What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] HTML_lFRAME.HT

11 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #32
Hi,

Heres the log.

ComboFix 08-11-04.02 - Scott 2008-11-05 21:14:03.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.996 [GMT -6:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\AutoRun.inf

.
((((((((((((((((((((((((( Files Created from 2008-10-06 to 2008-11-06 )))))))))))))))))))))))))))))))
.

2008-11-04 09:53 . 2008-11-04 09:53 d——– c:\users\Scott\AppData\Roaming\Malwarebytes
2008-11-04 09:53 . 2008-11-04 09:53 d——– c:\users\All Users\Malwarebytes
2008-11-04 09:53 . 2008-11-04 09:53 d——– c:\programdata\Malwarebytes
2008-11-04 09:53 . 2008-11-04 09:53 d——– c:\program files\Malwarebytes' Anti-Malware
2008-11-04 09:53 . 2008-10-22 16:10 38,496 –a—— c:\windows\System32\drivers\mbamswissarmy.sys
2008-11-04 09:53 . 2008-10-22 16:10 15,504 –a—— c:\windows\System32\drivers\mbam.sys
2008-10-30 19:33 . 2008-10-30 19:33 d——– c:\program files\SystemRequirementsLab
2008-10-30 19:25 . 2008-10-30 19:26 225,722,395 –a—— c:\windows\MEMORY.DMP
2008-10-30 16:25 . 2008-10-30 16:25 d——– c:\users\Scott\AppData\Roaming\Roxio
2008-10-30 08:40 . 2008-10-30 08:40 d——– c:\users\All Users\Trymedia
2008-10-30 08:40 . 2008-10-30 08:40 d——– c:\programdata\Trymedia
2008-10-29 12:11 . 2008-08-11 21:39 443,392 –a—— c:\windows\System32\win32spl.dll
2008-10-29 12:11 . 2008-09-17 22:56 147,456 –a—— c:\windows\System32\Faultrep.dll
2008-10-29 12:11 . 2008-09-17 22:56 125,952 –a—— c:\windows\System32\wersvc.dll
2008-10-23 15:48 . 2008-08-05 03:49 428,544 –a—— c:\windows\System32\EncDec.dll
2008-10-23 15:48 . 2008-08-05 03:49 293,376 –a—— c:\windows\System32\psisdecd.dll
2008-10-23 15:48 . 2008-08-05 03:48 217,088 –a—— c:\windows\System32\psisrndr.ax
2008-10-23 15:48 . 2008-08-05 03:48 177,664 –a—— c:\windows\System32\mpg2splt.ax
2008-10-23 15:48 . 2008-08-05 03:48 80,896 –a—— c:\windows\System32\MSNP.ax
2008-10-14 14:20 . 2008-09-17 20:16 2,032,640 –a—— c:\windows\System32\win32k.sys
2008-10-14 14:19 . 2008-09-17 23:09 3,601,464 –a—— c:\windows\System32\ntkrnlpa.exe
2008-10-14 14:19 . 2008-09-17 23:09 3,549,240 –a—— c:\windows\System32\ntoskrnl.exe
2008-10-14 14:19 . 2008-08-26 19:06 288,768 –a—— c:\windows\System32\drivers\srv.sys
2008-10-14 14:18 . 2008-10-01 19:32 1,383,424 –a—— c:\windows\System32\mshtml.tlb
2008-10-14 14:18 . 2008-10-01 21:49 827,392 –a—— c:\windows\System32\wininet.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-04 15:26 ——— d—–w c:\program files\HP
2008-11-04 01:08 ——— d—–w c:\program files\PokerStars
2008-11-04 00:49 ——— d—a-w c:\programdata\TEMP
2008-11-02 22:45 55,117 —-a-w c:\users\Scott\AppData\Roaming\nvModes.dat
2008-10-30 22:35 ——— d—–w c:\users\Scott\AppData\Roaming\muvee Technologies
2008-10-30 22:25 ——— d—–w c:\programdata\Sonic
2008-10-26 13:48 ——— d—–w c:\programdata\Symantec
2008-10-26 13:48 ——— d—–w c:\program files\Common Files\Symantec Shared
2008-10-22 22:21 21,248 —-a-w c:\windows\Help\OEM\scripts\HPScript.exe
2008-10-15 10:33 ——— d—–w c:\program files\Windows Mail
2008-10-15 03:25 ——— d—–w c:\programdata\Microsoft Help
2008-10-08 10:27 ——— d–h–w c:\program files\InstallShield Installation Information
2008-10-08 10:26 ——— d—–w c:\program files\Hewlett-Packard
2008-10-08 10:23 ——— d—–w c:\users\Scott\AppData\Roaming\Hewlett-Packard
2008-10-06 17:51 20,224 —-a-w c:\windows\Help\OEM\scripts\HC_checkMUI.dll
2008-09-21 13:11 0 —ha-w c:\windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2008-09-15 12:48 ——— d—–w c:\programdata\NVIDIA
2008-09-15 12:44 174 –sha-w c:\program files\desktop.ini
2008-09-15 12:35 ——— d—–w c:\program files\Windows Sidebar
2008-09-15 12:35 ——— d—–w c:\program files\Windows Photo Gallery
2008-09-15 12:35 ——— d—–w c:\program files\Windows Journal
2008-09-15 12:35 ——— d—–w c:\program files\Windows Defender
2008-09-15 12:35 ——— d—–w c:\program files\Windows Collaboration
2008-09-15 12:35 ——— d—–w c:\program files\Windows Calendar
2008-09-15 12:18 82,432 —-a-w c:\windows\System32\axaltocm.dll
2008-09-15 12:18 101,888 —-a-w c:\windows\System32\ifxcardm.dll
2008-09-15 12:07 ——— d—–w c:\programdata\Hewlett-Packard
2008-09-10 12:47 ——— d—–w c:\program files\Microsoft Works
2008-08-21 22:16 11,520 —-a-w c:\windows\Help\OEM\scripts\HCNetworkTest.exe
2008-08-15 00:06 478 —-a-w c:\users\Scott\AppData\Roaming\wklnhst.dat
2008-01-27 23:55 27,430 —-a-w c:\users\Vickki\AppData\Roaming\nvModes.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-04-19 484904]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"googletalk"="c:\users\Scott\AppData\Roaming\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]
"OE"="c:\program files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe" [2007-09-17 488712]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-01-12 827392]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2007-04-23 176128]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-02-13 159744]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-03-01 472776]
"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-10 317128]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784]
"UfSeAgnt.exe"="c:\program files\Trend Micro\Internet Security\UfSeAgnt.exe" [2008-07-29 1398024]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-08-20 150016]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-11-07 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-11-07 8534560]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-11-07 81920]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-06-16 75008]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2006-11-07 44128]

c:\users\Scott\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-07 101440]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-03-11 210520]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.NSVI"= nsvideo.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AutoUpdateDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{DDB79537-BE1B-49D8-9E35-865252F6818E}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{62DAD364-9054-4450-8B64-1E97F59A49D1}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{5BC58A37-88F1-48D7-8BE5-98236F326965}"= c:\program files\HP\QuickPlay\QP.exe:Quick Play
"{977244DC-0C6F-4602-9E5D-F53F4137696A}"= c:\program files\HP\QuickPlay\QPService.exe:Quick Play Resident Program
"{6B76B961-7BC3-47C4-B12A-42CF381A1E0A}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{05F6F3EF-B25C-4001-8372-FE26E6D1B328}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{097692B9-4521-4D1A-9F3E-8E0F924DCDB0}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{F238082B-3978-480D-B122-CF2A1C1231A2}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{C45F953C-C973-4D47-9B6F-8E3786D5C7A2}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{87A0D74F-F719-4D0B-9A9D-EDC91DA7E7E8}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{F5EDC70E-5EA9-4784-A169-53A0027D7A91}"= Disabled:UDP:c:\program files\MySpace\IM\MySpaceIM.exe:MySpaceIM
"{C15EF655-8A57-4F95-8A33-2BECC90D7D0F}"= Disabled:TCP:c:\program files\MySpace\IM\MySpaceIM.exe:MySpaceIM
"{27DF15C6-F70C-4F93-A401-A3FA49C1400D}"= c:\program files\HP\Digital Imaging\bin\hpqpse.exe:hpqpse.exe
"{910BEE01-C93C-4222-967F-D18F7CD2CA93}"= c:\program files\common files\hp\digital imaging\bin\hpqphotocrm.exe:hpqphotocrm.exe
"{E04FE730-BFE0-4FF4-BB29-64E0E6F363CF}"= c:\program files\HP\Digital Imaging\bin\hpqsudi.exe:hpqsudi.exe
"{C8DFBBCF-0597-4FFE-85DB-95A6DC524DC7}"= c:\program files\HP\Digital Imaging\bin\hpqpsapp.exe:hpqpsapp.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\EarthLink TotalAccess\\TaskPanl.exe"= c:\program files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink

R0 Achernar;Achernar - SCSI Command Filter Drivers;c:\windows\system32\Drivers\Achernar.sys [2007-02-05 18432]
R1 tmlwf;Trend Micro NDIS 6.0 Filter Driver;c:\windows\system32\DRIVERS\tmlwf.sys [2008-02-15 141840]
R2 tmwfp;Trend Micro WFP Callout Driver;c:\windows\system32\DRIVERS\tmwfp.sys [2008-02-15 234512]
S3 CoachVid;CoachVid;c:\windows\system32\DRIVERS\CoachVid.sys [2007-04-02 45344]
S3 GameConsoleService;GameConsoleService;c:\program files\HP Games\My HP Game Console\GameConsoleService.exe [2008-05-05 165416]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
Contents of the 'Scheduled Tasks' folder

2008-11-06 c:\windows\Tasks\User_Feed_Synchronization-{4DEDF4B7-CACA-4B34-9278-126704928930}.job
- c:\windows\system32\msfeedssync.exe [2008-01-19 01:33]
.
.
——- Supplementary Scan ——-
.
R0 -: HKCU-Main,Start Page = hxxp://www.google.com/
R0 -: HKLM-Main,Start Page = hxxp://www.yahoo.com
O8 -: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000

O16 -: {1E54D648-B804-468d-BC78-4AFFED8E262E} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
c:\windows\Downloaded Program Files\SysReqLab3.osd
c:\windows\Downloaded Program Files\sysreqlab3.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-05 21:16:33
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-11-05 21:18:13
ComboFix-quarantined-files.txt 2008-11-06 03:18:10

Pre-Run: 122,344,464,384 bytes free
Post-Run: 122,317,139,968 bytes free

182 — E O F — 2008-10-30 04:09:35
Post #33
Copy/paste the text in the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text. 

Folder::
c:\users\All Users\Trymedia
c:\programdata\Trymedia

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:
1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …


[external image: Posted Image]

Drag CFScript.txt into ComboFix.exe

Then post the results log and a new HijackThis log.


Also please describe how your computer behaves at the moment.
Post #34
Combi Log

ComboFix 08-11-04.02 - Scott 2008-11-05 22:05:42.3 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.833 [GMT -6:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\Scott\Desktop\CFScript.txt
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
—- Previous Run ——-
.
c:\programdata\Trymedia
c:\programdata\Trymedia\data\{495D4933-49D2-C727-8047-4551950DACE7}
c:\programdata\Trymedia\data\{81FA1696-009E-0F5A-6431-970B792F3535}
c:\programdata\Trymedia\data\{E3837D99-EFDA-2BEC-A86E-4F4BF2CC16DD}
c:\programdata\Trymedia\data\{F0D91375-8CBF-A516-5EEC-0D51555653CE}
c:\users\All Users\Trymedia\data\{495D4933-49D2-C727-8047-4551950DACE7}
c:\users\All Users\Trymedia\data\{81FA1696-009E-0F5A-6431-970B792F3535}
c:\users\All Users\Trymedia\data\{E3837D99-EFDA-2BEC-A86E-4F4BF2CC16DD}
c:\users\All Users\Trymedia\data\{F0D91375-8CBF-A516-5EEC-0D51555653CE}

.
((((((((((((((((((((((((( Files Created from 2008-10-06 to 2008-11-06 )))))))))))))))))))))))))))))))
.

2008-11-04 09:53 . 2008-11-04 09:53 d——– c:\users\Scott\AppData\Roaming\Malwarebytes
2008-11-04 09:53 . 2008-11-04 09:53 d——– c:\users\All Users\Malwarebytes
2008-11-04 09:53 . 2008-11-04 09:53 d——– c:\programdata\Malwarebytes
2008-11-04 09:53 . 2008-11-04 09:53 d——– c:\program files\Malwarebytes' Anti-Malware
2008-11-04 09:53 . 2008-10-22 16:10 38,496 –a—— c:\windows\System32\drivers\mbamswissarmy.sys
2008-11-04 09:53 . 2008-10-22 16:10 15,504 –a—— c:\windows\System32\drivers\mbam.sys
2008-10-30 19:33 . 2008-10-30 19:33 d——– c:\program files\SystemRequirementsLab
2008-10-30 19:25 . 2008-10-30 19:26 225,722,395 –a—— c:\windows\MEMORY.DMP
2008-10-30 16:25 . 2008-10-30 16:25 d——– c:\users\Scott\AppData\Roaming\Roxio
2008-10-29 12:11 . 2008-08-11 21:39 443,392 –a—— c:\windows\System32\win32spl.dll
2008-10-29 12:11 . 2008-09-17 22:56 147,456 –a—— c:\windows\System32\Faultrep.dll
2008-10-29 12:11 . 2008-09-17 22:56 125,952 –a—— c:\windows\System32\wersvc.dll
2008-10-23 15:48 . 2008-08-05 03:49 428,544 –a—— c:\windows\System32\EncDec.dll
2008-10-23 15:48 . 2008-08-05 03:49 293,376 –a—— c:\windows\System32\psisdecd.dll
2008-10-23 15:48 . 2008-08-05 03:48 217,088 –a—— c:\windows\System32\psisrndr.ax
2008-10-23 15:48 . 2008-08-05 03:48 177,664 –a—— c:\windows\System32\mpg2splt.ax
2008-10-23 15:48 . 2008-08-05 03:48 80,896 –a—— c:\windows\System32\MSNP.ax
2008-10-14 14:20 . 2008-09-17 20:16 2,032,640 –a—— c:\windows\System32\win32k.sys
2008-10-14 14:19 . 2008-09-17 23:09 3,601,464 –a—— c:\windows\System32\ntkrnlpa.exe
2008-10-14 14:19 . 2008-09-17 23:09 3,549,240 –a—— c:\windows\System32\ntoskrnl.exe
2008-10-14 14:19 . 2008-08-26 19:06 288,768 –a—— c:\windows\System32\drivers\srv.sys
2008-10-14 14:18 . 2008-10-01 19:32 1,383,424 –a—— c:\windows\System32\mshtml.tlb
2008-10-14 14:18 . 2008-10-01 21:49 827,392 –a—— c:\windows\System32\wininet.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-04 15:26 ——— d—–w c:\program files\HP
2008-11-04 01:08 ——— d—–w c:\program files\PokerStars
2008-11-04 00:49 ——— d—a-w c:\programdata\TEMP
2008-11-02 22:45 55,117 —-a-w c:\users\Scott\AppData\Roaming\nvModes.dat
2008-10-30 22:35 ——— d—–w c:\users\Scott\AppData\Roaming\muvee Technologies
2008-10-30 22:25 ——— d—–w c:\programdata\Sonic
2008-10-26 13:48 ——— d—–w c:\programdata\Symantec
2008-10-26 13:48 ——— d—–w c:\program files\Common Files\Symantec Shared
2008-10-22 22:21 21,248 —-a-w c:\windows\Help\OEM\scripts\HPScript.exe
2008-10-15 10:33 ——— d—–w c:\program files\Windows Mail
2008-10-15 03:25 ——— d—–w c:\programdata\Microsoft Help
2008-10-08 10:27 ——— d–h–w c:\program files\InstallShield Installation Information
2008-10-08 10:26 ——— d—–w c:\program files\Hewlett-Packard
2008-10-08 10:23 ——— d—–w c:\users\Scott\AppData\Roaming\Hewlett-Packard
2008-10-06 17:51 20,224 —-a-w c:\windows\Help\OEM\scripts\HC_checkMUI.dll
2008-09-21 13:11 0 —ha-w c:\windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2008-09-15 12:48 ——— d—–w c:\programdata\NVIDIA
2008-09-15 12:44 174 –sha-w c:\program files\desktop.ini
2008-09-15 12:35 ——— d—–w c:\program files\Windows Sidebar
2008-09-15 12:35 ——— d—–w c:\program files\Windows Photo Gallery
2008-09-15 12:35 ——— d—–w c:\program files\Windows Journal
2008-09-15 12:35 ——— d—–w c:\program files\Windows Defender
2008-09-15 12:35 ——— d—–w c:\program files\Windows Collaboration
2008-09-15 12:35 ——— d—–w c:\program files\Windows Calendar
2008-09-15 12:18 82,432 —-a-w c:\windows\System32\axaltocm.dll
2008-09-15 12:18 101,888 —-a-w c:\windows\System32\ifxcardm.dll
2008-09-15 12:07 ——— d—–w c:\programdata\Hewlett-Packard
2008-09-10 12:47 ——— d—–w c:\program files\Microsoft Works
2008-08-21 22:16 11,520 —-a-w c:\windows\Help\OEM\scripts\HCNetworkTest.exe
2008-08-15 00:06 478 —-a-w c:\users\Scott\AppData\Roaming\wklnhst.dat
2008-01-27 23:55 27,430 —-a-w c:\users\Vickki\AppData\Roaming\nvModes.dat
.

((((((((((((((((((((((((((((( snapshot@2008-11-05_21.17.21.79 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-08-24 13:37:02 16,384 –sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-11-06 03:21:24 16,384 –sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2008-08-24 13:37:02 32,768 –sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-11-06 03:21:24 32,768 –sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-08-24 13:37:02 16,384 –sha-w c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-11-06 03:21:24 16,384 –sha-w c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2008-11-06 02:49:58 16,384 –sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-11-06 04:03:33 16,384 –sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2008-11-06 02:49:58 32,768 –sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-11-06 04:03:33 32,768 –sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-11-06 02:49:58 16,384 –sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-11-06 04:03:33 16,384 –sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2008-11-05 22:51:14 242,702 —-a-w c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin
+ 2008-11-06 04:03:05 244,318 —-a-w c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-04-19 484904]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"googletalk"="c:\users\Scott\AppData\Roaming\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]
"OE"="c:\program files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe" [2007-09-17 488712]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-01-12 827392]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2007-04-23 176128]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-02-13 159744]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-03-01 472776]
"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-10 317128]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784]
"UfSeAgnt.exe"="c:\program files\Trend Micro\Internet Security\UfSeAgnt.exe" [2008-07-29 1398024]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-08-20 150016]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-11-07 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-11-07 8534560]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-11-07 81920]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-06-16 75008]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2006-11-07 44128]

c:\users\Scott\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-07 101440]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-03-11 210520]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.NSVI"= nsvideo.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AutoUpdateDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{DDB79537-BE1B-49D8-9E35-865252F6818E}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{62DAD364-9054-4450-8B64-1E97F59A49D1}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{5BC58A37-88F1-48D7-8BE5-98236F326965}"= c:\program files\HP\QuickPlay\QP.exe:Quick Play
"{977244DC-0C6F-4602-9E5D-F53F4137696A}"= c:\program files\HP\QuickPlay\QPService.exe:Quick Play Resident Program
"{6B76B961-7BC3-47C4-B12A-42CF381A1E0A}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{05F6F3EF-B25C-4001-8372-FE26E6D1B328}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{097692B9-4521-4D1A-9F3E-8E0F924DCDB0}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{F238082B-3978-480D-B122-CF2A1C1231A2}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{C45F953C-C973-4D47-9B6F-8E3786D5C7A2}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{87A0D74F-F719-4D0B-9A9D-EDC91DA7E7E8}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{F5EDC70E-5EA9-4784-A169-53A0027D7A91}"= Disabled:UDP:c:\program files\MySpace\IM\MySpaceIM.exe:MySpaceIM
"{C15EF655-8A57-4F95-8A33-2BECC90D7D0F}"= Disabled:TCP:c:\program files\MySpace\IM\MySpaceIM.exe:MySpaceIM
"{27DF15C6-F70C-4F93-A401-A3FA49C1400D}"= c:\program files\HP\Digital Imaging\bin\hpqpse.exe:hpqpse.exe
"{910BEE01-C93C-4222-967F-D18F7CD2CA93}"= c:\program files\common files\hp\digital imaging\bin\hpqphotocrm.exe:hpqphotocrm.exe
"{E04FE730-BFE0-4FF4-BB29-64E0E6F363CF}"= c:\program files\HP\Digital Imaging\bin\hpqsudi.exe:hpqsudi.exe
"{C8DFBBCF-0597-4FFE-85DB-95A6DC524DC7}"= c:\program files\HP\Digital Imaging\bin\hpqpsapp.exe:hpqpsapp.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\EarthLink TotalAccess\\TaskPanl.exe"= c:\program files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink

R0 Achernar;Achernar - SCSI Command Filter Drivers;c:\windows\system32\Drivers\Achernar.sys [2007-02-05 18432]
R1 tmlwf;Trend Micro NDIS 6.0 Filter Driver;c:\windows\system32\DRIVERS\tmlwf.sys [2008-02-15 141840]
R2 tmwfp;Trend Micro WFP Callout Driver;c:\windows\system32\DRIVERS\tmwfp.sys [2008-02-15 234512]
S3 CoachVid;CoachVid;c:\windows\system32\DRIVERS\CoachVid.sys [2007-04-02 45344]
S3 GameConsoleService;GameConsoleService;c:\program files\HP Games\My HP Game Console\GameConsoleService.exe [2008-05-05 165416]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
Contents of the 'Scheduled Tasks' folder

2008-11-06 c:\windows\Tasks\User_Feed_Synchronization-{4DEDF4B7-CACA-4B34-9278-126704928930}.job
- c:\windows\system32\msfeedssync.exe [2008-01-19 01:33]
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-05 22:09:14
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-11-05 22:11:36
ComboFix-quarantined-files.txt 2008-11-06 04:11:29
ComboFix2.txt 2008-11-06 03:18:14

Pre-Run: 122,324,762,624 bytes free
Post-Run: 122,300,710,912 bytes free

200 — E O F — 2008-10-30 04:09:35



HJT log
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:17:27 PM, on 11/5/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Windows\ehome\ehtray.exe
C:\Users\Scott\AppData\Roaming\Google\Google Talk\googletalk.exe
C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Windows\System32\rundll32.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Windows\Explorer.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HP\Smart Web Printing\hpswp_clipbook.exe
C:\Users\Scott\Desktop\hijackthis\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O1 - Hosts: ::1 localhost
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [UfSeAgnt.exe] "C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [googletalk] C:\Users\Scott\AppData\Roaming\Google\Google Talk\googletalk.exe /autostart
O4 - HKCU\..\Run: [OE] "C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: HP Clipbook - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: HP Smart Select - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo…/sysreqlab3.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Trend Micro Central Control Component (SfCtlCom) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Symantec RemoteAssist - Symantec, Inc. - C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe
O23 - Service: Trend Micro Unauthorized Change Prevention Service (TMBMServer) - Trend Micro Inc. - C:\Program Files\Trend Micro\BM\TMBMSRV.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

–
End of file - 8250 bytes

Computer running very good except It needed to go into hibernate and then log back on before connecting to internet. Also Combi Fix also said to mention that it may disable the auto play of the dvd or cd feature and I should mention that.
Post #35

Also Combi Fix also said to mention that it may disable the auto play of the dvd or cd feature and I should mention that.

Yes it does. That prevents the autorun feature so if you have an infection on something like a flash drive it won't auto load the infection. You can still access any USB device, just double click to open.



Good job :thumbup:

  • Click START Search
  • Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.

    • [external image: Posted Image]


    Here's my usual all clean post

    Log looks good :D


    You need to create a new Clean restore point.

    Note: This will remove all previous Restore Points

    Click Start Menu > Run > copy and paste

    %SystemRoot%\System32\restore\rstrui.exe

    Press OK. Choose Create a Restore Point then click Next. Name it (something you'll remember) and click Create, when the confirmation screen shows the restore point has been created click Close.

    Double-click My Computer.
    Click the Tools menu, and then click Folder Options.
    Click the View tab.
    Check "Hide file extensions for known file types."
    Under the "Hidden files" folder, Uncheck "Show hidden files and folders."
    Check "Hide protected operating system files."
    Click Apply, and then click OK.

    • Make your Internet Explorer more secure - This can be done by following these simple instructions:
      • From within Internet Explorer click on the Tools menu and then click on Options.
      • Click once on the Security tab
      • Click once on the Internet icon so it becomes highlighted.
      • Click once on the Custom Level button.
      • Change the Download signed ActiveX controls to Prompt
      • Change the Download unsigned ActiveX controls to Disable
      • Change the Initialize and script ActiveX controls not marked as safe to Disable
      • Change the Installation of desktop items to Prompt
      • Change the Launching programs and files in an IFRAME to Prompt
      • Change the Navigate sub-frames across different domains to Prompt
      • When all these settings have been made, click on the OK button.
      • If it prompts you as to whether or not you want to save the settings, press the Yes button.
    • Next press the Apply button and then the OK to exit the Internet Properties page.
  • Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week
    (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
  • Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly.
    This will ensure your computer has always the latest security updates available installed on your computer.
    If there are new updates to install, install them immediately, reboot your computer, and revisit the site
    until there are no more critical updates.

  • MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.
  • Winpatrol

  • Update all these programs regularly - Make sure you update all the programs I have listed regularly.
    Without regular updates you WILL NOT be protected when new malicious programs are released.

Only run one Anti-Virus and Firewall program.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein
Post #37
Got it! Had to actually type it in with the symbols and exact command. Restore point set. Also getting to the folder options was different but achieved that as well. All the file options were already set correctly. What about the other tools we downloaded. Just delete the icons and leave them or uninstall? Malwarebytes and ATF.The rest of this looks understandable, but if I have any more questions should I refer back to this link? In all Thank You for all of your assistance, help, and patience. I do have and older system that I would like to clean up as well, which I will post in forum when I get time.
Post #38
I would keep both ATF Cleaner and Malwarebytes. Run them once a week. I'll be closing this topic so start a new thread with the other computer when you get time. Thanks for your donation :thumbup:
Post #40
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI