1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Solved Unkown trojan

Discussion in 'Malware and Virus Removal Archive' started by judgmentmonkey, 2008/03/02.

  1. 2008/03/02
    judgmentmonkey

    judgmentmonkey Inactive Thread Starter

    Joined:
    2008/03/02
    Messages:
    11
    Likes Received:
    0
    [Resolved]Unkown trojan

    Hello, I'm trying to fix my friend's computer that is infected with a trojan virus. What has been done: McAffee run and found nothing, ATFclean run, and I just ran hijackthis. Here is the log:


    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 12:37:17 AM, on 3/3/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16608)
    Boot mode: Safe mode with network support

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\system32\drwtsn32.exe
    C:\WINDOWS\system32\drwtsn32.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\aim\aim.exe
    C:\WINDOWS\system32\drwtsn32.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Temporary Directory 2 for HiJackThis[1].zip\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com/avcenter/fix_homepage/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.lavasoft.com/download_and_buy/product_comparison_chart.php
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
    O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
    O2 - BHO: RDL Rolex - {6027FDCA-AE2C-438B-8535-3A96C154F97C} - C:\WINDOWS\dgtxrdfqnt.dll
    O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptcl.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O3 - Toolbar: ekvgsnw - {7EB9F20D-11C7-4D4C-828A-A29F010BD259} - C:\WINDOWS\ekvgsnw.dll
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "
    O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll "
    O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
    O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
    O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [AIM] C:\Program Files\aim\aim.exe -cnetwait.odl
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\shdocvw.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\shdocvw.dll
    O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\aim\aim.exe
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
    O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab
    O16 - DPF: {E72CFC93-BAE3-8D60-85D1-129993AAC8B9} - http://www.perfspot.com/u/UImageUploaderXP.cab
    O21 - SSODL: VolumeRam - {5245e3c7-c2f4-4f0b-896b-23668cb53e64} - C:\WINDOWS\Installer\{5245e3c7-c2f4-4f0b-896b-23668cb53e64}\VolumeRam.dll
    O21 - SSODL: zip - {4dce0459-15cb-4626-95ce-8313833b268e} - C:\WINDOWS\Installer\{4dce0459-15cb-4626-95ce-8313833b268e}\zip.dll
    O21 - SSODL: DriveKernel - {cf6cf1d2-f5f2-4f1c-a531-a57103501c5e} - C:\WINDOWS\Installer\{cf6cf1d2-f5f2-4f1c-a531-a57103501c5e}\DriveKernel.dll
    O21 - SSODL: alofkmn - {B25321AC-7DB7-4EAF-A8DA-A8D381DB8412} - C:\WINDOWS\alofkmn.dll
    O21 - SSODL: bxlrvps - {EBD41B99-6997-41CA-8001-75055C4A9FEB} - C:\WINDOWS\bxlrvps.dll
    O21 - SSODL: RomSrv - {028e21fd-585a-4a08-bdfc-827ad7a0ed99} - C:\WINDOWS\Installer\{028e21fd-585a-4a08-bdfc-827ad7a0ed99}\RomSrv.dll
    O22 - SharedTaskScheduler: benzaldoxime - {a6d478c6-7961-4fe9-be4b-e621dd640112} - (no file)
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
    O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
    O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
    O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe
    O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe
    O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
    O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
    O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

    --
    End of file - 8633 bytes
     
    judgmentmonkey,
    #1
  2. 2008/03/03
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi judgmentmonkey
    Welcome to Windowsbbs. :)

    Please download SmitfraudFix (by S!Ri) to your Desktop.

    You should print out these instructions, or copy them to a NotePad file for reading while in Safe Mode, because you will not be able to connect to the Internet to read from this site.

    Next, please reboot your computer in Safe Mode by doing the following :
    • Restart your computer
    • After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
    • Instead of Windows loading as normal, a menu with options should appear;
    • Select the first option, to run Windows in Safe Mode, then press "Enter ".
    • Choose your usual account.
    Once in Safe Mode, double-click on SmitfraudFix.exe
    Select option #2 - Clean by typing 2 and press "Enter" to delete infected files.

    You will be prompted : "Registry cleaning - Do you want to clean the registry ? "; answer "Yes" by typing Y and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection.

    The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing Y and press "Enter ".

    The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart it into Normal Windows.
    A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report into your next reply.
    The report can also be found at the root of the system drive, usually at C:\rapport.txt

    Warning : running option #2 on a non infected computer will remove your Desktop background.

    Please post the smitfraud log and a new HJT log.

    Thanks
    Geri
     
    Geri,
    #2


  3. to hide this advert.

  4. 2008/03/03
    judgmentmonkey

    judgmentmonkey Inactive Thread Starter

    Joined:
    2008/03/02
    Messages:
    11
    Likes Received:
    0
    Ok here is the smitfraudfix log:

    SmitFraudFix v2.300

    Scan done at 11:22:43.75, Mon 03/03/2008
    Run from C:\Documents and Settings\Administrator\Desktop\SmitfraudFix
    OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
    The filesystem type is NTFS
    Fix run in safe mode

    »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
    !!!Attention, following keys are not inevitably infected!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
    "{a6d478c6-7961-4fe9-be4b-e621dd640112} "= "benzaldoxime "


    »»»»»»»»»»»»»»»»»»»»»»»» Killing process


    »»»»»»»»»»»»»»»»»»»»»»»» hosts


    127.0.0.1 localhost

    »»»»»»»»»»»»»»»»»»»»»»»» VACFix



    »»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

    S!Ri's WS2Fix: LSP not Found.


    »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

    GenericRenosFix by S!Ri


    »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

    C:\WINDOWS\fkxvkns.exe Deleted
    Problem while deleting C:\WINDOWS\privacy_danger
    C:\Program Files\Video Add-on\ Deleted

    »»»»»»»»»»»»»»»»»»»»»»»» IEDFix

    IEDFix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri


    »»»»»»»»»»»»»»»»»»»»»»»» DNS

    HKLM\SYSTEM\CCS\Services\Tcpip\..\{5C3A1105-7377-4D58-AE1A-138F36138CA7}: DhcpNameServer=128.119.100.83 128.119.100.19
    HKLM\SYSTEM\CS1\Services\Tcpip\..\{5C3A1105-7377-4D58-AE1A-138F36138CA7}: DhcpNameServer=128.119.100.83 128.119.100.19
    HKLM\SYSTEM\CS3\Services\Tcpip\..\{5C3A1105-7377-4D58-AE1A-138F36138CA7}: DhcpNameServer=128.119.100.83 128.119.100.19
    HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=128.119.100.83 128.119.100.19
    HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=128.119.100.83 128.119.100.19
    HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=128.119.100.83 128.119.100.19


    »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


    »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
    !!!Attention, following keys are not inevitably infected!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
    "System "=" "


    »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

    Registry Cleaning done.

    »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
    !!!Attention, following keys are not inevitably infected!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll


    »»»»»»»»»»»»»»»»»»»»»»»» End




    And the Hijackthis with deckard's system scanner log:




    Deckard's System Scanner v20071014.68
    Run by Andres Castro on 2008-03-03 11:42:47
    Computer is in Normal Mode.
    --------------------------------------------------------------------------------

    -- System Restore --------------------------------------------------------------

    Successfully created a Deckard's System Scanner Restore Point.


    -- Last 2 Restore Point(s) --
    2: 2008-03-03 16:43:38 UTC - RP2 - Deckard's System Scanner Restore Point
    1: 2008-03-03 03:15:11 UTC - RP1 - System Checkpoint


    Backed up registry hives.
    Performed disk cleanup.

    Total Physical Memory: 504 MiB (512 MiB recommended).


    -- HijackThis (run as Andres Castro.exe) ---------------------------------------

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 11:45:25 AM, on 3/3/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16608)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\Program Files\McAfee\Common Framework\FrameworkService.exe
    C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe
    C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Viewpoint\Common\ViewpointService.exe
    C:\WINDOWS\wanmpsvc.exe
    C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
    C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE
    C:\Program Files\McAfee\Common Framework\UdaterUI.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\McAfee\Common Framework\McTray.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Documents and Settings\Administrator\Desktop\dss.exe
    C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\TEMPOR~2.ZIP\Andres Castro.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.emachines.com/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
    O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
    O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptcl.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O3 - Toolbar: ekvgsnw - {7EB9F20D-11C7-4D4C-828A-A29F010BD259} - C:\WINDOWS\ekvgsnw.dll
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "
    O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll "
    O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
    O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
    O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
    O4 - HKCU\..\Run: [AIM] C:\Program Files\aim\aim.exe -cnetwait.odl
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
    O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
    O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
    O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
    O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\shdocvw.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\shdocvw.dll
    O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\aim\aim.exe
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
    O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab
    O16 - DPF: {E72CFC93-BAE3-8D60-85D1-129993AAC8B9} - http://www.perfspot.com/u/UImageUploaderXP.cab
    O21 - SSODL: VolumeRam - {5245e3c7-c2f4-4f0b-896b-23668cb53e64} - C:\WINDOWS\Installer\{5245e3c7-c2f4-4f0b-896b-23668cb53e64}\VolumeRam.dll
    O21 - SSODL: zip - {4dce0459-15cb-4626-95ce-8313833b268e} - C:\WINDOWS\Installer\{4dce0459-15cb-4626-95ce-8313833b268e}\zip.dll
    O21 - SSODL: DriveKernel - {cf6cf1d2-f5f2-4f1c-a531-a57103501c5e} - C:\WINDOWS\Installer\{cf6cf1d2-f5f2-4f1c-a531-a57103501c5e}\DriveKernel.dll
    O21 - SSODL: alofkmn - {B25321AC-7DB7-4EAF-A8DA-A8D381DB8412} - C:\WINDOWS\alofkmn.dll
    O21 - SSODL: bxlrvps - {EBD41B99-6997-41CA-8001-75055C4A9FEB} - C:\WINDOWS\bxlrvps.dll
    O21 - SSODL: RomSrv - {028e21fd-585a-4a08-bdfc-827ad7a0ed99} - C:\WINDOWS\Installer\{028e21fd-585a-4a08-bdfc-827ad7a0ed99}\RomSrv.dll
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
    O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
    O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
    O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe
    O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe
    O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
    O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
    O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
    O24 - Desktop Component 0: Privacy Protection - file:///C:\WINDOWS\privacy_danger\index.htm

    --
    End of file - 9464 bytes

    -- File Associations -----------------------------------------------------------

    All associations okay.


    -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

    R3 SunkFilt (Alcor Micro Corp - 9360) - c:\windows\system32\drivers\sunkfilt.sys <Not Verified; Alcor Micro Corp.; SunkFilt92>

    S3 SunkFilt39 (Alcor Micro Corp - 3239) - c:\windows\system32\drivers\sunkfilt39.sys <Not Verified; Alcor Micro Corp.; SunkFilt39>
    S3 Sunkfiltp (HP && Alcor Micro Corp for Phison) - c:\windows\system32\drivers\sunkfiltp.sys (file missing)
    S3 usbsermpt (Motorola USB Modem Driver for MPT) - c:\windows\system32\drivers\usbsermpt.sys <Not Verified; Microsoft Corporation; Microsoft(R) Windows (R) 2000 Operating System>


    -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

    R2 Viewpoint Manager Service - "c:\program files\viewpoint\common\viewpointservice.exe" <Not Verified; Viewpoint Corporation; Viewpoint Manager>


    -- Device Manager: Disabled ----------------------------------------------------

    No disabled devices found.


    -- Scheduled Tasks -------------------------------------------------------------

    2008-02-23 00:10:07 580 --a------ C:\WINDOWS\Tasks\Norton Internet Security - Run Full System Scan - Andres Castro.job


    -- Files created between 2008-02-03 and 2008-03-03 -----------------------------

    2008-03-03 11:22:32 86016 --a------ C:\WINDOWS\system32\VACFix.exe <Not Verified; S!Ri.URZ; VACFix>
    2008-03-03 11:22:32 82432 --a------ C:\WINDOWS\system32\IEDFix.exe <Not Verified; S!Ri.URZ; IEDFix>
    2008-03-03 09:56:26 0 d-------- C:\WINDOWS\privacy_danger
    2008-03-03 00:34:57 0 d-------- C:\Program Files\Trend Micro
    2008-03-02 23:51:46 0 d-------- C:\Documents and Settings\Administrator\Application Data\Aim
    2008-03-02 23:37:59 0 d-------- C:\Documents and Settings\Administrator\Application Data\Real
    2008-03-02 23:19:37 0 dr-h----- C:\Documents and Settings\Guest\Application Data\yahoo!
    2008-03-02 23:15:03 0 d-------- C:\Documents and Settings\Guest\Application Data\Real
    2008-03-02 22:57:23 0 d-------- C:\Documents and Settings\Administrator\Application Data\Macromedia
    2008-03-02 18:00:24 0 d-------- C:\QUARANTINE
    2008-03-02 10:36:54 1495552 --a------ C:\WINDOWS\system32\epoPGPsdk.dll <Not Verified; PGP Corporation; PGPsdk>
    2008-03-02 10:36:54 0 d-------- C:\Program Files\Common Files\Cisco Systems
    2008-03-02 10:28:09 0 d-------- C:\Documents and Settings\All Users\Application Data\McAfee
    2008-03-02 10:18:09 0 d-------- C:\Program Files\Common Files\McAfee
    2008-03-02 10:18:08 0 d-------- C:\Program Files\McAfee
    2008-02-29 14:36:54 204800 --a------ C:\WINDOWS\ekvgsnw.dll
    2008-02-29 14:36:54 339968 --a------ C:\WINDOWS\bxlrvps.dll
    2008-02-29 14:36:54 200704 --a------ C:\WINDOWS\alofkmn.dll <Not Verified; ; alofkmn>
    2008-02-11 17:57:35 0 d-------- C:\Program Files\Common Files\SWF Studio
    2008-02-11 17:57:23 0 d-------- C:\Program Files\GQ Daily Style Tip Widget


    -- Find3M Report ---------------------------------------------------------------

    2008-03-03 11:44:46 0 d-------- C:\Program Files\Common Files\Symantec Shared
    2008-03-03 11:22:55 2230 --a------ C:\WINDOWS\system32\tmp.reg
    2008-03-02 22:42:47 0 d-------- C:\Program Files\MySpace
    2008-03-02 10:36:54 0 d-------- C:\Program Files\Common Files
    2008-03-01 11:43:20 0 d-------- C:\Program Files\Symantec
    2008-02-26 14:02:32 0 d-------- C:\Documents and Settings\Andres Castro\Application Data\U3
    2007-12-09 16:12:08 1323 --a------ C:\WINDOWS\nsreg.dat


    -- Registry Dump ---------------------------------------------------------------

    *Note* empty entries & legit default entries are not shown


    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Adobe Reader Speed Launcher "= "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [10/10/2007 07:51 PM]
    "Symantec PIF AlertEng "= "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [11/28/2007 07:51 PM]
    "ShStatEXE "= "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.exe" [02/22/2007 08:50 PM]
    "McAfeeUpdaterUI "= "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" [12/19/2006 11:27 AM]
    "MSConfig "= "C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [08/04/2004 02:56 AM]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "AIM "= "C:\Program Files\aim\aim.exe" [08/01/2006 02:35 PM]
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 02:56 AM]
    "AdobeUpdater "= "C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [03/01/2007 09:37 AM]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
    "DisableRegistryTools "=0 (0x0)
    "DisableTaskMgr "=1 (0x1)

    [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
    Source= file:///C:\WINDOWS\privacy_danger\index.htm
    FriendlyName= Privacy Protection

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
    "VolumeRam "= {5245e3c7-c2f4-4f0b-896b-23668cb53e64} - C:\WINDOWS\Installer\{5245e3c7-c2f4-4f0b-896b-23668cb53e64}\VolumeRam.dll [02/29/2008 02:36 PM 18698]
    "zip "= {4dce0459-15cb-4626-95ce-8313833b268e} - C:\WINDOWS\Installer\{4dce0459-15cb-4626-95ce-8313833b268e}\zip.dll [02/29/2008 02:54 PM 22826]
    "DriveKernel "= {cf6cf1d2-f5f2-4f1c-a531-a57103501c5e} - C:\WINDOWS\Installer\{cf6cf1d2-f5f2-4f1c-a531-a57103501c5e}\DriveKernel.dll [02/29/2008 02:37 PM 18510]
    "alofkmn "= {B25321AC-7DB7-4EAF-A8DA-A8D381DB8412} - C:\WINDOWS\alofkmn.dll [02/29/2008 12:58 PM 200704]
    "bxlrvps "= {EBD41B99-6997-41CA-8001-75055C4A9FEB} - C:\WINDOWS\bxlrvps.dll [02/29/2008 12:58 PM 339968]
    "RomSrv "= {028e21fd-585a-4a08-bdfc-827ad7a0ed99} - C:\WINDOWS\Installer\{028e21fd-585a-4a08-bdfc-827ad7a0ed99}\RomSrv.dll [02/29/2008 02:54 PM 18522]

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
    SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, xlibgfl254.dll

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
    @= "Service "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
    @= "Service "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
    @= "Volume shadow copy "

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech Desktop Messenger.lnk]
    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk
    backup=C:\WINDOWS\pss\Logitech Desktop Messenger.lnkCommon Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
    backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Andres Castro^Start Menu^Programs^Startup^GQ Daily Style Tip Widget.lnk]
    path=C:\Documents and Settings\Andres Castro\Start Menu\Programs\Startup\GQ Daily Style Tip Widget.lnk
    backup=C:\WINDOWS\pss\GQ Daily Style Tip Widget.lnkStartup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Andres Castro^Start Menu^Programs^Startup^HOTLLAMA Update Check.lnk]
    path=C:\Documents and Settings\Andres Castro\Start Menu\Programs\Startup\HOTLLAMA Update Check.lnk
    backup=C:\WINDOWS\pss\HOTLLAMA Update Check.lnkStartup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\!AVG Anti-Spyware]
    "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
    "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\antiviirus]
    C:\Program Files\antiviirus.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CHotkey]
    zHotkey.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
    C:\WINDOWS\system32\ctfmon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
    C:\Program Files\Common Files\AOL\1156461920\ee\AOLSoftware.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMC]
    C:\Program Files\FriendFinder\FriendFinder Messenger 40\imc.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IPHSend]
    C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LDM]
    C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechSoftwareUpdate]
    "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoRepair]
    C:\Program Files\Logitech\Video\ISStart.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoTray]
    C:\Program Files\Logitech\Video\LogiTray.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
    "C:\Program Files\MSN Messenger\msnmsgr.exe" /background

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM]
    C:\Program Files\MySpace\IM\MySpaceIM.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\osCheck]
    "C:\Program Files\Norton Internet Security\osCheck.exe "

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    "C:\Program Files\QuickTime\qttask.exe" -atboottime

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
    C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
    "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe "

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunKistEM]
    C:\Program Files\eMachines Bay Reader\shwiconem.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
    "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WatchDog]
    C:\Program Files\mobile PhoneTools\WatchDog.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
    "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "AVG Anti-Spyware Guard "=2 (0x2)

    *Newly Created Service* - COMHOST



    -- End of Deckard's System Scanner: finished at 2008-03-03 11:46:30 ------------
     
    judgmentmonkey,
    #3
  5. 2008/03/04
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi

    Download ComboFix from [color= "Red"]Here[/color] to your Desktop.
    It's best to disable realtime protection applications as they sometimes interfere with the tool. Check this link for any applicable programs you may have.
    • Close all open programs and windows
    • Double click combofix.exe and follow the prompts.
    • Vista users right click Combofix.exe and select Run As Administrator.
    • When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply
    Note: Do not mouseclick combofix's window while its running. That may cause it to stall

    Please post the combofix log.

    Thanks
    Geri
     
    Geri,
    #4
  6. 2008/03/04
    judgmentmonkey

    judgmentmonkey Inactive Thread Starter

    Joined:
    2008/03/02
    Messages:
    11
    Likes Received:
    0
    combofix:

    ComboFix 08-03-04.3 - Andres Castro 2008-03-04 13:39:42.1 - NTFSx86
    Running from: C:\Documents and Settings\Andres Castro\Desktop\ComboFix.exe

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Documents and Settings\Andres Castro\Application Data\ultra
    C:\Documents and Settings\Andres Castro\Application Data\ultra\uninstall.bat
    C:\Documents and Settings\Andres Castro\Desktop\Error Cleaner.url
    C:\Documents and Settings\Andres Castro\Desktop\Privacy Protector.url
    C:\Documents and Settings\Andres Castro\Desktop\Spyware&Malware Protection.url
    C:\Documents and Settings\Andres Castro\Favorites\Error Cleaner.url
    C:\Documents and Settings\Andres Castro\Favorites\Privacy Protector.url
    C:\Documents and Settings\Andres Castro\Favorites\Spyware&Malware Protection.url
    C:\Program Files\Common Files\Yazzle1549OinUninstaller.exe
    C:\Program Files\poolsv
    C:\Program Files\web buying
    C:\WINDOWS\bxlrvps.dll
    C:\WINDOWS\ekvgsnw.dll
    C:\WINDOWS\inf\ultra.inf
    C:\WINDOWS\privacy_danger
    C:\WINDOWS\privacy_danger\images\capt.gif
    C:\WINDOWS\privacy_danger\images\danger.jpg
    C:\WINDOWS\privacy_danger\images\down.gif
    C:\WINDOWS\privacy_danger\images\spacer.gif
    C:\WINDOWS\privacy_danger\index.htm
    C:\WINDOWS\system32\_000046_.tmp.dll
    C:\WINDOWS\system32\B0
    C:\WINDOWS\system32\B1
    C:\WINDOWS\system32\b10FdUe
    C:\WINDOWS\system32\B2
    C:\WINDOWS\system32\B3
    C:\WINDOWS\system32\B4
    C:\WINDOWS\system32\B5
    C:\WINDOWS\system32\driver
    C:\WINDOWS\wr.txt

    .
    ((((((((((((((((((((((((( Files Created from 2008-02-04 to 2008-03-04 )))))))))))))))))))))))))))))))
    .

    2008-03-03 17:20 . 2008-03-03 17:20 <DIR> d-------- C:\Documents and Settings\Guest\Application Data\Aim
    2008-03-03 11:22 . 2008-03-01 23:12 86,016 --a------ C:\WINDOWS\system32\VACFix.exe
    2008-03-03 11:22 . 2008-02-29 23:48 82,432 --a------ C:\WINDOWS\system32\IEDFix.exe
    2008-03-03 00:47 . 2008-03-03 00:47 <DIR> d-------- C:\Deckard
    2008-03-03 00:34 . 2008-03-03 00:34 <DIR> d-------- C:\Program Files\Trend Micro
    2008-03-02 23:51 . 2008-03-02 23:51 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Aim
    2008-03-02 23:19 . 2008-03-04 01:49 <DIR> dr-h----- C:\Documents and Settings\Guest\Application Data\yahoo!
    2008-03-02 18:00 . 2008-03-04 13:09 <DIR> d-------- C:\QUARANTINE
    2008-03-02 10:36 . 2008-03-02 10:36 <DIR> d-------- C:\Program Files\Common Files\Cisco Systems
    2008-03-02 10:36 . 2006-12-19 15:06 1,495,552 --a------ C:\WINDOWS\system32\epoPGPsdk.dll
    2008-03-02 10:36 . 2006-12-19 15:06 280 --a------ C:\WINDOWS\system32\epoPGPsdk.dll.sig
    2008-03-02 10:28 . 2008-03-02 10:41 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\McAfee
    2008-03-02 10:27 . 2007-02-22 20:50 170,408 --a------ C:\WINDOWS\system32\drivers\mfehidk.sys
    2008-03-02 10:27 . 2006-11-30 08:50 72,264 --a------ C:\WINDOWS\system32\drivers\mfeavfk.sys
    2008-03-02 10:27 . 2006-11-30 08:50 64,360 --a------ C:\WINDOWS\system32\drivers\mfeapfk.sys
    2008-03-02 10:27 . 2006-11-30 08:50 52,136 --a------ C:\WINDOWS\system32\drivers\mfetdik.sys
    2008-03-02 10:27 . 2006-11-30 08:50 34,152 --a------ C:\WINDOWS\system32\drivers\mfebopk.sys
    2008-03-02 10:18 . 2008-03-02 10:28 <DIR> d-------- C:\Program Files\McAfee
    2008-03-02 10:18 . 2008-03-02 10:18 <DIR> d-------- C:\Program Files\Common Files\McAfee
    2008-02-29 14:35 . 2008-02-29 14:35 54,156 --ah----- C:\WINDOWS\QTFont.qfn
    2008-02-29 14:35 . 2008-02-29 14:35 1,409 --a------ C:\WINDOWS\QTFont.for
    2008-02-11 17:57 . 2008-02-11 17:57 <DIR> d-------- C:\Program Files\GQ Daily Style Tip Widget
    2008-02-11 17:57 . 2008-02-11 17:57 <DIR> d-------- C:\Program Files\Common Files\SWF Studio

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-03-03 21:58 --------- d-----w C:\Program Files\Common Files\Symantec Shared
    2008-03-03 03:42 --------- d-----w C:\Program Files\MySpace
    2008-03-01 16:43 805 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
    2008-03-01 16:43 60,800 ----a-w C:\WINDOWS\system32\S32EVNT1.DLL
    2008-03-01 16:43 123,952 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
    2008-03-01 16:43 10,740 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
    2008-03-01 16:43 --------- d-----w C:\Program Files\Symantec
    2008-02-26 19:02 --------- d-----w C:\Documents and Settings\Andres Castro\Application Data\U3
    2008-02-01 05:42 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
    2008-01-15 14:54 10,537 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.cat
    2008-01-15 10:28 706 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.inf
    2008-01-12 23:32 23,904 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.sys
    2007-12-07 02:21 824,832 ----a-w C:\WINDOWS\system32\wininet.dll
    2007-12-04 18:38 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
    2007-03-09 07:50 30,440 ----a-w C:\Documents and Settings\Andres Castro\Application Data\GDIPFONTCACHEV1.DAT
    2006-11-14 15:03 92,064 ----a-w C:\Documents and Settings\Andres Castro\mqdmmdm.sys
    2006-11-14 15:03 9,232 ----a-w C:\Documents and Settings\Andres Castro\mqdmmdfl.sys
    2006-11-14 15:03 79,328 ----a-w C:\Documents and Settings\Andres Castro\mqdmserd.sys
    2006-11-14 15:03 66,656 ----a-w C:\Documents and Settings\Andres Castro\mqdmbus.sys
    2006-11-14 15:03 6,208 ----a-w C:\Documents and Settings\Andres Castro\mqdmcmnt.sys
    2006-11-14 15:03 5,936 ----a-w C:\Documents and Settings\Andres Castro\mqdmwhnt.sys
    2006-11-14 15:03 4,048 ----a-w C:\Documents and Settings\Andres Castro\mqdmcr.sys
    2006-11-14 15:03 25,600 ----a-w C:\Documents and Settings\Andres Castro\usbsermptxp.sys
    2006-11-14 15:03 22,768 ----a-w C:\Documents and Settings\Andres Castro\usbsermpt.sys
    2007-07-13 00:05 1,938,612 --sha-w C:\WINDOWS\system32\qqstv.bak1
    2007-07-14 01:51 1,949,624 --sha-w C:\WINDOWS\system32\qqstv.bak2
    2007-07-14 23:47 1,940,994 --sha-w C:\WINDOWS\system32\qqstv.ini2
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "AIM "= "C:\Program Files\aim\aim.exe" [2006-08-01 14:35 67112]
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56 15360]
    "AdobeUpdater "= "C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-03-01 09:37 2321600]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Adobe Reader Speed Launcher "= "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
    "Symantec PIF AlertEng "= "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-11-28 19:51 583048]
    "ShStatEXE "= "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.exe" [2007-02-22 20:50 112216]
    "McAfeeUpdaterUI "= "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" [2006-12-19 11:27 136768]

    [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
    Source= file:///C:\WINDOWS\privacy_danger\index.htm
    FriendlyName= Privacy Protection

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
    "VolumeRam "= {5245e3c7-c2f4-4f0b-896b-23668cb53e64} - C:\WINDOWS\Installer\{5245e3c7-c2f4-4f0b-896b-23668cb53e64}\VolumeRam.dll [2008-02-29 14:36 18698]
    "zip "= {4dce0459-15cb-4626-95ce-8313833b268e} - C:\WINDOWS\Installer\{4dce0459-15cb-4626-95ce-8313833b268e}\zip.dll [2008-02-29 14:54 22826]
    "DriveKernel "= {cf6cf1d2-f5f2-4f1c-a531-a57103501c5e} - C:\WINDOWS\Installer\{cf6cf1d2-f5f2-4f1c-a531-a57103501c5e}\DriveKernel.dll [2008-02-29 14:37 18510]
    "RomSrv "= {028e21fd-585a-4a08-bdfc-827ad7a0ed99} - C:\WINDOWS\Installer\{028e21fd-585a-4a08-bdfc-827ad7a0ed99}\RomSrv.dll [2008-02-29 14:54 18522]

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech Desktop Messenger.lnk]
    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk
    backup=C:\WINDOWS\pss\Logitech Desktop Messenger.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
    backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^Andres Castro^Start Menu^Programs^Startup^GQ Daily Style Tip Widget.lnk]
    path=C:\Documents and Settings\Andres Castro\Start Menu\Programs\Startup\GQ Daily Style Tip Widget.lnk
    backup=C:\WINDOWS\pss\GQ Daily Style Tip Widget.lnkStartup

    [HKLM\~\startupfolder\C:^Documents and Settings^Andres Castro^Start Menu^Programs^Startup^HOTLLAMA Update Check.lnk]
    path=C:\Documents and Settings\Andres Castro\Start Menu\Programs\Startup\HOTLLAMA Update Check.lnk
    backup=C:\WINDOWS\pss\HOTLLAMA Update Check.lnkStartup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\!AVG Anti-Spyware]
    --a------ 2007-06-11 04:25 6731312 C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
    --a------ 2007-10-10 19:51 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\antiviirus]
    C:\Program Files\antiviirus.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
    --a------ 2007-01-09 21:59 115816 C:\Program Files\Common Files\Symantec Shared\ccApp.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CHotkey]
    --a------ 2003-06-03 13:01 496640 C:\WINDOWS\zHotkey.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
    --a------ 2004-08-04 02:56 15360 C:\WINDOWS\system32\ctfmon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
    --a------ 2006-04-20 12:10 50792 C:\Program Files\Common Files\AOL\1156461920\ee\AOLSoftware.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMC]
    --a------ 2007-11-01 11:16 2704640 C:\Program Files\FriendFinder\FriendFinder Messenger 40\imc.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IPHSend]
    --a------ 2006-02-17 11:59 124520 C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LDM]
    --a------ 2006-12-28 13:16 20480 C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechSoftwareUpdate]
    --------- 2004-06-01 05:46 196608 C:\Program Files\Logitech\Video\ManifestEngine.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoRepair]
    --------- 2004-06-01 11:09 458752 C:\Program Files\Logitech\Video\ISStart.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoTray]
    --------- 2004-06-01 11:03 217088 C:\Program Files\Logitech\Video\LogiTray.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
    --a------ 2007-01-19 11:54 5674352 C:\Program Files\MSN Messenger\msnmsgr.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM]
    C:\Program Files\MySpace\IM\MySpaceIM.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\osCheck]
    --a------ 2006-09-05 20:22 26248 C:\Program Files\Norton Internet Security\osCheck.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    --a------ 2004-05-12 05:15 77824 C:\Program Files\QuickTime\qttask.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
    --a------ 2007-12-09 16:11 214560 C:\Program Files\Real\RealPlayer\RealPlay.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
    --a------ 2003-10-31 21:42 32768 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunKistEM]
    --a------ 2004-03-11 17:18 135168 C:\Program Files\eMachines Bay Reader\shwiconem.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
    --a------ 2007-12-09 16:11 185896 C:\Program Files\Common Files\Real\Update_OB\realsched.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WatchDog]
    --------- 2004-08-14 05:42 36864 C:\Program Files\mobile PhoneTools\WatchDog.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
    --a------ 2007-01-19 12:49 4670968 C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "AVG Anti-Spyware Guard "=2 (0x2)

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusDisableNotify "=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring "=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring "=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring "=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall "= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe "=
    "C:\\Program Files\\aim\\aim.exe "=
    "C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe "=
    "C:\\Program Files\\Common Files\\AOL\\1156461920\\ee\\aolsoftware.exe "=
    "C:\\Program Files\\Common Files\\AOL\\1156461920\\ee\\aim6.exe "=
    "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe "=
    "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe "=
    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe "=
    "C:\\Program Files\\MSN Messenger\\livecall.exe "=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe "=

    R2 Viewpoint Manager Service;Viewpoint Manager Service; "C:\Program Files\Viewpoint\Common\ViewpointService.exe" [2007-01-04 16:38]
    S3 PhilCam8116_XP;Logitech QuickCam Pro 3000(PID_08B1);C:\WINDOWS\system32\DRIVERS\CamDrL20.sys [2004-05-21 14:16]

    *Newly Created Service* - COMHOST
    .
    Contents of the 'Scheduled Tasks' folder
    "2008-02-23 05:10:07 C:\WINDOWS\Tasks\Norton Internet Security - Run Full System Scan - Andres Castro.job "
    - C:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exeh/TASK:
    .
    **************************************************************************

    catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-03-04 13:44:34
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-03-04 13:57:50
    ComboFix-quarantined-files.txt 2008-03-04 18:57:45
    .
    2008-02-13 08:03:32 --- E O F ---





    HJT:



    Deckard's System Scanner v20071014.68
    Run by Andres Castro on 2008-03-04 14:25:19
    Computer is in Normal Mode.
    --------------------------------------------------------------------------------

    Total Physical Memory: 504 MiB (512 MiB recommended).


    -- HijackThis (run as Andres Castro.exe) ---------------------------------------

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 2:25:34 PM, on 3/4/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16608)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\Program Files\McAfee\Common Framework\FrameworkService.exe
    C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe
    C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Viewpoint\Common\ViewpointService.exe
    C:\WINDOWS\wanmpsvc.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
    C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE
    C:\Program Files\McAfee\Common Framework\UdaterUI.exe
    C:\Program Files\McAfee\Common Framework\McTray.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Documents and Settings\Administrator\Desktop\dss.exe
    C:\PROGRA~1\TRENDM~1\HIJACK~1\Andres Castro.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.emachines.com/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
    O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
    O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptcl.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "
    O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll "
    O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
    O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
    O4 - HKCU\..\Run: [AIM] C:\Program Files\aim\aim.exe -cnetwait.odl
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
    O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
    O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
    O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
    O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\shdocvw.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\shdocvw.dll
    O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\aim\aim.exe
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
    O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab
    O16 - DPF: {E72CFC93-BAE3-8D60-85D1-129993AAC8B9} - http://www.perfspot.com/u/UImageUploaderXP.cab
    O21 - SSODL: VolumeRam - {5245e3c7-c2f4-4f0b-896b-23668cb53e64} - C:\WINDOWS\Installer\{5245e3c7-c2f4-4f0b-896b-23668cb53e64}\VolumeRam.dll
    O21 - SSODL: zip - {4dce0459-15cb-4626-95ce-8313833b268e} - C:\WINDOWS\Installer\{4dce0459-15cb-4626-95ce-8313833b268e}\zip.dll
    O21 - SSODL: DriveKernel - {cf6cf1d2-f5f2-4f1c-a531-a57103501c5e} - C:\WINDOWS\Installer\{cf6cf1d2-f5f2-4f1c-a531-a57103501c5e}\DriveKernel.dll
    O21 - SSODL: RomSrv - {028e21fd-585a-4a08-bdfc-827ad7a0ed99} - C:\WINDOWS\Installer\{028e21fd-585a-4a08-bdfc-827ad7a0ed99}\RomSrv.dll
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
    O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
    O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
    O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe
    O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe
    O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
    O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
    O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
    O24 - Desktop Component 0: Privacy Protection - file:///C:\WINDOWS\privacy_danger\index.htm

    --
    End of file - 9235 bytes

    -- Files created between 2008-02-04 and 2008-03-04 -----------------------------

    2008-03-04 13:28:00 68096 --a------ C:\WINDOWS\system32\zip.exe
    2008-03-04 13:27:30 80412 --a------ C:\WINDOWS\system32\grep.exe
    2008-03-04 13:27:22 98816 --a------ C:\WINDOWS\system32\sed.exe
    2008-03-04 13:27:19 73728 --a------ C:\WINDOWS\system32\fdsv.exe <Not Verified; Smallfrogs Studio; >
    2008-03-03 17:21:04 0 d-------- C:\Documents and Settings\Guest\Application Data\Macromedia
    2008-03-03 17:20:10 0 d-------- C:\Documents and Settings\Guest\Application Data\Aim
    2008-03-03 17:19:12 0 d-------- C:\Documents and Settings\Guest\Application Data\Mozilla
    2008-03-03 16:52:41 0 d-------- C:\Documents and Settings\Andres Castro\Application Data\Mozilla
    2008-03-03 11:22:32 86016 --a------ C:\WINDOWS\system32\VACFix.exe <Not Verified; S!Ri.URZ; VACFix>
    2008-03-03 11:22:32 82432 --a------ C:\WINDOWS\system32\IEDFix.exe <Not Verified; S!Ri.URZ; IEDFix>
    2008-03-03 00:34:57 0 d-------- C:\Program Files\Trend Micro
    2008-03-02 23:51:46 0 d-------- C:\Documents and Settings\Administrator\Application Data\Aim
    2008-03-02 23:37:59 0 d-------- C:\Documents and Settings\Administrator\Application Data\Real
    2008-03-02 23:19:37 0 dr-h----- C:\Documents and Settings\Guest\Application Data\yahoo!
    2008-03-02 23:15:03 0 d-------- C:\Documents and Settings\Guest\Application Data\Real
    2008-03-02 22:57:23 0 d-------- C:\Documents and Settings\Administrator\Application Data\Macromedia
    2008-03-02 18:00:24 0 d-------- C:\QUARANTINE
    2008-03-02 10:36:54 1495552 --a------ C:\WINDOWS\system32\epoPGPsdk.dll <Not Verified; PGP Corporation; PGPsdk>
    2008-03-02 10:36:54 0 d-------- C:\Program Files\Common Files\Cisco Systems
    2008-03-02 10:28:09 0 d-------- C:\Documents and Settings\All Users\Application Data\McAfee
    2008-03-02 10:18:09 0 d-------- C:\Program Files\Common Files\McAfee
    2008-03-02 10:18:08 0 d-------- C:\Program Files\McAfee
    2008-02-11 17:57:35 0 d-------- C:\Program Files\Common Files\SWF Studio
    2008-02-11 17:57:23 0 d-------- C:\Program Files\GQ Daily Style Tip Widget


    -- Find3M Report ---------------------------------------------------------------

    2008-03-04 13:44:06 0 d-------- C:\Program Files\Common Files
    2008-03-03 16:58:21 0 d-------- C:\Program Files\Common Files\Symantec Shared
    2008-03-03 11:22:55 2230 --a------ C:\WINDOWS\system32\tmp.reg
    2008-03-02 22:42:47 0 d-------- C:\Program Files\MySpace
    2008-03-01 11:43:20 0 d-------- C:\Program Files\Symantec
    2008-02-26 14:02:32 0 d-------- C:\Documents and Settings\Andres Castro\Application Data\U3
    2007-12-09 16:12:08 1323 --a------ C:\WINDOWS\nsreg.dat


    -- Registry Dump ---------------------------------------------------------------

    *Note* empty entries & legit default entries are not shown


    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Adobe Reader Speed Launcher "= "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [10/10/2007 07:51 PM]
    "Symantec PIF AlertEng "= "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [11/28/2007 07:51 PM]
    "ShStatEXE "= "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.exe" [02/22/2007 08:50 PM]
    "McAfeeUpdaterUI "= "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" [12/19/2006 11:27 AM]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "AIM "= "C:\Program Files\aim\aim.exe" [08/01/2006 02:35 PM]
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 02:56 AM]
    "AdobeUpdater "= "C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [03/01/2007 09:37 AM]

    [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
    Source= file:///C:\WINDOWS\privacy_danger\index.htm
    FriendlyName= Privacy Protection

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
    "VolumeRam "= {5245e3c7-c2f4-4f0b-896b-23668cb53e64} - C:\WINDOWS\Installer\{5245e3c7-c2f4-4f0b-896b-23668cb53e64}\VolumeRam.dll [02/29/2008 02:36 PM 18698]
    "zip "= {4dce0459-15cb-4626-95ce-8313833b268e} - C:\WINDOWS\Installer\{4dce0459-15cb-4626-95ce-8313833b268e}\zip.dll [02/29/2008 02:54 PM 22826]
    "DriveKernel "= {cf6cf1d2-f5f2-4f1c-a531-a57103501c5e} - C:\WINDOWS\Installer\{cf6cf1d2-f5f2-4f1c-a531-a57103501c5e}\DriveKernel.dll [02/29/2008 02:37 PM 18510]
    "RomSrv "= {028e21fd-585a-4a08-bdfc-827ad7a0ed99} - C:\WINDOWS\Installer\{028e21fd-585a-4a08-bdfc-827ad7a0ed99}\RomSrv.dll [02/29/2008 02:54 PM 18522]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
    @= "Service "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
    @= "Service "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
    @= "Volume shadow copy "

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech Desktop Messenger.lnk]
    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk
    backup=C:\WINDOWS\pss\Logitech Desktop Messenger.lnkCommon Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
    backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Andres Castro^Start Menu^Programs^Startup^GQ Daily Style Tip Widget.lnk]
    path=C:\Documents and Settings\Andres Castro\Start Menu\Programs\Startup\GQ Daily Style Tip Widget.lnk
    backup=C:\WINDOWS\pss\GQ Daily Style Tip Widget.lnkStartup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Andres Castro^Start Menu^Programs^Startup^HOTLLAMA Update Check.lnk]
    path=C:\Documents and Settings\Andres Castro\Start Menu\Programs\Startup\HOTLLAMA Update Check.lnk
    backup=C:\WINDOWS\pss\HOTLLAMA Update Check.lnkStartup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\!AVG Anti-Spyware]
    "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
    "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\antiviirus]
    C:\Program Files\antiviirus.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CHotkey]
    zHotkey.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
    C:\WINDOWS\system32\ctfmon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
    C:\Program Files\Common Files\AOL\1156461920\ee\AOLSoftware.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMC]
    C:\Program Files\FriendFinder\FriendFinder Messenger 40\imc.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IPHSend]
    C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LDM]
    C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechSoftwareUpdate]
    "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoRepair]
    C:\Program Files\Logitech\Video\ISStart.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoTray]
    C:\Program Files\Logitech\Video\LogiTray.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
    "C:\Program Files\MSN Messenger\msnmsgr.exe" /background

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM]
    C:\Program Files\MySpace\IM\MySpaceIM.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\osCheck]
    "C:\Program Files\Norton Internet Security\osCheck.exe "

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    "C:\Program Files\QuickTime\qttask.exe" -atboottime

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
    C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
    "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe "

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunKistEM]
    C:\Program Files\eMachines Bay Reader\shwiconem.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
    "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WatchDog]
    C:\Program Files\mobile PhoneTools\WatchDog.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
    "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "AVG Anti-Spyware Guard "=2 (0x2)

    *Newly Created Service* - COMHOST



    -- End of Deckard's System Scanner: finished at 2008-03-04 14:26:13 ------------




    Thanks
     
    judgmentmonkey,
    #5
  7. 2008/03/04
    judgmentmonkey

    judgmentmonkey Inactive Thread Starter

    Joined:
    2008/03/02
    Messages:
    11
    Likes Received:
    0
    The pop ups do seem to be fewer... but now a window keeps coming up that says "cannot find 'file:///C:/WINDOWS/privacy_danger/index.htm'. Make sure the path or internet address is correct" after running the combofix.

    EDIT: I thought I had already posted the logs, but it looks like they did not show up or I was not logged in...

    Combofix:

    ComboFix 08-03-04.3 - Andres Castro 2008-03-04 13:39:42.1 - NTFSx86
    Running from: C:\Documents and Settings\Andres Castro\Desktop\ComboFix.exe

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Documents and Settings\Andres Castro\Application Data\ultra
    C:\Documents and Settings\Andres Castro\Application Data\ultra\uninstall.bat
    C:\Documents and Settings\Andres Castro\Desktop\Error Cleaner.url
    C:\Documents and Settings\Andres Castro\Desktop\Privacy Protector.url
    C:\Documents and Settings\Andres Castro\Desktop\Spyware&Malware Protection.url
    C:\Documents and Settings\Andres Castro\Favorites\Error Cleaner.url
    C:\Documents and Settings\Andres Castro\Favorites\Privacy Protector.url
    C:\Documents and Settings\Andres Castro\Favorites\Spyware&Malware Protection.url
    C:\Program Files\Common Files\Yazzle1549OinUninstaller.exe
    C:\Program Files\poolsv
    C:\Program Files\web buying
    C:\WINDOWS\bxlrvps.dll
    C:\WINDOWS\ekvgsnw.dll
    C:\WINDOWS\inf\ultra.inf
    C:\WINDOWS\privacy_danger
    C:\WINDOWS\privacy_danger\images\capt.gif
    C:\WINDOWS\privacy_danger\images\danger.jpg
    C:\WINDOWS\privacy_danger\images\down.gif
    C:\WINDOWS\privacy_danger\images\spacer.gif
    C:\WINDOWS\privacy_danger\index.htm
    C:\WINDOWS\system32\_000046_.tmp.dll
    C:\WINDOWS\system32\B0
    C:\WINDOWS\system32\B1
    C:\WINDOWS\system32\b10FdUe
    C:\WINDOWS\system32\B2
    C:\WINDOWS\system32\B3
    C:\WINDOWS\system32\B4
    C:\WINDOWS\system32\B5
    C:\WINDOWS\system32\driver
    C:\WINDOWS\wr.txt

    .
    ((((((((((((((((((((((((( Files Created from 2008-02-04 to 2008-03-04 )))))))))))))))))))))))))))))))
    .

    2008-03-03 17:20 . 2008-03-03 17:20 <DIR> d-------- C:\Documents and Settings\Guest\Application Data\Aim
    2008-03-03 11:22 . 2008-03-01 23:12 86,016 --a------ C:\WINDOWS\system32\VACFix.exe
    2008-03-03 11:22 . 2008-02-29 23:48 82,432 --a------ C:\WINDOWS\system32\IEDFix.exe
    2008-03-03 00:47 . 2008-03-03 00:47 <DIR> d-------- C:\Deckard
    2008-03-03 00:34 . 2008-03-03 00:34 <DIR> d-------- C:\Program Files\Trend Micro
    2008-03-02 23:51 . 2008-03-02 23:51 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Aim
    2008-03-02 23:19 . 2008-03-04 01:49 <DIR> dr-h----- C:\Documents and Settings\Guest\Application Data\yahoo!
    2008-03-02 18:00 . 2008-03-04 13:09 <DIR> d-------- C:\QUARANTINE
    2008-03-02 10:36 . 2008-03-02 10:36 <DIR> d-------- C:\Program Files\Common Files\Cisco Systems
    2008-03-02 10:36 . 2006-12-19 15:06 1,495,552 --a------ C:\WINDOWS\system32\epoPGPsdk.dll
    2008-03-02 10:36 . 2006-12-19 15:06 280 --a------ C:\WINDOWS\system32\epoPGPsdk.dll.sig
    2008-03-02 10:28 . 2008-03-02 10:41 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\McAfee
    2008-03-02 10:27 . 2007-02-22 20:50 170,408 --a------ C:\WINDOWS\system32\drivers\mfehidk.sys
    2008-03-02 10:27 . 2006-11-30 08:50 72,264 --a------ C:\WINDOWS\system32\drivers\mfeavfk.sys
    2008-03-02 10:27 . 2006-11-30 08:50 64,360 --a------ C:\WINDOWS\system32\drivers\mfeapfk.sys
    2008-03-02 10:27 . 2006-11-30 08:50 52,136 --a------ C:\WINDOWS\system32\drivers\mfetdik.sys
    2008-03-02 10:27 . 2006-11-30 08:50 34,152 --a------ C:\WINDOWS\system32\drivers\mfebopk.sys
    2008-03-02 10:18 . 2008-03-02 10:28 <DIR> d-------- C:\Program Files\McAfee
    2008-03-02 10:18 . 2008-03-02 10:18 <DIR> d-------- C:\Program Files\Common Files\McAfee
    2008-02-29 14:35 . 2008-02-29 14:35 54,156 --ah----- C:\WINDOWS\QTFont.qfn
    2008-02-29 14:35 . 2008-02-29 14:35 1,409 --a------ C:\WINDOWS\QTFont.for
    2008-02-11 17:57 . 2008-02-11 17:57 <DIR> d-------- C:\Program Files\GQ Daily Style Tip Widget
    2008-02-11 17:57 . 2008-02-11 17:57 <DIR> d-------- C:\Program Files\Common Files\SWF Studio

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-03-03 21:58 --------- d-----w C:\Program Files\Common Files\Symantec Shared
    2008-03-03 03:42 --------- d-----w C:\Program Files\MySpace
    2008-03-01 16:43 805 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
    2008-03-01 16:43 60,800 ----a-w C:\WINDOWS\system32\S32EVNT1.DLL
    2008-03-01 16:43 123,952 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
    2008-03-01 16:43 10,740 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
    2008-03-01 16:43 --------- d-----w C:\Program Files\Symantec
    2008-02-26 19:02 --------- d-----w C:\Documents and Settings\Andres Castro\Application Data\U3
    2008-02-01 05:42 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
    2008-01-15 14:54 10,537 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.cat
    2008-01-15 10:28 706 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.inf
    2008-01-12 23:32 23,904 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.sys
    2007-12-07 02:21 824,832 ----a-w C:\WINDOWS\system32\wininet.dll
    2007-12-04 18:38 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
    2007-03-09 07:50 30,440 ----a-w C:\Documents and Settings\Andres Castro\Application Data\GDIPFONTCACHEV1.DAT
    2006-11-14 15:03 92,064 ----a-w C:\Documents and Settings\Andres Castro\mqdmmdm.sys
    2006-11-14 15:03 9,232 ----a-w C:\Documents and Settings\Andres Castro\mqdmmdfl.sys
    2006-11-14 15:03 79,328 ----a-w C:\Documents and Settings\Andres Castro\mqdmserd.sys
    2006-11-14 15:03 66,656 ----a-w C:\Documents and Settings\Andres Castro\mqdmbus.sys
    2006-11-14 15:03 6,208 ----a-w C:\Documents and Settings\Andres Castro\mqdmcmnt.sys
    2006-11-14 15:03 5,936 ----a-w C:\Documents and Settings\Andres Castro\mqdmwhnt.sys
    2006-11-14 15:03 4,048 ----a-w C:\Documents and Settings\Andres Castro\mqdmcr.sys
    2006-11-14 15:03 25,600 ----a-w C:\Documents and Settings\Andres Castro\usbsermptxp.sys
    2006-11-14 15:03 22,768 ----a-w C:\Documents and Settings\Andres Castro\usbsermpt.sys
    2007-07-13 00:05 1,938,612 --sha-w C:\WINDOWS\system32\qqstv.bak1
    2007-07-14 01:51 1,949,624 --sha-w C:\WINDOWS\system32\qqstv.bak2
    2007-07-14 23:47 1,940,994 --sha-w C:\WINDOWS\system32\qqstv.ini2
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "AIM "= "C:\Program Files\aim\aim.exe" [2006-08-01 14:35 67112]
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56 15360]
    "AdobeUpdater "= "C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-03-01 09:37 2321600]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Adobe Reader Speed Launcher "= "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
    "Symantec PIF AlertEng "= "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-11-28 19:51 583048]
    "ShStatEXE "= "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.exe" [2007-02-22 20:50 112216]
    "McAfeeUpdaterUI "= "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" [2006-12-19 11:27 136768]

    [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
    Source= file:///C:\WINDOWS\privacy_danger\index.htm
    FriendlyName= Privacy Protection

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
    "VolumeRam "= {5245e3c7-c2f4-4f0b-896b-23668cb53e64} - C:\WINDOWS\Installer\{5245e3c7-c2f4-4f0b-896b-23668cb53e64}\VolumeRam.dll [2008-02-29 14:36 18698]
    "zip "= {4dce0459-15cb-4626-95ce-8313833b268e} - C:\WINDOWS\Installer\{4dce0459-15cb-4626-95ce-8313833b268e}\zip.dll [2008-02-29 14:54 22826]
    "DriveKernel "= {cf6cf1d2-f5f2-4f1c-a531-a57103501c5e} - C:\WINDOWS\Installer\{cf6cf1d2-f5f2-4f1c-a531-a57103501c5e}\DriveKernel.dll [2008-02-29 14:37 18510]
    "RomSrv "= {028e21fd-585a-4a08-bdfc-827ad7a0ed99} - C:\WINDOWS\Installer\{028e21fd-585a-4a08-bdfc-827ad7a0ed99}\RomSrv.dll [2008-02-29 14:54 18522]

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech Desktop Messenger.lnk]
    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk
    backup=C:\WINDOWS\pss\Logitech Desktop Messenger.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
    backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^Andres Castro^Start Menu^Programs^Startup^GQ Daily Style Tip Widget.lnk]
    path=C:\Documents and Settings\Andres Castro\Start Menu\Programs\Startup\GQ Daily Style Tip Widget.lnk
    backup=C:\WINDOWS\pss\GQ Daily Style Tip Widget.lnkStartup

    [HKLM\~\startupfolder\C:^Documents and Settings^Andres Castro^Start Menu^Programs^Startup^HOTLLAMA Update Check.lnk]
    path=C:\Documents and Settings\Andres Castro\Start Menu\Programs\Startup\HOTLLAMA Update Check.lnk
    backup=C:\WINDOWS\pss\HOTLLAMA Update Check.lnkStartup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\!AVG Anti-Spyware]
    --a------ 2007-06-11 04:25 6731312 C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
    --a------ 2007-10-10 19:51 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\antiviirus]
    C:\Program Files\antiviirus.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
    --a------ 2007-01-09 21:59 115816 C:\Program Files\Common Files\Symantec Shared\ccApp.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CHotkey]
    --a------ 2003-06-03 13:01 496640 C:\WINDOWS\zHotkey.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
    --a------ 2004-08-04 02:56 15360 C:\WINDOWS\system32\ctfmon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
    --a------ 2006-04-20 12:10 50792 C:\Program Files\Common Files\AOL\1156461920\ee\AOLSoftware.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMC]
    --a------ 2007-11-01 11:16 2704640 C:\Program Files\FriendFinder\FriendFinder Messenger 40\imc.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IPHSend]
    --a------ 2006-02-17 11:59 124520 C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LDM]
    --a------ 2006-12-28 13:16 20480 C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechSoftwareUpdate]
    --------- 2004-06-01 05:46 196608 C:\Program Files\Logitech\Video\ManifestEngine.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoRepair]
    --------- 2004-06-01 11:09 458752 C:\Program Files\Logitech\Video\ISStart.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoTray]
    --------- 2004-06-01 11:03 217088 C:\Program Files\Logitech\Video\LogiTray.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
    --a------ 2007-01-19 11:54 5674352 C:\Program Files\MSN Messenger\msnmsgr.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM]
    C:\Program Files\MySpace\IM\MySpaceIM.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\osCheck]
    --a------ 2006-09-05 20:22 26248 C:\Program Files\Norton Internet Security\osCheck.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    --a------ 2004-05-12 05:15 77824 C:\Program Files\QuickTime\qttask.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
    --a------ 2007-12-09 16:11 214560 C:\Program Files\Real\RealPlayer\RealPlay.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
    --a------ 2003-10-31 21:42 32768 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunKistEM]
    --a------ 2004-03-11 17:18 135168 C:\Program Files\eMachines Bay Reader\shwiconem.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
    --a------ 2007-12-09 16:11 185896 C:\Program Files\Common Files\Real\Update_OB\realsched.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WatchDog]
    --------- 2004-08-14 05:42 36864 C:\Program Files\mobile PhoneTools\WatchDog.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
    --a------ 2007-01-19 12:49 4670968 C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "AVG Anti-Spyware Guard "=2 (0x2)

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusDisableNotify "=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring "=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring "=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring "=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall "= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe "=
    "C:\\Program Files\\aim\\aim.exe "=
    "C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe "=
    "C:\\Program Files\\Common Files\\AOL\\1156461920\\ee\\aolsoftware.exe "=
    "C:\\Program Files\\Common Files\\AOL\\1156461920\\ee\\aim6.exe "=
    "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe "=
    "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe "=
    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe "=
    "C:\\Program Files\\MSN Messenger\\livecall.exe "=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe "=

    R2 Viewpoint Manager Service;Viewpoint Manager Service; "C:\Program Files\Viewpoint\Common\ViewpointService.exe" [2007-01-04 16:38]
    S3 PhilCam8116_XP;Logitech QuickCam Pro 3000(PID_08B1);C:\WINDOWS\system32\DRIVERS\CamDrL20.sys [2004-05-21 14:16]

    *Newly Created Service* - COMHOST
    .
    Contents of the 'Scheduled Tasks' folder
    "2008-02-23 05:10:07 C:\WINDOWS\Tasks\Norton Internet Security - Run Full System Scan - Andres Castro.job "
    - C:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exeh/TASK:
    .
    **************************************************************************

    catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-03-04 13:44:34
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-03-04 13:57:50
    ComboFix-quarantined-files.txt 2008-03-04 18:57:45
    .
    2008-02-13 08:03:32 --- E O F ---



    HJT:


    Deckard's System Scanner v20071014.68
    Run by Andres Castro on 2008-03-04 14:25:19
    Computer is in Normal Mode.
    --------------------------------------------------------------------------------

    Total Physical Memory: 504 MiB (512 MiB recommended).


    -- HijackThis (run as Andres Castro.exe) ---------------------------------------

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 2:25:34 PM, on 3/4/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16608)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\Program Files\McAfee\Common Framework\FrameworkService.exe
    C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe
    C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Viewpoint\Common\ViewpointService.exe
    C:\WINDOWS\wanmpsvc.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
    C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE
    C:\Program Files\McAfee\Common Framework\UdaterUI.exe
    C:\Program Files\McAfee\Common Framework\McTray.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Documents and Settings\Administrator\Desktop\dss.exe
    C:\PROGRA~1\TRENDM~1\HIJACK~1\Andres Castro.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.emachines.com/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
    O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
    O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptcl.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "
    O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll "
    O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
    O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
    O4 - HKCU\..\Run: [AIM] C:\Program Files\aim\aim.exe -cnetwait.odl
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
    O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
    O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
    O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
    O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\shdocvw.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\shdocvw.dll
    O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\aim\aim.exe
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
    O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab
    O16 - DPF: {E72CFC93-BAE3-8D60-85D1-129993AAC8B9} - http://www.perfspot.com/u/UImageUploaderXP.cab
    O21 - SSODL: VolumeRam - {5245e3c7-c2f4-4f0b-896b-23668cb53e64} - C:\WINDOWS\Installer\{5245e3c7-c2f4-4f0b-896b-23668cb53e64}\VolumeRam.dll
    O21 - SSODL: zip - {4dce0459-15cb-4626-95ce-8313833b268e} - C:\WINDOWS\Installer\{4dce0459-15cb-4626-95ce-8313833b268e}\zip.dll
    O21 - SSODL: DriveKernel - {cf6cf1d2-f5f2-4f1c-a531-a57103501c5e} - C:\WINDOWS\Installer\{cf6cf1d2-f5f2-4f1c-a531-a57103501c5e}\DriveKernel.dll
    O21 - SSODL: RomSrv - {028e21fd-585a-4a08-bdfc-827ad7a0ed99} - C:\WINDOWS\Installer\{028e21fd-585a-4a08-bdfc-827ad7a0ed99}\RomSrv.dll
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
    O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
    O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
    O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe
    O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe
    O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
    O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
    O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
    O24 - Desktop Component 0: Privacy Protection - file:///C:\WINDOWS\privacy_danger\index.htm

    --
    End of file - 9235 bytes

    -- Files created between 2008-02-04 and 2008-03-04 -----------------------------

    2008-03-04 13:28:00 68096 --a------ C:\WINDOWS\system32\zip.exe
    2008-03-04 13:27:30 80412 --a------ C:\WINDOWS\system32\grep.exe
    2008-03-04 13:27:22 98816 --a------ C:\WINDOWS\system32\sed.exe
    2008-03-04 13:27:19 73728 --a------ C:\WINDOWS\system32\fdsv.exe <Not Verified; Smallfrogs Studio; >
    2008-03-03 17:21:04 0 d-------- C:\Documents and Settings\Guest\Application Data\Macromedia
    2008-03-03 17:20:10 0 d-------- C:\Documents and Settings\Guest\Application Data\Aim
    2008-03-03 17:19:12 0 d-------- C:\Documents and Settings\Guest\Application Data\Mozilla
    2008-03-03 16:52:41 0 d-------- C:\Documents and Settings\Andres Castro\Application Data\Mozilla
    2008-03-03 11:22:32 86016 --a------ C:\WINDOWS\system32\VACFix.exe <Not Verified; S!Ri.URZ; VACFix>
    2008-03-03 11:22:32 82432 --a------ C:\WINDOWS\system32\IEDFix.exe <Not Verified; S!Ri.URZ; IEDFix>
    2008-03-03 00:34:57 0 d-------- C:\Program Files\Trend Micro
    2008-03-02 23:51:46 0 d-------- C:\Documents and Settings\Administrator\Application Data\Aim
    2008-03-02 23:37:59 0 d-------- C:\Documents and Settings\Administrator\Application Data\Real
    2008-03-02 23:19:37 0 dr-h----- C:\Documents and Settings\Guest\Application Data\yahoo!
    2008-03-02 23:15:03 0 d-------- C:\Documents and Settings\Guest\Application Data\Real
    2008-03-02 22:57:23 0 d-------- C:\Documents and Settings\Administrator\Application Data\Macromedia
    2008-03-02 18:00:24 0 d-------- C:\QUARANTINE
    2008-03-02 10:36:54 1495552 --a------ C:\WINDOWS\system32\epoPGPsdk.dll <Not Verified; PGP Corporation; PGPsdk>
    2008-03-02 10:36:54 0 d-------- C:\Program Files\Common Files\Cisco Systems
    2008-03-02 10:28:09 0 d-------- C:\Documents and Settings\All Users\Application Data\McAfee
    2008-03-02 10:18:09 0 d-------- C:\Program Files\Common Files\McAfee
    2008-03-02 10:18:08 0 d-------- C:\Program Files\McAfee
    2008-02-11 17:57:35 0 d-------- C:\Program Files\Common Files\SWF Studio
    2008-02-11 17:57:23 0 d-------- C:\Program Files\GQ Daily Style Tip Widget


    -- Find3M Report ---------------------------------------------------------------

    2008-03-04 13:44:06 0 d-------- C:\Program Files\Common Files
    2008-03-03 16:58:21 0 d-------- C:\Program Files\Common Files\Symantec Shared
    2008-03-03 11:22:55 2230 --a------ C:\WINDOWS\system32\tmp.reg
    2008-03-02 22:42:47 0 d-------- C:\Program Files\MySpace
    2008-03-01 11:43:20 0 d-------- C:\Program Files\Symantec
    2008-02-26 14:02:32 0 d-------- C:\Documents and Settings\Andres Castro\Application Data\U3
    2007-12-09 16:12:08 1323 --a------ C:\WINDOWS\nsreg.dat


    -- Registry Dump ---------------------------------------------------------------

    *Note* empty entries & legit default entries are not shown


    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Adobe Reader Speed Launcher "= "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [10/10/2007 07:51 PM]
    "Symantec PIF AlertEng "= "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [11/28/2007 07:51 PM]
    "ShStatEXE "= "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.exe" [02/22/2007 08:50 PM]
    "McAfeeUpdaterUI "= "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" [12/19/2006 11:27 AM]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "AIM "= "C:\Program Files\aim\aim.exe" [08/01/2006 02:35 PM]
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 02:56 AM]
    "AdobeUpdater "= "C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [03/01/2007 09:37 AM]

    [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
    Source= file:///C:\WINDOWS\privacy_danger\index.htm
    FriendlyName= Privacy Protection

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
    "VolumeRam "= {5245e3c7-c2f4-4f0b-896b-23668cb53e64} - C:\WINDOWS\Installer\{5245e3c7-c2f4-4f0b-896b-23668cb53e64}\VolumeRam.dll [02/29/2008 02:36 PM 18698]
    "zip "= {4dce0459-15cb-4626-95ce-8313833b268e} - C:\WINDOWS\Installer\{4dce0459-15cb-4626-95ce-8313833b268e}\zip.dll [02/29/2008 02:54 PM 22826]
    "DriveKernel "= {cf6cf1d2-f5f2-4f1c-a531-a57103501c5e} - C:\WINDOWS\Installer\{cf6cf1d2-f5f2-4f1c-a531-a57103501c5e}\DriveKernel.dll [02/29/2008 02:37 PM 18510]
    "RomSrv "= {028e21fd-585a-4a08-bdfc-827ad7a0ed99} - C:\WINDOWS\Installer\{028e21fd-585a-4a08-bdfc-827ad7a0ed99}\RomSrv.dll [02/29/2008 02:54 PM 18522]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
    @= "Service "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
    @= "Service "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
    @= "Volume shadow copy "

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech Desktop Messenger.lnk]
    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk
    backup=C:\WINDOWS\pss\Logitech Desktop Messenger.lnkCommon Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
    backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Andres Castro^Start Menu^Programs^Startup^GQ Daily Style Tip Widget.lnk]
    path=C:\Documents and Settings\Andres Castro\Start Menu\Programs\Startup\GQ Daily Style Tip Widget.lnk
    backup=C:\WINDOWS\pss\GQ Daily Style Tip Widget.lnkStartup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Andres Castro^Start Menu^Programs^Startup^HOTLLAMA Update Check.lnk]
    path=C:\Documents and Settings\Andres Castro\Start Menu\Programs\Startup\HOTLLAMA Update Check.lnk
    backup=C:\WINDOWS\pss\HOTLLAMA Update Check.lnkStartup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\!AVG Anti-Spyware]
    "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
    "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\antiviirus]
    C:\Program Files\antiviirus.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CHotkey]
    zHotkey.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
    C:\WINDOWS\system32\ctfmon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
    C:\Program Files\Common Files\AOL\1156461920\ee\AOLSoftware.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMC]
    C:\Program Files\FriendFinder\FriendFinder Messenger 40\imc.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IPHSend]
    C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LDM]
    C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechSoftwareUpdate]
    "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoRepair]
    C:\Program Files\Logitech\Video\ISStart.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoTray]
    C:\Program Files\Logitech\Video\LogiTray.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
    "C:\Program Files\MSN Messenger\msnmsgr.exe" /background

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM]
    C:\Program Files\MySpace\IM\MySpaceIM.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\osCheck]
    "C:\Program Files\Norton Internet Security\osCheck.exe "

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    "C:\Program Files\QuickTime\qttask.exe" -atboottime

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
    C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
    "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe "

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunKistEM]
    C:\Program Files\eMachines Bay Reader\shwiconem.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
    "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WatchDog]
    C:\Program Files\mobile PhoneTools\WatchDog.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
    "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "AVG Anti-Spyware Guard "=2 (0x2)

    *Newly Created Service* - COMHOST



    -- End of Deckard's System Scanner: finished at 2008-03-04 14:26:13 ------------
     
    Last edited: 2008/03/04
    judgmentmonkey,
    #6
  8. 2008/03/04
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi judgmentmonkey

    Please do the following.

    Highlight and copy the contents of the code box below and paste it into a blank notepad, then save it to your desktop as;

    Filename: CFScript.txt
    Save As Type: All Files (*.*)

    Close all other windows and programs. Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button.
    Click here to see how to use CFScript.txt
    Combofix should run and may reboot the computer when it's done. A log will open when it's complete. Post the contents of that log and another fresh HijackThis log.

    Please do not click on the ComboFix window while it is running a scan. This can cause it to stall.

    Code:
    File::
C:\WINDOWS\QTFont.qfn
C:\WINDOWS\QTFont.for
C:\WINDOWS\system32\qqstv.bak1
C:\WINDOWS\system32\qqstv.bak2
C:\WINDOWS\system32\qqstv.ini2
C:\Program Files\antiviirus.exe

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\antiviirus]
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
 "Source "=- 
 "FriendlyName "=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
 "VolumeRam "=-
 "zip "=-
 "DriveKernel "=-
 "RomSrv "=-
    Please post the new CFScript log, and a new HJT log.

    Let me know if you still get the "cannot find file" pop up and if the pop-ups have stopped.

    Thanks
     
    Geri,
    #7
  9. 2008/03/05
    judgmentmonkey

    judgmentmonkey Inactive Thread Starter

    Joined:
    2008/03/02
    Messages:
    11
    Likes Received:
    0
    Everything seems to be working normal again... Ok here's the results:

    ComboFix 08-03-04.3 - Andres Castro 2008-03-05 13:55:34.2 - NTFSx86
    Running from: C:\Documents and Settings\Andres Castro\Desktop\ComboFix.exe
    Command switches used :: C:\Documents and Settings\Andres Castro\Desktop\CFScript.txt
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

    FILE ::
    C:\Program Files\antiviirus.exe
    C:\WINDOWS\QTFont.for
    C:\WINDOWS\QTFont.qfn
    C:\WINDOWS\system32\qqstv.bak1
    C:\WINDOWS\system32\qqstv.bak2
    C:\WINDOWS\system32\qqstv.ini2
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\WINDOWS\QTFont.for
    C:\WINDOWS\QTFont.qfn
    C:\WINDOWS\system32\qqstv.bak1
    C:\WINDOWS\system32\qqstv.bak2
    C:\WINDOWS\system32\qqstv.ini2

    .
    ((((((((((((((((((((((((( Files Created from 2008-02-05 to 2008-03-05 )))))))))))))))))))))))))))))))
    .

    2008-03-03 17:20 . 2008-03-03 17:20 <DIR> d-------- C:\Documents and Settings\Guest\Application Data\Aim
    2008-03-03 11:22 . 2008-03-01 23:12 86,016 --a------ C:\WINDOWS\system32\VACFix.exe
    2008-03-03 11:22 . 2008-02-29 23:48 82,432 --a------ C:\WINDOWS\system32\IEDFix.exe
    2008-03-03 00:47 . 2008-03-03 00:47 <DIR> d-------- C:\Deckard
    2008-03-03 00:34 . 2008-03-03 00:34 <DIR> d-------- C:\Program Files\Trend Micro
    2008-03-02 23:51 . 2008-03-02 23:51 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Aim
    2008-03-02 23:19 . 2008-03-04 01:49 <DIR> dr-h----- C:\Documents and Settings\Guest\Application Data\yahoo!
    2008-03-02 18:00 . 2008-03-05 13:54 <DIR> d-------- C:\QUARANTINE
    2008-03-02 10:36 . 2008-03-02 10:36 <DIR> d-------- C:\Program Files\Common Files\Cisco Systems
    2008-03-02 10:36 . 2006-12-19 15:06 1,495,552 --a------ C:\WINDOWS\system32\epoPGPsdk.dll
    2008-03-02 10:36 . 2006-12-19 15:06 280 --a------ C:\WINDOWS\system32\epoPGPsdk.dll.sig
    2008-03-02 10:28 . 2008-03-02 10:41 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\McAfee
    2008-03-02 10:27 . 2007-02-22 20:50 170,408 --a------ C:\WINDOWS\system32\drivers\mfehidk.sys
    2008-03-02 10:27 . 2006-11-30 08:50 72,264 --a------ C:\WINDOWS\system32\drivers\mfeavfk.sys
    2008-03-02 10:27 . 2006-11-30 08:50 64,360 --a------ C:\WINDOWS\system32\drivers\mfeapfk.sys
    2008-03-02 10:27 . 2006-11-30 08:50 52,136 --a------ C:\WINDOWS\system32\drivers\mfetdik.sys
    2008-03-02 10:27 . 2006-11-30 08:50 34,152 --a------ C:\WINDOWS\system32\drivers\mfebopk.sys
    2008-03-02 10:18 . 2008-03-02 10:28 <DIR> d-------- C:\Program Files\McAfee
    2008-03-02 10:18 . 2008-03-02 10:18 <DIR> d-------- C:\Program Files\Common Files\McAfee
    2008-02-11 17:57 . 2008-02-11 17:57 <DIR> d-------- C:\Program Files\GQ Daily Style Tip Widget
    2008-02-11 17:57 . 2008-02-11 17:57 <DIR> d-------- C:\Program Files\Common Files\SWF Studio

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-03-03 21:58 --------- d-----w C:\Program Files\Common Files\Symantec Shared
    2008-03-03 03:42 --------- d-----w C:\Program Files\MySpace
    2008-03-01 16:43 805 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
    2008-03-01 16:43 60,800 ----a-w C:\WINDOWS\system32\S32EVNT1.DLL
    2008-03-01 16:43 123,952 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
    2008-03-01 16:43 10,740 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
    2008-03-01 16:43 --------- d-----w C:\Program Files\Symantec
    2008-02-26 19:02 --------- d-----w C:\Documents and Settings\Andres Castro\Application Data\U3
    2008-02-01 05:42 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
    2008-01-15 14:54 10,537 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.cat
    2008-01-15 10:28 706 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.inf
    2008-01-12 23:32 23,904 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.sys
    2007-12-07 02:21 824,832 ----a-w C:\WINDOWS\system32\wininet.dll
    2007-03-09 07:50 30,440 ----a-w C:\Documents and Settings\Andres Castro\Application Data\GDIPFONTCACHEV1.DAT
    2006-11-14 15:03 92,064 ----a-w C:\Documents and Settings\Andres Castro\mqdmmdm.sys
    2006-11-14 15:03 9,232 ----a-w C:\Documents and Settings\Andres Castro\mqdmmdfl.sys
    2006-11-14 15:03 79,328 ----a-w C:\Documents and Settings\Andres Castro\mqdmserd.sys
    2006-11-14 15:03 66,656 ----a-w C:\Documents and Settings\Andres Castro\mqdmbus.sys
    2006-11-14 15:03 6,208 ----a-w C:\Documents and Settings\Andres Castro\mqdmcmnt.sys
    2006-11-14 15:03 5,936 ----a-w C:\Documents and Settings\Andres Castro\mqdmwhnt.sys
    2006-11-14 15:03 4,048 ----a-w C:\Documents and Settings\Andres Castro\mqdmcr.sys
    2006-11-14 15:03 25,600 ----a-w C:\Documents and Settings\Andres Castro\usbsermptxp.sys
    2006-11-14 15:03 22,768 ----a-w C:\Documents and Settings\Andres Castro\usbsermpt.sys
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "AIM "= "C:\Program Files\aim\aim.exe" [2006-08-01 14:35 67112]
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56 15360]
    "AdobeUpdater "= "C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-03-01 09:37 2321600]
    "Yahoo! Pager "= "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-01-19 12:49 4670968]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Adobe Reader Speed Launcher "= "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
    "Symantec PIF AlertEng "= "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-11-28 19:51 583048]
    "ShStatEXE "= "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.exe" [2007-02-22 20:50 112216]
    "McAfeeUpdaterUI "= "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" [2006-12-19 11:27 136768]

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech Desktop Messenger.lnk]
    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk
    backup=C:\WINDOWS\pss\Logitech Desktop Messenger.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
    backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^Andres Castro^Start Menu^Programs^Startup^GQ Daily Style Tip Widget.lnk]
    path=C:\Documents and Settings\Andres Castro\Start Menu\Programs\Startup\GQ Daily Style Tip Widget.lnk
    backup=C:\WINDOWS\pss\GQ Daily Style Tip Widget.lnkStartup

    [HKLM\~\startupfolder\C:^Documents and Settings^Andres Castro^Start Menu^Programs^Startup^HOTLLAMA Update Check.lnk]
    path=C:\Documents and Settings\Andres Castro\Start Menu\Programs\Startup\HOTLLAMA Update Check.lnk
    backup=C:\WINDOWS\pss\HOTLLAMA Update Check.lnkStartup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\!AVG Anti-Spyware]
    --a------ 2007-06-11 04:25 6731312 C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
    --a------ 2007-10-10 19:51 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
    --a------ 2007-01-09 21:59 115816 C:\Program Files\Common Files\Symantec Shared\ccApp.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CHotkey]
    --a------ 2003-06-03 13:01 496640 C:\WINDOWS\zHotkey.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
    --a------ 2004-08-04 02:56 15360 C:\WINDOWS\system32\ctfmon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
    --a------ 2006-04-20 12:10 50792 C:\Program Files\Common Files\AOL\1156461920\ee\AOLSoftware.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMC]
    --a------ 2007-11-01 11:16 2704640 C:\Program Files\FriendFinder\FriendFinder Messenger 40\imc.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IPHSend]
    --a------ 2006-02-17 11:59 124520 C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LDM]
    --a------ 2006-12-28 13:16 20480 C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechSoftwareUpdate]
    --------- 2004-06-01 05:46 196608 C:\Program Files\Logitech\Video\ManifestEngine.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoRepair]
    --------- 2004-06-01 11:09 458752 C:\Program Files\Logitech\Video\ISStart.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoTray]
    --------- 2004-06-01 11:03 217088 C:\Program Files\Logitech\Video\LogiTray.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
    --a------ 2007-01-19 11:54 5674352 C:\Program Files\MSN Messenger\msnmsgr.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM]
    C:\Program Files\MySpace\IM\MySpaceIM.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\osCheck]
    --a------ 2006-09-05 20:22 26248 C:\Program Files\Norton Internet Security\osCheck.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    --a------ 2004-05-12 05:15 77824 C:\Program Files\QuickTime\qttask.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
    --a------ 2007-12-09 16:11 214560 C:\Program Files\Real\RealPlayer\RealPlay.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
    --a------ 2003-10-31 21:42 32768 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunKistEM]
    --a------ 2004-03-11 17:18 135168 C:\Program Files\eMachines Bay Reader\shwiconem.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
    --a------ 2007-12-09 16:11 185896 C:\Program Files\Common Files\Real\Update_OB\realsched.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WatchDog]
    --------- 2004-08-14 05:42 36864 C:\Program Files\mobile PhoneTools\WatchDog.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
    --a------ 2007-01-19 12:49 4670968 C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "AVG Anti-Spyware Guard "=2 (0x2)

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusDisableNotify "=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring "=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring "=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring "=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall "= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe "=
    "C:\\Program Files\\aim\\aim.exe "=
    "C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe "=
    "C:\\Program Files\\Common Files\\AOL\\1156461920\\ee\\aolsoftware.exe "=
    "C:\\Program Files\\Common Files\\AOL\\1156461920\\ee\\aim6.exe "=
    "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe "=
    "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe "=
    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe "=
    "C:\\Program Files\\MSN Messenger\\livecall.exe "=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe "=

    R2 Viewpoint Manager Service;Viewpoint Manager Service; "C:\Program Files\Viewpoint\Common\ViewpointService.exe" [2007-01-04 16:38]
    S3 PhilCam8116_XP;Logitech QuickCam Pro 3000(PID_08B1);C:\WINDOWS\system32\DRIVERS\CamDrL20.sys [2004-05-21 14:16]

    *Newly Created Service* - COMHOST
    .
    Contents of the 'Scheduled Tasks' folder
    "2008-02-23 05:10:07 C:\WINDOWS\Tasks\Norton Internet Security - Run Full System Scan - Andres Castro.job "
    - C:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exeh/TASK:
    .
    **************************************************************************

    catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-03-05 14:02:53
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-03-05 14:18:36
    ComboFix-quarantined-files.txt 2008-03-05 19:18:32
    ComboFix2.txt 2008-03-04 18:57:51
    .
    2008-02-13 08:03:32 --- E O F ---


    HJT:


    Deckard's System Scanner v20071014.68
    Run by Andres Castro on 2008-03-05 16:00:48
    Computer is in Normal Mode.
    --------------------------------------------------------------------------------

    Percentage of Memory in Use: 82% (more than 75%).
    Total Physical Memory: 504 MiB (512 MiB recommended).


    -- HijackThis (run as Andres Castro.exe) ---------------------------------------

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 4:00:56 PM, on 3/5/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16608)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\Program Files\McAfee\Common Framework\FrameworkService.exe
    C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe
    C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Viewpoint\Common\ViewpointService.exe
    C:\WINDOWS\wanmpsvc.exe
    C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
    C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE
    C:\Program Files\McAfee\Common Framework\UdaterUI.exe
    C:\Program Files\aim\aim.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\McAfee\Common Framework\McTray.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
    C:\WINDOWS\explorer.exe
    C:\WINDOWS\system32\notepad.exe
    C:\Documents and Settings\Administrator\Desktop\dss.exe
    C:\PROGRA~1\TRENDM~1\HIJACK~1\ANDRES~1.EXE

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.emachines.com/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
    O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
    O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptcl.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "
    O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll "
    O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
    O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
    O4 - HKCU\..\Run: [AIM] C:\Program Files\aim\aim.exe -cnetwait.odl
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
    O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
    O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
    O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
    O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\shdocvw.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\shdocvw.dll
    O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\aim\aim.exe
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
    O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab
    O16 - DPF: {E72CFC93-BAE3-8D60-85D1-129993AAC8B9} - http://www.perfspot.com/u/UImageUploaderXP.cab
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
    O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
    O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
    O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe
    O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe
    O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
    O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
    O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
    O24 - Desktop Component 0: (no name) - (no file)

    --
    End of file - 8833 bytes

    -- Files created between 2008-02-05 and 2008-03-05 -----------------------------

    2008-03-04 13:28:00 68096 --a------ C:\WINDOWS\system32\zip.exe
    2008-03-04 13:27:30 80412 --a------ C:\WINDOWS\system32\grep.exe
    2008-03-04 13:27:22 98816 --a------ C:\WINDOWS\system32\sed.exe
    2008-03-04 13:27:19 73728 --a------ C:\WINDOWS\system32\fdsv.exe <Not Verified; Smallfrogs Studio; >
    2008-03-03 17:21:04 0 d-------- C:\Documents and Settings\Guest\Application Data\Macromedia
    2008-03-03 17:20:10 0 d-------- C:\Documents and Settings\Guest\Application Data\Aim
    2008-03-03 17:19:12 0 d-------- C:\Documents and Settings\Guest\Application Data\Mozilla
    2008-03-03 16:52:41 0 d-------- C:\Documents and Settings\Andres Castro\Application Data\Mozilla
    2008-03-03 11:22:32 86016 --a------ C:\WINDOWS\system32\VACFix.exe <Not Verified; S!Ri.URZ; VACFix>
    2008-03-03 11:22:32 82432 --a------ C:\WINDOWS\system32\IEDFix.exe <Not Verified; S!Ri.URZ; IEDFix>
    2008-03-03 00:34:57 0 d-------- C:\Program Files\Trend Micro
    2008-03-02 23:51:46 0 d-------- C:\Documents and Settings\Administrator\Application Data\Aim
    2008-03-02 23:37:59 0 d-------- C:\Documents and Settings\Administrator\Application Data\Real
    2008-03-02 23:19:37 0 dr-h----- C:\Documents and Settings\Guest\Application Data\yahoo!
    2008-03-02 23:15:03 0 d-------- C:\Documents and Settings\Guest\Application Data\Real
    2008-03-02 22:57:23 0 d-------- C:\Documents and Settings\Administrator\Application Data\Macromedia
    2008-03-02 18:00:24 0 d-------- C:\QUARANTINE
    2008-03-02 10:36:54 1495552 --a------ C:\WINDOWS\system32\epoPGPsdk.dll <Not Verified; PGP Corporation; PGPsdk>
    2008-03-02 10:36:54 0 d-------- C:\Program Files\Common Files\Cisco Systems
    2008-03-02 10:28:09 0 d-------- C:\Documents and Settings\All Users\Application Data\McAfee
    2008-03-02 10:18:09 0 d-------- C:\Program Files\Common Files\McAfee
    2008-03-02 10:18:08 0 d-------- C:\Program Files\McAfee
    2008-02-11 17:57:35 0 d-------- C:\Program Files\Common Files\SWF Studio
    2008-02-11 17:57:23 0 d-------- C:\Program Files\GQ Daily Style Tip Widget


    -- Find3M Report ---------------------------------------------------------------

    2008-03-04 13:44:06 0 d-------- C:\Program Files\Common Files
    2008-03-03 16:58:21 0 d-------- C:\Program Files\Common Files\Symantec Shared
    2008-03-03 11:22:55 2230 --a------ C:\WINDOWS\system32\tmp.reg
    2008-03-02 22:42:47 0 d-------- C:\Program Files\MySpace
    2008-03-01 11:43:20 0 d-------- C:\Program Files\Symantec
    2008-02-26 14:02:32 0 d-------- C:\Documents and Settings\Andres Castro\Application Data\U3
    2007-12-09 16:12:08 1323 --a------ C:\WINDOWS\nsreg.dat


    -- Registry Dump ---------------------------------------------------------------

    Unable to run batchfile; The system cannot find the file specified.
    ComSpec: C:\WINDOWS\system32\CF25737.exe


    -- End of Deckard's System Scanner: finished at 2008-03-05 16:01:07 ------------



    So far no pop ups, I'll reboot and see how things go.
     
    judgmentmonkey,
    #8
  10. 2008/03/05
    judgmentmonkey

    judgmentmonkey Inactive Thread Starter

    Joined:
    2008/03/02
    Messages:
    11
    Likes Received:
    0
    No more pop ups, no more cannot find file, everything seems back to normal. However, the last time I restarted, it showed the "program not responding" box with explorer before it ended the task. I know explorer is pretty vital, so i thought that was curious. Also, how does one go about getting their background back if I am indeed clean?
     
    judgmentmonkey,
    #9
  11. 2008/03/05
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi judgmentmonkey
    Let me know if that keeps happening, may have been just a one time thing.

    Right click your desktop, choose properties, under the desktop tab click the "Customize desktop" button under the Web tab remove all the pages entries from there except the "My Current Home Page" and OK your way out.

    Please do this.

    Please re-open HiJackThis and scan only. Check the boxes next to all the entries listed below.

    O24 - Desktop Component 0: (no name) - (no file)

    Now close all windows other than HiJackThis, then click Fix Checked.

    Close HJT.


    Please download ATF Cleaner by Atribune.
    This program is for XP and Windows 2000 only

    • Double-click ATF-Cleaner.exe to run the program.
      Under Main choose: Select All
      Click the Empty Selected button.
    If you use Firefox browser
    • Click Firefox at the top and choose: Select All
      Click the Empty Selected button.
      NOTE: If you would like to keep your saved passwords, please click No at the prompt.
    If you use Opera browser
    • Click Opera at the top and choose: Select All
      Click the Empty Selected button.
      NOTE: If you would like to keep your saved passwords, please click No at the prompt.
    Click Exit on the Main menu to close the program.
    For Technical Support, double-click the e-mail address located at the bottom of each menu.

    Now Lets run a on-line scan.

    Please do an online scan with Kaspersky WebScanner

    Click on "Accept" If your pop "“up blocker blocks the ActiveX download, allow it, click on "Accept" again

    You will be promted to install an ActiveX component from Kaspersky, Click Yes or Install.
    • The program will launch and then begin downloading the latest definition files:
    • Once the files have been downloaded click on NEXT
    • Now click on Scan Settings
    • In the scan settings make that the following are selected:
      • Scan using the following Anti-Virus database:
      • Extended (if available otherwise Standard)
      • Scan Options:
      • Scan Archives
        Scan Mail Bases
    • Click OK
    • Now under select a target to scan:
      • Select My Computer
    • This will start the program and scan your system.
    • The scan will take a while so be patient and let it run.
    • Once the scan is complete it will display if your system has been infected.
      • Now click on the Save as Text button:
    • Save the file to your desktop.
    • Copy and paste that information in your next post.

    Please post the Kaspersky results.

    Thanks
    Geri
     
    Geri,
    #10
  12. 2008/03/06
    judgmentmonkey

    judgmentmonkey Inactive Thread Starter

    Joined:
    2008/03/02
    Messages:
    11
    Likes Received:
    0
    Well the explorer thing seemed like a one time deal, and the pop ups are gone... but kaspersky turned up some stuff...


    -------------------------------------------------------------------------------
    KASPERSKY ONLINE SCANNER REPORT
    Thursday, March 06, 2008 1:41:12 AM
    Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
    Kaspersky Online Scanner version: 5.0.98.0
    Kaspersky Anti-Virus database last update: 6/03/2008
    Kaspersky Anti-Virus database records: 601345
    -------------------------------------------------------------------------------

    Scan Settings:
    Scan using the following antivirus database: extended
    Scan Archives: true
    Scan Mail Bases: true

    Scan Target - My Computer:
    C:\
    D:\
    E:\
    F:\
    G:\
    H:\

    Scan Statistics:
    Total number of scanned objects: 146212
    Number of viruses found: 9
    Number of infected objects: 42
    Number of suspicious objects: 0
    Duration of the scan process: 02:07:35

    Infected Object Name / Virus Name / Last Action
    C:\Deckard\System Scanner\20080304142504\backup\DOCUME~1\ANDRES~1\LOCALS~1\Temp\1lAYSGYa.exe Infected: Trojan-Downloader.Win32.Agent.keu skipped
    C:\Deckard\System Scanner\20080304142504\backup\DOCUME~1\ANDRES~1\LOCALS~1\Temp\59E3tyGm.exe Infected: Trojan-Downloader.Win32.Agent.keu skipped
    C:\Deckard\System Scanner\20080304142504\backup\DOCUME~1\ANDRES~1\LOCALS~1\Temp\5J1qYK4w.exe Infected: Trojan-Downloader.Win32.Agent.keu skipped
    C:\Deckard\System Scanner\20080304142504\backup\DOCUME~1\ANDRES~1\LOCALS~1\Temp\ASmjInya.exe Infected: Trojan-Downloader.Win32.Agent.keu skipped
    C:\Deckard\System Scanner\20080304142504\backup\DOCUME~1\ANDRES~1\LOCALS~1\Temp\BTPzI8W6.exe Infected: Trojan-Downloader.Win32.Agent.keu skipped
    C:\Deckard\System Scanner\20080304142504\backup\DOCUME~1\ANDRES~1\LOCALS~1\Temp\mso11.exe Infected: Trojan-Dropper.Win32.Agent.eya skipped
    C:\Deckard\System Scanner\20080304142504\backup\DOCUME~1\ANDRES~1\LOCALS~1\Temp\SEv1Qz5J.exe Infected: Trojan-Downloader.Win32.Agent.keu skipped
    C:\Deckard\System Scanner\20080304142504\backup\DOCUME~1\ANDRES~1\LOCALS~1\Temp\TnB0JSwB.exe Infected: Trojan-Downloader.Win32.Agent.keu skipped
    C:\Deckard\System Scanner\20080304142504\backup\DOCUME~1\ANDRES~1\LOCALS~1\Temp\Ty4XhHWc.exe Infected: Trojan-Downloader.Win32.Agent.keu skipped
    C:\Deckard\System Scanner\20080304142504\backup\DOCUME~1\ANDRES~1\LOCALS~1\Temp\U5tO7UIo.exe Infected: Trojan-Downloader.Win32.Agent.keu skipped
    C:\Deckard\System Scanner\20080304142504\backup\DOCUME~1\ANDRES~1\LOCALS~1\Temp\YtFQrELg.exe Infected: Trojan-Downloader.Win32.Agent.keu skipped
    C:\Documents and Settings\Administrator\Desktop\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
    C:\Documents and Settings\Administrator\Desktop\SmitfraudFix.exe/data.rar/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
    C:\Documents and Settings\Administrator\Desktop\SmitfraudFix.exe/data.rar Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
    C:\Documents and Settings\Administrator\Desktop\SmitfraudFix.exe RarSFX: infected - 2 skipped
    C:\Documents and Settings\All Users\Application Data\McAfee\Common Framework\Db\Agent_DRDRES317.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\McAfee\Common Framework\Db\PrdMgr_DRDRES317.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\McAfee\DesktopProtection\AccessProtectionLog.txt Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\McAfee\DesktopProtection\BufferOverflowProtectionLog.txt Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\McAfee\DesktopProtection\OnAccessScanLog.txt Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\2008-03-05_Log.ALUSchedulerSvc.LiveUpdate Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3CD75108.dll Infected: Trojan.Win32.Agent.qg skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\59B86BAD.wmf Infected: Exploit.Win32.IMG-WMF.u skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtETmp\C04D06B4.TMP Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtETmp\D8B202BD.TMP Object is locked skipped
    C:\Documents and Settings\Andres Castro\Application Data\Aim\fdjlrpjc\Drdres317\cert8.db Object is locked skipped
    C:\Documents and Settings\Andres Castro\Application Data\Aim\fdjlrpjc\Drdres317\key3.db Object is locked skipped
    C:\Documents and Settings\Andres Castro\Application Data\Microsoft\Internet Explorer\SmitfraudFix.exe/data.rar/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
    C:\Documents and Settings\Andres Castro\Application Data\Microsoft\Internet Explorer\SmitfraudFix.exe/data.rar Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
    C:\Documents and Settings\Andres Castro\Application Data\Microsoft\Internet Explorer\SmitfraudFix.exe RarSFX: infected - 2 skipped
    C:\Documents and Settings\Andres Castro\Application Data\Mozilla\Firefox\Profiles\arrhxa5a.default\cert8.db Object is locked skipped
    C:\Documents and Settings\Andres Castro\Application Data\Mozilla\Firefox\Profiles\arrhxa5a.default\formhistory.dat Object is locked skipped
    C:\Documents and Settings\Andres Castro\Application Data\Mozilla\Firefox\Profiles\arrhxa5a.default\history.dat Object is locked skipped
    C:\Documents and Settings\Andres Castro\Application Data\Mozilla\Firefox\Profiles\arrhxa5a.default\key3.db Object is locked skipped
    C:\Documents and Settings\Andres Castro\Application Data\Mozilla\Firefox\Profiles\arrhxa5a.default\parent.lock Object is locked skipped
    C:\Documents and Settings\Andres Castro\Application Data\Mozilla\Firefox\Profiles\arrhxa5a.default\search.sqlite Object is locked skipped
    C:\Documents and Settings\Andres Castro\Application Data\Mozilla\Firefox\Profiles\arrhxa5a.default\urlclassifier2.sqlite Object is locked skipped
    C:\Documents and Settings\Andres Castro\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\Andres Castro\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped
    C:\Documents and Settings\Andres Castro\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\Andres Castro\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\Andres Castro\Local Settings\Application Data\Mozilla\Firefox\Profiles\arrhxa5a.default\Cache\_CACHE_001_ Object is locked skipped
    C:\Documents and Settings\Andres Castro\Local Settings\Application Data\Mozilla\Firefox\Profiles\arrhxa5a.default\Cache\_CACHE_002_ Object is locked skipped
    C:\Documents and Settings\Andres Castro\Local Settings\Application Data\Mozilla\Firefox\Profiles\arrhxa5a.default\Cache\_CACHE_003_ Object is locked skipped
    C:\Documents and Settings\Andres Castro\Local Settings\Application Data\Mozilla\Firefox\Profiles\arrhxa5a.default\Cache\_CACHE_MAP_ Object is locked skipped
    C:\Documents and Settings\Andres Castro\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\Andres Castro\Local Settings\History\History.IE5\MSHist012008030620080307\index.dat Object is locked skipped
    C:\Documents and Settings\Andres Castro\Local Settings\Temp\NAILogs\UpdaterUI_DRDRES317.log Object is locked skipped
    C:\Documents and Settings\Andres Castro\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\Andres Castro\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\Andres Castro\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\EENGINE\EPERSIST.DAT Object is locked skipped
    C:\QooBox\Quarantine\C\WINDOWS\bxlrvps.dll.vir Infected: not-a-virus:AdWare.Win32.Vapsup.bup skipped
    C:\QooBox\Quarantine\C\WINDOWS\ekvgsnw.dll.vir Infected: not-a-virus:AdWare.Win32.Vapsup.buo skipped
    C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
    C:\System Volume Information\_restore{36A60E72-2A74-4D17-8231-F1C107C3453E}\RP1\A0000039.exe Infected: Trojan-Downloader.Win32.Agent.keu skipped
    C:\System Volume Information\_restore{36A60E72-2A74-4D17-8231-F1C107C3453E}\RP1\A0000040.exe Infected: Trojan-Downloader.Win32.Agent.keu skipped
    C:\System Volume Information\_restore{36A60E72-2A74-4D17-8231-F1C107C3453E}\RP1\A0000041.exe Infected: Trojan-Downloader.Win32.Agent.keu skipped
    C:\System Volume Information\_restore{36A60E72-2A74-4D17-8231-F1C107C3453E}\RP1\A0000042.exe Infected: Trojan-Downloader.Win32.Agent.keu skipped
    C:\System Volume Information\_restore{36A60E72-2A74-4D17-8231-F1C107C3453E}\RP1\A0000043.exe Infected: Trojan-Downloader.Win32.Agent.keu skipped
    C:\System Volume Information\_restore{36A60E72-2A74-4D17-8231-F1C107C3453E}\RP1\A0000044.exe Infected: Trojan-Downloader.Win32.Agent.keu skipped
    C:\System Volume Information\_restore{36A60E72-2A74-4D17-8231-F1C107C3453E}\RP1\A0000045.exe Infected: Trojan-Downloader.Win32.Agent.keu skipped
    C:\System Volume Information\_restore{36A60E72-2A74-4D17-8231-F1C107C3453E}\RP1\A0000046.exe Infected: Trojan-Downloader.Win32.Agent.keu skipped
    C:\System Volume Information\_restore{36A60E72-2A74-4D17-8231-F1C107C3453E}\RP1\A0000047.exe Infected: Trojan-Downloader.Win32.Agent.keu skipped
    C:\System Volume Information\_restore{36A60E72-2A74-4D17-8231-F1C107C3453E}\RP1\A0000048.exe Infected: Trojan-Dropper.Win32.Agent.eya skipped
    C:\System Volume Information\_restore{36A60E72-2A74-4D17-8231-F1C107C3453E}\RP1\A0000072.dll Infected: not-a-virus:AdWare.Win32.Vapsup.bul skipped
    C:\System Volume Information\_restore{36A60E72-2A74-4D17-8231-F1C107C3453E}\RP1\A0000073.exe Infected: not-a-virus:AdWare.Win32.Vapsup.bun skipped
    C:\System Volume Information\_restore{36A60E72-2A74-4D17-8231-F1C107C3453E}\RP3\A0000176.dll Infected: not-a-virus:AdWare.Win32.Vapsup.buo skipped
    C:\System Volume Information\_restore{36A60E72-2A74-4D17-8231-F1C107C3453E}\RP3\A0000177.dll Infected: not-a-virus:AdWare.Win32.Vapsup.bup skipped
    C:\System Volume Information\_restore{36A60E72-2A74-4D17-8231-F1C107C3453E}\RP4\change.log Object is locked skipped
    C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
    C:\WINDOWS\Installer\{028e21fd-585a-4a08-bdfc-827ad7a0ed99}\RomSrv.dll Infected: Trojan-Dropper.Win32.Agent.eya skipped
    C:\WINDOWS\Installer\{10a3007e-9a16-456c-842f-9cb6ac30cc6c}\zip.dll Infected: Trojan-Dropper.Win32.Agent.eya skipped
    C:\WINDOWS\Installer\{4dce0459-15cb-4626-95ce-8313833b268e}\zip.dll Infected: Trojan-Dropper.Win32.Agent.eya skipped
    C:\WINDOWS\Installer\{5245e3c7-c2f4-4f0b-896b-23668cb53e64}\VolumeRam.dll Infected: Trojan-Dropper.Win32.Agent.eya skipped
    C:\WINDOWS\Installer\{abddbdfe-c21e-4da2-a69d-b1d510b0e406}\zip.dll Infected: Trojan-Dropper.Win32.Agent.eya skipped
    C:\WINDOWS\Installer\{cf6cf1d2-f5f2-4f1c-a531-a57103501c5e}\DriveKernel.dll Infected: Trojan-Dropper.Win32.Agent.eya skipped
    C:\WINDOWS\SchedLgU.Txt Object is locked skipped
    C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
    C:\WINDOWS\Sti_Trace.log Object is locked skipped
    C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
    C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
    C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\default Object is locked skipped
    C:\WINDOWS\system32\config\default.LOG Object is locked skipped
    C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
    C:\WINDOWS\system32\config\SAM Object is locked skipped
    C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
    C:\WINDOWS\system32\config\software Object is locked skipped
    C:\WINDOWS\system32\config\software.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\system Object is locked skipped
    C:\WINDOWS\system32\config\system.LOG Object is locked skipped
    C:\WINDOWS\system32\h323log.txt Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
    C:\WINDOWS\wiadebug.log Object is locked skipped
    C:\WINDOWS\wiaservc.log Object is locked skipped
    C:\WINDOWS\WindowsUpdate.log Object is locked skipped

    Scan process completed.
     
    judgmentmonkey,
    #11
  13. 2008/03/06
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi

    You are running two anti-virus programs, this is not a good idea, they can conflict with each other and actually give you less protection
    Please remove one ( 1 ) of them.

    Norton Internet Security
    McAfee

    Please download the OTMoveIt2 by OldTimer.
    • Save it to your desktop.
    • Please double-click OTMoveIt2.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
    • Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

      Code:
      C:\WINDOWS\Installer\{028e21fd-585a-4a08-bdfc-827ad7a0ed99}\RomSrv.dll
C:\WINDOWS\Installer\{10a3007e-9a16-456c-842f-9cb6ac30cc6c}\zip.dll 
C:\WINDOWS\Installer\{4dce0459-15cb-4626-95ce-8313833b268e}\zip.dll
C:\WINDOWS\Installer\{5245e3c7-c2f4-4f0b-896b-23668cb53e64}\VolumeRam.dll
C:\WINDOWS\Installer\{abddbdfe-c21e-4da2-a69d-b1d510b0e406}\zip.dll 
C:\WINDOWS\Installer\{cf6cf1d2-f5f2-4f1c-a531-a57103501c5e}\DriveKernel.dll
    • Return to OTMoveIt2, right click in the "Paste Standard List of Files/Folders to Move " window (under the light blue bar) and choose Paste.

    • Click the red Moveit! button.
    • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
    • Close OTMoveIt2
    Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

    Open your Norton AntiVirus Quarantine section and delete/remove everything in it.

    Thanks
    Geri
     
    Geri,
    #12
  14. 2008/03/06
    judgmentmonkey

    judgmentmonkey Inactive Thread Starter

    Joined:
    2008/03/02
    Messages:
    11
    Likes Received:
    0
    DllUnregisterServer procedure not found in C:\WINDOWS\Installer\{028e21fd-585a-4a08-bdfc-827ad7a0ed99}\RomSrv.dll
    C:\WINDOWS\Installer\{028e21fd-585a-4a08-bdfc-827ad7a0ed99}\RomSrv.dll NOT unregistered.
    File move failed. C:\WINDOWS\Installer\{028e21fd-585a-4a08-bdfc-827ad7a0ed99}\RomSrv.dll scheduled to be moved on reboot.
    DllUnregisterServer procedure not found in C:\WINDOWS\Installer\{10a3007e-9a16-456c-842f-9cb6ac30cc6c}\zip.dll
    C:\WINDOWS\Installer\{10a3007e-9a16-456c-842f-9cb6ac30cc6c}\zip.dll NOT unregistered.
    File move failed. C:\WINDOWS\Installer\{10a3007e-9a16-456c-842f-9cb6ac30cc6c}\zip.dll scheduled to be moved on reboot.
    DllUnregisterServer procedure not found in C:\WINDOWS\Installer\{4dce0459-15cb-4626-95ce-8313833b268e}\zip.dll
    C:\WINDOWS\Installer\{4dce0459-15cb-4626-95ce-8313833b268e}\zip.dll NOT unregistered.
    File move failed. C:\WINDOWS\Installer\{4dce0459-15cb-4626-95ce-8313833b268e}\zip.dll scheduled to be moved on reboot.
    DllUnregisterServer procedure not found in C:\WINDOWS\Installer\{5245e3c7-c2f4-4f0b-896b-23668cb53e64}\VolumeRam.dll
    C:\WINDOWS\Installer\{5245e3c7-c2f4-4f0b-896b-23668cb53e64}\VolumeRam.dll NOT unregistered.
    File move failed. C:\WINDOWS\Installer\{5245e3c7-c2f4-4f0b-896b-23668cb53e64}\VolumeRam.dll scheduled to be moved on reboot.
    DllUnregisterServer procedure not found in C:\WINDOWS\Installer\{abddbdfe-c21e-4da2-a69d-b1d510b0e406}\zip.dll
    C:\WINDOWS\Installer\{abddbdfe-c21e-4da2-a69d-b1d510b0e406}\zip.dll NOT unregistered.
    File move failed. C:\WINDOWS\Installer\{abddbdfe-c21e-4da2-a69d-b1d510b0e406}\zip.dll scheduled to be moved on reboot.
    DllUnregisterServer procedure not found in C:\WINDOWS\Installer\{cf6cf1d2-f5f2-4f1c-a531-a57103501c5e}\DriveKernel.dll
    C:\WINDOWS\Installer\{cf6cf1d2-f5f2-4f1c-a531-a57103501c5e}\DriveKernel.dll NOT unregistered.
    File move failed. C:\WINDOWS\Installer\{cf6cf1d2-f5f2-4f1c-a531-a57103501c5e}\DriveKernel.dll scheduled to be moved on reboot.

    OTMoveIt2 v1.0.20 log created on 03062008_114255
     
    judgmentmonkey,
    #13
  15. 2008/03/06
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi
    Did OTMoveIt2 reboot your computer?

    If not please do so now.

    Then look to see if there is a new OTMoveIt2 log.

    Please scan with Kaspersky again and post the new Kaspersky scan log.

    Thanks
    Geri
     
    Geri,
    #14
  16. 2008/03/07
    judgmentmonkey

    judgmentmonkey Inactive Thread Starter

    Joined:
    2008/03/02
    Messages:
    11
    Likes Received:
    0
    File/Folder C:\WINDOWS\Installer\{028e21fd-585a-4a08-bdfc-827ad7a0ed99}\RomSrv.dll not found.
    File/Folder C:\WINDOWS\Installer\{10a3007e-9a16-456c-842f-9cb6ac30cc6c}\zip.dll not found.
    File/Folder C:\WINDOWS\Installer\{4dce0459-15cb-4626-95ce-8313833b268e}\zip.dll not found.
    File/Folder C:\WINDOWS\Installer\{5245e3c7-c2f4-4f0b-896b-23668cb53e64}\VolumeRam.dll not found.
    File/Folder C:\WINDOWS\Installer\{abddbdfe-c21e-4da2-a69d-b1d510b0e406}\zip.dll not found.
    File/Folder C:\WINDOWS\Installer\{cf6cf1d2-f5f2-4f1c-a531-a57103501c5e}\DriveKernel.dll not found.

    OTMoveIt2 v1.0.20 log created on 03072008_130807



    Kaspersky:
    -------------------------------------------------------------------------------
    KASPERSKY ONLINE SCANNER REPORT
    Friday, March 07, 2008 3:22:46 PM
    Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
    Kaspersky Online Scanner version: 5.0.98.0
    Kaspersky Anti-Virus database last update: 7/03/2008
    Kaspersky Anti-Virus database records: 610492
    -------------------------------------------------------------------------------

    Scan Settings:
    Scan using the following antivirus database: extended
    Scan Archives: true
    Scan Mail Bases: true

    Scan Target - My Computer:
    C:\
    D:\
    E:\
    F:\
    G:\
    H:\

    Scan Statistics:
    Total number of scanned objects: 144705
    Number of viruses found: 9
    Number of infected objects: 42
    Number of suspicious objects: 0
    Duration of the scan process: 01:56:17

    Infected Object Name / Virus Name / Last Action
    C:\Deckard\System Scanner\20080304142504\backup\DOCUME~1\ANDRES~1\LOCALS~1\Temp\1lAYSGYa.exe Infected: Trojan-Downloader.Win32.Agent.keu skipped
    C:\Deckard\System Scanner\20080304142504\backup\DOCUME~1\ANDRES~1\LOCALS~1\Temp\59E3tyGm.exe Infected: Trojan-Downloader.Win32.Agent.keu skipped
    C:\Deckard\System Scanner\20080304142504\backup\DOCUME~1\ANDRES~1\LOCALS~1\Temp\5J1qYK4w.exe Infected: Trojan-Downloader.Win32.Agent.keu skipped
    C:\Deckard\System Scanner\20080304142504\backup\DOCUME~1\ANDRES~1\LOCALS~1\Temp\ASmjInya.exe Infected: Trojan-Downloader.Win32.Agent.keu skipped
    C:\Deckard\System Scanner\20080304142504\backup\DOCUME~1\ANDRES~1\LOCALS~1\Temp\BTPzI8W6.exe Infected: Trojan-Downloader.Win32.Agent.keu skipped
    C:\Deckard\System Scanner\20080304142504\backup\DOCUME~1\ANDRES~1\LOCALS~1\Temp\mso11.exe Infected: Trojan-Dropper.Win32.Agent.eya skipped
    C:\Deckard\System Scanner\20080304142504\backup\DOCUME~1\ANDRES~1\LOCALS~1\Temp\SEv1Qz5J.exe Infected: Trojan-Downloader.Win32.Agent.keu skipped
    C:\Deckard\System Scanner\20080304142504\backup\DOCUME~1\ANDRES~1\LOCALS~1\Temp\TnB0JSwB.exe Infected: Trojan-Downloader.Win32.Agent.keu skipped
    C:\Deckard\System Scanner\20080304142504\backup\DOCUME~1\ANDRES~1\LOCALS~1\Temp\Ty4XhHWc.exe Infected: Trojan-Downloader.Win32.Agent.keu skipped
    C:\Deckard\System Scanner\20080304142504\backup\DOCUME~1\ANDRES~1\LOCALS~1\Temp\U5tO7UIo.exe Infected: Trojan-Downloader.Win32.Agent.keu skipped
    C:\Deckard\System Scanner\20080304142504\backup\DOCUME~1\ANDRES~1\LOCALS~1\Temp\YtFQrELg.exe Infected: Trojan-Downloader.Win32.Agent.keu skipped
    C:\Documents and Settings\Administrator\Desktop\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
    C:\Documents and Settings\Administrator\Desktop\SmitfraudFix.exe/data.rar/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
    C:\Documents and Settings\Administrator\Desktop\SmitfraudFix.exe/data.rar Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
    C:\Documents and Settings\Administrator\Desktop\SmitfraudFix.exe RarSFX: infected - 2 skipped
    C:\Documents and Settings\All Users\Application Data\McAfee\Common Framework\Db\Agent_DRDRES317.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\McAfee\Common Framework\Db\PrdMgr_DRDRES317.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\McAfee\DesktopProtection\AccessProtectionLog.txt Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\McAfee\DesktopProtection\BufferOverflowProtectionLog.txt Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\McAfee\DesktopProtection\OnAccessScanLog.txt Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3CD75108.dll Infected: Trojan.Win32.Agent.qg skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\59B86BAD.wmf Infected: Exploit.Win32.IMG-WMF.u skipped
    C:\Documents and Settings\Andres Castro\Application Data\Microsoft\Internet Explorer\SmitfraudFix.exe/data.rar/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
    C:\Documents and Settings\Andres Castro\Application Data\Microsoft\Internet Explorer\SmitfraudFix.exe/data.rar Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
    C:\Documents and Settings\Andres Castro\Application Data\Microsoft\Internet Explorer\SmitfraudFix.exe RarSFX: infected - 2 skipped
    C:\Documents and Settings\Andres Castro\Application Data\Mozilla\Firefox\Profiles\arrhxa5a.default\cert8.db Object is locked skipped
    C:\Documents and Settings\Andres Castro\Application Data\Mozilla\Firefox\Profiles\arrhxa5a.default\formhistory.dat Object is locked skipped
    C:\Documents and Settings\Andres Castro\Application Data\Mozilla\Firefox\Profiles\arrhxa5a.default\history.dat Object is locked skipped
    C:\Documents and Settings\Andres Castro\Application Data\Mozilla\Firefox\Profiles\arrhxa5a.default\key3.db Object is locked skipped
    C:\Documents and Settings\Andres Castro\Application Data\Mozilla\Firefox\Profiles\arrhxa5a.default\parent.lock Object is locked skipped
    C:\Documents and Settings\Andres Castro\Application Data\Mozilla\Firefox\Profiles\arrhxa5a.default\search.sqlite Object is locked skipped
    C:\Documents and Settings\Andres Castro\Application Data\Mozilla\Firefox\Profiles\arrhxa5a.default\urlclassifier2.sqlite Object is locked skipped
    C:\Documents and Settings\Andres Castro\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\Andres Castro\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped
    C:\Documents and Settings\Andres Castro\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\Andres Castro\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\Andres Castro\Local Settings\Application Data\Mozilla\Firefox\Profiles\arrhxa5a.default\Cache\_CACHE_001_ Object is locked skipped
    C:\Documents and Settings\Andres Castro\Local Settings\Application Data\Mozilla\Firefox\Profiles\arrhxa5a.default\Cache\_CACHE_002_ Object is locked skipped
    C:\Documents and Settings\Andres Castro\Local Settings\Application Data\Mozilla\Firefox\Profiles\arrhxa5a.default\Cache\_CACHE_003_ Object is locked skipped
    C:\Documents and Settings\Andres Castro\Local Settings\Application Data\Mozilla\Firefox\Profiles\arrhxa5a.default\Cache\_CACHE_MAP_ Object is locked skipped
    C:\Documents and Settings\Andres Castro\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\Andres Castro\Local Settings\History\History.IE5\MSHist012008030720080308\index.dat Object is locked skipped
    C:\Documents and Settings\Andres Castro\Local Settings\Temp\NAILogs\UpdaterUI_DRDRES317.log Object is locked skipped
    C:\Documents and Settings\Andres Castro\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
    C:\Documents and Settings\Andres Castro\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\Andres Castro\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\Andres Castro\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\Andres Castro\UserData\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\EENGINE\EPERSIST.DAT Object is locked skipped
    C:\QooBox\Quarantine\C\WINDOWS\bxlrvps.dll.vir Infected: not-a-virus:AdWare.Win32.Vapsup.bup skipped
    C:\QooBox\Quarantine\C\WINDOWS\ekvgsnw.dll.vir Infected: not-a-virus:AdWare.Win32.Vapsup.buo skipped
    C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
    C:\System Volume Information\_restore{36A60E72-2A74-4D17-8231-F1C107C3453E}\RP1\A0000039.exe Infected: Trojan-Downloader.Win32.Agent.keu skipped
    C:\System Volume Information\_restore{36A60E72-2A74-4D17-8231-F1C107C3453E}\RP1\A0000040.exe Infected: Trojan-Downloader.Win32.Agent.keu skipped
    C:\System Volume Information\_restore{36A60E72-2A74-4D17-8231-F1C107C3453E}\RP1\A0000041.exe Infected: Trojan-Downloader.Win32.Agent.keu skipped
    C:\System Volume Information\_restore{36A60E72-2A74-4D17-8231-F1C107C3453E}\RP1\A0000042.exe Infected: Trojan-Downloader.Win32.Agent.keu skipped
    C:\System Volume Information\_restore{36A60E72-2A74-4D17-8231-F1C107C3453E}\RP1\A0000043.exe Infected: Trojan-Downloader.Win32.Agent.keu skipped
    C:\System Volume Information\_restore{36A60E72-2A74-4D17-8231-F1C107C3453E}\RP1\A0000044.exe Infected: Trojan-Downloader.Win32.Agent.keu skipped
    C:\System Volume Information\_restore{36A60E72-2A74-4D17-8231-F1C107C3453E}\RP1\A0000045.exe Infected: Trojan-Downloader.Win32.Agent.keu skipped
    C:\System Volume Information\_restore{36A60E72-2A74-4D17-8231-F1C107C3453E}\RP1\A0000046.exe Infected: Trojan-Downloader.Win32.Agent.keu skipped
    C:\System Volume Information\_restore{36A60E72-2A74-4D17-8231-F1C107C3453E}\RP1\A0000047.exe Infected: Trojan-Downloader.Win32.Agent.keu skipped
    C:\System Volume Information\_restore{36A60E72-2A74-4D17-8231-F1C107C3453E}\RP1\A0000048.exe Infected: Trojan-Dropper.Win32.Agent.eya skipped
    C:\System Volume Information\_restore{36A60E72-2A74-4D17-8231-F1C107C3453E}\RP1\A0000072.dll Infected: not-a-virus:AdWare.Win32.Vapsup.bul skipped
    C:\System Volume Information\_restore{36A60E72-2A74-4D17-8231-F1C107C3453E}\RP1\A0000073.exe Infected: not-a-virus:AdWare.Win32.Vapsup.bun skipped
    C:\System Volume Information\_restore{36A60E72-2A74-4D17-8231-F1C107C3453E}\RP3\A0000176.dll Infected: not-a-virus:AdWare.Win32.Vapsup.buo skipped
    C:\System Volume Information\_restore{36A60E72-2A74-4D17-8231-F1C107C3453E}\RP3\A0000177.dll Infected: not-a-virus:AdWare.Win32.Vapsup.bup skipped
    C:\System Volume Information\_restore{36A60E72-2A74-4D17-8231-F1C107C3453E}\RP5\change.log Object is locked skipped
    C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
    C:\WINDOWS\SchedLgU.Txt Object is locked skipped
    C:\WINDOWS\SoftwareDistribution\EventCache\{2306C781-A50C-4B26-B490-730BB39B7331}.bin Object is locked skipped
    C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
    C:\WINDOWS\Sti_Trace.log Object is locked skipped
    C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
    C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
    C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\default Object is locked skipped
    C:\WINDOWS\system32\config\default.LOG Object is locked skipped
    C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
    C:\WINDOWS\system32\config\SAM Object is locked skipped
    C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
    C:\WINDOWS\system32\config\software Object is locked skipped
    C:\WINDOWS\system32\config\software.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\system Object is locked skipped
    C:\WINDOWS\system32\config\system.LOG Object is locked skipped
    C:\WINDOWS\system32\h323log.txt Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
    C:\WINDOWS\wiadebug.log Object is locked skipped
    C:\WINDOWS\wiaservc.log Object is locked skipped
    C:\WINDOWS\WindowsUpdate.log Object is locked skipped
    C:\_OTMoveIt\MovedFiles\03062008_114255\WINDOWS\Installer\{028e21fd-585a-4a08-bdfc-827ad7a0ed99}\RomSrv.dll Infected: Trojan-Dropper.Win32.Agent.eya skipped
    C:\_OTMoveIt\MovedFiles\03062008_114255\WINDOWS\Installer\{10a3007e-9a16-456c-842f-9cb6ac30cc6c}\zip.dll Infected: Trojan-Dropper.Win32.Agent.eya skipped
    C:\_OTMoveIt\MovedFiles\03062008_114255\WINDOWS\Installer\{4dce0459-15cb-4626-95ce-8313833b268e}\zip.dll Infected: Trojan-Dropper.Win32.Agent.eya skipped
    C:\_OTMoveIt\MovedFiles\03062008_114255\WINDOWS\Installer\{5245e3c7-c2f4-4f0b-896b-23668cb53e64}\VolumeRam.dll Infected: Trojan-Dropper.Win32.Agent.eya skipped
    C:\_OTMoveIt\MovedFiles\03062008_114255\WINDOWS\Installer\{abddbdfe-c21e-4da2-a69d-b1d510b0e406}\zip.dll Infected: Trojan-Dropper.Win32.Agent.eya skipped
    C:\_OTMoveIt\MovedFiles\03062008_114255\WINDOWS\Installer\{cf6cf1d2-f5f2-4f1c-a531-a57103501c5e}\DriveKernel.dll Infected: Trojan-Dropper.Win32.Agent.eya skipped

    Scan process completed.

    i uninstalled norton and i'm running mcaffee now, but idk if it got fully uninstalled
     
    judgmentmonkey,
    #15
  17. 2008/03/07
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi judgmentmonkey
    Ok we'll take care of that.

    Please do these in the order given.

    Go here and run the Norton Removal Tool for the product version you have/had.

    http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2005033108162039

    Kaspersky shows that OTMoveIt2 moved the files. so please do this.

    Now Open OTMoveIt2 and click on the CleanUp Button, this will remove the tools you have downloaded and then remove itself.

    Now we need to clear your system restore points, here is how.

    To turn off Windows XP System Restore:
    NOTE: These instructions assume that you are using the default Windows XP Start Menu and have not changed to the Classic Start menu. To re-enable the default menu, right-click Start, click Properties, click Start menu (not Classic) and then click OK.
    1. Click Start.
    2. Right-click the My Computer icon, and then click Properties.
    3. Click the System Restore tab.
    4. Check "Turn off System Restore" or "Turn off System Restore on all drives"
    5. Click Apply.
    6. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this.
    7. Click OK.
    8. Restart the computer and follow the instructions in the next section to turn on System Restore.

    To turn on Windows XP System Restore:
    1. Click Start.
    2. Right-click My Computer, and then click Properties.
    3. Click the System Restore tab.
    4. Uncheck "Turn off System Restore" or "Turn off System Restore on all drives. "
    5. Click Apply, and then click OK
    6. Make a new restore point.
    7. Click Start, All Programs, Accessories, System Tools, System Restore.
    Choose Create a restore point and clicked Next, Under "Type a description for your restore point…â€put a name in the box,. Click Create. In the next window click Close.

    Run ATF Cleaner again.

    Please reboot your computer.

    Now run Kaspersky one more time and post the log.

    Thanks
    Geri
     
    Geri,
    #16
  18. 2008/03/08
    judgmentmonkey

    judgmentmonkey Inactive Thread Starter

    Joined:
    2008/03/02
    Messages:
    11
    Likes Received:
    0
    -------------------------------------------------------------------------------
    KASPERSKY ONLINE SCANNER REPORT
    Saturday, March 08, 2008 9:58:39 PM
    Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
    Kaspersky Online Scanner version: 5.0.98.0
    Kaspersky Anti-Virus database last update: 8/03/2008
    Kaspersky Anti-Virus database records: 616276
    -------------------------------------------------------------------------------

    Scan Settings:
    Scan using the following antivirus database: extended
    Scan Archives: true
    Scan Mail Bases: true

    Scan Target - My Computer:
    C:\
    D:\
    E:\
    F:\
    G:\
    H:\

    Scan Statistics:
    Total number of scanned objects: 54554
    Number of viruses found: 1
    Number of infected objects: 6
    Number of suspicious objects: 0
    Duration of the scan process: 01:37:02

    Infected Object Name / Virus Name / Last Action
    C:\Documents and Settings\Administrator\Desktop\SmitfraudFix.exe/data.rar/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
    C:\Documents and Settings\Administrator\Desktop\SmitfraudFix.exe/data.rar Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
    C:\Documents and Settings\Administrator\Desktop\SmitfraudFix.exe RarSFX: infected - 2 skipped
    C:\Documents and Settings\All Users\Application Data\McAfee\Common Framework\Db\Agent_DRDRES317.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\McAfee\Common Framework\Db\PrdMgr_DRDRES317.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\McAfee\DesktopProtection\AccessProtectionLog.txt Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\McAfee\DesktopProtection\BufferOverflowProtectionLog.txt Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\McAfee\DesktopProtection\OnAccessScanLog.txt Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
    C:\Documents and Settings\Andres Castro\Application Data\Microsoft\Internet Explorer\SmitfraudFix.exe/data.rar/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
    C:\Documents and Settings\Andres Castro\Application Data\Microsoft\Internet Explorer\SmitfraudFix.exe/data.rar Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
    C:\Documents and Settings\Andres Castro\Application Data\Microsoft\Internet Explorer\SmitfraudFix.exe RarSFX: infected - 2 skipped
    C:\Documents and Settings\Andres Castro\Application Data\Mozilla\Firefox\Profiles\arrhxa5a.default\cert8.db Object is locked skipped
    C:\Documents and Settings\Andres Castro\Application Data\Mozilla\Firefox\Profiles\arrhxa5a.default\history.dat Object is locked skipped
    C:\Documents and Settings\Andres Castro\Application Data\Mozilla\Firefox\Profiles\arrhxa5a.default\key3.db Object is locked skipped
    C:\Documents and Settings\Andres Castro\Application Data\Mozilla\Firefox\Profiles\arrhxa5a.default\parent.lock Object is locked skipped
    C:\Documents and Settings\Andres Castro\Application Data\Mozilla\Firefox\Profiles\arrhxa5a.default\search.sqlite Object is locked skipped
    C:\Documents and Settings\Andres Castro\Application Data\Mozilla\Firefox\Profiles\arrhxa5a.default\urlclassifier2.sqlite Object is locked skipped
    C:\Documents and Settings\Andres Castro\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\Andres Castro\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped
    C:\Documents and Settings\Andres Castro\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\Andres Castro\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\Andres Castro\Local Settings\Application Data\Mozilla\Firefox\Profiles\arrhxa5a.default\Cache\_CACHE_001_ Object is locked skipped
    C:\Documents and Settings\Andres Castro\Local Settings\Application Data\Mozilla\Firefox\Profiles\arrhxa5a.default\Cache\_CACHE_002_ Object is locked skipped
    C:\Documents and Settings\Andres Castro\Local Settings\Application Data\Mozilla\Firefox\Profiles\arrhxa5a.default\Cache\_CACHE_003_ Object is locked skipped
    C:\Documents and Settings\Andres Castro\Local Settings\Application Data\Mozilla\Firefox\Profiles\arrhxa5a.default\Cache\_CACHE_MAP_ Object is locked skipped
    C:\Documents and Settings\Andres Castro\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\Andres Castro\Local Settings\History\History.IE5\MSHist012008030820080309\index.dat Object is locked skipped
    C:\Documents and Settings\Andres Castro\Local Settings\Temp\NAILogs\UpdaterUI_DRDRES317.log Object is locked skipped
    C:\Documents and Settings\Andres Castro\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
    C:\Documents and Settings\Andres Castro\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\Andres Castro\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\Andres Castro\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\Andres Castro\UserData\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
    C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
    C:\System Volume Information\_restore{36A60E72-2A74-4D17-8231-F1C107C3453E}\RP2\change.log Object is locked skipped
    C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
    C:\WINDOWS\SchedLgU.Txt Object is locked skipped
    C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
    C:\WINDOWS\Sti_Trace.log Object is locked skipped
    C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\default Object is locked skipped
    C:\WINDOWS\system32\config\default.LOG Object is locked skipped
    C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
    C:\WINDOWS\system32\config\SAM Object is locked skipped
    C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
    C:\WINDOWS\system32\config\software Object is locked skipped
    C:\WINDOWS\system32\config\software.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\system Object is locked skipped
    C:\WINDOWS\system32\config\system.LOG Object is locked skipped
    C:\WINDOWS\system32\h323log.txt Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
    C:\WINDOWS\wiadebug.log Object is locked skipped
    C:\WINDOWS\wiaservc.log Object is locked skipped
    C:\WINDOWS\WindowsUpdate.log Object is locked skipped

    Scan process completed.
     
    judgmentmonkey,
    #17
  19. 2008/03/08
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi judgmentmonkey

    OK Delete this from your DeskTop.

    SmitfraudFix.exe

    I'm not sure why but you have it here also, so please navigate to here and delete it.

    C:\Documents and Settings\Andres Castro\Application Data\Microsoft\Internet Explorer\SmitfraudFix.exe

    Let me know that you found both and deleted them and how things are running.

    Thanks
    Geri
     
    Geri,
    #18
  20. 2008/03/09
    judgmentmonkey

    judgmentmonkey Inactive Thread Starter

    Joined:
    2008/03/02
    Messages:
    11
    Likes Received:
    0
    Hey, i removed smitfraudfix and everything seems to be running great. My friend, whos computer this is, has not mentioned any other things and has said that things are running much smoother and there are zero pop ups now. Granted his computer has so much **** in general, but thats for another time. One of those technical pack rats too i suppose lol.
     
    judgmentmonkey,
    #19
  21. 2008/03/09
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi judgmentmonkey

    OK Good to hear.

    Please look at this link for some preventive recommendations, It could keep you from ending up back here to the Spyware and Virus Removal Forums.
    http://www.windowsbbs.com/showthread.php?t=67958

    I'll mark this one resolved.

    Surf Safely
    Geri
     
    Geri,
    #20

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...