Spyware / Malware / Virus Removal

[Closed] VirusResponse Lab 2009

7 min read

Looking for the outcome? Ask AI

ubie Topic Starter

Post #1October 15, 2008, 4:42 PM UTC

Hi all.

I've got a bit of a problem and could use some expert advice-instructions concerning a nagging pop-up ("system Alert.")

It's called VirusResponse Lab 2009 and it rests in the task area-periodically poping up with "virus warnings."

If I click on it (left or right) it automatically leads me to the website.

I've gone through the control panel and even deleted it's folder but it's still present.

Below is my HJT print out-please help (this thing is driving me nuts!)

Cheers,

ubie

————————-

Logfile of HijackThis v1.99.1
Scan saved at 11:38:46 AM, on 10/15/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\system32\svchost.exe
F:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
F:\Program Files\Alwil Software\Avast4\ashServ.exe
F:\WINDOWS\system32\spoolsv.exe
F:\Program Files\a-squared Free\a2service.exe
F:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
F:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
F:\WINDOWS\system32\CTsvcCDA.exe
F:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
F:\Program Files\Ontrack\Internet Cleanup\icserv.exe
F:\Program Files\Java\jre6\bin\jqs.exe
F:\Program Files\Kodak\printer\center\KodakSvc.exe
F:\Program Files\Microsoft LifeCam\MSCamS32.exe
F:\WINDOWS\system32\nvsvc32.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\system32\MsPMSPSv.exe
F:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
F:\Program Files\Alwil Software\Avast4\ashWebSv.exe
F:\WINDOWS\Explorer.EXE
F:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
F:\Program Files\Microsoft IntelliPoint\ipoint.exe
F:\WINDOWS\system32\RUNDLL32.EXE
F:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
F:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe
F:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
F:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
F:\Program Files\Java\jre6\bin\jusched.exe
F:\WINDOWS\system32\ctfmon.exe
F:\Documents and Settings\jesse\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
F:\PROGRA~1\MSNMES~1\msnmsgr.exe
F:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
F:\Program Files\MSN Messenger\usnsvc.exe
F:\Program Files\Windows Media Player\wmplayer.exe
F:\Program Files\Internet Explorer\iexplore.exe
F:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
F:\Program Files\Internet Explorer\IEXPLORE.EXE
F:\Documents and Settings\jesse\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ycomp/def…/search/ie.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.mchsd.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - F:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - F:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - F:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: dsWebAllowBHO Class - {2F85D76C-0569-466F-A488-493E6BD0E955} - F:\Program Files\Windows Desktop Search\dsWebAllow.dll
O2 - BHO: ALOT Toolbar - {5AA2BA46-9913-4dc7-9620-69AB0FA17AE7} - F:\Program Files\alot\bin\alot.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - F:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - f:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - F:\Program Files\Google\GoogleToolbarNotifier\4.1.805.1852\swg.dll
O2 - BHO: (no name) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O2 - BHO: (no name) - {BE1A344F-9FF5-4024-949B-52205E6DB2D0} - F:\Program Files\Applications\iebt.dll (file missing)
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - F:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - F:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - F:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - F:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: ALOT Toolbar - {5AA2BA46-9913-4dc7-9620-69AB0FA17AE7} - F:\Program Files\alot\bin\alot.dll (file missing)
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - F:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - F:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - f:\program files\google\googletoolbar1.dll
O3 - Toolbar: Internet Service - {144A6B24-0EBC-4D89-BF09-A06A718E57B5} - F:\Program Files\Applications\iebr.dll (file missing)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE F:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [CTSysVol] F:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL
O4 - HKLM\..\Run: [SBDrvDet] F:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r
O4 - HKLM\..\Run: [UpdReg] F:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [LifeCam] "F:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [IntelliPoint] "F:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE F:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [Microsoft Works Update Detection] F:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [EKIJ5000StatusMonitor] F:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe
O4 - HKLM\..\Run: [ArcSoft Connection Service] F:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKLM\..\Run: [avast!] F:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [UnlockerAssistant] "F:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "F:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [googletalk] F:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKLM\..\Run: [Google Desktop Search] "F:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "F:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "F:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SpybotSnD] "F:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck /autofix
O4 - HKLM\..\Run: [SunJavaUpdateSched] "F:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] F:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BitTorrent] "F:\Program Files\BitTorrent\bittorrent.exe"
O4 - HKCU\..\Run: [Google Update] "F:\Documents and Settings\jesse\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [msnmsgr] "F:\PROGRA~1\MSNMES~1\msnmsgr.exe" /background
O4 - HKCU\..\Run: [VirRL2009] "F:\Program Files\VirRL2009\VirRL2009.exe"
O4 - HKCU\..\Run: [ANTIVIRUS] F:\Program Files\AAV\aav.exe
O4 - Global Startup: Kodak EasyShare software.lnk = F:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: PHOTOfunSTUDIO -viewer-.lnk = F:\Program Files\Panasonic\PHOTOfunSTUDIO -viewer-\PhAutoRun.exe
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) -
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} -
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
O16 - DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} (Java Plug-in 1.6.0) -
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} (Java Plug-in 1.6.0_03) -
O16 - DPF: {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} (Java Plug-in 1.6.0_04) -
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} (Java Plug-in 1.6.0_05) -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - F:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - F:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - F:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O20 - Winlogon Notify: WgaLogon - F:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - F:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - F:\Program Files\a-squared Free\a2service.exe
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - F:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - F:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - F:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - F:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - F:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - F:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - F:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Google Updater Service (gusvc) - Google - F:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: icservice - ONTRACK Data International, Inc. - F:\Program Files\Ontrack\Internet Cleanup\icserv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - F:\Program Files\Java\jre6\bin\jqs.exe" -service -config "F:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf (file missing)
O23 - Service: Kodak AiO Device Service (KodakSvc) - Eastman Kodak Company - F:\Program Files\Kodak\printer\center\KodakSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - F:\WINDOWS\system32\nvsvc32.exe

Tomk

Post #2October 15, 2008, 8:09 PM UTC

Hi ubie,

My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for the issues on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.

Then

Please download Malwarebytes' Anti-Malware to your desktop.

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot (shut down your computer then restart it).

Also "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.

ubie

Post #3October 16, 2008, 4:42 PM UTC

Hi Tomk,

I appreciate you taking the time to help me with my problem.

I'm not all that computer savvy so please bear with me as we try to fix this problem.

Also, if you spot any other undesirable things/potential problems, etc. on my computer, please feel free to address those issues too-my brother is sharing my computer at the moment and he's about as savvy as me so …………………….

At any rate, I followed your instructions; the info follows.

Thanks,

ubie

————–

Logfile of HijackThis v1.99.1
Scan saved at 11:31:12 AM, on 10/16/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\system32\svchost.exe
F:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
F:\Program Files\Alwil Software\Avast4\ashServ.exe
F:\WINDOWS\system32\spoolsv.exe
F:\WINDOWS\Explorer.EXE
F:\Program Files\a-squared Free\a2service.exe
F:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
F:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
F:\WINDOWS\system32\CTsvcCDA.exe
F:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
F:\Program Files\Ontrack\Internet Cleanup\icserv.exe
F:\Program Files\Java\jre6\bin\jqs.exe
F:\Program Files\Kodak\printer\center\KodakSvc.exe
F:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
F:\Program Files\Microsoft IntelliPoint\ipoint.exe
F:\WINDOWS\system32\RUNDLL32.EXE
F:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
F:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe
F:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
F:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
F:\Program Files\Java\jre6\bin\jusched.exe
F:\WINDOWS\system32\ctfmon.exe
F:\Program Files\Microsoft LifeCam\MSCamS32.exe
F:\WINDOWS\system32\nvsvc32.exe
F:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
F:\Program Files\Panasonic\PHOTOfunSTUDIO -viewer-\PhAutoRun.exe
F:\Program Files\OpenOffice.org 2.4\program\soffice.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\system32\MsPMSPSv.exe
F:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
F:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
F:\Program Files\Alwil Software\Avast4\ashWebSv.exe
F:\WINDOWS\system32\wuauclt.exe
F:\Documents and Settings\Admin\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ycomp/def…/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ycomp/def…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - F:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - F:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: dsWebAllowBHO Class - {2F85D76C-0569-466F-A488-493E6BD0E955} - F:\Program Files\Windows Desktop Search\dsWebAllow.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - F:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - f:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - F:\Program Files\Google\GoogleToolbarNotifier\4.1.805.1852\swg.dll
O2 - BHO: (no name) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - F:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - F:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - F:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - F:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - F:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - F:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - f:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE F:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [CTSysVol] F:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL
O4 - HKLM\..\Run: [SBDrvDet] F:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r
O4 - HKLM\..\Run: [UpdReg] F:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [LifeCam] "F:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [IntelliPoint] "F:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE F:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [Microsoft Works Update Detection] F:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [EKIJ5000StatusMonitor] F:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe
O4 - HKLM\..\Run: [ArcSoft Connection Service] F:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKLM\..\Run: [avast!] F:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [UnlockerAssistant] "F:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "F:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [googletalk] F:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKLM\..\Run: [Google Desktop Search] "F:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "F:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "F:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "F:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] F:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Evidence Eliminator] F:\Program Files\Evidence Eliminator\ee.exe /m
O4 - Startup: OpenOffice.org 2.4.lnk = F:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Global Startup: Kodak EasyShare software.lnk = F:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: PHOTOfunSTUDIO -viewer-.lnk = F:\Program Files\Panasonic\PHOTOfunSTUDIO -viewer-\PhAutoRun.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) -
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} -
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
O16 - DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} (Java Plug-in 1.6.0) -
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} (Java Plug-in 1.6.0_03) -
O16 - DPF: {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} (Java Plug-in 1.6.0_04) -
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} (Java Plug-in 1.6.0_05) -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - F:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - F:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - F:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O20 - Winlogon Notify: WgaLogon - F:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - F:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - F:\Program Files\a-squared Free\a2service.exe
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - F:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - F:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - F:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - F:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - F:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - F:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - F:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Google Updater Service (gusvc) - Google - F:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: icservice - ONTRACK Data International, Inc. - F:\Program Files\Ontrack\Internet Cleanup\icserv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - F:\Program Files\Java\jre6\bin\jqs.exe" -service -config "F:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf (file missing)
O23 - Service: Kodak AiO Device Service (KodakSvc) - Eastman Kodak Company - F:\Program Files\Kodak\printer\center\KodakSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - F:\WINDOWS\system32\nvsvc32.exe

—————–

Malwarebytes' Anti-Malware 1.28
Database version: 1276
Windows 5.1.2600 Service Pack 3

10/16/2008 11:22:22 AM
mbam-log-2008-10-16 (11-22-22).txt

Scan type: Quick Scan
Objects scanned: 56253
Time elapsed: 6 minute(s), 0 second(s)

Memory Processes Infected: 1
Memory Modules Infected: 1
Registry Keys Infected: 16
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 5
Files Infected: 144

Memory Processes Infected:
F:\Program Files\Evidence Eliminator\Ee.exe (Rogue.EvidenceEliminator) -> Unloaded process successfully.

Memory Modules Infected:
F:\WINDOWS\system32\Eeshellx.dll (Rogue.EvidenceEliminator) -> Delete on reboot.

Registry Keys Infected:
HKEY_CLASSES_ROOT\TypeLib\{0e6117e2-c367-4be3-8045-52669e71b5df} (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{f272845d-cec2-4f95-92ee-6d08fdfbd471} (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a7c6e906-b0b8-4810-ae82-71809ed409eb} (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{b1816445-a3ed-11d3-b2b3-00104b4c6b08} (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\eeshellx.shellext (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\virrlwarning.warningbho (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\virrlwarning.warningbho.1 (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{F5734812-E6A1-8833-ECA9-949B5B8A88BF} (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Evidence Eliminator (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\Shell\Evidence Eliminator Safe Recycle (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\Evidence Eliminator Quick Mode (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\Evidence Eliminator Safe Restart (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\Evidence Eliminator Safe Shutdown (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Folder\shellex\ContextMenuHandlers\Evidence Eliminator (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Evidence Eliminator (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\VirRL2009 (Rogue.AntiVirusLab) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{a7c6e906-b0b8-4810-ae82-71809ed409eb} (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
F:\Program Files\Evidence Eliminator (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Help (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Documents and Settings\Daddy Cool…uh-huh\Start Menu\Programs\Evidence Eliminator (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.

Files Infected:
F:\WINDOWS\system32\Eeshellx.dll (Rogue.EvidenceEliminator) -> Delete on reboot.
F:\Program Files\Evidence Eliminator\Ee.exe (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\INSTALL.LOG (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\License.txt (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\ReadMe.txt (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\UNWISE.EXE (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\UNWISE.INI (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Config.dat (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Drives.dat (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Files.dat (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\FilesContents.dat (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Folders.dat (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\FolderScans.dat (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\IECookiesKeep.dat (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\IEDownloadedKeep.dat (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\NSN4CookiesKeep.dat (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\OE5ChoiceList.dat (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\PlugInSelections.dat (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\ScanMasks.dat (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\TBChoiceList.dat (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\AbsoluteFTP.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\ACDSEE Photo Viewer v3.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Adaptec Easy CD Creator v4.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Adobe Acrobat Reader v3.0.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Adobe Acrobat Reader v3.1.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Adobe Acrobat Reader v4.0.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Adobe Acrobat Reader v5.0.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Adobe Acrobat Reader v5.1.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Adobe Acrobat Reader v6.0.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Adobe Acrobat Reader v7.0.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Adobe Acrobat v6.0.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Adobe Photoshop v5.0 LE.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Adobe Photoshop v5.5.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Adobe Photoshop v5.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Adobe Photoshop v6.0.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Adobe Photoshop v7.0.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Adobe Photoshop v8.0.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Adobe Photoshop v9.0.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\ASPack.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Avant Browser.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Cabinet Manager.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Copernic 2000 Pro.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Copernic 2000.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Copernic Agent.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Corel Paintshop Pro v10.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Cute FTP v3.0.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Cute FTP v4.0.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Cute FTP v7.0.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Delphi v3.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Delphi v4.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Delphi v5.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\DiskKeeper v5.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\DivXPlayer.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Download Accelerator.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Eudora Mail.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\EventLog.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\FTP Explorer.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\GetRight ExplorerBar.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\GetRight v4.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\GoogleBar.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\GoogleNavigation.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\GoZilla.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Helios TextPad v3.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Helios TextPad v4.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\HelpWriter.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Icon Extractor.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\ICQ 2000a.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\InstallShield Express.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\J2 Messenger.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\JASC Paintshop Pro v5.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\JASC Paintshop Pro v6.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\JASC Paintshop Pro v7.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\JASC Paintshop Pro v8.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Jet PhotoShell v1.2.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Kazaa.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Limewire v4.0.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Macromedia Flash v4.0.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\MasterSplitter v2.1.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\McAfee Virus Scan v4.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Microangelo 98.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Micrografx Picture Publisher v7.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Micrografx Picture Publisher v8.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Microsoft FrontPage Express.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Microsoft FrontPage.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Microsoft Help Workshop.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Microsoft HTML Help.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Microsoft Office.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Microsoft Publisher 2000.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Microsoft Send-To Extensions.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Microsoft Windows Paint.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Microsoft Windows WordPad.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\My Network Places.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Napster Music Community.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\NEATO Labels.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\NeoPlanet v5.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Norton AntiVirus 2000 (v6).eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Norton Antivirus 2003.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Norton File Manager.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Norton Internet Security 2004.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Norton Personal Firewall.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Norton Utilities 2000.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\NoteTab Pro.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Opera Browser.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\PackageForTheWeb.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Personal Ancestral File.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Quicktime.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Real Audio Player v6 v7 v8.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Real Download v4.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Real Player v10.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\RealOne Player.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\RemoteDesktop.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Roxio Easy CD Creator v6.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\SureThing CD Labeler.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Telnet.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Ulead Gif Animator v4.0.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Ulead Photo Explorer v4.2.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Ulead Photo Viewer v4.0.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Ulead PhotoImpact v10.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Ulead PhotoImpact v5.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Ulead PhotoImpact Viewer v4.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\UltraEdit v4.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\UltraEdit v7.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Web Ferret v3.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\WinOnCD.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\WinRar v2.6.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\WinRar v2.70.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\WinRar v3.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\WinZip v7.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\WinZip v8.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Wise Installer.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Yahoo Player.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\YahooMessenger.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\ZipMagic 2000.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Data\Plug-Ins\Zone Alarm.eep (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Program Files\Evidence Eliminator\Help\ee.chm (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Documents and Settings\Daddy Cool…uh-huh\Start Menu\Programs\Evidence Eliminator\Evidence Eliminator Help.lnk (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Documents and Settings\Daddy Cool…uh-huh\Start Menu\Programs\Evidence Eliminator\Evidence Eliminator License Agreement.lnk (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Documents and Settings\Daddy Cool…uh-huh\Start Menu\Programs\Evidence Eliminator\Evidence Eliminator Read Me.lnk (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\Documents and Settings\Daddy Cool…uh-huh\Start Menu\Programs\Evidence Eliminator\Evidence Eliminator.lnk (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
F:\WINDOWS\system32\eivrbsi.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
F:\Documents and Settings\jesse\My Documents\My Music\My Music.url (Trojan.Zlob) -> Quarantined and deleted successfully.
F:\Documents and Settings\jesse\My Documents\My Videos\My Video.url (Trojan.Zlob) -> Quarantined and deleted successfully.
F:\Documents and Settings\jesse\My Documents\My Documents.url (Trojan.Zlob) -> Quarantined and deleted successfully.
F:\Documents and Settings\jesse\Local Settings\Temp\xrg2.exe (Trojan.Zlob) -> Quarantined and deleted successfully.

Tomk

Post #4October 16, 2008, 5:14 PM UTC

ubie,

That removed alot of garbage but there is still something going on in you computer.

You appear to be running two anti-Virus programs Avast and A-squared. That isn't good. Only run one anti-virus program or they can conflict with each other.
Please uninstall one of them

Disable resident protections (Antivirus…); you'll re-enable them after the scan

If you kept AVAST
Right click on the avast! icon in system tray (looks like this: [external image: Posted Image]) and choose (Stop On-Access Protection)

If you kept A-squared, it will require similar steps.

Download Lop S&D < here

Double-click Lop S&D.exe
Choose the language, then choose Option 1 (Search)
Wait till the end of the scan
Post the log which is created: (%SystemDrive%\lopR.txt)

ubie

Post #5October 17, 2008, 3:28 PM UTC

Good Morning Tomk,

Here's the info you requested. Again, thanks for your help.

My computer continues to run about the same-a little sluggish (DSL.)

The VirusResponse Lab 2009 problem seems to have disappeared-no more pop-ups (warnings, etc.)

I kept the Avast for my A/V.

Cheers,

ubie

———

——————–\\ Lop S&D 4.2.4-5 XP/Vista

Microsoft Windows XP Home Edition ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : Intel® Pentium® 4 CPU 3.00GHz )
BIOS : BIOS Date: 11/21/03 12:14:47 Ver: 08.00.09
USER : Admin ( Administrator )
BOOT : Normal boot
Antivirus : avast! antivirus 4.8.1229 [VPS 081016-0] 4.8.1229 (Not Activated)
A:\ (USB)
C:\ (Local Disk) - NTFS - Total : 111 Go Free : 108 Go
D:\ (CD or DVD)
E:\ (CD or DVD)
F:\ (Local Disk) - NTFS - Total : 111 Go Free : 51 Go
G:\ (CD or DVD)

"F:\Lop SD" ( MAJ : 02-10-2008|23:42 )
Option : [1] ( Fri 10/17/2008|10:17 )

——————–\\ Listing folders in APPLIC~1

[10/02/2008|01:25] F:\DOCUME~1\Admin\APPLIC~1\ Adobe
[10/03/2008|02:28] F:\DOCUME~1\Admin\APPLIC~1\ Apple Computer
[09/29/2008|11:17] F:\DOCUME~1\Admin\APPLIC~1\ ArcSoft
[10/01/2008|03:04] F:\DOCUME~1\Admin\APPLIC~1\ BitTorrent
[10/10/2008|11:15] F:\DOCUME~1\Admin\APPLIC~1\ DivX
[09/29/2008|11:37] F:\DOCUME~1\Admin\APPLIC~1\ Google
[10/14/2008|05:07] F:\DOCUME~1\Admin\APPLIC~1\ Help
[09/29/2008|11:17] F:\DOCUME~1\Admin\APPLIC~1\ Identities
[10/16/2008|08:02] F:\DOCUME~1\Admin\APPLIC~1\ InterVideo
[09/29/2008|11:22] F:\DOCUME~1\Admin\APPLIC~1\ Macromedia
[10/15/2008|01:03] F:\DOCUME~1\Admin\APPLIC~1\ Malwarebytes
[10/14/2008|05:23] F:\DOCUME~1\Admin\APPLIC~1\ Microsoft
[10/17/2008|10:09] F:\DOCUME~1\Admin\APPLIC~1\ OpenOffice.org2
[10/14/2008|07:20] F:\DOCUME~1\Admin\APPLIC~1\ Opera
[10/10/2008|11:20] F:\DOCUME~1\Admin\APPLIC~1\ Panasonic
[09/29/2008|11:18] F:\DOCUME~1\Admin\APPLIC~1\ Skinux
[10/08/2008|12:16] F:\DOCUME~1\Admin\APPLIC~1\ Sun
[10/15/2008|01:23] F:\DOCUME~1\Admin\APPLIC~1\ vlc
[09/29/2008|11:21] F:\DOCUME~1\Admin\APPLIC~1\ Yahoo!

[09/10/2008|04:39] F:\DOCUME~1\ADMINI~1\APPLIC~1\ Microsoft

[09/17/2008|03:54] F:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\ Adobe
[11/10/2007|09:58] F:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\ Age of Empires 3
[09/28/2007|10:02] F:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\ Apple
[09/28/2007|01:42] F:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\ Apple Computer
[03/16/2008|01:40] F:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\ ArcadeTown
[09/22/2008|09:42] F:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\ ArcSoft
[09/28/2007|10:55] F:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\ Avg7
[02/20/2008|01:20] F:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\ ConeXware
[02/22/2008|11:49] F:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\ Eastman Kodak Company
[09/11/2008|11:14] F:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\ Google
[10/17/2008|09:10] F:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\ Google Updater
[09/28/2007|10:54] F:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\ Grisoft
[07/04/2008|09:34] F:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\ GTek
[03/20/2008|04:27] F:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\ kds_kodak
[09/28/2007|12:17] F:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\ Kodak
[07/09/2007|10:57] F:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\ Legacy Interactive
[09/08/2008|09:41] F:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\ MailFrontier
[10/15/2008|01:03] F:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\ Malwarebytes
[09/07/2008|03:36] F:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\ Microsoft
[07/09/2007|08:11] F:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\ Mozilla
[09/09/2008|06:29] F:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\ MSN6
[09/17/2008|03:58] F:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\ NOS
[07/07/2007|10:25] F:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\ NVIDIA
[05/15/2008|11:12] F:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\ Pinnacle
[06/04/2008|07:39] F:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\ SecTaskMan
[10/15/2008|01:45] F:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\ SITEguard
[09/07/2008|08:15] F:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\ Skype
[08/24/2008|08:20] F:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\ Spybot - Search & Destroy
[10/16/2008|10:56] F:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\ STOPzilla!
[10/13/2008|07:03] F:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\ TEMP
[06/05/2008|12:44] F:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\ Uniblue
[05/15/2008|11:14] F:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\ VideoSpin
[07/07/2007|07:18] F:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\ Windows Genuine Advantage
[09/28/2007|10:33] F:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\ Windows Live Toolbar
[03/14/2008|06:53] F:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\ WLInstaller
[07/07/2007|06:57] F:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\ yahoo!
[09/09/2008|11:44] F:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\ Yahoo! Companion

[09/17/2008|03:48] F:\DOCUME~1\DADDYC~1.UH-\APPLIC~1\ Adobe
[09/22/2008|01:56] F:\DOCUME~1\DADDYC~1.UH-\APPLIC~1\ ArcSoft
[10/01/2008|03:04] F:\DOCUME~1\DADDYC~1.UH-\APPLIC~1\ BitTorrent
[09/11/2008|08:31] F:\DOCUME~1\DADDYC~1.UH-\APPLIC~1\ Google
[09/10/2008|10:33] F:\DOCUME~1\DADDYC~1.UH-\APPLIC~1\ Identities
[09/10/2008|10:41] F:\DOCUME~1\DADDYC~1.UH-\APPLIC~1\ Macromedia
[09/26/2008|10:36] F:\DOCUME~1\DADDYC~1.UH-\APPLIC~1\ Microsoft
[09/26/2008|05:05] F:\DOCUME~1\DADDYC~1.UH-\APPLIC~1\ OpenOffice.org2
[09/10/2008|10:35] F:\DOCUME~1\DADDYC~1.UH-\APPLIC~1\ Opera
[09/15/2008|08:55] F:\DOCUME~1\DADDYC~1.UH-\APPLIC~1\ Panasonic
[09/15/2008|08:15] F:\DOCUME~1\DADDYC~1.UH-\APPLIC~1\ Skinux
[09/18/2008|07:58] F:\DOCUME~1\DADDYC~1.UH-\APPLIC~1\ vlc
[09/10/2008|10:41] F:\DOCUME~1\DADDYC~1.UH-\APPLIC~1\ Yahoo!

[07/10/2008|12:52] F:\DOCUME~1\DEFAUL~1.WIN\APPLIC~1\ Microsoft

[04/23/2008|02:10] F:\DOCUME~1\jesse\APPLIC~1\ Adobe
[02/28/2008|01:28] F:\DOCUME~1\jesse\APPLIC~1\ AdobeUM
[09/29/2007|08:46] F:\DOCUME~1\jesse\APPLIC~1\ Apple Computer
[03/16/2008|01:39] F:\DOCUME~1\jesse\APPLIC~1\ ArcadeTown
[09/21/2008|08:43] F:\DOCUME~1\jesse\APPLIC~1\ ArcSoft
[04/23/2008|05:41] F:\DOCUME~1\jesse\APPLIC~1\ Astroburn
[05/15/2008|11:16] F:\DOCUME~1\jesse\APPLIC~1\ Auslogics
[10/16/2008|08:59] F:\DOCUME~1\jesse\APPLIC~1\ BitTorrent
[09/16/2008|06:51] F:\DOCUME~1\jesse\APPLIC~1\ BitTorrent DNA
[02/01/2008|10:39] F:\DOCUME~1\jesse\APPLIC~1\ COWON
[07/08/2007|01:06] F:\DOCUME~1\jesse\APPLIC~1\ Creative
[04/23/2008|05:01] F:\DOCUME~1\jesse\APPLIC~1\ DAEMON Tools
[09/10/2008|10:01] F:\DOCUME~1\jesse\APPLIC~1\ Desktopicon
[10/27/2007|07:54] F:\DOCUME~1\jesse\APPLIC~1\ DivX
[10/17/2008|10:09] F:\DOCUME~1\jesse\APPLIC~1\ DNA
[03/15/2008|06:14] F:\DOCUME~1\jesse\APPLIC~1\ DNA(2)
[11/13/2007|04:18] F:\DOCUME~1\jesse\APPLIC~1\ GetRightToGo
[09/14/2008|09:40] F:\DOCUME~1\jesse\APPLIC~1\ Google
[08/19/2007|08:02] F:\DOCUME~1\jesse\APPLIC~1\ Greyfirst
[06/07/2008|09:39] F:\DOCUME~1\jesse\APPLIC~1\ gtk-2.0
[07/30/2007|04:18] F:\DOCUME~1\jesse\APPLIC~1\ Help
[07/18/2008|09:12] F:\DOCUME~1\jesse\APPLIC~1\ Identities
[07/08/2007|12:31] F:\DOCUME~1\jesse\APPLIC~1\ InstallShield
[07/08/2007|01:03] F:\DOCUME~1\jesse\APPLIC~1\ InterTrust
[03/29/2008|09:20] F:\DOCUME~1\jesse\APPLIC~1\ InterVideo
[08/03/2007|08:07] F:\DOCUME~1\jesse\APPLIC~1\ Leadertech
[09/16/2008|06:47] F:\DOCUME~1\jesse\APPLIC~1\ LimeWire
[03/11/2008|10:00] F:\DOCUME~1\jesse\APPLIC~1\ Macromedia
[10/14/2008|10:48] F:\DOCUME~1\jesse\APPLIC~1\ Microsoft
[03/05/2008|12:51] F:\DOCUME~1\jesse\APPLIC~1\ Miranda
[07/09/2007|08:11] F:\DOCUME~1\jesse\APPLIC~1\ Mozilla
[09/09/2008|06:38] F:\DOCUME~1\jesse\APPLIC~1\ MSN6
[09/26/2008|07:30] F:\DOCUME~1\jesse\APPLIC~1\ OpenOffice.org2
[09/28/2007|05:00] F:\DOCUME~1\jesse\APPLIC~1\ Opera
[09/09/2008|10:48] F:\DOCUME~1\jesse\APPLIC~1\ Panasonic
[07/11/2007|09:49] F:\DOCUME~1\jesse\APPLIC~1\ PlayFirst
[07/02/2008|03:06] F:\DOCUME~1\jesse\APPLIC~1\ SecuROM
[09/15/2008|05:18] F:\DOCUME~1\jesse\APPLIC~1\ Skinux
[09/08/2008|09:31] F:\DOCUME~1\jesse\APPLIC~1\ Skype
[08/16/2008|05:40] F:\DOCUME~1\jesse\APPLIC~1\ SPORE Creature Creator
[07/09/2007|08:20] F:\DOCUME~1\jesse\APPLIC~1\ Sun
[07/11/2008|08:51] F:\DOCUME~1\jesse\APPLIC~1\ SystemRequirementsLab
[07/09/2007|08:11] F:\DOCUME~1\jesse\APPLIC~1\ Talkback
[11/13/2007|06:52] F:\DOCUME~1\jesse\APPLIC~1\ Turbine
[06/05/2008|12:44] F:\DOCUME~1\jesse\APPLIC~1\ Uniblue
[09/16/2008|06:52] F:\DOCUME~1\jesse\APPLIC~1\ uTorrent
[05/30/2008|12:41] F:\DOCUME~1\jesse\APPLIC~1\ Ventrilo
[06/09/2008|12:49] F:\DOCUME~1\jesse\APPLIC~1\ vlc
[09/28/2007|10:34] F:\DOCUME~1\jesse\APPLIC~1\ Windows Desktop Search
[08/19/2007|08:00] F:\DOCUME~1\jesse\APPLIC~1\ WinRAR
[09/07/2008|02:41] F:\DOCUME~1\jesse\APPLIC~1\ Wormux
[07/07/2007|06:54] F:\DOCUME~1\jesse\APPLIC~1\ Yahoo!

[12/09/2007|09:16] F:\DOCUME~1\LOCALS~1\APPLIC~1\ Microsoft
[09/28/2007|12:13] F:\DOCUME~1\LOCALS~1\APPLIC~1\ SDSD

[09/12/2008|02:13] F:\DOCUME~1\NETWOR~1\APPLIC~1\ Adobe
[09/12/2008|02:13] F:\DOCUME~1\NETWOR~1\APPLIC~1\ Macromedia
[09/28/2007|10:54] F:\DOCUME~1\NETWOR~1\APPLIC~1\ Microsoft

——————–\\ Scheduled Tasks located in F:\WINDOWS\Tasks

[10/15/2008 04:30 PM][–a——] F:\WINDOWS\tasks\At1.job
[10/17/2008 01:47 AM][–a——] F:\WINDOWS\tasks\GoogleUpdateTaskUser.job
[06/29/2008 08:15 PM][–a——] F:\WINDOWS\tasks\Uniblue SpyEraser.job
[10/10/2008 05:28 PM][–a——] F:\WINDOWS\tasks\Uniblue SpyEraser Nag.job
[10/15/2008 05:20 PM][–a——] F:\WINDOWS\tasks\Kodak AiO Scheduled Maintenance.job
[09/04/2008 10:21 AM][–a——] F:\WINDOWS\tasks\AppleSoftwareUpdate.job
[09/29/2008 07:31 PM][–a——] F:\WINDOWS\tasks\EasyShare Registration Task.job
[10/16/2008 08:57 PM][–ah—–] F:\WINDOWS\tasks\SA.DAT
[03/31/2003 07:00 AM][-r-h—–] F:\WINDOWS\tasks\desktop.ini

——————–\\ Listing Folders in F:\Program Files

[02/20/2008|01:26] F:\Program Files\ 7-Zip
[07/09/2007|08:14] F:\Program Files\ activePDF
[09/17/2008|03:54] F:\Program Files\ Adobe
[03/29/2008|09:39] F:\Program Files\ Alice Greenfingers
[09/08/2008|09:35] F:\Program Files\ Alwil Software
[03/29/2008|09:40] F:\Program Files\ Ammo Ambush2_at
[09/28/2007|10:02] F:\Program Files\ Apple Software Update
[10/17/2008|10:16] F:\Program Files\ a-squared Free
[04/24/2008|10:28] F:\Program Files\ AstroburnBar
[05/15/2008|10:57] F:\Program Files\ Auslogics
[06/15/2008|08:14] F:\Program Files\ BitTorrent
[03/18/2008|08:42] F:\Program Files\ BitTorrent_DNA
[07/08/2007|03:17] F:\Program Files\ Broderbund
[09/08/2008|09:03] F:\Program Files\ Build in Time
[03/29/2008|09:41] F:\Program Files\ Burger Rush
[03/29/2008|09:41] F:\Program Files\ Carnivores Ice Age
[09/16/2008|06:51] F:\Program Files\ Celtx
[10/15/2008|01:33] F:\Program Files\ Common Files
[07/07/2007|08:52] F:\Program Files\ ComPlus Applications
[07/08/2007|01:03] F:\Program Files\ Creative
[06/10/2008|05:33] F:\Program Files\ DAEMON Tools Lite
[09/07/2008|02:43] F:\Program Files\ DeerDrive_at
[05/19/2008|05:54] F:\Program Files\ DesktopEarth
[07/13/2007|06:53] F:\Program Files\ directx
[10/03/2008|02:38] F:\Program Files\ DivX
[03/18/2008|08:42] F:\Program Files\ DNA
[09/07/2008|02:48] F:\Program Files\ Doko UBCodes
[09/05/2008|10:49] F:\Program Files\ DreamCatcher
[07/02/2008|02:59] F:\Program Files\ Electronic Arts
[07/08/2007|12:16] F:\Program Files\ Firaxis Games
[09/07/2008|02:49] F:\Program Files\ Foxit Software
[06/07/2008|09:37] F:\Program Files\ GIMP-2.0
[09/12/2008|10:39] F:\Program Files\ Google
[05/19/2008|05:50] F:\Program Files\ Gunner2_at
[05/15/2008|10:59] F:\Program Files\ Haali
[10/07/2008|05:20] F:\Program Files\ InstallShield Installation Information
[10/14/2008|03:57] F:\Program Files\ Internet Explorer
[07/08/2007|01:44] F:\Program Files\ InterVideo
[10/14/2008|06:07] F:\Program Files\ Java
[04/22/2008|06:41] F:\Program Files\ JetAudio
[09/05/2008|10:40] F:\Program Files\ JoWood
[09/15/2008|04:41] F:\Program Files\ Kodak
[07/24/2008|09:03] F:\Program Files\ LifeScan
[03/29/2008|09:46] F:\Program Files\ LinCity-NG
[07/13/2007|04:39] F:\Program Files\ Lionhead Studios Ltd
[09/07/2008|02:37] F:\Program Files\ LuaEdit
[10/16/2008|11:13] F:\Program Files\ Malwarebytes' Anti-Malware
[09/07/2008|02:38] F:\Program Files\ MediaMonkey
[08/13/2008|03:07] F:\Program Files\ Messenger
[07/08/2007|02:46] F:\Program Files\ Microsoft ActiveSync
[07/07/2007|10:26] F:\Program Files\ Microsoft CAPICOM 2.1.0.2
[07/08/2007|02:51] F:\Program Files\ Microsoft Encarta
[07/07/2007|08:54] F:\Program Files\ microsoft frontpage
[09/07/2008|03:34] F:\Program Files\ Microsoft Games
[09/28/2007|10:50] F:\Program Files\ Microsoft IntelliPoint
[09/28/2007|10:41] F:\Program Files\ Microsoft LifeCam
[07/08/2007|02:45] F:\Program Files\ Microsoft Office
[07/08/2007|02:50] F:\Program Files\ Microsoft Picture It! 9
[05/14/2008|12:56] F:\Program Files\ Microsoft Research
[09/12/2008|06:01] F:\Program Files\ Microsoft Silverlight
[07/08/2007|02:46] F:\Program Files\ Microsoft Works
[07/08/2007|02:42] F:\Program Files\ Microsoft Works Suite 2004
[05/12/2008|11:42] F:\Program Files\ Movie Maker
[09/16/2008|06:51] F:\Program Files\ Mozilla Firefox
[09/10/2008|10:21] F:\Program Files\ MSN
[07/07/2007|08:51] F:\Program Files\ MSN Gaming Zone
[09/10/2008|01:15] F:\Program Files\ MSN Messenger
[09/28/2007|11:03] F:\Program Files\ MSXML 4.0
[05/12/2008|11:39] F:\Program Files\ NetMeeting
[05/15/2008|11:01] F:\Program Files\ Network Stumbler
[09/12/2008|02:13] F:\Program Files\ Norton PC Checkup
[09/17/2008|03:58] F:\Program Files\ NOS
[03/29/2008|07:46] F:\Program Files\ NTCore
[07/24/2008|09:05] F:\Program Files\ OneTouch USB Driver
[07/07/2007|08:51] F:\Program Files\ Online Services
[09/10/2008|10:56] F:\Program Files\ Ontrack
[09/16/2008|10:22] F:\Program Files\ OpenOffice.org 2.2
[09/16/2008|10:23] F:\Program Files\ OpenOffice.org 2.4
[10/08/2008|06:55] F:\Program Files\ Opera
[05/12/2008|11:39] F:\Program Files\ Outlook Express
[09/09/2008|10:39] F:\Program Files\ Panasonic
[05/15/2008|11:14] F:\Program Files\ Pinnacle
[09/02/2007|03:19] F:\Program Files\ Playlogic
[09/16/2008|06:51] F:\Program Files\ ProsePro 05
[03/29/2008|09:51] F:\Program Files\ PurrfectPetShop_at
[09/07/2008|03:40] F:\Program Files\ QuadWeb
[06/09/2008|12:45] F:\Program Files\ QuickTime
[03/29/2008|09:51] F:\Program Files\ Railroad Tycoon 3
[09/28/2007|10:33] F:\Program Files\ Real
[07/09/2007|08:02] F:\Program Files\ ReflexiveArcade
[09/07/2008|02:41] F:\Program Files\ ReNamer
[03/29/2008|09:52] F:\Program Files\ Rocky Mountain Trophy Hunter 3
[08/19/2007|08:00] F:\Program Files\ RoughDraft
[09/16/2008|06:52] F:\Program Files\ Script Wizard 05
[05/15/2008|11:08] F:\Program Files\ Send To Toys
[09/07/2008|08:15] F:\Program Files\ Skype
[10/13/2008|08:00] F:\Program Files\ Spybot - Search & Destroy
[03/06/2008|11:06] F:\Program Files\ Starcraft
[10/15/2008|01:38] F:\Program Files\ Steam
[09/10/2008|08:06] F:\Program Files\ Sun
[07/11/2008|08:53] F:\Program Files\ SystemRequirementsLab
[03/29/2008|09:53] F:\Program Files\ The Apprentice Los Angeles
[10/14/2008|06:07] F:\Program Files\ Three Rings Design
[03/09/2008|07:38] F:\Program Files\ TryMedia
[11/13/2007|06:10] F:\Program Files\ Turbine
[07/07/2007|08:59] F:\Program Files\ Uninstall Information
[09/11/2008|10:11] F:\Program Files\ Unlocker
[03/25/2008|12:29] F:\Program Files\ uTorrent
[05/30/2008|12:40] F:\Program Files\ Ventrilo
[05/20/2008|02:37] F:\Program Files\ vidalia Bundle
[06/09/2008|12:48] F:\Program Files\ VideoLAN
[08/05/2007|06:40] F:\Program Files\ WhatsRunning
[03/15/2008|08:47] F:\Program Files\ WiFiConnector
[09/28/2007|10:34] F:\Program Files\ Windows Desktop Search
[03/14/2008|06:55] F:\Program Files\ Windows Live
[09/10/2008|11:46] F:\Program Files\ Windows Live Toolbar
[12/09/2007|09:05] F:\Program Files\ Windows Media Connect 2
[05/12/2008|11:39] F:\Program Files\ Windows Media Player
[05/12/2008|11:39] F:\Program Files\ Windows NT
[07/07/2007|08:51] F:\Program Files\ WindowsUpdate
[03/29/2008|10:27] F:\Program Files\ WinRAR
[10/14/2008|10:33] F:\Program Files\ World of Warcraft
[09/07/2008|02:41] F:\Program Files\ Wormux 0.7
[07/07/2007|08:54] F:\Program Files\ xerox
[03/29/2008|09:54] F:\Program Files\ Xfire
[09/09/2008|11:44] F:\Program Files\ Yahoo!
[09/08/2008|09:44] F:\Program Files\ ZoneAlarmSB

——————–\\ Listing Folders in F:\Program Files\Common Files

[09/17/2008|03:54] F:\Program Files\Common Files\ Adobe
[09/17/2008|03:54] F:\Program Files\Common Files\ Adobe AIR
[09/28/2007|10:04] F:\Program Files\Common Files\ Apple
[09/09/2008|10:43] F:\Program Files\Common Files\ ArcSoft
[09/29/2007|12:38] F:\Program Files\Common Files\ Blizzard Entertainment
[04/23/2008|02:38] F:\Program Files\Common Files\ COWON
[07/08/2007|02:45] F:\Program Files\Common Files\ Designer
[03/09/2008|07:54] F:\Program Files\Common Files\ DirectX
[07/08/2007|12:57] F:\Program Files\Common Files\ InstallShield
[10/15/2008|01:33] F:\Program Files\Common Files\ iS3
[07/19/2007|07:17] F:\Program Files\Common Files\ Java
[09/15/2008|04:40] F:\Program Files\Common Files\ Kodak
[09/14/2008|12:17] F:\Program Files\Common Files\ Microsoft Shared
[07/07/2007|08:52] F:\Program Files\Common Files\ MSSoap
[01/12/2006|04:26] F:\Program Files\Common Files\ ODBC
[02/22/2008|02:25] F:\Program Files\Common Files\ Scanner
[07/07/2007|08:52] F:\Program Files\Common Files\ Services
[09/07/2008|08:15] F:\Program Files\Common Files\ Skype
[01/12/2006|04:26] F:\Program Files\Common Files\ SpeechEngines
[05/12/2008|11:38] F:\Program Files\Common Files\ System
[03/15/2008|06:14] F:\Program Files\Common Files\ WindowsLiveInstaller
[05/30/2008|12:39] F:\Program Files\Common Files\ Wise Installation Wizard
[05/15/2008|11:14] F:\Program Files\Common Files\ Yahoo!

——————–\\ Process

( 63 Processes )

… OK !

——————–\\ Searching with S_Lop

No Lop folder found !

——————–\\ Searching for Lop Files - Folders

No Lop folder found !

——————–\\ Searching within the Registry

….. OK !

——————–\\ Checking the Hosts file

Hosts file CLEAN

——————–\\ Searching for hidden files with Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-17 10:18:43
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes …
scanning hidden files …
scan completed successfully
hidden processes: 0
hidden files: 0

——————–\\ Searching for other infections

F:\WINDOWS\Tasks\At1.job

——————–\\ Cracks & Keygens ..

F:\DOCUME~1\Admin\Favorites\news\Crackheadland.url

[F:17][D:7]-> F:\DOCUME~1\Admin\LOCALS~1\Temp
[F:33][D:0]-> F:\DOCUME~1\Admin\Cookies
[F:11][D:7]-> F:\DOCUME~1\Admin\LOCALS~1\TEMPOR~1\content.IE5

1 - "F:\Lop SD\LopR_1.txt" - Fri 10/17/2008|10:16 - Option : [1]
2 - "F:\Lop SD\LopR_2.txt" - Fri 10/17/2008|10:19 - Option : [1]

——————–\\ Scan completed at 10:19:34

Tomk

Post #6October 17, 2008, 4:46 PM UTC

ubie,

Downloading cracks is almost guaranteed to get you infected.

Please download the OTMoveIt3 by OldTimer.

Save it to your desktop.
Please double-click OTMoveIt3.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).

Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

:Processes
explorer.exe

:Services

:Reg

:Files
F:\WINDOWS\Tasks\At1.job
F:\Documents and Settings\Admin\Favorites\news\Crackheadland.url

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
Click the red Moveit! button.
Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
Close OTMoveIt3

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

Please go to Kaspersky website and perform an online antivirus scan.

Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
- Spyware, Adware, Dialers, and other potentially dangerous programs
  Archives
  Mail databases
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As….
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
Please post this log in your next reply.

So in your next reply I'd like to see:
OTMoveit3 report
Kaspersky report
New HijackThis log

ubie

Post #7October 21, 2008, 4:22 PM UTC

Good Morning Tomk

Hope ya' had a good weekend.

Here's the info;

Ubie

————

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
File/Folder F:\WINDOWS\Tasks\At1.job not found.
File/Folder F:\Documents and Settings\Admin\Favorites\news\Crackheadland.url not found.
========== COMMANDS ==========
File delete failed. F:\DOCUME~1\Admin\LOCALS~1\Temp\~DFDDAC.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. F:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
File delete failed. F:\WINDOWS\temp\_avast4_\Webshlock.txt scheduled to be deleted on reboot.
File delete failed. F:\WINDOWS\temp\Perflib_Perfdata_578.dat scheduled to be deleted on reboot.
File delete failed. F:\WINDOWS\temp\Perflib_Perfdata_798.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
Opera cache emptied.
Temp folders emptied.
Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.5.0 log created on 10212008_111757

—————

Logfile of HijackThis v1.99.1
Scan saved at 11:15:12 AM, on 10/21/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\system32\svchost.exe
F:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
F:\Program Files\Alwil Software\Avast4\ashServ.exe
F:\WINDOWS\system32\spoolsv.exe
F:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
F:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
F:\WINDOWS\system32\CTsvcCDA.exe
F:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
F:\Program Files\Ontrack\Internet Cleanup\icserv.exe
F:\Program Files\Java\jre6\bin\jqs.exe
F:\Program Files\Kodak\printer\center\KodakSvc.exe
F:\Program Files\Microsoft LifeCam\MSCamS32.exe
F:\WINDOWS\system32\nvsvc32.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\system32\MsPMSPSv.exe
F:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
F:\Program Files\Alwil Software\Avast4\ashWebSv.exe
F:\Program Files\MSN Messenger\usnsvc.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\Explorer.EXE
F:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
F:\Program Files\Microsoft IntelliPoint\ipoint.exe
F:\WINDOWS\system32\RUNDLL32.EXE
F:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
F:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe
F:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
F:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
F:\Program Files\Java\jre6\bin\jusched.exe
F:\WINDOWS\system32\ctfmon.exe
F:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
F:\WINDOWS\system32\wuauclt.exe
F:\WINDOWS\System32\msiexec.exe
F:\WINDOWS\system32\NOTEPAD.EXE
F:\Program Files\Internet Explorer\IEXPLORE.EXE
F:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
F:\Documents and Settings\Admin\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ycomp/def…/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ycomp/def…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - F:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - F:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: dsWebAllowBHO Class - {2F85D76C-0569-466F-A488-493E6BD0E955} - F:\Program Files\Windows Desktop Search\dsWebAllow.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - F:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - f:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - F:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O2 - BHO: (no name) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - F:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - F:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - F:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - F:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - F:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - F:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - f:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE F:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [CTSysVol] F:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL
O4 - HKLM\..\Run: [SBDrvDet] F:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r
O4 - HKLM\..\Run: [UpdReg] F:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [LifeCam] "F:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [IntelliPoint] "F:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE F:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [Microsoft Works Update Detection] F:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [EKIJ5000StatusMonitor] F:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe
O4 - HKLM\..\Run: [ArcSoft Connection Service] F:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKLM\..\Run: [avast!] F:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [UnlockerAssistant] "F:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "F:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [googletalk] F:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKLM\..\Run: [Google Desktop Search] "F:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "F:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "F:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "F:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] F:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Evidence Eliminator] F:\Program Files\Evidence Eliminator\ee.exe /m
O4 - Startup: OpenOffice.org 2.4.lnk = F:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Global Startup: Kodak EasyShare software.lnk = F:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: PHOTOfunSTUDIO -viewer-.lnk = F:\Program Files\Panasonic\PHOTOfunSTUDIO -viewer-\PhAutoRun.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) -
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} -
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
O16 - DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} (Java Plug-in 1.6.0) -
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} (Java Plug-in 1.6.0_03) -
O16 - DPF: {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} (Java Plug-in 1.6.0_04) -
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} (Java Plug-in 1.6.0_05) -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - F:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - F:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - F:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O20 - Winlogon Notify: WgaLogon - F:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - F:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - F:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - F:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - F:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - F:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - F:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - F:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - F:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Google Updater Service (gusvc) - Google - F:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: icservice - ONTRACK Data International, Inc. - F:\Program Files\Ontrack\Internet Cleanup\icserv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - F:\Program Files\Java\jre6\bin\jqs.exe" -service -config "F:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf (file missing)
O23 - Service: Kodak AiO Device Service (KodakSvc) - Eastman Kodak Company - F:\Program Files\Kodak\printer\center\KodakSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - F:\WINDOWS\system32\nvsvc32.exe

———————

KASPERSKY ONLINE SCANNER 7 REPORT
Tuesday, October 21, 2008
Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Monday, October 20, 2008 22:06:26
Records in database: 1328736
——————————————————————————–

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\
E:\
F:\
G:\

Scan statistics:
Files scanned: 112395
Threat name: 0
Infected objects: 0
Suspicious objects: 0
Duration of the scan: 01:22:05

No malware has been detected. The scan area is clean.

The selected area was scanned.

Tomk

Post #8October 22, 2008, 1:11 AM UTC

ubie,

Download and Run SmitfraudFix
Please download SmitfraudFix (by S!Ri)
Extract the content (a folder named SmitfraudFix) to your Desktop.

Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply.

Also please post a new HijackThis log.

ubie

Post #9October 24, 2008, 4:13 PM UTC

Tomk I opened the zip but I did not see the file name you said-I found Smitfraud, the 16th file from the top (using 7 Zip Manager to open the zip.) At any rate, I opened that file (16th from top title Smitfraud.) A red box opened in a non-English language. I pressed 1 but as soon as I did the box closed! I tried it sveral times-no go. Can you send it another way? Or what else do you suggest? Thanks, ubie

Tomk

Post #10October 24, 2008, 4:54 PM UTC

ubie

Extract the content (a folder named SmitfraudFix) to your Desktop.

Did you extract all the files?

ubie

Post #11October 28, 2008, 12:17 AM UTC

Tomk Yes-I tried it repeatedly and once I click 1 the window closes! Nothing else happens.

Tomk

Post #12October 28, 2008, 1:22 AM UTC

ubie,

We will just use a bigger hammer then.

Download ComboFix from one of these locations:

Link 1
Link 2
Link 3

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link –> http://www.bleepingcomputer.com/forums/topic114351.html
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
5. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Tomk

Post #13November 1, 2008, 11:18 PM UTC

Due to inactivity this topic will be closed. If you need help please start a new thread and post a new HJT log

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Closed] VirusResponse Lab 2009

✨ Ask AI

Ask AI