What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Smacchat, Blogs?, vulguar ads

8 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Long story short I AVG 8 detected a viruis I wiped the object, however that did not fix the problem. I know have obscence ads, smacchat ads appearing everywhere. I have read previous posts and have already done HijackThis log to post here. I have ran avg and it shows only that my shell and kernell files have been changed, not much help there. And I have run Lavasoft Ad-Aware remover and it has removed the occasionally spyware. Nothing seems to help! I am leaving for college this week and need a healty laptop for the work ahead, someone please help me. Here is my log…thanxs in advance

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:29:06 PM, on 8/18/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Hali\Local Settings\Temporary Internet Files\Content.IE5\C12F4HUV\avg_free_stf_en_8_138a1332[1].exe
C:\DOCUME~1\Hali\LOCALS~1\Temp\7zS1D.tmp\avgsetup.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\msiexec.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://webmail.vt.edu/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com
O3 - Toolbar: Pop-Up Blocker - {D7F30B62-8269-41AF-9539-B2697FA7D77E} - C:\Program Files\EarthLink TotalAccess\PnEL.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (file missing)
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [DLCGCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCGtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [e4e0ab4f] rundll32.exe "C:\WINDOWS\system32\aljjpkon.dll",b
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-2837568732-1308431763-2382294085-501\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netWaiting.exe (User 'Guest')
O4 - HKUS\S-1-5-21-2837568732-1308431763-2382294085-501\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime (User 'Guest')
O4 - HKUS\S-1-5-21-2837568732-1308431763-2382294085-501\..\Run: [DellSupport-] "C:\Program Files\Dell Support\DSAgnt.exe" /startup (User 'Guest')
O4 - HKUS\S-1-5-21-2837568732-1308431763-2382294085-501\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Guest')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'Default user')
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/Facebo…toUploader5.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by23fd.bay23.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/…ro.cab56649.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} - http://3dlifeplayer.dl.3dvia.com/player/in…l/installer.exe
O16 - DPF: {DA80E089-4648-43D5-93B4-7F37917084E6} (CacheManager.CacheManagerCtrl) - http://www.candystand.com/assets/activex/v…acheManager.CAB
O20 - AppInit_DLLs: whynyt.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: dlcg_device - - C:\WINDOWS\system32\dlcgcoms.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

–
End of file - 6683 bytes
Post #2
Hi and welcome to the forums here at WTT! :)

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
  • Please, never rename Combofix unless instructed.
  • Close any open browsers.
  • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

    ———————————————————–

    • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

      ———————————————————–

    • Close any open browsers.
    • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

    ———————————————————–

  • Double click on combofix.exe & follow the prompts.
  • When finished, it will produce a report for you.
  • Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.
**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**
Post #3
Thank you for your quick reply. I done as you instructed and here are the Combo Fix & Hijack This Logs. Thanks! :pullhair:

ComboFix 08-08-19.06 - Hali 2008-08-21 4:56:58.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.213 [GMT -4:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Hali\Application Data\macromedia\Flash Player\#SharedObjects\JLQ49FED\interclick.com
C:\Documents and Settings\Hali\Application Data\macromedia\Flash Player\#SharedObjects\JLQ49FED\interclick.com\ud.sol
C:\Documents and Settings\Hali\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com
C:\Documents and Settings\Hali\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol
C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\awtqqrpq.dll
C:\WINDOWS\system32\hinmvd.dll
C:\WINDOWS\system32\kmaujplo.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mqeemcxd.dll
C:\WINDOWS\system32\nokpjjla.ini
C:\WINDOWS\system32\olpjuamk.ini
C:\WINDOWS\system32\qprqqtwa.ini
C:\WINDOWS\system32\qprqqtwa.ini2
C:\WINDOWS\system32\xdodcdby.dll
C:\WINDOWS\system32\xxyXoPFy.dll
C:\WINDOWS\system32\ybdcdodx.ini

.
((((((((((((((((((((((((( Files Created from 2008-07-21 to 2008-08-21 )))))))))))))))))))))))))))))))
.

2008-08-19 15:24 . 2008-08-19 15:24 d——– C:\Program Files\Spybot - Search & Destroy
2008-08-19 15:24 . 2008-08-19 16:31 d——– C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-08-19 15:06 . 2008-08-19 22:32 2,422 –a—— C:\WINDOWS\system32\tmp.reg
2008-08-19 15:00 . 2006-04-27 02:29 d——– C:\Documents and Settings\Administrator\Application Data\Gtek
2008-08-19 15:00 . 2006-04-27 02:34 d——– C:\Documents and Settings\Administrator\Application Data\Corel
2008-08-19 14:59 . 2008-08-19 15:00 d——– C:\Documents and Settings\Administrator
2008-08-18 18:52 . 2008-08-21 04:36 d–h—– C:\$AVG8.VAULT$
2008-08-18 16:31 . 2008-08-21 04:19 d——– C:\WINDOWS\system32\drivers\Avg
2008-08-18 16:31 . 2008-08-18 16:31 96,520 –a—— C:\WINDOWS\system32\drivers\avgldx86.sys
2008-08-18 16:31 . 2008-08-18 16:31 76,040 –a—— C:\WINDOWS\system32\drivers\avgtdix.sys
2008-08-18 16:31 . 2008-08-18 16:31 10,520 –a—— C:\WINDOWS\system32\avgrsstx.dll
2008-08-18 16:30 . 2008-08-18 16:30 d——– C:\Program Files\AVG
2008-08-18 16:30 . 2008-08-18 16:30 d——– C:\Documents and Settings\All Users\Application Data\avg8
2008-08-18 16:28 . 2008-08-18 16:28 d——– C:\Program Files\Trend Micro
2008-08-09 12:29 . 2008-08-09 12:29 7,985,707 –a—— C:\wreck.avi.MOV
2008-08-09 12:27 . 2008-08-09 12:27 d——– C:\Program Files\AviSynth 2.5
2008-08-09 12:27 . 2004-02-22 10:11 719,872 –a—— C:\WINDOWS\system32\devil.dll
2008-08-09 12:27 . 2006-10-07 17:43 502,784 –a—— C:\WINDOWS\x2.64.exe
2008-08-09 12:27 . 2007-05-14 15:24 394,240 –a—— C:\WINDOWS\system32\Smab.dll
2008-08-09 12:27 . 2007-05-17 17:30 318,976 –a—— C:\WINDOWS\system32\avisynth.dll
2008-08-09 12:27 . 2005-02-28 13:16 240,128 –a—— C:\WINDOWS\system32\x.264.exe
2008-08-09 12:27 . 2006-04-12 09:47 217,073 –a—— C:\WINDOWS\meta4.exe
2008-08-09 12:27 . 2004-01-25 00:00 70,656 –a—— C:\WINDOWS\system32\yv12vfw.dll
2008-08-09 12:27 . 2004-01-25 00:00 70,656 –a—— C:\WINDOWS\system32\i420vfw.dll
2008-08-09 12:27 . 2006-04-05 08:09 66,560 –a—— C:\WINDOWS\MOTA113.exe
2008-08-09 12:27 . 2005-07-14 12:31 27,648 –a—— C:\WINDOWS\system32\AVSredirect.dll
2008-08-09 12:26 . 2005-02-12 18:00 186,880 -rahs—- C:\WINDOWS\system32\RLOgg.ax
2008-08-09 12:26 . 2005-01-17 18:26 179,200 -rahs—- C:\WINDOWS\system32\DiracSplitter.ax
2008-08-09 12:26 . 2006-08-16 09:53 175,104 -rahs—- C:\WINDOWS\system32\CoreAAC.ax
2008-08-09 12:26 . 2005-02-05 18:00 92,672 -rahs—- C:\WINDOWS\system32\RLVorbisDec.ax
2008-08-09 12:26 . 2005-02-22 11:55 81,920 -rahs—- C:\WINDOWS\system32\aac_parser.ax
2008-08-09 12:26 . 2005-02-12 18:00 67,584 -rahs—- C:\WINDOWS\system32\RLTheoraDec.ax
2008-08-09 12:26 . 2005-02-12 18:00 51,712 -rahs—- C:\WINDOWS\system32\RLSpeexDec.ax
2008-08-08 19:02 . 2008-08-09 15:51 d——– C:\Program Files\DVR365-Player

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-19 18:35 ——— d—–w C:\Program Files\Jasc Software Inc
2008-08-19 18:35 ——— d—–w C:\Documents and Settings\Hali\Application Data\Jasc Software Inc
2008-07-31 18:20 ——— d—–w C:\Documents and Settings\Hali\Application Data\AdobeUM
2008-07-24 14:23 ——— d—–w C:\Program Files\Java
2008-07-23 20:17 ——— d—–w C:\Program Files\Dl_cats
2008-07-23 20:14 ——— d—–w C:\Documents and Settings\All Users\Application Data\Trymedia
2008-07-19 16:43 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-08-05 21:44 56 -csh–r C:\WINDOWS\system32\0618BB27E3.sys
2007-07-21 13:50 88 -csh–r C:\WINDOWS\system32\E327BB1806.sys
2007-08-05 21:44 6,528 -csha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-10-14 21:49 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-10-14 21:46 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-10-14 21:50 114688]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-11-29 05:56 761947]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-12-06 02:05 127035]
"DLCGCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCGtime.dll" [2005-09-08 14:56 73728]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-08-18 16:30 1232152]
"Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY.exe" [2005-12-19 16:08 1347584]
"SigmatelSysTrayApp"="stsystra.exe" [2005-09-10 00:19 393216 C:\WINDOWS\stsystra.exe]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=whynyt.dll,avgrsstx.dll hinmvd.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.I420"= i420vfw.dll
"vidc.yv12"= yv12vfw.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=C:\WINDOWS\pss\Digital Line Detect.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Works Calendar Reminders.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Works Calendar Reminders.lnk
backup=C:\WINDOWS\pss\Microsoft Works Calendar Reminders.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Hali^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
path=C:\Documents and Settings\Hali\Start Menu\Programs\Startup\LimeWire On Startup.lnk
backup=C:\WINDOWS\pss\LimeWire On Startup.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ShowLOMControl]
 [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Broadcom Wireless Manager UI]
–a—— 2005-12-19 16:08 1347584 C:\WINDOWS\system32\WLTRAY.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dlcgmon.exe]
–a—— 2005-10-21 11:42 425984 C:\Program Files\Dell AIO 810\DLCGmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
——— 2005-12-09 20:29 49152 C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\E6TaskPanel]
–a—— 2003-12-08 15:51 733184 C:\Program Files\EarthLink TotalAccess\TaskPanl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
–a—— 2005-06-10 11:44 249856 C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
–a—— 2005-06-10 11:44 81920 C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
–a—— 2007-11-15 14:11 267048 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
–a—— 2001-08-16 23:41 28738 C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
–a—— 2004-10-13 12:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a—— 2007-11-15 00:43 286720 C:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
-rahs—- 2008-07-07 09:42 2156368 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
–a—— 2008-06-10 04:27 144784 C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"AVGEMS"=2 (0x2)
"WinDefend"=2 (0x2)
"WMPNetworkSvc"=3 (0x3)
"usnjsvc"=3 (0x3)
"ose"=3 (0x3)
"iPod Service"=3 (0x3)
"Apple Mobile Device"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\EarthLink TotalAccess\\TaskPanl.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-08-18 16:31]
R2 avg8emc;AVG Free8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-08-18 16:30]
R2 avg8wd;AVG Free8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-08-18 16:30]
R2 AvgTdiX;AVG Free8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-08-18 16:31]
.
Contents of the 'Scheduled Tasks' folder

2008-02-27 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 15:57]
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-e4e0ab4f - C:\WINDOWS\system32\kmaujplo.dll
MSConfigStartUp-AlcoholAutomount - C:\Documents and Settings\Hali\Desktop\Alcohol 120\axcmd.exe
MSConfigStartUp-e4e0ab4f - C:\WINDOWS\system32\xdodcdby.dll
MSConfigStartUp-MCAgentExe - c:\PROGRA~1\mcafee.com\agent\mcagent.exe
MSConfigStartUp-MCUpdateExe - c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
MSConfigStartUp-MPFExe - C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
MSConfigStartUp-MSKAGENTEXE - C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
MSConfigStartUp-MSKDetectorExe - C:\Program Files\McAfee\SpamKiller\MSKDetct.exe
MSConfigStartUp-MsnMsgr - C:\Program Files\MSN Messenger\MsnMsgr.Exe
MSConfigStartUp-MySpaceIM - C:\Program Files\MySpace\IM\MySpaceIM.exe
MSConfigStartUp-OASClnt - C:\Program Files\McAfee.com\VSO\oasclnt.exe
MSConfigStartUp-VirusScan Online - c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
MSConfigStartUp-VSOCheckTask - C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe


.
——- Supplementary Scan ——-
.
R0 -: HKCU-Main,Start Page = hxxp://www.webmail.vt.edu/
O8 -: &Google; Search - C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 -: &Translate; English Word - C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 -: Backward Links - C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 -: Cached Snapshot of Page - C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 -: E&xport; to Microsoft Excel - C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 -: Similar Pages - C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 -: Translate Page into English - C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-21 05:07:41
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\WINDOWS\system32\WLTRYSVC.EXE
C:\WINDOWS\system32\BCMWLTRY.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Dell\NicConfigSvc\NicConfigSvc.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\WINDOWS\SoftwareDistribution\Download\69b4634e26426212182d03d1e1c76c7b\update\update.exe
C:\WINDOWS\system32\imapi.exe
.
**************************************************************************
.
Completion time: 2008-08-21 5:12:05 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-21 09:11:38

Pre-Run: 20,062,486,528 bytes free
Post-Run: 19,977,457,664 bytes free

215 — E O F — 2008-08-12 19:27:19









Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:36:57, on 8/21/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.webmail.vt.edu/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D; IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll (file missing)
O3 - Toolbar: Pop-Up Blocker - {D7F30B62-8269-41AF-9539-B2697FA7D77E} - C:\Program Files\EarthLink TotalAccess\PnEL.dll
O3 - Toolbar: &Google; - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (file missing)
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [DLCGCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCGtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: &Google; Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate; English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/Facebo…toUploader5.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/…ro.cab56649.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} - http://3dlifeplayer.dl.3dvia.com/player/in…l/installer.exe
O16 - DPF: {DA80E089-4648-43D5-93B4-7F37917084E6} (CacheManager.CacheManagerCtrl) - http://www.candystand.com/assets/activex/v…acheManager.CAB
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: whynyt.dll,avgrsstx.dll hinmvd.dll
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: dlcg_device - - C:\WINDOWS\system32\dlcgcoms.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

–
End of file - 6475 bytes
Post #4 last edited
Hi,

Just one entry to fix in HJT, the files are gone but the reference to them in the registry is still there. We'll use a reg fix for this one.

Backup Your Registry with ERUNT

* Please use the following link and scroll down to ERUNT and download it.
http://aumha.org/freeware/freeware.php
* For version with the Installer:
Use the setup program to install ERUNT on your computer
* For the zipped version:
Unzip all the files into a folder of your choice.

Click Erunt.exe to backup your registry to the folder of your choice.

Note: to restore your registry, go to the folder and start ERDNT.exe

Open Notepad (press Start->Run, enter notepad and press OK)
Copy everything inside the code box below (Starting with REGEDIT4) and paste it into a new notepad file.
Change the Save As Type to All Files and save it as fix020.reg to your Desktop.

Note: Please copy and paste all the text at once, and check that there is NO blank line above REGEDIT4 and one blank line at the bottom.

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="avgrsstx.dll"


Then double-click on the fix020.reg file, and when it prompts to merge say yes.

Now reboot and run HijackThis again, please post that log and let me know how it's running at this point.
Post #5
It seemed to be working perfect after running ComboFix the first time. However, after jumping online to post here and check my email the pop ups begun again and my computer became bogged down. I ran my AdAware,AVG, and SpyBot. The computer was infected with Virtunode,Virtunode.dll, and WildTangent. I tried clearing them from those programs. Once again it was a temp. fix.


So I started allover again with the ComboFix and then I ran the ERUNT program as you instructed however I am currently in safe mode because before the Internet Explore wouldn't load the fourms for me to reply. Thus I have been opening all programs in Safe Mode. Here is the current HijackThis log. I will continue to run in Safe Mode until you feel I can do otherwise. Ps. A guy from a local computer repair shop instructed me to use SmitFixFraud. It seemed to do nothing and my AVG detected it as "possible fake spyware" or something like that. Will it harm my computer? Thank you for all your support. College starts Monday! :wacko:


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:20:17, on 8/22/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.webmail.vt.edu/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll (file missing)
O3 - Toolbar: Pop-Up Blocker - {D7F30B62-8269-41AF-9539-B2697FA7D77E} - C:\Program Files\EarthLink TotalAccess\PnEL.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (file missing)
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [DLCGCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCGtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [e4e0ab4f] rundll32.exe "C:\WINDOWS\system32\mjggvhwg.dll",b
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE /auto
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/Facebo…toUploader5.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/…ro.cab56649.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} - http://3dlifeplayer.dl.3dvia.com/player/in…l/installer.exe
O16 - DPF: {DA80E089-4648-43D5-93B4-7F37917084E6} (CacheManager.CacheManagerCtrl) - http://www.candystand.com/assets/activex/v…acheManager.CAB
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: dlcg_device - - C:\WINDOWS\system32\dlcgcoms.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

–
End of file - 5926 bytes
Post #6
Hi,

Sorry things have turned for the worse. I can see from your last HJT log that yes, Vundo is back. Let's run combofix again and please post the log. I'll look back and see if I missed anything on the last go around also. For the internet connection issues, try WinsockFix to see if it brings back your connection. I would like you to run combofix in Normal Mode if at all possible.

WinsockFix to restore internet connectivity.

http://www.spychecker.com/program/winsockxpfix.html

The Winsockfix Utility will:
· Detect your current Operating System
· Release the IP address, taking you "Offline"
· Reset the TCP stack using Netsh.exe (Windows XP only)
· Delete the current Registry TCP and Winsock Values
· Import new "Working" Registry Values
· Backup any Current "Hosts" file
· Replace the "Hosts" file with a default one
· Reboot the Computer

Instructions:
http://www.home-network-help.com/winsockfix.html
Post #7
Oh also. Smitfraudfix tool is fine, and many AV's report it falsely as bad. It's good for removing the Smitfruad infections, but we're dealing with Vundo here. No harm done though, it's a great tool.
Post #8
Okay I run ComboFix again and here is the log from this scan. I think there may have been some confusion concerning my internet on my last post, sorry. I was just saying that when I run the Combo,ERUNT,& Hijackthis I disconnected my computer from my internet; then it seemed as though when I connected back the problems restarted so to say.

ComboFix 08-08-23.03 - Hali 2008-08-24 11:43:46.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.225 [GMT -4:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-07-24 to 2008-08-24 )))))))))))))))))))))))))))))))
.

2008-08-21 18:09 . 2008-08-21 18:09 d——– C:\Program Files\ERUNT
2008-08-19 15:24 . 2008-08-19 15:24 d——– C:\Program Files\Spybot - Search & Destroy
2008-08-19 15:24 . 2008-08-19 16:31 d——– C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-08-19 15:06 . 2008-08-19 22:32 2,422 –a—— C:\WINDOWS\system32\tmp.reg
2008-08-19 15:00 . 2006-04-27 02:29 d——– C:\Documents and Settings\Administrator\Application Data\Gtek
2008-08-19 15:00 . 2006-04-27 02:34 d——– C:\Documents and Settings\Administrator\Application Data\Corel
2008-08-19 14:59 . 2008-08-19 15:00 d——– C:\Documents and Settings\Administrator
2008-08-18 18:52 . 2008-08-21 13:33 d–h—– C:\$AVG8.VAULT$
2008-08-18 16:31 . 2008-08-24 11:40 d——– C:\WINDOWS\system32\drivers\Avg
2008-08-18 16:31 . 2008-08-18 16:31 96,520 –a—— C:\WINDOWS\system32\drivers\avgldx86.sys
2008-08-18 16:31 . 2008-08-18 16:31 76,040 –a—— C:\WINDOWS\system32\drivers\avgtdix.sys
2008-08-18 16:31 . 2008-08-18 16:31 10,520 –a—— C:\WINDOWS\system32\avgrsstx.dll
2008-08-18 16:30 . 2008-08-18 16:30 d——– C:\Program Files\AVG
2008-08-18 16:30 . 2008-08-18 16:30 d——– C:\Documents and Settings\All Users\Application Data\avg8
2008-08-18 16:28 . 2008-08-18 16:28 d——– C:\Program Files\Trend Micro
2008-08-09 12:29 . 2008-08-09 12:29 7,985,707 –a—— C:\wreck.avi.MOV
2008-08-09 12:27 . 2008-08-09 12:27 d——– C:\Program Files\AviSynth 2.5
2008-08-09 12:27 . 2004-02-22 10:11 719,872 –a—— C:\WINDOWS\system32\devil.dll
2008-08-09 12:27 . 2006-10-07 17:43 502,784 –a—— C:\WINDOWS\x2.64.exe
2008-08-09 12:27 . 2007-05-14 15:24 394,240 –a—— C:\WINDOWS\system32\Smab.dll
2008-08-09 12:27 . 2007-05-17 17:30 318,976 –a—— C:\WINDOWS\system32\avisynth.dll
2008-08-09 12:27 . 2005-02-28 13:16 240,128 –a—— C:\WINDOWS\system32\x.264.exe
2008-08-09 12:27 . 2006-04-12 09:47 217,073 –a—— C:\WINDOWS\meta4.exe
2008-08-09 12:27 . 2004-01-25 00:00 70,656 –a—— C:\WINDOWS\system32\yv12vfw.dll
2008-08-09 12:27 . 2004-01-25 00:00 70,656 –a—— C:\WINDOWS\system32\i420vfw.dll
2008-08-09 12:27 . 2006-04-05 08:09 66,560 –a—— C:\WINDOWS\MOTA113.exe
2008-08-09 12:27 . 2005-07-14 12:31 27,648 –a—— C:\WINDOWS\system32\AVSredirect.dll
2008-08-09 12:26 . 2005-02-12 18:00 186,880 -rahs—- C:\WINDOWS\system32\RLOgg.ax
2008-08-09 12:26 . 2005-01-17 18:26 179,200 -rahs—- C:\WINDOWS\system32\DiracSplitter.ax
2008-08-09 12:26 . 2006-08-16 09:53 175,104 -rahs—- C:\WINDOWS\system32\CoreAAC.ax
2008-08-09 12:26 . 2005-02-05 18:00 92,672 -rahs—- C:\WINDOWS\system32\RLVorbisDec.ax
2008-08-09 12:26 . 2005-02-22 11:55 81,920 -rahs—- C:\WINDOWS\system32\aac_parser.ax
2008-08-09 12:26 . 2005-02-12 18:00 67,584 -rahs—- C:\WINDOWS\system32\RLTheoraDec.ax
2008-08-09 12:26 . 2005-02-12 18:00 51,712 -rahs—- C:\WINDOWS\system32\RLSpeexDec.ax
2008-08-08 19:02 . 2008-08-09 15:51 d——– C:\Program Files\DVR365-Player

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-22 03:41 ——— d—–w C:\Program Files\Dl_cats
2008-08-19 18:35 ——— d—–w C:\Program Files\Jasc Software Inc
2008-08-19 18:35 ——— d—–w C:\Documents and Settings\Hali\Application Data\Jasc Software Inc
2008-07-31 18:20 ——— d—–w C:\Documents and Settings\Hali\Application Data\AdobeUM
2008-07-24 14:23 ——— d—–w C:\Program Files\Java
2008-07-23 20:14 ——— d—–w C:\Documents and Settings\All Users\Application Data\Trymedia
2008-07-19 16:43 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-07-07 20:32 253,952 —-a-w C:\WINDOWS\system32\es.dll
2008-07-07 20:32 253,952 ——w C:\WINDOWS\system32\dllcache\es.dll
2008-06-24 16:23 74,240 —-a-w C:\WINDOWS\system32\mscms.dll
2008-06-24 16:23 74,240 ——w C:\WINDOWS\system32\dllcache\mscms.dll
2008-06-23 16:12 667,136 —-a-w C:\WINDOWS\system32\wininet.dll
2008-06-23 16:12 667,136 ——w C:\WINDOWS\system32\dllcache\wininet.dll
2008-06-23 16:12 618,496 ——w C:\WINDOWS\system32\dllcache\urlmon.dll
2008-06-23 16:12 532,480 —-a-w C:\WINDOWS\system32\dllcache\mstime.dll
2008-06-23 16:12 474,112 ——w C:\WINDOWS\system32\dllcache\shlwapi.dll
2008-06-23 16:12 449,024 ——w C:\WINDOWS\system32\dllcache\mshtmled.dll
2008-06-23 16:12 39,424 ——w C:\WINDOWS\system32\dllcache\pngfilt.dll
2008-06-23 16:12 146,432 ——w C:\WINDOWS\system32\dllcache\msrating.dll
2008-06-23 16:12 1,499,136 ——w C:\WINDOWS\system32\dllcache\shdocvw.dll
2008-06-23 16:11 96,256 —-a-w C:\WINDOWS\system32\dllcache\inseng.dll
2008-06-23 16:11 55,808 ——w C:\WINDOWS\system32\dllcache\extmgr.dll
2008-06-23 16:11 357,888 ——w C:\WINDOWS\system32\dllcache\dxtmsft.dll
2008-06-23 16:11 3,067,392 ——w C:\WINDOWS\system32\dllcache\mshtml.dll
2008-06-23 16:11 251,904 ——w C:\WINDOWS\system32\dllcache\iepeers.dll
2008-06-23 16:11 205,312 ——w C:\WINDOWS\system32\dllcache\dxtrans.dll
2008-06-23 16:11 16,384 —-a-w C:\WINDOWS\system32\dllcache\jsproxy.dll
2008-06-23 16:11 151,040 ——w C:\WINDOWS\system32\dllcache\cdfview.dll
2008-06-23 16:11 1,054,208 —-a-w C:\WINDOWS\system32\dllcache\danim.dll
2008-06-23 16:11 1,024,000 ——w C:\WINDOWS\system32\dllcache\browseui.dll
2008-06-23 09:53 18,432 ——w C:\WINDOWS\system32\dllcache\iedw.exe
2008-06-20 17:41 245,248 —-a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 17:41 245,248 ——w C:\WINDOWS\system32\dllcache\mswsock.dll
2008-06-20 17:41 148,992 —-a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
2008-06-20 10:45 360,320 —-a-w C:\WINDOWS\system32\dllcache\tcpip.sys
2008-06-20 10:44 138,368 ——w C:\WINDOWS\system32\dllcache\afd.sys
2008-06-20 09:52 225,920 —-a-w C:\WINDOWS\system32\dllcache\tcpip6.sys
2008-06-13 13:10 272,128 ——w C:\WINDOWS\system32\dllcache\bthport.sys
2007-08-05 21:44 56 -csh–r C:\WINDOWS\system32\0618BB27E3.sys
2007-07-21 13:50 88 -csh–r C:\WINDOWS\system32\E327BB1806.sys
2007-08-05 21:44 6,528 -csha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((( snapshot@2008-08-21_ 5.11.07.17 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-10-20 16:02:28 163,328 —-a-w C:\WINDOWS\erdnt\8-21-2008\ERDNT.EXE
+ 2008-08-21 22:09:51 7,704,576 —-a-w C:\WINDOWS\erdnt\8-21-2008\Users\00000001\NTUSER.DAT
+ 2008-08-21 22:09:51 196,608 —-a-w C:\WINDOWS\erdnt\8-21-2008\Users\00000002\UsrClass.dat
+ 2005-10-20 16:02:28 163,328 —-a-w C:\WINDOWS\erdnt\8-22-2008\ERDNT.EXE
+ 2008-08-22 04:14:23 7,704,576 —-a-w C:\WINDOWS\erdnt\8-22-2008\Users\00000001\NTUSER.DAT
+ 2008-08-22 04:14:23 196,608 —-a-w C:\WINDOWS\erdnt\8-22-2008\Users\00000002\UsrClass.dat
+ 2005-10-20 16:02:28 163,328 —-a-w C:\WINDOWS\erdnt\AutoBackup\8-21-2008\ERDNT.EXE
+ 2008-08-22 03:40:13 7,704,576 —-a-w C:\WINDOWS\erdnt\AutoBackup\8-21-2008\Users\00000001\NTUSER.DAT
+ 2008-08-22 03:40:13 196,608 —-a-w C:\WINDOWS\erdnt\AutoBackup\8-21-2008\Users\00000002\UsrClass.dat
+ 2005-10-20 16:02:28 163,328 —-a-w C:\WINDOWS\erdnt\AutoBackup\8-24-2008\ERDNT.EXE
+ 2008-08-24 15:39:38 7,704,576 —-a-w C:\WINDOWS\erdnt\AutoBackup\8-24-2008\Users\00000001\NTUSER.DAT
+ 2008-08-24 15:39:38 196,608 —-a-w C:\WINDOWS\erdnt\AutoBackup\8-24-2008\Users\00000002\UsrClass.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-10-14 21:49 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-10-14 21:46 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-10-14 21:50 114688]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-11-29 05:56 761947]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-12-06 02:05 127035]
"DLCGCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCGtime.dll" [2005-09-08 14:56 73728]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-08-18 16:30 1232152]
"Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY.exe" [2005-12-19 16:08 1347584]
"e4e0ab4f"="C:\WINDOWS\system32\mjggvhwg.dll" [BU]
"MSConfig"="C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE" [2005-09-26 20:34 169984]
"SigmatelSysTrayApp"="stsystra.exe" [2005-09-10 00:19 393216 C:\WINDOWS\stsystra.exe]

C:\Documents and Settings\Hali\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - C:\Program Files\ERUNT\AUTOBACK.EXE [2005-10-20 12:04:08 38912]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.I420"= i420vfw.dll
"vidc.yv12"= yv12vfw.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=C:\WINDOWS\pss\Digital Line Detect.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Works Calendar Reminders.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Works Calendar Reminders.lnk
backup=C:\WINDOWS\pss\Microsoft Works Calendar Reminders.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Hali^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
path=C:\Documents and Settings\Hali\Start Menu\Programs\Startup\LimeWire On Startup.lnk
backup=C:\WINDOWS\pss\LimeWire On Startup.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ShowLOMControl]
 [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Broadcom Wireless Manager UI]
–a—— 2005-12-19 16:08 1347584 C:\WINDOWS\system32\WLTRAY.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dlcgmon.exe]
–a—— 2005-10-21 11:42 425984 C:\Program Files\Dell AIO 810\DLCGmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
——— 2005-12-09 20:29 49152 C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\E6TaskPanel]
–a—— 2003-12-08 15:51 733184 C:\Program Files\EarthLink TotalAccess\TaskPanl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
–a—— 2005-06-10 11:44 249856 C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
–a—— 2005-06-10 11:44 81920 C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
–a—— 2007-11-15 14:11 267048 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
–a—— 2001-08-16 23:41 28738 C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
–a—— 2004-10-13 12:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a—— 2007-11-15 00:43 286720 C:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
-rahs—- 2008-07-07 09:42 2156368 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
–a—— 2008-06-10 04:27 144784 C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"AVGEMS"=2 (0x2)
"WinDefend"=2 (0x2)
"WMPNetworkSvc"=3 (0x3)
"usnjsvc"=3 (0x3)
"ose"=3 (0x3)
"iPod Service"=3 (0x3)
"Apple Mobile Device"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\EarthLink TotalAccess\\TaskPanl.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-08-18 16:31]
R2 avg8emc;AVG Free8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-08-18 16:30]
R2 avg8wd;AVG Free8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-08-18 16:30]
R2 AvgTdiX;AVG Free8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-08-18 16:31]

*Newly Created Service* - CATCHME
.
Contents of the 'Scheduled Tasks' folder

2008-02-27 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 15:57]
.
.
——- Supplementary Scan ——-
.
R0 -: HKCU-Main,Start Page = hxxp://www.webmail.vt.edu/
O8 -: &Google Search - C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 -: &Translate English Word - C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 -: Backward Links - C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 -: Cached Snapshot of Page - C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 -: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 -: Similar Pages - C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 -: Translate Page into English - C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-24 11:47:04
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-08-24 11:48:59
ComboFix-quarantined-files.txt 2008-08-24 15:48:36
ComboFix2.txt 2008-08-22 04:12:19
ComboFix3.txt 2008-08-21 09:12:07

Pre-Run: 19,933,396,992 bytes free
Post-Run: 19,937,370,112 bytes free

221 — E O F — 2008-08-12 19:27:19
Post #9
OK I understand what you mean about the infection re-occurring only when connecting back up to the internet. That means either we missed something or we are dealing with something hidden like a rootkit.

Let's run this combofix script and see if that will kill this thing.

1. Please open Notepad
  • Click Start , then Run
  • Type notepad.exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

File::
C:\WINDOWS\system32\mjggvhwg.dll

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"e4e0ab4f"=-


3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

[external image: Posted Image]


5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
  • Combofix.txt
  • A new HijackThis log.



I also need to advise you of the policies on P2P/Filesharing in this forum since I noticed you have Limewire. Please read through this link and in particular the part about P2P. Thanks

http://forums.whatthetech.com/We_do_not_support_t91501.html

I also need you to provide this…

We are going to use HJT to create a list of your currently installed programs.1. Open HijackThis and click on the Config… button in the "Other stuff" section (lower right hand corner).
2. Click on the Misc Tools button.
3. Click on the Open Uninstall Manager… button.
4. Click on the Save list… button.
5. Save the file uninstall_list.txt to a convinient location. This should open Notepad with the list.
6. Please Copy and Paste the list into your next reply.
Post #10
Okay, let's see if this worked? I read the P2P link, I have this laptop with me at my college but it is shared between myself and my Dad…that is his program so I can't delete it. But if you can't help me because of this I understand. He will just have to have it fixed. Something to be noted, I installed the school's security disk for the network and stuff..and there hasn't been a single pop-up. Although my computer is still rather slow?


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:40:12, on 8/25/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.webmail.vt.edu/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll (file missing)
O3 - Toolbar: Pop-Up Blocker - {D7F30B62-8269-41AF-9539-B2697FA7D77E} - C:\Program Files\EarthLink TotalAccess\PnEL.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (file missing)
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [DLCGCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCGtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE /auto
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://learn.vt.edu
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/Facebo…toUploader5.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/…ro.cab56649.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} - http://3dlifeplayer.dl.3dvia.com/player/in…l/installer.exe
O16 - DPF: {DA80E089-4648-43D5-93B4-7F37917084E6} (CacheManager.CacheManagerCtrl) - http://www.candystand.com/assets/activex/v…acheManager.CAB
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: dlcg_device - - C:\WINDOWS\system32\dlcgcoms.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: Symantec Management Client (SmcService) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe
O23 - Service: Symantec Network Access Control (SNAC) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE
O23 - Service: Symantec Endpoint Protection (Symantec AntiVirus) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

–
End of file - 7829 bytes



ComboFix 08-08-23.03 - Hali 2008-08-25 10:44:22.4 - NTFSx86
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Hali\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\WINDOWS\system32\mjggvhwg.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Hali\Application Data\macromedia\Flash Player\#SharedObjects\JLQ49FED\interclick.com
C:\Documents and Settings\Hali\Application Data\macromedia\Flash Player\#SharedObjects\JLQ49FED\interclick.com\ud.sol
C:\Documents and Settings\Hali\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com
C:\Documents and Settings\Hali\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol
C:\Documents and Settings\Hali\cookies\[removed][1].txt

.
((((((((((((((((((((((((( Files Created from 2008-07-25 to 2008-08-25 )))))))))))))))))))))))))))))))
.

2008-08-24 22:16 . 2008-08-24 22:17 123,952 –a—— C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-08-24 22:16 . 2008-08-24 22:17 60,800 –a—— C:\WINDOWS\system32\S32EVNT1.DLL
2008-08-24 22:16 . 2008-08-24 22:17 10,563 –a—— C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-08-24 22:16 . 2008-08-24 22:17 805 –a—— C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-08-24 22:14 . 2008-08-24 22:17 d——– C:\Program Files\Symantec
2008-08-24 22:14 . 2008-08-24 22:19 d——– C:\Program Files\Common Files\Symantec Shared
2008-08-24 22:14 . 2008-08-24 22:18 d——– C:\Documents and Settings\All Users\Application Data\Symantec
2008-08-24 22:09 . 2008-08-24 22:09 d——– C:\VT-SecureTools
2008-08-24 22:09 . 2002-05-29 01:49 2,238 -r——- C:\WINDOWS\system32\myvticon.ico
2008-08-24 22:09 . 2003-04-22 02:47 1,078 -r——- C:\WINDOWS\system32\security.ico
2008-08-21 18:09 . 2008-08-21 18:09 d——– C:\Program Files\ERUNT
2008-08-19 15:24 . 2008-08-19 15:24 d——– C:\Program Files\Spybot - Search & Destroy
2008-08-19 15:24 . 2008-08-19 16:31 d——– C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-08-19 15:06 . 2008-08-19 22:32 2,422 –a—— C:\WINDOWS\system32\tmp.reg
2008-08-19 15:00 . 2006-04-27 02:29 d——– C:\Documents and Settings\Administrator\Application Data\Gtek
2008-08-19 15:00 . 2006-04-27 02:34 d——– C:\Documents and Settings\Administrator\Application Data\Corel
2008-08-19 14:59 . 2008-08-19 15:00 d——– C:\Documents and Settings\Administrator
2008-08-18 18:52 . 2008-08-21 13:33 d–h—– C:\$AVG8.VAULT$
2008-08-18 16:31 . 2008-08-25 08:42 d——– C:\WINDOWS\system32\drivers\Avg
2008-08-18 16:31 . 2008-08-18 16:31 96,520 –a—— C:\WINDOWS\system32\drivers\avgldx86.sys
2008-08-18 16:31 . 2008-08-18 16:31 76,040 –a—— C:\WINDOWS\system32\drivers\avgtdix.sys
2008-08-18 16:31 . 2008-08-18 16:31 10,520 –a—— C:\WINDOWS\system32\avgrsstx.dll
2008-08-18 16:30 . 2008-08-18 16:30 d——– C:\Program Files\AVG
2008-08-18 16:30 . 2008-08-18 16:30 d——– C:\Documents and Settings\All Users\Application Data\avg8
2008-08-18 16:28 . 2008-08-18 16:28 d——– C:\Program Files\Trend Micro
2008-08-09 12:29 . 2008-08-09 12:29 7,985,707 –a—— C:\wreck.avi.MOV
2008-08-09 12:27 . 2008-08-09 12:27 d——– C:\Program Files\AviSynth 2.5
2008-08-09 12:27 . 2004-02-22 10:11 719,872 –a—— C:\WINDOWS\system32\devil.dll
2008-08-09 12:27 . 2006-10-07 17:43 502,784 –a—— C:\WINDOWS\x2.64.exe
2008-08-09 12:27 . 2007-05-14 15:24 394,240 –a—— C:\WINDOWS\system32\Smab.dll
2008-08-09 12:27 . 2007-05-17 17:30 318,976 –a—— C:\WINDOWS\system32\avisynth.dll
2008-08-09 12:27 . 2005-02-28 13:16 240,128 –a—— C:\WINDOWS\system32\x.264.exe
2008-08-09 12:27 . 2006-04-12 09:47 217,073 –a—— C:\WINDOWS\meta4.exe
2008-08-09 12:27 . 2004-01-25 00:00 70,656 –a—— C:\WINDOWS\system32\yv12vfw.dll
2008-08-09 12:27 . 2004-01-25 00:00 70,656 –a—— C:\WINDOWS\system32\i420vfw.dll
2008-08-09 12:27 . 2006-04-05 08:09 66,560 –a—— C:\WINDOWS\MOTA113.exe
2008-08-09 12:27 . 2005-07-14 12:31 27,648 –a—— C:\WINDOWS\system32\AVSredirect.dll
2008-08-09 12:26 . 2005-02-12 18:00 186,880 -rahs—- C:\WINDOWS\system32\RLOgg.ax
2008-08-09 12:26 . 2005-01-17 18:26 179,200 -rahs—- C:\WINDOWS\system32\DiracSplitter.ax
2008-08-09 12:26 . 2006-08-16 09:53 175,104 -rahs—- C:\WINDOWS\system32\CoreAAC.ax
2008-08-09 12:26 . 2005-02-05 18:00 92,672 -rahs—- C:\WINDOWS\system32\RLVorbisDec.ax
2008-08-09 12:26 . 2005-02-22 11:55 81,920 -rahs—- C:\WINDOWS\system32\aac_parser.ax
2008-08-09 12:26 . 2005-02-12 18:00 67,584 -rahs—- C:\WINDOWS\system32\RLTheoraDec.ax
2008-08-09 12:26 . 2005-02-12 18:00 51,712 -rahs—- C:\WINDOWS\system32\RLSpeexDec.ax
2008-08-08 19:02 . 2008-08-09 15:51 d——– C:\Program Files\DVR365-Player

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-24 16:04 ——— d—–w C:\Program Files\Dl_cats
2008-08-24 16:00 ——— d—–w C:\Documents and Settings\Hali\Application Data\AdobeUM
2008-08-19 18:35 ——— d—–w C:\Program Files\Jasc Software Inc
2008-08-19 18:35 ——— d—–w C:\Documents and Settings\Hali\Application Data\Jasc Software Inc
2008-07-24 14:23 ——— d—–w C:\Program Files\Java
2008-07-23 20:14 ——— d—–w C:\Documents and Settings\All Users\Application Data\Trymedia
2008-07-19 16:43 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-07-07 20:32 253,952 —-a-w C:\WINDOWS\system32\es.dll
2008-07-07 20:32 253,952 ——w C:\WINDOWS\system32\dllcache\es.dll
2008-06-24 16:23 74,240 —-a-w C:\WINDOWS\system32\mscms.dll
2008-06-24 16:23 74,240 ——w C:\WINDOWS\system32\dllcache\mscms.dll
2008-06-23 16:12 667,136 —-a-w C:\WINDOWS\system32\wininet.dll
2008-06-23 16:12 667,136 ——w C:\WINDOWS\system32\dllcache\wininet.dll
2008-06-23 16:12 618,496 ——w C:\WINDOWS\system32\dllcache\urlmon.dll
2008-06-23 16:12 532,480 —-a-w C:\WINDOWS\system32\dllcache\mstime.dll
2008-06-23 16:12 474,112 ——w C:\WINDOWS\system32\dllcache\shlwapi.dll
2008-06-23 16:12 449,024 ——w C:\WINDOWS\system32\dllcache\mshtmled.dll
2008-06-23 16:12 39,424 ——w C:\WINDOWS\system32\dllcache\pngfilt.dll
2008-06-23 16:12 146,432 ——w C:\WINDOWS\system32\dllcache\msrating.dll
2008-06-23 16:12 1,499,136 ——w C:\WINDOWS\system32\dllcache\shdocvw.dll
2008-06-23 16:11 96,256 —-a-w C:\WINDOWS\system32\dllcache\inseng.dll
2008-06-23 16:11 55,808 ——w C:\WINDOWS\system32\dllcache\extmgr.dll
2008-06-23 16:11 357,888 ——w C:\WINDOWS\system32\dllcache\dxtmsft.dll
2008-06-23 16:11 3,067,392 ——w C:\WINDOWS\system32\dllcache\mshtml.dll
2008-06-23 16:11 251,904 ——w C:\WINDOWS\system32\dllcache\iepeers.dll
2008-06-23 16:11 205,312 ——w C:\WINDOWS\system32\dllcache\dxtrans.dll
2008-06-23 16:11 16,384 —-a-w C:\WINDOWS\system32\dllcache\jsproxy.dll
2008-06-23 16:11 151,040 ——w C:\WINDOWS\system32\dllcache\cdfview.dll
2008-06-23 16:11 1,054,208 —-a-w C:\WINDOWS\system32\dllcache\danim.dll
2008-06-23 16:11 1,024,000 ——w C:\WINDOWS\system32\dllcache\browseui.dll
2008-06-23 09:53 18,432 ——w C:\WINDOWS\system32\dllcache\iedw.exe
2008-06-20 17:41 245,248 —-a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 17:41 245,248 ——w C:\WINDOWS\system32\dllcache\mswsock.dll
2008-06-20 17:41 148,992 —-a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
2008-06-20 10:45 360,320 —-a-w C:\WINDOWS\system32\dllcache\tcpip.sys
2008-06-20 10:44 138,368 ——w C:\WINDOWS\system32\dllcache\afd.sys
2008-06-20 09:52 225,920 —-a-w C:\WINDOWS\system32\dllcache\tcpip6.sys
2008-06-13 13:10 272,128 ——w C:\WINDOWS\system32\dllcache\bthport.sys
2007-08-05 21:44 56 -csh–r C:\WINDOWS\system32\0618BB27E3.sys
2007-07-21 13:50 88 -csh–r C:\WINDOWS\system32\E327BB1806.sys
2007-08-05 21:44 6,528 -csha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((( snapshot@2008-08-21_ 5.11.07.17 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-10-20 16:02:28 163,328 —-a-w C:\WINDOWS\erdnt\8-21-2008\ERDNT.EXE
+ 2008-08-21 22:09:51 7,704,576 —-a-w C:\WINDOWS\erdnt\8-21-2008\Users\00000001\NTUSER.DAT
+ 2008-08-21 22:09:51 196,608 —-a-w C:\WINDOWS\erdnt\8-21-2008\Users\00000002\UsrClass.dat
+ 2005-10-20 16:02:28 163,328 —-a-w C:\WINDOWS\erdnt\8-22-2008\ERDNT.EXE
+ 2008-08-22 04:14:23 7,704,576 —-a-w C:\WINDOWS\erdnt\8-22-2008\Users\00000001\NTUSER.DAT
+ 2008-08-22 04:14:23 196,608 —-a-w C:\WINDOWS\erdnt\8-22-2008\Users\00000002\UsrClass.dat
+ 2005-10-20 16:02:28 163,328 —-a-w C:\WINDOWS\erdnt\AutoBackup\8-21-2008\ERDNT.EXE
+ 2008-08-22 03:40:13 7,704,576 —-a-w C:\WINDOWS\erdnt\AutoBackup\8-21-2008\Users\00000001\NTUSER.DAT
+ 2008-08-22 03:40:13 196,608 —-a-w C:\WINDOWS\erdnt\AutoBackup\8-21-2008\Users\00000002\UsrClass.dat
+ 2005-10-20 16:02:28 163,328 —-a-w C:\WINDOWS\erdnt\AutoBackup\8-24-2008\ERDNT.EXE
+ 2008-08-24 15:39:38 7,704,576 —-a-w C:\WINDOWS\erdnt\AutoBackup\8-24-2008\Users\00000001\NTUSER.DAT
+ 2008-08-24 15:39:38 196,608 —-a-w C:\WINDOWS\erdnt\AutoBackup\8-24-2008\Users\00000002\UsrClass.dat
+ 2008-08-25 02:18:07 21,446 —-a-r C:\WINDOWS\Installer\{76B2BC31-2D96-4170-9C44-09E13B5555F3}\ARPPRODUCTICON.exe
- 2005-12-19 20:08:30 89,088 —-a-w C:\WINDOWS\system32\ATL71.DLL
+ 2006-11-01 00:24:10 89,088 —-a-w C:\WINDOWS\system32\atl71.dll
+ 2007-08-12 00:05:27 511,328 —-a-w C:\WINDOWS\system32\capicom.dll
+ 2008-04-04 23:03:08 34,288 —-a-w C:\WINDOWS\system32\cba.dll
+ 2007-05-29 17:55:36 22,112 —-a-w C:\WINDOWS\system32\drivers\COH_Mon.sys
+ 2008-03-21 23:14:24 279,088 —-a-w C:\WINDOWS\system32\drivers\srtsp.sys
+ 2008-03-21 23:14:24 317,616 —-a-w C:\WINDOWS\system32\drivers\srtspl.sys
+ 2008-03-21 23:14:24 43,696 —-a-w C:\WINDOWS\system32\drivers\srtspx.sys
+ 2007-10-31 00:55:14 12,848 —-a-w C:\WINDOWS\system32\drivers\symdns.sys
+ 2007-10-31 00:55:20 145,968 —-a-w C:\WINDOWS\system32\drivers\symfw.sys
+ 2007-10-31 00:55:28 39,856 —-a-w C:\WINDOWS\system32\drivers\symids.sys
+ 2007-10-31 00:55:24 35,120 —-a-w C:\WINDOWS\system32\drivers\symndis.sys
+ 2007-10-31 00:55:44 37,936 —-a-w C:\WINDOWS\system32\drivers\symndisv.sys
+ 2007-10-31 00:55:34 27,696 —-a-w C:\WINDOWS\system32\drivers\symredrv.sys
+ 2007-10-31 00:55:38 191,536 —-a-w C:\WINDOWS\system32\drivers\symtdi.sys
+ 2008-04-04 06:45:34 38,632 —-a-w C:\WINDOWS\system32\drivers\WGX.SYS
+ 2008-04-04 22:55:52 48,000 —-a-w C:\WINDOWS\system32\FwsVpn.dll
+ 2008-04-04 23:03:10 83,384 —-a-w C:\WINDOWS\system32\loc32vc0.dll
- 2005-12-19 20:08:42 1,060,864 —-a-w C:\WINDOWS\system32\MFC71.DLL
+ 2007-03-22 00:39:00 1,060,864 —-a-w C:\WINDOWS\system32\MFC71.DLL
+ 2008-04-04 23:03:10 46,584 —-a-w C:\WINDOWS\system32\msgsys.dll
- 2005-09-09 00:20:04 503,808 —-a-w C:\WINDOWS\system32\msvcp71.dll
+ 2007-03-22 00:33:00 503,808 —-a-w C:\WINDOWS\system32\MSVCP71.DLL
- 2005-09-09 00:20:04 348,160 —-a-w C:\WINDOWS\system32\msvcr71.dll
+ 2007-03-22 00:33:00 348,160 —-a-w C:\WINDOWS\system32\MSVCR71.DLL
+ 2008-04-04 23:03:10 91,632 —-a-w C:\WINDOWS\system32\nts.dll
+ 2008-04-04 23:03:12 83,440 —-a-w C:\WINDOWS\system32\pds.dll
+ 2007-10-31 00:55:50 625,032 —-a-w C:\WINDOWS\system32\SymNeti.dll
+ 2007-10-31 00:55:48 242,056 —-a-w C:\WINDOWS\system32\SymRedir.dll
+ 2008-04-04 22:58:40 107,904 —-a-w C:\WINDOWS\system32\SymVPN.dll
+ 2008-08-25 14:11:45 16,384 —-atw C:\WINDOWS\temp\Perflib_Perfdata_420.dat
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-10-14 21:49 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-10-14 21:46 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-10-14 21:50 114688]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-11-29 05:56 761947]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-12-06 02:05 127035]
"DLCGCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCGtime.dll" [2005-09-08 14:56 73728]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-08-18 16:30 1232152]
"Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY.exe" [2005-12-19 16:08 1347584]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-02-01 01:25 115560]
"MSConfig"="C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE" [2005-09-26 20:34 169984]
"SigmatelSysTrayApp"="stsystra.exe" [2005-09-10 00:19 393216 C:\WINDOWS\stsystra.exe]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.I420"= i420vfw.dll
"vidc.yv12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccEvtMgr]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccSetMgr]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Symantec Antivirus]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Symantec Antvirus]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=C:\WINDOWS\pss\Digital Line Detect.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Works Calendar Reminders.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Works Calendar Reminders.lnk
backup=C:\WINDOWS\pss\Microsoft Works Calendar Reminders.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Hali^Start Menu^Programs^Startup^ERUNT AutoBackup.lnk]
path=C:\Documents and Settings\Hali\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
backup=C:\WINDOWS\pss\ERUNT AutoBackup.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Hali^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
path=C:\Documents and Settings\Hali\Start Menu\Programs\Startup\LimeWire On Startup.lnk
backup=C:\WINDOWS\pss\LimeWire On Startup.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ShowLOMControl]
 [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Broadcom Wireless Manager UI]
–a—— 2005-12-19 16:08 1347584 C:\WINDOWS\system32\WLTRAY.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dlcgmon.exe]
–a—— 2005-10-21 11:42 425984 C:\Program Files\Dell AIO 810\DLCGmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
——— 2005-12-09 20:29 49152 C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\E6TaskPanel]
–a—— 2003-12-08 15:51 733184 C:\Program Files\EarthLink TotalAccess\TaskPanl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
–a—— 2005-06-10 11:44 249856 C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
–a—— 2005-06-10 11:44 81920 C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
–a—— 2007-11-15 14:11 267048 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
–a—— 2001-08-16 23:41 28738 C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
–a—— 2004-10-13 12:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a—— 2007-11-15 00:43 286720 C:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
-rahs—- 2008-07-07 09:42 2156368 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
–a—— 2008-06-10 04:27 144784 C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"AVGEMS"=2 (0x2)
"WinDefend"=2 (0x2)
"WMPNetworkSvc"=3 (0x3)
"usnjsvc"=3 (0x3)
"ose"=3 (0x3)
"iPod Service"=3 (0x3)
"Apple Mobile Device"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\EarthLink TotalAccess\\TaskPanl.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"C:\\Program Files\\Symantec\\Symantec Endpoint Protection\\Smc.exe"=
"C:\\Program Files\\Symantec\\Symantec Endpoint Protection\\SNAC.EXE"=
"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-08-18 16:31]
R2 avg8emc;AVG Free8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-08-18 16:30]
R2 avg8wd;AVG Free8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-08-18 16:30]
R2 AvgTdiX;AVG Free8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-08-18 16:31]
.
Contents of the 'Scheduled Tasks' folder

2008-02-27 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 15:57]
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-25 10:48:09
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-08-25 10:50:03
ComboFix-quarantined-files.txt 2008-08-25 14:49:49
ComboFix2.txt 2008-08-24 15:49:00
ComboFix3.txt 2008-08-22 04:12:19
ComboFix4.txt 2008-08-21 09:12:07

Pre-Run: 19,299,123,200 bytes free
Post-Run: 19,369,717,760 bytes free

277 — E O F — 2008-08-12 19:27:19
Post #11
OK glad to hear the pop-ups have stopped.

I installed the school's security disk for the network and stuff


I assume Symantec Anti-virus or security suite was included with that security disk? Because now it looks like you have 2 anti-virus programs running, AVG and Symantec. This can cause all kinds of issues including conflicts, errors, false positves, and SYSTEM SLOWDOWN! If the school requires you to install that disk and Symantec gets regular updates then you should uninstall AVG, that should help with the performance issue.

Let's do some more scans and cleanup too.

First, use Use ATF Cleaner to remove temp files,
cookies, cache, ect…
Please download ATF Cleaner by Atribune.
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.


Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy and Paste the entire report in your next reply along with a Hijackthis log.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Please go to Kaspersky website and perform an online antivirus scan.

  • Read through the requirements and privacy statement and click on Accept button.
  • It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
  • When the downloads have finished, click on Settings.
  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
    • Spyware, Adware, Dialers, and other potentially dangerous programs
      Archives
      Mail databases
  • Click on My Computer under Scan.
  • Once the scan is complete, it will display the results. Click on View Scan Report.
  • You will see a list of infected items there. Click on Save Report As….
  • Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
  • Please post this log in your next reply.
Post a new HijackThis log too and let me know how it's running now.
Post #12
I removed the AVG software. My computer hasn't had any pop-up's since I installed the college cd but it still seems bogged down; and these infections were found. Other than that everything is running smoother. KASPERSKY ONLINE SCANNER 7 REPORT Monday, August 25, 2008 Operating System: Microsoft Windows XP Home Edition Service Pack 2 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Monday, August 25, 2008 15:15:15 Records in database: 1144482 Scan settings Scan using the following database extended Scan archives yes Scan mail databases yes Scan area My Computer C:\ D:\ Scan statistics Files scanned 44581 Threat name 5 Infected objects 6 Suspicious objects 0 Duration of the scan 01:28:33 File name Threat name Threats count C:\Documents and Settings\Administrator\Desktop\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f 1 C:\Documents and Settings\Hali\Application Data\Sun\Java\Deployment\cache\6.0\14\22b3580e-5f8f1cdf Infected: Trojan-Downloader.Java.OpenStream.ac 1 C:\Documents and Settings\Hali\Application Data\Sun\Java\Deployment\cache\6.0\52\6d7493b4-19536560 Infected: Trojan-Downloader.Java.OpenStream.ac 1 C:\QooBox\Quarantine\C\WINDOWS\system32\mjggvhwg.dll.vir Infected: Trojan.Win32.Monder.hop 1 C:\QooBox\Quarantine\C\WINDOWS\system32\xdodcdby.dll.vir Infected: Trojan.Win32.Monder.gil 1 C:\VT-SecureTools\CleanWipe.exe Infected: Trojan.Win32.MonaGray.f 1 The selected area was scanned.
Post #13
Hi,

Did the MalwareBytes Anti-Malware find anything? If so can you post that log.

Also, do you know if this is part of what was installed with the security CD at school? C:\VT-SecureTools
Kaspersky is flagging the Cleanwipe.exe file as bad but it looks like that was installed at the same time Symantec was, or just before.

My computer hasn't had any pop-up's since I installed the college cd but it still seems bogged down

Unfortunately this is probably caused by Symantec. It is known as a resource hog and will slow you down more than AVG…I typically don't recommend it but if your school requires it then….

How much RAM does the PC have? How about CPU?

Post a new HijackThis log and the MBAM log if there is one.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI