What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Porn site son

6 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I'd appreciate some help. My son borrowed his sisters laptop and i'm sure he visited some porn sites and now it has a virus.

When the computer is started it comes up with a popup window that has C system 32 bla bla and won't let it go.

I installed Spybot and ran it and it said everything was clear. Still comes up with this during normal boot. I can boot only in safe mode. Please revew and help me so i can get her off to college.

Logfile of HijackThis v1.99.1
Scan saved at 7:07:43 PM, on 8/20/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\HijackThis!\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {2D304198-89AC-4B3A-906C-E08C43C10617} - C:\WINDOWS\system32\ssqpo.dll (file missing)
O2 - BHO: PBlockHelper Class - {4115122B-85FF-4DD3-9515-F075BEDE5EB5} - C:\PROGRA~1\NETSCA~1\NETSCA~1\pbhelper.dll
O2 - BHO: {8df8086e-ad5a-dbcb-40c4-219213d1b664} - {466b1d31-2912-4c04-bcbd-a5dae6808fd8} - C:\WINDOWS\system32\fhnvsw.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {79AE735F-9663-4B92-9602-39EB563FA30C} - C:\WINDOWS\system32\fccyvus.dll (file missing)
O2 - BHO: (no name) - {A3CA8F2C-0BA6-4430-A17A-137669ABB4FB} - C:\WINDOWS\system32\ddcya.dll (file missing)
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {A9C7EF9C-3C46-4C2E-98CE-F47630BCC4Ee} - C:\WINDOWS\system32\auhyksjm.dll (file missing)
O2 - BHO: (no name) - {AE9F64F6-C1B8-47A2-A3B9-1132F2B4B2F5} - C:\WINDOWS\system32\geedb.dll (file missing)
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [d4c95283] rundll32.exe "C:\WINDOWS\system32\jscaasjc.dll",b
O4 - HKLM\..\RunOnce: [SpybotDeletingC4834] cmd /c del "C:\WINDOWS\system32\nonrboct.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA4325] command /c del "C:\WINDOWS\system32\onspomcn.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC1142] cmd /c del "C:\WINDOWS\system32\onspomcn.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA3394] command /c del "C:\WINDOWS\system32\pjdycipv.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC6818] cmd /c del "C:\WINDOWS\system32\pjdycipv.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA2093] command /c del "C:\WINDOWS\system32\qrvxodwk.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC384] cmd /c del "C:\WINDOWS\system32\qrvxodwk.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA5752] command /c del "C:\WINDOWS\system32\umcdabqe.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC3588] cmd /c del "C:\WINDOWS\system32\umcdabqe.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA417] command /c del "C:\WINDOWS\system32\wceixkpg.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC8548] cmd /c del "C:\WINDOWS\system32\wceixkpg.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA7795] command /c del "C:\WINDOWS\system32\auhyksjm.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC3966] cmd /c del "C:\WINDOWS\system32\auhyksjm.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA9407] command /c del "C:\WINDOWS\system32\bdrxuxnh.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC441] cmd /c del "C:\WINDOWS\system32\bdrxuxnh.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA6032] command /c del "C:\WINDOWS\system32\bfyitoqr.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC9236] cmd /c del "C:\WINDOWS\system32\bfyitoqr.dll_old"
O4 - HKLM\..\RunOnce: [Spybot - Search & Destroy] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKLM\..\RunOnce: [SpybotDeletingA4412] command /c del "C:\WINDOWS\system32\bgtcowcj.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC3626] cmd /c del "C:\WINDOWS\system32\bgtcowcj.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA1278] command /c del "C:\WINDOWS\system32\byltxwds.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC7985] cmd /c del "C:\WINDOWS\system32\byltxwds.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA2133] command /c del "C:\WINDOWS\system32\crbjlqjw.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC264] cmd /c del "C:\WINDOWS\system32\crbjlqjw.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA4522] command /c del "C:\WINDOWS\system32\daedgwug.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC4638] cmd /c del "C:\WINDOWS\system32\daedgwug.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA651] command /c del "C:\WINDOWS\system32\bgtcowcj.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC832] cmd /c del "C:\WINDOWS\system32\bgtcowcj.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA3781] command /c del "C:\WINDOWS\system32\byltxwds.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC380] cmd /c del "C:\WINDOWS\system32\byltxwds.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA2463] command /c del "C:\WINDOWS\system32\crbjlqjw.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC8226] cmd /c del "C:\WINDOWS\system32\crbjlqjw.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA8641] command /c del "C:\WINDOWS\system32\daedgwug.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC9990] cmd /c del "C:\WINDOWS\system32\daedgwug.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA1116] command /c del "C:\WINDOWS\system32\ektvbkvw.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC1881] cmd /c del "C:\WINDOWS\system32\ektvbkvw.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA1411] command /c del "C:\WINDOWS\system32\hjonboqe.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC8900] cmd /c del "C:\WINDOWS\system32\hjonboqe.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA1652] command /c del "C:\WINDOWS\system32\ibrguwwy.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5718] cmd /c del "C:\WINDOWS\system32\ibrguwwy.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA5730] command /c del "C:\WINDOWS\system32\kiqisawk.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC7017] cmd /c del "C:\WINDOWS\system32\kiqisawk.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA7210] command /c del "C:\WINDOWS\system32\knnbfapx.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC1895] cmd /c del "C:\WINDOWS\system32\knnbfapx.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA3038] command /c del "C:\WINDOWS\system32\kyojtumj.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC1839] cmd /c del "C:\WINDOWS\system32\kyojtumj.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA8150] command /c del "C:\WINDOWS\system32\mobwkccg.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC887] cmd /c del "C:\WINDOWS\system32\mobwkccg.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA3523] command /c del "C:\WINDOWS\system32\bgtcowcj.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC2448] cmd /c del "C:\WINDOWS\system32\bgtcowcj.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA6797] command /c del "C:\WINDOWS\system32\byltxwds.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC950] cmd /c del "C:\WINDOWS\system32\byltxwds.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA8514] command /c del "C:\WINDOWS\system32\crbjlqjw.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC7293] cmd /c del "C:\WINDOWS\system32\crbjlqjw.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA2615] command /c del "C:\WINDOWS\system32\daedgwug.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC3934] cmd /c del "C:\WINDOWS\system32\daedgwug.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA4130] command /c del "C:\WINDOWS\system32\ektvbkvw.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC2880] cmd /c del "C:\WINDOWS\system32\ektvbkvw.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA1441] command /c del "C:\WINDOWS\system32\hjonboqe.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC1382] cmd /c del "C:\WINDOWS\system32\hjonboqe.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA9938] command /c del "C:\WINDOWS\system32\ibrguwwy.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC2128] cmd /c del "C:\WINDOWS\system32\ibrguwwy.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA6245] command /c del "C:\WINDOWS\system32\kiqisawk.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC6458] cmd /c del "C:\WINDOWS\system32\kiqisawk.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA1037] command /c del "C:\WINDOWS\system32\knnbfapx.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC9826] cmd /c del "C:\WINDOWS\system32\knnbfapx.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA8296] command /c del "C:\WINDOWS\system32\kyojtumj.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC7881] cmd /c del "C:\WINDOWS\system32\kyojtumj.dll_old"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netWaiting.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [DellTransferAgent] "C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\RunOnce: [SpybotDeletingB3214] command /c del "C:\WINDOWS\system32\fccyvus.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD9551] cmd /c del "C:\WINDOWS\system32\fccyvus.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB3984] command /c del "C:\WINDOWS\system32\fccyvus.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD6585] cmd /c del "C:\WINDOWS\system32\fccyvus.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB4400] command /c del "C:\WINDOWS\system32\geedb.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD7137] cmd /c del "C:\WINDOWS\system32\geedb.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB7340] command /c del "C:\WINDOWS\system32\fccyvus.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD9967] cmd /c del "C:\WINDOWS\system32\fccyvus.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB5257] command /c del "C:\WINDOWS\system32\geedb.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD6778] cmd /c del "C:\WINDOWS\system32\geedb.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB7679] command /c del "C:\WINDOWS\system32\gtnnfdoe.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD3379] cmd /c del "C:\WINDOWS\system32\gtnnfdoe.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB6187] command /c del "C:\WINDOWS\system32\cglqhuwa.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD4461] cmd /c del "C:\WINDOWS\system32\cglqhuwa.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB3254] command /c del "C:\WINDOWS\system32\dasupmbk.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD5697] cmd /c del "C:\WINDOWS\system32\dasupmbk.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB1739] command /c del "C:\WINDOWS\system32\djuotvko.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD8746] cmd /c del "C:\WINDOWS\system32\djuotvko.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB553] command /c del "C:\WINDOWS\system32\dnxlikvn.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD7285] cmd /c del "C:\WINDOWS\system32\dnxlikvn.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB225] command /c del "C:\WINDOWS\system32\earsnlww.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD3689] cmd /c del "C:\WINDOWS\system32\earsnlww.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB208] command /c del "C:\WINDOWS\system32\flkshokp.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD6259] cmd /c del "C:\WINDOWS\system32\flkshokp.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB5737] command /c del "C:\WINDOWS\system32\gtfynauk.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD4277] cmd /c del "C:\WINDOWS\system32\gtfynauk.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB4410] command /c del "C:\WINDOWS\system32\hfxuhsya.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD8194] cmd /c del "C:\WINDOWS\system32\hfxuhsya.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB2860] command /c del "C:\WINDOWS\system32\itaodvcr.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD3622] cmd /c del "C:\WINDOWS\system32\itaodvcr.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB3859] command /c del "C:\WINDOWS\system32\iulewiis.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD1372] cmd /c del "C:\WINDOWS\system32\iulewiis.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB7711] command /c del "C:\WINDOWS\system32\ivqwgfya.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD3161] cmd /c del "C:\WINDOWS\system32\ivqwgfya.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB6441] command /c del "C:\WINDOWS\system32\mpjmyxur.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD4386] cmd /c del "C:\WINDOWS\system32\mpjmyxur.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB7234] command /c del "C:\WINDOWS\system32\nonrboct.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD94] cmd /c del "C:\WINDOWS\system32\nonrboct.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB9024] command /c del "C:\WINDOWS\system32\onspomcn.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD4887] cmd /c del "C:\WINDOWS\system32\onspomcn.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB4740] command /c del "C:\WINDOWS\system32\pjdycipv.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD9940] cmd /c del "C:\WINDOWS\system32\pjdycipv.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB9209] command /c del "C:\WINDOWS\system32\qrvxodwk.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD3157] cmd /c del "C:\WINDOWS\system32\qrvxodwk.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB359] command /c del "C:\WINDOWS\system32\umcdabqe.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD9810] cmd /c del "C:\WINDOWS\system32\umcdabqe.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB2660] command /c del "C:\WINDOWS\system32\wceixkpg.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD9715] cmd /c del "C:\WINDOWS\system32\wceixkpg.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB879] command /c del "C:\WINDOWS\system32\auhyksjm.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD1890] cmd /c del "C:\WINDOWS\system32\auhyksjm.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB5144] command /c del "C:\WINDOWS\system32\bdrxuxnh.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD3111] cmd /c del "C:\WINDOWS\system32\bdrxuxnh.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB8680] command /c del "C:\WINDOWS\system32\bfyitoqr.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD5422] cmd /c del "C:\WINDOWS\system32\bfyitoqr.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB6637] command /c del "C:\WINDOWS\system32\bgtcowcj.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD2024] cmd /c del "C:\WINDOWS\system32\bgtcowcj.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB2733] command /c del "C:\WINDOWS\system32\byltxwds.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD8459] cmd /c del "C:\WINDOWS\system32\byltxwds.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB5238] command /c del "C:\WINDOWS\system32\crbjlqjw.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD1659] cmd /c del "C:\WINDOWS\system32\crbjlqjw.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB8799] command /c del "C:\WINDOWS\system32\daedgwug.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD3826] cmd /c del "C:\WINDOWS\system32\daedgwug.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB7742] command /c del "C:\WINDOWS\system32\bgtcowcj.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD9734] cmd /c del "C:\WINDOWS\system32\bgtcowcj.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB3754] command /c del "C:\WINDOWS\system32\byltxwds.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD5688] cmd /c del "C:\WINDOWS\system32\byltxwds.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB5489] command /c del "C:\WINDOWS\system32\crbjlqjw.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD8466] cmd /c del "C:\WINDOWS\system32\crbjlqjw.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB481] command /c del "C:\WINDOWS\system32\daedgwug.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD7885] cmd /c del "C:\WINDOWS\system32\daedgwug.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB5796] command /c del "C:\WINDOWS\system32\ektvbkvw.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD4536] cmd /c del "C:\WINDOWS\system32\ektvbkvw.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB8211] command /c del "C:\WINDOWS\system32\hjonboqe.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD8032] cmd /c del "C:\WINDOWS\system32\hjonboqe.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB8496] command /c del "C:\WINDOWS\system32\ibrguwwy.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD8995] cmd /c del "C:\WINDOWS\system32\ibrguwwy.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB7724] command /c del "C:\WINDOWS\system32\kiqisawk.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD3642] cmd /c del "C:\WINDOWS\system32\kiqisawk.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB8407] command /c del "C:\WINDOWS\system32\knnbfapx.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD544] cmd /c del "C:\WINDOWS\system32\knnbfapx.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB7748] command /c del "C:\WINDOWS\system32\kyojtumj.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD7651] cmd /c del "C:\WINDOWS\system32\kyojtumj.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB3512] command /c del "C:\WINDOWS\system32\mobwkccg.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD2617] cmd /c del "C:\WINDOWS\system32\mobwkccg.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB5650] command /c del "C:\WINDOWS\system32\bgtcowcj.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD9752] cmd /c del "C:\WINDOWS\system32\bgtcowcj.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB9822] command /c del "C:\WINDOWS\system32\byltxwds.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD3683] cmd /c del "C:\WINDOWS\system32\byltxwds.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB470] command /c del "C:\WINDOWS\system32\crbjlqjw.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD7297] cmd /c del "C:\WINDOWS\system32\crbjlqjw.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB6568] command /c del "C:\WINDOWS\system32\daedgwug.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD9768] cmd /c del "C:\WINDOWS\system32\daedgwug.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB39] command /c del "C:\WINDOWS\system32\ektvbkvw.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD2952] cmd /c del "C:\WINDOWS\system32\ektvbkvw.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB8802] command /c del "C:\WINDOWS\system32\hjonboqe.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD2189] cmd /c del "C:\WINDOWS\system32\hjonboqe.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB4463] command /c del "C:\WINDOWS\system32\ibrguwwy.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD3392] cmd /c del "C:\WINDOWS\system32\ibrguwwy.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB1401] command /c del "C:\WINDOWS\system32\kiqisawk.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD8780] cmd /c del "C:\WINDOWS\system32\kiqisawk.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB7517] command /c del "C:\WINDOWS\system32\knnbfapx.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD4708] cmd /c del "C:\WINDOWS\system32\knnbfapx.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB7919] command /c del "C:\WINDOWS\system32\kyojtumj.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD7720] cmd /c del "C:\WINDOWS\system32\kyojtumj.dll_old"
O4 - Startup: LimeWire On Startup.lnk.disabled
O4 - Global Startup: Digital Line Detect.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1A26F07F-0D60-4835-91CF-1E1766A0EC56} (WebInstall Class) - http://scanner2.malware-scan.com/setup/webinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O20 - Winlogon Notify: fccyvus - fccyvus.dll (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: rqrppmn - rqrppmn.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Netscape Update Service (NCUpdateSvc) - Netscape Communications Corporation - C:\Program Files\Netscape Internet Service\ncupdatesvc.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
Post #2
[external image: Posted Image]


Stay with this topic until I give you the all clean post.

You might want to print these instructions out.

I suggest you do this:

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Clear "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Clear "Hide protected operating system files."
Click Apply, and then click OK.


Please do not delete anything unless instructed to.


Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.

Next:

Please download Malwarebytes' Anti-Malware to your desktop.

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected .
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
  • Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.
Also "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.
Post #3 last edited
thanks for your help in advance. Tim

I followed your instructions:
My Computer - done
ATF download and ran - done
Anti-Malware download and ran copied results below - done
HiJackthis - downloaded and ran copied results below - done

Started computer normally and still end up with the popup window that has C system 32. I can start in safe mode only.

Malwarebytes' Anti-Malware 1.25
Database version: 1062
Windows 5.1.2600 Service Pack 2

1:37:40 PM 8/21/2008
mbam-log-08-21-2008 (13-37-40).txt

Scan type: Quick Scan
Objects scanned: 41194
Time elapsed: 8 minute(s), 18 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 29
Registry Values Infected: 2
Registry Data Items Infected: 0
Folders Infected: 1
Files Infected: 21

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{466b1d31-2912-4c04-bcbd-a5dae6808fd8} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{466b1d31-2912-4c04-bcbd-a5dae6808fd8} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{79ae735f-9663-4b92-9602-39eb563fa30c} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\fccyvus (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{79ae735f-9663-4b92-9602-39eb563fa30c} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\malwarealarm.webinstall (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\c:/windows/downloaded program files/conflict.1/webinst.dll (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{7543fbd5-2279-4d03-8f29-eb21531fa2fe} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{1a26f07f-0d60-4835-91cf-1e1766a0ec56} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{1a26f07f-0d60-4835-91cf-1e1766a0ec56} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\malwarealarm.webinstall.1 (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\spyshredder.webinstall (Rogue.Installer) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\spyshredder.webinstall.1 (Rogue.Installer) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{85e06077-c824-43d0-a8dc-5efb17bc348a} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{fca3958a-8d38-4d14-8b81-ccd7f68a8a01} (Rogue.VirusHeat) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\CLSID\{182b90a3-f372-438a-800c-6814b4de417b} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{f0d4f88e-e1f8-460f-a41c-6cfb7f73af79} (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{9afb8248-617f-460d-9366-d71cdeda3179} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{4a3d609a-43b8-4406-b793-84f244246325} (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{daed9266-8c28-4c1c-8b58-5c66eff1d302} (Search.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{90b5a95a-afd5-4d11-b9bd-a69d53d22226} (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8109fd3d-d891-4f80-8339-50a4913ace6f} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\webinst.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IProxyProvider (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINDOWS\Downloaded Program Files\CONFLICT.1\webinst.dll (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\user32.dll (Trojan.Zlob) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Program Files\VirusHeat 4.3 (Rogue.VirusHeat) -> Quarantined and deleted successfully.

Files Infected:
C:\WINDOWS\system32\fhnvsw.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\fccyvus.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\jscaasjc.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\cjsaacsj.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\Downloaded Program Files\CONFLICT.1\webinst.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\aeqjiijl.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\btnvqgge.dll_old (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\duwguxim.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\frgqaz.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\gymwqgmp.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\irltogbp.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\msmuobdk.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\nfiagl.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ohjeyhlq.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\Program Files\VirusHeat 4.3\ignored.lst (Rogue.VirusHeat) -> Quarantined and deleted successfully.
C:\Program Files\VirusHeat 4.3\VirusHeat 4.3.exe (Rogue.VirusHeat) -> Quarantined and deleted successfully.
C:\Program Files\VirusHeat 4.3\vpp.ini (Rogue.VirusHeat) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mcrh.tmp (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ddayy.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\BMd7fa611f.xml (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\BMd7fa611f.txt (Trojan.Vundo) -> Quarantined and deleted successfully.


Logfile of HijackThis v1.99.1
Scan saved at 7:07:43 PM, on 8/20/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\HijackThis!\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {2D304198-89AC-4B3A-906C-E08C43C10617} - C:\WINDOWS\system32\ssqpo.dll (file missing)
O2 - BHO: PBlockHelper Class - {4115122B-85FF-4DD3-9515-F075BEDE5EB5} - C:\PROGRA~1\NETSCA~1\NETSCA~1\pbhelper.dll
O2 - BHO: {8df8086e-ad5a-dbcb-40c4-219213d1b664} - {466b1d31-2912-4c04-bcbd-a5dae6808fd8} - C:\WINDOWS\system32\fhnvsw.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {79AE735F-9663-4B92-9602-39EB563FA30C} - C:\WINDOWS\system32\fccyvus.dll (file missing)
O2 - BHO: (no name) - {A3CA8F2C-0BA6-4430-A17A-137669ABB4FB} - C:\WINDOWS\system32\ddcya.dll (file missing)
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {A9C7EF9C-3C46-4C2E-98CE-F47630BCC4Ee} - C:\WINDOWS\system32\auhyksjm.dll (file missing)
O2 - BHO: (no name) - {AE9F64F6-C1B8-47A2-A3B9-1132F2B4B2F5} - C:\WINDOWS\system32\geedb.dll (file missing)
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [d4c95283] rundll32.exe "C:\WINDOWS\system32\jscaasjc.dll",b
O4 - HKLM\..\RunOnce: [SpybotDeletingC4834] cmd /c del "C:\WINDOWS\system32\nonrboct.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA4325] command /c del "C:\WINDOWS\system32\onspomcn.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC1142] cmd /c del "C:\WINDOWS\system32\onspomcn.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA3394] command /c del "C:\WINDOWS\system32\pjdycipv.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC6818] cmd /c del "C:\WINDOWS\system32\pjdycipv.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA2093] command /c del "C:\WINDOWS\system32\qrvxodwk.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC384] cmd /c del "C:\WINDOWS\system32\qrvxodwk.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA5752] command /c del "C:\WINDOWS\system32\umcdabqe.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC3588] cmd /c del "C:\WINDOWS\system32\umcdabqe.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA417] command /c del "C:\WINDOWS\system32\wceixkpg.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC8548] cmd /c del "C:\WINDOWS\system32\wceixkpg.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA7795] command /c del "C:\WINDOWS\system32\auhyksjm.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC3966] cmd /c del "C:\WINDOWS\system32\auhyksjm.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA9407] command /c del "C:\WINDOWS\system32\bdrxuxnh.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC441] cmd /c del "C:\WINDOWS\system32\bdrxuxnh.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA6032] command /c del "C:\WINDOWS\system32\bfyitoqr.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC9236] cmd /c del "C:\WINDOWS\system32\bfyitoqr.dll_old"
O4 - HKLM\..\RunOnce: [Spybot - Search & Destroy] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKLM\..\RunOnce: [SpybotDeletingA4412] command /c del "C:\WINDOWS\system32\bgtcowcj.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC3626] cmd /c del "C:\WINDOWS\system32\bgtcowcj.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA1278] command /c del "C:\WINDOWS\system32\byltxwds.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC7985] cmd /c del "C:\WINDOWS\system32\byltxwds.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA2133] command /c del "C:\WINDOWS\system32\crbjlqjw.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC264] cmd /c del "C:\WINDOWS\system32\crbjlqjw.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA4522] command /c del "C:\WINDOWS\system32\daedgwug.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC4638] cmd /c del "C:\WINDOWS\system32\daedgwug.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA651] command /c del "C:\WINDOWS\system32\bgtcowcj.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC832] cmd /c del "C:\WINDOWS\system32\bgtcowcj.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA3781] command /c del "C:\WINDOWS\system32\byltxwds.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC380] cmd /c del "C:\WINDOWS\system32\byltxwds.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA2463] command /c del "C:\WINDOWS\system32\crbjlqjw.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC8226] cmd /c del "C:\WINDOWS\system32\crbjlqjw.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA8641] command /c del "C:\WINDOWS\system32\daedgwug.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC9990] cmd /c del "C:\WINDOWS\system32\daedgwug.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA1116] command /c del "C:\WINDOWS\system32\ektvbkvw.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC1881] cmd /c del "C:\WINDOWS\system32\ektvbkvw.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA1411] command /c del "C:\WINDOWS\system32\hjonboqe.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC8900] cmd /c del "C:\WINDOWS\system32\hjonboqe.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA1652] command /c del "C:\WINDOWS\system32\ibrguwwy.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5718] cmd /c del "C:\WINDOWS\system32\ibrguwwy.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA5730] command /c del "C:\WINDOWS\system32\kiqisawk.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC7017] cmd /c del "C:\WINDOWS\system32\kiqisawk.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA7210] command /c del "C:\WINDOWS\system32\knnbfapx.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC1895] cmd /c del "C:\WINDOWS\system32\knnbfapx.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA3038] command /c del "C:\WINDOWS\system32\kyojtumj.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC1839] cmd /c del "C:\WINDOWS\system32\kyojtumj.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA8150] command /c del "C:\WINDOWS\system32\mobwkccg.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC887] cmd /c del "C:\WINDOWS\system32\mobwkccg.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA3523] command /c del "C:\WINDOWS\system32\bgtcowcj.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC2448] cmd /c del "C:\WINDOWS\system32\bgtcowcj.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA6797] command /c del "C:\WINDOWS\system32\byltxwds.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC950] cmd /c del "C:\WINDOWS\system32\byltxwds.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA8514] command /c del "C:\WINDOWS\system32\crbjlqjw.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC7293] cmd /c del "C:\WINDOWS\system32\crbjlqjw.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA2615] command /c del "C:\WINDOWS\system32\daedgwug.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC3934] cmd /c del "C:\WINDOWS\system32\daedgwug.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA4130] command /c del "C:\WINDOWS\system32\ektvbkvw.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC2880] cmd /c del "C:\WINDOWS\system32\ektvbkvw.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA1441] command /c del "C:\WINDOWS\system32\hjonboqe.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC1382] cmd /c del "C:\WINDOWS\system32\hjonboqe.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA9938] command /c del "C:\WINDOWS\system32\ibrguwwy.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC2128] cmd /c del "C:\WINDOWS\system32\ibrguwwy.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA6245] command /c del "C:\WINDOWS\system32\kiqisawk.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC6458] cmd /c del "C:\WINDOWS\system32\kiqisawk.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA1037] command /c del "C:\WINDOWS\system32\knnbfapx.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC9826] cmd /c del "C:\WINDOWS\system32\knnbfapx.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA8296] command /c del "C:\WINDOWS\system32\kyojtumj.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC7881] cmd /c del "C:\WINDOWS\system32\kyojtumj.dll_old"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netWaiting.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [DellTransferAgent] "C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\RunOnce: [SpybotDeletingB3214] command /c del "C:\WINDOWS\system32\fccyvus.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD9551] cmd /c del "C:\WINDOWS\system32\fccyvus.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB3984] command /c del "C:\WINDOWS\system32\fccyvus.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD6585] cmd /c del "C:\WINDOWS\system32\fccyvus.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB4400] command /c del "C:\WINDOWS\system32\geedb.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD7137] cmd /c del "C:\WINDOWS\system32\geedb.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB7340] command /c del "C:\WINDOWS\system32\fccyvus.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD9967] cmd /c del "C:\WINDOWS\system32\fccyvus.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB5257] command /c del "C:\WINDOWS\system32\geedb.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD6778] cmd /c del "C:\WINDOWS\system32\geedb.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB7679] command /c del "C:\WINDOWS\system32\gtnnfdoe.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD3379] cmd /c del "C:\WINDOWS\system32\gtnnfdoe.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB6187] command /c del "C:\WINDOWS\system32\cglqhuwa.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD4461] cmd /c del "C:\WINDOWS\system32\cglqhuwa.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB3254] command /c del "C:\WINDOWS\system32\dasupmbk.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD5697] cmd /c del "C:\WINDOWS\system32\dasupmbk.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB1739] command /c del "C:\WINDOWS\system32\djuotvko.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD8746] cmd /c del "C:\WINDOWS\system32\djuotvko.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB553] command /c del "C:\WINDOWS\system32\dnxlikvn.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD7285] cmd /c del "C:\WINDOWS\system32\dnxlikvn.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB225] command /c del "C:\WINDOWS\system32\earsnlww.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD3689] cmd /c del "C:\WINDOWS\system32\earsnlww.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB208] command /c del "C:\WINDOWS\system32\flkshokp.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD6259] cmd /c del "C:\WINDOWS\system32\flkshokp.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB5737] command /c del "C:\WINDOWS\system32\gtfynauk.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD4277] cmd /c del "C:\WINDOWS\system32\gtfynauk.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB4410] command /c del "C:\WINDOWS\system32\hfxuhsya.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD8194] cmd /c del "C:\WINDOWS\system32\hfxuhsya.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB2860] command /c del "C:\WINDOWS\system32\itaodvcr.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD3622] cmd /c del "C:\WINDOWS\system32\itaodvcr.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB3859] command /c del "C:\WINDOWS\system32\iulewiis.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD1372] cmd /c del "C:\WINDOWS\system32\iulewiis.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB7711] command /c del "C:\WINDOWS\system32\ivqwgfya.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD3161] cmd /c del "C:\WINDOWS\system32\ivqwgfya.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB6441] command /c del "C:\WINDOWS\system32\mpjmyxur.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD4386] cmd /c del "C:\WINDOWS\system32\mpjmyxur.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB7234] command /c del "C:\WINDOWS\system32\nonrboct.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD94] cmd /c del "C:\WINDOWS\system32\nonrboct.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB9024] command /c del "C:\WINDOWS\system32\onspomcn.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD4887] cmd /c del "C:\WINDOWS\system32\onspomcn.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB4740] command /c del "C:\WINDOWS\system32\pjdycipv.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD9940] cmd /c del "C:\WINDOWS\system32\pjdycipv.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB9209] command /c del "C:\WINDOWS\system32\qrvxodwk.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD3157] cmd /c del "C:\WINDOWS\system32\qrvxodwk.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB359] command /c del "C:\WINDOWS\system32\umcdabqe.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD9810] cmd /c del "C:\WINDOWS\system32\umcdabqe.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB2660] command /c del "C:\WINDOWS\system32\wceixkpg.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD9715] cmd /c del "C:\WINDOWS\system32\wceixkpg.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB879] command /c del "C:\WINDOWS\system32\auhyksjm.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD1890] cmd /c del "C:\WINDOWS\system32\auhyksjm.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB5144] command /c del "C:\WINDOWS\system32\bdrxuxnh.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD3111] cmd /c del "C:\WINDOWS\system32\bdrxuxnh.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB8680] command /c del "C:\WINDOWS\system32\bfyitoqr.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD5422] cmd /c del "C:\WINDOWS\system32\bfyitoqr.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB6637] command /c del "C:\WINDOWS\system32\bgtcowcj.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD2024] cmd /c del "C:\WINDOWS\system32\bgtcowcj.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB2733] command /c del "C:\WINDOWS\system32\byltxwds.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD8459] cmd /c del "C:\WINDOWS\system32\byltxwds.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB5238] command /c del "C:\WINDOWS\system32\crbjlqjw.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD1659] cmd /c del "C:\WINDOWS\system32\crbjlqjw.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB8799] command /c del "C:\WINDOWS\system32\daedgwug.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD3826] cmd /c del "C:\WINDOWS\system32\daedgwug.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB7742] command /c del "C:\WINDOWS\system32\bgtcowcj.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD9734] cmd /c del "C:\WINDOWS\system32\bgtcowcj.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB3754] command /c del "C:\WINDOWS\system32\byltxwds.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD5688] cmd /c del "C:\WINDOWS\system32\byltxwds.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB5489] command /c del "C:\WINDOWS\system32\crbjlqjw.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD8466] cmd /c del "C:\WINDOWS\system32\crbjlqjw.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB481] command /c del "C:\WINDOWS\system32\daedgwug.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD7885] cmd /c del "C:\WINDOWS\system32\daedgwug.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB5796] command /c del "C:\WINDOWS\system32\ektvbkvw.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD4536] cmd /c del "C:\WINDOWS\system32\ektvbkvw.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB8211] command /c del "C:\WINDOWS\system32\hjonboqe.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD8032] cmd /c del "C:\WINDOWS\system32\hjonboqe.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB8496] command /c del "C:\WINDOWS\system32\ibrguwwy.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD8995] cmd /c del "C:\WINDOWS\system32\ibrguwwy.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB7724] command /c del "C:\WINDOWS\system32\kiqisawk.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD3642] cmd /c del "C:\WINDOWS\system32\kiqisawk.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB8407] command /c del "C:\WINDOWS\system32\knnbfapx.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD544] cmd /c del "C:\WINDOWS\system32\knnbfapx.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB7748] command /c del "C:\WINDOWS\system32\kyojtumj.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD7651] cmd /c del "C:\WINDOWS\system32\kyojtumj.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB3512] command /c del "C:\WINDOWS\system32\mobwkccg.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD2617] cmd /c del "C:\WINDOWS\system32\mobwkccg.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB5650] command /c del "C:\WINDOWS\system32\bgtcowcj.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD9752] cmd /c del "C:\WINDOWS\system32\bgtcowcj.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB9822] command /c del "C:\WINDOWS\system32\byltxwds.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD3683] cmd /c del "C:\WINDOWS\system32\byltxwds.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB470] command /c del "C:\WINDOWS\system32\crbjlqjw.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD7297] cmd /c del "C:\WINDOWS\system32\crbjlqjw.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB6568] command /c del "C:\WINDOWS\system32\daedgwug.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD9768] cmd /c del "C:\WINDOWS\system32\daedgwug.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB39] command /c del "C:\WINDOWS\system32\ektvbkvw.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD2952] cmd /c del "C:\WINDOWS\system32\ektvbkvw.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB8802] command /c del "C:\WINDOWS\system32\hjonboqe.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD2189] cmd /c del "C:\WINDOWS\system32\hjonboqe.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB4463] command /c del "C:\WINDOWS\system32\ibrguwwy.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD3392] cmd /c del "C:\WINDOWS\system32\ibrguwwy.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB1401] command /c del "C:\WINDOWS\system32\kiqisawk.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD8780] cmd /c del "C:\WINDOWS\system32\kiqisawk.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB7517] command /c del "C:\WINDOWS\system32\knnbfapx.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD4708] cmd /c del "C:\WINDOWS\system32\knnbfapx.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB7919] command /c del "C:\WINDOWS\system32\kyojtumj.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD7720] cmd /c del "C:\WINDOWS\system32\kyojtumj.dll_old"
O4 - Startup: LimeWire On Startup.lnk.disabled
O4 - Global Startup: Digital Line Detect.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1A26F07F-0D60-4835-91CF-1E1766A0EC56} (WebInstall Class) - http://scanner2.malware-scan.com/setup/webinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O20 - Winlogon Notify: fccyvus - fccyvus.dll (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: rqrppmn - rqrppmn.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Netscape Update Service (NCUpdateSvc) - Netscape Communications Corporation - C:\Program Files\Netscape Internet Service\ncupdatesvc.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
Post #4
Download ComboFix from Here or Here to your Desktop.
**Note: In the event you already have Combofix, please delete it from your desktop and download this new version . It is important that it is saved directly to your desktop**
——————————————————————–
  • Close any open browsers and make sure you are disconnected from the net. Unplug the cable if need be before running combofix.
  • WARNING: IF you have not already done so Combofix will disconnect your machine from the Internet when it starts
  • Please do not re-connect your machine back to the Internet until Combofix has completely finished.
——————————————————————–

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review

****Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze ****

*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.

Give it atleast 20-30 minutes to finish
Post #5
Downloaded and ran Combofix and ran Hijack. Here are both the files. The computer booted up normally with Combofix. Again thanks.
ComboFix 08-08-21.01 - DANIEL RYAN 2008-08-21 17:46:04.1 - NTFSx86 MINIMAL
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.790 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\DANIEL RYAN\Application Data\macromedia\Flash Player\#SharedObjects\HVPP8JT4\interclick.com
C:\Documents and Settings\DANIEL RYAN\Application Data\macromedia\Flash Player\#SharedObjects\HVPP8JT4\interclick.com\ud.sol
C:\Documents and Settings\DANIEL RYAN\Application Data\macromedia\Flash Player\#SharedObjects\HVPP8JT4\www.broadcaster.com
C:\Documents and Settings\DANIEL RYAN\Application Data\macromedia\Flash Player\#SharedObjects\HVPP8JT4\www.broadcaster.com\played_list.sol
C:\Documents and Settings\DANIEL RYAN\Application Data\macromedia\Flash Player\#SharedObjects\HVPP8JT4\www.broadcaster.com\video_queue.sol
C:\Documents and Settings\DANIEL RYAN\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com
C:\Documents and Settings\DANIEL RYAN\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol
C:\Documents and Settings\DANIEL RYAN\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com
C:\Documents and Settings\DANIEL RYAN\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol
C:\WINDOWS\Downloaded Program Files\setup.inf
C:\WINDOWS\system32\aycdd.ini
C:\WINDOWS\system32\aycdd.ini2
C:\WINDOWS\system32\bdeeg.ini
C:\WINDOWS\system32\bdeeg.ini2
C:\WINDOWS\system32\eodfnntg.ini
C:\WINDOWS\system32\mkxtosnc.ini
C:\WINDOWS\system32\ncmopsno.ini
C:\WINDOWS\system32\opqss.bak1
C:\WINDOWS\system32\opqss.bak2
C:\WINDOWS\system32\opqss.ini
C:\WINDOWS\system32\opqss.ini2
C:\WINDOWS\system32\opqss.tmp

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_DOMAINSERVICE


((((((((((((((((((((((((( Files Created from 2008-07-21 to 2008-08-21 )))))))))))))))))))))))))))))))
.

2008-08-21 13:28 . 2008-08-21 13:37 d——– C:\Program Files\Malwarebytes' Anti-Malware
2008-08-21 13:28 . 2008-08-21 13:28 d——– C:\Documents and Settings\DANIEL RYAN\Application Data\Malwarebytes
2008-08-21 13:28 . 2008-08-21 13:28 d——– C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-21 13:28 . 2008-08-17 15:01 38,472 –a—— C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-21 13:28 . 2008-08-17 15:01 17,144 –a—— C:\WINDOWS\system32\drivers\mbam.sys
2008-08-20 19:56 . 2008-08-20 19:56 d——– C:\_OTMoveIt
2008-08-20 19:05 . 2008-08-21 14:49 d——– C:\Program Files\HijackThis!
2008-08-20 17:09 . 2008-08-20 17:09 d——– C:\Program Files\Safer Networking
2008-08-20 17:07 . 2008-08-20 17:08 d——– C:\Program Files\Spybot - Search & Destroy
2008-08-19 00:17 . 2008-08-20 16:51 d——– C:\Program Files\Spybutt - Search & Destroy

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-21 01:21 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2008-08-21 01:18 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-08-20 23:54 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-01-04 01:31 104 –sha-r C:\WINDOWS\system32\5A0F8EC7B8.sys
2007-03-11 00:23 88 –sh–r C:\WINDOWS\system32\C4D4C6BAAC.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 05:00 15360]
"DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 11:09 460784]
"DellTransferAgent"="C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe" [2007-11-13 16:46 135168]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 11:24 1694208]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 09:42 2156368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-12-13 16:44 98304]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-12-13 16:41 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-12-13 16:45 118784]
"Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY.exe" [2005-12-19 08:08 1347584]
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2006-04-06 14:58 1032192]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-12-09 20:29 49152]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-12-06 01:05 127035]
"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 10:44 249856]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 10:44 81920]
"MCAgentExe"="c:\PROGRA~1\mcafee.com\agent\mcagent.exe" [2005-09-22 18:29 303104]
"MCUpdateExe"="c:\PROGRA~1\mcafee.com\agent\mcupdate.exe" [2006-01-11 12:05 212992]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe" [2005-04-13 03:48 36975]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-09-29 14:01 67584]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2005-09-17 10:27 52848]
"MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2005-09-26 19:34 169984]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"SpybotDeletingC3588"="del" [X]
"SpybotDeletingA417"="command" [X]
"SpybotDeletingC8548"="del" [X]
"SpybotDeletingA7795"="command" [X]
"SpybotDeletingC3966"="del" [X]
"SpybotDeletingA9407"="command" [X]
"SpybotDeletingC441"="del" [X]
"SpybotDeletingA6032"="command" [X]
"SpybotDeletingC9236"="del" [X]
"SpybotDeletingA4412"="command" [X]
"SpybotDeletingC7985"="del" [X]
"SpybotDeletingA2133"="command" [X]
"SpybotDeletingC264"="del" [X]
"SpybotDeletingA4522"="command" [X]
"SpybotDeletingC4638"="del" [X]
"SpybotDeletingA651"="command" [X]
"SpybotDeletingC832"="del" [X]
"SpybotDeletingA3781"="command" [X]
"SpybotDeletingC380"="del" [X]
"SpybotDeletingA2463"="command" [X]
"SpybotDeletingC8226"="del" [X]
"SpybotDeletingA8641"="command" [X]
"SpybotDeletingC9990"="del" [X]
"SpybotDeletingA1116"="command" [X]
"SpybotDeletingC1881"="del" [X]
"SpybotDeletingA1411"="command" [X]
"SpybotDeletingC8900"="del" [X]
"SpybotDeletingA1652"="command" [X]
"SpybotDeletingC5718"="del" [X]
"SpybotDeletingA5730"="command" [X]
"SpybotDeletingC7017"="del" [X]
"SpybotDeletingA7210"="command" [X]
"SpybotDeletingC1895"="del" [X]
"SpybotDeletingA3038"="command" [X]
"SpybotDeletingC1839"="del" [X]
"SpybotDeletingA8150"="command" [X]
"SpybotDeletingC887"="del" [X]
"SpybotDeletingA3523"="command" [X]
"SpybotDeletingC2448"="del" [X]
"SpybotDeletingA6797"="command" [X]
"SpybotDeletingC950"="del" [X]
"SpybotDeletingA8514"="command" [X]
"SpybotDeletingC7293"="del" [X]
"SpybotDeletingA2615"="command" [X]
"SpybotDeletingC3934"="del" [X]
"SpybotDeletingA4130"="command" [X]
"SpybotDeletingC2880"="del" [X]
"SpybotDeletingA1441"="command" [X]
"SpybotDeletingC1382"="del" [X]
"SpybotDeletingA9938"="command" [X]
"SpybotDeletingC2128"="del" [X]
"GrpConv"="grpconv -o" [X]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=C:\WINDOWS\pss\Digital Line Detect.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^DANIEL RYAN^Start Menu^Programs^Startup^LimeWire On Startup.lnk.disabled]
path=C:\Documents and Settings\DANIEL RYAN\Start Menu\Programs\Startup\LimeWire On Startup.lnk.disabled
backup=C:\WINDOWS\pss\LimeWire On Startup.lnk.disabledStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ModemOnHold]
——— 2003-09-10 02:24 20480 C:\Program Files\NetWaiting\netwaiting.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"IDriverT"=3 (0x3)
"DSBrokerService"=3 (0x3)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe"
"MSKDetectorExe"=C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\StubInstaller.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=

R2 NwSapAgent;SAP Agent;C:\WINDOWS\system32\svchost.exe [2004-08-10 05:00]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}]
\Shell\AutoRun\command - E:\setup.exe
.
Contents of the 'Scheduled Tasks' folder

2008-03-03 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - DANIEL RYAN.job
- C:\PROGRA~1\NORTON~1\Navw32.exe [2005-09-24 04:37]

2008-08-19 C:\WINDOWS\Tasks\Symantec NetDetect.job
- C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE [2005-09-09 15:21]
.
- - - - ORPHANS REMOVED - - - -

BHO-{2D304198-89AC-4B3A-906C-E08C43C10617} - C:\WINDOWS\system32\ssqpo.dll
BHO-{A3CA8F2C-0BA6-4430-A17A-137669ABB4FB} - C:\WINDOWS\system32\ddcya.dll
BHO-{A9C7EF9C-3C46-4C2E-98CE-F47630BCC4Ee} - C:\WINDOWS\system32\auhyksjm.dll
BHO-{AE9F64F6-C1B8-47A2-A3B9-1132F2B4B2F5} - C:\WINDOWS\system32\geedb.dll
SharedTaskScheduler-{f0d4f88e-e1f8-460f-a41c-6cfb7f73af79} - (no file)
Notify-rqrppmn - rqrppmn.dll


.
——- Supplementary Scan ——-
.
FireFox -: Profile - C:\Documents and Settings\DANIEL RYAN\Application Data\Mozilla\Firefox\Profiles\9q8e3kkh.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie;=UTF-8&oe;=UTF-8&q;=
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://en-us.start.mozilla.com/firefox?client=firefox-a&rls;=org.mozilla:en-US:official
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-21 17:52:07
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\WLTRYSVC.EXE
C:\WINDOWS\system32\BCMWLTRY.EXE
C:\WINDOWS\ehome\ehrecvr.exe
C:\WINDOWS\ehome\ehSched.exe
C:\Program Files\McAfee.com\Agent\Mcdetect.exe
C:\PROGRA~1\McAfee.com\Agent\McTskshd.exe
C:\WINDOWS\system32\ntvdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Netscape Internet Service\ncupdatesvc.exe
C:\Program Files\Dell\QuickSet\NicConfigSvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\WINDOWS\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2008-08-21 17:55:06 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-21 22:55:02

Pre-Run: 20,797,083,648 bytes free
Post-Run: 20,350,013,440 bytes free

235 — E O F — 2008-04-08 08:03:34




Logfile of HijackThis v1.99.1
Scan saved at 6:01:36 PM, on 8/21/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Netscape Internet Service\ncupdatesvc.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HijackThis!\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: PBlockHelper Class - {4115122B-85FF-4DD3-9515-F075BEDE5EB5} - C:\PROGRA~1\NETSCA~1\NETSCA~1\pbhelper.dll
O2 - BHO: Spybot-S&D; IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\RunOnce: [SpybotDeletingC3588] cmd /c del "C:\WINDOWS\system32\umcdabqe.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA417] command /c del "C:\WINDOWS\system32\wceixkpg.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC8548] cmd /c del "C:\WINDOWS\system32\wceixkpg.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA7795] command /c del "C:\WINDOWS\system32\auhyksjm.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC3966] cmd /c del "C:\WINDOWS\system32\auhyksjm.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA9407] command /c del "C:\WINDOWS\system32\bdrxuxnh.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC441] cmd /c del "C:\WINDOWS\system32\bdrxuxnh.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA6032] command /c del "C:\WINDOWS\system32\bfyitoqr.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC9236] cmd /c del "C:\WINDOWS\system32\bfyitoqr.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA4412] command /c del "C:\WINDOWS\system32\bgtcowcj.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC7985] cmd /c del "C:\WINDOWS\system32\byltxwds.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA2133] command /c del "C:\WINDOWS\system32\crbjlqjw.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC264] cmd /c del "C:\WINDOWS\system32\crbjlqjw.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA4522] command /c del "C:\WINDOWS\system32\daedgwug.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC4638] cmd /c del "C:\WINDOWS\system32\daedgwug.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA651] command /c del "C:\WINDOWS\system32\bgtcowcj.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC832] cmd /c del "C:\WINDOWS\system32\bgtcowcj.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA3781] command /c del "C:\WINDOWS\system32\byltxwds.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC380] cmd /c del "C:\WINDOWS\system32\byltxwds.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA2463] command /c del "C:\WINDOWS\system32\crbjlqjw.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC8226] cmd /c del "C:\WINDOWS\system32\crbjlqjw.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA8641] command /c del "C:\WINDOWS\system32\daedgwug.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC9990] cmd /c del "C:\WINDOWS\system32\daedgwug.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA1116] command /c del "C:\WINDOWS\system32\ektvbkvw.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC1881] cmd /c del "C:\WINDOWS\system32\ektvbkvw.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA1411] command /c del "C:\WINDOWS\system32\hjonboqe.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC8900] cmd /c del "C:\WINDOWS\system32\hjonboqe.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA1652] command /c del "C:\WINDOWS\system32\ibrguwwy.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5718] cmd /c del "C:\WINDOWS\system32\ibrguwwy.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA5730] command /c del "C:\WINDOWS\system32\kiqisawk.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC7017] cmd /c del "C:\WINDOWS\system32\kiqisawk.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA7210] command /c del "C:\WINDOWS\system32\knnbfapx.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC1895] cmd /c del "C:\WINDOWS\system32\knnbfapx.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA3038] command /c del "C:\WINDOWS\system32\kyojtumj.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC1839] cmd /c del "C:\WINDOWS\system32\kyojtumj.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA8150] command /c del "C:\WINDOWS\system32\mobwkccg.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC887] cmd /c del "C:\WINDOWS\system32\mobwkccg.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA3523] command /c del "C:\WINDOWS\system32\bgtcowcj.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC2448] cmd /c del "C:\WINDOWS\system32\bgtcowcj.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA6797] command /c del "C:\WINDOWS\system32\byltxwds.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC950] cmd /c del "C:\WINDOWS\system32\byltxwds.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA8514] command /c del "C:\WINDOWS\system32\crbjlqjw.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC7293] cmd /c del "C:\WINDOWS\system32\crbjlqjw.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA2615] command /c del "C:\WINDOWS\system32\daedgwug.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC3934] cmd /c del "C:\WINDOWS\system32\daedgwug.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA4130] command /c del "C:\WINDOWS\system32\ektvbkvw.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC2880] cmd /c del "C:\WINDOWS\system32\ektvbkvw.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA1441] command /c del "C:\WINDOWS\system32\hjonboqe.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC1382] cmd /c del "C:\WINDOWS\system32\hjonboqe.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA9938] command /c del "C:\WINDOWS\system32\ibrguwwy.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC2128] cmd /c del "C:\WINDOWS\system32\ibrguwwy.dll_old"
O4 - HKLM\..\RunOnce: [GrpConv] grpconv -o
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [DellTransferAgent] "C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Netscape Update Service (NCUpdateSvc) - Netscape Communications Corporation - C:\Program Files\Netscape Internet Service\ncupdatesvc.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
Post #6
Is limewire the only one you disabled with msconfig?

You need To disable TeaTimer, it can stop our fix.

The best way is to do both, Right click the system tray icon and shut down. This will reset TT's registry snapshot. Then, open spybot in advanced mode and turn it off. When cleaning is done, open Spybot in advanced mode to turn back on.

Once fix is completed in the all clear post!!


Open notepad and copy/paste the text in the Codebox below into it:

File::
C:\WINDOWS\system32\umcdabqe.dll_old
C:\WINDOWS\system32\wceixkpg.dll_old
C:\WINDOWS\system32\wceixkpg.dll_old
C:\WINDOWS\system32\auhyksjm.dll_old
C:\WINDOWS\system32\auhyksjm.dll_old
C:\WINDOWS\system32\bdrxuxnh.dll_old
C:\WINDOWS\system32\bdrxuxnh.dll_old
C:\WINDOWS\system32\bfyitoqr.dll_old
C:\WINDOWS\system32\bfyitoqr.dll_old
C:\WINDOWS\system32\bgtcowcj.dll_old
C:\WINDOWS\system32\byltxwds.dll_old
C:\WINDOWS\system32\crbjlqjw.dll_old
C:\WINDOWS\system32\crbjlqjw.dll_old
C:\WINDOWS\system32\daedgwug.dll_old
C:\WINDOWS\system32\daedgwug.dll_old
C:\WINDOWS\system32\bgtcowcj.dll_old
C:\WINDOWS\system32\bgtcowcj.dll_old
C:\WINDOWS\system32\byltxwds.dll_old
C:\WINDOWS\system32\byltxwds.dll_old
C:\WINDOWS\system32\crbjlqjw.dll_old
C:\WINDOWS\system32\crbjlqjw.dll_old
C:\WINDOWS\system32\daedgwug.dll_old
C:\WINDOWS\system32\daedgwug.dll_old
C:\WINDOWS\system32\ektvbkvw.dll_old
C:\WINDOWS\system32\ektvbkvw.dll_old
C:\WINDOWS\system32\hjonboqe.dll_old
C:\WINDOWS\system32\hjonboqe.dll_old
C:\WINDOWS\system32\ibrguwwy.dll_old
C:\WINDOWS\system32\ibrguwwy.dll_old
C:\WINDOWS\system32\kiqisawk.dll_old
C:\WINDOWS\system32\kiqisawk.dll_old
C:\WINDOWS\system32\knnbfapx.dll_old
C:\WINDOWS\system32\knnbfapx.dll_old
C:\WINDOWS\system32\kyojtumj.dll_old
C:\WINDOWS\system32\kyojtumj.dll_old
C:\WINDOWS\system32\mobwkccg.dll_old
C:\WINDOWS\system32\mobwkccg.dll_old
C:\WINDOWS\system32\bgtcowcj.dll_old
C:\WINDOWS\system32\bgtcowcj.dll_old
C:\WINDOWS\system32\byltxwds.dll_old
C:\WINDOWS\system32\byltxwds.dll_old
C:\WINDOWS\system32\crbjlqjw.dll_old
C:\WINDOWS\system32\crbjlqjw.dll_old
C:\WINDOWS\system32\daedgwug.dll_old
C:\WINDOWS\system32\daedgwug.dll_old
C:\WINDOWS\system32\ektvbkvw.dll_old
C:\WINDOWS\system32\ektvbkvw.dll_old
C:\WINDOWS\system32\hjonboqe.dll_old
C:\WINDOWS\system32\hjonboqe.dll_old
C:\WINDOWS\system32\ibrguwwy.dll_old
C:\WINDOWS\system32\ibrguwwy.dll_old

Save this as Save this as "CFScript"


[external image: Posted Image]

Drag CFScript.txt into ComboFix.exe

Then post the results log and a new HijackThis log.


Also please describe how your computer behaves at the moment.
Post #7
When i ran all the programs i did this in safe mode which did not load teatimer. I ran combofix and it shut down the unit and it started up ok. I did a reboot and when it started it was back to its old tricks so i shut down and now have started again in safe mode.
Post #9
I ran combofix and that was the log that i posted. I've restarted in safe mode and i'm running combofix again. it just shut down the computer and is restarting. Not sure what CFScript is? Combofix has a window up that says it is preparing log report and a second window with C:\Windows\system32\command.com is open with a blinking cursor. This happened the first time i ran Combofix.
Post #10
This is the one I need to know about.

Is limewire the only one you disabled with msconfig?

You need To disable TeaTimer, it can stop our fix.

The best way is to do both, Right click the system tray icon and shut down. This will reset TT's registry snapshot. Then, open spybot in advanced mode and turn it off. When cleaning is done, open Spybot in advanced mode to turn back on.

Once fix is completed in the all clear post!!


Open notepad and copy/paste the text in the Codebox below into it:

File::
C:\WINDOWS\system32\umcdabqe.dll_old
C:\WINDOWS\system32\wceixkpg.dll_old
C:\WINDOWS\system32\wceixkpg.dll_old
C:\WINDOWS\system32\auhyksjm.dll_old
C:\WINDOWS\system32\auhyksjm.dll_old
C:\WINDOWS\system32\bdrxuxnh.dll_old
C:\WINDOWS\system32\bdrxuxnh.dll_old
C:\WINDOWS\system32\bfyitoqr.dll_old
C:\WINDOWS\system32\bfyitoqr.dll_old
C:\WINDOWS\system32\bgtcowcj.dll_old
C:\WINDOWS\system32\byltxwds.dll_old
C:\WINDOWS\system32\crbjlqjw.dll_old
C:\WINDOWS\system32\crbjlqjw.dll_old
C:\WINDOWS\system32\daedgwug.dll_old
C:\WINDOWS\system32\daedgwug.dll_old
C:\WINDOWS\system32\bgtcowcj.dll_old
C:\WINDOWS\system32\bgtcowcj.dll_old
C:\WINDOWS\system32\byltxwds.dll_old
C:\WINDOWS\system32\byltxwds.dll_old
C:\WINDOWS\system32\crbjlqjw.dll_old
C:\WINDOWS\system32\crbjlqjw.dll_old
C:\WINDOWS\system32\daedgwug.dll_old
C:\WINDOWS\system32\daedgwug.dll_old
C:\WINDOWS\system32\ektvbkvw.dll_old
C:\WINDOWS\system32\ektvbkvw.dll_old
C:\WINDOWS\system32\hjonboqe.dll_old
C:\WINDOWS\system32\hjonboqe.dll_old
C:\WINDOWS\system32\ibrguwwy.dll_old
C:\WINDOWS\system32\ibrguwwy.dll_old
C:\WINDOWS\system32\kiqisawk.dll_old
C:\WINDOWS\system32\kiqisawk.dll_old
C:\WINDOWS\system32\knnbfapx.dll_old
C:\WINDOWS\system32\knnbfapx.dll_old
C:\WINDOWS\system32\kyojtumj.dll_old
C:\WINDOWS\system32\kyojtumj.dll_old
C:\WINDOWS\system32\mobwkccg.dll_old
C:\WINDOWS\system32\mobwkccg.dll_old
C:\WINDOWS\system32\bgtcowcj.dll_old
C:\WINDOWS\system32\bgtcowcj.dll_old
C:\WINDOWS\system32\byltxwds.dll_old
C:\WINDOWS\system32\byltxwds.dll_old
C:\WINDOWS\system32\crbjlqjw.dll_old
C:\WINDOWS\system32\crbjlqjw.dll_old
C:\WINDOWS\system32\daedgwug.dll_old
C:\WINDOWS\system32\daedgwug.dll_old
C:\WINDOWS\system32\ektvbkvw.dll_old
C:\WINDOWS\system32\ektvbkvw.dll_old
C:\WINDOWS\system32\hjonboqe.dll_old
C:\WINDOWS\system32\hjonboqe.dll_old
C:\WINDOWS\system32\ibrguwwy.dll_old
C:\WINDOWS\system32\ibrguwwy.dll_old

Save this as Save this as "CFScript"


[external image: Posted Image]

Drag CFScript.txt into ComboFix.exe

Then post the results log and a new HijackThis log.


Also please describe how your computer behaves at the moment.

Post #11
I'm on another computer and have the laptop next to me. I can't access the internet with the infected unit. I can save the file on a stick and put that into the computer but how do i load this into combofix?
Post #13
k i'm working on this. I'm at my office and I may have to head to the house. I have an internet connection and i'm on the website trying to get into the forums. The connection here is very slow. Bare with me.
Post #15
This connection is too slow. I'll head to the house and connect there. Take me about 20 min. If you are online - cool. If not, i'll get online and follow your instructions above and i'll let you know with a post. Thanks.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI