Active Explorer.EXE and IEXPLORE.EXE virus

tinapie · 2008/12/20

[Active] Explorer.EXE and IEXPLORE.EXE virus

My OS is Windows XP. I have a Spyware Terminator installed in my computer for a 2 years. Recently, I came to a suspicion that my laptop has virus. There are times when I open a webpage or link, the page is being redirected into a different site, most often into an antivirus site with a popup offering a computer scan. At the same time, the Spyware Terminator keeps on alerting me about warnings every 5-10 secs- Action: File Access, Process: Explorer.EXE / IEXPLORE.EXE - even if the Internet Explorer is not running. The said process warning also asks permission for file access on almost all the documents/folders and applications installed in my laptop (itunes, games, antivirus, and even the trend micro freebies such as RUBotted and Trend Secure, and others). When I tried to block the process, I noticed that the application Icons in the desktop changed and wont open. The Avira Anti-Virus hasnt detected anything. I also run Malwarebytes' Anti Malware but found nothing. I used Housecall, found cookies and deleted them. Problem still persists. What is the best thing to do? Thanks a lot

tinapie · 2008/12/20

Explorer.EXE and IEXPLORE.EXE virus

I forgot to post the HJT log. Here it is:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:43:57 AM, on 12/21/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18241)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\Program Files\NetWaiting\netWaiting.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\WINDOWS\system32\stacsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe
C:\Program Files\eMail ID\OEAddOn\OEdmn_4.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\PROGRA~1\Crawler\Toolbar\CToolbar.exe
C:\Documents and Settings\Kristina Formanes\Local Settings\Application Data\Trend Micro\HCMS\tsafe\en-US\tgui.exe
C:\Documents and Settings\Kristina Formanes\Local Settings\Application Data\Trend Micro\HCMS\tsafe\en-US\tgsvc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Chikka Messenger\Chikka v.4\ChikkaLauncher.exe
C:\WINDOWS\system32\runonce.exe
C:\Program Files\Trend Micro\RUBotted\TMRUBotted.exe
C:\Program Files\Trend Micro\RUBotted\TMRUBottedTray.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Kristina Formanes\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 196.168.1.254:1234
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: IconixBHOClass Class - {761233B6-F228-49E4-8F6B-668499D4E55A} - C:\Program Files\eMail ID\IEAddOn\IconixBHO_37.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: TrendProtect - {E3578B37-6346-4EC1-A82B-38273A100DCF} - C:\Program Files\Trend Micro\TrendProtect\MSIE\wrs.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: &Crawler Toolbar - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O3 - Toolbar: TrendProtect - {F83BE649-1CC3-48EE-B2E2-0826CEF3822A} - C:\Program Files\Trend Micro\TrendProtect\MSIE\wrs.dll
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe "
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe "
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe "
O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
O4 - HKLM\..\Run: [Gfixegemidaribi] rundll32.exe "C:\WINDOWS\axapazucowopo.dll ",e
O4 - HKLM\..\Run: [IconixOEAddOn] "C:\Program Files\eMail ID\OEAddOn\OEdmn_4.exe "
O4 - HKLM\..\Run: [TMRUBottedTray] "C:\Program Files\Trend Micro\RUBotted\TMRUBottedTray.exe "
O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netWaiting.exe
O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - Startup: Multiply AutoUploader.lnk = C:\Program Files\Multiply\AutoUploader\Multiply AutoUploader\Multiply AutoUploader.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: McAfee Anti-Phishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {400A6CFA-E326-4d61-A90C-9AD75358DC5F} - C:\Program Files\eMail ID\IEAddOn\IconixBHO_37.dll
O9 - Extra 'Tools' menuitem: Email ID Preferences - {400A6CFA-E326-4d61-A90C-9AD75358DC5F} - C:\Program Files\eMail ID\IEAddOn\IconixBHO_37.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {BC3F6B6D-2E49-4603-B028-7411655713F3} - C:\Program Files\eMail ID\IEAddOn\IconixBHO_37.dll
O9 - Extra 'Tools' menuitem: About Email ID - {BC3F6B6D-2E49-4603-B028-7411655713F3} - C:\Program Files\eMail ID\IEAddOn\IconixBHO_37.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0C92900E-4D5A-4F04-ACC9-729E1767BBAE} (Image Uploader Control) - http://safeway.lifepics.com/net/Uploader/LPUploader45.cab
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} (FunGamesLoader Object) - http://gsn.worldwinner.com/games/v47/shared/FunGamesLoader.cab
O16 - DPF: {1EF9F042-C2EB-4293-8213-474CAEEF531D} (TmHcmsX Control) - http://www.trendsecure.com/framework/control/en-US/activex/TmHcmsX.CAB
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} - http://www.sibelius.com/download/software/win/ActiveXPlugin.cab
O16 - DPF: {B06CE1BC-5D9D-4676-BD28-1752DBF394E0} (Hangman Control) - http://www.worldwinner.com/games/v41/hangman/hangman.cab
O16 - DPF: {CF969D51-F764-4FBF-9E90-475248601C8A} (FamilyFeud Control) - http://www.worldwinner.com/games/v47/familyfeud/familyfeud.cab
O16 - DPF: {E856B973-45FD-4559-8F82-EAB539144667} (Dell PC Checkup Installer Control) - http://pccheckup.dellfix.com/rel/41/install/gtdownde.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,2,0,5109/mcfscan.cab
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O18 - Protocol: trendprotect - {BC3A5F6F-12A0-4B14-A184-32939F413823} - C:\Program Files\Trend Micro\TrendProtect\MSIE\wrs.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Iconix Update Service (IconixService) - Unknown owner - C:\Program Files\Common Files\eMail ID\IconixService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Trend Micro RUBotted Service (RUBotted) - Trend Micro Inc. - C:\Program Files\Trend Micro\RUBotted\TMRUBotted.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\WINDOWS\system32\stacsv.exe
O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

--
End of file - 14562 bytes

noahdfear · 2008/12/21

Hi tinapie,

We need logs that give us a better look at things. Please download DDS and save it to your desktop.

Disable any script blocking protection

Double click dds.scr to run the tool.

When done, DDS will open two (2) logs:

DDS.txt

Attach.txt

Save both reports to your desktop.

Please include the contents of both logs in your next reply. The scan will instruct you to post the attach log as an attachment. No need for that though ..... just post it as you would any other log.

tinapie · 2008/12/22

[Active] Explorer.EXE and IEXPLORE.EXE virus

Thanks noahdfear, here are the DDS logs:

Attach:

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Version 1.0)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume2
Install Date: 8/2/2006 8:58:55 AM
System Uptime: 12/22/2008 8:57:08 AM (1 hours ago)

Motherboard: Dell Inc. | | 0RT486
Processor: Genuine Intel(R) CPU T2400 @ 1.83GHz | Microprocessor | 988/166mhz
Processor: Genuine Intel(R) CPU T2400 @ 1.83GHz | Microprocessor | 988/166mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 68 GiB total, 14.82 GiB free.
D: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP1: 10/3/2008 9:08:22 AM - System Checkpoint
RP2: 10/3/2008 9:14:34 AM - Software Distribution Service 3.0
RP3: 10/7/2008 4:23:17 PM - Software Distribution Service 3.0
RP4: 10/10/2008 8:39:26 AM - Software Distribution Service 3.0
RP5: 10/10/2008 9:24:19 PM - Software Distribution Service 3.0
RP6: 10/12/2008 9:21:06 AM - System Checkpoint
RP7: 10/14/2008 9:19:04 AM - System Checkpoint
RP8: 10/15/2008 11:50:43 AM - System Checkpoint
RP9: 10/15/2008 11:54:04 AM - Software Distribution Service 3.0
RP10: 10/16/2008 9:25:50 PM - System Checkpoint
RP11: 10/17/2008 4:08:41 PM - Software Distribution Service 3.0
RP12: 10/20/2008 4:33:36 PM - System Checkpoint
RP13: 10/21/2008 6:59:38 PM - System Checkpoint
RP14: 10/23/2008 9:38:02 PM - System Checkpoint
RP15: 10/24/2008 9:04:08 AM - Software Distribution Service 3.0
RP16: 10/24/2008 3:39:30 PM - Software Distribution Service 3.0
RP17: 10/27/2008 4:36:32 PM - System Checkpoint
RP18: 10/29/2008 8:38:53 AM - Software Distribution Service 3.0
RP19: 10/30/2008 12:24:43 PM - System Checkpoint
RP20: 10/31/2008 11:17:40 AM - Software Distribution Service 3.0
RP21: 11/3/2008 11:58:21 AM - System Checkpoint
RP22: 11/4/2008 9:00:44 PM - Software Distribution Service 3.0
RP23: 11/6/2008 12:58:12 PM - System Checkpoint
RP24: 11/7/2008 9:34:21 AM - Software Distribution Service 3.0
RP25: 11/10/2008 9:52:47 AM - System Checkpoint
RP26: 11/12/2008 8:40:20 AM - Software Distribution Service 3.0
RP27: 11/14/2008 8:55:26 AM - System Checkpoint
RP28: 11/15/2008 9:28:51 AM - Software Distribution Service 3.0
RP29: 11/15/2008 9:16:11 PM - Software Distribution Service 3.0
RP30: 11/20/2008 9:00:04 AM - Software Distribution Service 3.0
RP31: 11/22/2008 9:16:46 AM - Software Distribution Service 3.0
RP32: 11/22/2008 6:07:32 PM - Removed Multiply AutoUploader
RP33: 11/24/2008 1:16:27 PM - Software Distribution Service 3.0
RP34: 11/28/2008 11:24:04 AM - Software Distribution Service 3.0
RP35: 12/2/2008 9:19:25 AM - Software Distribution Service 3.0
RP36: 12/4/2008 11:52:58 AM - System Checkpoint
RP37: 12/4/2008 10:10:13 PM - Software Distribution Service 3.0
RP38: 12/5/2008 9:05:29 AM - Software Distribution Service 3.0
RP39: 12/6/2008 12:19:47 PM - System Checkpoint
RP40: 12/8/2008 10:03:14 AM - Software Distribution Service 3.0
RP41: 12/8/2008 10:12:17 AM - Software Distribution Service 3.0
RP42: 12/10/2008 8:24:36 AM - System Checkpoint
RP43: 12/11/2008 2:05:46 PM - System Checkpoint
RP44: 12/11/2008 2:47:50 PM - Software Distribution Service 3.0
RP45: 12/12/2008 11:40:38 AM - Software Distribution Service 3.0
RP46: 12/15/2008 3:36:56 PM - Removed MobileMe Control Panel
RP47: 12/16/2008 9:18:04 PM - Software Distribution Service 3.0
RP48: 12/18/2008 1:53:45 AM - System Checkpoint
RP49: 12/18/2008 3:19:25 AM - Spyware Terminator - restore point
RP50: 12/18/2008 3:21:43 AM - Software Distribution Service 3.0
RP51: 12/18/2008 1:44:59 PM - Software Distribution Service 3.0
RP52: 12/19/2008 2:15:27 PM - System Checkpoint
RP53: 12/20/2008 11:19:23 PM - Installed Trend Micro RUBotted
RP54: 12/20/2008 11:40:10 PM - Installed Trend Micro TrendProtect for Internet Explorer.
RP55: 12/22/2008 9:19:35 AM - System Checkpoint

==== Installed Programs ======================

2007 Microsoft Office Suite Service Pack 1 (SP1)
4300
4300_Help
4300Trb
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Photoshop CS
Adobe Reader 8.1.2
Adobe Reader 8.1.2 Security Update 1 (KB403742)
Adobe® Photoshop® Album Starter Edition 3.2
AiO_Scan_CDA
AiOSoftwareNPI
America Online (Choose which version to remove)
Andrea VoiceCenter
Any Video Converter 2.6.0
AOL Coach Version 1.0(Build:20040229.1 en)
AOL Connectivity Services
AOLIcon
Apple Mobile Device Support
Apple Software Update
ArcSoft Camera Suite 1.3
AutoCAD 2005 - English
Autodesk DWF Viewer
AutoUpdate
Avery Wizard 3.1
Avira AntiVir Personal - Free Antivirus
Banctec Service Agreement
Bonjour
Britannica Almanac 2006 CD
Broadcom Management Programs
BufferChm
Chikka Messenger V4
Conexant HDA D110 MDC V.92 Modem
CP_Package_Variety1
CP_Package_Variety2
CP_Package_Variety3
Crawler Toolbar with Web Security Guard
Creative MediaSource
CustomerResearchQFolder
Dell CinePlayer
Dell Digital Jukebox Driver
Dell Driver Reset Tool
Dell Game Console
Dell ResourceCD
Dell Support Center (Support Software)
Dell System Restore
DellSupport
Destinations
DeviceManagementQFolder
Digital Content Portal
Digital Line Detect
DivX Codec
DivX Converter
DivX Player
DivX Web Player
DocProc
EarthLink setup files
EducateU
ELIcon
eSupportQFolder
Fax_CDA
FLV Player
Garmin Communicator Plugin
Guitar Pro 5.0
High Definition Audio Driver Package - KB835221
HijackThis 2.0.2
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 10 (KB903157)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB888795)
Hotfix for Windows XP (KB891593)
Hotfix for Windows XP (KB895961)
Hotfix for Windows XP (KB896256)
Hotfix for Windows XP (KB899337)
Hotfix for Windows XP (KB899510)
Hotfix for Windows XP (KB902841)
Hotfix for Windows XP (KB906569)
Hotfix for Windows XP (KB908673)
Hotfix for Windows XP (KB912024)
Hotfix for Windows XP (KB914642)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB926239)
Hotfix for Windows XP (KB952287)
hp deskjet 3500
hp deskjet 3500 series
HP Extended Capabilities 6.1
HP Imaging Device Functions 6.1
hp LaserJet 4300 Uninstaller
HP Photo and Imaging 2.0 - Deskjet Series
HP Photosmart Essential
hp print screen utility
HP PSC & OfficeJet 6.1.A
HP Solution Center and Imaging Support Tools 6.1
HP Update
HPProductAssistant
Intel(R) Graphics Media Accelerator Driver
Intel(R) PROSet/Wireless Software
iTunes
Java 2 Runtime Environment, SE v1.4.2_03
Java(TM) 6 Update 2
Java(TM) 6 Update 3
Java(TM) 6 Update 5
Java(TM) 6 Update 7
Korean Fonts Support For Adobe Reader 8
Logitech QuickCam Software
Logitech® Camera Driver
Macromedia Flash MX 2004
Macromedia Flash Player
Malwarebytes' Anti-Malware
MarketResearch
mCore
MCU
mDriver
mDrWiFi
mHlpDell
Microsoft .NET Framework 1.0 Hotfix (KB887998)
Microsoft .NET Framework 1.0 Hotfix (KB930494)
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Excel MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Professional Edition 2003
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Standard 2007
Microsoft Office Word MUI (English) 2007
Microsoft Plus! Digital Media Edition Installer
Microsoft Plus! Photo Story 2 LE
Microsoft Software Update for Web Folders (English) 12
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Mirage Driver 1.1
mIWA
mLogView
mMHouse
Modem Helper
Move Networks Media Player for Internet Explorer
mPfMgr
mPfWiz
mProSafe
mSCfg
MSN
mSSO
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 6 Service Pack 2 (KB954459)
Musicmatch for Windows Media Player
mWlsSafe
mWMI
mZConfig
Nero 7 Essentials
neroxml
NetWaiting
NetZeroInstallers
NewCopy_CDA
Norton 360
Norton Security Scan
Norton Security Scan (Symantec Corporation)
Otto
ProductContextNPI
QuickSet
QuickTime
Readme
Scan
ScannerCopy
Security Update for 2007 Microsoft Office System (KB951550)
Security Update for 2007 Microsoft Office System (KB951944)
Security Update for 2007 Microsoft Office System (KB958439)
Security Update for CAPICOM (KB931906)
Security Update for Microsoft Office Excel 2007 (KB958437)
Security Update for Microsoft Office PowerPoint 2007 (KB951338)
Security Update for Microsoft Office system 2007 (KB954326)
Security Update for Microsoft Office system 2007 (KB956828)
Security Update for Microsoft Office Word 2007 (KB956358)
Security Update for Visio 2007 (KB947590)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 8 (KB960714)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 10 (KB936782)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896422)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899588)
Security Update for Windows XP (KB899589)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB916281)
Security Update for Windows XP (KB917159)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB918899)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920214)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923694)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925454)
Security Update for Windows XP (KB925486)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB929969)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933729)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB937894)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB938829)
Security Update for Windows XP (KB941202)
Security Update for Windows XP (KB941568)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB941644)
Security Update for Windows XP (KB941693)
Security Update for Windows XP (KB943055)
Security Update for Windows XP (KB943460)
Security Update for Windows XP (KB943485)
Security Update for Windows XP (KB944653)
Security Update for Windows XP (KB945553)
Security Update for Windows XP (KB946026)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB948590)
Security Update for Windows XP (KB948881)
Security Update for Windows XP (KB950749)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Skype 2.5
Skype Setup
SolutionCenter
Sonic Activation Module
Sonic Advanced Decoder
Sonic Encoders
Sonic Update Manager
Sony Ericsson Themes Creator 3.11
Sony USB Driver
Sound Blaster ADVANCED MB Drivers
Sound Blaster Audigy ADVANCED MB
Sound Blaster Audigy ADVANCED MB Product Registration
Spyware Terminator
Status
Synaptics Pointing Device Driver
The Sims Unleashed
Toolbox
Tradewinds
TrayApp
Trend Micro RUBotted
Trend Micro TrendProtect for Internet Explorer
Trend Microâ„¢ eMail ID
Unload
Update for Microsoft Office Outlook 2007 (KB952142)
Update for Office 2007 (KB946691)
Update for Outlook 2007 Junk Email Filter (kb958619)
Update for Windows Media Player 10 (KB910393)
Update for Windows Media Player 10 (KB913800)
Update for Windows Media Player 10 (KB926251)
Update for Windows XP (KB894391)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB912945)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB927891)
Update for Windows XP (KB930916)
Update for Windows XP (KB931836)
Update for Windows XP (KB932823-v3)
Update for Windows XP (KB933360)
Update for Windows XP (KB936357)
Update for Windows XP (KB938828)
Update for Windows XP (KB942763)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB955839)
Update Rollup 2 for Windows XP Media Center Edition 2005
Viewpoint Media Player
VS2005 Redist
WebCyberCoach 3.2 Dell
WebFldrs XP
WebReg
WildTangent Web Driver
Windows Defender
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Imaging Component
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Internet Explorer 8 Beta 2
Windows Live Mail
Windows Media Format 11 runtime
Windows Media Player 10
Windows Media Player 10 Hotfix [See EmeraldQFE2 for more information]
Windows Media Player 11
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB885855
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB889673
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB890927
Windows XP Hotfix - KB891781
Windows XP Hotfix - KB892627
Windows XP Hotfix - KB893056
Windows XP Media Center Edition 2005 KB908246
Windows XP Media Center Edition 2005 KB925766
WinRAR archiver
Yahoo! Browser Services
Yahoo! Install Manager
Yahoo! Internet Mail
Yahoo! Messenger
Yugma

==== Event Viewer Messages From Past Week ========

12/16/2008 11:50:48 AM, error: Service Control Manager [7024] - The Media Center Extender Service service terminated with service-specific error 2147549183 (0x8000FFFF).
12/16/2008 11:50:48 AM, error: Service Control Manager [7023] - The IPSEC Services service terminated with the following error: An invalid argument was supplied.
12/16/2008 11:50:48 AM, error: Service Control Manager [7024] - The Bonjour Service service terminated with service-specific error 4294967295 (0xFFFFFFFF).
12/16/2008 11:20:50 AM, error: ipnathlp [32003] - The Network Address Translator (NAT) was unable to request an operation of the kernel-mode translation module. This may indicate misconfiguration, insufficient resources, or an internal error. The data is the error code.
12/16/2008 11:20:50 AM, error: Dhcp [1002] - The IP address lease 192.168.15.103 for the Network Card with network address 001302C21210 has been denied by the DHCP server 192.168.15.1 (The DHCP Server sent a DHCPNACK message).
12/16/2008 9:13:22 AM, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751)
12/16/2008 9:09:51 PM, error: Dhcp [1002] - The IP address lease 192.168.15.102 for the Network Card with network address 001302C21210 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).
12/16/2008 9:10:58 PM, error: Dhcp [1001] - Your computer was not assigned an address from the network (by the DHCP Server) for the Network Card with network address 001302C21210. The following error occurred: The semaphore timeout period has expired. . Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.
12/17/2008 8:31:50 PM, error: Print [19] - Sharing printer failed + 1722, Printer HP LaserJet 4300 PCL 6 share name HP LaserJet 4300 PCL 6.
12/18/2008 8:10:09 AM, error: Print [19] - Sharing printer failed + 1722, Printer HP Officejet 4300 series share name HP Officejet 4300 series.
12/18/2008 12:49:49 PM, error: Print [19] - Sharing printer failed + 1722, Printer HP Officejet 4300 series fax share name HP Officejet 4300 series fax.
12/19/2008 8:40:44 AM, error: Dhcp [1002] - The IP address lease 192.168.15.102 for the Network Card with network address 001302C21210 has been denied by the DHCP server 192.168.15.1 (The DHCP Server sent a DHCPNACK message).
12/19/2008 3:58:17 PM, error: Dhcp [1002] - The IP address lease 192.168.1.109 for the Network Card with network address 001302C21210 has been denied by the DHCP server 192.168.15.1 (The DHCP Server sent a DHCPNACK message).
12/20/2008 11:02:09 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Iconix Update Service service to connect.
12/20/2008 11:02:09 PM, error: Service Control Manager [7000] - The Iconix Update Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
12/21/2008 3:32:56 PM, error: Dhcp [1001] - Your computer was not assigned an address from the network (by the DHCP Server) for the Network Card with network address 001302C21210. The following error occurred: The operation was canceled by the user. . Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.
12/22/2008 8:57:54 AM, error: Dhcp [1002] - The IP address lease 192.168.15.103 for the Network Card with network address 001302C21210 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).

==== End Of File ===========================

------------------------------------------------------------------------
------------------------------------------------------------------------

DDS (Version 1.1.0) - NTFSx86
Run by Kristina Formanes at 9:40:46.89 on Mon 12/22/2008
Internet Explorer: 8.0.6001.18241
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1014.340 [GMT -5:00]

AV: Avira AntiVir PersonalEdition *On-access scanning enabled* (Updated)
FW: Norton AntiVirus *enabled*

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\eMail ID\OEAddOn\OEdmn_4.exe
C:\Program Files\Trend Micro\RUBotted\TMRUBottedTray.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Common Files\eMail ID\IconixService.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Trend Micro\RUBotted\TMRUBotted.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
svchost.exe
C:\WINDOWS\system32\stacsv.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\svchost.exe -k netsvcs
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe
C:\PROGRA~1\Crawler\Toolbar\CToolbar.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Kristina Formanes\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
uInternet Settings,ProxyServer = 196.168.1.254:1234
uInternet Settings,ProxyOverride = <local>;*.local
BHO: Adobe PDF Reader Link Helper: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: N/A: {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - c:\progra~1\crawler\toolbar\ctbr.dll
BHO: Yahoo! IE Services Button: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - c:\program files\yahoo!\common\yiesrvc.dll
BHO: IconixBHOClass Class: {761233B6-F228-49E4-8F6B-668499D4E55A} - c:\program files\email id\ieaddon\IconixBHO_37.dll
BHO: SSVHelper Class: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre1.6.0_07\bin\ssv.dll
BHO: BhoMisc Class: {E3578B37-6346-4EC1-A82B-38273A100DCF} - c:\program files\trend micro\trendprotect\msie\wrs.dll
TB: &Crawler Toolbar: {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - c:\progra~1\crawler\toolbar\ctbr.dll
TB: TrendProtect: {F83BE649-1CC3-48EE-B2E2-0826CEF3822A} - c:\program files\trend micro\trendprotect\msie\wrs.dll
uRun: [ModemOnHold] c:\program files\netwaiting\netWaiting.exe
uRun: [SetDefaultMIDI] MIDIDef.exe
uRun: [Creative Detector] "c:\program files\creative\mediasource\detector\CTDetect.exe" /R
uRun: [DellSupport] "c:\program files\dellsupport\DSAgnt.exe" /startup
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [DellSupportCenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P DellSupportCenter
mRun: [avgnt] "c:\program files\avira\antivir personaledition classic\avgnt.exe" /min
mRun: [SpywareTerminator] "c:\program files\spyware terminator\SpywareTerminatorShield.exe "
mRun: [SunJavaUpdateSched] "c:\program files\java\jre1.6.0_07\bin\jusched.exe "
mRun: [dscactivate] "c:\program files\dell support center\gs_agent\custom\dsca.exe "
mRun: [DellSupportCenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P DellSupportCenter
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe "
mRun: [Gfixegemidaribi] rundll32.exe "c:\windows\axapazucowopo.dll ",e
mRun: [IconixOEAddOn] "c:\program files\email id\oeaddon\OEdmn_4.exe "
mRun: [TMRUBottedTray] "c:\program files\trend micro\rubotted\TMRUBottedTray.exe "
StartupFolder: c:\docume~1\kristi~1\startm~1\programs\startup\multip~1.lnk - c:\program files\multiply\autouploader\multiply autouploader\Multiply AutoUploader.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe
IE: Crawler Search - tbr:iemenu
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}
IE: {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - c:\program files\yahoo!\messenger\YahooMessenger.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_07\bin\ssv.dll
IE: {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - {7DD73374-7187-4103-8F29-622AA25E7C40}
IE: {400A6CFA-E326-4d61-A90C-9AD75358DC5F} - {44E212AB-13EA-4CA4-BE65-197FBA170412} - c:\program files\email id\ieaddon\IconixBHO_37.dll
IE: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - c:\program files\yahoo!\common\yiesrvc.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
IE: {BC3F6B6D-2E49-4603-B028-7411655713F3} - {0CC2F28D-D415-4FC6-A2E4-54B4D983609A} - c:\program files\email id\ieaddon\IconixBHO_37.dll
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} -
IE: {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - c:\program files\yahoo!\messenger\YahooMessenger.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\crawler\toolbar\ctbr.dll
Handler: trendprotect - {BC3A5F6F-12A0-4B14-A184-32939F413823} - c:\program files\trend micro\trendprotect\msie\WRS.dll
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Microsoft AntiMalware ShellExecuteHook: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - c:\progra~1\wifd1f~1\MpShHook.dll

============= SERVICES / DRIVERS ===============

R1 avgio;avgio;\??\c:\program files\avira\antivir personaledition classic\avgio.sys [2008-9-22 11840]
R1 sp_rsdrv2;Spyware Terminator Driver 2;\??\c:\windows\system32\drivers\sp_rsdrv2.sys [2008-9-22 141312]
R2 AntiVirScheduler;Avira AntiVir Personal - Free Antivirus Scheduler; "c:\program files\avira\antivir personaledition classic\sched.exe" [2008-9-22 68865]
R2 AntiVirService;Avira AntiVir Personal - Free Antivirus Guard; "c:\program files\avira\antivir personaledition classic\avguard.exe" [2008-9-22 151297]
R2 IconixService;Iconix Update Service; "c:\program files\common files\email id\IconixService.exe" [2008-12-20 258832]
R2 McProxy;McAfee Proxy Service;c:\progra~1\common~1\mcafee\mcproxy\mcproxy.exe [2007-11-20 359248]
R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]
R2 RUBotted;Trend Micro RUBotted Service; "c:\program files\trend micro\rubotted\TMRUBotted.exe" [2008-12-20 582992]
R2 WinDefend;Windows Defender; "c:\program files\windows defender\MsMpEng.exe" [2006-11-3 13592]
R3 avgntflt;avgntflt;\??\c:\program files\avira\antivir personaledition classic\avgntflt.sys [2008-9-22 52032]
R3 dfmirage;dfmirage;c:\windows\system32\drivers\dfmirage.sys [2005-11-25 31896]
R3 TMPassthruMP;TMPassthruMP;c:\windows\system32\drivers\TMPassthru.sys [2008-12-20 206608]
S0 fvdscsi;fvdscsi;c:\windows\system32\drivers\fvdscsi.sys []
S3 Frtmgiimi;Frtmgiimi;c:\windows\system32\drivers\netbt.sys [2005-8-16 162816]
S3 TMPassthru;Trend Micro Passthru Ndis Service;c:\windows\system32\drivers\TMPassthru.sys [2008-12-20 206608]

============== File Associations ===============

JSEFile=NOTEPAD.EXE %1
VBEFile=NOTEPAD.EXE %1
VBSFile=NOTEPAD.EXE %1

=============== Created Last 30 ================

2008-12-20 23:19 206,608 a------- c:\windows\system32\drivers\TMPassthru.sys
2008-12-20 23:02 <DIR> --d----- c:\docume~1\kristi~1\applic~1\eMail ID
2008-12-20 23:02 <DIR> --d----- c:\docume~1\alluse~1\applic~1\eMail ID
2008-12-20 23:01 <DIR> --d----- c:\program files\common files\eMail ID
2008-12-20 23:01 <DIR> --d----- c:\program files\eMail ID
2008-12-18 03:22 <DIR> --d----- c:\windows\ie8updates
2008-12-17 20:57 <DIR> --d----- c:\program files\DemoForge
2008-12-17 20:56 <DIR> --d-h--- c:\program files\Zero G Registry
2008-12-17 20:56 <DIR> --d-h--- c:\documents and settings\kristina formanes\InstallAnywhere
2008-12-17 20:53 <DIR> --d----- c:\documents and settings\kristina formanes\Yugma
2008-12-04 13:53 132,096 a------- c:\windows\axapazucowopo.dll
2008-12-01 08:45 <DIR> --d----- c:\program files\iPod
2008-12-01 08:45 <DIR> --d----- c:\program files\iTunes
2008-12-01 08:45 <DIR> --d----- c:\docume~1\alluse~1\applic~1\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-11-22 17:16 <DIR> --d----- c:\docume~1\kristi~1\applic~1\com.Multiply.AutoUploader.C7DF09F73C2059D294831784007C5F0856677385.1
2008-11-22 17:13 <DIR> --d----- c:\program files\Multiply

==================== Find3M ====================

2008-12-22 08:57 0 a------- c:\windows\system32\drivers\lvuvc.hs
2008-12-14 08:59 5,699,584 a------- c:\windows\system32\dllcache\mshtml.dll
2008-10-24 06:10 453,632 a------- c:\windows\system32\drivers\mrxsmb.sys
2008-10-24 06:10 453,632 -------- c:\windows\system32\dllcache\mrxsmb.sys
2008-10-23 08:01 283,648 a------- c:\windows\system32\gdi32.dll
2008-10-23 08:01 283,648 -------- c:\windows\system32\dllcache\gdi32.dll
2008-10-16 14:13 1,809,944 a------- c:\windows\system32\dllcache\wuaueng.dll
2008-10-16 14:13 202,776 a------- c:\windows\system32\dllcache\wuweb.dll
2008-10-16 14:12 323,608 a------- c:\windows\system32\dllcache\wucltui.dll
2008-10-16 14:12 561,688 a------- c:\windows\system32\dllcache\wuapi.dll
2008-10-16 14:09 92,696 a------- c:\windows\system32\dllcache\cdm.dll
2008-10-16 14:09 51,224 a------- c:\windows\system32\dllcache\wuauclt.exe
2008-10-16 14:08 34,328 a------- c:\windows\system32\dllcache\wups.dll
2008-10-16 14:06 268,648 a------- c:\windows\system32\mucltui.dll
2008-10-16 14:06 208,744 a------- c:\windows\system32\muweb.dll
2008-10-15 11:57 332,800 -------- c:\windows\system32\dllcache\netapi32.dll
2008-10-03 05:15 247,326 a------- c:\windows\system32\strmdll.dll
2008-10-03 05:15 247,326 -------- c:\windows\system32\dllcache\strmdll.dll
2008-09-30 16:43 1,286,152 a------- c:\windows\system32\msxml4.dll
2007-10-17 08:58 774,144 a------- c:\program files\RngInterstitial.dll
2007-01-24 20:40 88 ---shr-- c:\windows\system32\EB071C84D8.sys
2007-01-24 20:40 3,766 a--sh--- c:\windows\system32\KGyGaAvL.sys

============= FINISH: 9:41:20.25 ===============

noahdfear · 2008/12/22

Please visit the following webpage for instructions for downloading and running ComboFix

How to use ComboFix

Download ComboFix by sUBs from here, saving the file to your desktop.

Disable realtime protection applications as they sometimes interfere with the tool. Check this link for your applicable programs.

Close all open programs and windows

Double click ComboFix.exe and follow the prompts.

It may reboot your computer and resume running when you logon. Wait for it to complete. When finished, it will open a log for you. Post that log in your next reply.

Note: Do not mouseclick combofix's window while its running. That may cause it to stall

**NOTE - I recommend you allow the Recovery Console to be downloaded and installed if or when prompted.

tinapie · 2008/12/22

[Active] Explorer.EXE and IEXPLORE.EXE virus

I was quite hesitant at first to download the Combofix as I was prompted that the site was reported to Microsoft as unsafe. Anyway, I still downloaded it.

Here is the log:

ComboFix 08-12-21.04 - Kristina Formanes 2008-12-22 20:36:01.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1014.519 [GMT -5:00]
Running from: c:\documents and settings\Kristina Formanes\Desktop\ComboFix.exe
* Created a new restore point
.
The following files were disabled during the run:
c:\program files\Common Files\Logitech\LVMVFM\LVPrcInj.dll

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\nmllm.ini
F:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2008-11-23 to 2008-12-23 )))))))))))))))))))))))))))))))
.

2008-12-22 20:14 . 2008-12-22 20:14 <DIR> d-------- c:\documents and settings\All Users\Application Data\Avira
2008-12-22 17:08 . 2008-12-22 17:08 <DIR> d-------- c:\windows\system32\drivers\NAV
2008-12-22 17:08 . 2008-12-22 20:03 <DIR> d-------- c:\documents and settings\All Users\Application Data\Norton
2008-12-22 17:05 . 2008-12-22 17:05 <DIR> d-------- c:\program files\NortonInstaller
2008-12-22 17:04 . 2008-12-22 17:04 <DIR> d-------- c:\documents and settings\All Users\Symantec Temporary Files
2008-12-22 16:57 . 2008-12-22 16:57 <DIR> d-------- c:\documents and settings\All Users\Application Data\NortonInstaller
2008-12-20 23:19 . 2008-03-02 03:28 206,608 --a------ c:\windows\system32\drivers\TMPassthru.sys
2008-12-20 23:18 . 2008-12-20 23:18 <DIR> d-------- c:\documents and settings\Kristina Formanes\Application Data\InstallShield
2008-12-20 23:02 . 2008-12-21 00:12 <DIR> d-------- c:\documents and settings\Kristina Formanes\Application Data\eMail ID
2008-12-20 23:02 . 2008-12-20 23:02 <DIR> d-------- c:\documents and settings\All Users\Application Data\eMail ID
2008-12-20 23:01 . 2008-12-20 23:02 <DIR> d-------- c:\program files\eMail ID
2008-12-20 23:01 . 2008-12-20 23:01 <DIR> d-------- c:\program files\Common Files\eMail ID
2008-12-18 03:22 . 2008-12-18 03:22 <DIR> d-------- c:\windows\ie8updates
2008-12-17 20:57 . 2008-12-17 20:57 <DIR> d-------- c:\program files\DemoForge
2008-12-17 20:56 . 2008-12-17 20:56 <DIR> d--h----- c:\program files\Zero G Registry
2008-12-17 20:56 . 2008-12-17 20:56 <DIR> d--h----- c:\documents and settings\Kristina Formanes\InstallAnywhere
2008-12-17 20:53 . 2008-12-17 20:53 <DIR> d-------- c:\documents and settings\Kristina Formanes\Yugma
2008-12-04 13:53 . 2008-12-04 13:53 132,096 --a------ c:\windows\axapazucowopo.dll
2008-12-01 08:45 . 2008-12-01 08:46 <DIR> d-------- c:\program files\iTunes
2008-12-01 08:45 . 2008-12-01 08:45 <DIR> d-------- c:\program files\iPod
2008-12-01 08:45 . 2008-12-01 08:46 <DIR> d-------- c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-12-01 08:42 . 2008-12-01 08:43 <DIR> d-------- c:\program files\QuickTime

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-23 01:21 --------- d-----w c:\program files\Norton Security Scan
2008-12-23 01:12 0 ----a-w c:\windows\system32\drivers\lvuvc.hs
2008-12-23 01:06 --------- d-----w c:\program files\Common Files\Symantec Shared
2008-12-22 21:51 --------- d-----w c:\documents and settings\Kristina Formanes\Application Data\Symantec
2008-12-21 04:40 --------- d-----w c:\program files\Trend Micro
2008-12-21 04:19 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-16 14:09 --------- d-----w c:\program files\Yahoo!
2008-12-15 20:35 --------- d-----w c:\program files\Google
2008-12-14 13:59 5,699,584 ----a-w c:\windows\system32\dllcache\mshtml.dll
2008-12-11 19:54 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2008-12-01 15:43 --------- d-----w c:\documents and settings\Kristina Formanes\Application Data\Move Networks
2008-12-01 13:45 --------- d-----w c:\program files\Common Files\Apple
2008-11-22 22:16 --------- d-----w c:\documents and settings\Kristina Formanes\Application

Data\com.Multiply.AutoUploader.C7DF09F73C2059D294831784007C5F0856677385.1
2008-11-22 22:13 --------- d-----w c:\program files\Multiply
2008-11-22 22:13 --------- d-----w c:\program files\Common Files\Adobe AIR
2008-11-05 17:59 --------- d-----w c:\documents and settings\All Users\Application Data\MSScanAppDataDir
2008-10-30 17:06 --------- d-----w c:\program files\Avery Wizard 3.1
2008-10-24 11:10 453,632 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-24 11:10 453,632 ------w c:\windows\system32\dllcache\mrxsmb.sys
2008-10-23 13:01 283,648 ----a-w c:\windows\system32\gdi32.dll
2008-10-23 13:01 283,648 ------w c:\windows\system32\dllcache\gdi32.dll
2008-10-16 19:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 19:13 202,776 ----a-w c:\windows\system32\dllcache\wuweb.dll
2008-10-16 19:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 19:13 1,809,944 ----a-w c:\windows\system32\dllcache\wuaueng.dll
2008-10-16 19:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 19:12 561,688 ----a-w c:\windows\system32\dllcache\wuapi.dll
2008-10-16 19:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 19:12 323,608 ----a-w c:\windows\system32\dllcache\wucltui.dll
2008-10-16 19:09 92,696 ----a-w c:\windows\system32\dllcache\cdm.dll
2008-10-16 19:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 19:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 19:09 51,224 ----a-w c:\windows\system32\dllcache\wuauclt.exe
2008-10-16 19:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 19:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 19:08 34,328 ----a-w c:\windows\system32\dllcache\wups.dll
2008-10-16 19:06 268,648 ----a-w c:\windows\system32\mucltui.dll
2008-10-16 19:06 208,744 ----a-w c:\windows\system32\muweb.dll
2008-10-15 16:57 332,800 ------w c:\windows\system32\dllcache\netapi32.dll
2008-10-03 10:15 247,326 ----a-w c:\windows\system32\strmdll.dll
2008-10-03 10:15 247,326 ------w c:\windows\system32\dllcache\strmdll.dll
2008-09-30 21:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll
2008-05-24 01:31 24,678 -c--a-w c:\documents and settings\Incomplete\downloads.dat
2007-10-17 13:58 774,144 ----a-w c:\program files\RngInterstitial.dll
2007-01-25 01:40 88 --sh--r c:\windows\system32\EB071C84D8.sys
2007-01-25 01:40 3,766 --sha-w c:\windows\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ModemOnHold "= "c:\program files\NetWaiting\netWaiting.exe" [2003-09-10 20480]
"Creative Detector "= "c:\program files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 102400]
"DellSupport "= "c:\program files\DellSupport\DSAgnt.exe" [2007-03-14 460784]
"ctfmon.exe "= "c:\windows\system32\ctfmon.exe" [2004-08-10 15360]
"DellSupportCenter "= "c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-14 206064]
"SetDefaultMIDI "= "MIDIDef.exe" [2004-12-22 c:\windows\MIDIDEF.EXE]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched "= "c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"dscactivate "= "c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2008-03-11 16384]
"DellSupportCenter "= "c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-14 206064]
"QuickTime Task "= "c:\program files\QuickTime\qttask.exe" [2008-11-04 413696]
"iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"Gfixegemidaribi "= "c:\windows\axapazucowopo.dll" [2008-12-04 132096]
"IconixOEAddOn "= "c:\program files\eMail ID\OEAddOn\OEdmn_4.exe" [2008-12-08 333584]
"TMRUBottedTray "= "c:\program files\Trend Micro\RUBotted\TMRUBottedTray.exe" [2008-11-06 288088]
"avgnt "= "c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-07-26 24576]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe "=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe "=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe "=
"c:\\Program Files\\Messenger\\msmsgs.exe "=
"c:\\Program Files\\America Online 9.0\\waol.exe "=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqtra08.exe "=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqste08.exe "=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpofxm08.exe "=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hposfx08.exe "=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hposid01.exe "=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqscnvw.exe "=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqkygrp.exe "=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqCopy.exe "=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpfccopy.exe "=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpzwiz01.exe "=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\Unload\\HpqPhUnl.exe "=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\Unload\\HpqDIA.exe "=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpoews01.exe "=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqnrs08.exe "=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE "=
"c:\\Program Files\\Skype\\Phone\\Skype.exe "=
"c:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe "=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe "=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe "=
"c:\\WINDOWS\\ehome\\ehshell.exe "=
"c:\\Program Files\\iTunes\\iTunes.exe "=

R2 IconixService;Iconix Update Service; "c:\program files\Common Files\eMail ID\IconixService.exe" [2008-12-20 258832]
R2 RUBotted;Trend Micro RUBotted Service; "c:\program files\Trend Micro\RUBotted\TMRUBotted.exe" [2008-12-20 582992]
R2 WinDefend;Windows Defender; "c:\program files\Windows Defender\MsMpEng.exe" [2006-11-03 13592]
R3 dfmirage;dfmirage;c:\windows\system32\DRIVERS\dfmirage.sys [2005-11-25 31896]
R3 TMPassthruMP;TMPassthruMP;c:\windows\system32\DRIVERS\TMPassthru.sys [2008-12-20 206608]
S0 fvdscsi;fvdscsi;c:\windows\system32\DRIVERS\fvdscsi.sys []
S3 Frtmgiimi;Frtmgiimi;c:\windows\system32\drivers\netbt.sys [2005-08-16 162816]
S3 TMPassthru;Trend Micro Passthru Ndis Service;c:\windows\system32\DRIVERS\TMPassthru.sys [2008-12-20 206608]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2bb22c86-38bd-11dc-8021-00038a000015}]
\Shell\AutoRun\command - E:\LaunchU3.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}]
\Shell\AutoRun\command - E:\setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{753f433e-b29e-11db-beed-00038a000015}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL NETSVCS.EXE
\Shell\Ã©_â€ â„¢\command - NETSVCS.EXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a4575e5a-9673-11db-be65-00038a000015}]
\Shell\AutoRun\command - ie.exe
\Shell\explore\Command - ie.exe
\Shell\open\Command - ie.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bece751c-9b04-11db-be77-00038a000015}]
\Shell\AutoRun\command - E:\ie.exe
\Shell\explore\Command - E:\ie.exe
\Shell\open\Command - E:\ie.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e6f4c178-8839-11db-be4c-00038a000015}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL exiplorer.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e9f45398-8a41-11dd-83c6-00038a000015}]
\Shell\AutoRun\command - e:\wd_windows_tools\Setup.exe

*Newly Created Service* - ANTIVIRSCHEDULER
*Newly Created Service* - ANTIVIRSERVICE
*Newly Created Service* - AVGIO
*Newly Created Service* - AVGNTFLT
*Newly Created Service* - AVIPBB
.
Contents of the 'Scheduled Tasks' folder

2008-09-13 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-29 23:34]

2008-12-19 c:\windows\Tasks\McAfee.com Scan for Viruses - My Computer (KRISTINA21-Roland Recomono).job
- c:\program files\mcafee.com\vso\mcmnhdlr.exe []

2008-02-14 c:\windows\Tasks\McDefragTask.job
- c:\windows\SYSTEM32\defrag.exe [2004-08-10 05:00]

2008-04-30 c:\windows\Tasks\McQcTask.job
- c:\program files\mcafee\mqc\QcConsol.exe []

2008-12-23 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 18:20]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
uInternet Settings,ProxyServer = 196.168.1.254:1234
uInternet Settings,ProxyOverride = <local>;*.local
IE: Crawler Search - tbr:iemenu
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\Crawler\Toolbar\ctbr.dll
Handler: trendprotect - {BC3A5F6F-12A0-4B14-A184-32939F413823} - c:\program files\Trend Micro\TrendProtect\MSIE\WRS.dll

c:\windows\system32\unicows.dll - c:\windows\Downloaded Program Files\LPUploader45.ocx
O16 -: {0C92900E-4D5A-4F04-ACC9-729E1767BBAE}
hxxp://safeway.lifepics.com/net/Uploader/LPUploader45.cab
c:\windows\Downloaded Program Files\LPUploader45.inf

c:\windows\system32\gtdownde_110.ocx - O16 -: {E856B973-45FD-4559-8F82-EAB539144667}
hxxp://pccheckup.dellfix.com/rel/41/install/gtdownde.cab
c:\windows\Downloaded Program Files\gtdownde_110.inf
.
.
------- File Associations -------
.
JSEFile=NOTEPAD.EXE %1
VBEFile=NOTEPAD.EXE %1
VBSFile=NOTEPAD.EXE %1
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-22 20:37:46
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-12-22 20:38:55
ComboFix-quarantined-files.txt 2008-12-23 01:38:28
ComboFix2.txt 2008-09-30 12:57:56

Pre-Run: 15,466,823,680 bytes free
Post-Run: 15,654,596,608 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT= "Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS= "Windows XP Media Center Edition" /noexecute=optin /fastdetect

243 --- E O F --- 2008-12-18 18:45:1

noahdfear · 2008/12/22

Was that the IE phishing filter that alerted you, and was it for the site or the ComboFix download?

You have a flash drive infection. Please download Flash_Disinfector by sUBs and save it to your desktop:

NOTE: In the event you already have Flash_Disinfector, this is a new version that I need you to download.

Plug in your USB flash drive.

Double-click Flash_Disinfector.exe to run it.

Follow any prompts that may appear.

Your desktop will vanish for a while, and then reappear. This is normal.

Wait until the program has finished scanning, then please exit the program. If you use more than 1 flash drive, run the tool with each plugged in.

Please leave the flash drive plugged in whilst completing the following ComboFix instructions.

Once again, please disable any realtime protection applications. Highlight and copy the contents of the code box below and paste it into a blank notepad, then save it to your desktop as;

Filename: CFScript.txt
Save As Type: All Files (*.*)
Code:
http://www.windowsbbs.com/malware-virus-removal/79767-active-explorer-exe-iexplore-exe-virus.html#post433783

Collect::
c:\windows\axapazucowopo.dll
E:\ie.exe
Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{753f433e-b29e-11db-beed-00038a000015}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a4575e5a-9673-11db-be65-00038a000015}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bece751c-9b04-11db-be77-00038a000015}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e6f4c178-8839-11db-be4c-00038a000015}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
 "Gfixegemidaribi "=-
Close all other windows and programs. Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button. Combofix should run and may reboot the computer when it's done. A log will open when it's complete. Post the contents of that log here.

Please do not click on the ComboFix window while it is running a scan. This can cause it to stall.

Please note that I have instructed CFScript to collect some files. This means that when ComboFix finishes, you will be prompted to allow ComboFix to upload a zip file that was created. The zip contains the aforementioned files. Please copy the path shown in the prompt and paste it into the box, then click Send. This will assist the author in adding the files for removal in future updates. Thanks!

tinapie · 2008/12/22

[Active] Explorer.EXE and IEXPLORE.EXE virus

I am not sure if it was the IE phishing site or the TrendProtect I downloaded from TrendMicro, as I was paranoid that virus has infected my laptop.

I did as what you have instructed me. I also sent the zip file. Here is the latest ComboFix log:

ComboFix 08-12-21.04 - Kristina Formanes 2008-12-22 21:11:48.5 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1014.500 [GMT -5:00]
Running from: c:\documents and settings\Kristina Formanes\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Kristina Formanes\Desktop\CFScript.txt
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\axapazucowopo.dll

.
((((((((((((((((((((((((( Files Created from 2008-11-23 to 2008-12-23 )))))))))))))))))))))))))))))))
.

2008-12-22 20:14 . 2008-12-22 20:14 <DIR> d-------- c:\documents and settings\All Users\Application Data\Avira
2008-12-22 17:08 . 2008-12-22 17:08 <DIR> d-------- c:\windows\system32\drivers\NAV
2008-12-22 17:08 . 2008-12-22 20:03 <DIR> d-------- c:\documents and settings\All Users\Application Data\Norton
2008-12-22 17:05 . 2008-12-22 17:05 <DIR> d-------- c:\program files\NortonInstaller
2008-12-22 17:04 . 2008-12-22 17:04 <DIR> d-------- c:\documents and settings\All Users\Symantec Temporary Files
2008-12-22 16:57 . 2008-12-22 16:57 <DIR> d-------- c:\documents and settings\All Users\Application Data\NortonInstaller
2008-12-20 23:19 . 2008-03-02 03:28 206,608 --a------ c:\windows\system32\drivers\TMPassthru.sys
2008-12-20 23:18 . 2008-12-20 23:18 <DIR> d-------- c:\documents and settings\Kristina Formanes\Application Data\InstallShield
2008-12-20 23:02 . 2008-12-21 00:12 <DIR> d-------- c:\documents and settings\Kristina Formanes\Application Data\eMail ID
2008-12-20 23:02 . 2008-12-20 23:02 <DIR> d-------- c:\documents and settings\All Users\Application Data\eMail ID
2008-12-20 23:01 . 2008-12-20 23:02 <DIR> d-------- c:\program files\eMail ID
2008-12-20 23:01 . 2008-12-20 23:01 <DIR> d-------- c:\program files\Common Files\eMail ID
2008-12-18 03:22 . 2008-12-18 03:22 <DIR> d-------- c:\windows\ie8updates
2008-12-17 20:57 . 2008-12-17 20:57 <DIR> d-------- c:\program files\DemoForge
2008-12-17 20:56 . 2008-12-17 20:56 <DIR> d--h----- c:\program files\Zero G Registry
2008-12-17 20:56 . 2008-12-17 20:56 <DIR> d--h----- c:\documents and settings\Kristina Formanes\InstallAnywhere
2008-12-17 20:53 . 2008-12-17 20:53 <DIR> d-------- c:\documents and settings\Kristina Formanes\Yugma
2008-12-01 08:45 . 2008-12-01 08:46 <DIR> d-------- c:\program files\iTunes
2008-12-01 08:45 . 2008-12-01 08:45 <DIR> d-------- c:\program files\iPod
2008-12-01 08:45 . 2008-12-01 08:46 <DIR> d-------- c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-12-01 08:42 . 2008-12-01 08:43 <DIR> d-------- c:\program files\QuickTime

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-23 01:21 --------- d-----w c:\program files\Norton Security Scan
2008-12-23 01:12 0 ----a-w c:\windows\system32\drivers\lvuvc.hs
2008-12-23 01:06 --------- d-----w c:\program files\Common Files\Symantec Shared
2008-12-22 21:51 --------- d-----w c:\documents and settings\Kristina Formanes\Application Data\Symantec
2008-12-21 04:40 --------- d-----w c:\program files\Trend Micro
2008-12-21 04:19 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-16 14:09 --------- d-----w c:\program files\Yahoo!
2008-12-15 20:35 --------- d-----w c:\program files\Google
2008-12-14 13:59 5,699,584 ----a-w c:\windows\system32\dllcache\mshtml.dll
2008-12-11 19:54 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2008-12-01 15:43 --------- d-----w c:\documents and settings\Kristina Formanes\Application Data\Move Networks
2008-12-01 13:45 --------- d-----w c:\program files\Common Files\Apple
2008-11-22 22:16 --------- d-----w c:\documents and settings\Kristina Formanes\Application

Data\com.Multiply.AutoUploader.C7DF09F73C2059D294831784007C5F0856677385.1
2008-11-22 22:13 --------- d-----w c:\program files\Multiply
2008-11-22 22:13 --------- d-----w c:\program files\Common Files\Adobe AIR
2008-11-05 17:59 --------- d-----w c:\documents and settings\All Users\Application Data\MSScanAppDataDir
2008-10-30 17:06 --------- d-----w c:\program files\Avery Wizard 3.1
2008-10-24 11:10 453,632 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-24 11:10 453,632 ------w c:\windows\system32\dllcache\mrxsmb.sys
2008-10-23 13:01 283,648 ----a-w c:\windows\system32\gdi32.dll
2008-10-23 13:01 283,648 ------w c:\windows\system32\dllcache\gdi32.dll
2008-10-16 19:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 19:13 202,776 ----a-w c:\windows\system32\dllcache\wuweb.dll
2008-10-16 19:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 19:13 1,809,944 ----a-w c:\windows\system32\dllcache\wuaueng.dll
2008-10-16 19:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 19:12 561,688 ----a-w c:\windows\system32\dllcache\wuapi.dll
2008-10-16 19:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 19:12 323,608 ----a-w c:\windows\system32\dllcache\wucltui.dll
2008-10-16 19:09 92,696 ----a-w c:\windows\system32\dllcache\cdm.dll
2008-10-16 19:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 19:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 19:09 51,224 ----a-w c:\windows\system32\dllcache\wuauclt.exe
2008-10-16 19:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 19:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 19:08 34,328 ----a-w c:\windows\system32\dllcache\wups.dll
2008-10-16 19:06 268,648 ----a-w c:\windows\system32\mucltui.dll
2008-10-16 19:06 208,744 ----a-w c:\windows\system32\muweb.dll
2008-10-15 16:57 332,800 ------w c:\windows\system32\dllcache\netapi32.dll
2008-10-03 10:15 247,326 ----a-w c:\windows\system32\strmdll.dll
2008-10-03 10:15 247,326 ------w c:\windows\system32\dllcache\strmdll.dll
2008-09-30 21:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll
2008-05-24 01:31 24,678 -c--a-w c:\documents and settings\Incomplete\downloads.dat
2007-10-17 13:58 774,144 ----a-w c:\program files\RngInterstitial.dll
2007-01-25 01:40 88 --sh--r c:\windows\system32\EB071C84D8.sys
2007-01-25 01:40 3,766 --sha-w c:\windows\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ModemOnHold "= "c:\program files\NetWaiting\netWaiting.exe" [2003-09-10 20480]
"Creative Detector "= "c:\program files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 102400]
"DellSupport "= "c:\program files\DellSupport\DSAgnt.exe" [2007-03-14 460784]
"ctfmon.exe "= "c:\windows\system32\ctfmon.exe" [2004-08-10 15360]
"DellSupportCenter "= "c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-14 206064]
"SetDefaultMIDI "= "MIDIDef.exe" [2004-12-22 c:\windows\MIDIDEF.EXE]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched "= "c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"dscactivate "= "c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2008-03-11 16384]
"DellSupportCenter "= "c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-14 206064]
"QuickTime Task "= "c:\program files\QuickTime\qttask.exe" [2008-11-04 413696]
"iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"IconixOEAddOn "= "c:\program files\eMail ID\OEAddOn\OEdmn_4.exe" [2008-12-08 333584]
"TMRUBottedTray "= "c:\program files\Trend Micro\RUBotted\TMRUBottedTray.exe" [2008-11-06 288088]
"avgnt "= "c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-07-26 24576]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe "=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe "=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe "=
"c:\\Program Files\\Messenger\\msmsgs.exe "=
"c:\\Program Files\\America Online 9.0\\waol.exe "=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqtra08.exe "=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqste08.exe "=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpofxm08.exe "=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hposfx08.exe "=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hposid01.exe "=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqscnvw.exe "=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqkygrp.exe "=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqCopy.exe "=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpfccopy.exe "=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpzwiz01.exe "=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\Unload\\HpqPhUnl.exe "=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\Unload\\HpqDIA.exe "=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpoews01.exe "=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqnrs08.exe "=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE "=
"c:\\Program Files\\Skype\\Phone\\Skype.exe "=
"c:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe "=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe "=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe "=
"c:\\WINDOWS\\ehome\\ehshell.exe "=
"c:\\Program Files\\iTunes\\iTunes.exe "=

R2 IconixService;Iconix Update Service; "c:\program files\Common Files\eMail ID\IconixService.exe" [2008-12-20 258832]
R2 RUBotted;Trend Micro RUBotted Service; "c:\program files\Trend Micro\RUBotted\TMRUBotted.exe" [2008-12-20 582992]
R2 WinDefend;Windows Defender; "c:\program files\Windows Defender\MsMpEng.exe" [2006-11-03 13592]
R3 dfmirage;dfmirage;c:\windows\system32\DRIVERS\dfmirage.sys [2005-11-25 31896]
R3 TMPassthruMP;TMPassthruMP;c:\windows\system32\DRIVERS\TMPassthru.sys [2008-12-20 206608]
S0 fvdscsi;fvdscsi;c:\windows\system32\DRIVERS\fvdscsi.sys []
S3 Frtmgiimi;Frtmgiimi;c:\windows\system32\drivers\netbt.sys [2005-08-16 162816]
S3 TMPassthru;Trend Micro Passthru Ndis Service;c:\windows\system32\DRIVERS\TMPassthru.sys [2008-12-20 206608]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2bb22c86-38bd-11dc-8021-00038a000015}]
\Shell\AutoRun\command - E:\LaunchU3.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}]
\Shell\AutoRun\command - E:\setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e9f45398-8a41-11dd-83c6-00038a000015}]
\Shell\AutoRun\command - e:\wd_windows_tools\Setup.exe

*Newly Created Service* - ANTIVIRSCHEDULER
*Newly Created Service* - ANTIVIRSERVICE
*Newly Created Service* - AVGIO
*Newly Created Service* - AVGNTFLT
*Newly Created Service* - AVIPBB
.
Contents of the 'Scheduled Tasks' folder

2008-09-13 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-29 23:34]

2008-12-19 c:\windows\Tasks\McAfee.com Scan for Viruses - My Computer (KRISTINA21-Roland Recomono).job
- c:\program files\mcafee.com\vso\mcmnhdlr.exe []

2008-02-14 c:\windows\Tasks\McDefragTask.job
- c:\windows\SYSTEM32\defrag.exe [2004-08-10 05:00]

2008-04-30 c:\windows\Tasks\McQcTask.job
- c:\program files\mcafee\mqc\QcConsol.exe []

2008-12-23 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 18:20]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
uInternet Settings,ProxyServer = 196.168.1.254:1234
uInternet Settings,ProxyOverride = <local>;*.local
IE: Crawler Search - tbr:iemenu
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\Crawler\Toolbar\ctbr.dll
Handler: trendprotect - {BC3A5F6F-12A0-4B14-A184-32939F413823} - c:\program files\Trend Micro\TrendProtect\MSIE\WRS.dll

c:\windows\system32\unicows.dll - c:\windows\Downloaded Program Files\LPUploader45.ocx
O16 -: {0C92900E-4D5A-4F04-ACC9-729E1767BBAE}
hxxp://safeway.lifepics.com/net/Uploader/LPUploader45.cab
c:\windows\Downloaded Program Files\LPUploader45.inf

c:\windows\system32\gtdownde_110.ocx - O16 -: {E856B973-45FD-4559-8F82-EAB539144667}
hxxp://pccheckup.dellfix.com/rel/41/install/gtdownde.cab
c:\windows\Downloaded Program Files\gtdownde_110.inf
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-22 21:14:53
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-12-22 21:16:03
ComboFix-quarantined-files.txt 2008-12-23 02:15:37
ComboFix2.txt 2008-12-23 01:38:56
ComboFix3.txt 2008-09-30 12:57:56

Pre-Run: 15,638,417,408 bytes free
Post-Run: 15,622,721,536 bytes free

213 --- E O F --- 2008-12-18 18:45:11

Thanks!!!

noahdfear · 2008/12/22

Looks good. It appears that you have at least attempted to install several antivirus programs. Please remove all but 1 as they can conflict with each other and actually offer less protection as a result.

Lets get an online scan now. Please do an online scan with Kaspersky Online Scanner

Click Accept, when prompted to download and install the program files and database of malware definitions.

Click Run at the Security prompt.

The program will then begin downloading and installing and will also update the database.

Please be patient as this can take several minutes.

Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.

Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.

Click View scan report at the bottom.

Click the Save Report As... button.

Click the Save as Text button to save the file to your desktop so that you may post it in your next reply.

**Note**

To optimize scanning time and produce a more sensible report for review:

Close any open programs.

Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.

Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.

Post the Kaspersky log here.

tinapie · 2008/12/23

[Active] Explorer.EXE and IEXPLORE.EXE virus

Here it is, the result of the Kaspersky Scan:

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Tuesday, December 23, 2008
Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Tuesday, December 23, 2008 00:43:41
Records in database: 1502447
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\

Scan statistics:
Files scanned: 116613
Threat name: 2
Infected objects: 2
Suspicious objects: 0
Duration of the scan: 02:28:03

File name / Threat name / Threats count
C:\Documents and Settings\Kristina Formanes\Yugma\4.0\lib\DskHooks.dll Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.1370 1
C:\Documents and Settings\Kristina Formanes\Yugma\4.0\lib\YugmaPlugin.dll Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.1360 1

The selected area was scanned.

-------------

By the way, before I received your reply about the Combofix instruction, I uninstalled the real time security applications (including the Spyware Terminator) and installed the latest Norton antivirus. I got no or low internet coonection so I uninstalled Norton after it scanned the system. This always happens everytime I install Norton. Well, I just want to check out if it will detect any viruses since when I scanned with Mbam and Avira, only tracking cookies were found. Norton found two viruses. I just installed back Avira. Now, I also have TrendMicro RUBotted installed for 3 days now (see, I am really paranoid) and says that Bots are present in my system even after I scanned using Norton and Combofix. Just wondering.

Thanks!!!

noahdfear · 2008/12/23

What is RUBotted reporting as infected?

Appears Yugma is a legit Web Conferencing application and neither of the Kaspersky detections are a threat.

tinapie · 2008/12/23

[Active] Explorer.EXE and IEXPLORE.EXE virus

The activity detected is DNS query of malicious domain. I dont have any idea what this means. It just prompts me to scan with Housecall. But I did that 2 days ago, only tracking cookies were removed.

noahdfear · 2008/12/23

Are you knowingly connecting through a proxy server, for school or something? Did you add the proxy to RUBotted's settings?

tinapie · 2008/12/23

I am using a security-enabled wireless connection at home. I did not set or change any settings in RUBotted.

noahdfear · 2008/12/23

Go into RUBotted's main settings and add the following proxy.

196.168.1.254:1234

That appears to a legit address for some routers and RUB might be flagging that.

tinapie · 2008/12/23

I did changed the settings with the proxy numbers but RUBotted cant connect to the internet using the proxy numbers set. Thanks

noahdfear · 2008/12/23

Try it with only 196.168.1.254

tinapie · 2008/12/23

Hi noahdfear!

RUBotted requires port.

I installed ZoneAlarm after I read Geri's article and uninstalled other real-time protection but maintained the antivirus. My computer then has become slower.

Just tell me what to do next. I tried the search engines and I am still redirected to different sites. Thanks a lot.

noahdfear · 2008/12/23

Open a browser and click Tools>Internet Options
Select the Connections tab
Click LAN Settings
Uncheck the box for using a proxy server then click OK and OK again.
Close all browsers then reopen and test search results.

Many users have reported slowdowns with recent versions of Zone Alarm. Recommend you try another.

tinapie · 2008/12/25

noahdfear,

now i am having problems with the internet connection. after uninstalled other real time security programs other than the antivirus, i installed spybot. it did a system scan and afterwards deleted suspicious files. but afterwards, my connection has limited or no connectivity. this happened 3 months ago after i installed norton but connection went back to normal after i uninstalled norton. i already uninstalled spybot but still limited or no connectivity. i am using a different computer right now. thanks a lot!

tinapie

Log in or Sign up

Active Explorer.EXE and IEXPLORE.EXE virus

tinapie Inactive Thread Starter

tinapie Inactive Thread Starter

noahdfear Inactive

tinapie Inactive Thread Starter

noahdfear Inactive

tinapie Inactive Thread Starter

noahdfear Inactive

tinapie Inactive Thread Starter

noahdfear Inactive

tinapie Inactive Thread Starter

noahdfear Inactive

tinapie Inactive Thread Starter

noahdfear Inactive

tinapie Inactive Thread Starter

noahdfear Inactive

tinapie Inactive Thread Starter

noahdfear Inactive

tinapie Inactive Thread Starter

noahdfear Inactive

tinapie Inactive Thread Starter

Share This Page

Log in or Sign up

Active Explorer.EXE and IEXPLORE.EXE virus

tinapie Inactive Thread Starter

tinapie Inactive Thread Starter

noahdfear Inactive

tinapie Inactive Thread Starter

noahdfear Inactive

tinapie Inactive Thread Starter

noahdfear Inactive

tinapie Inactive Thread Starter

noahdfear Inactive

tinapie Inactive Thread Starter

noahdfear Inactive

tinapie Inactive Thread Starter

noahdfear Inactive

tinapie Inactive Thread Starter

noahdfear Inactive

tinapie Inactive Thread Starter

noahdfear Inactive

tinapie Inactive Thread Starter

noahdfear Inactive

tinapie Inactive Thread Starter

Share This Page

Useful Searches