What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] trojan

9 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
here is log file also have rocketdock and h control in start up how do i remove it


Logfile of Trend Micro

HijackThis v2.0.2
Scan saved at 9:36:50 AM, on

1/13/2009
Platform: Windows XP SP3

(WinNT 5.01.2600)
MSIE: Internet Explorer v6.00

SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.

exe
C:\WINDOWS\system32\services.

exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.e

xe
C:\WINDOWS\System32\svchost.e

xe
C:\WINDOWS\system32\spoolsv.e

xe
C:\Program

Files\Avira\AntiVir

PersonalEdition

Classic\sched.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.

exe
C:\Program Files\Wireless

Console 2\wcourier.exe
C:\Program

Files\Generic\Power4

Gear\BatteryLife.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\sm56hlpr.exe
C:\Program

Files\CyberLink\PowerDVD\PDVD

Serv.exe
C:\Program

Files\Java\jre6\bin\jusched.e

xe
C:\Program

Files\iTunes\iTunesHelper.exe
C:\Program

Files\Avira\AntiVir

PersonalEdition

Classic\avgnt.exe
C:\Program Files\Common

Files\Ahead\Lib\NMBgMonitor.e

xe
C:\WINDOWS\system32\ctfmon.ex

e
C:\Program Files\Common

Files\Ahead\Lib\NMIndexStoreS

vr.exe
C:\Documents and

Settings\Administrator\Local

Settings\Application

Data\Google\Update\GoogleUpda

te.exe
C:\Program Files\AIM\aim.exe
C:\Program

Files\RocketDock\RocketDock.e

xe
C:\Program

Files\Generic\Generic

ChkMail\ChkMail.exe
C:\Program

Files\Avira\AntiVir

PersonalEdition

Classic\avguard.exe
C:\Program Files\Common

Files\Apple\Mobile Device

Support\bin\AppleMobileDevice

Service.exe
C:\Program

Files\Bonjour\mDNSResponder.e

xe
C:\Program

Files\Google\Common\Google

Updater\GoogleUpdaterService.

exe
C:\Program

Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common

Files\LightScribe\LSSrvc.exe
C:\Program

Files\McAfee\SiteAdvisor\McSA

Core.exe
C:\WINDOWS\System32\PAStiSvc.

exe
C:\WINDOWS\system32\svchost.e

xe
C:\Program

Files\Viewpoint\Common\Viewpo

intService.exe
C:\Program

Files\iPod\bin\iPodService.ex

e
C:\Program Files\Common

Files\Ahead\Lib\NMIndexingSer

vice.exe
C:\Program

Files\Viewpoint\Viewpoint

Manager\ViewMgr.exe
C:\WINDOWS\system32\rundll32.

exe
C:\Program Files\Common

Files\Microsoft

Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Trend

Micro\HijackThis\HijackThis.e

xe

R1 -

HKCU\Software\Microsoft\Inter

net

Explorer\SearchURL,(Default)

=

http://search.yahoo.com/searc

h?fr=mcafee&p=%s
R1 -

HKCU\Software\Microsoft\Windo

ws\CurrentVersion\Internet

Settings,ProxyOverride =

*.local
O2 - BHO:

{d8879eb7-4090-469a-3b64-20e6

11db8fe5} -

{5ef8bd11-6e02-46b3-a964-0904

7be9788d} -

C:\WINDOWS\system32\bdvblm.dl

l (file missing)
O2 - BHO: (no name) -

{6D794CB4-C7CD-4c6f-BFDC-9B77

AFBDC02C} -

C:\WINDOWS\system32\urqOHASj.

dll (file missing)
O2 - BHO: Java™ Plug-In

SSV Helper -

{761497BB-D6F0-462C-B6EB-D4DA

F1D92D43} - C:\Program

Files\Java\jre6\bin\ssv.dll
O2 - BHO: Viewpoint Toolbar

BHO -

{A7327C09-B521-4EDB-8509-7D26

60C9EC98} - C:\Program

Files\Viewpoint\Viewpoint

Toolbar\3.8.0\ViewBarBHO.dll

(file missing)
O2 - BHO: Google Toolbar

Notifier BHO -

{AF69DE43-7D58-4638-B6FA-CE66

B5AD205D} - C:\Program

Files\Google\GoogleToolbarNot

ifier\4.1.805.4472\swg.dll
O2 - BHO: McAfee SiteAdvisor

BHO -

{B164E929-A1B6-4A06-B104-2CD0

E90A88FF} -

c:\PROGRA~1\mcafee\SITEAD~1\m

cieplg.dll
O2 - BHO: (no name) -

{C315F6CC-D7F7-4D9A-8471-A554

3FC62CDE} -

C:\WINDOWS\system32\yayaBuUm.

dll (file missing)
O2 - BHO: Java™ Plug-In 2

SSV Helper -

{DBC80044-A445-435b-BC74-9C25

C1C588A9} - C:\Program

Files\Java\jre6\bin\jp2ssv.dl

l
O3 - Toolbar: Viewpoint

Toolbar -

{F8AD5AA5-D966-4667-9DAF-2561

D68B2012} - C:\Program

Files\Common

Files\Viewpoint\Toolbar

Runtime\3.8.0\IEViewBar.dll
O3 - Toolbar: McAfee

SiteAdvisor Toolbar -

{0EBBBE48-BAD4-4B4C-8E5A-516A

BECAE064} -

c:\PROGRA~1\mcafee\SITEAD~1\m

cieplg.dll
O4 - HKLM\..\Run: [igfxhkcmd]

C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers]

C:\WINDOWS\system32\igfxpers.

exe
O4 - HKLM\..\Run: [Wireless

Console 2] C:\Program

Files\Wireless Console

2\wcourier.exe
O4 - HKLM\..\Run:

[Power_Gear] C:\Program

Files\Generic\Power4

Gear\BatteryLife.exe 1
O4 - HKLM\..\Run: [RTHDCPL]

RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel]

SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr]

ALCMTR.EXE
O4 - HKLM\..\Run: [SMSERIAL]

sm56hlpr.exe
O4 - HKLM\..\Run:

[NeroFilterCheck] C:\Program

Files\Common

Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run:

[RemoteControl] "C:\Program

Files\CyberLink\PowerDVD\PDVD

Serv.exe"
O4 - HKLM\..\Run:

[SunJavaUpdateSched]

"C:\Program

Files\Java\jre6\bin\jusched.e

xe"
O4 - HKLM\..\Run:

[AppleSyncNotifier]

C:\Program Files\Common

Files\Apple\Mobile Device

Support\bin\AppleSyncNotifier

.exe
O4 - HKLM\..\Run: [QuickTime

Task] "C:\Program

Files\QuickTime\QTTask.exe"

-atboottime
O4 - HKLM\..\Run:

[iTunesHelper] "C:\Program

Files\iTunes\iTunesHelper.exe

"
O4 - HKLM\..\Run: [prunnet]

"C:\WINDOWS\system32\prunnet.

exe"
O4 - HKLM\..\Run: [avgnt]

"C:\Program

Files\Avira\AntiVir

PersonalEdition

Classic\avgnt.exe" /min
O4 - HKCU\..\Run:

[BgMonitor_{79662E04-7C6C-4d9

f-84C7-88D8A56B10AA}]

"C:\Program Files\Common

Files\Ahead\Lib\NMBgMonitor.e

xe"
O4 - HKCU\..\Run:

[ctfmon.exe]

C:\WINDOWS\system32\ctfmon.ex

e
O4 - HKCU\..\Run: [updateMgr]

"C:\Program

Files\Adobe\Acrobat

7.0\Reader\AdobeUpdateManager

.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [Tunebite]

C:\Program

Files\RapidSolution\Tunebite\

Tunebite.exe -tray
O4 - HKCU\..\Run: [Google

Update] "C:\Documents and

Settings\Administrator\Local

Settings\Application

Data\Google\Update\GoogleUpda

te.exe" /c
Post #2 last edited
Hi msucura,

:welcome:

My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

  • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.

Your log is virtually impossible to read. :pullhair:

Open Notepad: Start > All Programs > Accessories > Notepad.
Click on Format and ensure that Wordwrap is unchecked. If it isn't, uncheck it.

That should allow me to read future posts. ;)

It appears that you do have a couple "baddies" in there so lets get started.

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.

Then

Please download Malwarebytes' Anti-Malware to your desktop.

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
  • Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot (shut down your computer then restart it).
Also "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.
Post #3
THANK YOU! First i could not stay on page would just change and new windows would pop up then i downloaded
avira which i ran over about 12 times this is report from that was still running slow , Thank You , Msucura



Avira AntiVir Personal
Report file date: Monday, January 12, 2009 09:25

Scanning for 1180145 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 3) [5.1.2600]
Boot mode: Normally booted
Username: SYSTEM
Computer name: XYZ

Version information:
BUILD.DAT : 8.2.0.337 16934 Bytes 11/18/2008 13:05:00
AVSCAN.EXE : 8.1.4.10 315649 Bytes 11/18/2008 14:21:26
AVSCAN.DLL : 8.1.4.0 40705 Bytes 5/26/2008 13:56:40
LUKE.DLL : 8.1.4.5 164097 Bytes 6/12/2008 18:44:19
LUKERES.DLL : 8.1.4.0 12033 Bytes 5/26/2008 13:58:52
ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 10/27/2008 17:30:36
ANTIVIR1.VDF : 7.1.1.33 1705984 Bytes 12/24/2008 07:46:01
ANTIVIR2.VDF : 7.1.1.88 726528 Bytes 1/8/2009 07:46:09
ANTIVIR3.VDF : 7.1.1.97 111104 Bytes 1/11/2009 07:46:10
Engineversion : 8.2.0.54
AEVDF.DLL : 8.1.0.6 102772 Bytes 10/14/2008 16:05:56
AESCRIPT.DLL : 8.1.1.24 340348 Bytes 1/12/2009 07:46:31
AESCN.DLL : 8.1.1.5 123251 Bytes 11/7/2008 21:06:41
AERDL.DLL : 8.1.1.3 438645 Bytes 11/4/2008 19:58:38
AEPACK.DLL : 8.1.3.5 393588 Bytes 1/12/2009 07:46:29
AEOFFICE.DLL : 8.1.0.33 196987 Bytes 1/12/2009 07:46:27
AEHEUR.DLL : 8.1.0.78 1532280 Bytes 1/12/2009 07:46:25
AEHELP.DLL : 8.1.2.0 119159 Bytes 1/12/2009 07:46:17
AEGEN.DLL : 8.1.1.8 323956 Bytes 1/12/2009 07:46:15
AEEMU.DLL : 8.1.0.9 393588 Bytes 10/14/2008 16:05:56
AECORE.DLL : 8.1.5.2 172405 Bytes 1/12/2009 07:46:12
AEBB.DLL : 8.1.0.3 53618 Bytes 10/14/2008 16:05:56
AVWINLL.DLL : 1.0.0.12 15105 Bytes 7/9/2008 14:40:05
AVPREF.DLL : 8.0.2.0 38657 Bytes 5/16/2008 15:28:01
AVREP.DLL : 8.0.0.2 98344 Bytes 7/31/2008 18:02:15
AVREG.DLL : 8.0.0.1 33537 Bytes 5/9/2008 17:26:40
AVARKT.DLL : 1.0.0.23 307457 Bytes 2/12/2008 14:29:23
AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 6/12/2008 18:27:49
SQLITE3.DLL : 3.3.17.1 339968 Bytes 1/22/2008 23:28:02
SMTPLIB.DLL : 1.2.0.23 28929 Bytes 6/12/2008 18:49:40
NETNT.DLL : 8.0.0.1 7937 Bytes 1/25/2008 18:05:10
RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 6/12/2008 19:48:07
RCTEXT.DLL : 8.0.52.0 86273 Bytes 6/27/2008 19:34:37

Configuration settings for the scan:
Jobname……………………..: Complete system scan
Configuration file……………: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging……………………..: low
Primary action……………….: interactive
Secondary action……………..: ignore
Scan master boot sector……….: on
Scan boot sector……………..: on
Boot sectors…………………: C:,
Process scan…………………: on
Scan registry………………..: on
Search for rootkits…………..: off
Scan all files……………….: Intelligent file selection
Scan archives………………..: on
Recursion depth………………: 20
Smart extensions……………..: on
Macro heuristic………………: on
File heuristic……………….: medium

Start of the scan: Monday, January 12, 2009 09:25

The scan of running processes will be started
Scan process 'guardgui.exe' - '1' Module(s) have been scanned
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'NMIndexingService.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'wscntfy.exe' - '1' Module(s) have been scanned
Scan process 'iPodService.exe' - '1' Module(s) have been scanned
Scan process 'ashWebSv.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'ashMaiSv.exe' - '1' Module(s) have been scanned
Scan process 'ViewMgr.exe' - '1' Module(s) have been scanned
Scan process 'ChkMail.exe' - '1' Module(s) have been scanned
Scan process 'reader_sl.exe' - '1' Module(s) have been scanned
Scan process 'RocketDock.exe' - '1' Module(s) have been scanned
Scan process 'NMIndexStoreSvr.exe' - '1' Module(s) have been scanned
Scan process 'aim.exe' - '1' Module(s) have been scanned
Scan process 'GoogleUpdate.exe' - '1' Module(s) have been scanned
Scan process 'ViewpointService.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'PAStiSvc.exe' - '1' Module(s) have been scanned
Scan process 'avgcsrvx.exe' - '1' Module(s) have been scanned
Scan process 'avgnsx.exe' - '1' Module(s) have been scanned
Scan process 'avgrsx.exe' - '1' Module(s) have been scanned
Scan process 'MDM.EXE' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'avgam.exe' - '1' Module(s) have been scanned
Scan process 'NMBgMonitor.exe' - '1' Module(s) have been scanned
Scan process 'McSACore.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'avgtray.exe' - '1' Module(s) have been scanned
Scan process 'ashDisp.exe' - '1' Module(s) have been scanned
Scan process 'LSSrvc.exe' - '1' Module(s) have been scanned
Scan process 'iTunesHelper.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'PDVDServ.exe' - '1' Module(s) have been scanned
Scan process 'sm56hlpr.exe' - '1' Module(s) have been scanned
Scan process 'jqs.exe' - '1' Module(s) have been scanned
Scan process 'RTHDCPL.EXE' - '1' Module(s) have been scanned
Scan process 'BatteryLife.exe' - '1' Module(s) have been scanned
Scan process 'wcourier.exe' - '1' Module(s) have been scanned
Scan process 'GoogleUpdaterService.exe' - '1' Module(s) have been scanned
Scan process 'igfxpers.exe' - '1' Module(s) have been scanned
Scan process 'hkcmd.exe' - '1' Module(s) have been scanned
Scan process 'mDNSResponder.exe' - '1' Module(s) have been scanned
Scan process 'avgwdsvc.exe' - '1' Module(s) have been scanned
Scan process 'AppleMobileDeviceService.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'ashServ.exe' - '1' Module(s) have been scanned
Scan process 'aswUpdSv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
61 processes with 61 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!

Starting to scan the registry.
The registry was scanned ( '71' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\WINDOWS\system32\ijjxtepj.dll
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was moved to '49d56be0.qua'!
C:\WINDOWS\system32\khfffDvV.dll
[DETECTION] Is the TR/Monder.alpv Trojan
[NOTE] The file was moved to '49d16bf3.qua'!
C:\WINDOWS\system32\tuvSiiJD.dll
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was moved to '49e16d51.qua'!
C:\WINDOWS\system32\xtxsmegl.dll
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was moved to '49e36d72.qua'!
C:\WINDOWS\system32\yayaBuUm.dll
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[WARNING] An error has occurred and the file was not deleted. ErrorID: 26003
[WARNING] The file could not be deleted!
[NOTE] Attempting to perform action using the ARK lib.
[NOTE] The file was moved to '49e46d66.qua'!


End of the scan: Monday, January 12, 2009 11:20
Used time: 1:54:46 Hour(s)

The scan has been done completely.

8946 Scanning directories
416720 Files were scanned
5 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
5 files were moved to quarantine
0 files were renamed
1 Files cannot be scanned
416714 Files not concerned
2419 Archives were scanned
2 Warnings
5 Notes







Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:46:56 PM, on 1/24/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Wireless Console 2\wcourier.exe
C:\Program Files\Generic\Power4 Gear\BatteryLife.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\sm56hlpr.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\ATK0100\HControl.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Generic\Generic ChkMail\ChkMail.exe
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.yahoo.com/search?fr=mcafee&p=%s
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Program Files\Viewpoint\Viewpoint Toolbar\3.8.0\ViewBarBHO.dll (file missing)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: (no name) - {C315F6CC-D7F7-4D9A-8471-A5543FC62CDE} - C:\WINDOWS\system32\yayaBuUm.dll (file missing)
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.8.0\IEViewBar.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Wireless Console 2] C:\Program Files\Wireless Console 2\wcourier.exe
O4 - HKLM\..\Run: [Power_Gear] C:\Program Files\Generic\Power4 Gear\BatteryLife.exe 1
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [Tunebite] C:\Program Files\RapidSolution\Tunebite\Tunebite.exe -tray
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Generic ChkMail.lnk = C:\Program Files\Generic\Generic ChkMail\ChkMail.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~4\GOEC62~1.DLL bdvblm.dll
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

–
End of file - 8681 bytes
Malwarebytes' Anti-Malware 1.33
Database version: 1687
Windows 5.1.2600 Service Pack 3

1/24/2009 12:37:09 PM
mbam-log-2009-01-24 (12-37-09).txt

Scan type: Quick Scan
Objects scanned: 56171
Time elapsed: 54 minute(s), 56 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 11
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5ef8bd11-6e02-46b3-a964-09047be9788d} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{5ef8bd11-6e02-46b3-a964-09047be9788d} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\prunnet (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\xpreapp (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Trymedia Systems (Adware.Trymedia) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\instkey (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\prunnet (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\bdvblm.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
Post #5
msucura,

I'm glad your computer is running better. However there is still a little more to do.

I see that Viewpoint is installed. Viewpoint, Viewpoint Manager, Viewpoint Media Player are Viewpoint components which are installed as a side effect of installing other software, most notably AOL and AOL Instant Messenger (AIM). Viewpoint Manager is responsible for managing and updating Viewpoint Media Player’s components. You can disable this using the Viewpoint Manager Control Panel found in the Windows Control Panel menu. By selecting Disable auto-updating for the Viewpoint Manager – the player will no longer attempt to check for updates. Anything that is installed without your consent is suspect. Read what Viewpoint says and make your own decision.

To provide a satisfying consumer experience and to operate effectively, the Viewpoint Media Player periodically sends information to servers at Viewpoint. Each installation of the Viewpoint Media Player is identifiable to Viewpoint via a Customer Unique Identifier (CUID), an alphanumeric identifier embedded in the Viewpoint Media Player. The Viewpoint Media Player randomly generates the CUID during installation and uses it to indicate a unique installation of the product. A CUID is never connected to a user's name, email address, or other personal contact information. CUIDs are used for the sole purpose of filtering redundant information. Each of these information exchanges occurs anonymously.



Viewpoint Manager is considered as foistware instead of malware since it is often installed without user's approval but doesn't spy or do anything "bad". This may change, read Viewpoint to Plunge Into Adware
It is STRONGLY recommended that you remove the Viewpoint products; however, decide for yourself. To uninstall the Viewpoint components (Viewpoint, Viewpoint Manager, Viewpoint Media Player):

  • Click Start, then Settings, then click Control Panel.
  • In Control Panel, double-click Add or Remove Programs.
  • In Add or Remove Programs, Remove the Viewpoint component
  • Do the same for each Viewpoint component.

Download ComboFix from one of these locations:

Link 1
Link 2
Link 3

* IMPORTANT !!! Save ComboFix.exe to your Desktop


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link –> http://forums.whatthetech.com/How_Disable_…ams_t96260.html

  • Double click on ComboFix.exe & follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


[external image: Posted Image]



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.


Notes:

1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
5. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
Post #6
ComboFix 09-01-21.04 - Administrator 2009-01-24 14:46:54.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1015.261 [GMT -5:00] Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated) * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\jpetxjji.ini c:\windows\system32\mUuBayay.ini c:\windows\system32\mUuBayay.ini2 c:\windows\system32\oyagdmea.ini c:\windows\Tasks\wcoqweug.job . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . ——-\Service_seneka ((((((((((((((((((((((((( Files Created from 2008-12-24 to 2009-01-24 ))))))))))))))))))))))))))))))) . 2009-01-24 00:42 . 2009-01-24 00:42 d——– c:\program files\Malwarebytes' Anti-Malware 2009-01-24 00:42 . 2009-01-24 00:42 d——– c:\documents and settings\All Users\Application Data\Malwarebytes 2009-01-24 00:42 . 2009-01-24 00:42 d——– c:\documents and settings\Administrator\Application Data\Malwarebytes 2009-01-24 00:42 . 2009-01-14 16:11 38,496 –a—— c:\windows\system32\drivers\mbamswissarmy.sys 2009-01-24 00:42 . 2009-01-14 16:11 15,504 –a—— c:\windows\system32\drivers\mbam.sys 2009-01-16 00:45 . 2009-01-16 00:45 d–h—– c:\windows\PIF 2009-01-13 15:39 . 2009-01-13 15:39 578,560 –a—— c:\windows\system32\DllCache\user32.dll 2009-01-13 15:37 . 2009-01-13 15:37 d——– c:\windows\ERUNT 2009-01-13 15:12 . 2009-01-13 15:53 d——– C:\SDFix 2009-01-12 02:02 . 2009-01-12 02:02 d——– c:\program files\Avira 2009-01-12 02:02 . 2009-01-12 02:02 d——– c:\documents and settings\All Users\Application Data\Avira 2009-01-12 01:09 . 2009-01-12 01:09 d——– c:\program files\Trend Micro 2009-01-11 02:23 . 2009-01-11 02:23 d——– c:\windows\STOPzilla! 2009-01-11 02:23 . 2009-01-11 02:23 d—s—- c:\documents and settings\Administrator\%SystemDrive% 2009-01-10 23:04 . 2009-01-10 23:04 d——– c:\program files\AVG 2008-12-31 02:50 . 2008-12-31 02:50 d——– c:\windows\system32\windows media 2008-12-31 02:50 . 2008-12-31 02:50 d–h—– c:\windows\msdownld.tmp 2008-12-31 02:50 . 2008-12-31 02:50 d——– c:\program files\Windows Media Components 2008-12-30 01:41 . 2008-12-30 01:41 410,984 –a—— c:\windows\system32\deploytk.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-01-24 19:40 ——— d—–w c:\program files\Viewpoint 2009-01-24 19:40 ——— d—–w c:\documents and settings\All Users\Application Data\Viewpoint 2009-01-24 19:40 ——— d—–w c:\documents and settings\Administrator\Application Data\Viewpoint 2009-01-24 06:53 ——— d—–w c:\documents and settings\All Users\Application Data\Google Updater 2009-01-17 23:42 ——— d—–w c:\documents and settings\Administrator\Application Data\Move Networks 2009-01-15 01:08 304,160 —-a-w C:\StiImg.dat 2009-01-11 19:39 ——— d—–w c:\documents and settings\LocalService\Application Data\SACore 2008-12-31 19:09 ——— d—–w c:\program files\Google 2008-12-30 06:41 ——— d—–w c:\program files\Java 2008-12-29 19:20 ——— d—–w c:\program files\Rio 2008-12-29 19:18 ——— d—–w c:\program files\LochJournal 2008-12-22 20:29 ——— d—–w c:\program files\Symantec 2008-12-22 20:29 ——— d—–w c:\program files\Common Files\Symantec Shared 2008-12-22 20:29 ——— d—–w c:\documents and settings\All Users\Application Data\Symantec 2008-12-22 19:38 ——— d—–w c:\program files\Alwil Software 2008-12-19 18:27 ——— d—–w c:\program files\Bonjour 2008-12-11 10:57 333,952 —-a-w c:\windows\system32\drivers\srv.sys 2008-12-07 21:39 ——— d—–w c:\program files\McAfee 2008-11-28 20:03 ——— d—–w c:\program files\Safari 2008-09-05 20:44 284,248 -c–a-w c:\program files\npmusicn.dll 2007-02-12 23:10 2,682,880 -c—-w c:\documents and settings\All Users\VCREDI~3.EXE . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-12-23 143360] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360] "updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472] "Google Update"="c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-05 133104] "AIM"="c:\program files\AIM\aim.exe" [2006-08-01 67112] "RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "igfxpers"="c:\windows\system32\igfxpers.exe" [2006-03-22 118784] "Wireless Console 2"="c:\program files\Wireless Console 2\wcourier.exe" [2005-10-17 987136] "Power_Gear"="c:\program files\Generic\Power4 Gear\BatteryLife.exe" [2006-03-06 86016] "NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648] "RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 32768] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-30 136600] "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-09-03 111936] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088] "avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497] "igfxtray"="c:\windows\system32\igfxtray.exe" [2006-03-22 94208] "igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-03-22 77824] "HControl"="c:\windows\ATK0100\HControl.exe" [2006-10-14 110592] "RTHDCPL"="RTHDCPL.EXE" [2006-08-23 c:\windows\RTHDCPL.EXE] "SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe] "SMSERIAL"="sm56hlpr.exe" [2006-01-19 c:\windows\sm56hlpr.exe] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696] Generic ChkMail.lnk - c:\program files\Generic\Generic ChkMail\ChkMail.exe [2007-08-07 45056] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\AIM\\aim.exe"= "c:\\Program Files\\Ruckus Player\\Ruckus.exe"= "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "c:\\Program Files\\AIM6\\aim6.exe"= "c:\\Program Files\\DNA\\btdna.exe"= "c:\\Program Files\\BitPim\\BitPim\\bitpim.exe"= "c:\\Program Files\\BitPim\\BitPim\\bitpimw.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Java\\jre1.6.0_07\\bin\\javaw.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015 "1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016 "500:UDP"= 500:UDP:@xpsp2res.dll,-22017 "3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009 R4 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [2008-07-30 206096] S3 lgatbus;LG USB Composite Device driver (WDM);c:\windows\system32\drivers\lgatbus.sys [2008-01-01 43024] S3 lgatmdm;LG CDMA USB Modem Drivers;c:\windows\system32\drivers\lgatmdm.sys [2008-01-01 77104] S3 lgatserd;LG CDMA USB Modem Diagnostic Serial Port Drivers (WDM);c:\windows\system32\drivers\lgatserd.sys [2008-01-01 60816] S3 PAC207;USB PC Cam Plus;c:\windows\system32\drivers\PFC027.sys [2005-02-24 162176] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b61876b8-92cc-11dc-a467-001bfc6e4c86}] \Shell\AutoRun\command - F:\LaunchU3.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f3854ece-d2f3-11dd-a4f3-0013e85ca6d7}] \Shell\AutoRun\command - E:\DPFMate.exe [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{61E3FE32-07B9-4563-A3E0-2DE2D620FE10}] c:\program files\PixiePack Codec Pack\InstallerHelper.exe . Contents of the 'Scheduled Tasks' folder 2009-01-23 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34] 2009-01-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-602162358-2146922213-725345543-500.job - c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-05 13:27] . - - - - ORPHANS REMOVED - - - - BHO-{C315F6CC-D7F7-4D9A-8471-A5543FC62CDE} - c:\windows\system32\yayaBuUm.dll HKCU-Run-Tunebite - c:\program files\RapidSolution\Tunebite\Tunebite.exe HKCU-Run-Aim6 - (no file) Notify-NavLogon - (no file) . ——- Supplementary Scan ——- . uInternet Connection Wizard,ShellNext = iexplore uInternet Settings,ProxyOverride = *.local uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p;=%s IE: Add to Google Photos Screensa&ver; - c:\windows\system32\GPhotos.scr/200 IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\x9sjoi7q.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.msn.com/ FF - component: c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\x9sjoi7q.default\extensions\{463F6CA5-EE3C-4be1-B7E6-7FEE11953374}\platform\WINNT\components\FoxyTunes.dll FF - component: c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\x9sjoi7q.default\extensions\[removed]\platform\WINNT_x86-msvc\components\mozFotofox.dll FF - plugin: c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\x9sjoi7q.default\extensions\[removed]\platform\WINNT_x86-msvc\plugins\npmnqmp071101000055.dll FF - plugin: c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\1.2.133.33\npGoogleOneClick7.dll FF - plugin: c:\program files\Google\Google Updater\2.4.1368.5602\npCIDetect13.dll FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll FF - plugin: c:\program files\kSolo\npAVX.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npmusicn.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\nppopcaploader.dll —- FIREFOX POLICIES —- FF - user.js: yahoo.homepage.dontask - true. ************************************************************************** scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: ************************************************************************** . ——————— DLLs Loaded Under Running Processes ——————— - - - - - - - > 'explorer.exe'(860) c:\program files\RocketDock\RocketDock.dll c:\program files\McAfee\SiteAdvisor\saHook.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll Ok removed viewpoint, here is the log from combo fix, did restart computer avair .went on detected virusVirus or unwanted program 'TR/Murdak.A.36 [trojan]' detected in file 'C:\ComboFix\catchme.cfexe. Action performed: Move file to quarantine. Completion time: 2009-01-24 14:58:41 - machine was rebooted ComboFix-quarantined-files.txt 2009-01-24 19:58:25 Pre-Run: 2,147,713,024 bytes free Post-Run: 2,077,519,872 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect 184 — E O F — 2009-01-24 08:09:56
Post #7
msucura,

Your Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older version Java components and update:
  • Download the latest version of Java Runtime Environment (JRE) Version 6 and save it to your desktop.
  • Scroll down to where it says "Java Runtime Environment (JRE) 6 Update 11…allows end-users to run Java applications".
  • Click the "Download" button to the right.
  • Select your Platform: "Windows".
  • Select your Language: "Multi-language".
  • Read the License Agreement, and then check the box that says: "Accept License Agreement".
  • Click Continue and the page will refresh.
  • Click on the link to download Windows Offline Installation and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button and follow the onscreen instructions for the Java uninstaller.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u11-windows-i586-p.exe to install the newest version.
Now to Clean out the Java cache:

Go into the Control Panel and double-click the Java Icon. [external image: Posted Image]
  • Under Temporary Internet Files, click the Settings… button
  • click the Delete Files button.
  • There are three options in the window to clear the cache - Leave all 3 Checked
    • Downloaded Applets
      Downloaded Applications
      Other Files
  • Click OK on Delete Temporary Files Window
    Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
  • Click OK to leave the Temporary Files Settings
  • Click OK to leave the Java Control Panel.

COMBOFIX-Script

  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

    File::

Folder::

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b61876b8-92cc-11dc-a467-001bfc6e4c86}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f3854ece-d2f3-11dd-a4f3-0013e85ca6d7}]
[-HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{61E3FE32-07B9-4563-A3E0-2DE2D620FE10}]

Driver::
  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

    [external image: Posted Image]
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

Then

Please go to Kaspersky website and perform an online antivirus scan.

  • Read through the requirements and privacy statement and click on Accept button.
  • It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
  • When the downloads have finished, click on Settings.
  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
    • Spyware, Adware, Dialers, and other potentially dangerous programs
      Archives
      Mail databases
  • Click on My Computer under Scan.
  • Once the scan is complete, it will display the results. Click on View Scan Report.
  • You will see a list of infected items there. Click on Save Report As….
  • Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
  • Please post this log in your next reply.

In your next reply please provide:
  • ComboFix.txt
  • Kaspersky report
  • New HijackThis log taken after everything else completed
Post #8
ok everything done looks good :woot:

Thank You soooo very much for all your help





Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:04:02 AM, on 1/25/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Generic\Power4 Gear\BatteryLife.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\sm56hlpr.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\ATK0100\HControl.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Generic\Generic ChkMail\ChkMail.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Java\jre6\bin\java.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.yahoo.com/search?fr=mcafee&p;=%s
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Program Files\Viewpoint\Viewpoint Toolbar\3.8.0\ViewBarBHO.dll (file missing)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Wireless Console 2] C:\Program Files\Wireless Console 2\wcourier.exe
O4 - HKLM\..\Run: [Power_Gear] C:\Program Files\Generic\Power4 Gear\BatteryLife.exe 1
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Generic ChkMail.lnk = C:\Program Files\Generic\Generic ChkMail\ChkMail.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver; - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe

–
End of file - 8230 bytes
ComboFix 09-01-21.04 - Administrator 2009-01-24 20:37:04.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1015.589 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt
AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated)
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2008-12-25 to 2009-01-25 )))))))))))))))))))))))))))))))
.

2009-01-24 20:14 . 2009-01-24 20:13 73,728 –a—— c:\windows\system32\javacpl.cpl
2009-01-24 19:32 . 2009-01-24 19:51 d——– c:\documents and settings\Administrator\.SunDownloadManager
2009-01-24 00:42 . 2009-01-24 00:42 d——– c:\program files\Malwarebytes' Anti-Malware
2009-01-24 00:42 . 2009-01-24 00:42 d——– c:\documents and settings\All Users\Application Data\Malwarebytes
2009-01-24 00:42 . 2009-01-24 00:42 d——– c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-01-24 00:42 . 2009-01-14 16:11 38,496 –a—— c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-24 00:42 . 2009-01-14 16:11 15,504 –a—— c:\windows\system32\drivers\mbam.sys
2009-01-16 00:45 . 2009-01-16 00:45 d–h—– c:\windows\PIF
2009-01-13 15:39 . 2009-01-13 15:39 578,560 –a—— c:\windows\system32\DllCache\user32.dll
2009-01-13 15:37 . 2009-01-13 15:37 d——– c:\windows\ERUNT
2009-01-13 15:12 . 2009-01-13 15:53 d——– C:\SDFix
2009-01-12 02:02 . 2009-01-12 02:02 d——– c:\program files\Avira
2009-01-12 02:02 . 2009-01-12 02:02 d——– c:\documents and settings\All Users\Application Data\Avira
2009-01-12 01:09 . 2009-01-12 01:09 d——– c:\program files\Trend Micro
2009-01-11 02:23 . 2009-01-11 02:23 d——– c:\windows\STOPzilla!
2009-01-11 02:23 . 2009-01-11 02:23 d—s—- c:\documents and settings\Administrator\%SystemDrive%
2009-01-10 23:04 . 2009-01-10 23:04 d——– c:\program files\AVG
2008-12-31 02:50 . 2008-12-31 02:50 d——– c:\windows\system32\windows media
2008-12-31 02:50 . 2008-12-31 02:50 d–h—– c:\windows\msdownld.tmp
2008-12-31 02:50 . 2008-12-31 02:50 d——– c:\program files\Windows Media Components
2008-12-30 01:41 . 2009-01-24 20:13 410,984 –a—— c:\windows\system32\deploytk.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-25 01:13 ——— d—–w c:\program files\Java
2009-01-24 19:40 ——— d—–w c:\program files\Viewpoint
2009-01-24 19:40 ——— d—–w c:\documents and settings\All Users\Application Data\Viewpoint
2009-01-24 19:40 ——— d—–w c:\documents and settings\Administrator\Application Data\Viewpoint
2009-01-24 06:53 ——— d—–w c:\documents and settings\All Users\Application Data\Google Updater
2009-01-17 23:42 ——— d—–w c:\documents and settings\Administrator\Application Data\Move Networks
2009-01-15 01:08 304,160 —-a-w C:\StiImg.dat
2009-01-11 19:39 ——— d—–w c:\documents and settings\LocalService\Application Data\SACore
2008-12-31 19:09 ——— d—–w c:\program files\Google
2008-12-29 19:20 ——— d—–w c:\program files\Rio
2008-12-29 19:18 ——— d—–w c:\program files\LochJournal
2008-12-22 20:29 ——— d—–w c:\program files\Symantec
2008-12-22 20:29 ——— d—–w c:\program files\Common Files\Symantec Shared
2008-12-22 20:29 ——— d—–w c:\documents and settings\All Users\Application Data\Symantec
2008-12-22 19:38 ——— d—–w c:\program files\Alwil Software
2008-12-19 18:27 ——— d—–w c:\program files\Bonjour
2008-12-12 17:01 3,067,904 —-a-w c:\windows\system32\DllCache\mshtml.dll
2008-12-12 16:18 87,336 —-a-w c:\windows\system32\dns-sd.exe
2008-12-12 16:11 61,440 —-a-w c:\windows\system32\dnssd.dll
2008-12-11 10:57 333,952 —-a-w c:\windows\system32\drivers\srv.sys
2008-12-11 10:57 333,952 —-a-w c:\windows\system32\DllCache\srv.sys
2008-12-07 21:39 ——— d—–w c:\program files\McAfee
2008-11-28 20:03 ——— d—–w c:\program files\Safari
2008-09-05 20:44 284,248 -c–a-w c:\program files\npmusicn.dll
2007-02-12 23:10 2,682,880 -c—-w c:\documents and settings\All Users\VCREDI~3.EXE
.

((((((((((((((((((((((((((((( snapshot@2009-01-24_14.57.09.77 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-12-30 06:41:15 144,792 —-a-w c:\windows\system32\java.exe
+ 2009-01-25 01:13:43 144,792 —-a-w c:\windows\system32\java.exe
- 2008-12-30 06:41:16 144,792 —-a-w c:\windows\system32\javaw.exe
+ 2009-01-25 01:13:43 144,792 —-a-w c:\windows\system32\javaw.exe
- 2008-12-30 06:41:16 148,888 —-a-w c:\windows\system32\javaws.exe
+ 2009-01-25 01:13:43 148,888 —-a-w c:\windows\system32\javaws.exe
+ 2009-01-25 01:14:12 16,384 —-atw c:\windows\Temp\Perflib_Perfdata_6c8.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-12-23 143360]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]
"Google Update"="c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-05 133104]
"AIM"="c:\program files\AIM\aim.exe" [2006-08-01 67112]
"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-03-22 118784]
"Wireless Console 2"="c:\program files\Wireless Console 2\wcourier.exe" [2005-10-17 987136]
"Power_Gear"="c:\program files\Generic\Power4 Gear\BatteryLife.exe" [2006-03-06 86016]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 32768]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-09-03 111936]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2006-03-22 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-03-22 77824]
"HControl"="c:\windows\ATK0100\HControl.exe" [2006-10-14 110592]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-24 136600]
"RTHDCPL"="RTHDCPL.EXE" [2006-08-23 c:\windows\RTHDCPL.EXE]
"SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe]
"SMSERIAL"="sm56hlpr.exe" [2006-01-19 c:\windows\sm56hlpr.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696]
Generic ChkMail.lnk - c:\program files\Generic\Generic ChkMail\ChkMail.exe [2007-08-07 45056]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\AIM\\aim.exe"=
"c:\\Program Files\\Ruckus Player\\Ruckus.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\BitPim\\BitPim\\bitpim.exe"=
"c:\\Program Files\\BitPim\\BitPim\\bitpimw.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015
"1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016
"500:UDP"= 500:UDP:@xpsp2res.dll,-22017
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009

R4 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [2008-07-30 206096]
S3 lgatbus;LG USB Composite Device driver (WDM);c:\windows\system32\drivers\lgatbus.sys [2008-01-01 43024]
S3 lgatmdm;LG CDMA USB Modem Drivers;c:\windows\system32\drivers\lgatmdm.sys [2008-01-01 77104]
S3 lgatserd;LG CDMA USB Modem Diagnostic Serial Port Drivers (WDM);c:\windows\system32\drivers\lgatserd.sys [2008-01-01 60816]
S3 PAC207;USB PC Cam Plus;c:\windows\system32\drivers\PFC027.sys [2005-02-24 162176]

— Other Services/Drivers In Memory —

*NewlyCreated* - JAVAQUICKSTARTERSERVICE
.
Contents of the 'Scheduled Tasks' folder

2009-01-23 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2009-01-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-602162358-2146922213-725345543-500.job
- c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-05 13:27]
.
.
——- Supplementary Scan ——-
.
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p;=%s
IE: Add to Google Photos Screensa&ver; - c:\windows\system32\GPhotos.scr/200
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\x9sjoi7q.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.msn.com/
FF - component: c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\x9sjoi7q.default\extensions\{463F6CA5-EE3C-4be1-B7E6-7FEE11953374}\platform\WINNT\components\FoxyTunes.dll
FF - component: c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\x9sjoi7q.default\extensions\[removed]\platform\WINNT_x86-msvc\components\mozFotofox.dll
FF - plugin: c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\x9sjoi7q.default\extensions\[removed]\platform\WINNT_x86-msvc\plugins\npmnqmp071101000055.dll
FF - plugin: c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\1.2.133.33\npGoogleOneClick7.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1368.5602\npCIDetect13.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\kSolo\npAVX.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmusicn.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\nppopcaploader.dll

—- FIREFOX POLICIES —-
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-24 20:41:01
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-01-24 20:43:34
ComboFix-quarantined-files.txt 2009-01-25 01:43:20
ComboFix2.txt 2009-01-24 19:58:42

Pre-Run: 2,126,094,336 bytes free
Post-Run: 2,112,409,600 bytes free

169 — E O F — 2009-01-24 08:09:56
ComboFix 09-01-21.04 - Administrator 2009-01-24 20:37:04.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1015.589 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt
AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated)
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2008-12-25 to 2009-01-25 )))))))))))))))))))))))))))))))
.

2009-01-24 20:14 . 2009-01-24 20:13 73,728 –a—— c:\windows\system32\javacpl.cpl
2009-01-24 19:32 . 2009-01-24 19:51 d——– c:\documents and settings\Administrator\.SunDownloadManager
2009-01-24 00:42 . 2009-01-24 00:42 d——– c:\program files\Malwarebytes' Anti-Malware
2009-01-24 00:42 . 2009-01-24 00:42 d——– c:\documents and settings\All Users\Application Data\Malwarebytes
2009-01-24 00:42 . 2009-01-24 00:42 d——– c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-01-24 00:42 . 2009-01-14 16:11 38,496 –a—— c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-24 00:42 . 2009-01-14 16:11 15,504 –a—— c:\windows\system32\drivers\mbam.sys
2009-01-16 00:45 . 2009-01-16 00:45 d–h—– c:\windows\PIF
2009-01-13 15:39 . 2009-01-13 15:39 578,560 –a—— c:\windows\system32\DllCache\user32.dll
2009-01-13 15:37 . 2009-01-13 15:37 d——– c:\windows\ERUNT
2009-01-13 15:12 . 2009-01-13 15:53 d——– C:\SDFix
2009-01-12 02:02 . 2009-01-12 02:02 d——– c:\program files\Avira
2009-01-12 02:02 . 2009-01-12 02:02 d——– c:\documents and settings\All Users\Application Data\Avira
2009-01-12 01:09 . 2009-01-12 01:09 d——– c:\program files\Trend Micro
2009-01-11 02:23 . 2009-01-11 02:23 d——– c:\windows\STOPzilla!
2009-01-11 02:23 . 2009-01-11 02:23 d—s—- c:\documents and settings\Administrator\%SystemDrive%
2009-01-10 23:04 . 2009-01-10 23:04 d——– c:\program files\AVG
2008-12-31 02:50 . 2008-12-31 02:50 d——– c:\windows\system32\windows media
2008-12-31 02:50 . 2008-12-31 02:50 d–h—– c:\windows\msdownld.tmp
2008-12-31 02:50 . 2008-12-31 02:50 d——– c:\program files\Windows Media Components
2008-12-30 01:41 . 2009-01-24 20:13 410,984 –a—— c:\windows\system32\deploytk.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-25 01:13 ——— d—–w c:\program files\Java
2009-01-24 19:40 ——— d—–w c:\program files\Viewpoint
2009-01-24 19:40 ——— d—–w c:\documents and settings\All Users\Application Data\Viewpoint
2009-01-24 19:40 ——— d—–w c:\documents and settings\Administrator\Application Data\Viewpoint
2009-01-24 06:53 ——— d—–w c:\documents and settings\All Users\Application Data\Google Updater
2009-01-17 23:42 ——— d—–w c:\documents and settings\Administrator\Application Data\Move Networks
2009-01-15 01:08 304,160 —-a-w C:\StiImg.dat
2009-01-11 19:39 ——— d—–w c:\documents and settings\LocalService\Application Data\SACore
2008-12-31 19:09 ——— d—–w c:\program files\Google
2008-12-29 19:20 ——— d—–w c:\program files\Rio
2008-12-29 19:18 ——— d—–w c:\program files\LochJournal
2008-12-22 20:29 ——— d—–w c:\program files\Symantec
2008-12-22 20:29 ——— d—–w c:\program files\Common Files\Symantec Shared
2008-12-22 20:29 ——— d—–w c:\documents and settings\All Users\Application Data\Symantec
2008-12-22 19:38 ——— d—–w c:\program files\Alwil Software
2008-12-19 18:27 ——— d—–w c:\program files\Bonjour
2008-12-12 17:01 3,067,904 —-a-w c:\windows\system32\DllCache\mshtml.dll
2008-12-12 16:18 87,336 —-a-w c:\windows\system32\dns-sd.exe
2008-12-12 16:11 61,440 —-a-w c:\windows\system32\dnssd.dll
2008-12-11 10:57 333,952 —-a-w c:\windows\system32\drivers\srv.sys
2008-12-11 10:57 333,952 —-a-w c:\windows\system32\DllCache\srv.sys
2008-12-07 21:39 ——— d—–w c:\program files\McAfee
2008-11-28 20:03 ——— d—–w c:\program files\Safari
2008-09-05 20:44 284,248 -c–a-w c:\program files\npmusicn.dll
2007-02-12 23:10 2,682,880 -c—-w c:\documents and settings\All Users\VCREDI~3.EXE
.

((((((((((((((((((((((((((((( snapshot@2009-01-24_14.57.09.77 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-12-30 06:41:15 144,792 —-a-w c:\windows\system32\java.exe
+ 2009-01-25 01:13:43 144,792 —-a-w c:\windows\system32\java.exe
- 2008-12-30 06:41:16 144,792 —-a-w c:\windows\system32\javaw.exe
+ 2009-01-25 01:13:43 144,792 —-a-w c:\windows\system32\javaw.exe
- 2008-12-30 06:41:16 148,888 —-a-w c:\windows\system32\javaws.exe
+ 2009-01-25 01:13:43 148,888 —-a-w c:\windows\system32\javaws.exe
+ 2009-01-25 01:14:12 16,384 —-atw c:\windows\Temp\Perflib_Perfdata_6c8.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-12-23 143360]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]
"Google Update"="c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-05 133104]
"AIM"="c:\program files\AIM\aim.exe" [2006-08-01 67112]
"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-03-22 118784]
"Wireless Console 2"="c:\program files\Wireless Console 2\wcourier.exe" [2005-10-17 987136]
"Power_Gear"="c:\program files\Generic\Power4 Gear\BatteryLife.exe" [2006-03-06 86016]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 32768]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-09-03 111936]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2006-03-22 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-03-22 77824]
"HControl"="c:\windows\ATK0100\HControl.exe" [2006-10-14 110592]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-24 136600]
"RTHDCPL"="RTHDCPL.EXE" [2006-08-23 c:\windows\RTHDCPL.EXE]
"SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe]
"SMSERIAL"="sm56hlpr.exe" [2006-01-19 c:\windows\sm56hlpr.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696]
Generic ChkMail.lnk - c:\program files\Generic\Generic ChkMail\ChkMail.exe [2007-08-07 45056]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\AIM\\aim.exe"=
"c:\\Program Files\\Ruckus Player\\Ruckus.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\BitPim\\BitPim\\bitpim.exe"=
"c:\\Program Files\\BitPim\\BitPim\\bitpimw.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015
"1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016
"500:UDP"= 500:UDP:@xpsp2res.dll,-22017
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009

R4 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [2008-07-30 206096]
S3 lgatbus;LG USB Composite Device driver (WDM);c:\windows\system32\drivers\lgatbus.sys [2008-01-01 43024]
S3 lgatmdm;LG CDMA USB Modem Drivers;c:\windows\system32\drivers\lgatmdm.sys [2008-01-01 77104]
S3 lgatserd;LG CDMA USB Modem Diagnostic Serial Port Drivers (WDM);c:\windows\system32\drivers\lgatserd.sys [2008-01-01 60816]
S3 PAC207;USB PC Cam Plus;c:\windows\system32\drivers\PFC027.sys [2005-02-24 162176]

— Other Services/Drivers In Memory —

*NewlyCreated* - JAVAQUICKSTARTERSERVICE
.
Contents of the 'Scheduled Tasks' folder

2009-01-23 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2009-01-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-602162358-2146922213-725345543-500.job
- c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-05 13:27]
.
.
——- Supplementary Scan ——-
.
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p;=%s
IE: Add to Google Photos Screensa&ver; - c:\windows\system32\GPhotos.scr/200
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\x9sjoi7q.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.msn.com/
FF - component: c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\x9sjoi7q.default\extensions\{463F6CA5-EE3C-4be1-B7E6-7FEE11953374}\platform\WINNT\components\FoxyTunes.dll
FF - component: c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\x9sjoi7q.default\extensions\[removed]\platform\WINNT_x86-msvc\components\mozFotofox.dll
FF - plugin: c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\x9sjoi7q.default\extensions\[removed]\platform\WINNT_x86-msvc\plugins\npmnqmp071101000055.dll
FF - plugin: c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\1.2.133.33\npGoogleOneClick7.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1368.5602\npCIDetect13.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\kSolo\npAVX.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmusicn.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\nppopcaploader.dll

—- FIREFOX POLICIES —-
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-24 20:41:01
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-01-24 20:43:34
ComboFix-quarantined-files.txt 2009-01-25 01:43:20
ComboFix2.txt 2009-01-24 19:58:42

Pre-Run: 2,126,094,336 bytes free
Post-Run: 2,112,409,600 bytes free

169 — E O F — 2009-01-24 08:09:56
KASPERSKY ONLINE SCANNER 7 REPORT
Sunday, January 25, 2009
Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Saturday, January 24, 2009 21:45:06
Records in database: 1700407
Scan settings
Scan using the following database extended
Scan archives yes
Scan mail databases yes
Scan area My Computer
C:\
D:\
Scan statistics
Files scanned 59121
Threat name 0
Infected objects 0
Suspicious objects 0
Duration of the scan 03:31:55

No malware has been detected. The scan area is clean.
The selected area was scanned.
Post #9
msucura,

Log looks good :D


Time for some housekeeping
  • Click START then RUN
  • Now type Combofix /u in the runbox and click OK
  • Note the space between the X and the U, it needs to be there.
  • [external image: Posted Image]
The above procedure will:
  • Implement some cleanup procedures.
  • Reset System Restore.

Please re-enable any security that was disabled.

The following is my standard advice for the future. Use what you can and pat yourself on the back for what you're already doing.

Please take time to read Preventing Malware - Tools and Practices for Safe Computing. Very important information for your consideration is contained therein.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein


Also: "How to prevent malware"
by miekiemoes

Please respond back that you understand the above and let me know if you have any questions. Otherwise, this thread will be closed Resolved. :thumbup:
Post #12
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI