This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] helping out a friend

15 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

sorry, traveling again! thanks for your help and patience, here are the two reports: dds DDS (Ver_09-02-01.01) - NTFSx86 Run by [removed] at 23:55:35.16 on Thu 02/19/2009 Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_11 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1006.397 [GMT -5:00] AV: avast! antivirus 4.8.1335 [VPS 090215-0] *On-access scanning enabled* (Updated) ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe svchost.exe svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Canon\DIAS\CnxDIAS.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Dell\Media Experience\DMXLauncher.exe C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe C:\WINDOWS\system32\LVCOMSX.EXE C:\Program Files\Logitech\Video\LogiTray.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\Adobe\Photoshop Elements 6.0\apdproxy.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe C:\Program Files\DellSupport\DSAgnt.exe C:\WINDOWS\system32\igfxsrvc.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Program Files\Logitech\Video\FxSvr2.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\wuauclt.exe c:\progra~1\common~1\instal~1\update~1\isuspm.exe C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Alwil Software\Avast4\setup\avast.setup C:\Documents and Settings\Steve\Desktop\dds.pif ============== Pseudo HJT Report =============== uStart Page = hxxp://www.yahoo.com/ mStart Page = hxxp://www.dell4me.com/myway uInternet Connection Wizard,ShellNext = hxxp://www.dell4me.com/myway uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 6.0\reader\activex\AcroIEHelper.dll BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\tfswshx.dll BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll BHO: Act.UI.InternetExplorer.Plugins.AttachFile.CAttachFile: {d5233fcd-d258-4903-89b8-fb1568e7413d} - mscoree.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No File TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - uRun: [MsnMsgr] "c:\program files\msn messenger\MsnMsgr.Exe" /background uRun: [LogitechSoftwareUpdate] "c:\program files\logitech\video\ManifestEngine.exe" boot uRun: [DellSupport] "c:\program files\dellsupport\DSAgnt.exe" /startup mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" mRun: [SynTPLpr] c:\program files\synaptics\syntp\SynTPLpr.exe mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe mRun: [IntelWireless] c:\program files\intel\wireless\bin\ifrmewrk.exe /tf Intel PROSet/Wireless mRun: [DVDLauncher] "c:\program files\cyberlink\powerdvd\DVDLauncher.exe" mRun: [dla] c:\windows\system32\dla\tfswctrl.exe mRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\isuspm.exe -startup mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start mRun: [DMXLauncher] c:\program files\dell\media experience\DMXLauncher.exe mRun: [mmtask] "c:\program files\musicmatch\musicmatch jukebox\mmtask.exe" mRun: [LVCOMSX] c:\windows\system32\LVCOMSX.EXE mRun: [LogitechVideoRepair] c:\program files\logitech\video\ISStart.exe mRun: [LogitechVideoTray] c:\program files\logitech\video\LogiTray.exe mRun: [igfxtray] c:\windows\system32\igfxtray.exe mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe mRun: [igfxpers] c:\windows\system32\igfxpers.exe mRun: [Adobe Photo Downloader] "c:\program files\adobe\photoshop elements 6.0\apdproxy.exe" mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE mRun: [Ad-Watch] c:\program files\lavasoft\ad-aware\AAWTray.exe mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office11\EXCEL.EXE/3000 IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {6F431AC3-364A-478b-BBDB-89C7CE1B18F6} - {6F431AC3-364A-478b-BBDB-89C7CE1B18F6} - mscoree.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office11\REFIEBAR.DLL DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\yinsthelper.dll DPF: {87587503-20F0-4FF5-8DA3-0107C4C03FDC} - hxxp://downloads.comcast.net/videomail/vmLauncher.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} - hxxps://secure.logmein.com/activex/ractrl.cab?lmi=100 DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} - hxxp://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab Notify: igfxcui - igfxdev.dll Notify: IntelWireless - c:\program files\intel\wireless\bin\LgNotify.dll Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\steve\applic~1\mozilla\firefox\profiles\c1ae0dq5.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/ FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll ============= SERVICES / DRIVERS =============== R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-2-6 64160] R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-2-6 114768] R2 AdobeActiveFileMonitor6.0;Adobe Active File Monitor V6;c:\program files\adobe\photoshop elements 6.0\PhotoshopElementsFileAgent.exe [2007-9-10 124832] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-2-6 20560] R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast4\ashServ.exe [2009-2-6 138680] R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-1-18 950096] R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [2009-1-7 10384] R2 MSSQL$ACT7;SQL Server (ACT7);c:\program files\microsoft sql server\mssql.1\mssql\binn\sqlservr.exe [2008-12-18 29181272] R3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast4\ashMaiSv.exe [2009-2-6 254040] R3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast4\ashWebSv.exe [2009-2-6 352920] S3 Novatel;Novatel Wireless Network Adapter;c:\windows\system32\drivers\nwc201.sys –> c:\windows\system32\drivers\nwc201.sys [?] S3 SocketQuadSerial;Novatel Wireless CDMA 1.9GHz Modem driver;c:\windows\system32\drivers\nvtlg2k.sys –> c:\windows\system32\drivers\nvtlg2k.sys [?] =============== Created Last 30 ================ 2009-02-19 23:55 –d-h— c:\windows\PIF 2009-02-15 13:29 –d—– c:\docume~1\steve\applic~1\Malwarebytes 2009-02-15 13:29 15,504 a——- c:\windows\system32\drivers\mbam.sys 2009-02-15 13:29 38,496 a——- c:\windows\system32\drivers\mbamswissarmy.sys 2009-02-15 13:29 –d—– c:\docume~1\alluse~1\applic~1\Malwarebytes 2009-02-15 13:29 –d—– c:\program files\Malwarebytes' Anti-Malware 2009-02-15 13:26 607,640 a——- c:\documents and settings\steve\jre-6u12-windows-i586-p-iftw.exe 2009-02-15 12:59 16,278,936 a——- c:\documents and settings\steve\jre-6u12-windows-i586-p.exe 2009-02-15 12:59 –d—– c:\documents and settings\steve\.SunDownloadManager 2009-02-13 21:15 –d—– c:\windows\SQL9_KB960089_ENU 2009-02-08 20:06 a-dshr– C:\cmdcons 2009-02-08 20:04 161,792 a——- c:\windows\SWREG.exe 2009-02-08 20:04 98,816 a——- c:\windows\sed.exe 2009-02-08 14:47 –d—– c:\windows\ERUNT 2009-02-08 14:42 –d—– C:\SDFix 2009-02-07 16:51 410,984 a——- c:\windows\system32\deploytk.dll 2009-02-07 16:51 73,728 a——- c:\windows\system32\javacpl.cpl 2009-02-07 14:22 –d—– c:\program files\Spybot - Search & Destroy 2009-02-07 14:22 –d—– c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy 2009-02-07 02:23 –d—– c:\windows\pss 2009-02-06 23:47 15,688 a——- c:\windows\system32\lsdelete.exe 2009-02-06 22:57 64,160 a——- c:\windows\system32\drivers\Lbd.sys 2009-02-06 22:55 –d—– c:\program files\Lavasoft 2009-02-06 22:46 -cd-h— c:\docume~1\alluse~1\applic~1\{83C91755-2546-441D-AC40-9A6B4B860800} 2009-02-04 15:25 –d—– c:\docume~1\steve\applic~1\Webroot 2009-02-04 15:24 –d—– c:\docume~1\alluse~1\applic~1\Geek Squad 2009-02-03 11:13 –d—– c:\documents and settings\steve\WINDOWS ==================== Find3M ==================== 2009-02-04 12:56 952 a–sh— c:\docume~1\alluse~1\applic~1\KGyGaAvL.sys 2009-01-07 17:38 0 a—h— c:\windows\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf 2009-01-07 17:38 0 a—h— c:\windows\system32\drivers\Msft_Kernel_LHidFilt_01005.Wdf 2009-01-07 17:38 0 a—h— c:\windows\system32\drivers\Msft_Kernel_LUsbFilt_01005.Wdf 2009-01-07 17:38 0 a—h— c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf 2008-12-12 12:33 3,060,224 ——– c:\windows\system32\dllcache\mshtml.dll 2008-12-11 06:57 333,184 ——– c:\windows\system32\dllcache\srv.sys 2005-11-17 20:37 1,890 a–sh— c:\windows\system32\KGyGaAvL.sys ============= FINISH: 23:56:21.49 =============== attach UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT DDS (Ver_09-02-01.01) Microsoft Windows XP Home Edition Boot Device: \Device\HarddiskVolume2 Install Date: 8/23/2005 5:42:56 PM System Uptime: 2/19/2009 11:51:47 PM (0 hours ago) Motherboard: DELL SYSTEM | | 0RC359 Processor: Intel® Pentium® M processor 1.70GHz | U1 | 1694/100mhz ==== Disk Partitions ========================= C: is FIXED (NTFS) - 71 GiB total, 17.733 GiB free. D: is CDROM () ==== Disabled Device Manager Items ============= ==== System Restore Points =================== RP233: 11/10/2008 5:53:40 PM - System Checkpoint RP234: 11/11/2008 9:00:10 AM - Installed Color Network ScanGear Ver.2.21 RP235: 11/11/2008 10:25:01 AM - Installed ACT! by Sage 2009 (11.0) RP236: 11/11/2008 8:48:08 PM - Software Distribution Service 3.0 RP237: 11/12/2008 8:05:14 PM - Software Distribution Service 3.0 RP238: 11/14/2008 8:33:47 PM - Software Distribution Service 3.0 RP239: 11/15/2008 10:01:49 PM - System Checkpoint RP240: 11/16/2008 5:49:17 PM - Removed Dell Picture Studio v3.0 RP241: 11/16/2008 5:51:22 PM - Removed Fore! Reservations 2008 RP242: 11/16/2008 5:53:42 PM - Removed Jasc Paint Shop Photo Album RP243: 11/16/2008 5:55:10 PM - Removed Jasc Paint Shop Photo Album 5 RP244: 11/16/2008 5:57:47 PM - Removed Jasc Paint Shop Pro 8 Dell Edition RP245: 11/16/2008 7:14:39 PM - Removed Jasc Paint Shop Pro Studio, Dell Editon RP246: 11/18/2008 1:04:45 PM - System Checkpoint RP247: 11/19/2008 2:16:03 PM - System Checkpoint RP248: 11/20/2008 4:24:35 PM - System Checkpoint RP249: 12/21/2008 4:10:24 PM - System Checkpoint RP250: 11/21/2008 6:19:42 PM - System Checkpoint RP251: 11/22/2008 8:47:15 PM - System Checkpoint RP252: 11/24/2008 10:08:37 AM - System Checkpoint RP253: 11/25/2008 1:43:13 PM - System Checkpoint RP254: 11/26/2008 3:07:16 PM - System Checkpoint RP255: 11/30/2008 12:47:29 PM - System Checkpoint RP256: 12/3/2008 2:49:32 PM - System Checkpoint RP257: 12/5/2008 1:40:34 PM - System Checkpoint RP258: 12/6/2008 3:38:20 PM - System Checkpoint RP259: 12/8/2008 12:44:18 PM - System Checkpoint RP260: 12/9/2008 11:24:13 AM - Installed The Print Shop 23 RP261: 12/10/2008 12:04:21 PM - System Checkpoint RP262: 12/10/2008 6:39:31 PM - Software Distribution Service 3.0 RP263: 12/12/2008 10:39:07 AM - Software Distribution Service 3.0 RP264: 12/15/2008 10:21:38 AM - System Checkpoint RP265: 12/16/2008 10:48:46 AM - System Checkpoint RP266: 12/17/2008 12:17:25 PM - System Checkpoint RP267: 12/18/2008 2:37:49 PM - System Checkpoint RP268: 12/19/2008 9:47:59 AM - Software Distribution Service 3.0 RP269: 12/22/2008 12:10:34 PM - System Checkpoint RP270: 12/24/2008 11:09:40 AM - System Checkpoint RP271: 12/24/2008 12:37:23 PM - Software Distribution Service 3.0 RP272: 12/26/2008 11:33:01 AM - System Checkpoint RP273: 12/26/2008 6:38:16 PM - Software Distribution Service 3.0 RP274: 12/27/2008 8:37:07 AM - Software Distribution Service 3.0 RP275: 12/29/2008 9:20:15 AM - System Checkpoint RP276: 12/30/2008 9:20:57 AM - System Checkpoint RP277: 12/31/2008 11:54:24 AM - System Checkpoint RP278: 1/2/2009 10:47:19 AM - System Checkpoint RP279: 1/3/2009 5:38:40 PM - System Checkpoint RP280: 1/5/2009 10:00:35 AM - System Checkpoint RP281: 1/6/2009 2:52:10 PM - System Checkpoint RP282: 1/7/2009 5:33:39 PM - SetPoint 4.70 RP283: 1/7/2009 5:37:53 PM - Installed Windows XP Wdf01005. RP284: 1/10/2009 9:15:59 AM - System Checkpoint RP285: 1/12/2009 10:00:57 AM - System Checkpoint RP286: 1/13/2009 1:09:08 PM - System Checkpoint RP287: 1/15/2009 10:29:23 AM - Software Distribution Service 3.0 RP288: 1/17/2009 10:19:56 AM - System Checkpoint RP289: 1/19/2009 11:19:10 AM - System Checkpoint RP290: 1/20/2009 1:20:11 PM - System Checkpoint RP291: 1/21/2009 4:03:42 PM - System Checkpoint RP292: 1/23/2009 3:28:04 PM - System Checkpoint RP293: 1/26/2009 10:11:41 AM - System Checkpoint RP294: 1/27/2009 1:43:45 PM - System Checkpoint RP295: 2/2/2009 10:57:52 AM - System Checkpoint RP296: 2/3/2009 1:50:16 PM - System Checkpoint RP297: 2/4/2009 1:19:27 PM - Configured ACT! by Sage 2009 (11.0) RP298: 2/5/2009 1:22:41 PM - System Checkpoint RP299: 2/7/2009 1:17:09 AM - Removed Norton Security Center RP300: 2/7/2009 1:49:06 AM - Removed Bonjour RP301: 2/7/2009 1:49:46 AM - Removed Get High Speed Internet! RP302: 2/7/2009 4:48:29 PM - Software Distribution Service 3.0 RP303: 2/8/2009 8:04:41 PM - ComboFix created restore point RP304: 2/9/2009 7:23:05 PM - ComboFix created restore point RP305: 2/13/2009 8:55:44 PM - ComboFix created restore point RP306: 2/13/2009 9:15:11 PM - Software Distribution Service 3.0 RP307: 2/15/2009 3:35:19 PM - System Checkpoint ==== Installed Programs ====================== Ad-Aware Adobe Acrobat - Reader 6.0.2 Update Adobe Flash Player 10 Plugin Adobe Flash Player ActiveX Adobe Photoshop Elements 6.0 Adobe Reader 6.0.1 AOLIcon Apple Mobile Device Support Apple Software Update avast! Antivirus Broadcom Management Programs CDDRV_Installer Conexant D480 MDC V.9x Modem Dell Digital Jukebox Driver Dell Driver Reset Tool Dell Media Experience Dell Photo Printer 720 Dell Photo Printer 720 Logger Dell System Restore DellSupport Digital Line Detect EarthLink setup files GDR 3077 for SQL Server Database Services 2005 ENU (KB960089) HijackThis 2.0.2 Hotfix for Windows XP (KB952287) iDEN Phonebook Manager Intel® Extreme Graphics 2 Driver Intel® PROSet/Wireless Software Internet Explorer Default Page iPod for Windows 2005-09-06 iPod for Windows 2005-10-12 iPod for Windows 2005-11-17 iPod for Windows 2006-01-10 iTunes Java™ 6 Update 11 KhalInstallWrapper Logitech QuickCam Software Logitech SetPoint Logitech® Camera Driver Macromedia Flash Player Macromedia Flash Player 8 Malwarebytes' Anti-Malware mCore mDrWiFi mHlpDell Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Hotfix (KB928366) Microsoft .NET Framework 2.0 Service Pack 1 Microsoft Kernel-Mode Driver Framework Feature Pack 1.5 Microsoft Office Standard Edition 2003 Microsoft Plus! Digital Media Edition Installer Microsoft Plus! Photo Story 2 LE Microsoft Silverlight Microsoft SQL Server 2005 Microsoft SQL Server 2005 Express Edition (ACT7) Microsoft SQL Server Native Client Microsoft SQL Server Setup Support Files (English) Microsoft SQL Server VSS Writer Microsoft Streets and Trips 2004 Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 Microsoft Web Publishing Wizard 1.52 mIWA mIWCA mLogView mMHouse Modem Helper Mozilla Firefox (3.0.6) mPfMgr mPfWiz mProSafe mSSO MSXML 4.0 SP2 (KB927978) MSXML 4.0 SP2 (KB936181) MSXML 4.0 SP2 (KB954430) MSXML 6 Service Pack 2 (KB954459) mToolkit Musicmatch® Jukebox mWlsSafe mXML mZConfig NetWaiting PCIxx20 Photo Click PowerDVD 5.5 QuickBooks Simple Start Special Edition Quicken 2006 QuickTime SAMSUNG CDMA Modem Driver Set Security Update for CAPICOM (KB931906) Security Update for Step By Step Interactive Training (KB898458) Security Update for Step By Step Interactive Training (KB923723) Security Update for Windows Media Player (KB911564) Security Update for Windows Media Player (KB952069) Security Update for Windows Media Player 10 (KB911565) Security Update for Windows Media Player 10 (KB917734) Security Update for Windows Media Player 10 (KB936782) Security Update for Windows Media Player 6.4 (KB925398) Security Update for Windows XP (KB890046) Security Update for Windows XP (KB893066) Security Update for Windows XP (KB893756) Security Update for Windows XP (KB896358) Security Update for Windows XP (KB896422) Security Update for Windows XP (KB896423) Security Update for Windows XP (KB896424) Security Update for Windows XP (KB896428) Security Update for Windows XP (KB899587) Security Update for Windows XP (KB899591) Security Update for Windows XP (KB900725) Security Update for Windows XP (KB901017) Security Update for Windows XP (KB901214) Security Update for Windows XP (KB902400) Security Update for Windows XP (KB904706) Security Update for Windows XP (KB905414) Security Update for Windows XP (KB905749) Security Update for Windows XP (KB905915) Security Update for Windows XP (KB908519) Security Update for Windows XP (KB908531) Security Update for Windows XP (KB911280) Security Update for Windows XP (KB911562) Security Update for Windows XP (KB911567) Security Update for Windows XP (KB911927) Security Update for Windows XP (KB912812) Security Update for Windows XP (KB912919) Security Update for Windows XP (KB913446) Security Update for Windows XP (KB913580) Security Update for Windows XP (KB914388) Security Update for Windows XP (KB914389) Security Update for Windows XP (KB916281) Security Update for Windows XP (KB917159) Security Update for Windows XP (KB917344) Security Update for Windows XP (KB917422) Security Update for Windows XP (KB917953) Security Update for Windows XP (KB918118) Security Update for Windows XP (KB918439) Security Update for Windows XP (KB918899) Security Update for Windows XP (KB919007) Security Update for Windows XP (KB920213) Security Update for Windows XP (KB920214) Security Update for Windows XP (KB920670) Security Update for Windows XP (KB920683) Security Update for Windows XP (KB920685) Security Update for Windows XP (KB921398) Security Update for Windows XP (KB921503) Security Update for Windows XP (KB921883) Security Update for Windows XP (KB922616) Security Update for Windows XP (KB922760) Security Update for Windows XP (KB922819) Security Update for Windows XP (KB923191) Security Update for Windows XP (KB923414) Security Update for Windows XP (KB923689) Security Update for Windows XP (KB923694) Security Update for Windows XP (KB923980) Security Update for Windows XP (KB924191) Security Update for Windows XP (KB924270) Security Update for Windows XP (KB924496) Security Update for Windows XP (KB924667) Security Update for Windows XP (KB925454) Security Update for Windows XP (KB925486) Security Update for Windows XP (KB925902) Security Update for Windows XP (KB926255) Security Update for Windows XP (KB926436) Security Update for Windows XP (KB927779) Security Update for Windows XP (KB927802) Security Update for Windows XP (KB928090) Security Update for Windows XP (KB928255) Security Update for Windows XP (KB928843) Security Update for Windows XP (KB929123) Security Update for Windows XP (KB929969) Security Update for Windows XP (KB930178) Security Update for Windows XP (KB931261) Security Update for Windows XP (KB931768) Security Update for Windows XP (KB931784) Security Update for Windows XP (KB932168) Security Update for Windows XP (KB933729) Security Update for Windows XP (KB935839) Security Update for Windows XP (KB935840) Security Update for Windows XP (KB936021) Security Update for Windows XP (KB937143) Security Update for Windows XP (KB938127) Security Update for Windows XP (KB938464) Security Update for Windows XP (KB938829) Security Update for Windows XP (KB939653) Security Update for Windows XP (KB941202) Security Update for Windows XP (KB941568) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB941644) Security Update for Windows XP (KB941693) Security Update for Windows XP (KB942615) Security Update for Windows XP (KB943055) Security Update for Windows XP (KB943460) Security Update for Windows XP (KB943485) Security Update for Windows XP (KB944338) Security Update for Windows XP (KB944653) Security Update for Windows XP (KB945553) Security Update for Windows XP (KB946026) Security Update for Windows XP (KB946648) Security Update for Windows XP (KB947864) Security Update for Windows XP (KB948590) Security Update for Windows XP (KB948881) Security Update for Windows XP (KB950749) Security Update for Windows XP (KB950759) Security Update for Windows XP (KB950760) Security Update for Windows XP (KB950762) Security Update for Windows XP (KB950974) Security Update for Windows XP (KB951066) Security Update for Windows XP (KB951376-v2) Security Update for Windows XP (KB951376) Security Update for Windows XP (KB951698) Security Update for Windows XP (KB951748) Security Update for Windows XP (KB952954) Security Update for Windows XP (KB953838) Security Update for Windows XP (KB953839) Security Update for Windows XP (KB954211) Security Update for Windows XP (KB954600) Security Update for Windows XP (KB955069) Security Update for Windows XP (KB956390) Security Update for Windows XP (KB956391) Security Update for Windows XP (KB956802) Security Update for Windows XP (KB956803) Security Update for Windows XP (KB956841) Security Update for Windows XP (KB957095) Security Update for Windows XP (KB957097) Security Update for Windows XP (KB958215) Security Update for Windows XP (KB958644) Security Update for Windows XP (KB958687) Security Update for Windows XP (KB960714) Security Update for Windows XP (KB960715) Sonic DLA Sonic MyDVD LE Sonic RecordNow Audio Sonic RecordNow Copy Sonic RecordNow Data Sonic Update Manager Spybot - Search & Destroy SwingView Pro Version 7 Synaptics Pointing Device Driver Texas Instruments PCIxx20 drivers. The Print Shop 23 Tune Tools for iPod Multimedia Edition Update for Windows XP (KB894391) Update for Windows XP (KB898461) Update for Windows XP (KB900485) Update for Windows XP (KB910437) Update for Windows XP (KB916595) Update for Windows XP (KB920872) Update for Windows XP (KB922582) Update for Windows XP (KB927891) Update for Windows XP (KB929338) Update for Windows XP (KB930916) Update for Windows XP (KB931836) Update for Windows XP (KB933360) Update for Windows XP (KB936357) Update for Windows XP (KB938828) Update for Windows XP (KB942763) Update for Windows XP (KB942840) Update for Windows XP (KB946627) Update for Windows XP (KB951072-v2) Update for Windows XP (KB955839) Viewpoint Media Player Visual C++ 2008 x86 Runtime - (v9.0.30729) Visual C++ 2008 x86 Runtime - v9.0.30729.01 WebCyberCoach 3.2 Dell WebFldrs XP Windows Driver Package - MSN (usbccgp) USB (04/19/2006 1.1.0.2) Windows Installer 3.1 (KB893803) Windows Live Messenger Windows Media Format Runtime Windows Media Player 10 Windows XP Hotfix - KB873339 Windows XP Hotfix - KB885250 Windows XP Hotfix - KB885835 Windows XP Hotfix - KB885836 Windows XP Hotfix - KB885855 Windows XP Hotfix - KB885884 Windows XP Hotfix - KB886185 Windows XP Hotfix - KB887472 Windows XP Hotfix - KB887742 Windows XP Hotfix - KB888113 Windows XP Hotfix - KB888302 Windows XP Hotfix - KB888310 Windows XP Hotfix - KB890175 Windows XP Hotfix - KB890859 Windows XP Hotfix - KB891781 Yahoo! Install Manager ==== Event Viewer Messages From Past Week ======== 2/13/2009 8:57:21 PM, error: Service Control Manager [7031] - The Lavasoft Ad-Aware Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service. 2/13/2009 8:57:21 PM, error: Service Control Manager [7034] - The LexBce Server service terminated unexpectedly. It has done this 1 time(s). 2/13/2009 8:57:17 PM, error: Service Control Manager [7034] - The iPod Service service terminated unexpectedly. It has done this 1 time(s). 2/13/2009 8:57:17 PM, error: Service Control Manager [7034] - The SQL Server VSS Writer service terminated unexpectedly. It has done this 1 time(s). 2/13/2009 8:57:17 PM, error: Service Control Manager [7034] - The RegSrvc service terminated unexpectedly. It has done this 1 time(s). 2/13/2009 8:57:17 PM, error: Service Control Manager [7034] - The Adobe Active File Monitor V6 service terminated unexpectedly. It has done this 1 time(s). 2/13/2009 8:57:17 PM, error: Service Control Manager [7034] - The WLANKEEPER service terminated unexpectedly. It has done this 1 time(s). 2/13/2009 8:57:17 PM, error: Service Control Manager [7034] - The Spectrum24 Event Monitor service terminated unexpectedly. It has done this 1 time(s). 2/13/2009 8:57:17 PM, error: Service Control Manager [7034] - The EvtEng service terminated unexpectedly. It has done this 1 time(s). 2/13/2009 8:57:17 PM, error: Service Control Manager [7034] - The Windows User Mode Driver Framework service terminated unexpectedly. It has done this 1 time(s). 2/13/2009 8:57:21 PM, error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service. 2/13/2009 8:57:21 PM, error: Service Control Manager [7031] - The Canon Driver Information Assist Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 500 milliseconds: Restart the service. 2/13/2009 8:57:21 PM, error: Service Control Manager [7034] - The Java Quick Starter service terminated unexpectedly. It has done this 1 time(s). 2/13/2009 8:57:21 PM, error: Service Control Manager [7034] - The SQL Server (ACT7) service terminated unexpectedly. It has done this 1 time(s). 2/13/2009 8:57:21 PM, error: Service Control Manager [7031] - The SQL Server Browser service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service. 2/13/2009 8:57:21 PM, error: Service Control Manager [7034] - The Application Layer Gateway Service service terminated unexpectedly. It has done this 1 time(s). 2/13/2009 8:57:21 PM, error: Service Control Manager [7031] - The Print Spooler service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service. 2/13/2009 8:58:21 PM, error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Print Spooler service, but this action failed with the following error: An instance of the service is already running. ==== End Of File ===========================
Hello raisitup,


Good news, logs look clean :thumbup:

Just a little tidying up to do:

First:
  • Open HiJackThis
  • Click on Do a system scan only
  • Check the boxes next to ONLY the entries listed below (if still present):

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Act.UI.InternetExplorer.Plugins.AttachFile.CAttachFile - {D5233FCD-D258-4903-89B8-FB1568E7413D} - mscoree.dll (file missing)
O9 - Extra button: Attach Web page to ACT! contact - {6F431AC3-364A-478b-BBDB-89C7CE1B18F6} - mscoree.dll (file missing)
O9 - Extra 'Tools' menuitem: Attach Web page to ACT! contact… - {6F431AC3-364A-478b-BBDB-89C7CE1B18F6} - mscoree.dll (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)


  • Close all windows except Hijackthis and click Fix Checked
  • Click Yes when prompted
  • Close HijackThis.


NEXT

Follow these steps to uninstall Combofix

  • Click START then RUN
  • Now type Combofix /u in the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.

[external image: Posted Image]

NEXT

Download ToolsCleaner2 to your desktop and run it ( by de A.Rothstein & Dj Quiou )
  • Click the Pt. Restauration button and press OK to the prompts.
  • Click the Corbeille button and press OK to the prompt.
  • Click the Fichiers temp button and press OK to the prompt.
  • Click the Recherche button and let it run ( it may look like it freezes but let it continue )
  • Once it is done click the Suppression button and let it remove anything it finds.
  • Close the program


Below I have included a number of recommendations for how to protect your computer against malware infections.
  • Keep Windows updated by regularly checking their website at :
    http://windowsupdate.microsoft.com/
    This will ensure your computer has always the latest security updates available installed on your computer.
  • SpywareBlaster protects against bad ActiveX, it immunizes your PC against them.
  • SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program ( eg : TeaTimer, Windows Defender ) or there will be a conflict.
  • Make Internet Explorer more secure
  • Click Start > Run
  • Type Inetcpl.cpl & click OK
  • Click on the Security tab
  • Click Reset all zones to default level
  • Make sure the Internet Zone is selected & Click Custom level
  • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
  • Next Click OK, then Apply button and then OK to exit the Internet Properties page.
I also recommend using a third party firewall to protect your computer from hackers.
We don't recommend the firewall that comes built in to Windows.
It doesn't block everything that may try to get in, and the entire firewall is written to the registry.
As various kinds of malware hack the Registry in order to disable the Windows firewall, it's far preferable to install one of the excellent third party solutions.
Three excellent free firewalls are:
Comodo
Sunbelt Kerio
Sygate
NOTE: DO NOT install more than one firewall.
Note: If you choose Comodo - Please be careful with the installation of the Comodo program, it comes bundled with an adware toolbar which you need to de-select when you are going through the installation process. It's not a malicious program, but it may be a privacy risk and I don't think you want it on your system.
  • ATF Cleaner - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.
  • MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.
  • For Firefox, I highly recommend these add-ons to keep your PC even more secure.
    • NoScript - for blocking ads and other potential website attacks
    • McAfee SiteAdvisor - this tells you whether the sites you are about to visit are safe or not. A must if you do a lot of Googling
  • Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
  • ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
  • Recovery Console - Recent trends appear to indicate that future infections will include attacks to the boot sector of the computer. The installation of the Recovery Console in the computer will be our only defense against this threat. For more information and steps to install the Recovery Console see This Article. Should you need assistance in installing the Recovery Console, please do not hesitate to ask.
  • Please read the guide by Rorschach112 on how to prevent malware and about safe computing here
Thank you for your patience, and performing all of the procedures requested.
thanks very much for your help! my home comp is having issues, i'll start another thread in a couple of weeks when i return. thanks again, ryan
You are most welcome Stay Safe :wavey: ( Good idea to post a new topic for your home computer - please don't try and run any of the specialized tools we used without the guidance of one of our experts as each fix is specific to the infection on the specific computer being cleaned)
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI