Spyware / Malware / Virus Removal

[Resolved] trojan. DNS Changer - wont go away

16 min read

Looking for the outcome? Ask AI

Tomk

Post #16October 22, 2008, 8:04 PM UTC

peachjuteux,

Let's use a bigger hammer then.

Download ComboFix from one of these locations:

Link 1
Link 2
Link 3

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link –> http://www.bleepingcomputer.com/forums/topic114351.html
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
5. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

peachjuteux

Post #17October 22, 2008, 10:20 PM UTC last edited October 22, 2008, 11:32 PM UTC

i get page cannot be diaplayed with each of the 3 links also- i even turned off everything i could think of plus lowered all my security settings to low- but cant access those download oh my goodness- i got it to start downloading- it was a disabled ethernal something- willpost a log when done- thanks so much.

peachjuteux

Post #18October 23, 2008, 12:20 AM UTC

ComboFix 08-10-22.02 - Compaq_Owner 2008-10-22 19:08:33.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.131 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\HotbarSA
C:\Documents and Settings\All Users\Application Data\HotbarSA\HotbarSA_kyf_update.dat
C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
C:\Program Files\alexa toolbar
C:\Program Files\SelectRebates
C:\Program Files\SelectRebates\FFToolbar.txt
C:\Program Files\SelectRebates\FFToolbar\chrome.manifest
C:\Program Files\SelectRebates\FFToolbar\chrome\content\options.js
C:\Program Files\SelectRebates\FFToolbar\chrome\content\options.xul
C:\Program Files\SelectRebates\FFToolbar\chrome\content\sahtoolbar.js
C:\Program Files\SelectRebates\FFToolbar\chrome\content\sahtoolbar.xul
C:\Program Files\SelectRebates\FFToolbar\chrome\locale\en-US\contents.rdf
C:\Program Files\SelectRebates\FFToolbar\chrome\locale\en-US\sahtoolbar.dtd
C:\Program Files\SelectRebates\FFToolbar\chrome\locale\en-US\sahtoolbar.dtd.skin
C:\Program Files\SelectRebates\FFToolbar\chrome\locale\en-US\sahtoolbar.properties
C:\Program Files\SelectRebates\FFToolbar\chrome\skin\3rdParty.png
C:\Program Files\SelectRebates\FFToolbar\chrome\skin\add-folderplus.png
C:\Program Files\SelectRebates\FFToolbar\chrome\skin\add-plussign.png
C:\Program Files\SelectRebates\FFToolbar\chrome\skin\alert-blue.png
C:\Program Files\SelectRebates\FFToolbar\chrome\skin\alert-red.png
C:\Program Files\SelectRebates\FFToolbar\chrome\skin\bluebar.png
C:\Program Files\SelectRebates\FFToolbar\chrome\skin\dollarsign.png
C:\Program Files\SelectRebates\FFToolbar\chrome\skin\FindWords.png
C:\Program Files\SelectRebates\FFToolbar\chrome\skin\gripper.png
C:\Program Files\SelectRebates\FFToolbar\chrome\skin\icon-magnifying.png
C:\Program Files\SelectRebates\FFToolbar\chrome\skin\invite.png
C:\Program Files\SelectRebates\FFToolbar\chrome\skin\invite2.png
C:\Program Files\SelectRebates\FFToolbar\chrome\skin\my-blue.png
C:\Program Files\SelectRebates\FFToolbar\chrome\skin\my-gray.png
C:\Program Files\SelectRebates\FFToolbar\chrome\skin\my-green.png
C:\Program Files\SelectRebates\FFToolbar\chrome\skin\my-red.png
C:\Program Files\SelectRebates\FFToolbar\chrome\skin\Options.png
C:\Program Files\SelectRebates\FFToolbar\chrome\skin\S.png
C:\Program Files\SelectRebates\FFToolbar\chrome\skin\SAH-LogoHotSpots.png
C:\Program Files\SelectRebates\FFToolbar\chrome\skin\SAH-logotext.png
C:\Program Files\SelectRebates\FFToolbar\chrome\skin\SAH-mainlogo-v1.png
C:\Program Files\SelectRebates\FFToolbar\chrome\skin\SAH-mainlogo-v2.png
C:\Program Files\SelectRebates\FFToolbar\chrome\skin\sahtoolbar.css
C:\Program Files\SelectRebates\FFToolbar\chrome\skin\Scissors.png
C:\Program Files\SelectRebates\FFToolbar\chrome\skin\Search.png
C:\Program Files\SelectRebates\FFToolbar\chrome\skin\shoppingcart.png
C:\Program Files\SelectRebates\FFToolbar\chrome\skin\singleperson.png
C:\Program Files\SelectRebates\FFToolbar\chrome\skin\star.png
C:\Program Files\SelectRebates\FFToolbar\chrome\skin\thumb2.png
C:\Program Files\SelectRebates\FFToolbar\chrome\skin\Thumbs.db
C:\Program Files\SelectRebates\FFToolbar\chrome\skin\toolbar-images-ALL.png
C:\Program Files\SelectRebates\FFToolbar\chrome\skin\Toolbar_HelpAndFeedback.png
C:\Program Files\SelectRebates\FFToolbar\chrome\skin\Wrench.png
C:\Program Files\SelectRebates\FFToolbar\defaults\preferences\sahtoolbar.js
C:\Program Files\SelectRebates\FFToolbar\install.rdf
C:\Program Files\SelectRebates\SahImages\bg-gradient.gif
C:\Program Files\SelectRebates\SahImages\button-close.gif
C:\Program Files\SelectRebates\SahImages\button-finish.gif
C:\Program Files\SelectRebates\SahImages\icon-desktop.gif
C:\Program Files\SelectRebates\SahImages\sah-logopop.gif
C:\Program Files\SelectRebates\SahImages\sah-logopoplg.gif
C:\Program Files\SelectRebates\SelectAlerts.dat
C:\Program Files\SelectRebates\SelectRebates.ini
C:\Program Files\SelectRebates\SelectRebatesA.dat
C:\Program Files\SelectRebates\SelectRebatesB.dat
C:\Program Files\SelectRebates\SelectRebatesBT.dat
C:\Program Files\SelectRebates\SelectRebatesDownload.exe
C:\Program Files\SelectRebates\Toolbar\Add.bmp
C:\Program Files\SelectRebates\Toolbar\AdvancedOptions.html
C:\Program Files\SelectRebates\Toolbar\basis.xml
C:\Program Files\SelectRebates\Toolbar\Basis.xml.dym
C:\Program Files\SelectRebates\Toolbar\Blank.bmp
C:\Program Files\SelectRebates\Toolbar\button-CloseWindow.gif
C:\Program Files\SelectRebates\Toolbar\i_clipboard.bmp
C:\Program Files\SelectRebates\Toolbar\i_help.bmp
C:\Program Files\SelectRebates\Toolbar\i_magnifying.bmp
C:\Program Files\SelectRebates\Toolbar\icons.bmp
C:\Program Files\SelectRebates\Toolbar\Invite.bmp
C:\Program Files\SelectRebates\Toolbar\logo.bmp
C:\Program Files\SelectRebates\Toolbar\logo_24.bmp
C:\Program Files\SelectRebates\Toolbar\logo_HotSpots.bmp
C:\Program Files\SelectRebates\Toolbar\MyNew.bmp
C:\Program Files\SelectRebates\Toolbar\MyNone.bmp
C:\Program Files\SelectRebates\Toolbar\MyPage.bmp
C:\Program Files\SelectRebates\Toolbar\Rate.bmp
C:\Program Files\SelectRebates\Toolbar\RightControls.dym
C:\Program Files\SelectRebates\Toolbar\sah_logo_bars.gif
C:\Program Files\SelectRebates\Toolbar\Scissors.bmp
C:\Program Files\SelectRebates\Toolbar\ShopAtHomeToolbar.dll
C:\Program Files\SelectRebates\Toolbar\Tools.bmp
C:\Program Files\SelectRebates\Toolbar\Tools2.bmp
D:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2008-09-23 to 2008-10-23 )))))))))))))))))))))))))))))))
.

2008-10-22 16:11 . 2008-10-22 16:11 d——– C:\Documents and Settings\Compaq_Owner\Application Data\FidelityNetworks
2008-10-22 16:08 . 2008-10-22 16:13 d——– C:\Program Files\FidelityNetworks fidnet Dominator
2008-10-22 14:27 . 2008-10-22 14:31 d——– C:\fixwareout
2008-10-22 13:54 . 2008-10-22 13:58 d——– C:\Lop SD
2008-10-20 20:28 . 2008-10-20 20:27 410,976 –a—— C:\WINDOWS\system32\deploytk.dll
2008-10-20 20:28 . 2008-10-20 20:27 73,728 –a—— C:\WINDOWS\system32\javacpl.cpl
2008-10-19 12:27 . 2008-10-19 12:27 d——– C:\Documents and Settings\Compaq_Owner\Application Data\Malwarebytes
2008-10-19 12:26 . 2008-10-19 12:27 d——– C:\Program Files\Malwarebytes' Anti-Malware
2008-10-19 12:26 . 2008-10-19 12:26 d——– C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-10-19 12:26 . 2008-10-16 20:25 38,496 –a—— C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-10-19 12:26 . 2008-10-16 20:25 15,504 –a—— C:\WINDOWS\system32\drivers\mbam.sys
2008-10-18 02:58 . 2008-10-18 02:58 d——– C:\Program Files\Alwil Software
2008-10-15 01:34 . 2008-10-22 16:09 5,144,608 –ahs—- C:\WINDOWS\system32\drivers\fidbox.dat
2008-10-15 01:34 . 2008-10-22 16:09 64,052 –ahs—- C:\WINDOWS\system32\drivers\fidbox.idx
2008-10-15 01:29 . 2008-10-15 01:29 d——– C:\Program Files\Zone Labs
2008-10-14 18:19 . 2008-10-14 18:19 d——– C:\Documents and Settings\Compaq_Owner\Application Data\EPSON
2008-10-14 18:09 . 2008-10-14 18:09 d——– C:\EPSONREG
2008-10-14 17:57 . 2008-10-14 17:58 d——– C:\Program Files\ABBYY FineReader 6.0 Sprint
2008-10-14 17:57 . 2008-10-14 17:57 d——– C:\Documents and Settings\All Users\Application Data\ArcSoft
2008-10-14 17:56 . 2008-10-14 17:57 d——– C:\Program Files\Common Files\ArcSoft
2008-10-14 17:56 . 2008-10-21 21:55 d——– C:\Documents and Settings\Compaq_Owner\Application Data\ArcSoft
2008-10-14 17:56 . 2004-08-04 07:52 413,696 -ra—— C:\WINDOWS\system32\msvce97e.rra
2008-10-14 17:56 . 2004-12-07 10:11 258,352 –a—— C:\WINDOWS\system32\unicows.dll
2008-10-14 17:56 . 1995-08-01 04:44 212,480 –a—— C:\WINDOWS\PCDLIB32.DLL
2008-10-14 17:56 . 2006-10-20 16:11 126,976 –a—— C:\WINDOWS\system32\PhotoImpression Slideshow.scr
2008-10-14 17:56 . 2005-02-23 14:58 11,776 –a—— C:\WINDOWS\system32\drivers\afc.sys
2008-10-14 17:55 . 2008-10-14 17:56 d——– C:\WINDOWS\system32\PhotoImpression Slideshow
2008-10-14 17:55 . 2008-10-14 17:57 d——– C:\Program Files\ArcSoft
2008-10-14 17:54 . 2008-10-14 17:54 d——– C:\Documents and Settings\All Users\Application Data\EPSON
2008-10-14 17:54 . 2004-08-03 22:58 15,104 –a—— C:\WINDOWS\system32\drivers\usbscan.sys
2008-10-14 17:54 . 2004-08-03 22:58 15,104 –a—— C:\WINDOWS\system32\dllcache\usbscan.sys
2008-10-14 17:52 . 2008-10-14 17:52 d——– C:\Documents and Settings\Compaq_Owner\Application Data\InstallShield
2008-10-14 17:50 . 2008-10-14 18:09 d——– C:\Program Files\epson
2008-10-14 17:50 . 2007-04-18 00:00 67,072 –a—— C:\WINDOWS\system32\escwiad.dll
2008-10-14 17:49 . 2008-10-14 18:09 44 –a—— C:\WINDOWS\EPSCX9400Fax.ini
2008-10-13 15:53 . 2008-10-13 15:31 102,664 –a—— C:\WINDOWS\system32\drivers\tmcomm.sys
2008-10-13 14:48 . 2008-10-21 19:49 d——– C:\Documents and Settings\Compaq_Owner\.housecall6.6
2008-09-27 02:10 . 2008-09-27 02:10 d——– C:\Program Files\ZoneAlarmSB
2008-09-27 02:08 . 2008-09-27 02:08 d——– C:\Documents and Settings\All Users\Application Data\MailFrontier
2008-09-26 12:07 . 2008-09-26 12:07 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-09-26 12:07 . 2008-09-26 12:07 1,409 –a—— C:\WINDOWS\QTFont.for
2008-09-26 01:00 . 2008-09-26 01:09 d——– C:\Program Files\Windows Live Safety Center

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-22 21:53 ——— d—–w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-10-22 03:05 ——— d—–w C:\Documents and Settings\Compaq_Owner\Application Data\WeatherBug
2008-10-22 02:55 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-10-21 05:15 ——— d—–w C:\Program Files\Coupons
2008-10-21 01:27 ——— d—–w C:\Program Files\Java
2008-10-19 17:35 18,906 —-a-w C:\Documents and Settings\Compaq_Owner\Application Data\wklnhst.dat
2008-10-18 07:50 ——— d—–w C:\Documents and Settings\All Users\Application Data\avg8
2008-09-02 20:28 ——— d—–w C:\Program Files\Microsoft Silverlight
2006-05-05 21:50 22 –sha-w C:\WINDOWS\SMINST\HPCD.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 15360]
"Weather"="C:\PROGRA~1\AWS\WEATHE~1\Weather.exe" [2006-04-07 1343488]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-09-10 68856]
"EPSON Stylus CX9400Fax Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICFA.EXE" [2007-03-23 182272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2005-07-22 237568]
"HPBootOp"="C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2005-11-09 249856]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPwuSchd2.exe" [2005-02-17 49152]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-02-17 180269]
"FLMK08KB"="C:\Program Files\Muiltmedia keyboard utility\1.1\MMKEYBD.EXE" [2006-05-23 207360]
"FLMOFFICE4DMOUSE"="C:\Program Files\Browser Mouse\mouse32a.exe" [2006-05-23 360448]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 282624]
"ArcSoft Connection Service"="C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2008-07-04 109056]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 919016]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008]
"SunJavaUpdateSched"="C:\Program Files\Java\jre6\bin\jusched.exe" [2008-10-20 136600]
"Propel Accelerator"="C:\Program Files\FidelityNetworks fidnet Dominator\trayctl.exe" [2005-01-27 28672]
"Malwarebytes Anti-Malware (reboot)"="C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" [2008-10-16 1257104]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 29696]
Compaq Connections.lnk - C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe [2006-02-17 36903]
Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2007-09-10 126136]
ymetray.lnk - C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe [2007-01-26 54776]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2006-12-20 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2007-04-19 12:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\WINDOWS\\system32\\fxsclnt.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Yahoo!\\UPnP\\yupnpsrv.exe"=
"C:\\Program Files\\Yahoo!\\Yahoo! Music Jukebox\\YahooMusicEngine.exe"=
"C:\\Program Files\\Compaq Connections\\5577497\\Program\\Compaq Connections.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]

*Newly Created Service* - PROCEXP90
.
Contents of the 'Scheduled Tasks' folder

2008-10-16 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 14:57]

2008-10-22 C:\WINDOWS\Tasks\User_Feed_Synchronization-{0AFED55C-6B93-4A2C-A732-8035DDA63C3A}.job
- C:\WINDOWS\system32\msfeedssync.exe [2006-10-17 13:58]
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)

.
——- Supplementary Scan ——-
.
FireFox -: Profile - C:\Documents and Settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\auayepkl.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.com/
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-22 19:11:11
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

PROCESS: C:\WINDOWS\system32\lsass.exe
-> C:\Program Files\FidelityNetworks fidnet Dominator\prplsf.dll
.
Completion time: 2008-10-22 19:14:12
ComboFix-quarantined-files.txt 2008-10-23 00:14:08

Pre-Run: 140,462,948,352 bytes free
Post-Run: 140,506,312,704 bytes free

241 — E O F — 2008-09-22 16:48:17

Tomk

Post #19October 23, 2008, 12:43 AM UTC

peachjuteux,

COMBOFIX-Script

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

KILLALL::

File::
C:\WINDOWS\system32\msvce97e.rra
D:\I386\APPS\APP07355\src\CompaqPresario_Spring06.exe
D:\I386\APPS\APP07355\src\HPPavillion_Spring06.exe

Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

Also paste a new HijackThis log and let me know how things are running now.

peachjuteux

Post #20October 23, 2008, 1:38 AM UTC

ok here they are:

ComboFix 08-10-22.02 - Compaq_Owner 2008-10-22 19:52:18.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.163 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Compaq_Owner\Desktop\CFScript.txt
* Created a new restore point

FILE ::
C:\WINDOWS\system32\msvce97e.rra
D:\I386\APPS\APP07355\src\CompaqPresario_Spring06.exe
D:\I386\APPS\APP07355\src\HPPavillion_Spring06.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\msvce97e.rra
D:\I386\APPS\APP07355\src\CompaqPresario_Spring06.exe
D:\I386\APPS\APP07355\src\HPPavillion_Spring06.exe

.
((((((((((((((((((((((((( Files Created from 2008-09-23 to 2008-10-23 )))))))))))))))))))))))))))))))
.

2008-10-22 16:11 . 2008-10-22 16:11 d——– C:\Documents and Settings\Compaq_Owner\Application Data\FidelityNetworks
2008-10-22 16:08 . 2008-10-22 16:13 d——– C:\Program Files\FidelityNetworks fidnet Dominator
2008-10-22 14:27 . 2008-10-22 14:31 d——– C:\fixwareout
2008-10-22 13:54 . 2008-10-22 13:58 d——– C:\Lop SD
2008-10-20 20:28 . 2008-10-20 20:27 410,976 –a—— C:\WINDOWS\system32\deploytk.dll
2008-10-20 20:28 . 2008-10-20 20:27 73,728 –a—— C:\WINDOWS\system32\javacpl.cpl
2008-10-19 12:27 . 2008-10-19 12:27 d——– C:\Documents and Settings\Compaq_Owner\Application Data\Malwarebytes
2008-10-19 12:26 . 2008-10-19 12:27 d——– C:\Program Files\Malwarebytes' Anti-Malware
2008-10-19 12:26 . 2008-10-19 12:26 d——– C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-10-19 12:26 . 2008-10-16 20:25 38,496 –a—— C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-10-19 12:26 . 2008-10-16 20:25 15,504 –a—— C:\WINDOWS\system32\drivers\mbam.sys
2008-10-18 02:58 . 2008-10-18 02:58 d——– C:\Program Files\Alwil Software
2008-10-15 01:34 . 2008-10-22 19:55 5,144,608 –ahs—- C:\WINDOWS\system32\drivers\fidbox.dat
2008-10-15 01:34 . 2008-10-22 19:55 66,716 –ahs—- C:\WINDOWS\system32\drivers\fidbox.idx
2008-10-15 01:29 . 2008-10-15 01:29 d——– C:\Program Files\Zone Labs
2008-10-14 18:19 . 2008-10-14 18:19 d——– C:\Documents and Settings\Compaq_Owner\Application Data\EPSON
2008-10-14 18:09 . 2008-10-14 18:09 d——– C:\EPSONREG
2008-10-14 17:57 . 2008-10-14 17:58 d——– C:\Program Files\ABBYY FineReader 6.0 Sprint
2008-10-14 17:57 . 2008-10-14 17:57 d——– C:\Documents and Settings\All Users\Application Data\ArcSoft
2008-10-14 17:56 . 2008-10-14 17:57 d——– C:\Program Files\Common Files\ArcSoft
2008-10-14 17:56 . 2008-10-21 21:55 d——– C:\Documents and Settings\Compaq_Owner\Application Data\ArcSoft
2008-10-14 17:56 . 2004-12-07 10:11 258,352 –a—— C:\WINDOWS\system32\unicows.dll
2008-10-14 17:56 . 1995-08-01 04:44 212,480 –a—— C:\WINDOWS\PCDLIB32.DLL
2008-10-14 17:56 . 2006-10-20 16:11 126,976 –a—— C:\WINDOWS\system32\PhotoImpression Slideshow.scr
2008-10-14 17:56 . 2005-02-23 14:58 11,776 –a—— C:\WINDOWS\system32\drivers\afc.sys
2008-10-14 17:55 . 2008-10-14 17:56 d——– C:\WINDOWS\system32\PhotoImpression Slideshow
2008-10-14 17:55 . 2008-10-14 17:57 d——– C:\Program Files\ArcSoft
2008-10-14 17:54 . 2008-10-14 17:54 d——– C:\Documents and Settings\All Users\Application Data\EPSON
2008-10-14 17:54 . 2004-08-03 22:58 15,104 –a—— C:\WINDOWS\system32\drivers\usbscan.sys
2008-10-14 17:54 . 2004-08-03 22:58 15,104 –a—— C:\WINDOWS\system32\dllcache\usbscan.sys
2008-10-14 17:52 . 2008-10-14 17:52 d——– C:\Documents and Settings\Compaq_Owner\Application Data\InstallShield
2008-10-14 17:50 . 2008-10-14 18:09 d——– C:\Program Files\epson
2008-10-14 17:50 . 2007-04-18 00:00 67,072 –a—— C:\WINDOWS\system32\escwiad.dll
2008-10-14 17:49 . 2008-10-14 18:09 44 –a—— C:\WINDOWS\EPSCX9400Fax.ini
2008-10-13 15:53 . 2008-10-13 15:31 102,664 –a—— C:\WINDOWS\system32\drivers\tmcomm.sys
2008-10-13 14:48 . 2008-10-21 19:49 d——– C:\Documents and Settings\Compaq_Owner\.housecall6.6
2008-09-27 02:10 . 2008-09-27 02:10 d——– C:\Program Files\ZoneAlarmSB
2008-09-27 02:08 . 2008-09-27 02:08 d——– C:\Documents and Settings\All Users\Application Data\MailFrontier
2008-09-26 12:07 . 2008-09-26 12:07 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-09-26 12:07 . 2008-09-26 12:07 1,409 –a—— C:\WINDOWS\QTFont.for
2008-09-26 01:00 . 2008-09-26 01:09 d——– C:\Program Files\Windows Live Safety Center

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-22 21:53 ——— d—–w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-10-22 03:05 ——— d—–w C:\Documents and Settings\Compaq_Owner\Application Data\WeatherBug
2008-10-22 02:55 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-10-21 05:15 ——— d—–w C:\Program Files\Coupons
2008-10-21 01:27 ——— d—–w C:\Program Files\Java
2008-10-19 17:35 18,906 —-a-w C:\Documents and Settings\Compaq_Owner\Application Data\wklnhst.dat
2008-10-18 07:50 ——— d—–w C:\Documents and Settings\All Users\Application Data\avg8
2008-09-02 20:28 ——— d—–w C:\Program Files\Microsoft Silverlight
2006-05-05 21:50 22 –sha-w C:\WINDOWS\SMINST\HPCD.sys
.

((((((((((((((((((((((((((((( snapshot@2008-10-22_19.13.28.70 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-10-23 00:56:05 16,384 —-atw C:\WINDOWS\Temp\Perflib_Perfdata_1ac.dat
+ 2008-10-23 00:56:02 16,384 —-atw C:\WINDOWS\Temp\Perflib_Perfdata_6f4.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 15360]
"Weather"="C:\PROGRA~1\AWS\WEATHE~1\Weather.exe" [2006-04-07 1343488]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-09-10 68856]
"EPSON Stylus CX9400Fax Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICFA.EXE" [2007-03-23 182272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2005-07-22 237568]
"HPBootOp"="C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2005-11-09 249856]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPwuSchd2.exe" [2005-02-17 49152]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-02-17 180269]
"FLMK08KB"="C:\Program Files\Muiltmedia keyboard utility\1.1\MMKEYBD.EXE" [2006-05-23 207360]
"FLMOFFICE4DMOUSE"="C:\Program Files\Browser Mouse\mouse32a.exe" [2006-05-23 360448]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 282624]
"ArcSoft Connection Service"="C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2008-07-04 109056]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 919016]
"SunJavaUpdateSched"="C:\Program Files\Java\jre6\bin\jusched.exe" [2008-10-20 136600]
"Propel Accelerator"="C:\Program Files\FidelityNetworks fidnet Dominator\trayctl.exe" [2005-01-27 28672]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 29696]
Compaq Connections.lnk - C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe [2006-02-17 36903]
Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2007-09-10 126136]
ymetray.lnk - C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe [2007-01-26 54776]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2006-12-20 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2007-04-19 12:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\WINDOWS\\system32\\fxsclnt.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Yahoo!\\UPnP\\yupnpsrv.exe"=
"C:\\Program Files\\Yahoo!\\Yahoo! Music Jukebox\\YahooMusicEngine.exe"=
"C:\\Program Files\\Compaq Connections\\5577497\\Program\\Compaq Connections.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]
R2 ACDaemon;ArcSoft Connect Daemon;C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [2008-07-03 109056]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
R2 JavaQuickStarterService;Java Quick Starter;C:\Program Files\Java\jre6\bin\jqs.exe [2008-10-20 152984]
.
Contents of the 'Scheduled Tasks' folder

2008-10-16 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 14:57]

2008-10-22 C:\WINDOWS\Tasks\User_Feed_Synchronization-{0AFED55C-6B93-4A2C-A732-8035DDA63C3A}.job
- C:\WINDOWS\system32\msfeedssync.exe [2006-10-17 13:58]
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-22 19:56:47
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

PROCESS: C:\WINDOWS\system32\lsass.exe
-> C:\Program Files\FidelityNetworks fidnet Dominator\prplsf.dll
.
———————— Other Running Processes ————————
.
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Muiltmedia keyboard utility\1.1\KBDAP32A.EXE
C:\Program Files\FidelityNetworks fidnet Dominator\PropelAC.exe
.
**************************************************************************
.
Completion time: 2008-10-22 20:03:53 - machine was rebooted
ComboFix-quarantined-files.txt 2008-10-23 01:03:44
ComboFix2.txt 2008-10-23 00:14:13

Pre-Run: 140,478,255,104 bytes free
Post-Run: 140,483,194,880 bytes free

176 — E O F — 2008-09-22 16:48:17

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:09:12 PM, on 10/22/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Browser Mouse\mouse32a.exe
C:\Program Files\Muiltmedia keyboard utility\1.1\KbdAp32A.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\AWS\WEATHE~1\Weather.exe
C:\Program Files\FidelityNetworks fidnet Dominator\PropelAC.exe
C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe
C:\WINDOWS\explorer.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
c:\windows\system\hpsysdrv.exe
C:\Documents and Settings\Compaq_Owner\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.excite.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:8080
O2 - BHO: Winzy Assistant - {039AF219-4B6F-4AC6-8763-7BF5BBD481B3} - C:\Program Files\Winzy\Winzy IE Toolbar\winzyietoolbar.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: IE_PopupBlocker Class - {656EC4B7-072B-4698-B504-2A414C1F0037} - C:\Program Files\FidelityNetworks fidnet Dominator\prpl_IePopupBlocker.dll
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: hpWebHelper Class - {AAAE832A-5FFF-4661-9C8F-369692D1DCB9} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\WebHelper.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: Winzy Toolbar - {5B327C15-C1B7-4d1f-A5B7-A2F5FFDF2881} - C:\Program Files\Winzy\Winzy IE Toolbar\winzyietoolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [FLMK08KB] C:\Program Files\Muiltmedia keyboard utility\1.1\MMKEYBD.EXE
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Browser Mouse\mouse32a.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Propel Accelerator] "C:\Program Files\FidelityNetworks fidnet Dominator\trayctl.exe" /STARTUPLAUNCH
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Weather] C:\PROGRA~1\AWS\WEATHE~1\Weather.exe 1
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [EPSON Stylus CX9400Fax Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICFA.EXE /FU "C:\WINDOWS\TEMP\E_SBF.tmp" /EF "HKCU"
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Compaq Connections.lnk = C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: ymetray.lnk = C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Allow pop-ups from this site - C:\Program Files\FidelityNetworks fidnet Dominator\pac-addwl.html
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: Refresh Pa&ge with Full Quality - C:\Program Files\FidelityNetworks fidnet Dominator\pac-page.html
O8 - Extra context menu item: Refresh Pi&cture with Full Quality - C:\Program Files\FidelityNetworks fidnet Dominator\pac-image.html
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://www.bankrollbucks.com
O15 - Trusted Zone: http://www.ellabugclicks.info
O15 - Trusted Zone: http://support.f-secure.com
O15 - Trusted Zone: http://subs.geekstogo.com
O15 - Trusted Zone: http://survey10.greenfieldonline.com
O15 - Trusted Zone: http://survey.otxresearch.com
O15 - Trusted Zone: http://*.paidthefastest.com
O15 - Trusted Zone: http://www2.quickrewards.net
O15 - Trusted Zone: http://www.sunshineclicks.com
O15 - Trusted Zone: http://ups.surveyrouter.com
O15 - Trusted Zone: http://*.thecashsaloon.com
O15 - Trusted Zone: http://forums.whatthetech.com
O15 - Trusted Zone: http://www.whatthetech.com
O16 - DPF: {02A2D714-433E-46E4-B217-7C3B3FAF8EAE} (ScrabbleCubes Control) - http://www.worldwinner.com/games/v46/scrab…rabblecubes.cab
O16 - DPF: {1D082E71-DF20-4AAF-863B-596428C49874} (TPIR Control) - http://www.worldwinner.com/games/v50/tpir/tpir.cab
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {3492AC37-16C6-42FC-A2CA-439E9CFDACDF} - http://falcon.web2server.info/install/1.4/ie/install.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/…lscbase5036.cab
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://72.32.179.44/filter/cameraviewer/isetup.cab
O16 - DPF: {9732FB42-C321-11D1-836F-00A0C993F125} (mhLabel Class) - http://www.pcpitstop.com/mhLbl.cab
O16 - DPF: {A52FBD2B-7AB3-4F6B-90E3-91C772C5D00F} (WoF Control) - http://www.worldwinner.com/games/v57/wof/wof.cab
O16 - DPF: {A922B6AB-3B87-11D3-B3C2-0008C7DA6CB9} (InetDownload Class) - https://media.pineconeresearch.com/ActiveX/…loadcontrol.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {CF969D51-F764-4FBF-9E90-475248601C8A} (FamilyFeud Control) - http://www.worldwinner.com/games/v47/famil…/familyfeud.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

–
End of file - 12753 bytes

i will run malwarebyes again . so far all works , just have to tinker with outlook express connection settings- not a biggy though.

Tomk

Post #21October 23, 2008, 2:31 AM UTC

peachjuteux, Please post the log when you get it.

peachjuteux

Post #22October 23, 2008, 3:19 AM UTC last edited October 23, 2008, 3:34 AM UTC

Malwarebytes' Anti-Malware 1.29 Database version: 1304 Windows 5.1.2600 Service Pack 2 10/22/2008 10:15:54 PM mbam-log-2008-10-22 (22-15-54).txt Scan type: Quick Scan Objects scanned: 45568 Time elapsed: 5 minute(s), 1 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 2 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{101e9aeb-9fc1-4eb4-a72e-c3f0a5f8462e}\NameServer (Trojan.DNSChanger) -> Data: 85.255.115.59 85.255.112.126 -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{101e9aeb-9fc1-4eb4-a72e-c3f0a5f8462e}\NameServer (Trojan.DNSChanger) -> Data: 85.255.115.59 85.255.112.126 -> Quarantined and deleted successfully. Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) going to do the reboot now and see if it comes back again. after thr restart Malwarebytes' Anti-Malware 1.29 Database version: 1304 Windows 5.1.2600 Service Pack 2 10/22/2008 10:30:00 PM mbam-log-2008-10-22 (22-30-00).txt Scan type: Quick Scan Objects scanned: 45445 Time elapsed: 4 minute(s), 33 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 2 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{101e9aeb-9fc1-4eb4-a72e-c3f0a5f8462e}\NameServer (Trojan.DNSChanger) -> Data: 85.255.115.59 85.255.112.126 -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{101e9aeb-9fc1-4eb4-a72e-c3f0a5f8462e}\NameServer (Trojan.DNSChanger) -> Data: 85.255.115.59 85.255.112.126 -> Quarantined and deleted successfully. Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) it comes back.

Tomk

Post #23October 23, 2008, 4:53 AM UTC

peachjuteux,

OK. Let's gang up on it.

Restart Lop S&D

This time choose Option 3 (Fix - Hosts)
Don't close the window during suppression!
Post the log which is created: (%SystemDrive%\lopR.txt)

Then

Download and Run FixWarout

Download FixWareout by LonnyRJones from the link below and save it to your desktop
http://downloads.subratam.org/Fixwareout.exe
Launch Fixwareout.exe, and follow the prompts. Make sure Run fixit is checked.
You will be asked to reboot your computer, do so.
Your system may take longer than usual to load; this is normal.
After the reboot there will be a log located at c:\fixwareout\report.txt. Include this log in your next reply.

Next

Download and Run SmitfraudFix
Please download SmitfraudFix (by S!Ri)
Extract the content (a folder named SmitfraudFix) to your Desktop.

Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply.

peachjuteux

Post #24October 23, 2008, 5:47 AM UTC

ok here we go:

——————–\\ Lop S&D 4.2.4-6 XP/Vista

Microsoft Windows XP Home Edition ( v5.1.2600 ) Service Pack 2
X86-based PC ( Uniprocessor Free : AMD Sempron™ Processor 3500+ )
BIOS : Phoenix - AwardBIOS v6.00PG
USER : Compaq_Owner ( Administrator )
BOOT : Normal boot
Antivirus : avast! antivirus 4.8.1229 [VPS 081022-1] 4.8.1229 (Activated)
Firewall : ZoneAlarm Firewall 7.0.483.000 (Activated)
C:\ (Local Disk) - NTFS - Total : 141 Go Free : 130 Go
D:\ (Local Disk) - FAT32 - Total : 7 Go Free : 0 Go
E:\ (CD or DVD)
F:\ (CD or DVD)
G:\ (USB)
H:\ (USB)
I:\ (USB)
J:\ (USB)
L:\ (USB)

"C:\Lop SD" ( MAJ : 20-10-2008|20:35 )
Option : [3] ( Thu 10/23/2008| 0:04 )

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

——————–\\ Listing folders in APPLIC~1

[05/12/2008|11:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Adobe
[05/05/2006|09:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ AOL Downloads
[09/12/2007|09:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Apple
[03/13/2007|12:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Apple Computer
[10/22/2008|10:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ ArcSoft
[10/18/2008|02:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ avg8
[02/17/2006|10:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ CyberLink
[10/14/2008|05:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ EPSON
[02/19/2008|04:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Google
[10/22/2008|04:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Google Updater
[05/24/2008|11:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Grisoft
[02/17/2006|10:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ InstallShield
[02/17/2006|10:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Intuit
[09/27/2008|02:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ MailFrontier
[10/19/2008|12:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Malwarebytes
[05/23/2006|08:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Microsoft
[05/05/2006|10:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ QuickTime
[06/26/2007|09:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ RoboForm
[02/17/2006|10:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ SBSI
[02/17/2006|10:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Sonic
[03/26/2008|10:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ SUPERAntiSpyware.com
[06/02/2006|05:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Symantec
[04/29/2006|10:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Windows Genuine Advantage
[11/22/2006|05:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ WinZip
[05/17/2008|12:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Yahoo

[05/30/2008|06:25] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Adobe
[05/12/2008|11:20] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ AdobeUM
[03/13/2007|12:41] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Apple Computer
[10/21/2008|09:55] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ ArcSoft
[04/29/2006|09:33] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ CyberLink
[10/14/2008|06:19] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ EPSON
[10/22/2008|04:11] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ FidelityNetworks
[02/19/2008|04:36] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Google
[05/02/2006|08:31] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Help
[04/30/2006|05:49] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ HP
[04/29/2006|02:42] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ HPQ
[12/06/2005|05:18] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Identities
[10/14/2008|05:52] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ InstallShield
[02/17/2006|10:56] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Intuit
[04/29/2006|09:09] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Lavasoft
[04/29/2006|09:43] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Leadertech
[03/12/2007|09:25] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Macromedia
[10/19/2008|12:27] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Malwarebytes
[10/18/2008|02:50] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Microsoft
[04/30/2008|10:26] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Move Networks
[11/26/2007|05:27] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Mozilla
[07/25/2007|01:12] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ MySpace
[07/06/2007|12:51] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Netscape
[04/29/2006|03:44] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Real
[04/29/2006|09:45] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Sonic
[05/10/2006|06:05] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Sun
[03/26/2008|10:53] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ SUPERAntiSpyware.com
[04/29/2006|10:59] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Template
[11/05/2007|07:09] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ U3
[10/21/2008|10:05] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ WeatherBug
[05/17/2008|05:00] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ Yahoo!

[12/06/2005|05:18] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Identities
[02/17/2006|10:56] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Intuit
[10/14/2007|06:37] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Macromedia
[02/17/2006|11:23] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Microsoft
[02/17/2006|10:42] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Real

[02/23/2007|01:37] C:\DOCUME~1\LOCALS~1\APPLIC~1\ Help
[10/18/2008|02:50] C:\DOCUME~1\LOCALS~1\APPLIC~1\ Microsoft

[10/18/2008|02:50] C:\DOCUME~1\NETWOR~1\APPLIC~1\ Microsoft

——————–\\ Scheduled Tasks located in C:\WINDOWS\Tasks

[10/22/2008 11:53 PM][–ah—–] C:\WINDOWS\tasks\User_Feed_Synchronization-{0AFED55C-6B93-4A2C-A732-8035DDA63C3A}.job
[10/16/2008 03:39 PM][–a——] C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[10/22/2008 10:46 PM][–ah—–] C:\WINDOWS\tasks\SA.DAT
[08/03/2004 11:00 PM][-rah—–] C:\WINDOWS\tasks\desktop.ini

——————–\\ Listing Folders in C:\Program Files

[10/14/2008|05:58] C:\Program Files\ ABBYY FineReader 6.0 Sprint
[02/17/2006|10:50] C:\Program Files\ Adobe
[10/18/2008|02:58] C:\Program Files\ Alwil Software
[09/12/2007|09:00] C:\Program Files\ Apple Software Update
[10/14/2008|05:57] C:\Program Files\ ArcSoft
[02/17/2006|10:33] C:\Program Files\ ATI Technologies
[05/24/2008|11:10] C:\Program Files\ AVG
[04/29/2006|10:05] C:\Program Files\ AWS
[05/01/2006|02:34] C:\Program Files\ Belarc
[05/23/2006|10:10] C:\Program Files\ Browser Mouse
[07/26/2007|03:18] C:\Program Files\ CCleaner
[10/22/2008|07:53] C:\Program Files\ Common Files
[02/17/2006|10:59] C:\Program Files\ Compaq Connections
[12/05/2005|07:33] C:\Program Files\ ComPlus Applications
[02/17/2006|10:35] C:\Program Files\ CONEXANT
[10/21/2008|12:15] C:\Program Files\ Coupons
[11/10/2006|08:28] C:\Program Files\ DAP
[10/14/2008|06:09] C:\Program Files\ epson
[11/03/2006|07:21] C:\Program Files\ e-Watch
[04/29/2006|08:17] C:\Program Files\ FamilySearch
[10/22/2008|04:13] C:\Program Files\ FidelityNetworks fidnet Dominator
[07/29/2008|07:41] C:\Program Files\ Google
[05/24/2008|11:10] C:\Program Files\ Grisoft
[02/17/2006|11:20] C:\Program Files\ Hewlett-Packard
[02/17/2006|10:49] C:\Program Files\ HP
[02/17/2006|10:43] C:\Program Files\ HP Rhapsody
[10/21/2008|09:55] C:\Program Files\ InstallShield Installation Information
[10/13/2008|03:53] C:\Program Files\ Internet Explorer
[06/03/2006|02:57] C:\Program Files\ IrfanView
[10/20/2008|08:27] C:\Program Files\ Java
[04/29/2006|09:09] C:\Program Files\ Lavasoft
[10/05/2007|08:35] C:\Program Files\ LimeWire
[10/19/2008|12:27] C:\Program Files\ Malwarebytes' Anti-Malware
[09/22/2008|11:48] C:\Program Files\ Messenger
[12/06/2005|05:19] C:\Program Files\ microsoft frontpage
[05/10/2006|10:01] C:\Program Files\ Microsoft Money 2006
[05/16/2006|04:31] C:\Program Files\ Microsoft Office
[09/02/2008|03:28] C:\Program Files\ Microsoft Silverlight
[02/17/2006|10:53] C:\Program Files\ Microsoft Visual Studio
[02/17/2006|10:52] C:\Program Files\ Microsoft Works
[12/06/2005|05:19] C:\Program Files\ Movie Maker
[10/22/2008|06:22] C:\Program Files\ Mozilla Firefox
[06/22/2008|10:28] C:\Program Files\ MSN
[02/17/2006|10:41] C:\Program Files\ MSN Encarta Standard
[12/06/2005|05:19] C:\Program Files\ MSN Gaming Zone
[11/15/2006|02:06] C:\Program Files\ MSXML 4.0
[05/23/2006|10:10] C:\Program Files\ Muiltmedia keyboard utility
[02/17/2006|10:42] C:\Program Files\ music_now
[01/31/2008|12:14] C:\Program Files\ MySpace
[05/01/2006|05:01] C:\Program Files\ MyWebSearchWB
[12/06/2005|05:20] C:\Program Files\ NetMeeting
[02/17/2006|10:42] C:\Program Files\ Netscape
[02/17/2006|11:07] C:\Program Files\ Online Services
[11/17/2007|01:58] C:\Program Files\ Outlook Express
[02/17/2006|11:03] C:\Program Files\ PC-Doctor 5 for Windows
[02/17/2006|11:03] C:\Program Files\ PC-Doctor for DOS
[07/13/2007|01:28] C:\Program Files\ Quicken
[07/04/2007|02:08] C:\Program Files\ QuickTime
[05/17/2008|12:36] C:\Program Files\ RCA
[04/30/2006|10:53] C:\Program Files\ Real
[12/19/2007|05:26] C:\Program Files\ Savings Bond Wizard
[06/26/2007|09:20] C:\Program Files\ Siber Systems
[04/29/2006|06:26] C:\Program Files\ Sierra On-Line
[02/17/2006|10:48] C:\Program Files\ Sonic
[12/16/2006|09:32] C:\Program Files\ SpeedFan
[07/27/2008|08:04] C:\Program Files\ Stella
[03/26/2008|10:53] C:\Program Files\ SUPERAntiSpyware
[01/07/2008|08:03] C:\Program Files\ Trillian
[12/05/2005|07:33] C:\Program Files\ Uninstall Information
[04/29/2006|09:31] C:\Program Files\ WildTangent
[09/26/2008|01:09] C:\Program Files\ Windows Live Safety Center
[04/29/2006|01:24] C:\Program Files\ Windows Media Player
[12/06/2005|05:20] C:\Program Files\ Windows NT
[12/05/2005|07:33] C:\Program Files\ WindowsUpdate
[07/09/2007|05:50] C:\Program Files\ Winzy
[12/06/2005|05:20] C:\Program Files\ xerox
[06/24/2008|11:36] C:\Program Files\ Yahoo!
[10/15/2008|01:29] C:\Program Files\ Zone Labs
[09/27/2008|02:10] C:\Program Files\ ZoneAlarmSB

——————–\\ Listing Folders in C:\Program Files\Common Files

[05/12/2008|11:22] C:\Program Files\Common Files\ Adobe
[10/14/2008|05:57] C:\Program Files\Common Files\ ArcSoft
[02/17/2006|10:38] C:\Program Files\Common Files\ HP
[05/24/2006|04:40] C:\Program Files\Common Files\ InstallShield
[02/17/2006|10:56] C:\Program Files\Common Files\ Intuit
[02/17/2006|10:49] C:\Program Files\Common Files\ LightScribe
[05/24/2008|11:09] C:\Program Files\Common Files\ Microsoft Shared
[12/06/2005|05:19] C:\Program Files\Common Files\ MSSoap
[12/06/2005|05:19] C:\Program Files\Common Files\ ODBC
[02/17/2006|10:56] C:\Program Files\Common Files\ Palo Alto Software
[02/17/2006|10:42] C:\Program Files\Common Files\ Real
[12/06/2005|05:19] C:\Program Files\Common Files\ Services
[02/17/2006|10:43] C:\Program Files\Common Files\ Sonic Shared
[12/06/2005|05:19] C:\Program Files\Common Files\ SpeechEngines
[05/17/2008|12:44] C:\Program Files\Common Files\ SureThing Shared
[06/02/2006|05:17] C:\Program Files\Common Files\ Symantec Shared
[06/13/2007|04:04] C:\Program Files\Common Files\ System
[02/17/2006|10:48] C:\Program Files\Common Files\ TiVo Shared
[03/26/2008|10:52] C:\Program Files\Common Files\ Wise Installation Wizard
[02/17/2006|10:42] C:\Program Files\Common Files\ xing shared

——————–\\ Process

( 50 Processes )

… OK !

——————–\\ Searching with S_Lop

No Lop folder found !

——————–\\ Searching for Lop Files - Folders

No Lop folder found !

——————–\\ Searching within the Registry

….. OK !

——————–\\ Checking the Hosts file

Hosts file CLEAN

——————–\\ Searching for hidden files with Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-23 00:07:12
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes …
scanning hidden files …
scan completed successfully
hidden processes: 0
hidden files: 0

——————–\\ Searching for other infections

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\..\{101E9AEB-9FC1-4EB4-A72E-C3F0A5F8462E}]
NameServer REG_SZ 85.255.115.59 85.255.112.126
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\..\{101E9AEB-9FC1-4EB4-A72E-C3F0A5F8462E}]
NameServer REG_SZ 85.255.115.59 85.255.112.126
==> WAREOUT <==

[F:2][D:2]-> C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp
[F:14][D:0]-> C:\DOCUME~1\COMPAQ~1\Cookies
[F:1396][D:4]-> C:\DOCUME~1\COMPAQ~1\LOCALS~1\TEMPOR~1\content.IE5

1 - "C:\Lop SD\LopR_1.txt" - Wed 10/22/2008|13:58 - Option : [1]
2 - "C:\Lop SD\LopR_2.txt" - Thu 10/23/2008| 0:08 - Option : [3]

——————–\\ Scan completed at 0:08:33
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Username "Compaq_Owner" - 10/23/2008 0:11:28 [Fixwareout edited 9/01/2007]

~~~~~ Prerun check

HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{101E9AEB-9FC1-4EB4-A72E-C3F0A5F8462E}
"nameserver"="85.255.115.59"
Successfully flushed the DNS Resolver Cache.
System was rebooted successfully.

~~~~~ Postrun check
HKLM\SOFTWARE\~\Winlogon\ "System"=""
….
….
~~~~~ Misc files.
….
~~~~~ Checking for older varients.
….

~~~~~ Current runs (hklm hkcu "run" Keys Only)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
"Recguard"="C:\\WINDOWS\\SMINST\\RECGUARD.EXE"
"HPBootOp"="\"C:\\Program Files\\Hewlett-Packard\\HP Boot Optimizer\\HPBootOp.exe\" /run"
"HP Software Update"=hex(2):43,3a,5c,50,72,6f,67,72,61,6d,20,46,69,6c,65,73,5c,\
48,50,5c,48,50,20,53,6f,66,74,77,61,72,65,20,55,70,64,61,74,65,5c,48,50,77,\
75,53,63,68,64,32,2e,65,78,65,00
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"FLMK08KB"="C:\\Program Files\\Muiltmedia keyboard utility\\1.1\\MMKEYBD.EXE"
"FLMOFFICE4DMOUSE"="C:\\Program Files\\Browser Mouse\\mouse32a.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"ArcSoft Connection Service"="C:\\Program Files\\Common Files\\ArcSoft\\Connection Service\\Bin\\ACDaemon.exe"
"ZoneAlarm Client"="\"C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe\""
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre6\\bin\\jusched.exe\""
"Propel Accelerator"="\"C:\\Program Files\\FidelityNetworks fidnet Dominator\\trayctl.exe\" /STARTUPLAUNCH"
"avast!"="C:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"Weather"="C:\\PROGRA~1\\AWS\\WEATHE~1\\Weather.exe 1"
"swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\GoogleToolbarNotifier.exe"
"EPSON Stylus CX9400Fax Series"="C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_FATICFA.EXE /FU \"C:\\WINDOWS\\TEMP\\E_SBF.tmp\" /EF \"HKCU\""
….
Hosts file was reset, If you use a custom hosts file please replace it…
~~~~~ End report ~~~~~

SmitFraudFix v2.366

Scan done at 0:37:12.53, Thu 10/23/2008
Run from C:\Documents and Settings\Compaq_Owner\Desktop\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Muiltmedia keyboard utility\1.1\KbdAp32A.exe
C:\Program Files\Browser Mouse\mouse32a.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\AWS\WEATHE~1\Weather.exe
C:\Program Files\FidelityNetworks fidnet Dominator\PropelAC.exe
C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
c:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Compaq_Owner

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Compaq_Owner\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Start Menu

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\COMPAQ~1\FAVORI~1

»»»»»»»»»»»»»»»»»»»»»»»» Desktop

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys

»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"

»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, following keys are not inevitably infected!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, following keys are not inevitably infected!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, following keys are not inevitably infected!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix
!!!Attention, following keys are not inevitably infected!!!

AntiXPVSTFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» RK

»»»»»»»»»»»»»»»»»»»»»»»» DNS

Your computer may be victim of a DNS Hijack: 85.255.x.x detected !

Description: WAN (PPP/SLIP) Interface
DNS Server Search Order: 85.255.115.59
DNS Server Search Order: 85.255.112.126

HKLM\SYSTEM\CCS\Services\Tcpip\..\{101E9AEB-9FC1-4EB4-A72E-C3F0A5F8462E}: NameServer=85.255.115.59 85.255.112.126
HKLM\SYSTEM\CS1\Services\Tcpip\..\{101E9AEB-9FC1-4EB4-A72E-C3F0A5F8462E}: NameServer=85.255.115.59 85.255.112.126

»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection

»»»»»»»»»»»»»»»»»»»»»»»» End

Tomk

Post #25October 23, 2008, 5:58 AM UTC

peachjuteux,

Well, I think I finally found it.

Now let's see if we can make it go away.

Go into Control Panel –>Network Connections.
Right click on your connection
and click Properties.
On the Properties page, highlight Internet Protocol(TCP/IP)
Click Properties. This will bring up another page.
Select Obtain DNS Server Automatically.
Click the ok button. The page will close.
Press ok on the page in front of you.
Restart the computer.

Then please run Malwarebytes again and post the log.

peachjuteux

Post #26October 23, 2008, 6:55 AM UTC last edited October 23, 2008, 7:30 AM UTC

oh thank you so much. it looks like its gone . and no errors - thank you so much i just wanted to ad that everything is working great now- i even got the windows updates finally - thansk you again so much. Malwarebytes' Anti-Malware 1.30 Database version: 1306 Windows 5.1.2600 Service Pack 2 10/23/2008 1:53:19 AM mbam-log-2008-10-23 (01-53-19).txt Scan type: Quick Scan Objects scanned: 44973 Time elapsed: 4 minute(s), 14 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)

Tomk

Post #27October 23, 2008, 2:08 PM UTC

peachjuteux,

Log looks good

Time for some housekeeping

Click START then RUN
Now type Combofix /u in the runbox and click OK
Note the space between the X and the U, it needs to be there.
[external image: Posted Image]

The above procedure will:

Delete the following:
- ComboFix and its associated files and folders.
- VundoFix backups, if present
- The C:\Deckard folder, if present
- The C:_OtMoveIt folder, if present
Reset the clock settings.
Hide file extensions, if required.
Hide System/Hidden files, if required.
Reset System Restore.

Please re-enable any security that was disabled.

Make sure you have an Internet Connection.
Download OTCleanIt to your desktop and run it
A list of tool components used in the Cleanup of malware will be downloaded.
If your Firewall or Real Time protection attempts to block OTCleanUp to reach the Internet, please allow the application to do so.
Click Yes to beging the Cleanup process and remove these components, including this application.
You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.

Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week
(Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

Use a Firewall - I can not stress how important it is that you use a Firewall on your computer.
Without a firewall your computer is succeptible to being hacked and taken over.
I am very serious about this and see it happen almost every day with my clients.
Simply using a Firewall in its default configuration can lower your risk greatly.

For a tutorial on Firewalls and a listing of some available ones see the link below:

Understanding and Using Firewalls

Keep Microsoft Windows Updated - This will ensure your computer has always the latest security updates available installed on your computer. The easiest way to do this is to turn on Automatic Updates. Do this by:

From your desktop, right-click on My Computer,
click on Properties
Select the Automatic Updates tab
Click on Automatic
Click on Apply button
Click on OK to exit.

If there are new updates to install, install them immediately, until there are no more critical updates.

Install SpywareBlaster - SpywareBlaster will add a large list of programs and sites into your Internet Explorer
settings that will protect you from running and downloading known malicious programs.

A tutorial on installing & using this product can be found here:

Using SpywareBlaster to protect your computer from Spyware and Malware

Download and install the free version of WinPatrol - This program protects your computer in a variety of ways and will work well with your existing security software.
Winpatrol

Update all these programs regularly - Make sure you update all the programs I have listed regularly.
Without regular updates you WILL NOT be protected when new malicious programs are released.

Only run one Anti-Virus and Firewall program.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein

Also: "How to prevent malware"
by miekiemoes

Please respond back that you understand the above and let me know if you have any questions. Otherwise, this thread will be closed Resolved.

peachjuteux

Post #28October 23, 2008, 11:55 PM UTC

ok all done- i understand . i have a firewall up- adn avast up to date and read through everything in your post- im headed to the last thing on the list now- spywareblaster. thansk so much.

Tomk

Post #29October 24, 2008, 12:03 AM UTC

peachjuteux, You are very welcome. That was a tough one. Glad we could help. Good Luck and Be Well.

Tomk

Post #30October 24, 2008, 12:20 AM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] trojan. DNS Changer - wont go away

✨ Ask AI

Ask AI