What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Downloader.Generic_c.Aft

19 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
tlj,

Disable any script blocking protection

These are the same programs you disabled to run ComboFix.

Please rename dds.scr to dds.com and try again.
Post #18
tlj, Is it on your desktop? If it is then: Right click on it and select rename. The name will become highlighted. Type dds.com and hit enter. A window will open asking if you really want to change the extention. Click on yes. Run the renamed program. (with the .scr extention your computer thinks it's a CAD file script.)
Post #22
tlj,

Then let's back up farther.

Delete it off your desktop.

Re-download but this time when you save it, change it's name to dds.com first. (Important.. Make sure that save as type: is All Files)
Post #23
Don't know what exactly i did to get it to run but here is the log and the attachment (if I've done it right) If this is not a quick answer I will have to get back to it in the morning it's after midnight here DDS (Version 1.0) - NTFSx86 Run by [removed] at 0:23:50.12 on Sun 12/07/08 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.510.222 [GMT -5:00] ============== Running Processes =============== C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost -k DcomLaunch C:\WINDOWS\system32\svchost -k rpcss C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k NetworkService C:\WINDOWS\system32\svchost.exe -k LocalService C:\WINDOWS\system32\brss01a.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe C:\Program Files\Scansoft\PaperPort\pptd40nt.exe C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe C:\Program Files\Verizon\McciTrayApp.exe C:\Program Files\Brother\ControlCenter3\brccMCtl.exe C:\Program Files\Verizon\VSP\VerizonServicepoint.exe C:\Program Files\Spyware Doctor\pctsTray.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Windows Media Player\WMPNSCFG.exe C:\Program Files\Palm\HOTSYNC.EXE C:\WINDOWS\SYSTEM32\Brmfrmps.exe C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Spyware Doctor\pctsAuxs.exe C:\Program Files\Spyware Doctor\pctsSvc.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\WINDOWS\System32\alg.exe C:\WINDOWS\System32\svchost.exe -k HTTPFilter C:\WINDOWS\explorer.exe C:\Program Files\internet explorer\iexplore.exe C:\WINDOWS\SYSTEM32\MSHEARTS.EXE C:\Documents and Settings\Terry L. Jones\Desktop\dds.com C:\WINDOWS\system32\wbem\wmiprvse.exe ============== Pseudo HJT Report =============== uStart Page = hxxp://wapp.verizon.net/bookmarks/bmredir.asp?region=all&bw=fiber&cd=7.0unattached&bm=ho_central uInternet Connection Wizard,ShellNext = iexplore BHO: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll BHO: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre6\bin\ssv.dll BHO: {A057A204-BACC-4D26-8398-26FADCF27386} - c:\progra~1\verizo~1\VERIZO~1.DLL BHO: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: {A057A204-BACC-4D26-8398-26FADCF27386} - c:\progra~1\verizo~1\VERIZO~1.DLL TB: {A057A204-BACC-4D26-8398-26FADCF27386} - c:\progra~1\verizo~1\VERIZO~1.DLL uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe uRun: [updateMgr] "c:\program files\adobe\acrobat 7.0\reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1 uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background mRun: [SoundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe mRun: [IAAnotif] c:\program files\intel\intel application accelerator\iaanotif.exe mRun: [SetDefPrt] c:\program files\brother\brmfl03a\BrStDvPt.exe mRun: [SSBkgdUpdate] "c:\program files\common files\scansoft shared\ssbkgdupdate\SSBkgdupdate.exe" -Embedding -boot mRun: [PaperPort PTD] c:\program files\scansoft\paperport\pptd40nt.exe mRun: [IndexSearch] c:\program files\scansoft\paperport\IndexSearch.exe mRun: [BrMfcWnd] c:\program files\brother\brmfcmon\BrMfcWnd.exe /AUTORUN mRun: [SetDefPrt2] c:\program files\brother\brmfl06b\BrStDvPt.exe mRun: [ControlCenter3] c:\program files\brother\controlcenter3\brctrcen.exe /autorun mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [MMTray] "c:\program files\musicmatch\musicmatch jukebox\mm_tray.exe" mRun: [Verizon_McciTrayApp] c:\program files\verizon\McciTrayApp.exe mRun: [VerizonServicepoint.exe] "c:\program files\verizon\vsp\VerizonServicepoint.exe" /AUTORUN mRun: [ISTray] "c:\program files\spyware doctor\pctsTray.exe" mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" StartupFolder: c:\docume~1\terryl~1.jon\startm~1\programs\startup\hotsyn~1.lnk - c:\program files\palm\HOTSYNC.EXE StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\smartui.lnk - c:\program files\scansoft\paperport\smartui\SmartUI.exe IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {11316B13-33F0-4C9F-BD55-09994CCFA8EB} - {73F7F495-A325-4C52-BE48-5F97FA511E89} IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll ============= SERVICES / DRIVERS =============== R0 IKFileSec;File Security Driver;c:\windows\system32\drivers\ikfilesec.sys [2008-12-4 40840] R1 IKSysFlt;System Filter Driver;c:\windows\system32\drivers\iksysflt.sys [2008-12-4 66952] R1 IKSysSec;System Security Driver;c:\windows\system32\drivers\iksyssec.sys [2008-12-4 81288] R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\spyware doctor\pctsAuxs.exe [2008-12-4 356920] R2 sdCoreService;PC Tools Security Service;c:\program files\spyware doctor\pctsSvc.exe [2008-12-4 1079176] S3 brfilt;Brother MFC Filter Driver;c:\windows\system32\drivers\Brfilt.sys [2005-5-22 2944] S3 BrSerWDM;Brother Serial driver;c:\windows\system32\drivers\BrSerWdm.sys [2005-5-22 61952] S3 BrUsbMdm;Brother MFC USB Fax Only Modem;c:\windows\system32\drivers\BrUsbMdm.sys [2005-5-22 11008] S3 BrUsbScn;Brother MFC USB Scanner driver;c:\windows\system32\drivers\BrUsbScn.sys [2005-5-22 10368] S3 Radialpoint Security Services;Radialpoint Security Services;c:\windows\system32\dllhost.exe /Processid:{80098F68-1220-4F43-80A8-15C7395B8874} [2004-8-4 5120] S3 RioS10;RioS10 driver;c:\windows\system32\drivers\RioS10.sys [2006-8-21 12661] =============== Created Last 30 ================ 2008-12-06 11:57 a-dshr– C:\cmdcons 2008-12-06 11:56 161,792 a——- c:\windows\SWREG.exe 2008-12-06 11:56 98,816 a——- c:\windows\sed.exe 2008-12-06 10:23 –d—– c:\documents and settings\terry l. jones\.SunDownloadManager 2008-12-06 10:21 410,984 a——- c:\windows\system32\deploytk.dll 2008-12-06 10:21 73,728 a——- c:\windows\system32\javacpl.cpl 2008-12-05 22:47 15,504 a——- c:\windows\system32\drivers\mbam.sys 2008-12-05 22:46 38,496 a——- c:\windows\system32\drivers\mbamswissarmy.sys 2008-12-05 22:46 –d—– c:\program files\Malwarebytes' Anti-Malware 2008-12-04 17:04 40,840 a——- c:\windows\system32\drivers\ikfilesec.sys 2008-12-04 17:04 29,576 a——- c:\windows\system32\drivers\kcom.sys 2008-12-04 17:04 81,288 a——- c:\windows\system32\drivers\iksyssec.sys 2008-12-04 17:04 66,952 a——- c:\windows\system32\drivers\iksysflt.sys 2008-12-04 17:04 –d—– c:\program files\Spyware Doctor 2008-12-04 17:04 –d—– c:\docume~1\terryl~1.jon\applic~1\PC Tools 2008-12-04 16:58 –d—– c:\program files\IObit 2008-12-04 16:43 –d—– c:\program files\CCleaner 2008-12-04 12:05 –d—– C:\VundoFix Backups 2008-12-04 11:01 –d—– c:\docume~1\terryl~1.jon\applic~1\Antispyware 2008-11-12 23:27 455,296 ——– c:\windows\system32\dllcache\mrxsmb.sys 2008-11-12 23:27 1,106,944 ——– c:\windows\system32\dllcache\msxml3.dll ==================== Find3M ==================== 2008-10-24 06:21 455,296 a——- c:\windows\system32\drivers\mrxsmb.sys 2008-10-16 14:13 1,809,944 a——- c:\windows\system32\dllcache\wuaueng.dll 2008-10-16 14:13 202,776 a——- c:\windows\system32\dllcache\wuweb.dll 2008-10-16 14:12 323,608 a——- c:\windows\system32\dllcache\wucltui.dll 2008-10-16 14:12 561,688 a——- c:\windows\system32\dllcache\wuapi.dll 2008-10-16 14:09 92,696 a——- c:\windows\system32\dllcache\cdm.dll 2008-10-16 14:09 51,224 a——- c:\windows\system32\dllcache\wuauclt.exe 2008-10-16 14:08 34,328 a——- c:\windows\system32\dllcache\wups.dll 2008-10-15 11:34 337,408 ——– c:\windows\system32\dllcache\netapi32.dll 2008-10-03 12:41 6,066,176 ——– c:\windows\system32\dllcache\ieframe.dll 2008-09-30 16:43 1,286,152 a——- c:\windows\system32\msxml4.dll 2008-09-15 07:12 1,846,400 a——- c:\windows\system32\win32k.sys 2008-09-15 07:12 1,846,400 ——– c:\windows\system32\dllcache\win32k.sys 2008-09-09 20:14 1,307,648 a——- c:\windows\system32\msxml6.dll 2008-09-09 20:14 1,307,648 ——– c:\windows\system32\dllcache\msxml6.dll 2008-09-08 05:41 333,824 ——– c:\windows\system32\dllcache\srv.sys 2008-02-22 09:20 80,056 a——- c:\docume~1\terryl~1.jon\applic~1\GDIPFONTCACHEV1.DAT 2006-11-15 10:38 356,352 a——- c:\documents and settings\terry l. jones\cwshredder.dll 2008-09-03 16:34 16,384 a–sh— c:\windows\system32\config\systemprofile\cookies\index.dat 2008-09-03 16:34 32,768 a–sh— c:\windows\system32\config\systemprofile\local settings\history\history.ie5\index.dat 2008-09-03 16:34 32,768 a–sh— c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008090320080904\index.dat 2008-09-03 16:34 32,768 a–sh— c:\windows\system32\config\systemprofile\local settings\temporary internet files\content.ie5\index.dat ============= FINISH: 0:24:24.82 ===============

Attachments:

Post #26
tlj,

Alright, here we go.

According to that last scan, the following programs should show in your add/remove programs and should be uninstalled.

  • Click Start, then Settings, then click Control Panel.
  • In Control Panel, double-click Add or Remove Programs.
  • In Add or Remove Programs, Remove Authentium AntiVirus SDK - 2
  • Do the same for each of these also:
    My Way Search Assistant
    Radialpoint Security Services
    Verizon PC Security Checkup
If they don't show, don't worry. Just carry on the best you can.

COMBOFIX-Script

  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

    File::

Folder::
c:\program files\Common Files\Authentium
c:\program files\Radialpoint

Registry::

Driver::
Radialpoint Security Services
  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

    [external image: Posted Image]
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

You need to get an Anti-virus installed.
You aren't running Anti Virus Software

Anti-virus software are programs that detect, cleanse, and erase harmful virus files on a computer, Web server, or network.
Unchecked, virus files can unintentionally be forwarded to others, including trading partners and thereby spreading infection. Because new viruses regularly emerge, anti-virus software should be updated frequently. Anti-virus software can scan the computer memory and disk drives for malicious code. They can alert the user if a virus is present, and will clean, delete (or quarantine) infected files or directories. Please download a free anti-virus software (for personal use), from one these excellent vendors NOW:

1) Antivir PersonalEditionClassic
-Free anti-virus software for Windows.
-Detects and removes more than 50,000 viruses. Free support.
2) avast! 4 Home Edition
-Anti-virus program for Windows.
-The home edition is freeware for noncommercial user
3) AVG Anti-Virus Free Edition
- Free edition of the AVG anti-virus program for Windows.
- Available for single computer use for home and non commercial use.

It is strongly recommended that you run only one antivirus program at a time. Having more than one antivirus program active in memory uses additional resources and can result in program conflicts and false virus alerts.

After all the above, please post me a new Hijackthis log. I predict that we will be ready for a final housekeeping and recommendation speech. :yeah:
Post #27
tom
here are the results of the two scans

ComboFix 08-12-06.01 - Terry L. Jones 2008-12-07 9:25:34.6 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.202 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Terry L. Jones\Desktop\CFScript.txt
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Radialpoint
c:\program files\Radialpoint\Security Advisor\AVManagerUnified.dll
c:\program files\Radialpoint\Security Advisor\CAntiVirusCOM.dll
c:\program files\Radialpoint\Security Advisor\CFirewallCOM.dll
c:\program files\Radialpoint\Security Advisor\FWManager.dll
c:\program files\Radialpoint\Security Advisor\Microsoft.VC80.CRT.manifest
c:\program files\Radialpoint\Security Advisor\msvcm80.dll
c:\program files\Radialpoint\Security Advisor\msvcp80.dll
c:\program files\Radialpoint\Security Advisor\msvcr80.dll
c:\program files\Radialpoint\Security Advisor\SasSpaHandler.dll
c:\program files\Radialpoint\Security Advisor\SecurityAdvisorLogic.exe

.
((((((((((((((((((((((((( Files Created from 2008-11-07 to 2008-12-07 )))))))))))))))))))))))))))))))
.

2008-12-07 09:18 . 2008-12-07 09:18 d——– c:\windows\LastGood
2008-12-06 11:21 . 2008-12-06 11:21 d——– c:\documents and settings\All Users\Application Data\Avg7
2008-12-06 10:23 . 2008-12-06 10:33 d——– c:\documents and settings\Terry L. Jones\.SunDownloadManager
2008-12-06 10:21 . 2008-12-06 10:21 d——– c:\program files\Java
2008-12-06 10:21 . 2008-12-06 10:21 410,984 –a—— c:\windows\SYSTEM32\deploytk.dll
2008-12-06 10:21 . 2008-12-06 10:21 73,728 –a—— c:\windows\SYSTEM32\javacpl.cpl
2008-12-05 22:47 . 2008-12-03 19:52 15,504 –a—— c:\windows\SYSTEM32\DRIVERS\mbam.sys
2008-12-05 22:46 . 2008-12-05 22:48 d——– c:\program files\Malwarebytes' Anti-Malware
2008-12-05 22:46 . 2008-12-03 19:52 38,496 –a—— c:\windows\SYSTEM32\DRIVERS\mbamswissarmy.sys
2008-12-04 19:45 . 2005-04-12 09:34 d——– c:\documents and settings\Administrator\Application Data\Sonic
2008-12-04 19:45 . 2005-04-12 09:27 d——– c:\documents and settings\Administrator\Application Data\Jasc Software Inc
2008-12-04 19:45 . 2005-04-12 09:26 d–h—– c:\documents and settings\Administrator\Application Data\Gtek
2008-12-04 19:45 . 2008-12-06 11:21 d——– c:\documents and settings\Administrator
2008-12-04 17:04 . 2008-12-05 02:19 d——– c:\program files\Spyware Doctor
2008-12-04 17:04 . 2008-12-04 17:04 d——– c:\documents and settings\Terry L. Jones\Application Data\PC Tools
2008-12-04 17:04 . 2008-08-25 12:36 81,288 –a—— c:\windows\SYSTEM32\DRIVERS\iksyssec.sys
2008-12-04 17:04 . 2008-08-25 12:36 66,952 –a—— c:\windows\SYSTEM32\DRIVERS\iksysflt.sys
2008-12-04 17:04 . 2008-08-25 12:36 40,840 –a—— c:\windows\SYSTEM32\DRIVERS\ikfilesec.sys
2008-12-04 17:04 . 2008-06-02 16:19 29,576 –a—— c:\windows\SYSTEM32\DRIVERS\kcom.sys
2008-12-04 16:58 . 2008-12-04 16:58 d——– c:\program files\IObit
2008-12-04 16:43 . 2008-12-04 16:43 d——– c:\program files\CCleaner
2008-12-04 12:05 . 2008-12-04 12:05 d——– C:\VundoFix Backups
2008-12-04 11:01 . 2008-12-04 11:01 d——– c:\documents and settings\Terry L. Jones\Application Data\Antispyware
2008-11-12 23:27 . 2008-09-04 12:15 1,106,944 ——— c:\windows\SYSTEM32\DLLCACHE\msxml3.dll
2008-11-12 23:27 . 2008-10-24 06:21 455,296 ——— c:\windows\SYSTEM32\DLLCACHE\mrxsmb.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-07 14:23 ——— d—a-w c:\documents and settings\All Users\Application Data\TEMP
2008-12-07 14:19 ——— d–h–w c:\program files\InstallShield Installation Information
2008-12-07 14:18 ——— d—–w c:\program files\Verizon
2008-12-04 17:37 ——— d—–w c:\program files\Trend Micro
2008-12-04 16:06 ——— d—–w c:\program files\Lavasoft
2008-12-04 16:06 ——— d—–w c:\documents and settings\All Users\Application Data\Lavasoft
2008-11-05 23:26 ——— d—–w c:\documents and settings\Terry L. Jones\Application Data\Motive
2008-10-29 23:38 ——— d—–w c:\documents and settings\Terry L. Jones\Application Data\verizon_broad
2008-10-24 11:21 455,296 —-a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-16 19:13 202,776 —-a-w c:\windows\SYSTEM32\wuweb.dll
2008-10-16 19:13 202,776 —-a-w c:\windows\SYSTEM32\DLLCACHE\wuweb.dll
2008-10-16 19:13 1,809,944 —-a-w c:\windows\SYSTEM32\wuaueng.dll
2008-10-16 19:13 1,809,944 —-a-w c:\windows\SYSTEM32\DLLCACHE\wuaueng.dll
2008-10-16 19:12 561,688 —-a-w c:\windows\SYSTEM32\wuapi.dll
2008-10-16 19:12 561,688 —-a-w c:\windows\SYSTEM32\DLLCACHE\wuapi.dll
2008-10-16 19:12 323,608 —-a-w c:\windows\SYSTEM32\wucltui.dll
2008-10-16 19:12 323,608 —-a-w c:\windows\SYSTEM32\DLLCACHE\wucltui.dll
2008-10-16 19:09 92,696 —-a-w c:\windows\SYSTEM32\DLLCACHE\cdm.dll
2008-10-16 19:09 92,696 —-a-w c:\windows\SYSTEM32\cdm.dll
2008-10-16 19:09 51,224 —-a-w c:\windows\SYSTEM32\wuauclt.exe
2008-10-16 19:09 51,224 —-a-w c:\windows\SYSTEM32\DLLCACHE\wuauclt.exe
2008-10-16 19:09 43,544 —-a-w c:\windows\SYSTEM32\wups2.dll
2008-10-16 19:08 34,328 —-a-w c:\windows\SYSTEM32\wups.dll
2008-10-16 19:08 34,328 —-a-w c:\windows\SYSTEM32\DLLCACHE\wups.dll
2008-10-15 16:34 337,408 ——w c:\windows\SYSTEM32\DLLCACHE\netapi32.dll
2008-10-09 02:03 ——— d—–w c:\documents and settings\All Users\Application Data\Verizon
2008-10-08 21:54 ——— d—–w c:\documents and settings\Terry L. Jones\Application Data\Verizon
2008-10-08 21:53 ——— d—–w c:\program files\verizon_broad
2008-10-08 21:53 ——— d—–w c:\program files\Verizon Broadband Firefox Toolbar
2008-10-08 21:53 ——— d—–w c:\program files\Common Files\Motive
2008-10-08 21:53 ——— d—–w c:\documents and settings\All Users\Application Data\Motive
2008-10-03 17:41 6,066,176 ——w c:\windows\SYSTEM32\DLLCACHE\ieframe.dll
2008-09-30 21:43 1,286,152 —-a-w c:\windows\SYSTEM32\msxml4.dll
2008-09-15 12:12 1,846,400 —-a-w c:\windows\SYSTEM32\win32k.sys
2008-09-15 12:12 1,846,400 ——w c:\windows\SYSTEM32\DLLCACHE\win32k.sys
2008-09-10 01:14 1,307,648 —-a-w c:\windows\SYSTEM32\msxml6.dll
2008-09-10 01:14 1,307,648 ——w c:\windows\SYSTEM32\DLLCACHE\msxml6.dll
2008-09-08 10:41 333,824 ——w c:\windows\SYSTEM32\DLLCACHE\srv.sys
2008-02-22 14:20 80,056 —-a-w c:\documents and settings\Terry L. Jones\Application Data\GDIPFONTCACHEV1.DAT
2006-11-15 15:38 356,352 —-a-w c:\documents and settings\Terry L. Jones\cwshredder.dll
2008-09-03 21:34 16,384 –sha-w c:\windows\SYSTEM32\CONFIG\systemprofile\Cookies\index.dat
2008-09-03 21:34 32,768 –sha-w c:\windows\SYSTEM32\CONFIG\systemprofile\Local Settings\History\History.IE5\index.dat
2008-09-03 21:34 32,768 –sha-w c:\windows\SYSTEM32\CONFIG\systemprofile\Local Settings\History\History.IE5\MSHist012008090320080904\index.dat
2008-09-03 21:34 32,768 –sha-w c:\windows\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
.

((((((((((((((((((((((((((((( snapshot@2008-12-06_12.01.04.82 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-04-04 21:15:02 839,880 —-a-w c:\windows\LastGood\system32\DRIVERS\css-dvp.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A057A204-BACC-4D26-8398-26FADCF27386}]
2008-05-30 11:42 1991680 –a—— c:\progra~1\VERIZO~1\VERIZO~1.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{A057A204-BACC-4D26-8398-26FADCF27386}"= "c:\progra~1\VERIZO~1\VERIZO~1.DLL" [2008-05-30 1991680]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{A057A204-BACC-4D26-8398-26FADCF27386}"= "c:\progra~1\VERIZO~1\VERIZO~1.DLL" [2008-05-30 1991680]

[HKEY_CLASSES_ROOT\clsid\{a057a204-bacc-4d26-8398-26fadcf27386}]
[HKEY_CLASSES_ROOT\verizon_broad.VERIZON_BROAD]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 204288]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 1404928]
"IAAnotif"="c:\program files\Intel\Intel Application Accelerator\iaanotif.exe" [2004-03-23 135168]
"SetDefPrt"="c:\program files\Brother\Brmfl03a\BrStDvPt.exe" [2003-07-03 45056]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 155648]
"PaperPort PTD"="c:\program files\Scansoft\PaperPort\pptd40nt.exe" [2005-03-17 57393]
"IndexSearch"="c:\program files\Scansoft\PaperPort\IndexSearch.exe" [2005-03-17 40960]
"BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2006-06-28 622592]
"SetDefPrt2"="c:\program files\Brother\Brmfl06b\BrStDvPt.exe" [2005-01-26 49152]
"ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2006-06-29 77824]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2005-04-12 98304]
"MMTray"="c:\program files\Musicmatch\Musicmatch Jukebox\mm_tray.exe" [2006-01-17 135168]
"Verizon_McciTrayApp"="c:\program files\Verizon\McciTrayApp.exe" [2007-09-28 936960]
"VerizonServicepoint.exe"="c:\program files\Verizon\VSP\VerizonServicepoint.exe" [2007-11-16 2065648]
"ISTray"="c:\program files\Spyware Doctor\pctsTray.exe" [2008-08-25 1168264]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-06 136600]

c:\documents and settings\Terry L. Jones\Start Menu\Programs\Startup\
HotSync Manager.lnk - c:\program files\Palm\HOTSYNC.EXE [2002-08-09 299008]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
SmartUI.lnk - c:\program files\Scansoft\PaperPort\SmartUI\SmartUI.exe [2007-02-11 1646592]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Billminder.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Billminder.lnk
backup=c:\windows\pss\Billminder.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk
backup=c:\windows\pss\QuickBooks Update Agent.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Quicken Startup.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Quicken Startup.lnk
backup=c:\windows\pss\Quicken Startup.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Terry L. Jones^Start Menu^Programs^Startup^VirtualExpander.lnk]
path=c:\documents and settings\Terry L. Jones\Start Menu\Programs\Startup\VirtualExpander.lnk
backup=c:\windows\pss\VirtualExpander.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
–a—— 2004-08-25 12:52 339968 c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
–a—— 2004-07-19 07:51 306688 c:\program files\Dell Support\DSAgnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dla]
–a–c— 2004-12-06 01:05 127035 c:\windows\SYSTEM32\dla\tfswctrl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask]
–a–c— 2006-01-17 12:03 53248 c:\program files\MUSICMATCH\Musicmatch Jukebox\mmtask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray]
–a—— 2006-01-17 12:03 135168 c:\program files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
–a—— 2008-04-13 19:12 1695232 c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PhotoShow Deluxe Media Manager]
–a—— 2005-05-09 18:16 192512 c:\progra~1\Comcast\COMCAS~1\data\Xtras\mssysmgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a—— 2005-04-12 09:30 98304 c:\program files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
–a—— 2005-04-12 09:30 26112 c:\program files\Real\RealPlayer\realplay.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateManager]
–a—— 2004-01-07 01:01 110592 c:\program files\Common Files\Sonic\Update Manager\sgtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
-ra—— 2006-03-30 16:45 313472 c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
——— 2006-10-18 20:05 204288 c:\program files\Windows Media Player\wmpnscfg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\StubInstaller.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2008-12-04 356920]
S3 brfilt;Brother MFC Filter Driver;c:\windows\system32\Drivers\Brfilt.sys [2005-05-22 2944]
S3 BrSerWDM;Brother Serial driver;c:\windows\system32\Drivers\BrSerWdm.sys [2005-05-22 61952]
S3 BrUsbMdm;Brother MFC USB Fax Only Modem;c:\windows\system32\Drivers\BrUsbMdm.sys [2005-05-22 11008]
S3 BrUsbScn;Brother MFC USB Scanner driver;c:\windows\system32\Drivers\BrUsbScn.sys [2005-05-22 10368]
S3 RioS10;RioS10 driver;c:\windows\system32\Drivers\RioS10.sys [2006-08-21 12661]

*Newly Created Service* - CATCHME
.
Contents of the 'Scheduled Tasks' folder

2008-12-07 c:\windows\Tasks\Antispyware Scheduled Scan.job
- c:\program files\Antispyware\Antispyware.exe []

2008-12-07 c:\windows\Tasks\Antispyware Scheduled Scan.job
- c:\program files\Antispyware []
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://wapp.verizon.net/bookmarks/bmredir.asp?region=all&bw=fiber&cd=7.0unattached&bm=ho_central
uInternet Connection Wizard,ShellNext = iexplore
FireFox -: Profile - c:\documents and settings\Terry L. Jones\Application Data\Mozilla\Firefox\Profiles\lycdfhc0.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://wapp.verizon.net/bookmarks/bmredir.asp?region=all&bw=fiber&cd=7.0unattached&bm=ho_central
FF -: plugin - c:\program files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\NPMGWRAP.DLL
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-07 09:28:02
Windows 5.1.2600 Service Pack 3 NTFS

detected NTDLL code modification:
ZwClose

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-12-07 9:29:14
ComboFix-quarantined-files.txt 2008-12-07 14:29:11
ComboFix2.txt 2008-12-06 18:58:09
ComboFix3.txt 2008-12-06 17:01:52
ComboFix4.txt 2008-03-13 01:43:39

Pre-Run: 58,868,404,224 bytes free
Post-Run: 58,936,745,984 bytes free

233 — E O F — 2008-11-13 08:02:09


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:40:09 AM, on 12/7/08
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
C:\Program Files\Verizon\McciTrayApp.exe
C:\Program Files\Brother\ControlCenter3\brccMCtl.exe
C:\Program Files\Verizon\VSP\VerizonServicepoint.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Palm\HOTSYNC.EXE
C:\WINDOWS\SYSTEM32\Brmfrmps.exe
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\msdtc.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\msiexec.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Program Files\internet explorer\iexplore.exe
C:\PROGRA~1\AVG\AVG8\aAvgApi.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://wapp.verizon.net/bookmarks/bmredir….p;bm=ho_central
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Verizon Broadband Toolbar - {A057A204-BACC-4D26-8398-26FADCF27386} - C:\PROGRA~1\VERIZO~1\VERIZO~1.DLL
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Verizon Broadband Toolbar - {A057A204-BACC-4D26-8398-26FADCF27386} - C:\PROGRA~1\VERIZO~1\VERIZO~1.DLL
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl03a\BrStDvPt.exe
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\Scansoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
O4 - HKLM\..\Run: [SetDefPrt2] C:\Program Files\Brother\Brmfl06b\BrStDvPt.exe
O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [Verizon_McciTrayApp] C:\Program Files\Verizon\McciTrayApp.exe
O4 - HKLM\..\Run: [VerizonServicepoint.exe] "C:\Program Files\Verizon\VSP\VerizonServicepoint.exe" /AUTORUN
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE
O4 - Global Startup: SmartUI.lnk = C:\Program Files\Scansoft\PaperPort\SmartUI\SmartUI.exe
O9 - Extra button: (no name) - {11316B13-33F0-4C9F-BD55-09994CCFA8EB} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://activatemyfios.verizon.net/sdcCommo…20Installer.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD5/JSCDL/jre…ows-i586-jc.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Brother Popup Suspend service for Resource manager (brmfrmps) - Brother Industries, Ltd. - C:\WINDOWS\SYSTEM32\Brmfrmps.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe

–
End of file - 8202 bytes
Post #28
tlj,

Log looks good :D


Time for some housekeeping
  • Click START then RUN
  • Now type Combofix /u in the runbox and click OK
  • Note the space between the X and the U, it needs to be there.
  • [external image: Posted Image]
The above procedure will:
  • Delete the following:
    • ComboFix and its associated files and folders.
    • VundoFix backups, if present
    • The C:\Deckard folder, if present
    • The C:_OtMoveIt folder, if present
  • Reset the clock settings.
  • Hide file extensions, if required.
  • Hide System/Hidden files, if required.
  • Reset System Restore.

Please re-enable any security that was disabled.
Delete dds.com off of desktop

Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week
(Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

Use a Firewall - I can not stress how important it is that you use a Firewall on your computer.
Without a firewall your computer is succeptible to being hacked and taken over.
I am very serious about this and see it happen almost every day with my clients.
Simply using a Firewall in its default configuration can lower your risk greatly.

For a tutorial on Firewalls and a listing of some available ones see the link below:

Understanding and Using Firewalls

Keep Microsoft Windows Updated - This will ensure your computer has always the latest security updates available installed on your computer. The easiest way to do this is to turn on Automatic Updates. Do this by:
  • From your desktop, right-click on My Computer,
  • click on Properties
  • Select the Automatic Updates tab
  • Click on Automatic
  • Click on Apply button
  • Click on OK to exit.
If there are new updates to install, install them immediately, until there are no more critical updates.

Install SpywareBlaster - SpywareBlaster will add a large list of programs and sites into your Internet Explorer
settings that will protect you from running and downloading known malicious programs.

A tutorial on installing & using this product can be found here:

Using SpywareBlaster to protect your computer from Spyware and Malware

Download and install the free version of WinPatrol - This program protects your computer in a variety of ways and will work well with your existing security software.
Winpatrol


Update all these programs regularly - Make sure you update all the programs I have listed regularly.
Without regular updates you WILL NOT be protected when new malicious programs are released.


Only run one Anti-Virus and Firewall program.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein

Also: "How to prevent malware"
by miekiemoes

Please respond back that you understand the above and let me know if you have any questions. Otherwise, this thread will be closed Resolved. :thumbup:

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI