Please check for infections / DECKARDS results attached

Computer would not let me run Hijack This


Deckard's System Scanner v20071014.68
Run by Gregg * on 2008-04-24 11:40:33
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.


-- Last 5 Restore Point(s) --
60: 2008-04-24 15:40:40 UTC - RP361 - Deckard's System Scanner Restore Point
59: 2008-04-23 21:40:16 UTC - RP360 - System Checkpoint
58: 2008-04-22 10:07:42 UTC - RP359 - System Checkpoint
57: 2008-04-20 21:37:42 UTC - RP358 - System Checkpoint
56: 2008-04-18 22:16:55 UTC - RP357 - System Checkpoint


-- First Restore Point --
1: 2008-01-25 20:13:20 UTC - RP302 - System Checkpoint


Backed up registry hives.
Performed disk cleanup.



-- HijackThis Clone ------------------------------------------------------------


Emulating logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2008-04-24 11:43:55
Platform: Windows XP Service Pack 2 (5.01.2600)
MSIE: Internet Explorer (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HPQ\Quick Launch Buttons\eabservr.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\opwareSE2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Hp\HP Software Update\hpwuSchd2.exe
C:\Program Files\Verizon\McciTrayApp.exe
C:\Program Files\Verizon\Servicepoint\VerizonServicepoint.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\RioMSC.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\alg.exe
C:\Program Files\HPQ\Shared\hpqwmi.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Gregg *\Desktop\dss.exe
C:\WINDOWS\system32\svchost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/search?q=%s
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=presario&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - C:\WINDOWS\DOWNLO~1\vzbb.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\GoogleToolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\GoogleToolbar4.dll
O3 - Toolbar: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - C:\WINDOWS\DOWNLO~1\vzbb.dll (file missing)
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe "
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe "
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Verizon_McciTrayApp] C:\Program Files\Verizon\McciTrayApp.exe
O4 - HKLM\..\Run: [VerizonServicepoint.exe] C:\Program Files\Verizon\Servicepoint\VerizonServicepoint.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SoundMan] " SOUNDMAN.EXE "
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\NPJPI150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\NPJPI150_02.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL
O18 - Protocol: lbxfile - {56831180-F115-11d2-B6AA-00104B2B9943} - C:\Program Files\Libronix DLS\System\FileProt.dll
O18 - Protocol: lbxres - {24508F1B-9E94-40EE-9759-9AF5795ADF52} - C:\Program Files\Libronix DLS\System\ResProt.dll
O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\ati2evxx.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\Shared\hpqwmi.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Rio MSC Manager (RioMSC) - Digital Networks North America, Inc. - C:\WINDOWS\system32\RioMSC.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe


--
End of file - 8709 bytes

-- File Associations -----------------------------------------------------------

All associations okay.


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

S3 MREMPR5 (MREMPR5 NDIS Protocol Driver) - c:\program files\common files\motive\mrempr5.sys <Not Verified; Motive, Inc.; Motive Rawether for Windows>
S3 MRENDIS5 (MRENDIS5 NDIS Protocol Driver) - c:\program files\common files\motive\mrendis5.sys <Not Verified; Motive, Inc.; Motive Rawether for Windows>


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 RioMSC (Rio MSC Manager) - c:\windows\system32\riomsc.exe <Not Verified; Digital Networks North America, Inc.; Rio Mass Storage Class Device Manager>
R3 hpqwmi (HP WMI Interface) - c:\program files\hpq\shared\hpqwmi.exe <Not Verified; Hewlett-Packard Development Company, L.P.; hpqwmi Module>


-- Device Manager: Disabled ----------------------------------------------------

No disabled devices found.


-- Files created between 2008-03-24 and 2008-04-24 -----------------------------

2008-03-29 22:52:24 299008 --a------ C:\WINDOWS\uninst.exe <Not Verified; InstallShield Corporation, Inc.; InstallShield unInstaller>
2008-03-29 22:52:22 0 d-------- C:\Documents and Settings\Gregg *\WINDOWS
2008-03-28 16:51:18 0 d-------- C:\Program Files\Nova Development


-- Find3M Report ---------------------------------------------------------------

2008-04-24 07:30:50 0 d-------- C:\Documents and Settings\Gregg *\Application Data\U3
2008-04-23 14:15:59 52164 --a------ C:\Documents and Settings\Gregg *\Application Data\wklnhst.dat
2008-03-02 19:16:15 0 d-------- C:\Documents and Settings\Gregg *\Application Data\Real
2008-03-02 19:15:26 0 d-------- C:\Program Files\Common Files
2008-03-02 19:15:26 0 d-------- C:\Program Files\Common Files\xing shared
2008-03-02 19:15:18 0 d-------- C:\Program Files\Common Files\Real
2008-02-19 19:36:57 69408 --a------ C:\Documents and Settings\Gregg *\Application Data\GDIPFONTCACHEV1.DAT


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA "= "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [04/11/2005 01:00 PM]
"hpWirelessAssistant "= "C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [04/01/2005 06:11 PM]
"SynTPLpr "= "C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [02/02/2005 08:12 AM]
"SynTPEnh "= "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [02/02/2005 08:11 AM]
"eabconfg.cpl "= "C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe" [12/03/2004 04:24 PM]
"Cpqset "= "C:\Program Files\HPQ\Default Settings\cpqset.exe" [02/17/2005 05:01 PM]
"LSBWatcher "= "c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [10/14/2004 04:54 PM]
"OpwareSE2 "= "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [05/08/2003 11:00 AM]
"iTunesHelper "= "C:\Program Files\iTunes\iTunesHelper.exe" [06/14/2006 04:24 PM]
"QuickTime Task "= "C:\Program Files\QuickTime\qttask.exe" [06/29/2006 07:54 PM]
"WorksFUD "= "C:\Program Files\Microsoft Works\wkfud.exe" [10/04/2001 09:34 PM]
"Microsoft Works Portfolio "= "C:\Program Files\Microsoft Works\WksSb.exe" [06/23/2004 03:22 PM]
"Microsoft Works Update Detection "= "C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [08/16/2001 01:41 AM]
"Zone Labs Client "= "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [08/24/2006 12:38 AM]
"HP Software Update "= "C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [02/16/2005 11:11 PM]
"Verizon_McciTrayApp "= "C:\Program Files\Verizon\McciTrayApp.exe" [03/11/2007 05:37 PM]
"VerizonServicepoint.exe "= "C:\Program Files\Verizon\Servicepoint\VerizonServicepoint.exe" [02/01/2006 06:33 PM]
"TkBellExe "= "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [03/02/2008 07:15 PM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 04:00 AM]
"swg "= "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [06/30/2007 11:05 PM]
"SoundMan "=" SOUNDMAN.EXE" [12/03/2007 06:05 PM C:\WINDOWS\system32\ SOUNDMAN.EXE]


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{176bf8a8-5c8e-11db-a24b-0014a5714477}]
AutoRun\command- E:\LaunchU3.exe -a




-- End of Deckard's System Scanner: finished at 2008-04-24 11:44:41 ------------

 

Hi Denise,

Your logs look fine. Is there a reason we're checking for infections, eg; problems? For the record, those logs alone are no guarantee you aren't infected. An online virus scan would certainly be a more reliable check.

 

Various problems.
Basically, computer freezes up and crashes, often needs to be rebooted, on a regular basis. Almost always with Microsoft Word. It's a lap top, and in the middle of typing a paper, it just freezes, sounds like a fan is running and while that's happening we can't click on anything, then it tells us that there is a problem and Ms Word has to close.
When we start up, there is a little box at the top right hand corner of the desktop from "works portfolio" Not sure if that's related.. but we can't understand how it got there and why it's there every time we start up.

We just recently were working with Win. Movie Maker and had freezing and crashing issues with that as well. When checking it looks like we have only used about 45% of the hard drive memory...

I don't think my husband has kept up to date with Windows updates.
What's the best way to get what he's missing?

Since the Scan I attached above, the only programs I downloaded are spybot and ATF cleaner. Spybot found two low risk viruses that we deleted, but the system is still acting the same.

Sorry I'm rambling.
Thanks 4 ur help
Denise

 

Works Portfolio .........

If the icon is still on the desktop, click the colored boxes and it will expand the icon.
Click Tasks, then Options.
Uncheck the box 'Start the Works Portfolio every time I start Windows'.
Click OK.
Click Tasks then Close.

If the icon is not present, click Start>All Programs>Microsoft Works>Microsoft Works Portfolio to bring up the icon.


It sounds very much like the laptop is overheating and needs to have the fan and heatsink cleaned, and possibly a fresh coating of thermal paste between the heatsink and CPU. While some laptops have a rear panel that once removed allow for easy access to the fan and CPU heatsink, others require a considerable amount of disassembly to get to them. What is the make and model? You or your husband handy with a screwdriver and able to re-assemble what you've disassembled?

A laptop's heat factor can also be associated with the type of surface it's sitting on. While dubbed a 'laptop', often-times resting them in your lap or some other soft (cushiony) surface can restrict the amount of airflow enough to cause overheating. The air intake is often located on the bottom, so it's important that air can move freely under the machine.

I would also recommend you open the Device Manager and check for errors, which will be identifies with a yellow warning icon.

You can get up-to-date with critical updates by visiting the Windows Update website and selecting the Express option.

 

OK.. Thanks for the info on WORKS PORTFOLIO

We are both handy with a screwdriver, but we are both leary about messing with computers. Any idea what it would cost to have a company do "fan and heatsink cleaned, and possibly a fresh coating of thermal paste" ?

It's a Compaq V2000
It is almost always on a desk, and not a cushy surface.

Can you give me the Web address for windows update?

thanks again for all your help

Denise

 

Sorry Denise, I really have no idea what a shop might charge. Here's a link to the official manual from HP though, in case you do decide to try it yourself. You can pick up thermal paste at Radio Shack or online at places like Newegg.com. I recommend Arctic Silver if you decide to go through an online source.

Click Start>All Programs>Windows Update (left column, all the way up) or, in an IE browser window, click Tools>Windows Update, or Google windows update.

 

Followed your instructions for Works portfolio, interestingly there is no option listed for "Start Works portfolio every time I start Windows ". Any other idea how I can turn it off?

Also, which online scan do you recommend?

Thanks for the other info

Denise

 

That's odd. Lets do it another way then. First, close the Works Portfolio. Then scan again with HijackThis and place a check next to the following entries.

O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe


Click Fix Check then close HijackThis. Will take effect upon next reboot.


Since you reported problems with Word, lets do a smidge of housecleaning there too. Word uses a template file named normal.dot which stores customized settings for Word. Sometimes it gets corrupted, which can cause a number of oddities (problems) when using Word. It's not uncommon that deleting the normal.dot file (with all Word docs and Word closed) corrects those oddities, and it will be automatically re-created the next time Word is used. You will need to re-apply any custom settings however. The normal.dot file is generally located in the

\Documents and Settings\yourusernamehere\Application Data\Microsoft\Templates

folder. The Application Data folder is a hidden folder, so unless you have set Windows to show hidden files and folders, the easiest way to access the folder is to copy the following bolded text (quotes included), click Start>Run and paste the text on the Run line then hit Enter.

"%userprofile%\Application Data\Microsoft\Templates "


I often recommend using the Kaspersky WebScanner. Instructions for it's use can be found here.

 

can't run Hijackthis

For some reason my husband's lap top won't let me run HiJack This.
I tried it when I ran Deckards Scan.
Any suggestions on that?

On a positive note, after running the windows updates ( he needed 89 of them) his computer is running much better.

Thanks for your help, look forward to hearing from you!
D

 

What happens when trying to run HijackThis? Error? Opens then closes? Just never opens?

Did you run Kaspersky?

 

While running Deckards, Hijack this attempted to run, and a box popped up saying my computer would not allow Hijack this to run, then I clicked on OK, and it said " running Hijack this clone "
That is the log that I attached.

I did not yet run Kaspersky.
I haven't had my husband's laptop .. I get it back tonight and will run Kaspersky then.. What is the best site to download that from?

Thanks

 

The Kaspersky scan is an online scan ..... nothing to download. See here for instructions.

Sounds as though you don't have HijackThis installed. Download the HijackThis Installer from here, then run a scan and save the log. Post the contents of that log here.

 

Kaspersky 3 viruses, 415 infected files...WOW

Monday, May 05, 2008 3:46:53 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 5/05/2008
Kaspersky Anti-Virus database records: 740943


Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true

Scan Target My Computer
C:\
D:\

Scan Statistics
Total number of scanned objects 74962
Number of viruses found 3
Number of infected objects 415
Number of suspicious objects 0
Duration of the scan process 04:25:31

DAVE... SEE BELOW

 

KASPERSKY, 3 viruses, 415 files infected

Dave,
I emailed you the Kaspersky results because the report is too large to fit it in the post and I didn't want to bog down the forum.
Hope that's OK

Looks like my system Volume Info Files have been infected.

Thanks

Denise

 

Hi Denise,

No problem emailing me the log. Please follow the instructions in my last post to download and install HijackThis.

• Once installed, open HijackThis and select Open the Misc Tools section from the main menu.
• From the list of System Tools, select Open ADS Spy
• Check the 2nd boxe labled Ignore safe system info streams
• Click Scan
• If anything is listed when the scan is complete, click Save log
• The log will be saved as adsspy.txt in the HijackThis folder, and will open in notepad once saved.
• Please post the contents of that log here.

 

ADS SPY Results

Thanks Dave, Hopefully this is what you needed......



C:\Program Files\Yahoo! Games\Monopoly Here & Now Edition\Monopoly.exe : {D2C61AEE-4AFC-57A2-9F77-6F1F2ABD41FD} (128 bytes)
C:\WINDOWS\explorer.exe : analyzer1.jpg (240128 bytes)
C:\WINDOWS\explorer.exe : blogger5.jpg (820736 bytes)
C:\WINDOWS\explorer.exe : crawler1.dmp (196721 bytes)
C:\WINDOWS\explorer.exe : crawler1.jpg (96256 bytes)
C:\WINDOWS\explorer.exe : extractor3.trg (8 bytes)
C:\WINDOWS\explorer.exe : extractor5.jpg (110080 bytes)
C:\WINDOWS\explorer.exe : extractor5.trg (8 bytes)
C:\WINDOWS\explorer.exe : gmail3.jpg (821248 bytes)
C:\WINDOWS\explorer.exe : googrou4.jpg (1148928 bytes)
C:\WINDOWS\explorer.exe : host.opts.db (1344 bytes)
C:\WINDOWS\explorer.exe : httpcomm (13312 bytes)
C:\WINDOWS\explorer.exe : httpcomm.set (288 bytes)
C:\WINDOWS\explorer.exe : mian.nest (6656 bytes)
C:\WINDOWS\explorer.exe : scrpfg5.jpg (645632 bytes)
C:\WINDOWS\explorer.exe : seh3.jpg (258048 bytes)
C:\WINDOWS\explorer.exe : submitter5.jpg (657408 bytes)
C:\WINDOWS\explorer.exe : whois.dmp (31513 bytes)
C:\WINDOWS\explorer.exe : whois2.dmp (236366 bytes)
C:\WINDOWS\explorer.exe : whois2.jpg (113152 bytes)
C:\WINDOWS\explorer.exe : yahooblog2.jpg (676864 bytes)

 

Perfect!

• Now do another ADS Spy scan, except this time check the box labled Quick scan (Windows base folder only) in addition to the Ignore safe system info streams. Those same entries for C:\WINDOWS\explorer.exe should come up.
• Check the box next to each entry, then click Remove Selected
• When complete, restart the computer then run another ADS Spy scan to verify nothing remains.

 

Dave, all except the following were deleted.
The dialog box stated that:
The folloing ADS streams could not be deleted. They may be locked by another program:
C:\WINDOWS\explorer.exe : extractor5.jpg (110080 bytes)
C:\WINDOWS\explorer.exe : extractor5.txt (0 bytes)
C:\WINDOWS\explorer.exe : host.opts.db (1344 bytes)
C:\WINDOWS\explorer.exe : httpcomm (13312 bytes)
C:\WINDOWS\explorer.exe : httpcomm.set (288 bytes)
C:\WINDOWS\explorer.exe : mian.nest (6656 bytes)
C:\WINDOWS\explorer.exe : submitter5.jpg (657408 bytes)
C:\WINDOWS\explorer.exe : yahooblog2.jpg (676864 bytes)

 

Lets grab a more powerful tool. Download ComboFix by sUBs from here, saving the file to your desktop.

Highlight and copy the contents of the code box below and paste it into a blank notepad, then save it to your desktop as;

Filename: CFScript.txt
Save As Type: All Files (*.*)

Code:

KillAll::
ADS::
C:\WINDOWS\explorer.exe

Please disable realtime protection applications as they sometimes interfere with the tool. Check this link for your applicable programs.

Close all other windows and programs. Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button. Combofix should run (agree to it's use) and may reboot the computer when it's done. A log will open when it's complete. Post the contents of that log.

Please do not click on the ComboFix window while it is running a scan. This can cause it to stall.

 

Dave, got a lg which I will post below, but also got a box to abort, retry , or ignore with the following warning and a red X

Debug assertion failed!

Program: C;\hp\drivers\hplsbwatcher\lsburnwatcher.exe
File: c:\program files\microsoft virtualstudio.net 2003\vc7\atlmfc\nclude/\atlfile.h
Line:188

Expression: m_h ! +0

Forimformation on how your program can cause an assertion failure, see the Visual C ++ documentation on asserts.

( press retry to debug the application )

I will post the log in the next box