What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Way too many popups

17 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
I've recently run ad-aware 2008 and also malware's antispyware programs which found items that they've deleted, but I'm still getting alot of popups in the internet. They seem to be worse when my son tries to open his myspace page. Can you tell me what else I can try to get rid of them?
Logfile of HijackThis v1.99.1
Scan saved at 3:52:42 PM, on 12/1/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZuneBusEnum.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Creative\VoiceCenter\AndreaVC.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\DOCUME~1\Cher\LOCALS~1\Temp\clclean.0001
C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LMPDPSRV.EXE
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\MUSICM~1\MUSICM~3\MMDiag.exe
C:\Program Files\McAfee\Common Framework\UdaterUI.exe
C:\Program Files\Zune\ZuneLauncher.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mim.exe
C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe
C:\WINDOWS\system32\wuauclt.exe
c:\program files\common files\installshield\updateservice\isuspm.exe
C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://us.mcafee.com/root/campaign.asp?cid=16313
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\Scriptcl.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\Program Files\GoogleAFE\GoogleAE.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [MBMon] Rundll32 CTMBHA.DLL,MBMon
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [VoiceCenter] "C:\Program Files\Creative\VoiceCenter\AndreaVC.exe" /tray
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [ISUSPM Startup] "c:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~3\mimboot.exe
O4 - HKLM\..\Run: [LMPDPSRV] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LMPDPSRV.EXE
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Zune Launcher] "C:\Program Files\Zune\ZuneLauncher.exe"
O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DellTransferAgent] "C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe"
O4 - HKCU\..\Run: [EasyLinkAdvisor] "C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup
O4 - Global Startup: Commonwealth of Pennsylvania VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://qtinstall.info.apple.com/qtactivex/QTPlugin.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m…01/mcinsctl.cab
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/…tiveXPlugin.cab
O16 - DPF: {E473A65C-8087-49A3-AFFD-C5BC4A10669B} (Quantum Streaming IE Player Class) - http://mvnet.xlontech.net/qm/fox/06101102/qsp2ie06101001.cab
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Unknown owner - C:\Program Files\McAfee\Common Framework\FrameworkService.exe" /ServiceStart (file missing)
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
Post #2
Hello CherBear

Welcome to the Whatthetech Malware Removal Forum

C:\Program Files\Hijackthis <—Your version of Hijackthis is outdated, delete this version so there won't be any confusion in the future.


Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.<– Don't forget this
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy and Paste the entire report in your next reply along with a New Hijackthis log.





Download Trendmicros Hijackthis to your desktop.
  • Double click it to install
  • Follow the prompts and by default it will install in C:\Program Files\Trendmicro\Hijackthis\Highjackthis.exe
  • Open HJT Scan and Save a Log File, it will open in Notepad
  • Go to Format and make sure Wordwrap is Unchecked
  • Go to Edit> Select All…..Edit > Copy and Paste the new log into this thread by using the Post Reply and not start a New Thread.
DO NOT have HijackThis fix anything yet. Most of what it finds will be harmless or even required.


Post the Malwarebytes log and a new hijackthis log please
Post #3
Ken545,
Thank you for your quick response.

I removed the old version of HiJack This.
I installed Malwarebytes Anti-malware and ran it. It said nothing was found. This is the program that I had run before I created this post.
Here is the log
Malwarebytes' Anti-Malware 1.30
Database version: 1450
Windows 5.1.2600 Service Pack 3

12/2/2008 7:43:22 PM
mbam-log-2008-12-02 (19-43-22).txt

Scan type: Quick Scan
Objects scanned: 79269
Time elapsed: 12 minute(s), 34 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Installed new version of Hijack this from trend and here is the log
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:46:59 PM, on 12/2/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZuneBusEnum.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Creative\VoiceCenter\AndreaVC.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LMPDPSRV.EXE
C:\PROGRA~1\MUSICM~1\MUSICM~3\MMDiag.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\DOCUME~1\Cher\LOCALS~1\Temp\clclean.0001
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mim.exe
C:\Program Files\McAfee\Common Framework\UdaterUI.exe
C:\Program Files\Zune\ZuneLauncher.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe
C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://cm.my.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://us.mcafee.com/root/campaign.asp?cid=16313
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\Scriptcl.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\Program Files\GoogleAFE\GoogleAE.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [MBMon] Rundll32 CTMBHA.DLL,MBMon
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [VoiceCenter] "C:\Program Files\Creative\VoiceCenter\AndreaVC.exe" /tray
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~3\mimboot.exe
O4 - HKLM\..\Run: [LMPDPSRV] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LMPDPSRV.EXE
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Zune Launcher] "C:\Program Files\Zune\ZuneLauncher.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DellTransferAgent] "C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe"
O4 - HKCU\..\Run: [EasyLinkAdvisor] "C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup
O4 - HKUS\S-1-5-21-2372229341-3047002395-576542031-1007\..\Run: [SetDefaultMIDI] MIDIDef.exe (User 'Kyle')
O4 - HKUS\S-1-5-21-2372229341-3047002395-576542031-1007\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R (User 'Kyle')
O4 - HKUS\S-1-5-21-2372229341-3047002395-576542031-1007\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime (User 'Kyle')
O4 - HKUS\S-1-5-21-2372229341-3047002395-576542031-1007\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'Kyle')
O4 - HKUS\S-1-5-21-2372229341-3047002395-576542031-1007\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet (User 'Kyle')
O4 - HKUS\S-1-5-21-2372229341-3047002395-576542031-1007\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe (User 'Kyle')
O4 - HKUS\S-1-5-21-2372229341-3047002395-576542031-1007\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Kyle')
O4 - HKUS\S-1-5-21-2372229341-3047002395-576542031-1007\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup (User 'Kyle')
O4 - HKUS\S-1-5-21-2372229341-3047002395-576542031-1007\..\Run: [EasyLinkAdvisor] "C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup (User 'Kyle')
O4 - HKUS\S-1-5-21-2372229341-3047002395-576542031-1007\..\Run: [lphcglpj0erdj] C:\WINDOWS\system32\lphcglpj0erdj.exe (User 'Kyle')
O4 - HKUS\S-1-5-21-2372229341-3047002395-576542031-1007\..\Run: [SVCHOST.EXE] C:\WINDOWS\system32\drivers\svchost.exe (User 'Kyle')
O4 - HKUS\S-1-5-21-2372229341-3047002395-576542031-1007\..\Run: [brastk] C:\WINDOWS\system32\brastk.exe (User 'Kyle')
O4 - HKUS\S-1-5-21-2372229341-3047002395-576542031-1007\..\Run: [lovikupibu] Rundll32.exe "C:\Documents and Settings\All Users\Application Data\sotujuba\sotujuba.dll",s (User 'Kyle')
O4 - HKUS\S-1-5-21-2372229341-3047002395-576542031-1007\..\Run: [CPM27ee027a] Rundll32.exe "C:\Documents and Settings\All Users\Application Data\yugepiyo\yugepiyo.dll",a (User 'Kyle')
O4 - Global Startup: Commonwealth of Pennsylvania VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://qtinstall.info.apple.com/qtactivex/QTPlugin.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m…01/mcinsctl.cab
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/…tiveXPlugin.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.com/p…obat/nos/gp.cab
O16 - DPF: {E473A65C-8087-49A3-AFFD-C5BC4A10669B} (Quantum Streaming IE Player Class) - http://mvnet.xlontech.net/qm/fox/06101102/qsp2ie06101001.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: getPlus® Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe

–
End of file - 13632 bytes
Thanks for your help!!
CherBear
Post #4
Hello,

The newer version of HJT is showing more than the older, thanks for changing it.


Download ComboFix from one of these locations:

Link 1
Link 2
Link 3

* IMPORTANT !!! Save ComboFix.exe to your Desktop


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
  • See this Link for programs that need to be disabled and instruction on how to disable them.
  • Remember to re-enable them when we're done.

  • Double click on ComboFix.exe & follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


[external image: Posted Image]



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply along with a New Hijackthis log.

*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.
Post #5
Here is the Combo Fix log;
ComboFix 08-12-02.02 - Cher 2008-12-03 16:12:31.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.611 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\bold.log
c:\windows\Downloaded Program Files\setup.inf
c:\windows\system32\mdm.exe

.
((((((((((((((((((((((((( Files Created from 2008-11-03 to 2008-12-03 )))))))))))))))))))))))))))))))
.

2008-12-03 06:18 . 2008-12-03 06:18 d——– c:\documents and settings\All Users\Application Data\fomikago
2008-12-03 06:18 . 2008-12-03 06:18 d——– c:\documents and settings\All Users\Application Data\biwiluga
2008-12-02 19:46 . 2008-12-02 19:46 d——– c:\program files\Trend Micro
2008-12-02 18:17 . 2008-12-02 18:17 d——– c:\documents and settings\All Users\Application Data\yugepiyo
2008-12-02 18:17 . 2008-12-02 18:18 d——– c:\documents and settings\All Users\Application Data\nidawila
2008-12-02 06:17 . 2008-12-02 12:52 d——– c:\documents and settings\All Users\Application Data\tisisiga
2008-12-02 06:17 . 2008-12-02 06:17 d——– c:\documents and settings\All Users\Application Data\huwiyuke
2008-12-01 18:17 . 2008-12-01 18:17 d——– c:\documents and settings\All Users\Application Data\vufewuta
2008-12-01 18:17 . 2008-12-01 18:17 d——– c:\documents and settings\All Users\Application Data\jayoriji
2008-12-01 17:16 . 2008-12-01 17:16 d——– c:\program files\Common Files\Adobe AIR
2008-12-01 17:15 . 2008-12-01 17:15 d——– c:\program files\Common Files\Adobe
2008-12-01 16:49 . 2008-12-01 16:49 d——– c:\program files\NOS
2008-12-01 16:49 . 2008-12-01 16:54 d——– c:\documents and settings\All Users\Application Data\NOS
2008-11-29 20:06 . 2008-11-29 20:06 d——– c:\documents and settings\All Users\Application Data\sisofeda
2008-11-29 20:06 . 2008-11-29 20:06 d——– c:\documents and settings\All Users\Application Data\lunazuse
2008-11-29 11:37 . 2008-11-29 11:37 d——– c:\windows\system32\scripting
2008-11-29 11:37 . 2008-11-29 11:37 d——– c:\windows\system32\en
2008-11-29 11:37 . 2008-11-29 11:37 d——– c:\windows\system32\bits
2008-11-29 11:37 . 2008-11-29 11:37 d——– c:\windows\l2schemas
2008-11-29 11:34 . 2008-11-29 11:37 d——– c:\windows\ServicePackFiles
2008-11-29 09:47 . 2008-12-02 19:29 d——– c:\program files\Malwarebytes' Anti-Malware
2008-11-29 09:47 . 2008-11-29 09:47 d——– c:\documents and settings\Cher\Application Data\Malwarebytes
2008-11-29 09:47 . 2008-11-29 09:47 d——– c:\documents and settings\All Users\Application Data\Malwarebytes
2008-11-29 09:47 . 2008-10-22 16:28 38,496 –a—— c:\windows\system32\drivers\mbamswissarmy.sys
2008-11-29 09:47 . 2008-10-22 16:28 15,504 –a—— c:\windows\system32\drivers\mbam.sys
2008-11-29 08:05 . 2008-11-29 08:06 d——– c:\documents and settings\All Users\Application Data\yijeyenu
2008-11-29 08:05 . 2008-11-29 08:05 d——– c:\documents and settings\All Users\Application Data\kayezera
2008-11-28 20:05 . 2008-11-28 20:05 d——– c:\documents and settings\All Users\Application Data\punefovu
2008-11-28 20:05 . 2008-11-28 20:05 d——– c:\documents and settings\All Users\Application Data\hotajumo
2008-11-28 19:05 . 2008-11-28 19:05 d——– c:\documents and settings\All Users\Application Data\sotujuba
2008-11-28 19:05 . 2008-11-28 19:05 d——– c:\documents and settings\All Users\Application Data\sokawuge
2008-11-28 19:05 . 2008-11-28 19:05 d——– c:\documents and settings\All Users\Application Data\ruyoneta
2008-11-28 19:05 . 2008-11-28 19:05 d——– c:\documents and settings\All Users\Application Data\norolija
2008-11-28 19:05 . 2008-11-28 19:05 d——– c:\documents and settings\All Users\Application Data\hivoneka
2008-11-28 19:05 . 2008-11-28 19:05 d——– c:\documents and settings\All Users\Application Data\bawesawe
2008-11-28 07:05 . 2008-11-28 07:05 d——– c:\documents and settings\All Users\Application Data\yubitadi
2008-11-28 07:05 . 2008-11-28 07:05 d——– c:\documents and settings\All Users\Application Data\harugidu
2008-11-27 19:05 . 2008-11-29 11:12 d——– c:\documents and settings\All Users\Application Data\zisigohu
2008-11-27 19:05 . 2008-11-29 11:12 d——– c:\documents and settings\All Users\Application Data\jibagiba
2008-11-27 07:05 . 2008-11-29 11:12 d——– c:\documents and settings\All Users\Application Data\wedaboya
2008-11-27 07:05 . 2008-11-29 11:12 d——– c:\documents and settings\All Users\Application Data\pudepila
2008-11-26 19:05 . 2008-11-29 11:12 d——– c:\documents and settings\All Users\Application Data\pazimovu
2008-11-26 19:05 . 2008-11-29 11:12 d——– c:\documents and settings\All Users\Application Data\papulifu
2008-11-26 07:05 . 2008-11-29 11:12 d——– c:\documents and settings\All Users\Application Data\zimisefi
2008-11-26 07:05 . 2008-11-29 11:12 d——– c:\documents and settings\All Users\Application Data\tisugute
2008-11-25 19:05 . 2008-11-29 09:53 d——– c:\documents and settings\All Users\Application Data\juyereni
2008-11-25 19:05 . 2008-11-29 09:50 d——– c:\documents and settings\All Users\Application Data\filarilu
2008-11-24 19:04 . 2008-11-24 19:04 d——– c:\documents and settings\All Users\Application Data\rinotune
2008-11-24 19:04 . 2008-11-24 19:04 d——– c:\documents and settings\All Users\Application Data\bareyufa
2008-11-24 07:04 . 2008-11-24 07:04 d——– c:\documents and settings\All Users\Application Data\mesasodu
2008-11-24 07:04 . 2008-11-24 07:04 d——– c:\documents and settings\All Users\Application Data\fuwupiga
2008-11-23 19:03 . 2008-11-23 19:04 d——– c:\documents and settings\All Users\Application Data\holurohu
2008-11-23 19:03 . 2008-11-23 19:04 d——– c:\documents and settings\All Users\Application Data\fodobore
2008-11-23 07:03 . 2008-11-23 07:03 d——– c:\documents and settings\All Users\Application Data\pefedoki
2008-11-23 07:03 . 2008-11-23 07:03 d——– c:\documents and settings\All Users\Application Data\girodili
2008-11-22 19:03 . 2008-11-22 19:03 d——– c:\documents and settings\All Users\Application Data\tenejive
2008-11-22 19:03 . 2008-11-22 19:03 d——– c:\documents and settings\All Users\Application Data\mukozora
2008-11-22 07:03 . 2008-11-22 07:03 d——– c:\documents and settings\All Users\Application Data\yotukano
2008-11-22 07:03 . 2008-11-22 07:03 d——– c:\documents and settings\All Users\Application Data\tutumowu
2008-11-21 21:44 . 2008-11-21 21:44 d——– c:\documents and settings\Kyle\WINDOWS
2008-11-21 19:02 . 2008-11-21 19:03 d——– c:\documents and settings\All Users\Application Data\hahupidi
2008-11-21 19:02 . 2008-11-21 19:03 d——– c:\documents and settings\All Users\Application Data\fujuyiya
2008-11-21 07:02 . 2008-11-29 09:54 d——– c:\documents and settings\All Users\Application Data\tutizoka
2008-11-21 07:02 . 2008-11-29 09:53 d——– c:\documents and settings\All Users\Application Data\kuhabero
2008-11-20 19:02 . 2008-11-29 09:54 d——– c:\documents and settings\All Users\Application Data\yeniboja
2008-11-20 19:02 . 2008-11-29 09:53 d——– c:\documents and settings\All Users\Application Data\kotamili
2008-11-20 07:02 . 2008-11-29 09:52 d——– c:\documents and settings\All Users\Application Data\rifewimi
2008-11-20 07:02 . 2008-11-29 09:51 d——– c:\documents and settings\All Users\Application Data\nudebame
2008-11-19 19:02 . 2008-11-29 09:54 d——– c:\documents and settings\All Users\Application Data\wulamolu
2008-11-19 19:02 . 2008-11-29 09:53 d——– c:\documents and settings\All Users\Application Data\kotipuki
2008-11-19 07:02 . 2008-11-29 09:52 d——– c:\documents and settings\All Users\Application Data\robofada
2008-11-19 07:02 . 2008-11-29 09:52 d——– c:\documents and settings\All Users\Application Data\jeyibefa
2008-11-18 19:02 . 2008-11-29 09:51 d——– c:\documents and settings\All Users\Application Data\nedakodo
2008-11-18 19:02 . 2008-11-29 09:50 d——– c:\documents and settings\All Users\Application Data\dasidetu
2008-11-18 07:01 . 2008-11-22 11:36 d——– c:\documents and settings\All Users\Application Data\vosahesa
2008-11-18 07:01 . 2008-11-29 09:51 d——– c:\documents and settings\All Users\Application Data\miyebogu
2008-11-17 19:01 . 2008-11-21 18:21 d——– c:\documents and settings\All Users\Application Data\wihohize
2008-11-17 19:01 . 2008-11-21 18:21 d——– c:\documents and settings\All Users\Application Data\geyeziju
2008-11-17 07:01 . 2008-11-27 08:02 d——– c:\documents and settings\All Users\Application Data\waledidu
2008-11-17 07:01 . 2008-11-27 08:02 d——– c:\documents and settings\All Users\Application Data\ragakune
2008-11-16 19:01 . 2008-11-22 11:36 d——– c:\documents and settings\All Users\Application Data\suhayiya
2008-11-16 19:01 . 2008-11-22 11:36 d——– c:\documents and settings\All Users\Application Data\gipitobi
2008-11-16 07:00 . 2008-11-29 09:52 d——– c:\documents and settings\All Users\Application Data\hatapuni
2008-11-16 07:00 . 2008-11-29 09:52 d——– c:\documents and settings\All Users\Application Data\guborusi
2008-11-15 19:00 . 2008-11-29 09:51 d——– c:\documents and settings\All Users\Application Data\rawopupi
2008-11-15 19:00 . 2008-11-29 09:54 d——– c:\documents and settings\All Users\Application Data\lirumega
2008-11-15 07:00 . 2008-11-29 09:54 d——– c:\documents and settings\All Users\Application Data\wimiwufa
2008-11-15 07:00 . 2008-11-29 09:51 d——– c:\documents and settings\All Users\Application Data\nimiwuvi
2008-11-14 19:00 . 2008-11-29 09:51 d——– c:\documents and settings\All Users\Application Data\papehehi
2008-11-14 19:00 . 2008-11-29 09:50 d——– c:\documents and settings\All Users\Application Data\gesumeye
2008-11-14 07:00 . 2008-11-29 09:53 d——– c:\documents and settings\All Users\Application Data\ledekuka
2008-11-14 07:00 . 2008-11-22 11:36 d——– c:\documents and settings\All Users\Application Data\bojitebu
2008-11-13 18:59 . 2008-11-29 09:52 d——– c:\documents and settings\All Users\Application Data\gozonisi
2008-11-13 18:59 . 2008-11-29 09:49 d——– c:\documents and settings\All Users\Application Data\gokegaze
2008-11-13 06:59 . 2008-11-22 11:36 d——– c:\documents and settings\All Users\Application Data\layeyiro
2008-11-12 18:59 . 2008-11-29 09:50 d——– c:\documents and settings\All Users\Application Data\fulefoze
2008-11-12 06:59 . 2008-11-29 09:51 d——– c:\documents and settings\All Users\Application Data\mizuyoha
2008-11-12 06:59 . 2008-11-22 11:36 d——– c:\documents and settings\All Users\Application Data\jaditibi
2008-11-11 18:58 . 2008-11-29 09:55 d——– c:\documents and settings\All Users\Application Data\zobirawa
2008-11-11 18:58 . 2008-11-29 09:53 d——– c:\documents and settings\All Users\Application Data\jisanifu
2008-11-11 17:47 . 2008-11-11 17:47 d——– c:\program files\Sun
2008-11-11 17:47 . 2008-06-10 02:32 73,728 –a—— c:\windows\system32\javacpl.cpl
2008-11-11 17:18 . 2008-11-11 17:18 d——– c:\documents and settings\Kyle\SERVER 508 oo
2008-11-11 16:26 . 2008-11-11 16:30 d——– C:\.mpr_file_store_32
2008-11-11 14:29 . 2008-10-24 06:21 455,296 ——— c:\windows\system32\dllcache\mrxsmb.sys
2008-11-11 06:58 . 2008-11-21 18:21 d——– c:\documents and settings\All Users\Application Data\vuzepeta
2008-11-11 06:58 . 2008-11-21 18:21 d——– c:\documents and settings\All Users\Application Data\basahipo
2008-11-10 18:58 . 2008-11-29 09:54 d——– c:\documents and settings\All Users\Application Data\vopidoko
2008-11-10 18:58 . 2008-11-29 09:50 d——– c:\documents and settings\All Users\Application Data\gihezawo
2008-11-10 06:58 . 2008-11-29 09:51 d——– c:\documents and settings\All Users\Application Data\ravoruna
2008-11-10 06:58 . 2008-11-29 11:12 d——– c:\documents and settings\All Users\Application Data\babupata
2008-11-09 20:09 . 2008-11-09 20:09 d——– c:\program files\Lavasoft
2008-11-09 20:09 . 2008-11-09 20:09 d——– c:\program files\Common Files\Wise Installation Wizard
2008-11-09 20:09 . 2008-11-09 20:09 d——– c:\documents and settings\All Users\Application Data\Lavasoft
2008-11-08 15:28 . 2008-11-27 08:23 d——– c:\documents and settings\All Users\Application Data\yikiwasu
2008-11-08 15:28 . 2008-11-27 08:22 d——– c:\documents and settings\All Users\Application Data\gipopahu
2008-11-08 03:27 . 2008-11-29 09:53 d——– c:\documents and settings\All Users\Application Data\ketisozi
2008-11-08 03:27 . 2008-11-29 09:49 d——– c:\documents and settings\All Users\Application Data\bujusafu
2008-11-07 15:27 . 2008-11-29 09:54 d——– c:\documents and settings\All Users\Application Data\yaleweyu
2008-11-07 15:27 . 2008-11-29 09:50 d——– c:\documents and settings\All Users\Application Data\dozuferi
2008-11-07 13:22 . 2008-11-29 11:12 d——– c:\documents and settings\All Users\Application Data\ponigadi
2008-11-07 13:22 . 2008-11-29 11:12 d——– c:\documents and settings\All Users\Application Data\pipakuja
2008-11-07 13:22 . 2008-11-29 11:13 d——– c:\documents and settings\All Users\Application Data\gozohapi

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-03 11:35 31 —-a-w c:\documents and settings\Kyle\jagex_runescape_preferences.dat
2008-11-29 17:11 ——— d—–w c:\program files\CMS Products
2008-11-29 16:12 ——— d—–w c:\documents and settings\Kyle\Application Data\FrostWire
2008-11-11 22:47 ——— d—–w c:\program files\Java
2008-10-24 11:21 455,296 ——w c:\windows\system32\drivers\mrxsmb.sys
2008-10-20 00:28 0 —ha-w c:\windows\system32\drivers\Msft_User_ZuneDriver_01_07_00.Wdf
2008-10-20 00:28 0 —ha-w c:\windows\system32\drivers\Msft_Kernel_WinUSB_01007.Wdf
2008-10-20 00:27 0 —ha-w c:\windows\system32\drivers\MsftWdf_user_01_07_00.Wdf
2008-10-20 00:23 ——— d—–w c:\program files\Zune
2008-10-20 00:19 0 —ha-w c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2008-10-20 00:19 0 —ha-w c:\windows\system32\drivers\Msft_Kernel_zumbus_01007.Wdf
2008-10-16 19:13 202,776 —-a-w c:\windows\system32\wuweb.dll
2008-10-16 19:13 202,776 —-a-w c:\windows\system32\dllcache\wuweb.dll
2008-10-16 19:13 1,809,944 —-a-w c:\windows\system32\wuaueng.dll
2008-10-16 19:13 1,809,944 —-a-w c:\windows\system32\dllcache\wuaueng.dll
2008-10-16 19:12 561,688 —-a-w c:\windows\system32\wuapi.dll
2008-10-16 19:12 561,688 —-a-w c:\windows\system32\dllcache\wuapi.dll
2008-10-16 19:12 323,608 —-a-w c:\windows\system32\wucltui.dll
2008-10-16 19:12 323,608 —-a-w c:\windows\system32\dllcache\wucltui.dll
2008-10-16 19:09 92,696 —-a-w c:\windows\system32\dllcache\cdm.dll
2008-10-16 19:09 92,696 —-a-w c:\windows\system32\cdm.dll
2008-10-16 19:09 51,224 —-a-w c:\windows\system32\wuauclt.exe
2008-10-16 19:09 51,224 —-a-w c:\windows\system32\dllcache\wuauclt.exe
2008-10-16 19:09 43,544 —-a-w c:\windows\system32\wups2.dll
2008-10-16 19:08 34,328 —-a-w c:\windows\system32\wups.dll
2008-10-16 19:08 34,328 —-a-w c:\windows\system32\dllcache\wups.dll
2008-10-16 18:55 4,236 –sha-w c:\windows\system32\KGyGaAvL.sys
2008-10-15 16:34 337,408 ——w c:\windows\system32\dllcache\netapi32.dll
2008-10-03 17:41 6,066,176 ——w c:\windows\system32\dllcache\ieframe.dll
2008-09-30 21:43 1,286,152 —-a-w c:\windows\system32\msxml4.dll
2008-09-15 12:12 1,846,400 ——w c:\windows\system32\win32k.sys
2008-09-15 12:12 1,846,400 ——w c:\windows\system32\dllcache\win32k.sys
2008-09-12 22:48 245,664 —-a-w c:\windows\system32\ZuneWlanCfgSvc.exe
2008-09-12 22:46 61,856 —-a-w c:\windows\system32\ZuneBusEnum.exe
2008-09-12 22:32 73,216 —-a-w c:\windows\system32\ZuneUsbTransport.dll
2008-09-12 22:32 57,344 —-a-w c:\windows\system32\ZuneRegUtil.dll
2008-09-12 22:32 310,272 —-a-w c:\windows\system32\ZuneNetProxy.dll
2008-09-12 22:32 18,944 —-a-w c:\windows\system32\ZuneTcp2Udp.dll
2008-09-12 22:32 145,920 —-a-w c:\windows\system32\ZuneMTPZ.dll
2008-09-12 22:32 12,800 —-a-w c:\windows\system32\ZunePTDNS.dll
2008-09-10 01:14 1,307,648 ——w c:\windows\system32\msxml6.dll
2008-09-10 01:14 1,307,648 ——w c:\windows\system32\dllcache\msxml6.dll
2008-09-08 10:41 333,824 ——w c:\windows\system32\dllcache\srv.sys
2008-09-04 17:15 1,106,944 —-a-w c:\windows\system32\msxml3.dll
2008-09-04 17:15 1,106,944 ——w c:\windows\system32\dllcache\msxml3.dll
2008-07-23 21:01 4 —-a-w c:\documents and settings\Kyle\version.dat
2008-07-19 03:19 5,287,936 —-a-w c:\documents and settings\Kyle\soul.exe
2008-07-18 23:15 614,400 —-a-w c:\documents and settings\Kyle\C3_CORE_DLL.dll
2008-07-17 18:33 200,704 —-a-w c:\documents and settings\Kyle\GraphicData.dll
2008-07-17 18:33 159,744 —-a-w c:\documents and settings\Kyle\graphic.dll
2008-07-17 18:33 135,168 —-a-w c:\documents and settings\Kyle\Role3D.dll
2008-05-28 04:43 167,936 —-a-w c:\documents and settings\Kyle\Chat.dll
2008-05-26 19:11 360,448 —-a-w c:\documents and settings\Kyle\GameData.dll
2008-05-26 19:10 122,880 —-a-w c:\documents and settings\Kyle\RoleView.dll
2007-12-04 01:14 3,932 —-a-w c:\documents and settings\Cher\Application Data\LMLayout.dat
2007-12-04 01:14 268 —-a-w c:\documents and settings\Cher\Application Data\LMCPaper.dat
2007-12-04 01:05 3,932 —-a-w c:\documents and settings\Kyle\Application Data\LMLayout.dat
2007-12-04 01:05 268 —-a-w c:\documents and settings\Kyle\Application Data\LMCPaper.dat
1998-12-08 21:53 99,840 ——w c:\program files\Common Files\IRAABOUT.DLL
1998-12-08 21:53 70,144 ——w c:\program files\Common Files\IRAMDMTR.DLL
1998-12-08 21:53 48,640 ——w c:\program files\Common Files\IRALPTTR.DLL
1998-12-08 21:53 31,744 ——w c:\program files\Common Files\IRAWEBTR.DLL
1998-12-08 21:53 186,368 ——w c:\program files\Common Files\IRAREG.DLL
1998-12-08 21:53 17,920 ——w c:\program files\Common Files\IRASRIAL.DLL
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Creative Detector"="c:\program files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 102400]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"DellTransferAgent"="c:\documents and settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe" [2007-11-13 135168]
"EasyLinkAdvisor"="c:\program files\Linksys EasyLink Advisor\LinksysAgent.exe" [2006-04-02 389120]
"SetDefaultMIDI"="MIDIDef.exe" [2004-12-22 c:\windows\MIDIDEF.EXE]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-29 67584]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 344064]
"IntelMeM"="c:\program files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-03 221184]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 53248]
"CTSysVol"="c:\program files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-09-15 57344]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
"VoiceCenter"="c:\program files\Creative\VoiceCenter\AndreaVC.exe" [2005-09-19 1159168]
"RealTray"="c:\program files\Real\RealPlayer\RealPlay.exe" [2006-02-17 26112]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 249856]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 81920]
"MimBoot"="c:\progra~1\MUSICM~1\MUSICM~3\mimboot.exe" [2005-09-08 8192]
"LMPDPSRV"="c:\windows\System32\spool\DRIVERS\W32X86\3\LMPDPSRV.EXE" [2002-09-05 45056]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2005-05-31 122941]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2006-10-30 256576]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-12-07 282624]
"MSKDetectorExe"="c:\program files\McAfee\SpamKiller\MSKDetct.exe" [2006-11-07 1121280]
"ShStatEXE"="c:\program files\McAfee\VirusScan Enterprise\SHSTAT.EXE" [2007-02-22 112216]
"McAfeeUpdaterUI"="c:\program files\McAfee\Common Framework\UdaterUI.exe" [2006-12-19 136768]
"Zune Launcher"="c:\program files\Zune\ZuneLauncher.exe" [2008-09-12 160160]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"SigmatelSysTrayApp"="stsystra.exe" [2005-03-23 c:\windows\stsystra.exe]
"MBMon"="CTMBHA.DLL" [2005-05-19 c:\windows\system32\CTMBHA.DLL]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Commonwealth of Pennsylvania VPN Client.lnk - c:\program files\Cisco Systems\VPN Client\vpngui.exe [2006-03-25 1470480]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-02-17 65588]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\LMpdpsrv.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Microsoft Office\\Office\\1033\\WFXMSRVR.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\America Online 9.0\\waol.exe"=
"c:\\Program Files\\McAfee\\Common Framework\\FrameworkService.exe"=

R3 EL99X;3Com 3C99x EtherLink XL Adapter;c:\windows\system32\DRIVERS\EL99XN51.SYS [2006-08-04 138240]
S2 portD;CMS PortIO Service;c:\windows\system32\DRIVERS\portd2k.sys []
S3 AVC3310F;AVC-3310/AVC-3610 USB Loader;c:\windows\system32\Drivers\avcuwfl2.sys [2006-09-04 17536]
S3 AvcUWil2;Adaptec AVC-3210/3310/3610 USB Device;c:\windows\system32\DRIVERS\avcuwil2.sys [2006-09-04 1434080]
S3 getPlus® Helper;getPlus® Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2008-12-01 33752]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}]
\Shell\AutoRun\command - E:\setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{73c5282a-afca-11da-9de6-00038a000015}]
\Shell\AutoRun\command - J:\LinksysConnectPC.exe

*Newly Created Service* - PROCEXP90
.
Contents of the 'Scheduled Tasks' folder

2008-11-27 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2006-10-10 17:13]
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-03 16:14:28
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-12-03 16:15:16
ComboFix-quarantined-files.txt 2008-12-03 21:15:12

Pre-Run: 3,858,173,952 bytes free
Post-Run: 5,139,247,104 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect

295 — E O F — 2008-11-30 08:01:14
And here is the Hijack This log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:17:35 PM, on 12/3/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZuneBusEnum.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Creative\VoiceCenter\AndreaVC.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LMPDPSRV.EXE
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\MUSICM~1\MUSICM~3\MMDiag.exe
C:\Program Files\McAfee\Common Framework\UdaterUI.exe
C:\Program Files\Zune\ZuneLauncher.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe
C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mim.exe
C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://cm.my.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://us.mcafee.com/root/campaign.asp?cid=16313
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\Scriptcl.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\Program Files\GoogleAFE\GoogleAE.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [MBMon] Rundll32 CTMBHA.DLL,MBMon
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [VoiceCenter] "C:\Program Files\Creative\VoiceCenter\AndreaVC.exe" /tray
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~3\mimboot.exe
O4 - HKLM\..\Run: [LMPDPSRV] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LMPDPSRV.EXE
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Zune Launcher] "C:\Program Files\Zune\ZuneLauncher.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DellTransferAgent] "C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe"
O4 - HKCU\..\Run: [EasyLinkAdvisor] "C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup
O4 - HKUS\S-1-5-21-2372229341-3047002395-576542031-1006\..\Run: [SetDefaultMIDI] MIDIDef.exe (User '?')
O4 - HKUS\S-1-5-21-2372229341-3047002395-576542031-1006\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R (User '?')
O4 - HKUS\S-1-5-21-2372229341-3047002395-576542031-1006\..\Run: [Creative MediaSource Go] "C:\Program Files\Creative\MediaSource\Go\CTCMSGo.exe" /SCB (User '?')
O4 - HKUS\S-1-5-21-2372229341-3047002395-576542031-1006\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime (User '?')
O4 - HKUS\S-1-5-21-2372229341-3047002395-576542031-1006\..\Run: [EasyLinkAdvisor] "C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup (User '?')
O4 - Global Startup: Commonwealth of Pennsylvania VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://qtinstall.info.apple.com/qtactivex/QTPlugin.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m…01/mcinsctl.cab
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/…tiveXPlugin.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.com/p…obat/nos/gp.cab
O16 - DPF: {E473A65C-8087-49A3-AFFD-C5BC4A10669B} (Quantum Streaming IE Player Class) - http://mvnet.xlontech.net/qm/fox/06101102/qsp2ie06101001.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: getPlus® Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe

–
End of file - 11739 bytes

Thanks!!
Post #6
Hi,

You have a bunch of directories that do not look good, lets see what's in one of them

Please download DirLook by jpshortstuff from one of the following mirrors:

Here
Here
Here

  • Double-click DirLook.exe to run it (Vista Users should right-click and select Run As Administrator…).
  • Ensure that Show Hidden Files/Folders and BBCode Ouput are both checked.
  • Copy the content of the following codebox into the main textfield:

c:\documents and settings\All Users\Application Data\fomikago

  • Click the DirLook button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply. (Note: The log can also be found at C:\DirLook.txt)
Note: Scanning may take longer for large folders.
Post #7
Here is the result of looking in that folder
DirLook.exe v2.0 by jpshortstuff
Log created at 17:53 on 04/12/2008
==================================
Contents of "c:\documents and settings\All Users\Application Data\fomikago"

—FOLDERS—

(none found)

—FILES—

fomikago.dll (93236 bytes - created on 03/09/2008 at 11:18, modified on 03/12/2008 at 11:18) –ahs-

==================================
=EOF=

I wanted to let you know that I looked through all of those folders (the ones with 8 letter names that didn't make any sense) and only 6 of them had a file in them. a dll file named the same as the folder name. The description on the dll files is the same for all - it says DRM Store Netscape Plugin, Company: MIcrosoft Corp
My son plays that Runescape game all the time and I know he has downloaded some programs that people tell him to on there. I'm beginning to think I'd be better off wiping out my entire hard drive and reinstalling XP fresh. What do you think?
Thanks for all of your help!!
Cherie
Post #8
Hello Cherie,

These may be game related, the date on the file goes back to last March, but the directories have been created in the last month. Whether or not you want to reinstall windows is up to you, its really a lot of work and may not be needed.

You need to enable windows to Show All Files and Folders
Click Here for instructions

Go to VirusTotal and submit this file for analysis, just use the browse feature and then Send File, you will get a report back, post the report into this thread for me to see.

c:\documents and settings\All Users\Application Data\fomikago\fomikago.dll
Post #9
File fomikago.dll received on 12.05.2008 21:50:30 (CET) Current status: Loading … queued waiting scanning finished NOT FOUND STOPPED Result: 16/38 (42.11%) Loading server information… Your file is queued in position: 4. Estimated start time is between 62 and 88 seconds. Do not close the window until scan is complete. The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result. If you are waiting for more than five minutes you have to resend your file. Your file is being scanned by VirusTotal in this moment, results will be shown as they're generated. Compact Print results Your file has expired or does not exists. Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time. You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished. Email: Antivirus Version Last Update Result AhnLab-V3 2008.12.6.0 2008.12.05 - AntiVir 7.9.0.42 2008.12.05 ADSPY/AdClicker.S Authentium 5.1.0.4 2008.12.05 - Avast 4.8.1281.0 2008.12.04 Win32:Adware-gen AVG 8.0.0.199 2008.12.05 Generic12.UML BitDefender 7.2 2008.12.05 - CAT-QuickHeal 10.00 2008.12.05 - ClamAV 0.94.1 2008.12.05 - Comodo 682 2008.12.04 - DrWeb 4.44.0.09170 2008.12.05 Trojan.Virtumod.1459 eSafe 7.0.17.0 2008.12.04 Suspicious File eTrust-Vet 31.6.6243 2008.12.04 - Ewido 4.0 2008.12.05 - F-Prot 4.4.4.56 2008.12.04 - F-Secure 8.0.14332.0 2008.12.05 Trojan.Win32.Monder.aaua Fortinet 3.117.0.0 2008.12.05 PossibleThreat GData 19 2008.12.05 Win32:Adware-gen Ikarus T3.1.1.45.0 2008.12.05 - K7AntiVirus 7.10.545 2008.12.05 - Kaspersky 7.0.0.125 2008.12.05 Trojan.Win32.Monder.aaua McAfee 5455 2008.12.05 - McAfee+Artemis 5455 2008.12.05 - Microsoft 1.4205 2008.12.05 Trojan:Win32/Vundo.LC NOD32 3667 2008.12.05 Win32/Adware.Virtumonde Norman 5.80.02 2008.12.05 W32/Virtumonde.AEUZ Panda 9.0.0.4 2008.12.05 - PCTools 4.4.2.0 2008.12.05 - Prevx1 V2 2008.12.05 - Rising 21.06.43.00 2008.12.05 Trojan.Win32.VUNDO.bvp SecureWeb-Gateway 6.7.6 2008.12.05 Ad-Spyware.AdClicker.S Sophos 4.36.0 2008.12.05 Troj/Virtum-Gen Sunbelt 3.1.1832.2 2008.12.01 - Symantec 10 2008.12.05 Trojan.Vundo TheHacker 6.3.1.2.176 2008.12.05 - TrendMicro 8.700.0.1004 2008.12.05 - VBA32 3.12.8.10 2008.12.05 - ViRobot 2008.12.5.1502 2008.12.05 - VirusBuster 4.5.11.0 2008.12.05 - Additional information File size: 93236 bytes MD5…: d05cde0282cf9b66ec8ad931e9f13a4e SHA1..: 0a1b4a8b5f80bca4239d3b618491fa1ca313be8c SHA256: 81968e2fab83216f25395ddc169de857b35cc6ca3665610e1fea36b3f74eb604 SHA512: 9949e50179cea2db811ca32eb32adf5f3f9c4d9ebce5cbed211025a95d81b825 ba0516c3efebd5abdf7631d641fcd250335e6381ebbfb0ab04ab1d863fe6453a ssdeep: 1536:4B/2GtUbh1cMjSIJtURZwG0SaEX/EIlaQNPcjGbnv7I6:O2zUayZx83QNpv M6 PEiD..: - TrID..: File type identification Win32 Executable Generic (42.3%) Win32 Dynamic Link Library (generic) (37.6%) Generic Win/DOS Executable (9.9%) DOS Executable Generic (9.9%) Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%) PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x10001067 timedatestamp…..: 0x0 (Thu Jan 01 00:00:00 1970) machinetype…….: 0x14c (I386) ( 5 sections ) name viradd virsiz rawdsiz ntrpy md5 CODE 0x1000 0x51d2 0x5200 7.92 3ec2d1c3c80a1f7de4e4ff2cc5904a64 .rdata 0x7000 0x52d4 0x5400 7.85 f337639ad381495417ede5b268f5db8b .data 0xd000 0xb7ff 0xb400 7.99 fd1220e078663fa2f7daf6a4e8728906 .rsrc 0x19000 0x489 0x600 2.67 83b220b4281def97f43a351a012a9e2b .reloc 0x1a000 0x7954 0x800 0.77 848ac8f4412a072219c2896a1630cc56 ( 4 imports ) > user32.dll: ToAscii, RegisterClassW, MessageBoxW, MessageBeep, GetMessageW, DispatchMessageW > KERNEL32.dll: HeapDestroy, SetFilePointer, SetEnvironmentVariableW, GetStdHandle, GetExitCodeProcess, FlushFileBuffers, CloseHandle, ExitProcess > advapi32.dll: RegOpenKeyExW, RegQueryValueExW, RegCloseKey, RegEnumValueW > comdlg32.dll: GetOpenFileNameW, GetFileTitleW ( 0 exports ) ATTENTION: VirusTotal is a free service offered by Hispasec Sistemas. There are no guarantees about the availability and continuity of this service. Although the detection rate afforded by the use of multiple antivirus engines is far superior to that offered by just one product, these results DO NOT guarantee the harmlessness of a file. Currently, there is not any solution that offers a 100% effectiveness rate for detecting viruses and malware. Well, after changing the settings to also view protected system files, over half of those folders had an ini or dll file in them. Some were still empty. Don't know quite what to think of these results but they didn't look good. Thanks, Cherie
Post #10
Hello cherie,

It looks like that file is part of Vundo, never seen it install like this before.

Drag Combofix to the trash and grab a new copy as its updated on a regular basis.

Download ComboFix from one of these locations:

Link 1
Link 2
Link 3

* IMPORTANT !!! Save ComboFix.exe to your Desktop




Open Notepad Go to Start> All Programs> Assessories> Notepad ( this will only work with Notepad )and copy all the text inside the Codebox by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad, make sure there is no space before and above Folder::


Folder::
c:\documents and settings\All Users\Application Data\sisofeda
c:\documents and settings\All Users\Application Data\lunazuse
c:\documents and settings\All Users\Application Data\yugepiyo
c:\documents and settings\All Users\Application Data\nidawila
c:\documents and settings\All Users\Application Data\tisisiga
c:\documents and settings\All Users\Application Data\huwiyuke
c:\documents and settings\All Users\Application Data\vufewuta
c:\documents and settings\All Users\Application Data\jayoriji
c:\documents and settings\All Users\Application Data\fomikago
c:\documents and settings\All Users\Application Data\biwiluga
c:\documents and settings\All Users\Application Data\yijeyenu
c:\documents and settings\All Users\Application Data\kayezera
c:\documents and settings\All Users\Application Data\punefovu
c:\documents and settings\All Users\Application Data\hotajumo
c:\documents and settings\All Users\Application Data\sotujuba
c:\documents and settings\All Users\Application Data\sokawuge
c:\documents and settings\All Users\Application Data\ruyoneta
c:\documents and settings\All Users\Application Data\norolija
c:\documents and settings\All Users\Application Data\hivoneka
c:\documents and settings\All Users\Application Data\bawesawe
c:\documents and settings\All Users\Application Data\yubitadi
c:\documents and settings\All Users\Application Data\harugidu
c:\documents and settings\All Users\Application Data\zisigohu
c:\documents and settings\All Users\Application Data\jibagiba
c:\documents and settings\All Users\Application Data\wedaboya
c:\documents and settings\All Users\Application Data\pudepila
c:\documents and settings\All Users\Application Data\pazimovu
c:\documents and settings\All Users\Application Data\papulifu
c:\documents and settings\All Users\Application Data\zimisefi
c:\documents and settings\All Users\Application Data\tisugute
c:\documents and settings\All Users\Application Data\juyereni
c:\documents and settings\All Users\Application Data\filarilu
c:\documents and settings\All Users\Application Data\rinotune
c:\documents and settings\All Users\Application Data\bareyufa
c:\documents and settings\All Users\Application Data\mesasodu
c:\documents and settings\All Users\Application Data\fuwupiga
c:\documents and settings\All Users\Application Data\holurohu
c:\documents and settings\All Users\Application Data\fodobore
c:\documents and settings\All Users\Application Data\pefedoki
c:\documents and settings\All Users\Application Data\girodili
c:\documents and settings\All Users\Application Data\tenejive
c:\documents and settings\All Users\Application Data\mukozora
c:\documents and settings\All Users\Application Data\yotukano
c:\documents and settings\All Users\Application Data\tutumowu
c:\documents and settings\All Users\Application Data\hahupidi
c:\documents and settings\All Users\Application Data\fujuyiya
c:\documents and settings\All Users\Application Data\tutizoka
c:\documents and settings\All Users\Application Data\kuhabero
c:\documents and settings\All Users\Application Data\yeniboja
c:\documents and settings\All Users\Application Data\kotamili
c:\documents and settings\All Users\Application Data\rifewimi
c:\documents and settings\All Users\Application Data\nudebame
c:\documents and settings\All Users\Application Data\wulamolu
c:\documents and settings\All Users\Application Data\kotipuki
c:\documents and settings\All Users\Application Data\robofada
c:\documents and settings\All Users\Application Data\jeyibefa
c:\documents and settings\All Users\Application Data\nedakodo
c:\documents and settings\All Users\Application Data\dasidetu
c:\documents and settings\All Users\Application Data\vosahesa
c:\documents and settings\All Users\Application Data\miyebogu
c:\documents and settings\All Users\Application Data\wihohize
c:\documents and settings\All Users\Application Data\geyeziju
c:\documents and settings\All Users\Application Data\waledidu
c:\documents and settings\All Users\Application Data\ragakune
c:\documents and settings\All Users\Application Data\suhayiya
c:\documents and settings\All Users\Application Data\gipitobi
c:\documents and settings\All Users\Application Data\hatapuni
c:\documents and settings\All Users\Application Data\guborusi
c:\documents and settings\All Users\Application Data\rawopupi
c:\documents and settings\All Users\Application Data\lirumega
c:\documents and settings\All Users\Application Data\wimiwufa
c:\documents and settings\All Users\Application Data\nimiwuvi
c:\documents and settings\All Users\Application Data\papehehi
c:\documents and settings\All Users\Application Data\gesumeye
c:\documents and settings\All Users\Application Data\ledekuka
c:\documents and settings\All Users\Application Data\bojitebu
c:\documents and settings\All Users\Application Data\gozonisi
c:\documents and settings\All Users\Application Data\gokegaze
c:\documents and settings\All Users\Application Data\layeyiro
c:\documents and settings\All Users\Application Data\fulefoze
c:\documents and settings\All Users\Application Data\mizuyoha
c:\documents and settings\All Users\Application Data\jaditibi
c:\documents and settings\All Users\Application Data\zobirawa
c:\documents and settings\All Users\Application Data\jisanifu
c:\documents and settings\All Users\Application Data\vuzepeta
c:\documents and settings\All Users\Application Data\basahipo
c:\documents and settings\All Users\Application Data\vopidoko
c:\documents and settings\All Users\Application Data\gihezawo
c:\documents and settings\All Users\Application Data\ravoruna
c:\documents and settings\All Users\Application Data\babupata
c:\documents and settings\All Users\Application Data\yikiwasu
c:\documents and settings\All Users\Application Data\gipopahu
c:\documents and settings\All Users\Application Data\ketisozi
c:\documents and settings\All Users\Application Data\bujusafu
c:\documents and settings\All Users\Application Data\yaleweyu
c:\documents and settings\All Users\Application Data\dozuferi
c:\documents and settings\All Users\Application Data\ponigadi
c:\documents and settings\All Users\Application Data\pipakuja
c:\documents and settings\All Users\Application Data\gozohapi

Save this as CFScript to your desktop.

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

[external image: Posted Image]


This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.
Post #11
Hello Ken,
Is VUNDO a virus? Never heard of it before. Below is the information you requested. Thanks again for all of your time!!

Combo Fix log
ComboFix 08-12-06.03 - Cher 2008-12-06 16:47:15.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.486 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Cher\Desktop\CFScript.txt
* Created a new restore point
* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\babupata
c:\documents and settings\All Users\Application Data\babupata\atapubab.ini
c:\documents and settings\All Users\Application Data\bareyufa
c:\documents and settings\All Users\Application Data\basahipo
c:\documents and settings\All Users\Application Data\basahipo\opihasab.ini
c:\documents and settings\All Users\Application Data\bawesawe
c:\documents and settings\All Users\Application Data\bawesawe\bawesawe.dll.tmp
c:\documents and settings\All Users\Application Data\biwiluga
c:\documents and settings\All Users\Application Data\biwiluga\aguliwib.ini
c:\documents and settings\All Users\Application Data\biwiluga\biwiluga.dll
c:\documents and settings\All Users\Application Data\bojitebu
c:\documents and settings\All Users\Application Data\bojitebu\ubetijob.ini
c:\documents and settings\All Users\Application Data\bujusafu
c:\documents and settings\All Users\Application Data\dasidetu
c:\documents and settings\All Users\Application Data\dozuferi
c:\documents and settings\All Users\Application Data\dozuferi\irefuzod.ini
c:\documents and settings\All Users\Application Data\filarilu
c:\documents and settings\All Users\Application Data\fodobore
c:\documents and settings\All Users\Application Data\fomikago
c:\documents and settings\All Users\Application Data\fomikago\fomikago.dll
c:\documents and settings\All Users\Application Data\fujuyiya
c:\documents and settings\All Users\Application Data\fulefoze
c:\documents and settings\All Users\Application Data\fuwupiga
c:\documents and settings\All Users\Application Data\gesumeye
c:\documents and settings\All Users\Application Data\gesumeye\eyemuseg.ini
c:\documents and settings\All Users\Application Data\geyeziju
c:\documents and settings\All Users\Application Data\geyeziju\ujizeyeg.ini
c:\documents and settings\All Users\Application Data\gihezawo
c:\documents and settings\All Users\Application Data\gipitobi
c:\documents and settings\All Users\Application Data\gipitobi\ibotipig.ini
c:\documents and settings\All Users\Application Data\gipopahu
c:\documents and settings\All Users\Application Data\gipopahu\uhapopig.ini
c:\documents and settings\All Users\Application Data\girodili
c:\documents and settings\All Users\Application Data\gokegaze
c:\documents and settings\All Users\Application Data\gokegaze\ezagekog.ini
c:\documents and settings\All Users\Application Data\gozohapi
c:\documents and settings\All Users\Application Data\gozonisi
c:\documents and settings\All Users\Application Data\guborusi
c:\documents and settings\All Users\Application Data\hahupidi
c:\documents and settings\All Users\Application Data\harugidu
c:\documents and settings\All Users\Application Data\harugidu\harugidu.dll
c:\documents and settings\All Users\Application Data\harugidu\udigurah.ini
c:\documents and settings\All Users\Application Data\hatapuni
c:\documents and settings\All Users\Application Data\hatapuni\inupatah.ini
c:\documents and settings\All Users\Application Data\hivoneka
c:\documents and settings\All Users\Application Data\hivoneka\hivoneka.dll
c:\documents and settings\All Users\Application Data\holurohu
c:\documents and settings\All Users\Application Data\hotajumo
c:\documents and settings\All Users\Application Data\hotajumo\hotajumo.dll
c:\documents and settings\All Users\Application Data\huwiyuke
c:\documents and settings\All Users\Application Data\huwiyuke\huwiyuke.dll
c:\documents and settings\All Users\Application Data\jaditibi
c:\documents and settings\All Users\Application Data\jaditibi\ibitidaj.ini
c:\documents and settings\All Users\Application Data\jayoriji
c:\documents and settings\All Users\Application Data\jayoriji\ijiroyaj.ini
c:\documents and settings\All Users\Application Data\jayoriji\jayoriji.dll
c:\documents and settings\All Users\Application Data\jeyibefa
c:\documents and settings\All Users\Application Data\jibagiba
c:\documents and settings\All Users\Application Data\jisanifu
c:\documents and settings\All Users\Application Data\juyereni
c:\documents and settings\All Users\Application Data\kayezera
c:\documents and settings\All Users\Application Data\kayezera\kayezera.dll
c:\documents and settings\All Users\Application Data\ketisozi
c:\documents and settings\All Users\Application Data\ketisozi\izositek.ini
c:\documents and settings\All Users\Application Data\kotamili
c:\documents and settings\All Users\Application Data\kotipuki
c:\documents and settings\All Users\Application Data\kuhabero
c:\documents and settings\All Users\Application Data\layeyiro
c:\documents and settings\All Users\Application Data\ledekuka
c:\documents and settings\All Users\Application Data\lirumega
c:\documents and settings\All Users\Application Data\lirumega\agemuril.ini
c:\documents and settings\All Users\Application Data\lunazuse
c:\documents and settings\All Users\Application Data\lunazuse\lunazuse.dll
c:\documents and settings\All Users\Application Data\mesasodu
c:\documents and settings\All Users\Application Data\miyebogu
c:\documents and settings\All Users\Application Data\mizuyoha
c:\documents and settings\All Users\Application Data\mukozora
c:\documents and settings\All Users\Application Data\nedakodo
c:\documents and settings\All Users\Application Data\nidawila
c:\documents and settings\All Users\Application Data\nidawila\aliwadin.ini
c:\documents and settings\All Users\Application Data\nidawila\nidawila.dll
c:\documents and settings\All Users\Application Data\nimiwuvi
c:\documents and settings\All Users\Application Data\norolija
c:\documents and settings\All Users\Application Data\norolija\norolija.dll
c:\documents and settings\All Users\Application Data\nudebame
c:\documents and settings\All Users\Application Data\papehehi
c:\documents and settings\All Users\Application Data\papulifu
c:\documents and settings\All Users\Application Data\pazimovu
c:\documents and settings\All Users\Application Data\pefedoki
c:\documents and settings\All Users\Application Data\pipakuja
c:\documents and settings\All Users\Application Data\ponigadi
c:\documents and settings\All Users\Application Data\pudepila
c:\documents and settings\All Users\Application Data\punefovu
c:\documents and settings\All Users\Application Data\punefovu\punefovu.dll
c:\documents and settings\All Users\Application Data\punefovu\uvofenup.ini
c:\documents and settings\All Users\Application Data\ragakune
c:\documents and settings\All Users\Application Data\ragakune\enukagar.ini
c:\documents and settings\All Users\Application Data\ravoruna
c:\documents and settings\All Users\Application Data\rawopupi
c:\documents and settings\All Users\Application Data\rifewimi
c:\documents and settings\All Users\Application Data\rinotune
c:\documents and settings\All Users\Application Data\robofada
c:\documents and settings\All Users\Application Data\ruyoneta
c:\documents and settings\All Users\Application Data\ruyoneta\ruyoneta.dll
c:\documents and settings\All Users\Application Data\sisofeda
c:\documents and settings\All Users\Application Data\sisofeda\adefosis.ini
c:\documents and settings\All Users\Application Data\sisofeda\sisofeda.dll
c:\documents and settings\All Users\Application Data\sokawuge
c:\documents and settings\All Users\Application Data\sokawuge\sokawuge.dll.tmp
c:\documents and settings\All Users\Application Data\sotujuba
c:\documents and settings\All Users\Application Data\sotujuba\sotujuba.dll.tmp
c:\documents and settings\All Users\Application Data\suhayiya
c:\documents and settings\All Users\Application Data\tenejive
c:\documents and settings\All Users\Application Data\tisisiga
c:\documents and settings\All Users\Application Data\tisisiga\agisisit.ini
c:\documents and settings\All Users\Application Data\tisisiga\tisisiga.dll
c:\documents and settings\All Users\Application Data\tisugute
c:\documents and settings\All Users\Application Data\tutizoka
c:\documents and settings\All Users\Application Data\tutumowu
c:\documents and settings\All Users\Application Data\vopidoko
c:\documents and settings\All Users\Application Data\vopidoko\okodipov.ini
c:\documents and settings\All Users\Application Data\vosahesa
c:\documents and settings\All Users\Application Data\vosahesa\asehasov.ini
c:\documents and settings\All Users\Application Data\vufewuta
c:\documents and settings\All Users\Application Data\vufewuta\vufewuta.dll
c:\documents and settings\All Users\Application Data\vuzepeta
c:\documents and settings\All Users\Application Data\waledidu
c:\documents and settings\All Users\Application Data\wedaboya
c:\documents and settings\All Users\Application Data\wihohize
c:\documents and settings\All Users\Application Data\wimiwufa
c:\documents and settings\All Users\Application Data\wimiwufa\afuwimiw.ini
c:\documents and settings\All Users\Application Data\wulamolu
c:\documents and settings\All Users\Application Data\yaleweyu
c:\documents and settings\All Users\Application Data\yeniboja
c:\documents and settings\All Users\Application Data\yijeyenu
c:\documents and settings\All Users\Application Data\yijeyenu\uneyejiy.ini
c:\documents and settings\All Users\Application Data\yijeyenu\yijeyenu.dll
c:\documents and settings\All Users\Application Data\yikiwasu
c:\documents and settings\All Users\Application Data\yotukano
c:\documents and settings\All Users\Application Data\yubitadi
c:\documents and settings\All Users\Application Data\yubitadi\yubitadi.dll
c:\documents and settings\All Users\Application Data\yugepiyo
c:\documents and settings\All Users\Application Data\yugepiyo\yugepiyo.dll
c:\documents and settings\All Users\Application Data\zimisefi
c:\documents and settings\All Users\Application Data\zisigohu
c:\documents and settings\All Users\Application Data\zisigohu\uhogisiz.ini
c:\documents and settings\All Users\Application Data\zobirawa
c:\documents and settings\All Users\Application Data\zobirawa\awariboz.ini

.
((((((((((((((((((((((((( Files Created from 2008-11-06 to 2008-12-06 )))))))))))))))))))))))))))))))
.

2008-12-04 18:03 . 2008-12-04 18:03 2 –a—— c:\windows\msoffice.ini
2008-12-04 06:54 . 2008-12-04 06:54 0 –a—— c:\documents and settings\Cher\jagex_runescape_preferences.dat
2008-12-04 06:50 . 2008-12-04 06:50 410,984 –a—— c:\windows\system32\deploytk.dll
2008-12-03 19:34 . 2008-12-03 19:34 d——– c:\documents and settings\All Users\Application Data\yovukuyo
2008-12-03 19:34 . 2008-12-03 19:34 d——– c:\documents and settings\All Users\Application Data\tibugizu
2008-12-03 19:34 . 2008-12-03 19:34 d——– c:\documents and settings\All Users\Application Data\lukodiku
2008-12-03 19:34 . 2008-12-03 19:34 d——– c:\documents and settings\All Users\Application Data\likegene
2008-12-03 19:34 . 2008-12-03 19:34 d——– c:\documents and settings\All Users\Application Data\geripote
2008-12-02 19:46 . 2008-12-02 19:46 d——– c:\program files\Trend Micro
2008-12-01 17:15 . 2008-12-01 17:15 d——– c:\program files\Common Files\Adobe
2008-12-01 16:49 . 2008-12-04 18:01 d——– c:\program files\NOS
2008-12-01 16:49 . 2008-12-04 18:01 d——– c:\documents and settings\All Users\Application Data\NOS
2008-11-29 11:37 . 2008-11-29 11:37 d——– c:\windows\system32\scripting
2008-11-29 11:37 . 2008-11-29 11:37 d——– c:\windows\system32\en
2008-11-29 11:37 . 2008-11-29 11:37 d——– c:\windows\system32\bits
2008-11-29 11:37 . 2008-11-29 11:37 d——– c:\windows\l2schemas
2008-11-29 11:34 . 2008-11-29 11:37 d——– c:\windows\ServicePackFiles
2008-11-29 09:47 . 2008-12-02 19:29 d——– c:\program files\Malwarebytes' Anti-Malware
2008-11-29 09:47 . 2008-11-29 09:47 d——– c:\documents and settings\Cher\Application Data\Malwarebytes
2008-11-29 09:47 . 2008-11-29 09:47 d——– c:\documents and settings\All Users\Application Data\Malwarebytes
2008-11-29 09:47 . 2008-10-22 16:28 38,496 –a—— c:\windows\system32\drivers\mbamswissarmy.sys
2008-11-29 09:47 . 2008-10-22 16:28 15,504 –a—— c:\windows\system32\drivers\mbam.sys
2008-11-21 21:44 . 2008-11-21 21:44 d——– c:\documents and settings\Kyle\WINDOWS
2008-11-11 17:47 . 2008-12-04 06:50 73,728 –a—— c:\windows\system32\javacpl.cpl
2008-11-11 17:18 . 2008-11-11 17:18 d——– c:\documents and settings\Kyle\SERVER 508 oo
2008-11-11 16:26 . 2008-11-11 16:30 d——– C:\.mpr_file_store_32
2008-11-11 14:29 . 2008-10-24 06:21 455,296 ——— c:\windows\system32\dllcache\mrxsmb.sys
2008-11-09 20:09 . 2008-11-09 20:09 d——– c:\program files\Lavasoft
2008-11-09 20:09 . 2008-11-09 20:09 d——– c:\program files\Common Files\Wise Installation Wizard
2008-11-09 20:09 . 2008-11-09 20:09 d——– c:\documents and settings\All Users\Application Data\Lavasoft

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-04 23:17 ——— d–h–r c:\documents and settings\Cher\Application Data\yahoo!
2008-12-04 23:17 ——— d—–w c:\program files\WildTangent
2008-12-04 23:17 ——— d—–w c:\documents and settings\All Users\Application Data\yahoo!
2008-12-04 23:16 ——— d–ha-w c:\documents and settings\All Users\Application Data\GTek
2008-12-04 23:16 ——— d–h–w c:\program files\InstallShield Installation Information
2008-12-04 23:13 ——— d—–w c:\program files\GemMaster
2008-12-04 23:12 ——— d—–w c:\program files\eGames
2008-12-04 23:11 ——— d—–w c:\program files\Dell
2008-12-04 23:04 ——— d—–w c:\program files\Common Files\AOL
2008-12-04 23:04 ——— d—–w c:\documents and settings\All Users\Application Data\AOL
2008-12-04 20:26 31 —-a-w c:\documents and settings\Kyle\jagex_runescape_preferences.dat
2008-12-04 11:50 ——— d—–w c:\program files\Java
2008-11-29 17:11 ——— d—–w c:\program files\CMS Products
2008-11-29 16:12 ——— d—–w c:\documents and settings\Kyle\Application Data\FrostWire
2008-10-24 11:21 455,296 ——w c:\windows\system32\drivers\mrxsmb.sys
2008-10-20 00:28 0 —ha-w c:\windows\system32\drivers\Msft_User_ZuneDriver_01_07_00.Wdf
2008-10-20 00:28 0 —ha-w c:\windows\system32\drivers\Msft_Kernel_WinUSB_01007.Wdf
2008-10-20 00:27 0 —ha-w c:\windows\system32\drivers\MsftWdf_user_01_07_00.Wdf
2008-10-20 00:23 ——— d—–w c:\program files\Zune
2008-10-20 00:19 0 —ha-w c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2008-10-20 00:19 0 —ha-w c:\windows\system32\drivers\Msft_Kernel_zumbus_01007.Wdf
2008-10-16 19:13 202,776 —-a-w c:\windows\system32\wuweb.dll
2008-10-16 19:13 202,776 —-a-w c:\windows\system32\dllcache\wuweb.dll
2008-10-16 19:13 1,809,944 —-a-w c:\windows\system32\wuaueng.dll
2008-10-16 19:13 1,809,944 —-a-w c:\windows\system32\dllcache\wuaueng.dll
2008-10-16 19:12 561,688 —-a-w c:\windows\system32\wuapi.dll
2008-10-16 19:12 561,688 —-a-w c:\windows\system32\dllcache\wuapi.dll
2008-10-16 19:12 323,608 —-a-w c:\windows\system32\wucltui.dll
2008-10-16 19:12 323,608 —-a-w c:\windows\system32\dllcache\wucltui.dll
2008-10-16 19:09 92,696 —-a-w c:\windows\system32\dllcache\cdm.dll
2008-10-16 19:09 92,696 —-a-w c:\windows\system32\cdm.dll
2008-10-16 19:09 51,224 —-a-w c:\windows\system32\wuauclt.exe
2008-10-16 19:09 51,224 —-a-w c:\windows\system32\dllcache\wuauclt.exe
2008-10-16 19:09 43,544 —-a-w c:\windows\system32\wups2.dll
2008-10-16 19:08 34,328 —-a-w c:\windows\system32\wups.dll
2008-10-16 19:08 34,328 —-a-w c:\windows\system32\dllcache\wups.dll
2008-10-16 18:55 4,236 –sha-w c:\windows\system32\KGyGaAvL.sys
2008-10-15 16:34 337,408 ——w c:\windows\system32\dllcache\netapi32.dll
2008-10-03 17:41 6,066,176 ——w c:\windows\system32\dllcache\ieframe.dll
2008-09-30 21:43 1,286,152 —-a-w c:\windows\system32\msxml4.dll
2008-09-15 12:12 1,846,400 ——w c:\windows\system32\win32k.sys
2008-09-15 12:12 1,846,400 ——w c:\windows\system32\dllcache\win32k.sys
2008-09-12 22:48 245,664 —-a-w c:\windows\system32\ZuneWlanCfgSvc.exe
2008-09-12 22:46 61,856 —-a-w c:\windows\system32\ZuneBusEnum.exe
2008-09-12 22:32 73,216 —-a-w c:\windows\system32\ZuneUsbTransport.dll
2008-09-12 22:32 57,344 —-a-w c:\windows\system32\ZuneRegUtil.dll
2008-09-12 22:32 310,272 —-a-w c:\windows\system32\ZuneNetProxy.dll
2008-09-12 22:32 18,944 —-a-w c:\windows\system32\ZuneTcp2Udp.dll
2008-09-12 22:32 145,920 —-a-w c:\windows\system32\ZuneMTPZ.dll
2008-09-12 22:32 12,800 —-a-w c:\windows\system32\ZunePTDNS.dll
2008-09-10 01:14 1,307,648 ——w c:\windows\system32\msxml6.dll
2008-09-10 01:14 1,307,648 ——w c:\windows\system32\dllcache\msxml6.dll
2008-09-08 10:41 333,824 ——w c:\windows\system32\dllcache\srv.sys
2008-07-23 21:01 4 —-a-w c:\documents and settings\Kyle\version.dat
2008-07-19 03:19 5,287,936 —-a-w c:\documents and settings\Kyle\soul.exe
2008-07-18 23:15 614,400 —-a-w c:\documents and settings\Kyle\C3_CORE_DLL.dll
2008-07-17 18:33 200,704 —-a-w c:\documents and settings\Kyle\GraphicData.dll
2008-07-17 18:33 159,744 —-a-w c:\documents and settings\Kyle\graphic.dll
2008-07-17 18:33 135,168 —-a-w c:\documents and settings\Kyle\Role3D.dll
2008-05-28 04:43 167,936 —-a-w c:\documents and settings\Kyle\Chat.dll
2008-05-26 19:11 360,448 —-a-w c:\documents and settings\Kyle\GameData.dll
2008-05-26 19:10 122,880 —-a-w c:\documents and settings\Kyle\RoleView.dll
2007-12-04 01:14 3,932 —-a-w c:\documents and settings\Cher\Application Data\LMLayout.dat
2007-12-04 01:14 268 —-a-w c:\documents and settings\Cher\Application Data\LMCPaper.dat
2007-12-04 01:05 3,932 —-a-w c:\documents and settings\Kyle\Application Data\LMLayout.dat
2007-12-04 01:05 268 —-a-w c:\documents and settings\Kyle\Application Data\LMCPaper.dat
1998-12-08 21:53 99,840 ——w c:\program files\Common Files\IRAABOUT.DLL
1998-12-08 21:53 70,144 ——w c:\program files\Common Files\IRAMDMTR.DLL
1998-12-08 21:53 48,640 ——w c:\program files\Common Files\IRALPTTR.DLL
1998-12-08 21:53 31,744 ——w c:\program files\Common Files\IRAWEBTR.DLL
1998-12-08 21:53 186,368 ——w c:\program files\Common Files\IRAREG.DLL
1998-12-08 21:53 17,920 ——w c:\program files\Common Files\IRASRIAL.DLL
.

((((((((((((((((((((((((((((( snapshot@2008-12-03_16.14.49.24 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-10 06:21:01 135,168 —-a-w c:\windows\system32\java.exe
+ 2008-12-04 11:50:43 144,792 —-a-w c:\windows\system32\java.exe
- 2008-06-10 06:21:04 135,168 —-a-w c:\windows\system32\javaw.exe
+ 2008-12-04 11:50:43 144,792 —-a-w c:\windows\system32\javaw.exe
- 2008-06-10 07:32:34 139,264 —-a-w c:\windows\system32\javaws.exe
+ 2008-12-04 11:50:43 148,888 —-a-w c:\windows\system32\javaws.exe
- 2008-12-03 01:27:29 63,016 —-a-w c:\windows\system32\perfc009.dat
+ 2008-12-04 23:09:50 63,016 —-a-w c:\windows\system32\perfc009.dat
- 2008-12-03 01:27:29 402,406 —-a-w c:\windows\system32\perfh009.dat
+ 2008-12-04 23:09:50 402,406 —-a-w c:\windows\system32\perfh009.dat
+ 2008-12-04 23:19:37 16,384 —-atw c:\windows\temp\Perflib_Perfdata_1a8.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Creative Detector"="c:\program files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 102400]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"DellTransferAgent"="c:\documents and settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe" [2007-11-13 135168]
"EasyLinkAdvisor"="c:\program files\Linksys EasyLink Advisor\LinksysAgent.exe" [2006-04-02 389120]
"SetDefaultMIDI"="MIDIDef.exe" [2004-12-22 c:\windows\MIDIDEF.EXE]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-29 67584]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-04 136600]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 344064]
"IntelMeM"="c:\program files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-03 221184]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 53248]
"CTSysVol"="c:\program files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-09-15 57344]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
"VoiceCenter"="c:\program files\Creative\VoiceCenter\AndreaVC.exe" [2005-09-19 1159168]
"RealTray"="c:\program files\Real\RealPlayer\RealPlay.exe" [2006-02-17 26112]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 249856]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 81920]
"MimBoot"="c:\progra~1\MUSICM~1\MUSICM~3\mimboot.exe" [2005-09-08 8192]
"LMPDPSRV"="c:\windows\System32\spool\DRIVERS\W32X86\3\LMPDPSRV.EXE" [2002-09-05 45056]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2005-05-31 122941]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2006-10-30 256576]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-12-07 282624]
"MSKDetectorExe"="c:\program files\McAfee\SpamKiller\MSKDetct.exe" [2006-11-07 1121280]
"ShStatEXE"="c:\program files\McAfee\VirusScan Enterprise\SHSTAT.EXE" [2007-02-22 112216]
"McAfeeUpdaterUI"="c:\program files\McAfee\Common Framework\UdaterUI.exe" [2006-12-19 136768]
"Zune Launcher"="c:\program files\Zune\ZuneLauncher.exe" [2008-09-12 160160]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"SigmatelSysTrayApp"="stsystra.exe" [2005-03-23 c:\windows\stsystra.exe]
"MBMon"="CTMBHA.DLL" [2005-05-19 c:\windows\system32\CTMBHA.DLL]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-02-17 65588]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\LMpdpsrv.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Microsoft Office\\Office\\1033\\WFXMSRVR.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\McAfee\\Common Framework\\FrameworkService.exe"=

R3 EL99X;3Com 3C99x EtherLink XL Adapter;c:\windows\system32\DRIVERS\EL99XN51.SYS [2006-08-04 138240]
S2 portD;CMS PortIO Service;c:\windows\system32\DRIVERS\portd2k.sys []
S3 AVC3310F;AVC-3310/AVC-3610 USB Loader;c:\windows\system32\Drivers\avcuwfl2.sys [2006-09-04 17536]
S3 AvcUWil2;Adaptec AVC-3210/3310/3610 USB Device;c:\windows\system32\DRIVERS\avcuwil2.sys [2006-09-04 1434080]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}]
\Shell\AutoRun\command - E:\setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{73c5282a-afca-11da-9de6-00038a000015}]
\Shell\AutoRun\command - J:\LinksysConnectPC.exe
.
Contents of the 'Scheduled Tasks' folder

2008-12-04 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2006-10-10 17:13]
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)


.
——- Supplementary Scan ——-
.
uStart Page = hxxp://m.www.yahoo.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = hxxp://us.mcafee.com/root/campaign.asp?cid=16313
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
FireFox -: Profile - c:\documents and settings\Cher\Application Data\Mozilla\Firefox\Profiles\sa4ph9ot.default\
FF -: plugin - c:\program files\Java\jre6\bin\new_plugin\npdeploytk.dll
FF -: plugin - c:\program files\Java\jre6\bin\new_plugin\npjp2.dll
FF -: plugin - c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-06 16:50:31
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-12-06 16:51:35
ComboFix-quarantined-files.txt 2008-12-06 21:51:31
ComboFix2.txt 2008-12-03 21:15:17

Pre-Run: 6,799,339,520 bytes free
Post-Run: 6,923,960,320 bytes free

375 — E O F — 2008-11-30 08:01:14

Hijack This Log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:55:48 PM, on 12/6/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZuneBusEnum.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
C:\Program Files\Creative\VoiceCenter\AndreaVC.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LMPDPSRV.EXE
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\MUSICM~1\MUSICM~3\MMDiag.exe
C:\Program Files\McAfee\Common Framework\UdaterUI.exe
C:\Program Files\Zune\ZuneLauncher.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe
C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mim.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://m.www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://us.mcafee.com/root/campaign.asp?cid=16313
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptcl.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [MBMon] Rundll32 CTMBHA.DLL,MBMon
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [VoiceCenter] "C:\Program Files\Creative\VoiceCenter\AndreaVC.exe" /tray
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~3\mimboot.exe
O4 - HKLM\..\Run: [LMPDPSRV] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LMPDPSRV.EXE
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Zune Launcher] "C:\Program Files\Zune\ZuneLauncher.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DellTransferAgent] "C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe"
O4 - HKCU\..\Run: [EasyLinkAdvisor] "C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://qtinstall.info.apple.com/qtactivex/QTPlugin.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m…01/mcinsctl.cab
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/…tiveXPlugin.cab
O16 - DPF: {E473A65C-8087-49A3-AFFD-C5BC4A10669B} (Quantum Streaming IE Player Class) - http://mvnet.xlontech.net/qm/fox/06101102/qsp2ie06101001.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe

–
End of file - 9582 bytes

When the combo fix was running, a virus alert popped up saying it deleted a filed called EICAR test file. Don't know if that matters or not.
Thanks,
Cherie
Post #12
Hello Cherie,

Almost there. Vundo is actually a trojan, someone clicked on something that appeared harmless and it was not.

EICAR test file <– This is placed by some anti virus programs and is just a test file to make sure the program is working ok, no harm done.

There where so many folders I may have missed these.

Open Notepad Go to Start> All Programs> Assessories> Notepad ( this will only work with Notepad )and copy all the text inside the Codebox by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad, make sure there is no space before and above Folder::


Folder::
c:\documents and settings\All Users\Application Data\yovukuyo
c:\documents and settings\All Users\Application Data\tibugizu
c:\documents and settings\All Users\Application Data\lukodiku
c:\documents and settings\All Users\Application Data\likegene
c:\documents and settings\All Users\Application Data\geripote

Save this as CFScript to your desktop.

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

[external image: Posted Image]


This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.


How are things running now??? Once the above is removed all else appears fine
Post #13 last edited
New Combo Fix results
ComboFix 08-12-06.04 - Cher 2008-12-06 20:51:10.5 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.573 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Cher\Desktop\cfscript.txt
* Created a new restore point
* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\geripote
c:\documents and settings\All Users\Application Data\geripote\geripote.dll
c:\documents and settings\All Users\Application Data\likegene
c:\documents and settings\All Users\Application Data\likegene\likegene.dll
c:\documents and settings\All Users\Application Data\lukodiku
c:\documents and settings\All Users\Application Data\lukodiku\lukodiku.dll
c:\documents and settings\All Users\Application Data\tibugizu
c:\documents and settings\All Users\Application Data\tibugizu\tibugizu.dll
c:\documents and settings\All Users\Application Data\yovukuyo
c:\documents and settings\All Users\Application Data\yovukuyo\yovukuyo.dll

.
((((((((((((((((((((((((( Files Created from 2008-11-07 to 2008-12-07 )))))))))))))))))))))))))))))))
.

2008-12-04 18:03 . 2008-12-04 18:03 2 –a—— c:\windows\msoffice.ini
2008-12-04 06:54 . 2008-12-04 06:54 0 –a—— c:\documents and settings\Cher\jagex_runescape_preferences.dat
2008-12-04 06:50 . 2008-12-04 06:50 410,984 –a—— c:\windows\system32\deploytk.dll
2008-12-02 19:46 . 2008-12-02 19:46 d——– c:\program files\Trend Micro
2008-12-01 17:15 . 2008-12-01 17:15 d——– c:\program files\Common Files\Adobe
2008-12-01 16:49 . 2008-12-04 18:01 d——– c:\program files\NOS
2008-12-01 16:49 . 2008-12-04 18:01 d——– c:\documents and settings\All Users\Application Data\NOS
2008-11-29 11:37 . 2008-11-29 11:37 d——– c:\windows\system32\scripting
2008-11-29 11:37 . 2008-11-29 11:37 d——– c:\windows\system32\en
2008-11-29 11:37 . 2008-11-29 11:37 d——– c:\windows\system32\bits
2008-11-29 11:37 . 2008-11-29 11:37 d——– c:\windows\l2schemas
2008-11-29 11:34 . 2008-11-29 11:37 d——– c:\windows\ServicePackFiles
2008-11-29 09:47 . 2008-12-02 19:29 d——– c:\program files\Malwarebytes' Anti-Malware
2008-11-29 09:47 . 2008-11-29 09:47 d——– c:\documents and settings\Cher\Application Data\Malwarebytes
2008-11-29 09:47 . 2008-11-29 09:47 d——– c:\documents and settings\All Users\Application Data\Malwarebytes
2008-11-29 09:47 . 2008-10-22 16:28 38,496 –a—— c:\windows\system32\drivers\mbamswissarmy.sys
2008-11-29 09:47 . 2008-10-22 16:28 15,504 –a—— c:\windows\system32\drivers\mbam.sys
2008-11-21 21:44 . 2008-11-21 21:44 d——– c:\documents and settings\Kyle\WINDOWS
2008-11-11 17:47 . 2008-12-04 06:50 73,728 –a—— c:\windows\system32\javacpl.cpl
2008-11-11 17:18 . 2008-11-11 17:18 d——– c:\documents and settings\Kyle\SERVER 508 oo
2008-11-11 16:26 . 2008-11-11 16:30 d——– C:\.mpr_file_store_32
2008-11-11 14:29 . 2008-10-24 06:21 455,296 ——— c:\windows\system32\dllcache\mrxsmb.sys
2008-11-09 20:09 . 2008-11-09 20:09 d——– c:\program files\Lavasoft
2008-11-09 20:09 . 2008-11-09 20:09 d——– c:\program files\Common Files\Wise Installation Wizard
2008-11-09 20:09 . 2008-11-09 20:09 d——– c:\documents and settings\All Users\Application Data\Lavasoft

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-04 23:17 ——— d–h–r c:\documents and settings\Cher\Application Data\yahoo!
2008-12-04 23:17 ——— d—–w c:\program files\WildTangent
2008-12-04 23:17 ——— d—–w c:\documents and settings\All Users\Application Data\yahoo!
2008-12-04 23:16 ——— d–ha-w c:\documents and settings\All Users\Application Data\GTek
2008-12-04 23:16 ——— d–h–w c:\program files\InstallShield Installation Information
2008-12-04 23:13 ——— d—–w c:\program files\GemMaster
2008-12-04 23:12 ——— d—–w c:\program files\eGames
2008-12-04 23:11 ——— d—–w c:\program files\Dell
2008-12-04 23:04 ——— d—–w c:\program files\Common Files\AOL
2008-12-04 23:04 ——— d—–w c:\documents and settings\All Users\Application Data\AOL
2008-12-04 20:26 31 —-a-w c:\documents and settings\Kyle\jagex_runescape_preferences.dat
2008-12-04 11:50 ——— d—–w c:\program files\Java
2008-11-29 17:11 ——— d—–w c:\program files\CMS Products
2008-11-29 16:12 ——— d—–w c:\documents and settings\Kyle\Application Data\FrostWire
2008-10-24 11:21 455,296 ——w c:\windows\system32\drivers\mrxsmb.sys
2008-10-20 00:28 0 —ha-w c:\windows\system32\drivers\Msft_User_ZuneDriver_01_07_00.Wdf
2008-10-20 00:28 0 —ha-w c:\windows\system32\drivers\Msft_Kernel_WinUSB_01007.Wdf
2008-10-20 00:27 0 —ha-w c:\windows\system32\drivers\MsftWdf_user_01_07_00.Wdf
2008-10-20 00:23 ——— d—–w c:\program files\Zune
2008-10-20 00:19 0 —ha-w c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2008-10-20 00:19 0 —ha-w c:\windows\system32\drivers\Msft_Kernel_zumbus_01007.Wdf
2008-10-16 19:13 202,776 —-a-w c:\windows\system32\wuweb.dll
2008-10-16 19:13 202,776 —-a-w c:\windows\system32\dllcache\wuweb.dll
2008-10-16 19:13 1,809,944 —-a-w c:\windows\system32\wuaueng.dll
2008-10-16 19:13 1,809,944 —-a-w c:\windows\system32\dllcache\wuaueng.dll
2008-10-16 19:12 561,688 —-a-w c:\windows\system32\wuapi.dll
2008-10-16 19:12 561,688 —-a-w c:\windows\system32\dllcache\wuapi.dll
2008-10-16 19:12 323,608 —-a-w c:\windows\system32\wucltui.dll
2008-10-16 19:12 323,608 —-a-w c:\windows\system32\dllcache\wucltui.dll
2008-10-16 19:09 92,696 —-a-w c:\windows\system32\dllcache\cdm.dll
2008-10-16 19:09 92,696 —-a-w c:\windows\system32\cdm.dll
2008-10-16 19:09 51,224 —-a-w c:\windows\system32\wuauclt.exe
2008-10-16 19:09 51,224 —-a-w c:\windows\system32\dllcache\wuauclt.exe
2008-10-16 19:09 43,544 —-a-w c:\windows\system32\wups2.dll
2008-10-16 19:08 34,328 —-a-w c:\windows\system32\wups.dll
2008-10-16 19:08 34,328 —-a-w c:\windows\system32\dllcache\wups.dll
2008-10-16 18:55 4,236 –sha-w c:\windows\system32\KGyGaAvL.sys
2008-10-15 16:34 337,408 ——w c:\windows\system32\dllcache\netapi32.dll
2008-10-03 17:41 6,066,176 ——w c:\windows\system32\dllcache\ieframe.dll
2008-09-30 21:43 1,286,152 —-a-w c:\windows\system32\msxml4.dll
2008-09-15 12:12 1,846,400 ——w c:\windows\system32\win32k.sys
2008-09-15 12:12 1,846,400 ——w c:\windows\system32\dllcache\win32k.sys
2008-09-12 22:48 245,664 —-a-w c:\windows\system32\ZuneWlanCfgSvc.exe
2008-09-12 22:46 61,856 —-a-w c:\windows\system32\ZuneBusEnum.exe
2008-09-12 22:32 73,216 —-a-w c:\windows\system32\ZuneUsbTransport.dll
2008-09-12 22:32 57,344 —-a-w c:\windows\system32\ZuneRegUtil.dll
2008-09-12 22:32 310,272 —-a-w c:\windows\system32\ZuneNetProxy.dll
2008-09-12 22:32 18,944 —-a-w c:\windows\system32\ZuneTcp2Udp.dll
2008-09-12 22:32 145,920 —-a-w c:\windows\system32\ZuneMTPZ.dll
2008-09-12 22:32 12,800 —-a-w c:\windows\system32\ZunePTDNS.dll
2008-09-10 01:14 1,307,648 ——w c:\windows\system32\msxml6.dll
2008-09-10 01:14 1,307,648 ——w c:\windows\system32\dllcache\msxml6.dll
2008-09-08 10:41 333,824 ——w c:\windows\system32\dllcache\srv.sys
2008-07-23 21:01 4 —-a-w c:\documents and settings\Kyle\version.dat
2008-07-19 03:19 5,287,936 —-a-w c:\documents and settings\Kyle\soul.exe
2008-07-18 23:15 614,400 —-a-w c:\documents and settings\Kyle\C3_CORE_DLL.dll
2008-07-17 18:33 200,704 —-a-w c:\documents and settings\Kyle\GraphicData.dll
2008-07-17 18:33 159,744 —-a-w c:\documents and settings\Kyle\graphic.dll
2008-07-17 18:33 135,168 —-a-w c:\documents and settings\Kyle\Role3D.dll
2008-05-28 04:43 167,936 —-a-w c:\documents and settings\Kyle\Chat.dll
2008-05-26 19:11 360,448 —-a-w c:\documents and settings\Kyle\GameData.dll
2008-05-26 19:10 122,880 —-a-w c:\documents and settings\Kyle\RoleView.dll
2007-12-04 01:14 3,932 —-a-w c:\documents and settings\Cher\Application Data\LMLayout.dat
2007-12-04 01:14 268 —-a-w c:\documents and settings\Cher\Application Data\LMCPaper.dat
2007-12-04 01:05 3,932 —-a-w c:\documents and settings\Kyle\Application Data\LMLayout.dat
2007-12-04 01:05 268 —-a-w c:\documents and settings\Kyle\Application Data\LMCPaper.dat
1998-12-08 21:53 99,840 ——w c:\program files\Common Files\IRAABOUT.DLL
1998-12-08 21:53 70,144 ——w c:\program files\Common Files\IRAMDMTR.DLL
1998-12-08 21:53 48,640 ——w c:\program files\Common Files\IRALPTTR.DLL
1998-12-08 21:53 31,744 ——w c:\program files\Common Files\IRAWEBTR.DLL
1998-12-08 21:53 186,368 ——w c:\program files\Common Files\IRAREG.DLL
1998-12-08 21:53 17,920 ——w c:\program files\Common Files\IRASRIAL.DLL
.

((((((((((((((((((((((((((((( snapshot@2008-12-03_16.14.49.24 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-10 06:21:01 135,168 —-a-w c:\windows\system32\java.exe
+ 2008-12-04 11:50:43 144,792 —-a-w c:\windows\system32\java.exe
- 2008-06-10 06:21:04 135,168 —-a-w c:\windows\system32\javaw.exe
+ 2008-12-04 11:50:43 144,792 —-a-w c:\windows\system32\javaw.exe
- 2008-06-10 07:32:34 139,264 —-a-w c:\windows\system32\javaws.exe
+ 2008-12-04 11:50:43 148,888 —-a-w c:\windows\system32\javaws.exe
- 2008-12-03 01:27:29 63,016 —-a-w c:\windows\system32\perfc009.dat
+ 2008-12-04 23:09:50 63,016 —-a-w c:\windows\system32\perfc009.dat
- 2008-12-03 01:27:29 402,406 —-a-w c:\windows\system32\perfh009.dat
+ 2008-12-04 23:09:50 402,406 —-a-w c:\windows\system32\perfh009.dat
+ 2008-12-07 01:36:36 16,384 —-atw c:\windows\temp\Perflib_Perfdata_190.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Creative Detector"="c:\program files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 102400]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"DellTransferAgent"="c:\documents and settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe" [2007-11-13 135168]
"EasyLinkAdvisor"="c:\program files\Linksys EasyLink Advisor\LinksysAgent.exe" [2006-04-02 389120]
"SetDefaultMIDI"="MIDIDef.exe" [2004-12-22 c:\windows\MIDIDEF.EXE]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-29 67584]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-04 136600]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 344064]
"IntelMeM"="c:\program files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-03 221184]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 53248]
"CTSysVol"="c:\program files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-09-15 57344]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
"VoiceCenter"="c:\program files\Creative\VoiceCenter\AndreaVC.exe" [2005-09-19 1159168]
"RealTray"="c:\program files\Real\RealPlayer\RealPlay.exe" [2006-02-17 26112]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 249856]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 81920]
"MimBoot"="c:\progra~1\MUSICM~1\MUSICM~3\mimboot.exe" [2005-09-08 8192]
"LMPDPSRV"="c:\windows\System32\spool\DRIVERS\W32X86\3\LMPDPSRV.EXE" [2002-09-05 45056]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2005-05-31 122941]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2006-10-30 256576]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-12-07 282624]
"MSKDetectorExe"="c:\program files\McAfee\SpamKiller\MSKDetct.exe" [2006-11-07 1121280]
"ShStatEXE"="c:\program files\McAfee\VirusScan Enterprise\SHSTAT.EXE" [2007-02-22 112216]
"McAfeeUpdaterUI"="c:\program files\McAfee\Common Framework\UdaterUI.exe" [2006-12-19 136768]
"Zune Launcher"="c:\program files\Zune\ZuneLauncher.exe" [2008-09-12 160160]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"SigmatelSysTrayApp"="stsystra.exe" [2005-03-23 c:\windows\stsystra.exe]
"MBMon"="CTMBHA.DLL" [2005-05-19 c:\windows\system32\CTMBHA.DLL]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-02-17 65588]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\LMpdpsrv.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Microsoft Office\\Office\\1033\\WFXMSRVR.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\McAfee\\Common Framework\\FrameworkService.exe"=

R3 EL99X;3Com 3C99x EtherLink XL Adapter;c:\windows\system32\DRIVERS\EL99XN51.SYS [2006-08-04 138240]
S2 portD;CMS PortIO Service;c:\windows\system32\DRIVERS\portd2k.sys []
S3 AVC3310F;AVC-3310/AVC-3610 USB Loader;c:\windows\system32\Drivers\avcuwfl2.sys [2006-09-04 17536]
S3 AvcUWil2;Adaptec AVC-3210/3310/3610 USB Device;c:\windows\system32\DRIVERS\avcuwil2.sys [2006-09-04 1434080]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}]
\Shell\AutoRun\command - E:\setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{73c5282a-afca-11da-9de6-00038a000015}]
\Shell\AutoRun\command - J:\LinksysConnectPC.exe
.
Contents of the 'Scheduled Tasks' folder

2008-12-04 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2006-10-10 17:13]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://m.www.yahoo.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = hxxp://us.mcafee.com/root/campaign.asp?cid=16313
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
FireFox -: Profile - c:\documents and settings\Cher\Application Data\Mozilla\Firefox\Profiles\sa4ph9ot.default\
FF -: plugin - c:\program files\Java\jre6\bin\new_plugin\npdeploytk.dll
FF -: plugin - c:\program files\Java\jre6\bin\new_plugin\npjp2.dll
FF -: plugin - c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-06 20:53:25
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-12-06 20:54:29
ComboFix-quarantined-files.txt 2008-12-07 01:54:25
ComboFix2.txt 2008-12-07 01:32:43
ComboFix3.txt 2008-12-06 21:51:37
ComboFix4.txt 2008-12-03 21:15:17

Pre-Run: 6,838,362,112 bytes free
Post-Run: 6,819,827,712 bytes free

232 — E O F — 2008-11-30 08:01:14

Hijack this results:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:56:54 PM, on 12/6/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZuneBusEnum.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
C:\Program Files\Creative\VoiceCenter\AndreaVC.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LMPDPSRV.EXE
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\MUSICM~1\MUSICM~3\MMDiag.exe
C:\Program Files\McAfee\Common Framework\UdaterUI.exe
C:\Program Files\Zune\ZuneLauncher.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe
C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mim.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://m.www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://us.mcafee.com/root/campaign.asp?cid=16313
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptcl.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [MBMon] Rundll32 CTMBHA.DLL,MBMon
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [VoiceCenter] "C:\Program Files\Creative\VoiceCenter\AndreaVC.exe" /tray
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~3\mimboot.exe
O4 - HKLM\..\Run: [LMPDPSRV] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LMPDPSRV.EXE
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Zune Launcher] "C:\Program Files\Zune\ZuneLauncher.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DellTransferAgent] "C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe"
O4 - HKCU\..\Run: [EasyLinkAdvisor] "C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://qtinstall.info.apple.com/qtactivex/QTPlugin.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m…01/mcinsctl.cab
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/…tiveXPlugin.cab
O16 - DPF: {E473A65C-8087-49A3-AFFD-C5BC4A10669B} (Quantum Streaming IE Player Class) - http://mvnet.xlontech.net/qm/fox/06101102/qsp2ie06101001.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe

–
End of file - 9582 bytes


I don't seem to be getting any more popups and all seems well. I logged on as my son and there were 3 dll errors that came up when his profile loaded. They were for …All Users\App.. Data\biwiluga, lukodiko, and fomikago. How can I get these errors to stop showing up? Would they be registry entries somewhere?

Now that we've almost got this thing fixed, how can I keep this virus from affecting my computer again? I read something about a vulnerability in a certain version of Java. I believe i have the most up to date version now.
Thanks again for all of your help!!
Cherie
Post #14
Cherie,

This is the latest version of Java. You can go to Start> Control Panel and click on the Java icon, then go to the General Tab click on About and you should have this
Java Runtime Environment (JRE) 6 Update 11


If not you can update it this way

  • Your Java is out of date and leaving your system vulnerable.
  • Go to your Add-Remove Programs in the Control Panel and uninstall any previous versions of Java (J2SE Runtime Environment)
  • It should have an icon next to it:
    [external image: Posted Image]
    Select it and click Remove.
  • Reboot your system.
  • Then go to the Sun Microsystems and install the update
  • Java Runtime Environment (JRE) 6 Update 11 <–This is what you need to download and install.
  • If you chose the online installation, it will prompt you to run the program.
  • If you chose the offline installation, you will be prompted to save the file and you can run it from wherever you saved it.
  • Then after install you can verify your installation here Sun Java Verify
I like to to do the offline installation and save the setup file in case I may need it in the future




Those dll errors are for bad files we removed that still want to load but I do not see them on your HJT or Combofix log.

Run this cleaner, download and install it, then log on as your son and run it

Download and Install CCleaner
If you don't want the Yahoo Toolbar, be sure to uncheck it during installation
  • Click on Run Cleaner
Tutorial for CCleaner

This also has an option to clean the registry, click on the registry scan but check these only

* Missing Shared dll
* Obsolete Software
* Run at Start up

Let me know if that helped and then I will link you to free tools to install to help keep you more secure
Post #15
Download RegSearch by Bobbi Flekman.
  • Create a folder in your C: drive C:\Regsearch, and extract all the files from the zip archive into that folder.
  • Double click regsearch.exe to launch the program.
  • Copy/Paste the following into the Search Box
    biwiluga
  • Click OK.
Regsearch will now search your Registry for the required strings, when it is finished it will open a Notepad file RegSearch.txt, saved to the Regsearch folder.

Copy/Paste that file into your next post.

Do the same for these two also please

lukodiko

fomikago

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI