Solved Remove XP antivirus Warning

Malware and Virus Removal

I have limited computer experience and everything went well until I got to the dragging part. I saved to my desktop, then I could not find combofix and could not drag the title. Is there something else I know about the dragging process?
Your directions were excellent.
Thanks for your help.

Dee

 

Click > here < to initiate a download of ComboFix.
When the File Download dialog pops up, click Save.
Another dialog will open. Along the left side, click Desktop.
Now click the Save button.
When the download completes, click Close and you should see the ComboFix icon on your desktop.
Now left click and hold on the CFScript.txt file created previously, then drag it over top of the ComboFix icon and release the left mouse click to drop the file.

Click here to see how to use CFScript.txt

 

Malware and Virus Removal

ComboFix 08-08-08.07 - Dee 2008-08-08 21:47:40.6 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.149 [GMT -4:00]
Running from: C:\Documents and Settings\Dee\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Dee\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-07-09 to 2008-08-09 )))))))))))))))))))))))))))))))
.

2008-08-08 16:48 . 2008-08-08 16:48 268 --ah----- C:\sqmdata07.sqm
2008-08-08 16:48 . 2008-08-08 16:48 244 --ah----- C:\sqmnoopt07.sqm
2008-08-08 11:28 . 2008-08-08 11:28 268 --ah----- C:\sqmdata06.sqm
2008-08-08 11:28 . 2008-08-08 11:28 244 --ah----- C:\sqmnoopt06.sqm
2008-08-07 10:39 . 2008-08-07 10:39 268 --ah----- C:\sqmdata05.sqm
2008-08-07 10:39 . 2008-08-07 10:39 244 --ah----- C:\sqmnoopt05.sqm
2008-08-07 00:00 . 2008-08-07 00:00 268 --ah----- C:\sqmdata04.sqm
2008-08-07 00:00 . 2008-08-07 00:00 244 --ah----- C:\sqmnoopt04.sqm
2008-08-06 16:39 . 2008-08-06 16:39 268 --ah----- C:\sqmdata03.sqm
2008-08-06 16:39 . 2008-08-06 16:39 244 --ah----- C:\sqmnoopt03.sqm
2008-08-06 09:53 . 2008-08-06 09:53 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-08-06 09:53 . 2008-08-06 09:53 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-08-06 09:21 . 2008-08-06 09:21 268 --ah----- C:\sqmdata02.sqm
2008-08-06 09:21 . 2008-08-06 09:21 244 --ah----- C:\sqmnoopt02.sqm
2008-08-06 03:07 . 2008-08-06 03:07 268 --ah----- C:\sqmdata01.sqm
2008-08-06 03:07 . 2008-08-06 03:07 244 --ah----- C:\sqmnoopt01.sqm
2008-08-05 18:19 . 2008-08-05 18:19 <DIR> d-------- C:\Program Files\ErrorSmart
2008-08-05 03:42 . 2008-08-05 03:42 <DIR> d-------- C:\Program Files\VS Revo Group
2008-08-05 03:35 . 2008-08-06 03:08 <DIR> d-------- C:\Documents and Settings\Dee\Application Data\ErrorSmart
2008-08-05 02:31 . 2008-08-05 02:31 <DIR> d-------- C:\Program Files\Sun
2008-08-05 02:31 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-08-05 02:29 . 2008-08-05 02:30 <DIR> d-------- C:\Program Files\Java
2008-08-05 02:29 . 2008-08-05 02:29 <DIR> d-------- C:\Program Files\Common Files\Java
2008-08-04 17:21 . 2008-08-04 17:26 <DIR> d-------- C:\Documents and Settings\ted\Application Data\ErrorSmart
2008-08-04 16:55 . 2008-08-04 16:55 <DIR> d-------- C:\Documents and Settings\Dee\Application Data\Viewpoint
2008-08-04 16:54 . 2008-08-04 16:54 <DIR> d-------- C:\Documents and Settings\Dee\Application Data\Yahoo!
2008-08-04 16:54 . 2008-08-04 16:54 244 --ah----- C:\sqmnoopt00.sqm
2008-08-04 16:54 . 2008-08-04 16:54 232 --ah----- C:\sqmdata00.sqm
2008-08-04 16:52 . 2008-08-04 16:55 <DIR> d-------- C:\Documents and Settings\Dee\Application Data\AOL
2008-08-04 16:49 . 2008-08-04 16:49 <DIR> d-------- C:\Documents and Settings\Dee
2008-08-04 14:05 . 2008-08-04 14:05 <DIR> d-------- C:\Program Files\Universal
2008-08-04 13:54 . 2008-08-04 13:54 230 --a------ C:\WINDOWS\system32\spupdsvc.inf
2008-08-03 18:45 . 2008-08-03 18:45 <DIR> d-------- C:\Deckard
2008-08-03 18:34 . 2008-08-03 18:34 <DIR> d-------- C:\Program Files\Trend Micro
2008-08-03 18:25 . 2008-08-03 18:25 42 --a------ C:\WINDOWS\system32\AK083E209605E394C.lie
2008-08-03 18:00 . 2008-08-03 18:00 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Viewpoint
2008-08-03 17:59 . 2008-08-03 17:59 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\AOL
2008-08-03 17:52 . 2008-08-03 17:52 <DIR> d-------- C:\Documents and Settings\Administrator

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-09 01:28 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-08-05 06:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL OCP
2008-08-05 06:21 --------- d-----w C:\Program Files\Common Files\AOL
2008-08-05 06:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL Downloads
2008-08-04 18:14 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-07-26 23:55 --------- d-----w C:\Program Files\XoftSpySE
2008-07-15 22:47 --------- d-----w C:\Program Files\Detroit
2008-07-15 22:46 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE
2008-07-15 22:46 249,856 ------w C:\WINDOWS\Setup1.exe
2008-07-06 20:37 --------- d-----w C:\Program Files\Driver-Soft
2008-07-06 20:05 --------- d-----w C:\Program Files\Lexmark X6100 Series
2008-06-27 21:01 --------- d-----w C:\Program Files\Pure Networks
2008-06-27 21:00 --------- d-----w C:\Program Files\Common Files\Pure Networks Shared
2008-06-27 21:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\Pure Networks
2008-06-26 22:31 --------- d-----w C:\Program Files\ParetoLogic
2008-06-26 22:31 --------- d-----w C:\Program Files\Common Files\ParetoLogic
2008-06-26 22:31 --------- d-----w C:\Documents and Settings\ted\Application Data\ParetoLogic
2008-06-26 22:31 --------- d-----w C:\Documents and Settings\All Users\Application Data\ParetoLogic
2008-06-26 22:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Downloaded Installations
2008-06-25 17:27 --------- d-----w C:\Documents and Settings\ted\Application Data\AOL
2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-20 00:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL
2008-06-19 20:08 --------- d-----w C:\Documents and Settings\ted\Application Data\acccore
2008-06-19 17:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft
2008-06-19 17:18 --------- d-----w C:\Documents and Settings\NetworkService\Application Data\Symantec
2008-06-19 17:12 --------- d-----w C:\Program Files\Norton SystemWorks
2008-06-19 17:04 --------- d-----w C:\Program Files\Symantec
2008-06-19 17:04 --------- d-----w C:\Documents and Settings\ted\Application Data\Symantec
2008-06-19 17:04 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-06-18 18:01 --------- d-----w C:\Program Files\Common Files\AdvancedCleaner
2008-06-18 17:30 1,700 ----a-w C:\WINDOWS\system32\tmp.reg
2008-06-18 17:28 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-18 17:28 --------- d-----w C:\Program Files\Common Files\Panda Software
2008-06-18 17:26 --------- d-----w C:\Program Files\AOL Deskbar
2008-06-18 17:25 --------- d-----w C:\Program Files\AWS
2008-06-15 19:28 81,920 ----a-w C:\WINDOWS\system32\IEDFix.C.exe
2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-09 13:01 --------- d-----w C:\Program Files\Common Files\Real
2008-05-23 22:21 81,920 ----a-w C:\WINDOWS\system32\404Fix.exe
2008-05-16 10:02 487,424 ----a-w C:\WINDOWS\system32\msvcp70.dll
1998-12-09 02:53 99,840 ----a-w C:\Program Files\Common Files\IRAABOUT.DLL
1998-12-09 02:53 70,144 ----a-w C:\Program Files\Common Files\IRAMDMTR.DLL
1998-12-09 02:53 48,640 ----a-w C:\Program Files\Common Files\IRALPTTR.DLL
1998-12-09 02:53 31,744 ----a-w C:\Program Files\Common Files\IRAWEBTR.DLL
1998-12-09 02:53 186,368 ----a-w C:\Program Files\Common Files\IRAREG.DLL
1998-12-09 02:53 17,920 ----a-w C:\Program Files\Common Files\IRASRIAL.DLL
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{45174314-58E7-4790-BCCF-C05FE1CB7B67}]
C:\WINDOWS\system32\comre.dll [BU]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr "= "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 12:34 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelliPoint "= "c:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2006-11-21 18:09 842584]
"ccApp "= "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2002-08-19 22:22 50880]
"ccRegVfy "= "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe" [2002-08-19 22:23 34504]
"HostManager "= "C:\Program Files\Common Files\AOL\1211853138\ee\AOLSoftware.exe" [2007-10-08 17:50 41824]
"VX3000 "= "C:\WINDOWS\vVX3000.exe" [2006-12-05 19:38 707360]
"nmctxth "= "C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2008-05-16 06:11 648504]
"nmapp "= "C:\Program Files\Pure Networks\Network Magic\nmapp.exe" [2008-05-16 05:57 451896]
"QuickTime Task "= "C:\Program Files\QuickTime\qttask.exe" [2007-02-05 19:10 98304]
"Lexmark X6100 Series "= "C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe" [2003-05-16 06:10 57344]
"lphc7abj0e7c7 "= "C:\WINDOWS\system32\lphc7abj0e7c7.exe" [BU]
"SMrhc3abj0e7c7 "= "C:\Program Files\rhc3abj0e7c7\rhc3abj0e7c7.exe" [BU]
"SiteAdvisor "= "C:\Program Files\SiteAdvisor\6172\SiteAdv.exe" [BU]
"SiSUSBRG "= "C:\WINDOWS\SiSUSBrg.exe" [2002-07-12 06:15 106496]
"SiS Windows KeyHook "= "C:\WINDOWS\system32\keyhook.exe" [2004-05-12 17:22 249856]
"RealTray "= "C:\Program Files\Real\RealPlayer\RealPlay.exe" [2007-02-05 19:09 26112]
"PinnacleDriverCheck "= "C:\WINDOWS\system32\PSDrvCheck.exe" [2003-11-10 17:06 406016]
"NeroFilterCheck "= "C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648]
"My Web Search Bar Search Scope Monitor "= "C:\PROGRA~1\MYWEBS~2\bar\1.bin\m3SrchMn.exe" [BU]
"LifeCam "= "C:\Program Files\Microsoft LifeCam\LifeExp.exe" [2007-01-12 21:48 275800]
"ISUSScheduler "= "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-06-16 07:03 81920]
"ISUSPM Startup "= "C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-06-16 07:03 221184]
"AOLDialer "= "C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" [2006-10-23 08:50 71216]
"Adobe Reader Speed Launcher "= "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"ADC_286449925 "= "C:\Program Files\Common Files\AdvancedCleaner\ADCcw.exe" [BU]
"SunJavaUpdateSched "= "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"SoundMan "= "SOUNDMAN.EXE" [2004-02-26 04:53 65024 C:\WINDOWS\SOUNDMAN.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ALUAlert "= "C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe" [2002-08-07 09:04 54936]

C:\Documents and Settings\ted\Start Menu\Programs\Startup\
AOL Desktop.lnk - C:\Program Files\Common Files\AOL\Launch\aollaunch.exe [2007-04-12 17:23:33 42032]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 16:05:56 65588]
Symantec Fax Starter Edition Port.lnk - C:\Program Files\Microsoft Office\Office\1033\OLFSNT40.EXE [1998-12-23 17:51:54 45568]
Utility Tray.lnk - C:\WINDOWS\system32\sistray.exe [2007-02-05 18:30:32 335872]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup=C:\WINDOWS\pss\Kodak EasyShare software.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak software updater.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak software updater.lnk
backup=C:\WINDOWS\pss\Kodak software updater.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ErrorSmart]
--a------ 2008-07-31 13:56 16094456 C:\Program Files\ErrorSmart\ErrorSmart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe "=
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe "=
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe "=
"C:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe "=
"C:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\backWeb-7288971.exe "=
"C:\\WINDOWS\\system32\\LEXPPS.EXE "=
"C:\\Program Files\\Microsoft LifeCam\\LifeCam.exe "=
"C:\\Program Files\\Microsoft LifeCam\\LifeExp.exe "=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe "=
"C:\\Program Files\\Common Files\\AOL\\1211853138\\ee\\aolsoftware.exe "=
"C:\\Program Files\\AOL 9.1\\waol.exe "=
"C:\\Program Files\\Common Files\\AOL\\TopSpeed\\3.0\\aoltpsd3.exe "=
"C:\\Program Files\\Common Files\\AOL\\1211853138\\ee\\AOLDesktop.exe "=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"67:UDP "= 67:UDPHCP Discovery Service

R0 VOBID;VOBID;C:\WINDOWS\system32\DRIVERS\vobid.sys [2003-08-01 15:47]
R1 vobiw;vobiw;C:\WINDOWS\system32\drivers\vobiw.sys [2004-07-06 18:06]
R2 MSCamSvc;MSCamSvc;C:\Program Files\Microsoft LifeCam\MSCamS32.exe [2007-01-04 18:13]
R2 Winferno Subscription Service;Winferno Subscription Service;C:\Program Files\Common Files\Winferno\WSS\WSS.exe [2007-09-07 11:00]
R3 cdrdrv;Cdrdrv;C:\WINDOWS\system32\Drivers\Cdrdrv.sys [2004-06-01 13:41]
S3 FXDRV;FXDRV;D:\Fxdrv.sys []

*Newly Created Service* - CATCHME
.
Contents of the 'Scheduled Tasks' folder

2008-08-09 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 12:20]

2008-08-08 C:\WINDOWS\Tasks\ErrorSmart Scheduled Scan.job
- C:\Program Files\ErrorSmart\ErrorSmart.exe [2008-07-31 13:56]

2008-08-08 C:\WINDOWS\Tasks\ErrorSmart Scheduled Scan.job
- C:\Program Files\ErrorSmart [2008-08-05 18:19]

2008-08-09 C:\WINDOWS\Tasks\Norton AntiVirus - Scan my computer.job
- C:\PROGRA~1\NORTON~1\NORTON~1\NAVW32.exe [2002-11-14 19:31]

2008-08-08 C:\WINDOWS\Tasks\Norton SystemWorks One Button Checkup.job
- C:\Program Files\Norton SystemWorks\OBC.exe [2002-08-29 21:30]

2008-08-08 C:\WINDOWS\Tasks\ParetoLogic Update.job
- C:\Program Files\Common Files\ParetoLogic\UUS2\Pareto_Update.exe [2007-09-19 00:55]

2008-08-09 C:\WINDOWS\Tasks\Symantec NetDetect.job
- C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE [2002-08-07 09:04]

2008-08-08 C:\WINDOWS\Tasks\WSSHelper.job
- C:\Program Files\Common Files\Winferno\WSS\WSSHelper.exe [2007-07-26 13:49]
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-08 21:49:54
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-08-08 21:51:44
ComboFix-quarantined-files.txt 2008-08-09 01:51:29
ComboFix2.txt 2008-08-09 01:43:23
ComboFix3.txt 2008-08-08 16:17:06
ComboFix4.txt 2008-08-04 12:12:53
ComboFix5.txt 2008-08-09 01:47:08

Pre-Run: 49,596,026,880 bytes free
Post-Run: 49,580,736,512 bytes free

217 --- E O F --- 2008-08-06 07:01:24

 

You successfully ran ComboFix using CFScript.txt, but it appears as though the CFScript was empty. Lets try again. Just make sure the CFScript file does contain the correct information after you save it (close it then re-open it).

Once again, please disable any realtime protection applications. Highlight and copy the contents of the code box below and paste it into a blank notepad, then save it to your desktop as;

Filename: CFScript.txt
Save As Type: All Files (*.*)

Code:

KillAll::
File::
C:\Documents and Settings\Administrator\Desktop\sdsetup.exe
C:\Documents and Settings\Dee\Desktop\setupxv(2).exe
C:\Documents and Settings\Dee\Desktop\setupxv.exe
C:\Documents and Settings\ted\Desktop\setupxv(2).exe
C:\Documents and Settings\ted\Desktop\setupxv.exe
C:\WINDOWS\Tasks\ErrorSmart Scheduled Scan.job
Folder::
C:\Program Files\ErrorSmart
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{45174314-58E7-4790-BCCF-C05FE1CB7B67}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
 "lphc7abj0e7c7 "=-
 "SMrhc3abj0e7c7 "=-
 "ADC_286449925 "=-
 "My Web Search Bar Search Scope Monitor "=-
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ErrorSmart]

Close all other windows and programs. Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button. Combofix should run and may reboot the computer when it's done. A log will open when it's complete. Post the contents of that log.

Please do not click on the ComboFix window while it is running a scan. This can cause it to stall.

 

Malware and Virus Removal

ComboFix 08-08-08.07 - Dee 2008-08-09 0:50:13.8 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.73 [GMT -4:00]
Running from: C:\Documents and Settings\Dee\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-07-09 to 2008-08-09 )))))))))))))))))))))))))))))))
.

2008-08-08 23:02 . 2008-08-08 23:02 268 --ah----- C:\sqmdata08.sqm
2008-08-08 23:02 . 2008-08-08 23:02 244 --ah----- C:\sqmnoopt08.sqm
2008-08-08 16:48 . 2008-08-08 16:48 268 --ah----- C:\sqmdata07.sqm
2008-08-08 16:48 . 2008-08-08 16:48 244 --ah----- C:\sqmnoopt07.sqm
2008-08-08 11:28 . 2008-08-08 11:28 268 --ah----- C:\sqmdata06.sqm
2008-08-08 11:28 . 2008-08-08 11:28 244 --ah----- C:\sqmnoopt06.sqm
2008-08-07 10:39 . 2008-08-07 10:39 268 --ah----- C:\sqmdata05.sqm
2008-08-07 10:39 . 2008-08-07 10:39 244 --ah----- C:\sqmnoopt05.sqm
2008-08-07 00:00 . 2008-08-07 00:00 268 --ah----- C:\sqmdata04.sqm
2008-08-07 00:00 . 2008-08-07 00:00 244 --ah----- C:\sqmnoopt04.sqm
2008-08-06 16:39 . 2008-08-06 16:39 268 --ah----- C:\sqmdata03.sqm
2008-08-06 16:39 . 2008-08-06 16:39 244 --ah----- C:\sqmnoopt03.sqm
2008-08-06 09:53 . 2008-08-06 09:53 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-08-06 09:53 . 2008-08-06 09:53 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-08-06 09:21 . 2008-08-06 09:21 268 --ah----- C:\sqmdata02.sqm
2008-08-06 09:21 . 2008-08-06 09:21 244 --ah----- C:\sqmnoopt02.sqm
2008-08-06 03:07 . 2008-08-06 03:07 268 --ah----- C:\sqmdata01.sqm
2008-08-06 03:07 . 2008-08-06 03:07 244 --ah----- C:\sqmnoopt01.sqm
2008-08-05 03:42 . 2008-08-05 03:42 <DIR> d-------- C:\Program Files\VS Revo Group
2008-08-05 03:35 . 2008-08-06 03:08 <DIR> d-------- C:\Documents and Settings\Dee\Application Data\ErrorSmart
2008-08-05 02:31 . 2008-08-05 02:31 <DIR> d-------- C:\Program Files\Sun
2008-08-05 02:31 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-08-05 02:29 . 2008-08-05 02:30 <DIR> d-------- C:\Program Files\Java
2008-08-05 02:29 . 2008-08-05 02:29 <DIR> d-------- C:\Program Files\Common Files\Java
2008-08-04 17:21 . 2008-08-04 17:26 <DIR> d-------- C:\Documents and Settings\ted\Application Data\ErrorSmart
2008-08-04 16:55 . 2008-08-04 16:55 <DIR> d-------- C:\Documents and Settings\Dee\Application Data\Viewpoint
2008-08-04 16:54 . 2008-08-04 16:54 <DIR> d-------- C:\Documents and Settings\Dee\Application Data\Yahoo!
2008-08-04 16:54 . 2008-08-04 16:54 244 --ah----- C:\sqmnoopt00.sqm
2008-08-04 16:54 . 2008-08-04 16:54 232 --ah----- C:\sqmdata00.sqm
2008-08-04 16:52 . 2008-08-04 16:55 <DIR> d-------- C:\Documents and Settings\Dee\Application Data\AOL
2008-08-04 16:49 . 2008-08-04 16:49 <DIR> d-------- C:\Documents and Settings\Dee
2008-08-04 14:05 . 2008-08-04 14:05 <DIR> d-------- C:\Program Files\Universal
2008-08-04 13:54 . 2008-08-04 13:54 230 --a------ C:\WINDOWS\system32\spupdsvc.inf
2008-08-03 18:45 . 2008-08-03 18:45 <DIR> d-------- C:\Deckard
2008-08-03 18:34 . 2008-08-03 18:34 <DIR> d-------- C:\Program Files\Trend Micro
2008-08-03 18:25 . 2008-08-03 18:25 42 --a------ C:\WINDOWS\system32\AK083E209605E394C.lie
2008-08-03 18:00 . 2008-08-03 18:00 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Viewpoint
2008-08-03 17:59 . 2008-08-03 17:59 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\AOL
2008-08-03 17:52 . 2008-08-03 17:52 <DIR> d-------- C:\Documents and Settings\Administrator

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-09 03:04 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-08-05 06:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL OCP
2008-08-05 06:21 --------- d-----w C:\Program Files\Common Files\AOL
2008-08-05 06:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL Downloads
2008-08-04 18:14 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-07-26 23:55 --------- d-----w C:\Program Files\XoftSpySE
2008-07-15 22:47 --------- d-----w C:\Program Files\Detroit
2008-07-15 22:46 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE
2008-07-15 22:46 249,856 ------w C:\WINDOWS\Setup1.exe
2008-07-06 20:37 --------- d-----w C:\Program Files\Driver-Soft
2008-07-06 20:05 --------- d-----w C:\Program Files\Lexmark X6100 Series
2008-06-27 21:01 --------- d-----w C:\Program Files\Pure Networks
2008-06-27 21:00 --------- d-----w C:\Program Files\Common Files\Pure Networks Shared
2008-06-27 21:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\Pure Networks
2008-06-26 22:31 --------- d-----w C:\Program Files\ParetoLogic
2008-06-26 22:31 --------- d-----w C:\Program Files\Common Files\ParetoLogic
2008-06-26 22:31 --------- d-----w C:\Documents and Settings\ted\Application Data\ParetoLogic
2008-06-26 22:31 --------- d-----w C:\Documents and Settings\All Users\Application Data\ParetoLogic
2008-06-26 22:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Downloaded Installations
2008-06-25 17:27 --------- d-----w C:\Documents and Settings\ted\Application Data\AOL
2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-20 00:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL
2008-06-19 20:08 --------- d-----w C:\Documents and Settings\ted\Application Data\acccore
2008-06-19 17:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft
2008-06-19 17:18 --------- d-----w C:\Documents and Settings\NetworkService\Application Data\Symantec
2008-06-19 17:12 --------- d-----w C:\Program Files\Norton SystemWorks
2008-06-19 17:04 --------- d-----w C:\Program Files\Symantec
2008-06-19 17:04 --------- d-----w C:\Documents and Settings\ted\Application Data\Symantec
2008-06-19 17:04 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-06-18 18:01 --------- d-----w C:\Program Files\Common Files\AdvancedCleaner
2008-06-18 17:30 1,700 ----a-w C:\WINDOWS\system32\tmp.reg
2008-06-18 17:28 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-18 17:28 --------- d-----w C:\Program Files\Common Files\Panda Software
2008-06-18 17:26 --------- d-----w C:\Program Files\AOL Deskbar
2008-06-18 17:25 --------- d-----w C:\Program Files\AWS
2008-06-15 19:28 81,920 ----a-w C:\WINDOWS\system32\IEDFix.C.exe
2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-09 13:01 --------- d-----w C:\Program Files\Common Files\Real
2008-05-23 22:21 81,920 ----a-w C:\WINDOWS\system32\404Fix.exe
2008-05-16 10:02 487,424 ----a-w C:\WINDOWS\system32\msvcp70.dll
1998-12-09 02:53 99,840 ----a-w C:\Program Files\Common Files\IRAABOUT.DLL
1998-12-09 02:53 70,144 ----a-w C:\Program Files\Common Files\IRAMDMTR.DLL
1998-12-09 02:53 48,640 ----a-w C:\Program Files\Common Files\IRALPTTR.DLL
1998-12-09 02:53 31,744 ----a-w C:\Program Files\Common Files\IRAWEBTR.DLL
1998-12-09 02:53 186,368 ----a-w C:\Program Files\Common Files\IRAREG.DLL
1998-12-09 02:53 17,920 ----a-w C:\Program Files\Common Files\IRASRIAL.DLL
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{45174314-58E7-4790-BCCF-C05FE1CB7B67}]
C:\WINDOWS\system32\comre.dll [BU]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr "= "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 12:34 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelliPoint "= "c:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2006-11-21 18:09 842584]
"ccApp "= "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2002-08-19 22:22 50880]
"ccRegVfy "= "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe" [2002-08-19 22:23 34504]
"HostManager "= "C:\Program Files\Common Files\AOL\1211853138\ee\AOLSoftware.exe" [2007-10-08 17:50 41824]
"VX3000 "= "C:\WINDOWS\vVX3000.exe" [2006-12-05 19:38 707360]
"nmctxth "= "C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2008-05-16 06:11 648504]
"nmapp "= "C:\Program Files\Pure Networks\Network Magic\nmapp.exe" [2008-05-16 05:57 451896]
"QuickTime Task "= "C:\Program Files\QuickTime\qttask.exe" [2007-02-05 19:10 98304]
"Lexmark X6100 Series "= "C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe" [2003-05-16 06:10 57344]
"lphc7abj0e7c7 "= "C:\WINDOWS\system32\lphc7abj0e7c7.exe" [BU]
"SMrhc3abj0e7c7 "= "C:\Program Files\rhc3abj0e7c7\rhc3abj0e7c7.exe" [BU]
"SiteAdvisor "= "C:\Program Files\SiteAdvisor\6172\SiteAdv.exe" [BU]
"SiSUSBRG "= "C:\WINDOWS\SiSUSBrg.exe" [2002-07-12 06:15 106496]
"SiS Windows KeyHook "= "C:\WINDOWS\system32\keyhook.exe" [2004-05-12 17:22 249856]
"RealTray "= "C:\Program Files\Real\RealPlayer\RealPlay.exe" [2007-02-05 19:09 26112]
"PinnacleDriverCheck "= "C:\WINDOWS\system32\PSDrvCheck.exe" [2003-11-10 17:06 406016]
"NeroFilterCheck "= "C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648]
"My Web Search Bar Search Scope Monitor "= "C:\PROGRA~1\MYWEBS~2\bar\1.bin\m3SrchMn.exe" [BU]
"LifeCam "= "C:\Program Files\Microsoft LifeCam\LifeExp.exe" [2007-01-12 21:48 275800]
"ISUSScheduler "= "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-06-16 07:03 81920]
"ISUSPM Startup "= "C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-06-16 07:03 221184]
"AOLDialer "= "C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" [2006-10-23 08:50 71216]
"Adobe Reader Speed Launcher "= "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"ADC_286449925 "= "C:\Program Files\Common Files\AdvancedCleaner\ADCcw.exe" [BU]
"SunJavaUpdateSched "= "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"SoundMan "= "SOUNDMAN.EXE" [2004-02-26 04:53 65024 C:\WINDOWS\SOUNDMAN.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ALUAlert "= "C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe" [2002-08-07 09:04 54936]

C:\Documents and Settings\ted\Start Menu\Programs\Startup\
AOL Desktop.lnk - C:\Program Files\Common Files\AOL\Launch\aollaunch.exe [2007-04-12 17:23:33 42032]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 16:05:56 65588]
Symantec Fax Starter Edition Port.lnk - C:\Program Files\Microsoft Office\Office\1033\OLFSNT40.EXE [1998-12-23 17:51:54 45568]
Utility Tray.lnk - C:\WINDOWS\system32\sistray.exe [2007-02-05 18:30:32 335872]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup=C:\WINDOWS\pss\Kodak EasyShare software.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak software updater.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak software updater.lnk
backup=C:\WINDOWS\pss\Kodak software updater.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe "=
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe "=
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe "=
"C:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe "=
"C:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\backWeb-7288971.exe "=
"C:\\WINDOWS\\system32\\LEXPPS.EXE "=
"C:\\Program Files\\Microsoft LifeCam\\LifeCam.exe "=
"C:\\Program Files\\Microsoft LifeCam\\LifeExp.exe "=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe "=
"C:\\Program Files\\Common Files\\AOL\\1211853138\\ee\\aolsoftware.exe "=
"C:\\Program Files\\AOL 9.1\\waol.exe "=
"C:\\Program Files\\Common Files\\AOL\\TopSpeed\\3.0\\aoltpsd3.exe "=
"C:\\Program Files\\Common Files\\AOL\\1211853138\\ee\\AOLDesktop.exe "=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"67:UDP "= 67:UDPHCP Discovery Service

R0 VOBID;VOBID;C:\WINDOWS\system32\DRIVERS\vobid.sys [2003-08-01 15:47]
R1 vobiw;vobiw;C:\WINDOWS\system32\drivers\vobiw.sys [2004-07-06 18:06]
R2 MSCamSvc;MSCamSvc;C:\Program Files\Microsoft LifeCam\MSCamS32.exe [2007-01-04 18:13]
R2 Winferno Subscription Service;Winferno Subscription Service;C:\Program Files\Common Files\Winferno\WSS\WSS.exe [2007-09-07 11:00]
R3 cdrdrv;Cdrdrv;C:\WINDOWS\system32\Drivers\Cdrdrv.sys [2004-06-01 13:41]
S3 FXDRV;FXDRV;D:\Fxdrv.sys []
.
Contents of the 'Scheduled Tasks' folder

2008-08-09 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 12:20]

2008-08-08 C:\WINDOWS\Tasks\ErrorSmart Scheduled Scan.job
- C:\Program Files\ErrorSmart\ErrorSmart.exe []

2008-08-08 C:\WINDOWS\Tasks\ErrorSmart Scheduled Scan.job
- C:\Program Files\ErrorSmart []

2008-08-09 C:\WINDOWS\Tasks\Norton AntiVirus - Scan my computer.job
- C:\PROGRA~1\NORTON~1\NORTON~1\NAVW32.exe [2002-11-14 19:31]

2008-08-08 C:\WINDOWS\Tasks\Norton SystemWorks One Button Checkup.job
- C:\Program Files\Norton SystemWorks\OBC.exe [2002-08-29 21:30]

2008-08-09 C:\WINDOWS\Tasks\ParetoLogic Update.job
- C:\Program Files\Common Files\ParetoLogic\UUS2\Pareto_Update.exe [2007-09-19 00:55]

2008-08-09 C:\WINDOWS\Tasks\Symantec NetDetect.job
- C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE [2002-08-07 09:04]

2008-08-09 C:\WINDOWS\Tasks\WSSHelper.job
- C:\Program Files\Common Files\Winferno\WSS\WSSHelper.exe [2007-07-26 13:49]
.
- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-ErrorSmart - C:\Program Files\ErrorSmart\ErrorSmart.exe


.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Dee\Application Data\Mozilla\Firefox\Profiles\20qh97m7.default\
FF -: plugin - C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-09 00:52:26
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-08-09 0:55:44
ComboFix-quarantined-files.txt 2008-08-09 04:55:28
ComboFix2.txt 2008-08-09 04:18:28
ComboFix3.txt 2008-08-09 01:51:45
ComboFix4.txt 2008-08-09 01:43:23
ComboFix5.txt 2008-08-09 04:34:37

Pre-Run: 49,525,903,360 bytes free
Post-Run: 49,511,981,056 bytes free

220 --- E O F --- 2008-08-06 07:01:24

 

Hi Dee,

Please post the contents of the log at C:\Qoobox\ComboFix2.txt

Delete the following file(s)

C:\WINDOWS\Tasks\ErrorSmart Scheduled Scan.job

And the folder C:\Program Files\Common Files\AdvancedCleaner

How's your computer behaving now?

 

Malware and Virus Removal

Dave,

It is much better than it was when we started. It continues to be slow but does not freeze up. You sure have taught me a lot and I have enjoyedit . Explain to me exactly how I am to delete those files. I think I know, but want to be sure.
Will be out for awhile.
Thanks for your help.
Dee

 

Open My Computer, then Local Disk C:, then Windows, then Tasks. You should see the Error Smart job(s). Just right click and delete.
Now go to C:\Program Files\Common Files and delete the AdvancedCleaner folder.

Don't forget please, to post the log at C:\Qoobox\ComboFix2.txt

 

Malware and Virus Removal

Dave,ng
I deleted the files and it's a good thing I ask, that is not at all the way I planned to do them.
I am going to show my ignorance again, I don't understand which log I'm supposed to post. I have so many in Quobox , I have 1 titled combofix # 2 but I don't think this is the correct one. Can you give me dates?
Thanks for your help,
Dee






i

 

That is the one.

 

Malware and Virus Removal

ComboFix 08-08-08.07 - Dee 2008-08-09 0:50:13.8 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.73 [GMT -4:00]
Running from: C:\Documents and Settings\Dee\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-07-09 to 2008-08-09 )))))))))))))))))))))))))))))))
.

2008-08-08 23:02 . 2008-08-08 23:02 268 --ah----- C:\sqmdata08.sqm
2008-08-08 23:02 . 2008-08-08 23:02 244 --ah----- C:\sqmnoopt08.sqm
2008-08-08 16:48 . 2008-08-08 16:48 268 --ah----- C:\sqmdata07.sqm
2008-08-08 16:48 . 2008-08-08 16:48 244 --ah----- C:\sqmnoopt07.sqm
2008-08-08 11:28 . 2008-08-08 11:28 268 --ah----- C:\sqmdata06.sqm
2008-08-08 11:28 . 2008-08-08 11:28 244 --ah----- C:\sqmnoopt06.sqm
2008-08-07 10:39 . 2008-08-07 10:39 268 --ah----- C:\sqmdata05.sqm
2008-08-07 10:39 . 2008-08-07 10:39 244 --ah----- C:\sqmnoopt05.sqm
2008-08-07 00:00 . 2008-08-07 00:00 268 --ah----- C:\sqmdata04.sqm
2008-08-07 00:00 . 2008-08-07 00:00 244 --ah----- C:\sqmnoopt04.sqm
2008-08-06 16:39 . 2008-08-06 16:39 268 --ah----- C:\sqmdata03.sqm
2008-08-06 16:39 . 2008-08-06 16:39 244 --ah----- C:\sqmnoopt03.sqm
2008-08-06 09:53 . 2008-08-06 09:53 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-08-06 09:53 . 2008-08-06 09:53 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-08-06 09:21 . 2008-08-06 09:21 268 --ah----- C:\sqmdata02.sqm
2008-08-06 09:21 . 2008-08-06 09:21 244 --ah----- C:\sqmnoopt02.sqm
2008-08-06 03:07 . 2008-08-06 03:07 268 --ah----- C:\sqmdata01.sqm
2008-08-06 03:07 . 2008-08-06 03:07 244 --ah----- C:\sqmnoopt01.sqm
2008-08-05 03:42 . 2008-08-05 03:42 <DIR> d-------- C:\Program Files\VS Revo Group
2008-08-05 03:35 . 2008-08-06 03:08 <DIR> d-------- C:\Documents and Settings\Dee\Application Data\ErrorSmart
2008-08-05 02:31 . 2008-08-05 02:31 <DIR> d-------- C:\Program Files\Sun
2008-08-05 02:31 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-08-05 02:29 . 2008-08-05 02:30 <DIR> d-------- C:\Program Files\Java
2008-08-05 02:29 . 2008-08-05 02:29 <DIR> d-------- C:\Program Files\Common Files\Java
2008-08-04 17:21 . 2008-08-04 17:26 <DIR> d-------- C:\Documents and Settings\ted\Application Data\ErrorSmart
2008-08-04 16:55 . 2008-08-04 16:55 <DIR> d-------- C:\Documents and Settings\Dee\Application Data\Viewpoint
2008-08-04 16:54 . 2008-08-04 16:54 <DIR> d-------- C:\Documents and Settings\Dee\Application Data\Yahoo!
2008-08-04 16:54 . 2008-08-04 16:54 244 --ah----- C:\sqmnoopt00.sqm
2008-08-04 16:54 . 2008-08-04 16:54 232 --ah----- C:\sqmdata00.sqm
2008-08-04 16:52 . 2008-08-04 16:55 <DIR> d-------- C:\Documents and Settings\Dee\Application Data\AOL
2008-08-04 16:49 . 2008-08-04 16:49 <DIR> d-------- C:\Documents and Settings\Dee
2008-08-04 14:05 . 2008-08-04 14:05 <DIR> d-------- C:\Program Files\Universal
2008-08-04 13:54 . 2008-08-04 13:54 230 --a------ C:\WINDOWS\system32\spupdsvc.inf
2008-08-03 18:45 . 2008-08-03 18:45 <DIR> d-------- C:\Deckard
2008-08-03 18:34 . 2008-08-03 18:34 <DIR> d-------- C:\Program Files\Trend Micro
2008-08-03 18:25 . 2008-08-03 18:25 42 --a------ C:\WINDOWS\system32\AK083E209605E394C.lie
2008-08-03 18:00 . 2008-08-03 18:00 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Viewpoint
2008-08-03 17:59 . 2008-08-03 17:59 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\AOL
2008-08-03 17:52 . 2008-08-03 17:52 <DIR> d-------- C:\Documents and Settings\Administrator

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-09 03:04 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-08-05 06:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL OCP
2008-08-05 06:21 --------- d-----w C:\Program Files\Common Files\AOL
2008-08-05 06:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL Downloads
2008-08-04 18:14 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-07-26 23:55 --------- d-----w C:\Program Files\XoftSpySE
2008-07-15 22:47 --------- d-----w C:\Program Files\Detroit
2008-07-15 22:46 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE
2008-07-15 22:46 249,856 ------w C:\WINDOWS\Setup1.exe
2008-07-06 20:37 --------- d-----w C:\Program Files\Driver-Soft
2008-07-06 20:05 --------- d-----w C:\Program Files\Lexmark X6100 Series
2008-06-27 21:01 --------- d-----w C:\Program Files\Pure Networks
2008-06-27 21:00 --------- d-----w C:\Program Files\Common Files\Pure Networks Shared
2008-06-27 21:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\Pure Networks
2008-06-26 22:31 --------- d-----w C:\Program Files\ParetoLogic
2008-06-26 22:31 --------- d-----w C:\Program Files\Common Files\ParetoLogic
2008-06-26 22:31 --------- d-----w C:\Documents and Settings\ted\Application Data\ParetoLogic
2008-06-26 22:31 --------- d-----w C:\Documents and Settings\All Users\Application Data\ParetoLogic
2008-06-26 22:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Downloaded Installations
2008-06-25 17:27 --------- d-----w C:\Documents and Settings\ted\Application Data\AOL
2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-20 00:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL
2008-06-19 20:08 --------- d-----w C:\Documents and Settings\ted\Application Data\acccore
2008-06-19 17:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft
2008-06-19 17:18 --------- d-----w C:\Documents and Settings\NetworkService\Application Data\Symantec
2008-06-19 17:12 --------- d-----w C:\Program Files\Norton SystemWorks
2008-06-19 17:04 --------- d-----w C:\Program Files\Symantec
2008-06-19 17:04 --------- d-----w C:\Documents and Settings\ted\Application Data\Symantec
2008-06-19 17:04 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-06-18 18:01 --------- d-----w C:\Program Files\Common Files\AdvancedCleaner
2008-06-18 17:30 1,700 ----a-w C:\WINDOWS\system32\tmp.reg
2008-06-18 17:28 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-18 17:28 --------- d-----w C:\Program Files\Common Files\Panda Software
2008-06-18 17:26 --------- d-----w C:\Program Files\AOL Deskbar
2008-06-18 17:25 --------- d-----w C:\Program Files\AWS
2008-06-15 19:28 81,920 ----a-w C:\WINDOWS\system32\IEDFix.C.exe
2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-09 13:01 --------- d-----w C:\Program Files\Common Files\Real
2008-05-23 22:21 81,920 ----a-w C:\WINDOWS\system32\404Fix.exe
2008-05-16 10:02 487,424 ----a-w C:\WINDOWS\system32\msvcp70.dll
1998-12-09 02:53 99,840 ----a-w C:\Program Files\Common Files\IRAABOUT.DLL
1998-12-09 02:53 70,144 ----a-w C:\Program Files\Common Files\IRAMDMTR.DLL
1998-12-09 02:53 48,640 ----a-w C:\Program Files\Common Files\IRALPTTR.DLL
1998-12-09 02:53 31,744 ----a-w C:\Program Files\Common Files\IRAWEBTR.DLL
1998-12-09 02:53 186,368 ----a-w C:\Program Files\Common Files\IRAREG.DLL
1998-12-09 02:53 17,920 ----a-w C:\Program Files\Common Files\IRASRIAL.DLL
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{45174314-58E7-4790-BCCF-C05FE1CB7B67}]
C:\WINDOWS\system32\comre.dll [BU]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr "= "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 12:34 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelliPoint "= "c:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2006-11-21 18:09 842584]
"ccApp "= "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2002-08-19 22:22 50880]
"ccRegVfy "= "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe" [2002-08-19 22:23 34504]
"HostManager "= "C:\Program Files\Common Files\AOL\1211853138\ee\AOLSoftware.exe" [2007-10-08 17:50 41824]
"VX3000 "= "C:\WINDOWS\vVX3000.exe" [2006-12-05 19:38 707360]
"nmctxth "= "C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2008-05-16 06:11 648504]
"nmapp "= "C:\Program Files\Pure Networks\Network Magic\nmapp.exe" [2008-05-16 05:57 451896]
"QuickTime Task "= "C:\Program Files\QuickTime\qttask.exe" [2007-02-05 19:10 98304]
"Lexmark X6100 Series "= "C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe" [2003-05-16 06:10 57344]
"lphc7abj0e7c7 "= "C:\WINDOWS\system32\lphc7abj0e7c7.exe" [BU]
"SMrhc3abj0e7c7 "= "C:\Program Files\rhc3abj0e7c7\rhc3abj0e7c7.exe" [BU]
"SiteAdvisor "= "C:\Program Files\SiteAdvisor\6172\SiteAdv.exe" [BU]
"SiSUSBRG "= "C:\WINDOWS\SiSUSBrg.exe" [2002-07-12 06:15 106496]
"SiS Windows KeyHook "= "C:\WINDOWS\system32\keyhook.exe" [2004-05-12 17:22 249856]
"RealTray "= "C:\Program Files\Real\RealPlayer\RealPlay.exe" [2007-02-05 19:09 26112]
"PinnacleDriverCheck "= "C:\WINDOWS\system32\PSDrvCheck.exe" [2003-11-10 17:06 406016]
"NeroFilterCheck "= "C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648]
"My Web Search Bar Search Scope Monitor "= "C:\PROGRA~1\MYWEBS~2\bar\1.bin\m3SrchMn.exe" [BU]
"LifeCam "= "C:\Program Files\Microsoft LifeCam\LifeExp.exe" [2007-01-12 21:48 275800]
"ISUSScheduler "= "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-06-16 07:03 81920]
"ISUSPM Startup "= "C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-06-16 07:03 221184]
"AOLDialer "= "C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" [2006-10-23 08:50 71216]
"Adobe Reader Speed Launcher "= "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"ADC_286449925 "= "C:\Program Files\Common Files\AdvancedCleaner\ADCcw.exe" [BU]
"SunJavaUpdateSched "= "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"SoundMan "= "SOUNDMAN.EXE" [2004-02-26 04:53 65024 C:\WINDOWS\SOUNDMAN.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ALUAlert "= "C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe" [2002-08-07 09:04 54936]

C:\Documents and Settings\ted\Start Menu\Programs\Startup\
AOL Desktop.lnk - C:\Program Files\Common Files\AOL\Launch\aollaunch.exe [2007-04-12 17:23:33 42032]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 16:05:56 65588]
Symantec Fax Starter Edition Port.lnk - C:\Program Files\Microsoft Office\Office\1033\OLFSNT40.EXE [1998-12-23 17:51:54 45568]
Utility Tray.lnk - C:\WINDOWS\system32\sistray.exe [2007-02-05 18:30:32 335872]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup=C:\WINDOWS\pss\Kodak EasyShare software.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak software updater.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak software updater.lnk
backup=C:\WINDOWS\pss\Kodak software updater.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe "=
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe "=
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe "=
"C:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe "=
"C:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\backWeb-7288971.exe "=
"C:\\WINDOWS\\system32\\LEXPPS.EXE "=
"C:\\Program Files\\Microsoft LifeCam\\LifeCam.exe "=
"C:\\Program Files\\Microsoft LifeCam\\LifeExp.exe "=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe "=
"C:\\Program Files\\Common Files\\AOL\\1211853138\\ee\\aolsoftware.exe "=
"C:\\Program Files\\AOL 9.1\\waol.exe "=
"C:\\Program Files\\Common Files\\AOL\\TopSpeed\\3.0\\aoltpsd3.exe "=
"C:\\Program Files\\Common Files\\AOL\\1211853138\\ee\\AOLDesktop.exe "=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"67:UDP "= 67:UDPHCP Discovery Service

R0 VOBID;VOBID;C:\WINDOWS\system32\DRIVERS\vobid.sys [2003-08-01 15:47]
R1 vobiw;vobiw;C:\WINDOWS\system32\drivers\vobiw.sys [2004-07-06 18:06]
R2 MSCamSvc;MSCamSvc;C:\Program Files\Microsoft LifeCam\MSCamS32.exe [2007-01-04 18:13]
R2 Winferno Subscription Service;Winferno Subscription Service;C:\Program Files\Common Files\Winferno\WSS\WSS.exe [2007-09-07 11:00]
R3 cdrdrv;Cdrdrv;C:\WINDOWS\system32\Drivers\Cdrdrv.sys [2004-06-01 13:41]
S3 FXDRV;FXDRV;D:\Fxdrv.sys []
.
Contents of the 'Scheduled Tasks' folder

2008-08-09 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 12:20]

2008-08-08 C:\WINDOWS\Tasks\ErrorSmart Scheduled Scan.job
- C:\Program Files\ErrorSmart\ErrorSmart.exe []

2008-08-08 C:\WINDOWS\Tasks\ErrorSmart Scheduled Scan.job
- C:\Program Files\ErrorSmart []

2008-08-09 C:\WINDOWS\Tasks\Norton AntiVirus - Scan my computer.job
- C:\PROGRA~1\NORTON~1\NORTON~1\NAVW32.exe [2002-11-14 19:31]

2008-08-08 C:\WINDOWS\Tasks\Norton SystemWorks One Button Checkup.job
- C:\Program Files\Norton SystemWorks\OBC.exe [2002-08-29 21:30]

2008-08-09 C:\WINDOWS\Tasks\ParetoLogic Update.job
- C:\Program Files\Common Files\ParetoLogic\UUS2\Pareto_Update.exe [2007-09-19 00:55]

2008-08-09 C:\WINDOWS\Tasks\Symantec NetDetect.job
- C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE [2002-08-07 09:04]

2008-08-09 C:\WINDOWS\Tasks\WSSHelper.job
- C:\Program Files\Common Files\Winferno\WSS\WSSHelper.exe [2007-07-26 13:49]
.
- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-ErrorSmart - C:\Program Files\ErrorSmart\ErrorSmart.exe


.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Dee\Application Data\Mozilla\Firefox\Profiles\20qh97m7.default\
FF -: plugin - C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-09 00:52:26
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-08-09 0:55:44
ComboFix-quarantined-files.txt 2008-08-09 04:55:28
ComboFix2.txt 2008-08-09 04:18:28
ComboFix3.txt 2008-08-09 01:51:45
ComboFix4.txt 2008-08-09 01:43:23
ComboFix5.txt 2008-08-09 04:34:37

Pre-Run: 49,525,903,360 bytes free
Post-Run: 49,511,981,056 bytes free

220 --- E O F --- 2008-08-06 07:01:24

 

Malware and Virus Removal

Hope this is the one.

Dee

 

No, the one I want to see is located in C:\qoobox and is named ComboFix2.txt (unless you have run ComboFix again since the last time, which means the log will be named ComboFix3.txt)
The first line in the log will have the following information.

ComboFix 08-08-08.07 - Dee 2008-08-09 04:18:28.7 - NTFSx86

Make note of the time (in blue) and the run # (in red) above.
The header will also have the following line.

Command switches used :: C:\Documents and Settings\Dee\Desktop\CFScript.txt

 

Malware and Virus Removal

Dave,

I've checked every log I have and I do not any with these rusn times. What do I do now?

Dee

 

That's odd. The last log you posted shows the following.

Completion time: 2008-08-09 0:55:44
ComboFix-quarantined-files.txt 2008-08-09 04:55:28
ComboFix2.txt 2008-08-09 04:18:28
ComboFix3.txt 2008-08-09 01:51:45
ComboFix4.txt 2008-08-09 01:43:23
ComboFix5.txt 2008-08-09 04:34:37

Only ComboFix.txt is located in C: ........ all others (ComboFix2.txt, ComboFix3.txt, etc) are located in C:\Qoobox) Do any of the ComboFix.txt logs show run # 7 as I indicated in red in my previous post? If not, no worries. Just proceed with the following.

Download Deckard's System Scanner (dss.exe) and save it to your desktop.

• Close all applications and windows.
• Double click on dss.exe to run it and follow the prompts.
• When the scan is complete, two text files will open; main.txt, which will be maximized and extra.txt, which will be minimized.

Post the contents of main.txt only for now.

 

Malware and Virus Removal

Deckard's System Scanner v20071014.68
Run by Dee on 2008-08-10 16:53:57
Computer is in Normal Mode.
--------------------------------------------------------------------------------

Percentage of Memory in Use: 83% (more than 75%).
Total Physical Memory: 480 MiB (512 MiB recommended).


-- HijackThis (run as Dee.exe) -------------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:54:05 PM, on 8/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\ScsiAccess.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Winferno\WSS\WSS.exe
C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\AOL\1211853138\ee\AOLSoftware.exe
C:\WINDOWS\vVX3000.exe
C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
C:\Program Files\Pure Networks\Network Magic\nmapp.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe
C:\WINDOWS\system32\keyhook.exe
C:\Program Files\Lexmark X6100 Series\lxbfbmon.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\AOL 9.1\waol.exe
C:\WINDOWS\system32\sistray.exe
C:\Program Files\AOL 9.1\shellmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Dee\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Dee.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: My Web Search Bar BHO - {8EAB99C1-F9EC-4b64-A4BA-D9BCAE8779C2} - C:\Program Files\MyWebSearchWB\bar\1.bin\W6BAR.DLL (file missing)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: WeatherBug Browser Bar - powered by MyWebSearch - {8EAB99C9-F9EC-4b64-A4BA-D9BCAE8779C2} - C:\Program Files\MyWebSearchWB\bar\1.bin\W6BAR.DLL (file missing)
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [IntelliPoint] "c:\Program Files\Microsoft IntelliPoint\ipoint.exe "
O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [ccRegVfy] C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1211853138\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [VX3000] C:\WINDOWS\vVX3000.exe
O4 - HKLM\..\Run: [nmctxth] "C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe "
O4 - HKLM\..\Run: [nmapp] "C:\Program Files\Pure Networks\Network Magic\nmapp.exe" -autorun -nosplash
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Lexmark X6100 Series] "C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe "
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6172\SiteAdv.exe
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe "
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\AOL 9.1\AOL.EXE" -b
O4 - HKUS\S-1-5-18\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.nl/scanforvirus-en/kavwebscan_unicode.cab
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Pure Networks Net2Go Service (nmraapache) - Pure Networks, Inc. - C:\Program Files\Pure Networks\Network Magic\WebServer\bin\nmraapache.exe
O23 - Service: Pure Networks Platform Service (nmservice) - Pure Networks, Inc. - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\system32\ScsiAccess.EXE
O23 - Service: Winferno Subscription Service - Capital Intellect Inc - C:\Program Files\Common Files\Winferno\WSS\WSS.exe

--
End of file - 8731 bytes

-- Files created between 2008-07-10 and 2008-08-10 -----------------------------

2008-08-10 10:07:56 0 d-------- C:\New Folder
2008-08-10 10:05:43 0 d-------- C:\WINDOWS\New Folder
2008-08-08 12:19:31 0 d-------- C:\Documents and Settings\Dee\Application Data\Help
2008-08-06 09:53:38 0 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-08-06 09:53:34 0 d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-08-05 03:42:54 0 d-------- C:\Program Files\VS Revo Group
2008-08-05 03:41:48 0 d-------- C:\Documents and Settings\Dee\Application Data\Adobe
2008-08-05 03:38:18 0 d-------- C:\Documents and Settings\Dee\Application Data\Mozilla
2008-08-05 03:35:01 0 d-------- C:\Documents and Settings\Dee\Application Data\ErrorSmart
2008-08-05 02:31:17 0 d-------- C:\Program Files\Sun
2008-08-05 02:29:58 0 d-------- C:\Program Files\Java
2008-08-05 02:29:37 0 d-------- C:\Program Files\Common Files\Java
2008-08-04 17:21:40 0 d-------- C:\Documents and Settings\ted\Application Data\ErrorSmart
2008-08-04 16:55:59 0 d-------- C:\Documents and Settings\Dee\Application Data\Viewpoint
2008-08-04 16:55:50 0 d-------- C:\Documents and Settings\Dee\Application Data\Macromedia
2008-08-04 16:54:08 0 d-------- C:\Documents and Settings\Dee\Application Data\Yahoo!
2008-08-04 16:52:03 0 d-------- C:\Documents and Settings\Dee\Application Data\AOL
2008-08-04 16:50:13 0 d-------- C:\Documents and Settings\Dee\Application Data\Identities
2008-08-04 16:49:45 0 d--h----- C:\Documents and Settings\Dee\Templates
2008-08-04 16:49:45 0 dr------- C:\Documents and Settings\Dee\Start Menu
2008-08-04 16:49:45 0 dr-h----- C:\Documents and Settings\Dee\SendTo
2008-08-04 16:49:45 0 dr-h----- C:\Documents and Settings\Dee\Recent
2008-08-04 16:49:45 0 d--h----- C:\Documents and Settings\Dee\PrintHood
2008-08-04 16:49:45 1310720 --ah----- C:\Documents and Settings\Dee\NTUSER.DAT
2008-08-04 16:49:45 0 d--h----- C:\Documents and Settings\Dee\NetHood
2008-08-04 16:49:45 0 dr------- C:\Documents and Settings\Dee\My Documents
2008-08-04 16:49:45 0 d--h----- C:\Documents and Settings\Dee\Local Settings
2008-08-04 16:49:45 0 dr------- C:\Documents and Settings\Dee\Favorites
2008-08-04 16:49:45 0 d-------- C:\Documents and Settings\Dee\Desktop
2008-08-04 16:49:45 0 d---s---- C:\Documents and Settings\Dee\Cookies
2008-08-04 16:49:45 0 dr-h----- C:\Documents and Settings\Dee\Application Data
2008-08-04 14:05:20 0 d-------- C:\Program Files\Universal
2008-08-04 07:30:10 0 d-------- C:\Documents and Settings\ted\Application Data\Mozilla
2008-08-04 07:02:10 68096 --a------ C:\WINDOWS\zip.exe
2008-08-04 07:02:10 161792 --a------ C:\WINDOWS\swreg.exe <Not Verified; SteelWerX; SteelWerX Registry Editor>
2008-08-04 07:02:09 49152 --a------ C:\WINDOWS\VFind.exe
2008-08-04 07:02:09 212480 --a------ C:\WINDOWS\swxcacls.exe <Not Verified; SteelWerX; SteelWerX Extended Configurator ACLists>
2008-08-04 07:02:09 136704 --a------ C:\WINDOWS\swsc.exe <Not Verified; SteelWerX; SteelWerX Service Controller>
2008-08-04 07:02:09 98816 --a------ C:\WINDOWS\sed.exe
2008-08-04 07:02:09 80412 --a------ C:\WINDOWS\grep.exe
2008-08-04 07:02:09 89504 --a------ C:\WINDOWS\fdsv.exe <Not Verified; Smallfrogs Studio; >
2008-08-03 18:34:13 0 d-------- C:\Program Files\Trend Micro
2008-08-03 18:21:39 0 d-------- C:\Documents and Settings\Administrator\Application Data\Mozilla
2008-08-03 18:19:20 0 d-------- C:\Documents and Settings\Administrator\Application Data\Adobe
2008-08-03 18:00:08 0 d-------- C:\Documents and Settings\Administrator\Application Data\Viewpoint
2008-08-03 17:59:44 0 d-------- C:\Documents and Settings\Administrator\Application Data\AOL
2008-08-03 17:59:38 0 d-------- C:\Documents and Settings\Administrator\Application Data\Macromedia
2008-08-03 17:52:20 0 d--h----- C:\Documents and Settings\Administrator\Templates
2008-08-03 17:52:20 0 dr------- C:\Documents and Settings\Administrator\Start Menu
2008-08-03 17:52:20 0 dr-h----- C:\Documents and Settings\Administrator\SendTo
2008-08-03 17:52:20 0 d--h----- C:\Documents and Settings\Administrator\Recent
2008-08-03 17:52:20 0 d--h----- C:\Documents and Settings\Administrator\PrintHood
2008-08-03 17:52:20 0 d--h----- C:\Documents and Settings\Administrator\NetHood
2008-08-03 17:52:20 0 d-------- C:\Documents and Settings\Administrator\My Documents
2008-08-03 17:52:20 0 d--h----- C:\Documents and Settings\Administrator\Local Settings
2008-08-03 17:52:20 0 d-------- C:\Documents and Settings\Administrator\Favorites
2008-08-03 17:52:20 0 d-------- C:\Documents and Settings\Administrator\Desktop
2008-08-03 17:52:20 0 d---s---- C:\Documents and Settings\Administrator\Cookies
2008-08-03 17:52:20 0 dr-h----- C:\Documents and Settings\Administrator\Application Data
2008-08-03 17:52:20 0 d---s---- C:\Documents and Settings\Administrator\Application Data\Microsoft
2008-08-03 17:52:19 786432 --ah----- C:\Documents and Settings\Administrator\NTUSER.DAT


-- Find3M Report ---------------------------------------------------------------

2008-08-10 13:44:25 0 d-------- C:\Program Files\Common Files\Symantec Shared
2008-08-10 10:16:02 0 d-------- C:\Program Files\Common Files
2008-08-05 02:21:55 0 d-------- C:\Program Files\Common Files\AOL
2008-07-26 19:55:36 0 d-------- C:\Program Files\XoftSpySE
2008-07-15 18:47:39 0 d-------- C:\Program Files\Detroit
2008-07-15 18:46:51 73216 --a------ C:\WINDOWS\ST6UNST.EXE <Not Verified; Microsoft Corporation; Microsoft® Visual Basic for Windows>
2008-07-06 16:37:54 0 d-------- C:\Program Files\Driver-Soft
2008-07-06 16:05:06 0 d-------- C:\Program Files\Lexmark X6100 Series
2008-06-27 17:01:53 0 d-------- C:\Program Files\Pure Networks
2008-06-27 17:00:32 0 d-------- C:\Program Files\Common Files\Pure Networks Shared
2008-06-26 18:31:24 0 d-------- C:\Program Files\ParetoLogic
2008-06-26 18:31:24 0 d-------- C:\Program Files\Common Files\ParetoLogic
2008-06-19 13:12:19 0 d-------- C:\Program Files\Norton SystemWorks
2008-06-19 13:05:20 32 --ahs---- C:\WINDOWS\system32\{809E1F85-AA19-4CE1-A8FA-0A36AE60E149}.dat
2008-06-19 13:05:20 32 --ahs---- C:\WINDOWS\{BE0F15FE-3B90-4612-95E9-E497C6D4CEB1}.dat
2008-06-19 13:04:45 32 --ahs---- C:\WINDOWS\system32\{F8D91BE1-CE2B-45BE-A911-032EFD33BE03}.dat
2008-06-19 13:04:45 32 --ahs---- C:\WINDOWS\{907E937B-59BD-46EB-8C00-170EA0FF8DE4}.dat
2008-06-19 13:04:39 14 --a------ C:\WINDOWS\system32\SR2.dat
2008-06-19 13:04:18 0 d-------- C:\Program Files\Symantec
2008-06-18 13:30:53 1700 --a------ C:\WINDOWS\system32\tmp.reg
2008-06-18 13:28:44 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-06-18 13:28:43 0 d-------- C:\Program Files\Common Files\Panda Software
2008-06-18 13:26:22 0 d-------- C:\Program Files\AOL Deskbar
2008-06-18 13:25:21 0 d-------- C:\Program Files\AWS
2008-05-23 18:21:42 81920 --a------ C:\WINDOWS\system32\404Fix.exe <Not Verified; S!Ri.URZ; 404Fix>


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelliPoint "= "c:\Program Files\Microsoft IntelliPoint\ipoint.exe" [11/21/2006 06:09 PM]
"ccApp "= "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [08/19/2002 10:22 PM]
"ccRegVfy "= "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe" [08/19/2002 10:23 PM]
"HostManager "= "C:\Program Files\Common Files\AOL\1211853138\ee\AOLSoftware.exe" [10/08/2007 05:50 PM]
"VX3000 "= "C:\WINDOWS\vVX3000.exe" [12/05/2006 07:38 PM]
"nmctxth "= "C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [05/16/2008 06:11 AM]
"nmapp "= "C:\Program Files\Pure Networks\Network Magic\nmapp.exe" [05/16/2008 05:57 AM]
"QuickTime Task "= "C:\Program Files\QuickTime\qttask.exe" [02/05/2007 07:10 PM]
"Lexmark X6100 Series "= "C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe" [05/16/2003 06:10 AM]
"SiteAdvisor "= "C:\Program Files\SiteAdvisor\6172\SiteAdv.exe" []
"SiSUSBRG "= "C:\WINDOWS\SiSUSBrg.exe" [07/12/2002 06:15 AM]
"SiS Windows KeyHook "= "C:\WINDOWS\system32\keyhook.exe" [05/12/2004 05:22 PM]
"PinnacleDriverCheck "= "C:\WINDOWS\system32\PSDrvCheck.exe" [11/10/2003 05:06 PM]
"NeroFilterCheck "= "C:\WINDOWS\system32\NeroCheck.exe" [07/09/2001 12:50 PM]
"ISUSScheduler "= "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [06/16/2004 07:03 AM]
"ISUSPM Startup "= "C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [06/16/2004 07:03 AM]
"AOLDialer "= "C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" [10/23/2006 08:50 AM]
"Adobe Reader Speed Launcher "= "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [01/11/2008 11:16 PM]
"SunJavaUpdateSched "= "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [06/10/2008 04:27 AM]
"SoundMan "= "SOUNDMAN.EXE" [02/26/2004 04:53 AM C:\WINDOWS\SOUNDMAN.EXE]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AOL Fast Start "= "C:\Program Files\AOL 9.1\AOL.exe" [03/06/2008 06:12 AM]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"ALUAlert "=C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools "=0 (0x0)
"HideLegacyLogonScripts "=0 (0x0)
"HideLogoffScripts "=0 (0x0)
"RunLogonScriptSync "=1 (0x1)
"RunStartupScriptSync "=0 (0x0)
"HideStartupScripts "=0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"HideLegacyLogonScripts "=0 (0x0)
"HideLogoffScripts "=0 (0x0)
"RunLogonScriptSync "=1 (0x1)
"RunStartupScriptSync "=0 (0x0)
"HideStartupScripts "=0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
@= "Service "

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@= "Volume shadow copy "

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup=C:\WINDOWS\pss\Kodak EasyShare software.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak software updater.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak software updater.lnk
backup=C:\WINDOWS\pss\Kodak software updater.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Symantec Fax Starter Edition Port.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Symantec Fax Starter Edition Port.lnk
backup=C:\WINDOWS\pss\Symantec Fax Starter Edition Port.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LifeCam]
"C:\Program Files\Microsoft LifeCam\LifeExp.exe "

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER




-- End of Deckard's System Scanner: finished at 2008-08-10 16:54:38 ------------

 

Open My Computer
On the Menu, click Tools then Folder Options
Select the View tab
Scroll down and select

• Show hidden files and folders

Uncheck the box Hide protected operating system files
Click OK

Now navigate to C:\Documents and Settings\Dee\Application Data
Delete the folder named ErrorSmart
Now navigate to C:\Documents and Settings\ted\Application Data
Delete the folder named ErrorSmart


Click Start>Run and type ComboFix /u then hit Enter to uninstall ComboFix and remove the files it has quarantined. This action will also reset the System Restore points, removing the infected files there as well. The C:\Deckard's folder will also be removed. You can delete any logs that were created/saved too.


Now run ATF Cleaner again.

• Check the boxes to the left of:
  
  
  • Windows Temp
  • Current User Temp
  • All Users Temp
  • Temporary Internet Files
  • Prefetch
  • Java Cache
  • Recycle bin
• The rest are optional - if you want it to remove everything check "Select All ".
• Finally, click Empty Selected. When you get the "Done Cleaning" message, click OK.

Reboot


Time for another online scan to make sure we haven't missed anything. Please do an online scan with Kaspersky Online Scanner

Click Accept, when prompted to download and install the program files and database of malware definitions.

• Click Run at the Security prompt.
• The program will then begin downloading and installing and will also update the database.
• Please be patient as this can take several minutes.
• Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
• Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
• Click View scan report at the bottom.
• Click the Save Report As... button.
• Click the Save as Text button to save the file to your desktop so that you may post it in your next reply.

**Note**

To optimize scanning time and produce a more sensible report for review:

• Close any open programs.
• Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.

Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.


Post the Kaspersky log here.

 

Malware and Virus Removal

Dave,

My machine will not accept the combofix/u in the run mode, any thing else I can do.

Dee

 

Make sure you are doing it from the Dee user account, and that ComboFix.exe is on the Desktop. If ComboFix is not there, you will need to download it again as described here.

 

Malware and Virus Removal

Dave,

I thought I had saved combofix, I went back and saved again. I can find the icon on my desk top but when I click, it starts a scan. I just know my run prompt will not recognize combofix with or without the u.
Dee