup\
Microsoft Works Calendar Reminders.lnk - C:\Program Files\MSWorks45a\Calendar\WKCALREM.EXE [1998-07-21 68368]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\MSOffice2000\Office\OSA9.EXE [2000-01-21 04:15:54 65588]
Symantec Fax Starter Edition Port.lnk - C:\Program Files\MSOffice2000\Office\1033\OLFSNT40.EXE [1998-12-23 17:51:52 45568]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ACNotify]
2008-03-14 18:54 32768 C:\Program Files\ThinkPad\ConnectUtilities\ACNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpfnf2]
2005-07-05 23:45 28672 C:\WINDOWS\system32\notifyf2.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey]
2005-11-30 20:16 24576 C:\WINDOWS\system32\tphklock.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 C:\WINDOWS\system32\urqRIxvW

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Instant Wireless Configuration Utility.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Instant Wireless Configuration Utility.lnk
backup=C:\WINDOWS\pss\Instant Wireless Configuration Utility.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ACTray]
–a—— 2008-03-14 18:57 425984 C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ACWLIcon]
–a—— 2008-03-14 18:53 126976 C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DriverUpdaterPro]
–a—— 2008-05-16 02:35 2480164 C:\Program Files\XPC Tools\Driver Updater Pro\DriverUpdaterPro.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPHOTKEY]
–a—— 2006-10-02 10:19 94208 C:\PROGRA~1\ThinkPad\Pkg
Mgr\HOTKEY\TPHKMGR.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TVT Scheduler Proxy]
–a—— 2008-03-04 10:34 487424 C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AEIWLSTA.EXE]
–a—— 2002-09-23 20:07 214016 C:\WINDOWS\system32\AEIWLSTA.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGRSMMSG]
–a—— 2002-01-15 13:03 87037 C:\WINDOWS\AGRSMMSG.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Ati HotKey Poller"=2 (0x2)
"IBMPMSVC"=2 (0x2)
"Dot3svc"=3 (0x3)
"mnmsrvc"=3 (0x3)
"Irmon"=3 (0x3)
"cisvc"=3 (0x3)
"TVT Scheduler"=3 (0x3)
"SUService"=2 (0x2)
"AcSvc"=2 (0x2)
"AcPrfMgrSvc"=2 (0x2)
"ThinkVantage Registry Monitor Service"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\WINDOWS\\system32\\sessmgr.exe"=

R1 ANC;ANC;C:\WINDOWS\system32\drivers\ANC.SYS [2008-01-21 20:34]
R1 IBMTPCHK;IBMTPCHK;C:\WINDOWS\system32\Drivers\IBMBLDID.sys [2008-01-21 20:34]
R1 TPPWR;TPPWR;C:\WINDOWS\system32\drivers\Tppwr.sys [2002-02-20 01:23]
R2 phildecn;Philips WDM Video Decoder (PHILDECN);C:\WINDOWS\system32\DRIVERS\phildecn.sys [2002-01-22 14:28]
R2 VProt2k;BroadJump PPPoE Helper Protocol;C:\WINDOWS\system32\DRIVERS\VProt2k.SYS [2003-05-10 15:18]
R3 Tp4Track;PS/2 TrackPoint Driver;C:\WINDOWS\system32\DRIVERS\tp4track.sys [2008-03-04 07:28]
R3 VWan2k;BroadJump PPPoE Adapter;C:\WINDOWS\system32\DRIVERS\VWan2k.SYS [2003-05-10 15:19]
S2 McciCMService;McciCMService;C:\Program Files\Common Files\Motive\McciCMService.exe []
S3 AEIWL;IBM High Rate Wireless LAN MiniPCI Combo Card Driver;C:\WINDOWS\system32\DRIVERS\AEIWLNDS.sys [2002-09-23 19:16]
S3 MREMP50;MREMP50 NDIS Protocol Driver;C:\PROGRA~1\COMMON~1\Motive\MREMP50.SYS [2007-01-19 10:53]
S3 MREMP50a64;MREMP50a64 NDIS Protocol Driver;C:\PROGRA~1\COMMON~1\Motive\MREMP50a64.SYS []
S3 MRESP50;MRESP50 NDIS Protocol Driver;C:\PROGRA~1\COMMON~1\Motive\MRESP50.SYS [2007-01-19 10:53]
S3 MRESP50a64;MRESP50a64 NDIS Protocol Driver;C:\PROGRA~1\COMMON~1\Motive\MRESP50a64.SYS []
S3 WPC11;Instant Wireless Network PC Card V3.0 Driver;C:\WINDOWS\system32\DRIVERS\LSWLNDS.sys [2002-03-27 23:14]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
\Shell\AutoRun\command - D:\setup.exe
.
Contents of the 'Scheduled Tasks' folder
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-Uahe - C:\DOCUME~1\Monique\MYDOCU~1\SMBOLS~1\spoolsv.exe
HKLM-Run-34401059 - C:\WINDOWS\system32\mbhcawim.dll
HKLM-Run-BM377323c5 - C:\WINDOWS\system32\omsaaqpy.dll


.
——- Supplementary Scan ——-
.
R0 -: HKCU-Main,Start Page = hxxp://google.com/

O16 -: Microsoft XML Parser for Java - file://C:\WINDOWS\Java\classes\xmldso.cab
C:\WINDOWS\Downloaded Program Files\Microsoft XML Parser for Java.osd

O16 -: {2DAD3559-2923-4935-AD49-B673D2539944} - hxxp://www-307.ibm.com/pc/support/acpir.cab
C:\WINDOWS\Downloaded Program Files\acpir.inf
C:\WINDOWS\system32\capicom.dll
C:\WINDOWS\Downloaded Program Files\acpir2.dll

O16 -: {EA7F451B-94DD-4009-A8BF-8F977B0B2696} - hxxp://pbells.broadjump.com/wizlet/StandardInstall/static/controls/WebflowActiveXInstaller_4-2-0.cab
C:\WINDOWS\Downloaded Program Files\WebflowActiveXInstaller.inf
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-18 21:11:12
Windows 5.1.2600 Service Pack 3 FAT NTAPI

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\tphklock.dll

PROCESS: C:\WINDOWS\system32\lsass.exe
-> C:\WINDOWS\system32\urqRIxvW.dll

PROCESS: C:\WINDOWS\explorer.exe
-> C:\WINDOWS\system32\urqRIxvW.dll
.
———————— Other Running Processes ————————
.
C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\Motive\BellSouthBrowser.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\verclsid.exe
.
**************************************************************************
.
Completion time: 2008-08-18 21:12:58 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-19 01:12:54

Pre-Run: 37,091,835,904 bytes free
Post-Run: 37,127,290,880 bytes free

293 — E O F — 2008-07-22 05:55:00



*************************************************



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:17:20, on 8/18/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\FastAccessDSL\HelpCenter43\bin\sprtcmd.exe
C:\Program Files\BellSouthWCC\McciTrayApp.exe
C:\Program Files\Common Files\Motive\BellSouthBrowser.exe
C:\Program Files\CyberLink\PowerDVD SE\PDVDServ.exe
C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSOffice2000\Office\1033\OLFSNT40.EXE
C:\Program Files\MSWorks45a\Calendar\WKCALREM.EXE
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O3 - Toolbar: AT&T Toolbar - {4E7BD74F-2B8D-469E-8CBD-FD60BB9AAE2E} - C:\PROGRA~1\BLSTOO~1\BLSTOO~1.DLL
O4 - HKLM\..\Run: [HelpCenter4.1] C:\Program Files\FastAccessDSL\HelpCenter43\bin\sprtcmd.exe /P HelpCenter4.1
O4 - HKLM\..\Run: [MotiveReportAgent] "C:\Program Files\Common Files\Motive\McciBootStrapper.exe" /url="-url=file://C:\Program Files\Common Files\Motive\ReportAgent.html" /browsertype=CustomMSIE /browserpath="C:\Program Files\Common Files\Motive\BellSouthBrowser.exe" /hidden
O4 - HKLM\..\Run: [BellSouthWCC_McciTrayApp] C:\Program Files\BellSouthWCC\McciTrayApp.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD SE\PDVDServ.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime750\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\Scansoft\PaperPort\IndexSearch.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Dqefb] "C:\Documents and Settings\Monique\Application Data\??mantec\w?nspool.exe"
O4 - Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\MSWorks45a\Calendar\WKCALREM.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\MSOffice2000\Office\OSA9.EXE
O4 - Global Startup: Symantec Fax Starter Edition Port.lnk = C:\Program Files\MSOffice2000\Office\1033\OLFSNT40.EXE
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - Cmdmapping - (no file) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://support.att.net/sdccommon/download/tgctlcm.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://pcpitstop.com/betapit/PCPitStop.CAB
O16 - DPF: {2DAD3559-2923-4935-AD49-B673D2539944} (IASRunner Class) - http://www-307.ibm.com/pc/support/acpir.cab
O16 - DPF: {321FB770-1FBE-4BFE-BDC1-6F622D4FA499} - https://pbells.broadjump.com/wizlet/iw60/st…aller_4-0-0.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1210984409787
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1210990980218
O16 - DPF: {9BFC2253-B9D9-477E-9488-CA450232620D} (BinAg1 Class) - https://pbells.broadjump.com/wizlet/iw60/st…flowActiveX.CAB
O16 - DPF: {EA7F451B-94DD-4009-A8BF-8F977B0B2696} - http://pbells.broadjump.com/wizlet/Standar…aller_4-2-0.cab
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
O23 - Service: McciCMService - Unknown owner - C:\Program Files\Common Files\Motive\McciCMService.exe (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

–
End of file - 5383 bytes
Post #10
Monique,

Open Notepad Go to Start> All Programs> Assessories> Notepad ( this will only work with Notepad )and copy all the text inside the Code Box by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad, make sure there is no space before and above File::

File::
C:\WINDOWS\system32\urqRIxvW.dll

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7D216F3F-9F32-4924-AD8D-E896D078DD26}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Dqefb"=-

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"=hex(7):6d,73,76,31,5f,30,00,00

Save this as CFScript to your desktop.

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

[external image: Posted Image]


This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.



C:\Documents and Settings\Monique\Application Data\??mantec <–Delete this file, just the one with the ??


P.S. How do I insert bitmaps into a post? I took screenshots of the error msgs and pasted them into Paint to be saved as bmp files. Trying to copy and paste from Paint into this post failed.

You need to upload the image to http://photobucket.com/ and paste the URL of the image into this thread
Post #11

C:\Documents and Settings\Monique\Application Data\??mantec <–Delete this file, just the one with the ??

Delete from where, from HijackThis? There was no entry that looked like that.


Monique



*****************************************************************



ComboFix 08-08-18.01 - Monique 2008-08-19 6:44:19.2 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.700 [GMT -4:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Monique\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\WINDOWS\system32\urqRIxvW.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\urqRIxvW.dll
C:\WINDOWS\system32\WvxIRqru.ini
C:\WINDOWS\system32\WvxIRqru.ini2

.
((((((((((((((((((((((((( Files Created from 2008-07-19 to 2008-08-19 )))))))))))))))))))))))))))))))
.

2008-08-18 21:40 . 2008-08-18 21:40 d——– C:\Program Files\COMODO
2008-08-18 21:40 . 2008-08-18 21:40 d——– C:\Documents and Settings\Monique\Application Data\Comodo
2008-08-18 21:40 . 2008-08-18 21:40 d——– C:\Documents and Settings\All Users\Application Data\comodo
2008-08-18 21:40 . 2008-08-18 21:40 143,104 –a—— C:\WINDOWS\system32\guard32.dll
2008-08-18 21:40 . 2008-08-18 21:40 87,056 –a—— C:\WINDOWS\system32\drivers\cmdguard.sys
2008-08-18 21:40 . 2008-08-18 21:40 24,208 –a—— C:\WINDOWS\system32\drivers\cmdhlp.sys
2008-08-18 21:21 . 2008-08-18 21:21 d——– C:\Program Files\Avast4
2008-08-18 20:20 . 2008-08-18 20:20 d——– C:\Program Files\Trend Micro
2008-08-16 13:34 . 2008-08-16 13:34 d——– C:\Program Files\Malwarebytes
2008-08-16 13:34 . 2008-08-16 13:34 d——– C:\Documents and Settings\Monique\Application Data\Malwarebytes
2008-08-16 13:34 . 2008-08-16 13:34 d——– C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-16 13:34 . 2008-07-30 20:07 38,472 –a—— C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-16 13:34 . 2008-07-30 20:07 17,144 –a—— C:\WINDOWS\system32\drivers\mbam.sys
2008-08-15 00:05 . 2008-08-15 00:05 578,560 –a—— C:\WINDOWS\system32\dllcache\user32.dll
2008-08-15 00:00 . 2008-08-15 00:00 d——– C:\WINDOWS\ERUNT
2008-08-14 23:27 . 2008-08-15 21:15 d——– C:\SDFix
2008-08-13 19:46 . 2008-08-13 19:46 2,238 –a—— C:\WINDOWS\system32\GClogo_32x32.ico
2008-08-13 00:19 . 2008-08-13 00:19 4,286 –a—— C:\WINDOWS\system32\Jamster.ico
2008-08-09 19:21 . 2008-08-09 19:21 d——– C:\Documents and Settings\LocalService\Application Data\BLSTOOLBAR
2008-08-09 19:13 . 2008-08-09 19:13 d——– C:\WINDOWS\SUJNIFVTRVI
2008-08-09 19:08 . 2008-08-09 19:08 9,662 –a—— C:\WINDOWS\system32\ZoneAlarmIconUS.ico
2008-08-05 16:22 . 2008-08-05 16:31 3,246 –a—— C:\WINDOWS\system32\tmp.reg
2008-07-29 11:15 . 2008-07-29 11:15 1,409 –a—— C:\WINDOWS\system\arnari.FOT
2008-07-29 11:15 . 2008-07-29 11:15 1,409 –a—— C:\WINDOWS\system\arnar.FOT
2008-07-29 11:14 . 2008-07-29 11:14 d——– C:\Program Files\MSWorks45a
2008-07-29 10:55 . 2008-07-29 10:55 d——– C:\Program Files\Microsoft Works 4.5
2008-07-29 10:17 . 2008-07-29 10:17 d——– C:\Documents and Settings\All Users\Application Data\SBT
2008-07-29 10:16 . 2008-07-29 10:16 d——– C:\WINDOWS\Twain32
2008-07-29 10:16 . 2008-07-29 10:16 d——– C:\Documents and Settings\Monique\Application Data\Microsoft Web Folders
2008-07-21 01:58 . 2008-07-21 01:58 d——– C:\Documents and Settings\All Users\Application Data\ScanSoft
2008-07-20 22:00 . 2008-06-13 07:05 272,128 ——— C:\WINDOWS\system32\dllcache\bthport.sys
2008-07-20 21:55 . 2008-05-08 10:02 203,136 ——— C:\WINDOWS\system32\dllcache\rmcast.sys
2008-07-20 11:35 . 2008-07-20 11:35 50 –a—— C:\WINDOWS\BRQIKMON.INI
2008-07-20 11:14 . 2008-07-20 11:14 d——– C:\INSTALLDIR
2008-07-20 09:05 . 2008-07-21 01:58 812 –a—— C:\WINDOWS\maxlink.ini
2008-07-20 09:04 . 2008-07-20 09:04 d——– C:\Program Files\Scansoft
2008-07-20 09:04 . 2008-07-20 09:04 d——– C:\Program Files\Common Files\scansoft shared

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-22 06:02 4,724 —-a-w C:\WINDOWS\system32\PerfStringBackup.TMP
2008-07-19 00:09 ——— d—–w C:\Documents and Settings\Monique\Application Data\Apple Computer
2008-07-17 13:38 ——— d—–w C:\Program Files\ItsDeductible2005
2008-07-17 09:16 ——— d—–w C:\Documents and Settings\Monique\Application Data\Intuit
2008-07-17 09:07 ——— d—–w C:\Program Files\ItsDeductible2006
2008-07-17 09:06 ——— d—–w C:\Program Files\Common Files\AnswerWorks 4.0
2008-07-17 09:06 ——— d—–w C:\Documents and Settings\All Users\Application Data\Intuit
2008-07-17 09:05 ——— d—–w C:\Program Files\Common Files\Intuit
2008-07-17 09:04 ——— d—–w C:\Program Files\TurboTax
2008-07-17 09:03 ——— d—–w C:\Documents and Settings\Monique\Application Data\InstallShield
2008-07-15 07:29 ——— d—–w C:\Documents and Settings\Monique\Application Data\Uniblue
2008-07-15 07:09 ——— d—–w C:\Program Files\Snapshot Viewer
2008-07-15 07:07 ——— d—–w C:\Program Files\MSOffice2000
2008-05-24 08:44 524,437 —-a-w C:\Program Files\INSTALL.LOG
2008-05-24 03:55 43,487,426 —-a-w C:\REGISTRYBKUP.reg
2007-05-13 11:35 479,360 ——w C:\WINDOWS\inf\rt61.sys
2002-06-04 04:06 65,536 ——w C:\WINDOWS\inf\copyinf.exe
1998-12-09 02:53 99,840 —-a-w C:\Program Files\Common Files\IRAABOUT.DLL
1998-12-09 02:53 70,144 —-a-w C:\Program Files\Common Files\IRAMDMTR.DLL
1998-12-09 02:53 48,640 —-a-w C:\Program Files\Common Files\IRALPTTR.DLL
1998-12-09 02:53 31,744 —-a-w C:\Program Files\Common Files\IRAWEBTR.DLL
1998-12-09 02:53 186,368 —-a-w C:\Program Files\Common Files\IRAREG.DLL
1998-12-09 02:53 17,920 —-a-w C:\Program Files\Common Files\IRASRIAL.DLL
.

((((((((((((((((((((((((((((( snapshot@2008-08-18_21.12.19.42 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-07-19 14:43:08 1,163,960 —-a-w C:\WINDOWS\system32\aswBoot.exe
+ 2008-07-19 14:30:54 94,392 —-a-w C:\WINDOWS\system32\AvastSS.scr
+ 2008-07-19 14:32:16 26,944 —-a-w C:\WINDOWS\system32\drivers\aavmker4.sys
+ 2008-07-19 14:37:42 20,560 —-a-w C:\WINDOWS\system32\drivers\aswFsBlk.sys
+ 2008-01-17 16:34:02 93,264 —-a-w C:\WINDOWS\system32\drivers\aswmon.sys
+ 2008-07-19 14:37:22 94,416 —-a-w C:\WINDOWS\system32\drivers\aswmon2.sys
+ 2008-07-19 14:33:42 23,152 —-a-w C:\WINDOWS\system32\drivers\aswRdr.sys
+ 2008-07-19 14:35:18 78,416 —-a-w C:\WINDOWS\system32\drivers\aswSP.sys
+ 2008-07-19 14:32:36 42,912 —-a-w C:\WINDOWS\system32\drivers\aswTdi.sys
+ 2008-08-19 01:40:24 79,760 —-a-w C:\WINDOWS\system32\drivers\inspect.sys
+ 2008-08-19 10:55:08 16,384 —-a-w C:\WINDOWS\temp\Perflib_Perfdata_6d4.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 17:12 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HelpCenter4.1"="C:\Program Files\FastAccessDSL\HelpCenter43\bin\sprtcmd.exe" [2007-04-12 20:59 198184]
"MotiveReportAgent"="C:\Program Files\Common Files\Motive\McciBootStrapper.exe" [2004-06-25 11:14 204800]
"BellSouthWCC_McciTrayApp"="C:\Program Files\BellSouthWCC\McciTrayApp.exe" [2006-03-10 11:01 543232]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD SE\PDVDServ.exe" [2004-07-15 01:07 32768]
"QuickTime Task"="C:\Program Files\QuickTime750\qttask.exe" [2008-05-27 10:50 413696]
"PaperPort PTD"="C:\Program Files\Scansoft\PaperPort\pptd40nt.exe" [2002-08-12 09:33 45108]
"IndexSearch"="C:\Program Files\Scansoft\PaperPort\IndexSearch.exe" [2002-08-12 10:07 36864]
"COMODO Firewall Pro"="C:\Program Files\COMODO\Firewall\cfp.exe" [2008-08-18 21:40 1655552]

C:\Documents and Settings\Monique\Start Menu\Programs\Startup\
Microsoft Works Calendar Reminders.lnk - C:\Program Files\MSWorks45a\Calendar\WKCALREM.EXE [1998-07-21 68368]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\MSOffice2000\Office\OSA9.EXE [2000-01-21 04:15:54 65588]
Symantec Fax Starter Edition Port.lnk - C:\Program Files\MSOffice2000\Office\1033\OLFSNT40.EXE [1998-12-23 17:51:52 45568]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ACNotify]
2008-03-14 18:54 32768 C:\Program Files\ThinkPad\ConnectUtilities\ACNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpfnf2]
2005-07-05 23:45 28672 C:\WINDOWS\system32\notifyf2.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey]
2005-11-30 20:16 24576 C:\WINDOWS\system32\tphklock.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"= C:\WINDOWS\system32\guard32.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Instant Wireless Configuration Utility.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Instant Wireless Configuration Utility.lnk
backup=C:\WINDOWS\pss\Instant Wireless Configuration Utility.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ACTray]
–a—— 2008-03-14 18:57 425984 C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ACWLIcon]
–a—— 2008-03-14 18:53 126976 C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DriverUpdaterPro]
–a—— 2008-05-16 02:35 2480164 C:\Program Files\XPC Tools\Driver Updater Pro\DriverUpdaterPro.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPHOTKEY]
–a—— 2006-10-02 10:19 94208 C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TVT Scheduler Proxy]
–a—— 2008-03-04 10:34 487424 C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AEIWLSTA.EXE]
–a—— 2002-09-23 20:07 214016 C:\WINDOWS\system32\AEIWLSTA.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGRSMMSG]
–a—— 2002-01-15 13:03 87037 C:\WINDOWS\AGRSMMSG.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Ati HotKey Poller"=2 (0x2)
"IBMPMSVC"=2 (0x2)
"Dot3svc"=3 (0x3)
"mnmsrvc"=3 (0x3)
"Irmon"=3 (0x3)
"cisvc"=3 (0x3)
"TVT Scheduler"=3 (0x3)
"SUService"=2 (0x2)
"AcSvc"=2 (0x2)
"AcPrfMgrSvc"=2 (0x2)
"ThinkVantage Registry Monitor Service"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\WINDOWS\\system32\\sessmgr.exe"=

R1 ANC;ANC;C:\WINDOWS\system32\drivers\ANC.SYS [2008-01-21 20:34]
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 10:35]
R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;C:\WINDOWS\system32\DRIVERS\cmdguard.sys [2008-08-18 21:40]
R1 cmdHlp;COMODO Firewall Pro Helper Driver;C:\WINDOWS\system32\DRIVERS\cmdhlp.sys [2008-08-18 21:40]
R1 IBMTPCHK;IBMTPCHK;C:\WINDOWS\system32\Drivers\IBMBLDID.sys [2008-01-21 20:34]
R1 TPPWR;TPPWR;C:\WINDOWS\system32\drivers\Tppwr.sys [2002-02-20 01:23]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 10:37]
R2 phildecn;Philips WDM Video Decoder (PHILDECN);C:\WINDOWS\system32\DRIVERS\phildecn.sys [2002-01-22 14:28]
R2 VProt2k;BroadJump PPPoE Helper Protocol;C:\WINDOWS\system32\DRIVERS\VProt2k.SYS [2003-05-10 15:18]
R3 Tp4Track;PS/2 TrackPoint Driver;C:\WINDOWS\system32\DRIVERS\tp4track.sys [2008-03-04 07:28]
R3 VWan2k;BroadJump PPPoE Adapter;C:\WINDOWS\system32\DRIVERS\VWan2k.SYS [2003-05-10 15:19]
S2 McciCMService;McciCMService;C:\Program Files\Common Files\Motive\McciCMService.exe []
S3 AEIWL;IBM High Rate Wireless LAN MiniPCI Combo Card Driver;C:\WINDOWS\system32\DRIVERS\AEIWLNDS.sys [2002-09-23 19:16]
S3 MREMP50;MREMP50 NDIS Protocol Driver;C:\PROGRA~1\COMMON~1\Motive\MREMP50.SYS [2007-01-19 10:53]
S3 MREMP50a64;MREMP50a64 NDIS Protocol Driver;C:\PROGRA~1\COMMON~1\Motive\MREMP50a64.SYS []
S3 MRESP50;MRESP50 NDIS Protocol Driver;C:\PROGRA~1\COMMON~1\Motive\MRESP50.SYS [2007-01-19 10:53]
S3 MRESP50a64;MRESP50a64 NDIS Protocol Driver;C:\PROGRA~1\COMMON~1\Motive\MRESP50a64.SYS []
S3 WPC11;Instant Wireless Network PC Card V3.0 Driver;C:\WINDOWS\system32\DRIVERS\LSWLNDS.sys [2002-03-27 23:14]

[HKEY_CURRENT_USER\software\microsoft\windows\currentve
rsion\explorer\mountpoints2\D]
\Shell\AutoRun\command - D:\setup.exe
.
Contents of the 'Scheduled Tasks' folder

2008-05-21 C:\WINDOWS\Tasks\BMMTask.job
- C:\PROGRA~1\ThinkPad\UTILIT~1\Bmmtask.exe [2002-01-15 01:23]
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-19 06:55:38
Windows 5.1.2600 Service Pack 3 FAT NTAPI

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\tphklock.dll
.
———————— Other Running Processes ————————
.
C:\Program Files\Avast4\aswUpdSv.exe
C:\Program Files\Avast4\ashServ.exe
C:\Program Files\COMODO\Firewall\cmdagent.exe
C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Program Files\Avast4\ashMaiSv.exe
C:\Program Files\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\Motive\BellSouthBrowser.exe
.
**************************************************************************
.
Completion time: 2008-08-19 7:00:03 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-19 10:59:54
ComboFix2.txt 2008-08-19 01:13:00

Pre-Run: 36,890,443,776 bytes free
Post-Run: 36,861,902,848 bytes free

220 — E O F — 2008-07-22 05:55:00



********************************************************************************
********************************



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 07:01:47, on 8/19/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Avast4\aswUpdSv.exe
C:\Program Files\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\COMODO\Firewall\cmdagent.exe
C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Program Files\Avast4\ashMaiSv.exe
C:\Program Files\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\FastAccessDSL\HelpCenter43\bin\sprtcmd.exe
C:\Program Files\BellSouthWCC\McciTrayApp.exe
C:\Program Files\CyberLink\PowerDVD SE\PDVDServ.exe
C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
C:\Program Files\Common Files\Motive\BellSouthBrowser.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSOffice2000\Office\1033\OLFSNT40.EXE
C:\Program Files\MSWorks45a\Calendar\WKCALREM.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: AT&T Toolbar - {4E7BD74F-2B8D-469E-8CBD-FD60BB9AAE2E} - C:\PROGRA~1\BLSTOO~1\BLSTOO~1.DLL
O3 - Toolbar: AT&T Toolbar - {4E7BD74F-2B8D-469E-8CBD-FD60BB9AAE2E} - C:\PROGRA~1\BLSTOO~1\BLSTOO~1.DLL
O4 - HKLM\..\Run: [HelpCenter4.1] C:\Program Files\FastAccessDSL\HelpCenter43\bin\sprtcmd.exe /P HelpCenter4.1
O4 - HKLM\..\Run: [MotiveReportAgent] "C:\Program Files\Common Files\Motive\McciBootStrapper.exe" /url="-url=file://C:\Program Files\Common Files\Motive\ReportAgent.html" /browsertype=CustomMSIE /browserpath="C:\Program Files\Common Files\Motive\BellSouthBrowser.exe" /hidden
O4 - HKLM\..\Run: [BellSouthWCC_McciTrayApp] C:\Program Files\BellSouthWCC\McciTrayApp.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD SE\PDVDServ.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime750\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\Scansoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\MSWorks45a\Calendar\WKCALREM.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\MSOffice2000\Office\OSA9.EXE
O4 - Global Startup: Symantec Fax Starter Edition Port.lnk = C:\Program Files\MSOffice2000\Office\1033\OLFSNT40.EXE
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - Cmdmapping - (no file) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://support.att.net/sdccommon/download/tgctlcm.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://pcpitstop.com/betapit/PCPitStop.CAB
O16 - DPF: {2DAD3559-2923-4935-AD49-B673D2539944} (IASRunner Class) - http://www-307.ibm.com/pc/support/acpir.cab
O16 - DPF: {321FB770-1FBE-4BFE-BDC1-6F622D4FA499} - https://pbells.broadjump.com/wizlet/iw60/st…aller_4-0-0.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1210984409787
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1210990980218
O16 - DPF: {9BFC2253-B9D9-477E-9488-CA450232620D} (BinAg1 Class) - https://pbells.broadjump.com/wizlet/iw60/st…flowActiveX.CAB
O16 - DPF: {EA7F451B-94DD-4009-A8BF-8F977B0B2696} - http://pbells.broadjump.com/wizlet/Standar…aller_4-2-0.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll
O20 - Winlogon Notify: ACNotify - ACNotify.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Avast4\ashWebSv.exe
O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\Firewall\cmdagent.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
O23 - Service: McciCMService - Unknown owner - C:\Program Files\Common Files\Motive\McciCMService.exe (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

–
End of file - 6467 bytes
Post #12
No, not HJT , you need to browse to the file with the path I provided

You need to enable windows to show all files and folders, instructions Here

C:\Documents and Settings\Monique\Application Data\??mantec <–Delete this folder, just the one with the ??

Click On My Computer
Then your C: drive
Then Documents and Settings
Then Monique
Then Application Data
Then this folder ??mantec <–Delete this folder just the one with the ??

The rest of your logs look fine :thumbup: How are things running now??
Post #13
That folder is not in the path you provided either. I did a filesearch and found a folder named MANTEC~1 containing winspool.exe.vir in C:\QooBox\Quarantine\… I went ahead and deleted it. Things are running much better. The crazy windows have stopped, I'm able to get to this thread, I was able to get current with my windows updates, and the other websites that were acting flaky seem to be ok again. Is it all fixed? Can I start breathing again? (smile) One thing that's odd is that my tray icon for Avast disappeared ever since I ran combofix. Oh well, I'll figure it out. Is there anything else I should do to prevent future infection? Monique
Post #14
Monique ,

It been a pleasure helping you, you have followed sometimes very difficult instructions very well. :thumbup: I am not familiar with Avast but I am sure if you open the program and under options there will be be something for you to re enable it to show in the system tray.

SDfix <— Drag it to the trash

ATF Cleaner <– Yours to keep, run it now and then to clean out the clutter.

Malwarebytes <– Yours to keep also, check for updates and run a scan now and then.

Combofix <—Is not a general cleaning tool, just run it with supervision or you can bork your system

  • Click START then RUN
  • Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.


    • [external image: Posted Image]

  • When shown the disclaimer, Select "2"

The above procedure will:
  • Delete the following:
    • ComboFix and its associated files and folders.
    • VundoFix backups, if present
    • The C:\Deckard folder, if present
    • The C:_OtMoveIt folder, if present
  • Reset the clock settings.
  • Hide file extensions, if required.
  • Hide System/Hidden files, if required.
  • Reset System Restore.


Malware Complaints
Are you mad ? I mean really mad, seething mad, so mad your ready to spit, mad that you have taken your hard earned dollars to buy a computer only to have some Miscredents, Dirt Bags and Cyber Criminals install a malicious program on your computer without your knowledge or consent. You can post your complaint at the above site. If you live in the U.S.A. you can also report your grievance to your State Attorney Generals Office and the Federal Trade Commission's Bureau of Consumer Protection.




Keep in mind if you install some of these programs. Only ONE Anti Virus and only ONE Firewall is recommended, more is overkill and can cause you problems. You can install all the Spyware programs I have listed without any problems. If you install Spyware Blaster, you can still install Spybot Search and Destroy but do not enable the TeaTimer in Spybot.


Here are some free programs to install, all free and highly regarded by the fine people in the Malware Removal Community
  • Spybot Search and Destroy 1.6
    Check for Updates/ Immunize and run a Full System Scan on a regular basis. If you install Spyware Blaster ( Recommended ) then do not enable the TeaTimer in Spybot Search and Destroy.
  • Spyware Blaster It will prevent most spyware from ever being installed. No scan to run, just update about once a week and enable all protection.
  • Spyware Guard It offers realtime protection from spyware installation attempts, again, no scan to run, just install it and let it do its thing.
  • IE-Spyad
    IE-Spyad places over 6000 web sites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (cookies etc) from the sites listed, although you will still be able to connect to the sites.
  • Firefox 3 It has more features and is a lot more secure than IE. It is a very easy and painless download and install, it will no way interfere with IE, you can use them both.


  • How did I get infected in the first place ? Read these links and find out how to prevent getting infected again.
  • Tutorial for System Restore <– Do this first to prevent yourself from being reinfected.
  • WhattheTech
  • TonyKlein CastleCops
  • Grinler BleepingComputer
  • GeeksTo Go
  • Dslreports


Safe Surfn
Ken
Post #15
Thanks Ken, the feeling's mutual. It was great to work with you and I've learned a lot. Combofix uninstalled itself just fine, and I'm checking out the links you provided one by one so I can do better in the future. A million thanks, you guys are awesome! :) Monique

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI