What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Everything going wrong

93 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
:pullhair: Hi Guys.
I'm having different sort of problems at different times lately,
If i go to another link all I get is a lot of headings having nothing to do with my search.
my CD/DVD is not being reconised I get ( autorunner - 12RD ) application not found.
Internet Explorer was slow as a wet week so I went to Firefox,but I could not remove
all of IE. and the list goes on .
Help Help Help.
i know there is a lot of carp** on my machine but I don't know what to get rid of
Im only a beginner who has enough knowledge to get into trouble.


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:37:31 PM, on 21/11/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Portrait Displays\HP My Display\DTSRVC.exe
C:\Program Files\Optus Internet Security Suite\Anti-Virus\fsgk32st.exe
C:\Program Files\Optus Internet Security Suite\Anti-Virus\FSGK32.EXE
C:\Program Files\Optus Internet Security Suite\Common\FSMA32.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Optus Internet Security Suite\Common\FSMB32.EXE
C:\WINDOWS\System32\Fast.exe
C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Optus Internet Security Suite\Common\FCH32.EXE
C:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Optus Internet Security Suite\Common\FAMEH32.EXE
C:\Program Files\Optus Internet Security Suite\Anti-Virus\fsqh.exe
C:\Program Files\TrustDefender\TrustDefender\TrustDefender.exe
C:\Program Files\Optus Internet Security Suite\FSPC\fspc.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Optus Internet Security Suite\Common\FSM32.EXE
C:\Program Files\Optus Internet Security Suite\FSAUA\program\fsaua.exe
C:\Program Files\Optus Internet Security Suite\FWES\Program\fsdfwd.exe
C:\Program Files\Optus Internet Security Suite\FSGUI\fsguidll.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\vsnpstd.exe
C:\Program Files\Optus Internet Security Suite\Anti-Virus\fssm32.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\carpserv.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\TrustDefender\TrustDefender\TDWatchdog.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Optus Internet Security Suite\FSAUA\program\fsus.exe
C:\Program Files\Optus Internet Security Suite\Anti-Virus\fsav32.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ninemsn.com.au/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843
O2 - BHO: (no name) - {0055C089-8582-441B-A0BF-17B458C2A3A8} - (no file)
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Optus Internet Security Suite\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Optus Internet Security Suite\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [EssSpkPhone] essspk.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [TrustDefenderWD] "C:\Program Files\TrustDefender\TrustDefender\WinUserAppLauncher.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-21-1214440339-413027322-839522115-1006\..\RunOnce: [NeroHomeFirstStart] "C:\Program Files\Common Files\Nero\Lib\NMFirstStart.exe" (User '?')
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Parental… - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Optus Internet Security Suite\FSPC\fspcmsie.dll
O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\Optus Internet Security Suite\FSPC\fspcmsie.dll
O9 - Extra 'Tools' menuitem: Parental… - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\Optus Internet Security Suite\FSPC\fspcmsie.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: TrustDefender - Safe Secure Check - {C1F0024B-8278-4999-B7E6-2718426D9FE6} - C:\Program Files\TrustDefender\TrustDefender\TDIEButton.dll (HKCU)
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} - http://www.ipix.com/download/ipixx.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/…lscbase6662.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/inst…ctDetection.cab
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} - http://h20270.www2.hp.com/ediags/gmn2/inst…ctDetection.cab
O16 - DPF: {A9F8D9EC-3D0A-4A60-BD82-FBD64BAD370D} - http://h20264.www2.hp.com/ediags/dd/instal…nosticsxp2k.cab
O16 - DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} - http://tools.ebayimg.com/eps/wl/activex/eB…l_v1-0-27-0.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files\Portrait Displays\HP My Display\DTSRVC.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Optus Internet Security Suite\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Optus Internet Security Suite\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Optus Internet Security Suite\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Optus Internet Security Suite\Common\FSMA32.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LiveUpdate\LuComServer_3_2.EXE
O23 - Service: MaxBackServiceInt - Unknown owner - C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: MaxSyncService (NTService1) - - C:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TrustDefender - Symbiotic Technologies Pty Ltd - C:\Program Files\TrustDefender\TrustDefender\TrustDefender.exe

–
End of file - 11386 bytes
Post #2
Hi ed-e-dee,

:welcome:

My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

  • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.

Not alot of problems showing. Let's try a couple things.

You appear to have Symantec(Norton) Anti-Virus running as well as Optus. One of the needs to go. I think you want to keep the Optus.
Please remove Symantec components using Add/Remove programs in your Control Panel. If this is a failed uninstall, you will need to do the following:
Use the link below to see how to run the Norton Removal Tool
http://service1.symantec.com/SUPPORT/tsgen…005033108162039

Next

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.

Then

Please download Malwarebytes' Anti-Malware to your desktop.

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
  • Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot (shut down your computer then restart it).
Also "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.
Post #3
Hello Tomk, thanks for getting to me, I've done what you asked so I hope that I got it right here goes.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:08:08 PM, on 23/11/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device

Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Portrait Displays\HP My Display\DTSRVC.exe
C:\Program Files\Optus Internet Security Suite\Anti-Virus\fsgk32st.exe
C:\Program Files\Optus Internet Security Suite\Anti-Virus\FSGK32.EXE
C:\Program Files\Optus Internet Security Suite\Common\FSMA32.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Optus Internet Security Suite\Common\FSMB32.EXE
C:\WINDOWS\System32\Fast.exe
C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe
C:\Program Files\Optus Internet Security Suite\Common\FCH32.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TrustDefender\TrustDefender\TrustDefender.exe
C:\Program Files\Optus Internet Security Suite\Anti-Virus\fsqh.exe
C:\Program Files\Optus Internet Security Suite\Common\FAMEH32.EXE
C:\Program Files\Optus Internet Security Suite\FSPC\fspc.exe
C:\Program Files\Optus Internet Security Suite\FSAUA\program\fsaua.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Optus Internet Security Suite\FWES\Program\fsdfwd.exe
C:\Program Files\Optus Internet Security Suite\Anti-Virus\fssm32.exe
C:\Program Files\Optus Internet Security Suite\Common\FSM32.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\vsnpstd.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\carpserv.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Optus Internet Security Suite\FSGUI\fsguidll.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Optus Internet Security Suite\FSAUA\program\fsus.exe
C:\Program Files\TrustDefender\TrustDefender\TDWatchdog.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Optus Internet Security Suite\Anti-Virus\fsav32.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =

http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

http://ninemsn.com.au/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page =

http://go.microsoft.com/fwlink/?LinkId=54843
O2 - BHO: (no name) - {0055C089-8582-441B-A0BF-17B458C2A3A8} - (no file)
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} -

C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer -

{3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program

Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F}

- C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -

C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} -

C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows

Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Optus Internet

Security Suite\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Optus Internet Security

Suite\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common

Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software

Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [EssSpkPhone] essspk.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe

bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI

Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program

Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [TrustDefenderWD] "C:\Program

Files\TrustDefender\TrustDefender\WinUserAppLauncher.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe"

-atboottime
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program

Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media

Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search &

Destroy\TeaTimer.exe
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI

Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program

Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -

C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console -

{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Parental… - {200DB664-75B5-47c0-8B45-A44ACCF73C00} -

C:\Program Files\Optus Internet Security Suite\FSPC\fspcmsie.dll
O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} -

C:\Program Files\Optus Internet Security Suite\FSPC\fspcmsie.dll
O9 - Extra 'Tools' menuitem: Parental… -

{200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\Optus Internet

Security Suite\FSPC\fspcmsie.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -

C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} -

C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration -

{DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} -

C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 -

{e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network

Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -

C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe
O9 - Extra button: TrustDefender - Safe Secure Check -

{C1F0024B-8278-4999-B7E6-2718426D9FE6} - C:\Program

Files\TrustDefender\TrustDefender\TDIEButton.dll (HKCU)
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} -

http://www.ipix.com/download/ipixx.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety

Center Base Module) -

http://cdn.scan.onecare.live.com/resource/…lscbase6662.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} -

http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection

Class) -

http://h20270.www2.hp.com/ediags/gmn2/inst…ctDetection.cab
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} -

http://h20270.www2.hp.com/ediags/gmn2/inst…ctDetection.cab
O16 - DPF: {A9F8D9EC-3D0A-4A60-BD82-FBD64BAD370D} -

http://h20264.www2.hp.com/ediags/dd/instal…nosticsxp2k.cab
O16 - DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} -

http://tools.ebayimg.com/eps/wl/activex/eB…e_Control_v1-0-

27-0.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program

Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common

Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. -

C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown

owner - C:\Program Files\Portrait Displays\HP My Display\DTSRVC.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure

Corporation - C:\Program Files\Optus Internet Security

Suite\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure

Corporation - C:\Program Files\Optus Internet Security

Suite\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure

Corporation - C:\Program Files\Optus Internet Security

Suite\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation -

C:\Program Files\Optus Internet Security Suite\Common\FSMA32.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program

Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision

Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel

32\IDriverT.exe
O23 - Service: MaxBackServiceInt - Unknown owner - C:\Program

Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program

Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: MaxSyncService (NTService1) - - C:\Program

Files\Maxtor\OneTouch\Utils\SyncServices.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TrustDefender - Symbiotic Technologies Pty Ltd - C:\Program

Files\TrustDefender\TrustDefender\TrustDefender.exe



Malwarebytes' Anti-Malware 1.30
Database version: 1416
Windows 5.1.2600 Service Pack 3

23/11/2008 11:52:12 AM
mbam-log-2008-11-23 (11-52-12).txt

Scan type: Quick Scan
Objects scanned: 62671
Time elapsed: 6 minute(s), 3 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 6
Registry Values Infected: 0
Registry Data Items Infected: 6
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{83c35173-e029-42f1-9692-0341ee379a0d} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{f58ff278-2198-403b-9170-c95022a194c6} (Rogue.AntiSpyCheck) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{d46beaa4-a304-40b3-a9da-ec7f7f501f25} (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{0bd44ab1-76a7-4e05-92f4-4b065fe72bd6} (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{94a5c93f-bd18-4c46-b777-c94c145c3cab} (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FwHookDrv (Rogue.WinDefender) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\DhcpNameServer (Trojan.DNSChanger) -> Data: [removed] [removed] -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{91649239-7301-4d26-84e9-7dfee5c93524}\DhcpNameServer (Trojan.DNSChanger) -> Data: [removed] [removed] -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\DhcpNameServer (Trojan.DNSChanger) -> Data: [removed] [removed] -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{91649239-7301-4d26-84e9-7dfee5c93524}\DhcpNameServer (Trojan.DNSChanger) -> Data: [removed] [removed] -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\DhcpNameServer (Trojan.DNSChanger) -> Data: [removed] [removed] -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{91649239-7301-4d26-84e9-7dfee5c93524}\DhcpNameServer (Trojan.DNSChanger) -> Data: [removed] [removed] -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\Explorer.sav (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.


Tom hope I did it right
Ed.
Post #4
Hi Tom ,computer has slowed down not much but I can see the differance,I did get a notice that Mozilla Firefox cannot open "try again ". but that seems to have sorted itself out hope. Ed.
Post #5
ed-e-dee,

Please open Notepad and click on format. Make sure that word wrap is unchecked.


Download and Run SmitfraudFix
Please download SmitfraudFix (by S!Ri)
Extract the content (a folder named SmitfraudFix) to your Desktop.

Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply.
Post #7
ed-e-dee,

Download ComboFix from one of these locations:

Link 1
Link 2
Link 3

* IMPORTANT !!! Save ComboFix.exe to your Desktop


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link –> http://www.bleepingcomputer.com/forums/topic114351.html

  • Double click on ComboFix.exe & follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


[external image: Posted Image]



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.


Notes:

1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
5. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
Post #8
G/Day Tomk. hope this helps I don't know anything about this stuff.
When I opened Firefox I was told Address not found, Try again, the same happened to this forum, I had to restart to get going again,


ComboFix 08-11-22.02 - Owner 2008-11-23 18:10:27.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.314 [GMT 11:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point
* Resident AV is active


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\SAV
c:\windows\emMON.exe
c:\windows\search_res.txt
c:\windows\system32\bbxdrynbqx_navtmp.dat
c:\windows\system32\vmdksiahef_navtmp.dat

.
((((((((((((((((((((((((( Files Created from 2008-10-23 to 2008-11-23 )))))))))))))))))))))))))))))))
.

2008-11-23 11:04 . 2008-11-23 11:05 d——– c:\documents and settings\All Users\Application Data\NortonInstaller
2008-11-21 20:12 . 2008-11-21 20:12 d——– C:\4DiskcleanG
2008-11-21 17:07 . 2008-11-21 17:09 d——– c:\documents and settings\Owner\Application Data\MSN6
2008-11-21 17:07 . 2008-11-21 17:07 d——– c:\documents and settings\All Users\Application Data\MSN6
2008-11-21 16:34 . 2008-11-21 16:34 d——– C:\DVR112D
2008-11-21 14:30 . 2008-09-15 23:12 1,846,400 —–c— c:\windows\system32\dllcache\win32k.sys
2008-11-21 14:29 . 2008-08-14 21:11 2,189,184 —–c— c:\windows\system32\dllcache\ntoskrnl.exe
2008-11-21 14:29 . 2008-08-14 20:33 2,066,048 —–c— c:\windows\system32\dllcache\ntkrnlpa.exe
2008-11-21 14:28 . 2008-10-16 03:34 337,408 —–c— c:\windows\system32\dllcache\netapi32.dll
2008-11-21 10:11 . 2008-11-21 10:11 d——– c:\program files\TeaTimer (Spybot - Search & Destroy)
2008-11-21 10:11 . 2008-11-21 10:11 d——– c:\program files\SDHelper (Spybot - Search & Destroy)
2008-11-21 10:11 . 2008-11-21 10:11 d——– c:\program files\Misc. Support Library (Spybot - Search & Destroy)
2008-11-21 10:11 . 2008-11-21 10:11 d——– c:\program files\File Scanner Library (Spybot - Search & Destroy)
2008-11-17 12:10 . 2008-11-17 12:10 d——– c:\program files\Morpheus Upgrades
2008-11-16 22:20 . 2008-11-16 22:20 d——– c:\program files\Magellass
2008-11-16 21:37 . 2008-11-16 21:37 d——– c:\documents and settings\All Users\Application Data\HP Product Assistant

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-23 00:41 ——— d—–w c:\program files\Malwarebytes' Anti-Malware
2008-11-23 00:07 ——— d—–w c:\program files\Common Files\Symantec Shared
2008-11-21 06:03 ——— d—–w c:\documents and settings\All Users\Application Data\WinZip
2008-11-21 06:00 ——— d–h–w c:\program files\InstallShield Installation Information
2008-11-20 23:57 ——— d—–w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-11-20 23:21 ——— d—–w c:\program files\Spybot - Search & Destroy
2008-11-19 04:17 ——— d—–w c:\program files\A4Tech
2008-11-19 01:48 ——— d—–w c:\program files\SUPERAntiSpyware
2008-11-17 03:27 ——— d—–w c:\program files\Windows Live Safety Center
2008-10-24 11:21 455,296 —-a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-22 05:10 38,496 —-a-w c:\windows\system32\drivers\mbamswissarmy.sys
2008-10-22 05:10 15,504 —-a-w c:\windows\system32\drivers\mbam.sys
2008-10-16 03:13 202,776 —-a-w c:\windows\system32\wuweb.dll
2008-10-16 03:13 1,809,944 —-a-w c:\windows\system32\wuaueng.dll
2008-10-16 03:12 561,688 —-a-w c:\windows\system32\wuapi.dll
2008-10-16 03:12 323,608 —-a-w c:\windows\system32\wucltui.dll
2008-10-16 03:09 92,696 —-a-w c:\windows\system32\cdm.dll
2008-10-16 03:09 51,224 —-a-w c:\windows\system32\wuauclt.exe
2008-10-16 03:09 43,544 -c–a-w c:\windows\system32\wups2.dll
2008-10-16 03:08 34,328 -c–a-w c:\windows\system32\wups.dll
2008-10-12 07:03 ——— d—–w c:\program files\Google
2008-09-30 05:43 1,286,152 —-a-w c:\windows\system32\msxml4.dll
2008-09-15 12:12 1,846,400 —-a-w c:\windows\system32\win32k.sys
2008-09-10 05:40 348,160 —-a-w c:\windows\system32\msvcr71.dll
2008-09-10 01:14 1,307,648 ——w c:\windows\system32\msxml6.dll
2008-09-04 17:15 1,106,944 —-a-w c:\windows\system32\msxml3.dll
2008-08-26 07:24 826,368 —-a-w c:\windows\system32\wininet.dll
2008-05-19 06:18 32,768 -csha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008051920080520\index.dat
2008-05-19 06:19 32,768 -csha-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-11-19 1805552]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 204288]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-08-18 1832272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"F-Secure Manager"="c:\program files\Optus Internet Security Suite\Common\FSM32.EXE" [2007-04-27 183208]
"F-Secure TNB"="c:\program files\Optus Internet Security Suite\FSGUI\TNBUtil.exe" [2007-04-27 740208]
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592]
"snpstd"="c:\windows\vsnpstd.exe" [2004-06-10 286720]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2005-08-06 61440]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"TrustDefenderWD"="c:\program files\TrustDefender\TrustDefender\WinUserAppLauncher.exe" [2008-03-02 15528]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]
"SoundMan"="SOUNDMAN.EXE" [2005-02-23 c:\windows\SOUNDMAN.EXE]
"PCTVOICE"="pctspk.exe" [2001-08-17 c:\windows\system32\pctspk.exe]
"EssSpkPhone"="essspk.exe" [2001-10-19 c:\windows\essspk.exe]
"CARPService"="carpserv.exe" [2001-12-23 c:\windows\system32\carpserv.exe]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 c:\windows\system32\bthprops.cpl]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
ATI CATALYST System Tray.lnk - c:\program files\ATI Technologies\ATI.ACE\CLI.exe [2005-08-06 61440]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 288472]
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2008-11-23 118784]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"SynchronousMachineGroupPolicy"= 0 (0x0)
"SynchronousUserGroupPolicy"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-21 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-08-26 12:17 352256 c:\program files\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Documents and Settings\\Owner\\Desktop\\setup.exe"=
"c:\\kav\\kav7.0\\english\\setup.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\TrustDefender\\TrustDefender\\TrustDefender.exe"=

R0 FSFW;F-Secure Firewall Driver;c:\windows\system32\drivers\fsdfw.sys [2008-02-14 51072]
R1 anftdird.sys;anftdird.sys;\??\c:\windows\system32\drivers\anftdird.sys [2008-07-30 19624]
R1 F-Secure HIPS;F-Secure HIPS;\??\c:\program files\Optus Internet Security Suite\HIPS\fshs.sys [2008-02-14 41184]
R1 TRIXX;TRIXX;\??\c:\program files\TRIXX\TRIXXDriver.sys [2005-08-16 15360]
R2 TrustDefender;TrustDefender;"c:\program files\TrustDefender\TrustDefender\TrustDefender.exe" -service [2008-07-30 1683624]
R3 F-Secure Gatekeeper;F-Secure Gatekeeper;\??\c:\program files\Optus Internet Security Suite\Anti-Virus\minifilter\fsgk.sys [2008-02-14 59760]
R3 SISNICXP;SiS PCI Fast Ethernet Adapter Driver for NDIS51;c:\windows\system32\DRIVERS\sisnicxp.sys [2006-02-14 32768]
S2 BT848;WinFast TV2000 XP WDM Video Capture;c:\windows\system32\drivers\wf2kvcap.sys [2005-12-15 75925]
S2 tv2ktunr;WinFast TV2000 XP WDM TVTuner;c:\windows\system32\drivers\wf2ktunr.sys [2005-12-15 36423]
S2 Tv2kXbar;WinFast TV2000 XP WDM Crossbar;c:\windows\system32\drivers\wf2kxbar.sys [2005-12-15 10005]
S3 Amps2prt;A4Tech PS/2 Port Mouse Driver;c:\windows\system32\DRIVERS\Amps2prt.sys []
S3 SIS163u;SiS 163 usb Wireless LAN Adapter Driver;c:\windows\system32\DRIVERS\sis163u.sys [2006-01-18 167424]
S4 F-Secure Filter;F-Secure File System Filter;\??\c:\program files\Optus Internet Security Suite\Anti-Virus\Win2K\FSfilter.sys [2008-02-14 40048]
S4 F-Secure Recognizer;F-Secure File System Recognizer;\??\c:\program files\Optus Internet Security Suite\Anti-Virus\Win2K\FSrec.sys [2008-02-14 25456]
.
Contents of the 'Scheduled Tasks' folder

2008-11-03 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 13:34]

2008-07-01 c:\windows\Tasks\ErrorSweeper Scheduled Scan.job
- c:\program files\ErrorSweeper\ErrorSweeper.exe []

2008-07-01 c:\windows\Tasks\ErrorSweeper Scheduled Scan.job
- c:\program files\ErrorSweeper [2008-02-04 16:48]

2008-11-23 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 19:20]

2008-11-23 c:\windows\Tasks\Scheduled scanning task.job
- c:\progra~1\Optus Internet Security Suite\Anti-Virus\fsav.exe [2007-04-26 22:42]
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-Cmaudio - cmicnfg.cpl


.
——- Supplementary Scan ——-
.
FireFox -: Profile - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\99z819kb.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.com/
FF -: plugin - c:\program files\Yahoo!\Common\npyaxmpb.dll
.
.
——- File Associations ——-
.
regfile\shell\edit\command=%SystemRoot%\system32\NOTEPAD.EXE %1
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-23 18:15:52
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(560)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\WgaLogon.dll

- - - - - - - > 'lsass.exe'(616)
c:\program files\Optus Internet Security Suite\FSPS\program\FSLSP.DLL
.
Completion time: 2008-11-23 18:17:04
ComboFix-quarantined-files.txt 2008-11-23 07:17:01
ComboFix2.txt 2007-06-27 05:35:21

Pre-Run: 70,257,471,488 bytes free
Post-Run: 71,340,408,832 bytes free

189 — E O F — 2008-11-21 10:00:19
Post #9
ed-e-dee,

Please try running SmitfraudFix again per instructions in Post #5.

Then

Disable resident protections (Antivirus…); you'll re-enable them after the scan

Download Lop S&D < here

Double-click Lop S&D.exe
Choose the language, then choose Option 1 (Search)
Wait till the end of the scan
Post the log which is created: (%SystemDrive%\lopR.txt)
Post #10
:popcorn: Hi Tomk…I got it to work. oh I'm feeling good about myself.Lol n done at 8:32:57.39, Mon 24/11/2008 Run from C:\unzipped\SmitfraudFix\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in normal mode »»»»»»»»»»»»»»»»»»»»»»»» Process C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Portrait Displays\HP My Display\DTSRVC.exe C:\Program Files\Optus Internet Security Suite\Anti-Virus\fsgk32st.exe C:\Program Files\Optus Internet Security Suite\Anti-Virus\FSGK32.EXE C:\Program Files\Optus Internet Security Suite\Common\FSMA32.EXE C:\WINDOWS\System32\svchost.exe C:\Program Files\Optus Internet Security Suite\Common\FSMB32.EXE C:\WINDOWS\System32\Fast.exe C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Optus Internet Security Suite\Common\FSM32.EXE C:\WINDOWS\SOUNDMAN.EXE C:\WINDOWS\vsnpstd.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\WINDOWS\system32\carpserv.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\TrustDefender\TrustDefender\TDWatchdog.exe C:\Program Files\QuickTime\QTTask.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Program Files\Windows Media Player\WMPNSCFG.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\WinZip\WZQKPICK.EXE C:\Program Files\Optus Internet Security Suite\Common\FCH32.EXE C:\Program Files\CDBurnerXP\NMSAccessU.exe C:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\TrustDefender\TrustDefender\TrustDefender.exe C:\Program Files\Optus Internet Security Suite\Common\FAMEH32.EXE C:\Program Files\Optus Internet Security Suite\Anti-Virus\fsqh.exe C:\Program Files\Optus Internet Security Suite\FSPC\fspc.exe C:\Program Files\Optus Internet Security Suite\FSGUI\fsguidll.exe C:\Program Files\Optus Internet Security Suite\FSAUA\program\fsaua.exe C:\Program Files\Optus Internet Security Suite\Anti-Virus\fssm32.exe C:\Program Files\Optus Internet Security Suite\FWES\Program\fsdfwd.exe C:\Program Files\Optus Internet Security Suite\FSAUA\program\fsus.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\Optus Internet Security Suite\Anti-Virus\fsav32.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\cmd.exe »»»»»»»»»»»»»»»»»»»»»»»» hosts hosts file corrupted ! 127.0.0.1 www.legal-at-spybot.info 127.0.0.1 legal-at-spybot.info »»»»»»»»»»»»»»»»»»»»»»»» C:\ »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32 »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Owner »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Owner\LOCALS~1\Temp »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Owner\Application Data »»»»»»»»»»»»»»»»»»»»»»»» Start Menu »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Owner\FAVORI~1 »»»»»»»»»»»»»»»»»»»»»»»» Desktop »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files C:\Program Files\Applications\ FOUND ! »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" »»»»»»»»»»»»»»»»»»»»»»»» o4Patch !!!Attention, following keys are not inevitably infected!!! o4Patch Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» IEDFix !!!Attention, following keys are not inevitably infected!!! IEDFix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» VACFix !!!Attention, following keys are not inevitably infected!!! VACFix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» 404Fix !!!Attention, following keys are not inevitably infected!!! 404Fix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="" »»»»»»»»»»»»»»»»»»»»»»»» Winlogon !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "Userinit"="C:\\WINDOWS\\system32\\userinit.exe," "System"="" »»»»»»»»»»»»»»»»»»»»»»»» RK »»»»»»»»»»»»»»»»»»»»»»»» DNS Your computer may be victim of a DNS Hijack: 85.255.x.x detected ! Description: SiS 900 PCI Fast Ethernet Adapter #2 - Packet Scheduler Miniport DNS Server Search Order: 85.255.116.24 DNS Server Search Order: 85.255.112.184 HKLM\SYSTEM\CCS\Services\Tcpip\..\{91649239-7301-4D26-84E9-7DFEE5C93524}: DhcpNameServer=[removed] [removed] HKLM\SYSTEM\CS1\Services\Tcpip\..\{91649239-7301-4D26-84E9-7DFEE5C93524}: DhcpNameServer=[removed] [removed] HKLM\SYSTEM\CS3\Services\Tcpip\..\{91649239-7301-4D26-84E9-7DFEE5C93524}: DhcpNameServer=[removed] [removed] HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=[removed] [removed] HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=[removed] [removed] HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=[removed] [removed] »»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection »»»»»»»»»»»»»»»»»»»»»»»» End Hope it's ok
Post #11
ed-e-dee,

Hope it's ok

Not yet but we'll keep working on it.

Run Smitfraudfix
Open the SmitfraudFix folder again and double-click smitfraudfix.cmd
Select option #2 - Clean by typing 2 and press "Enter" to delete infected files.

You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing Y and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection.

The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing Y and press "Enter".

The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart it into Normal Windows.
A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report into your next reply.
The report can also be found at the root of the system drive, usually at C:\rapport.txt

Warning : running option #2 on a non infected computer will remove your Desktop background.
Post #12
——————–\\ Lop S&D; 4.2.4-9c XP/Vista

Microsoft Windows XP Professional ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : Intel® Pentium® D CPU 3.00GHz )
BIOS : Award Modular BIOS v6.00PG
USER : Owner ( Administrator )
BOOT : Normal boot
Antivirus : Optus Internet Security Suite 2008 7.00 7.00 (Activated)
Firewall : Optus Internet Security Suite 2008 7.00 7.00 (Activated)
A:\ (USB)
C:\ (Local Disk) - NTFS - Total:186 Go (Free:66 Go)
D:\ (CD or DVD)

"C:\Lop SD" ( MAJ : 01-11-2008|16:30 )
Option : [1] ( Mon 24/11/2008| 8:45 )

——————–\\ Listing folders in APPLIC~1

[11/04/2007|03:02] C:\DOCUME~1\ADMINI~1\APPLIC~1\ AVG7
[15/05/2008|07:29] C:\DOCUME~1\ADMINI~1\APPLIC~1\ Microsoft
[25/06/2007|03:48] C:\DOCUME~1\ADMINI~1\APPLIC~1\ SUPERAntiSpyware.com
[25/06/2007|05:38] C:\DOCUME~1\ADMINI~1\APPLIC~1\ TrojanHunter

[13/04/2006|07:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ ACD Systems
[10/06/2008|02:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Adobe
[29/01/2005|09:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Ahead
[19/12/2007|10:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Apple
[19/12/2007|10:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Apple Computer
[15/05/2008|03:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ ATI
[15/05/2008|07:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ avg7
[11/06/2007|05:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ DVD Shrink
[02/11/2007|07:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ eBay
[14/02/2008|04:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ F-Secure
[14/02/2008|04:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ fssg
[12/10/2008|05:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Google
[14/02/2008|04:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Grisoft
[01/02/2007|12:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ HP
[16/11/2008|09:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ HP Product Assistant
[01/02/2008|05:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Kaspersky Lab Setup Files
[18/01/2008|12:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Kodak
[13/06/2008|11:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Malwarebytes
[12/06/2007|05:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Maxtor
[01/06/2008|02:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Microsoft
[13/07/2007|12:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Microsoft Corporation
[21/11/2008|05:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ MSN6
[10/02/2008|09:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Nero
[23/11/2008|11:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ NortonInstaller
[06/07/2007|04:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ PC Drivers Headquarters
[19/11/2005|12:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ QuickTime
[24/02/2007|12:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ SecTaskMan
[27/01/2008|02:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ SmartSound Software Inc
[01/02/2007|12:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Sonic
[21/11/2008|10:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Spybot - Search & Destroy
[17/06/2007|06:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ SUPERAntiSpyware.com
[11/08/2008|12:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ TEMP
[22/01/2008|07:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Ulead Systems
[15/01/2008|02:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ WholeSecurity
[01/02/2007|07:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Windows Genuine Advantage
[09/03/2007|03:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Windows Live Toolbar
[21/11/2008|05:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ WinZip
[04/12/2007|03:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ WLInstaller
[09/11/2007|10:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Yahoo! Companion

[13/12/2007|06:04] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Microsoft

[24/02/2007|03:47] C:\DOCUME~1\LOCALS~1\APPLIC~1\ AVG7
[01/02/2007|12:53] C:\DOCUME~1\LOCALS~1\APPLIC~1\ HP
[15/05/2008|07:29] C:\DOCUME~1\LOCALS~1\APPLIC~1\ Microsoft

[15/05/2008|07:29] C:\DOCUME~1\NETWOR~1\APPLIC~1\ Microsoft

[13/04/2006|07:11] C:\DOCUME~1\Owner\APPLIC~1\ ACD Systems
[10/06/2008|02:09] C:\DOCUME~1\Owner\APPLIC~1\ Adobe
[23/04/2007|03:25] C:\DOCUME~1\Owner\APPLIC~1\ AdobeAUM
[07/09/2007|01:20] C:\DOCUME~1\Owner\APPLIC~1\ AdobeUM
[28/08/2007|09:02] C:\DOCUME~1\Owner\APPLIC~1\ Ahead
[04/02/2008|04:51] C:\DOCUME~1\Owner\APPLIC~1\ Apple Computer
[15/05/2008|07:28] C:\DOCUME~1\Owner\APPLIC~1\ ATI
[14/02/2008|09:21] C:\DOCUME~1\Owner\APPLIC~1\ AVG7
[01/02/2007|04:12] C:\DOCUME~1\Owner\APPLIC~1\ BitTorrent
[18/03/2007|05:24] C:\DOCUME~1\Owner\APPLIC~1\ CyberScrub
[27/05/2008|04:46] C:\DOCUME~1\Owner\APPLIC~1\ DivX
[01/07/2008|11:01] C:\DOCUME~1\Owner\APPLIC~1\ DMCache
[09/07/2007|05:12] C:\DOCUME~1\Owner\APPLIC~1\ Earthsim
[02/11/2007|07:42] C:\DOCUME~1\Owner\APPLIC~1\ eBay
[04/02/2008|04:46] C:\DOCUME~1\Owner\APPLIC~1\ ErrorSweeper
[10/08/2008|07:07] C:\DOCUME~1\Owner\APPLIC~1\ F-Secure
[15/06/2007|06:37] C:\DOCUME~1\Owner\APPLIC~1\ GES
[16/05/2008|08:43] C:\DOCUME~1\Owner\APPLIC~1\ Google
[05/04/2005|03:25] C:\DOCUME~1\Owner\APPLIC~1\ Help
[17/06/2008|02:23] C:\DOCUME~1\Owner\APPLIC~1\ HP
[29/01/2005|01:53] C:\DOCUME~1\Owner\APPLIC~1\ Identities
[30/06/2008|09:05] C:\DOCUME~1\Owner\APPLIC~1\ IDM
[03/08/2008|01:51] C:\DOCUME~1\Owner\APPLIC~1\ Image Zone Express
[06/08/2007|02:41] C:\DOCUME~1\Owner\APPLIC~1\ iShell
[06/02/2005|09:18] C:\DOCUME~1\Owner\APPLIC~1\ Kazaa Lite
[28/10/2005|08:16] C:\DOCUME~1\Owner\APPLIC~1\ Leadertech
[23/11/2007|04:49] C:\DOCUME~1\Owner\APPLIC~1\ LG Electronics
[06/06/2008|11:51] C:\DOCUME~1\Owner\APPLIC~1\ LimeWire
[02/02/2005|01:54] C:\DOCUME~1\Owner\APPLIC~1\ Macromedia
[13/06/2008|11:37] C:\DOCUME~1\Owner\APPLIC~1\ Malwarebytes
[07/02/2008|02:32] C:\DOCUME~1\Owner\APPLIC~1\ Microsoft
[03/09/2008|09:59] C:\DOCUME~1\Owner\APPLIC~1\ Mozilla
[21/11/2008|05:09] C:\DOCUME~1\Owner\APPLIC~1\ MSN6
[26/01/2008|12:49] C:\DOCUME~1\Owner\APPLIC~1\ Nero
[13/05/2008|11:00] C:\DOCUME~1\Owner\APPLIC~1\ Preclick
[21/05/2008|12:46] C:\DOCUME~1\Owner\APPLIC~1\ Printer Info Cache
[15/05/2008|07:31] C:\DOCUME~1\Owner\APPLIC~1\ Real
[28/10/2005|08:11] C:\DOCUME~1\Owner\APPLIC~1\ Sonic
[08/02/2007|03:20] C:\DOCUME~1\Owner\APPLIC~1\ Sun
[04/02/2008|02:22] C:\DOCUME~1\Owner\APPLIC~1\ SUPERAntiSpyware.com
[08/05/2008|10:39] C:\DOCUME~1\Owner\APPLIC~1\ Talkback
[14/06/2007|10:46] C:\DOCUME~1\Owner\APPLIC~1\ TrojanHunter
[15/12/2005|10:48] C:\DOCUME~1\Owner\APPLIC~1\ Ulead Systems
[11/07/2007|10:13] C:\DOCUME~1\Owner\APPLIC~1\ Uniblue
[25/08/2008|10:18] C:\DOCUME~1\Owner\APPLIC~1\ Webroot


[04/10/2005|05:48] C:\DOCUME~1\x\APPLIC~1\ Identities
[15/05/2008|07:29] C:\DOCUME~1\x\APPLIC~1\ Microsoft
[04/10/2005|05:48] C:\DOCUME~1\x\APPLIC~1\ Real

——————–\\ Scheduled Tasks located in C:\WINDOWS\Tasks

[23/11/2008 11:00 AM][–a——] C:\WINDOWS\tasks\Scheduled scanning task.job
[02/07/2008 04:30 AM][–a–c—] C:\WINDOWS\tasks\ErrorSweeper Scheduled Scan.job
[24/11/2008 08:24 AM][–ah—–] C:\WINDOWS\tasks\MP Scheduled Scan.job
[04/11/2008 10:49 AM][–a–c—] C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[24/11/2008 08:20 AM][–ah-c—] C:\WINDOWS\tasks\SA.DAT
[31/03/2003 11:00 PM][-r-h-c—] C:\WINDOWS\tasks\desktop.ini

——————–\\ Listing Folders in C:\Program Files

[04/01/2006|07:21] C:\Program Files\ 802.11 Wireless LAN
[19/11/2008|03:17] C:\Program Files\ A4Tech
[25/08/2008|10:33] C:\Program Files\ ACAD2000
[13/04/2006|07:10] C:\Program Files\ ACD Systems
[11/03/2007|01:15] C:\Program Files\ ACW
[10/06/2008|02:17] C:\Program Files\ Adobe
[15/05/2008|07:32] C:\Program Files\ Adobe Media Player
[15/05/2008|07:31] C:\Program Files\ Ahead
[24/02/2007|02:44] C:\Program Files\ AnalogX
[18/09/2008|10:46] C:\Program Files\ Apple Software Update
[06/09/2008|05:48] C:\Program Files\ Applications
[11/06/2007|02:23] C:\Program Files\ AskTBar
[15/05/2008|07:27] C:\Program Files\ ATI Technologies
[07/04/2007|03:32] C:\Program Files\ ATI Technologies(2)
[06/02/2005|06:17] C:\Program Files\ AvRack
[02/07/2007|03:29] C:\Program Files\ Belarc
[10/06/2008|04:42] C:\Program Files\ CDBurnerXP
[23/11/2008|06:13] C:\Program Files\ Common Files
[29/01/2005|01:42] C:\Program Files\ ComPlus Applications
[01/02/2005|08:55] C:\Program Files\ CONEXANT
[10/06/2008|04:55] C:\Program Files\ DivX
[29/01/2005|08:20] C:\Program Files\ DVD Decrypter
[11/06/2007|05:16] C:\Program Files\ DVD Shrink
[16/12/2005|08:16] C:\Program Files\ DVD Wizard Pro
[13/01/2008|08:07] C:\Program Files\ DVDFab HD Decrypter 4
[14/02/2008|06:21] C:\Program Files\ eBay
[02/02/2005|01:48] C:\Program Files\ Elaborate Bytes
[31/07/2008|03:50] C:\Program Files\ Enigma Software Group
[04/02/2007|08:55] C:\Program Files\ Error Expert
[04/02/2008|04:48] C:\Program Files\ ErrorSweeper
[04/02/2008|04:17] C:\Program Files\ ewido anti-malware
[21/11/2008|10:11] C:\Program Files\ File Scanner Library (Spybot - Search & Destroy)
[17/02/2007|04:08] C:\Program Files\ filesubmit
[10/06/2008|03:00] C:\Program Files\ Foxit Software
[04/02/2008|04:56] C:\Program Files\ FrequentFlyerFriend
[04/02/2008|02:35] C:\Program Files\ Garden Composer
[12/10/2008|06:03] C:\Program Files\ Google
[14/02/2008|04:04] C:\Program Files\ Grisoft
[02/09/2008|09:07] C:\Program Files\ Hewlett-Packard
[01/02/2005|08:52] C:\Program Files\ HighMAT CD Writing Wizard
[12/04/2007|11:51] C:\Program Files\ Hijackthis
[02/09/2008|08:23] C:\Program Files\ HP
[21/11/2008|05:00] C:\Program Files\ InstallShield Installation Information
[15/12/2005|10:42] C:\Program Files\ Intel
[01/07/2008|11:06] C:\Program Files\ Internet Download Manager
[21/11/2008|08:59] C:\Program Files\ Internet Explorer
[19/03/2007|12:02] C:\Program Files\ iolo
[04/02/2008|02:36] C:\Program Files\ IrfanView
[28/07/2008|09:43] C:\Program Files\ Java
[08/06/2008|07:16] C:\Program Files\ Kaspersky Anti-Virus
[20/01/2008|04:05] C:\Program Files\ Kaspersky Lab
[18/01/2008|12:55] C:\Program Files\ Kodak
[30/11/2007|01:12] C:\Program Files\ KYE
[18/01/2008|04:26] C:\Program Files\ LG Electronics
[23/11/2007|04:33] C:\Program Files\ LG PC Suite
[05/02/2005|09:18] C:\Program Files\ LifeGlobe
[06/02/2005|08:55] C:\Program Files\ LucasArts
[16/11/2008|10:20] C:\Program Files\ Magellass
[23/11/2008|11:41] C:\Program Files\ Malwarebytes' Anti-Malware
[12/06/2007|05:15] C:\Program Files\ Maxtor
[22/08/2008|07:13] C:\Program Files\ Messenger
[29/01/2005|09:37] C:\Program Files\ Microsoft ActiveSync
[29/01/2005|08:38] C:\Program Files\ Microsoft Calculator Plus
[29/01/2005|01:46] C:\Program Files\ microsoft frontpage
[24/02/2007|03:11] C:\Program Files\ Microsoft Office
[29/01/2005|09:36] C:\Program Files\ Microsoft Visual Studio
[10/04/2008|04:56] C:\Program Files\ Microsoft Works
[29/01/2005|09:36] C:\Program Files\ Microsoft.NET
[21/11/2008|10:11] C:\Program Files\ Misc. Support Library (Spybot - Search & Destroy)
[17/11/2008|12:10] C:\Program Files\ Morpheus Upgrades
[19/05/2008|05:10] C:\Program Files\ Movie Maker
[24/11/2008|08:27] C:\Program Files\ Mozilla Firefox
[25/08/2008|10:17] C:\Program Files\ MSECACHE
[21/11/2008|05:07] C:\Program Files\ MSN
[29/01/2005|01:41] C:\Program Files\ MSN Gaming Zone
[01/02/2007|07:42] C:\Program Files\ MSXML 4.0
[27/08/2007|08:19] C:\Program Files\ MTV Networks
[19/05/2008|05:06] C:\Program Files\ NetMeeting
[19/09/2008|06:33] C:\Program Files\ Norton Ghost
[29/06/2005|06:43] C:\Program Files\ Online Services
[10/04/2008|08:43] C:\Program Files\ Optus Internet Security Suite
[19/05/2008|05:06] C:\Program Files\ Outlook Express
[23/02/2007|02:34] C:\Program Files\ PC Doc Pro
[08/05/2008|09:30] C:\Program Files\ PC Drivers HeadQuarters
[16/05/2008|12:11] C:\Program Files\ Picasa2
[19/06/2007|03:45] C:\Program Files\ PolderbitS
[09/08/2007|07:39] C:\Program Files\ Portrait Displays
[22/04/2007|05:39] C:\Program Files\ Pro Imaging Powertoys
[13/04/2006|04:54] C:\Program Files\ Prolink
[18/09/2008|10:45] C:\Program Files\ QuickTime
[15/05/2008|07:31] C:\Program Files\ Real
[15/05/2008|07:26] C:\Program Files\ Realtek AC97
[06/02/2005|06:16] C:\Program Files\ Realtek Sound Manager
[31/07/2008|03:50] C:\Program Files\ Registry Helper
[18/06/2007|03:51] C:\Program Files\ Registry Mechanic
[20/01/2008|03:25] C:\Program Files\ RegistryFix
[15/05/2008|11:58] C:\Program Files\ RegSweep
[21/11/2008|10:11] C:\Program Files\ SDHelper (Spybot - Search & Destroy)
[12/08/2005|09:18] C:\Program Files\ Silicon Integrated Systems
[12/08/2005|09:14] C:\Program Files\ SiSLan
[18/05/2008|07:01] C:\Program Files\ SIW
[10/11/2005|09:11] C:\Program Files\ SlySoft
[27/01/2008|02:26] C:\Program Files\ SmartSound Software
[21/11/2008|10:21] C:\Program Files\ Spybot - Search & Destroy
[28/10/2005|08:11] C:\Program Files\ Stomp
[19/11/2008|12:48] C:\Program Files\ SUPERAntiSpyware
[21/11/2008|10:11] C:\Program Files\ TeaTimer (Spybot - Search & Destroy)
[24/01/2008|10:04] C:\Program Files\ Trend Micro
[25/08/2008|10:26] C:\Program Files\ TRIXX
[30/08/2007|01:46] C:\Program Files\ TrojanHunter 4.6
[30/07/2008|02:59] C:\Program Files\ TrustDefender
[23/02/2007|03:04] C:\Program Files\ TweakNow RegCleaner Std
[29/06/2005|07:51] C:\Program Files\ UIU
[29/01/2005|01:53] C:\Program Files\ Uninstall Information
[10/03/2007|06:03] C:\Program Files\ Virtual Earth 3D
[25/08/2008|10:18] C:\Program Files\ Webroot
[12/08/2008|03:35] C:\Program Files\ Winamp
[10/07/2007|05:53] C:\Program Files\ Windows Defender
[29/01/2005|09:21] C:\Program Files\ Windows Journal Viewer
[22/01/2008|07:39] C:\Program Files\ Windows Live
[17/11/2008|02:27] C:\Program Files\ Windows Live Safety Center
[22/01/2008|07:39] C:\Program Files\ Windows Live Toolbar
[15/12/2005|10:45] C:\Program Files\ Windows Media Components
[10/03/2007|06:42] C:\Program Files\ Windows Media Connect
[10/03/2007|06:46] C:\Program Files\ Windows Media Connect 2
[19/05/2008|05:06] C:\Program Files\ Windows Media Player
[19/05/2008|05:06] C:\Program Files\ Windows NT
[22/06/2007|08:53] C:\Program Files\ Windows X
[29/01/2005|08:20] C:\Program Files\ WindowsUpdate
[15/12/2005|10:34] C:\Program Files\ WinFast
[11/04/2007|01:17] C:\Program Files\ WinRAR
[23/11/2008|05:00] C:\Program Files\ WinZip
[04/02/2008|02:38] C:\Program Files\ Wise Registry Cleaner
[29/01/2005|01:46] C:\Program Files\ xerox
[30/11/2007|02:51] C:\Program Files\ XoftSpySE
[21/01/2008|05:58] C:\Program Files\ XviD
[01/11/2007|05:27] C:\Program Files\ Yahoo!
[09/11/2007|10:50] C:\Program Files\ YHBPM
[19/11/2005|12:12] C:\Program Files\ Zero G Registry

——————–\\ Listing Folders in C:\Program Files\Common Files

[13/04/2006|07:10] C:\Program Files\Common Files\ ACD Systems
[10/06/2008|02:17] C:\Program Files\Common Files\ Adobe
[06/05/2008|11:17] C:\Program Files\Common Files\ Adobe AIR
[26/01/2008|12:27] C:\Program Files\Common Files\ Ahead
[18/09/2008|10:45] C:\Program Files\Common Files\ Apple
[29/11/2005|01:42] C:\Program Files\Common Files\ Borland Shared
[29/01/2005|09:36] C:\Program Files\Common Files\ DESIGNER
[01/02/2007|12:31] C:\Program Files\Common Files\ Hewlett-Packard
[01/02/2007|12:34] C:\Program Files\Common Files\ HP
[15/12/2005|10:44] C:\Program Files\Common Files\ InstallShield
[14/06/2008|09:19] C:\Program Files\Common Files\ Java
[29/01/2005|09:37] C:\Program Files\Common Files\ L&H;
[22/01/2008|07:38] C:\Program Files\Common Files\ Microsoft Shared
[29/01/2005|01:43] C:\Program Files\Common Files\ MSSoap
[10/02/2008|09:13] C:\Program Files\Common Files\ Nero
[29/01/2005|12:30] C:\Program Files\Common Files\ ODBC
[10/09/2008|04:43] C:\Program Files\Common Files\ Real
[29/01/2005|01:43] C:\Program Files\Common Files\ Services
[30/11/2007|01:12] C:\Program Files\Common Files\ snpstd
[28/10/2005|08:12] C:\Program Files\Common Files\ Sonic
[29/01/2005|12:30] C:\Program Files\Common Files\ SpeechEngines
[23/11/2008|11:07] C:\Program Files\Common Files\ Symantec Shared
[19/05/2008|05:06] C:\Program Files\Common Files\ System
[22/01/2008|07:43] C:\Program Files\Common Files\ Ulead Systems
[29/01/2005|08:36] C:\Program Files\Common Files\ Vbox
[27/11/2007|03:57] C:\Program Files\Common Files\ WindowsLiveInstaller
[07/09/2008|06:20] C:\Program Files\Common Files\ Wise Installation Wizard
[10/09/2008|04:43] C:\Program Files\Common Files\ xing shared

——————–\\ Process

( 66 Processes )

… OK !

——————–\\ Searching with S_Lop

No Lop folder found !

——————–\\ Searching for Lop Files - Folders

No Lop folder found !

——————–\\ Searching within the Registry

….. OK !

——————–\\ Checking the Hosts file

Hosts file CLEAN


——————–\\ Searching for hidden files with Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-24 08:47:40
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes …
scanning hidden files …
scan completed successfully
hidden processes: 0
hidden files: 0

——————–\\ Searching for other infections

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters]
DhcpNameServer REG_SZ [removed] [removed]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters]
DhcpNameServer REG_SZ [removed] [removed]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters]
DhcpNameServer REG_SZ [removed] [removed]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\..\{91649239-7301-4D26-84E9-7DFEE5C93524}]
DhcpNameServer REG_SZ [removed] [removed]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\..\{91649239-7301-4D26-84E9-7DFEE5C93524}]
DhcpNameServer REG_SZ [removed] [removed]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\..\{91649239-7301-4D26-84E9-7DFEE5C93524}]
DhcpNameServer REG_SZ [removed] [removed]
==> WAREOUT <==

——————–\\ Cracks & Keygens ..

C:\DOCUME~1\Owner\My Documents\LimeWire\Saved\Nero 7 Ultra Edition (ENHANCED) + Serials!!(REAL) v7.8.5.0 for Windows Vista!! … crack keygen vista nero 7 mp3 dvd tv multichannel windows serial code (RVGJR) 1 - Copy
C:\DOCUME~1\Owner\My Documents\LimeWire\Saved\Nero 7 Ultra Edition (ENHANCED) + Serials!!(REAL) v7.8.5.0 for Windows Vista!! … crack keygen vista nero 7 mp3 dvd tv multichannel windows serial code (RVGJR) 1 - Copy.rar
C:\DOCUME~1\Owner\My Documents\LimeWire\Saved\Nero Burning Rom 6.3.0.0 + Vision Express 2.2 + KeyGen + DVD-PlugIn.zip


[F:13][D:3]-> C:\DOCUME~1\Owner\LOCALS~1\Temp
[F:2][D:0]-> C:\DOCUME~1\Owner\Cookies
[F:18][D:4]-> C:\DOCUME~1\Owner\LOCALS~1\TEMPOR~1\content.IE5

1 - "C:\Lop SD\LopR_1.txt" - Mon 24/11/2008| 8:48 - Option : [1]

——————–\\ Scan completed at 8:48:34
Post #13
ed-e-dee, I jumped the gun a little by already posting instructions. I really wanted the LOP S&D to confirm the wareout. Please continue this the instructions given. We will deal with the cracks (which is probably the source of your infection) later.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI