Solved cannot copy file log from hijackthis

Hi
OK I think you missed this one, or did not copy the whole thing so please run it in OTMoveIt2.

Code:

C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\S7NLTH2O 

 

C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\S7NLTH2O moved successfully.

OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 09142008_075005

I have lost my taskbar again, I will try the #164 again. When I reboot it seems I get a bunch of pop ups that tell me I have a new cd rom, and it cannot install, I need the manufacturers install cd. I have no clue why that is all of a suddden coming up. I have had that cd in the computer for about 4 years and it was working fine.

 

Do you have a CD you can put in it and check to make sure it works.

Try rebooting again and see it it happens again.

 

I do not have a cd for it. I ran another kasper scan, and it still shows after 62% scanned, the same infections. I will post it here when it is complete

KASPERSKY ONLINE SCANNER 7 REPORT
Sunday, September 14, 2008
Operating System: Microsoft Windows XP Home Edition Service Pack 2 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Sunday, September 14, 2008 12:39:30
Records in database: 1227715


Scan settings
Scan using the following database extended
Scan archives yes
Scan mail databases yes

Scan area My Computer
C:\
D:\
E:\
F:\
G:\
I:\
J:\
K:\

Scan statistics
Files scanned 158028
Threat name 15
Infected objects 66
Suspicious objects 0
Duration of the scan 02:34:18

File name Threat name Threats count
C:\Qoobox\Quarantine\C\Program Files\AAV\aav.exe.vir Infected: not-a-virus:FraudTool.Win32.SpywarePreventer.r 1

C:\Qoobox\Quarantine\C\WINDOWS\system32\788877\788877.dll.vir Infected: not-a-virus:AdWare.Win32.E404.dp 1

C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\tdssserv.sys.vir Infected: Backdoor.Win32.Agent.qqh 1

C:\Qoobox\Quarantine\C\WINDOWS\system32\lphcre5j0e7a9.exe.vir Infected: Backdoor.Win32.Frauder.dk 1

C:\Qoobox\Quarantine\C\WINDOWS\system32\sysrest32.exe.vir Infected: Trojan.Win32.KillAV.agz 1

C:\Qoobox\Quarantine\C\WINDOWS\system32\tdssadw.dll.vir Infected: Rootkit.Win32.Clbd.jj 1

C:\Qoobox\Quarantine\C\WINDOWS\system32\tdssl.dll.vir Infected: Trojan-Downloader.Win32.Small.acri 1

C:\Qoobox\Quarantine\C\WINDOWS\system32\tdsslog.dll.vir Infected: Backdoor.Win32.Agent.rfv 1

C:\Qoobox\Quarantine\C\WINDOWS\system32\tdssmain.dll.vir Infected: Backdoor.Win32.Agent.rfw 1

C:\Qoobox\Quarantine\C\WINDOWS\system32\tdssserf.dll.vir Infected: Trojan-Downloader.Win32.FraudLoad.vbxt 1

C:\Qoobox\Quarantine\catchme2008-09-10_234530.98.zip Infected: Rootkit.Win32.Agent.cmh 5

C:\Qoobox\Quarantine\catchme2008-09-10_234530.98.zip Infected: Email-Worm.Win32.Zhelatin.vl 1

C:\RECYCLER\S-1-5-21-3791265235-4017911181-3869940563-1007\Dc1.bac_a03684 Infected: Trojan-Downloader.Java.OpenStream.y 1

C:\_OTMoveIt\MovedFiles\09142008_013706\Documents and Settings\David Tonning\Local Settings\Application Data\Mozilla\Firefox\Profiles\672rpasw.default\Cache\278016E0d01 Infected: Trojan-Downloader.JS.Agent.cnn 1

C:\_OTMoveIt\MovedFiles\09142008_013706\Documents and Settings\David Tonning\Local Settings\Application Data\Mozilla\Firefox\Profiles\672rpasw.default\Cache\672CC238d01 Infected: Trojan-Downloader.JS.Agent.cnn 1

C:\_OTMoveIt\MovedFiles\09142008_013706\Documents and Settings\David Tonning\Local Settings\Application Data\Mozilla\Firefox\Profiles\672rpasw.default\Cache\696F24F5d01 Infected: Trojan-Downloader.JS.Agent.cnn 1

C:\_OTMoveIt\MovedFiles\09142008_013706\Documents and Settings\David Tonning\Local Settings\Application Data\Mozilla\Firefox\Profiles\672rpasw.default\Cache\929B6473d01 Infected: Trojan-Downloader.JS.Agent.cnn 1

C:\_OTMoveIt\MovedFiles\09142008_013706\Documents and Settings\David Tonning\Local Settings\Application Data\Mozilla\Firefox\Profiles\672rpasw.default\Cache\9F6E93C0d01 Infected: Trojan-Downloader.JS.Agent.cnn 1

C:\_OTMoveIt\MovedFiles\09142008_013706\Documents and Settings\David Tonning\Local Settings\Application Data\Mozilla\Firefox\Profiles\672rpasw.default\Cache\B3FB50B7d01 Infected: Trojan-Downloader.JS.Agent.cnn 1

C:\_OTMoveIt\MovedFiles\09142008_013706\Documents and Settings\David Tonning\Local Settings\Application Data\Mozilla\Firefox\Profiles\672rpasw.default\Cache\C3FD3025d01 Infected: Trojan-Downloader.JS.Agent.cnn 1

C:\_OTMoveIt\MovedFiles\09142008_013706\Documents and Settings\David Tonning\Local Settings\Application Data\Mozilla\Firefox\Profiles\672rpasw.default\Cache\C81F1BC2d01 Infected: Trojan-Downloader.JS.Agent.cnn 1

C:\_OTMoveIt\MovedFiles\09142008_013706\Documents and Settings\David Tonning\Local Settings\Application Data\Mozilla\Firefox\Profiles\672rpasw.default\Cache\D366BD92d01 Infected: Trojan-Downloader.JS.Agent.cnn 1

C:\_OTMoveIt\MovedFiles\09142008_013706\Documents and Settings\David Tonning\Local Settings\Application Data\Mozilla\Firefox\Profiles\672rpasw.default\Cache\E154C9C6d01 Infected: Trojan-Downloader.JS.Agent.cnn 1

C:\_OTMoveIt\MovedFiles\09142008_013706\Documents and Settings\David Tonning\Local Settings\Application Data\Mozilla\Firefox\Profiles\672rpasw.default\Cache\E891C9F9d01 Infected: Trojan-Downloader.JS.Agent.cnn 1

C:\_OTMoveIt\MovedFiles\09142008_013706\Program Files\MUSICMATCH\Common\ComponentMgr\HoldingArea\WebSys(3)\WebSys.mmz Infected: not-a-virus:RiskTool.Win32.Deleter.f 1

C:\_OTMoveIt\MovedFiles\09142008_013706\Program Files\MUSICMATCH\Musicmatch Jukebox\WebSys\offline.mmz Infected: not-a-virus:RiskTool.Win32.Deleter.f 1

C:\_OTMoveIt\MovedFiles\09142008_013706\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\2QEWN9M9\acCA3BA3BV.htm Infected: Trojan-Downloader.JS.Agent.cnn 1

C:\_OTMoveIt\MovedFiles\09142008_013706\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\2QEWN9M9\acCA44S35J.htm Infected: Trojan-Downloader.JS.Agent.cnn 1

C:\_OTMoveIt\MovedFiles\09142008_013706\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\2QEWN9M9\acCA48BS8S.htm Infected: Trojan-Downloader.JS.Agent.cnn 1

C:\_OTMoveIt\MovedFiles\09142008_013706\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\2QEWN9M9\acCA4UU5BN.htm Infected: Trojan-Downloader.JS.Agent.cnn 1

C:\_OTMoveIt\MovedFiles\09142008_013706\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\2QEWN9M9\acCA55F5KH.htm Infected: Trojan-Downloader.JS.Agent.cnn 1

C:\_OTMoveIt\MovedFiles\09142008_013706\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\2QEWN9M9\acCA5RW9JU.htm Infected: Trojan-Downloader.JS.Agent.cnn 1

C:\_OTMoveIt\MovedFiles\09142008_013706\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\2QEWN9M9\acCA6SYUJ4.htm Infected: Trojan-Downloader.JS.Agent.cnn 1

C:\_OTMoveIt\MovedFiles\09142008_013706\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\2QEWN9M9\acCA8PQORK.htm Infected: Trojan-Downloader.JS.Agent.cnn 1

C:\_OTMoveIt\MovedFiles\09142008_013706\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\2QEWN9M9\acCABV73NR.htm Infected: Trojan-Downloader.JS.Agent.cnn 1

C:\_OTMoveIt\MovedFiles\09142008_013706\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\2QEWN9M9\acCABWOCEZ.htm Infected: Trojan-Downloader.JS.Agent.cnn 1

C:\_OTMoveIt\MovedFiles\09142008_013706\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\2QEWN9M9\acCADFL28L.htm Infected: Trojan-Downloader.JS.Agent.cnn 1

C:\_OTMoveIt\MovedFiles\09142008_013706\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\2QEWN9M9\acCADWRBXD.htm Infected: Trojan-Downloader.JS.Agent.cnn 1

C:\_OTMoveIt\MovedFiles\09142008_013706\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\2QEWN9M9\acCAHZ156G.htm Infected: Trojan-Downloader.JS.Agent.cnn 1

C:\_OTMoveIt\MovedFiles\09142008_013706\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\2QEWN9M9\acCAIL8FYG.htm Infected: Trojan-Downloader.JS.Agent.cnn 1

C:\_OTMoveIt\MovedFiles\09142008_013706\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\2QEWN9M9\acCAKSX03D.htm Infected: Trojan-Downloader.JS.Agent.cnn 1

C:\_OTMoveIt\MovedFiles\09142008_013706\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\2QEWN9M9\acCALUJ2CF.htm Infected: Trojan-Downloader.JS.Agent.cnn 1

C:\_OTMoveIt\MovedFiles\09142008_013706\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\2QEWN9M9\acCAM9610S.htm Infected: Trojan-Downloader.JS.Agent.cnn 1

C:\_OTMoveIt\MovedFiles\09142008_013706\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\2QEWN9M9\acCAMXFZER.htm Infected: Trojan-Downloader.JS.Agent.cnn 1

C:\_OTMoveIt\MovedFiles\09142008_013706\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\2QEWN9M9\acCANEGPA0.htm Infected: Trojan-Downloader.JS.Agent.cnn 1

C:\_OTMoveIt\MovedFiles\09142008_013706\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\2QEWN9M9\acCAQ05BI9.htm Infected: Trojan-Downloader.JS.Agent.cnn 1

C:\_OTMoveIt\MovedFiles\09142008_013706\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\2QEWN9M9\acCATSYEZJ.htm Infected: Trojan-Downloader.JS.Agent.cnn 1

C:\_OTMoveIt\MovedFiles\09142008_013706\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\2QEWN9M9\acCAXB8VS8.htm Infected: Trojan-Downloader.JS.Agent.cnn 1

C:\_OTMoveIt\MovedFiles\09142008_013706\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\2QEWN9M9\ac[10].htm Infected: Trojan-Downloader.JS.Agent.cnn 1

C:\_OTMoveIt\MovedFiles\09142008_013706\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\2QEWN9M9\ac[11].htm Infected: Trojan-Downloader.JS.Agent.cnn 1

C:\_OTMoveIt\MovedFiles\09142008_013706\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\2QEWN9M9\ac[1].htm Infected: Trojan-Downloader.JS.Agent.cnn 1

C:\_OTMoveIt\MovedFiles\09142008_013706\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\2QEWN9M9\ac[2].htm Infected: Trojan-Downloader.JS.Agent.cnn 1

C:\_OTMoveIt\MovedFiles\09142008_013706\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\2QEWN9M9\ac[3].htm Infected: Trojan-Downloader.JS.Agent.cnn 1

C:\_OTMoveIt\MovedFiles\09142008_013706\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\2QEWN9M9\ac[4].htm Infected: Trojan-Downloader.JS.Agent.cnn 1

C:\_OTMoveIt\MovedFiles\09142008_013706\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\2QEWN9M9\ac[5].htm Infected: Trojan-Downloader.JS.Agent.cnn 1

C:\_OTMoveIt\MovedFiles\09142008_013706\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\2QEWN9M9\ac[6].htm Infected: Trojan-Downloader.JS.Agent.cnn 1

C:\_OTMoveIt\MovedFiles\09142008_013706\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\2QEWN9M9\ac[7].htm Infected: Trojan-Downloader.JS.Agent.cnn 1

C:\_OTMoveIt\MovedFiles\09142008_013706\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\2QEWN9M9\ac[8].htm Infected: Trojan-Downloader.JS.Agent.cnn 1

C:\_OTMoveIt\MovedFiles\09142008_013706\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\2QEWN9M9\ac[9].htm Infected: Trojan-Downloader.JS.Agent.cnn 1

C:\_OTMoveIt\MovedFiles\09142008_013706\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\E9DPJC3E\ac[1].htm Infected: Trojan-Downloader.JS.Agent.cnn 1

C:\_OTMoveIt\MovedFiles\09142008_075005\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\S7NLTH2O\ac[1].htm Infected: Trojan-Downloader.JS.Agent.cnn 1

C:\_OTMoveIt\MovedFiles\09142008_075005\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\S7NLTH2O\ac[2].htm Infected: Trojan-Downloader.JS.Agent.cnn 1

The scan was stopped by the user.

 

Hi
I don't mean the CD for the cd rom, I mean any CD that you can put in it to make sure it is working. music CD maybe?

Please reboot again and let me know if you still get those messages and check your taskbar.

Yes those infections are showing but they are quarantined either in combofix or OTMoveIt2. we will take care of that in a while.
I want to make sure your cd rom is working first.

 

it appears to be working, but when I re-booted, I still get the "stop installation message" and found new hardware message. I have to close about 5 things and then I can proceed

 

Hi

Is that for the CD ROM?

Also for the CD ROM?

What are they?

I need as many details as you can give me please. I can't see your computer so I need you to tell me as much as you can.

Thanks

 

Thanks sorry for being vague. When it first boots, after I sign in to windows, while it is loading the desktop, I first get a "found new hardware" I x out of that, Then a box opens with the "continue anyways" or "stop installation" I tried both, either way I get another box to install the cd rom, and use the cd install tool or browse. I close that box, and get another pop up that says it may not work correctly, and I x out of that, then I get the install thing again. After I have exhausted all of those, I can go to my programs. I deleted the firefox completely, and went back to using explorer.

 

Hi
OK I want to see if this will help.
Please open OTMoveIt2.
Click on the Restore button.
Locate this folder in the Moved files window, 09142008_013706
Open it and put a check in these two boxes.
C:\Program Files\MUSICMATCH\Common\ComponentMgr\HoldingArea\WebSys(3)\WebSys.mmz
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\WebSys\offline.mmz

Then click RestoreIt.

Reboot and let me know if that helped.

 

Sorry, it is worse. It opened all those boxes again and it locked up when an error "cled" came on. I hit cntrl alt del, and closed that, and x'd out of the rest and it is working as normal to this point. The error was in the main window, but in the tqask bar there was an icon for the srv100 , The icon was the h2o key for some of these programs I have.

 

What program are you using SyncroSoft for?

Is this your Anti virus ? did you buy this or is it from a P2P download?

 

i am not sure what that is, my virus protection I bought, it is advance anti virus I purchased online. my brother told me the synchrosoft is my virtual dongle for my recording program stienberg cubase sx3

 

Hi
OK Got some help here.
Please go here and follow the instructions
http://www.microsoft.com/technet/pr...serv/reskit/prork/prdh_dmt_tolm.mspx?mfr=true

Have the user do that, then remove all cd/dvd rom devices shown and reboot. If any more requests for a cd, verify what it's trying to install (it might be a secondary request rather than a request for cd drive drivers) XP has the drivers for most cd/dvd drives and doesn't require any drivers from a cd.

Let me know.
Thanks
Geri

 

We are gaining, I did the microsoft site you gave me, and it found a usb protection device hidden. I deleted it and rebooted. I did get a "found new device" pop up usb protection device, and then the installation box came up. I closed them and it told me the device may not work properly and it closed. All was normal after that. No more cd rom problem at this point. I guess I am at a loss what the usb protection device is now, especially after I deleted it from the device mgr.

 

Hi
OK LOL, just wanted cd/dvd rom deleted.

Not sure what usb protection it would be.

If you reboot again does the message still come up with the usb?

 

Ok it still comes up with the usb thing, and I got the big red X and a cled error and the task bar pop up with srv100. That locked the screen untill I did the task mgr thing and had to reset the task bar again. It seems to try to confuse with a different problem each time I reboot, I am getting real good at that though. I really owe you Geri, I would like to send you a token of my appreciation, something other than a virus

 

Hi
Right click My Computer and select Properties.
Select the Hardware tab.
In the Drivers section, click Windows Update.
Select 'Ask me to search Windows Update ....' then OK your way out.
Restart the computer and allow the USB protection device to install.
If/when prompted, select Yes to allow Windows Update to be checked.
Let us know if the device is successfully installed, and if the install hardware prompt returns upon reboot.

Geri

 

OK I did that and it installed successfully. I did have to "continue anyway" from the box to get it to go, and reset the taskbar again. I did not get any other pop ups after that. I see each time I reboot, there are updates that are to be installed, and it appears they are not getting done, I went to the security site, and the auto updates are indeed on?

 

You may have to update manually this time.
Is it asking you to update to SP3 maybe?

Click > Start > All Programs Click on > Windows Update, and follow the online instructions from there.

It is important to have them updated.

I'll see what i can find here, this should be fixed with just the one fix.

Geri

 

I went to the updates and installed, one failed, the sp3. I tried to do the install the way they instructed if it failed, and still will not install it. the log also says there are 4 remaining to install. It cannot get by the sp3 it seems. I turned off the pop up blocker as well for that site.