Need Help With Nt Kernel Error 1256 Please

Darkumas
Darkumas
in Malware talk

Here is my logfile. Thank you in advance


Logfile of Trend Micro HijackThis v2.0.0 (BETA)


Scan saved at 9:33:51 AM, on 2/12/2008


Platform: Windows XP SP2 (WinNT 5.01.2600)


Boot mode: Normal


Running processes:


C:\WINDOWS\System32\smss.exe


C:\WINDOWS\system32\csrss.exe


C:\WINDOWS\system32\winlogon.exe


C:\WINDOWS\system32\services.exe


C:\WINDOWS\system32\lsass.exe


C:\WINDOWS\system32\svchost.exe


C:\WINDOWS\system32\svchost.exe


C:\Program Files\Windows Defender\MsMpEng.exe


C:\WINDOWS\System32\svchost.exe


C:\WINDOWS\system32\svchost.exe


C:\WINDOWS\system32\svchost.exe


C:\WINDOWS\System32\WLTRYSVC.EXE


C:\WINDOWS\System32\bcmwltry.exe


C:\WINDOWS\system32\LEXBCES.EXE


C:\WINDOWS\system32\spoolsv.exe


C:\WINDOWS\system32\LEXPPS.EXE


C:\Program Files\a-squared Anti-Malware\a2service.exe


C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe


C:\WINDOWS\system32\dlcqcoms.exe


C:\Program Files\Citrix\GoToMyPC\g2svc.exe


C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE


C:\Program Files\Citrix\GoToMyPC\g2comm.exe


C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe


C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe


C:\Program Files\Citrix\GoToMyPC\g2pre.exe


C:\WINDOWS\system32\HPZipm12.exe


C:\WINDOWS\system32\svchost.exe


C:\Program Files\Citrix\GoToMyPC\g2tray.exe


C:\WINDOWS\system32\wbem\wmiprvse.exe


C:\WINDOWS\System32\alg.exe


C:\WINDOWS\system32\wscntfy.exe


C:\WINDOWS\Explorer.EXE


C:\Program Files\Common Files\Real\Update_OB\realsched.exe


C:\Program Files\Dell Photo AIO Printer 966\dlcqmon.exe


C:\Program Files\a-squared Anti-Malware\a2guard.exe


C:\Program Files\QuickTime\qttask.exe


C:\WINDOWS\system32\ctfmon.exe


C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe


C:\documents and settings\finesse\local settings\application data\ktipfomdg.exe


C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe


C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe


C:\WINDOWS\system32\rundll32.exe


C:\Program Files\Internet Explorer\iexplore.exe


C:\Documents and Settings\Finesse\Local Settings\Temporary Internet Files\Content.IE5\I3MYIC6H\HiJackThis_v2[1].exe


C:\WINDOWS\system32\wbem\wmiprvse.exe


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=6060913


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.msn.com/


R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157


R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896


R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896


R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157


R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=6060913


O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll


O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll


O2 - BHO: (no name) - {670C5695-B062-4613-8038-08DA43589893} - C:\WINDOWS\system32\ssqpm.dll


O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MI1933~1\Office12\GRA8E1~1.DLL


O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll


O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)


O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll


O2 - BHO: {f41ce103-ee1e-b3e8-faf4-7c1dcc790329} - {923097cc-d1c7-4faf-8e3b-e1ee301ec14f} - C:\WINDOWS\system32\vksmsrtw.dll


O2 - BHO: (no name) - {A95B2816-1D7E-4561-A202-68C0DE02353A} - C:\WINDOWS\system32\youwlhyv.dll


O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll


O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot


O4 - HKLM\..\Run: [dlcqmon.exe] "C:\Program Files\Dell Photo AIO Printer 966\dlcqmon.exe"


O4 - HKLM\..\Run: [DLCQCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCQtime.dll,_RunDLLEntry@16


O4 - HKLM\..\Run: [a-squared] "C:\Program Files\a-squared Anti-Malware\a2guard.exe" /d=60


O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime


O4 - HKLM\..\Run: [98f87c1a] rundll32.exe "C:\WINDOWS\system32\tbscghbv.dll",b


O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe


O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe"


O4 - HKCU\..\Run: [ktipfomdg] c:\documents and settings\finesse\local settings\application data\ktipfomdg.exe ktipfomdg


O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')


O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')


O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE


O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000


O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll


O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll


O9 - Extra button: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Finesse\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk


O9 - Extra 'Tools' menuitem: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Finesse\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk


O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll


O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll


O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\Office12\REFIEBAR.DLL


O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll


O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)


O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe


O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe


O16 - DPF: PUFLITE - http://www.hinesville-homes.com/Office/Col...rol/PUFLITE.CAB


O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab55579.cab


O16 - DPF: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} (Microsoft VM) - https://www.topproduceronline.com/downloads/msjavx86.exe


O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab


O16 - DPF: {11865A2A-649F-4FA1-8B99-B97DF8070B7C} (IWSystemchecks Control) - http://elliemae.interwise.com/elliemae/Eng...ystemchecks.cab


O16 - DPF: {13EC55CF-D993-475B-9ACA-F4A384957956} (Controller Class) - https://www.windowsonecare.com/install/cli/...nSSWebAgent.CAB


O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - https://citrix.exitrealty.com/CitrixSession...ca32/wficat.cab


O16 - DPF: {254AA86E-5655-4518-AA87-185D7CC41801} (LogMeIn Rescue Technician Console) - https://secure.logmeinrescue.com/TechConsol...scueControl.cab


O16 - DPF: {284DAE3C-A691-11D3-AD58-00E0B8107A24} (SISCtrl Class) - http://sav.mlxchange.com/Control/SISC.cab


O16 - DPF: {2EB1E425-74DC-4DC0-A9E1-03A4C852E1F2} (CPlayFirstTriJinxControl Object) - http://zone.msn.com/bingame/trix/default/T...nx.1.0.0.87.cab


O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (MSN Games – Buddy Invite) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab55579.cab


O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab


O16 - DPF: {4989312D-58CF-11D5-A7D7-00E02911103E} (Interealty MultiSelect) - http://sav.mlxchange.com/Control/MultiSelectComboBox.cab


O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m...01/mcinsctl.cab


O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab55579.cab


O16 - DPF: {64D01C7F-810D-446E-A07E-16C764235644} (AtlAtomadersCtlAttrib Class) - http://zone.msn.com/bingame/amad/default/atomaders.cab


O16 - DPF: {664088B0-6AF3-4514-AF9D-A0DC3A3DF24A} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols3beta/fscax.cab


O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab


O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1167029388656


O16 - DPF: {6FD482A3-7B57-438B-B040-52CAA30147EE} (MLXchange Client Utils) - http://sav.mlxchange.com/Control/MLXClientUtils.cab


O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://zone.msn.com/bingame/amun/default/mjolauncher.cab


O16 - DPF: {809A6301-7B40-4436-A02C-87B8D3D7D9E3} (ZPA_DMNO Object) - http://zone.msn.com/bingame/zpagames/zpa_dmno.cab55579.cab


O16 - DPF: {80B626D6-BC34-4BCF-B5A1-7149E4FD9CFA} (UnoCtrl Class) - http://zone.msn.com/bingame/zpagames/GAME_UNO1.cab60096.cab


O16 - DPF: {83AB6E4D-CDD7-11D3-B5E7-00104B9AFF6E} (GeacRevw Control) - http://sav.mlxchange.com/3.0.09.83/Control/IRCSharc.cab


O16 - DPF: {8569D715-FF88-44BA-8D1D-AD3E59543DDE} (ActiveReports Viewer2) - https://www.topproduceronline.com/Downloads/arview2.cab


O16 - DPF: {95B5D20C-BD31-4489-8ABF-F8C8BE748463} (MSN Games – Hearts) - http://zone.msn.com/bingame/zpagames/zpa_hrtz.cab70018.cab


O16 - DPF: {9BDF4724-10AA-43D5-BD15-AEA0D2287303} (ZPA_TexasHoldem Object) - http://zone.msn.com/bingame/zpagames/zpa_txhe.cab55579.cab


O16 - DPF: {A4110378-789B-455F-AE86-3A1BFC402853} (ZPA_SHVL Object) - http://zone.msn.com/bingame/zpagames/zpa_shvl.cab55579.cab


O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/...ro.cab56649.cab


O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab


O16 - DPF: {C487F60B-59B9-47D9-BFDF-AB26786F8823} - http://zone.msn.com/bingame/zpagames/zpa_stoo.cab62201.cab


O16 - DPF: {C86FF4B0-AA1D-46D4-8612-025FB86583C7} (AstoundLauncher Control) - http://zone.msn.com/bingame/jobo/default/A...ersion=1,0,0,10


O16 - DPF: {CBD8B1CB-2F5F-415F-93E8-A297B33DCBB2} (CentrinoCheck Control) - http://entriq.vo.llnwd.net/o1/NBCUniversal...eck_1_0_0_5.cab


O16 - DPF: {CE7D2BF2-D173-4CE2-9DAF-15EA153B5B43} - http://entriq.vo.llnwd.net/o1/NBCUniversal..._2_2_Silent.cab


O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (MSN Games – Game Communicator) - http://zone.msn.com/binframework/v10/StProxy.cab55579.cab


O16 - DPF: {DE0FB644-C59B-46D1-B650-88BA945BC98F} - http://entriq.vo.llnwd.net/o1/NBCUniversal...sal_1_0_0_7.cab


O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/popcaploader_v10.cab


O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://flagstar.webex.com/client/T23L/training/ieatgpc.cab


O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MI1933~1\Office12\GR99D3~1.DLL


O20 - Winlogon Notify: youwlhyv - C:\WINDOWS\SYSTEM32\youwlhyv.dll


O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll


O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll


O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Malware\a2service.exe


O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe


O23 - Service: dlcq_device - - C:\WINDOWS\system32\dlcqcoms.exe


O23 - Service: GoToMyPC - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToMyPC\g2svc.exe


O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe


O23 - Service: JavaLOG - Unknown owner - C:\Documents and Settings\Finesse\Desktop\Th3x\services.exe (file missing)


O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE


O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE


O23 - Service: MSSQL$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (file missing)


O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe


O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe


O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe


O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe


O23 - Service: SQLAgent$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE (file missing)


O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE


--


End of file - 14196 bytes

Comments

  • Darkumas
    Darkumas

    Can someone please help. It infected my business laptop apparently after I downloaded Ccleaner from download.com. After running it, I immediately noticed the problem.

  • ceacu
    ceacu

    Send this files to the BitDefender labs:


    C:\WINDOWS\system32\dla\tfswshx.dll


    C:\WINDOWS\system32\ssqpm.dll


    C:\WINDOWS\system32\vksmsrtw.dll


    C:\WINDOWS\system32\youwlhyv.dll


    C:\WINDOWS\system32\tbscghbv.dll


    c:\documents and settings\finesse\local settings\application data\ktipfomdg.exe


    C:\WINDOWS\SYSTEM32\youwlhyv.dll

  • Darkumas
    Darkumas

    I ran vundofix and a virus scan and deleted some items with spybot and here is the updated hijackthis log. Some of the files you mentione are no longer there. I still have some pop ups and still have a red "X" where my HD used to be.


    Logfile of Trend Micro HijackThis v2.0.2


    Scan saved at 3:08:03 PM, on 2/15/2008


    Platform: Windows XP SP2 (WinNT 5.01.2600)


    MSIE: Internet Explorer v7.00 (7.00.6000.16608)


    Boot mode: Normal


    Running processes:


    C:\WINDOWS\System32\smss.exe


    C:\WINDOWS\system32\csrss.exe


    C:\WINDOWS\system32\winlogon.exe


    C:\WINDOWS\system32\services.exe


    C:\WINDOWS\system32\lsass.exe


    C:\WINDOWS\system32\svchost.exe


    C:\WINDOWS\system32\svchost.exe


    C:\Program Files\Windows Defender\MsMpEng.exe


    C:\WINDOWS\System32\svchost.exe


    C:\WINDOWS\system32\svchost.exe


    C:\WINDOWS\system32\svchost.exe


    C:\WINDOWS\System32\WLTRYSVC.EXE


    C:\WINDOWS\System32\bcmwltry.exe


    C:\WINDOWS\system32\LEXBCES.EXE


    C:\WINDOWS\system32\spoolsv.exe


    C:\WINDOWS\system32\LEXPPS.EXE


    C:\Program Files\a-squared Anti-Malware\a2service.exe


    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe


    C:\WINDOWS\system32\dlcqcoms.exe


    C:\Program Files\Citrix\GoToMyPC\g2svc.exe


    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE


    C:\Program Files\Citrix\GoToMyPC\g2comm.exe


    C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe


    C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe


    C:\WINDOWS\system32\HPZipm12.exe


    C:\WINDOWS\system32\svchost.exe


    C:\Program Files\Citrix\GoToMyPC\g2pre.exe


    C:\Program Files\Citrix\GoToMyPC\g2tray.exe


    C:\WINDOWS\system32\wbem\wmiprvse.exe


    C:\WINDOWS\System32\alg.exe


    C:\WINDOWS\Explorer.EXE


    C:\Program Files\Common Files\Real\Update_OB\realsched.exe


    C:\Program Files\Dell Photo AIO Printer 966\dlcqmon.exe


    C:\Program Files\QuickTime\qttask.exe


    C:\WINDOWS\system32\ctfmon.exe


    C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe


    C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe


    C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe


    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe


    C:\Program Files\Internet Explorer\iexplore.exe


    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe


    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe


    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe


    C:\Program Files\Grisoft\AVG7\avgcc.exe


    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe


    C:\WINDOWS\system32\wbem\wmiprvse.exe


    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=6060913


    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.msn.com/


    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157


    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896


    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896


    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157


    R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=6060913


    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll


    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll


    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll


    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MI1933~1\Office12\GRA8E1~1.DLL


    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll


    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)


    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll


    O2 - BHO: {b70a8eff-816e-875b-c964-da94e25f62da} - {ad26f52e-49ad-469c-b578-e618ffe8a07b} - C:\WINDOWS\system32\ddjdpdfn.dll (file missing)


    O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll


    O2 - BHO: (no name) - {EE9C7343-B083-43DB-A718-E99F907A1102} - C:\WINDOWS\system32\ssqpm.dll (file missing)


    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot


    O4 - HKLM\..\Run: [dlcqmon.exe] "C:\Program Files\Dell Photo AIO Printer 966\dlcqmon.exe"


    O4 - HKLM\..\Run: [DLCQCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCQtime.dll,_RunDLLEntry@16


    O4 - HKLM\..\Run: [a-squared] "C:\Program Files\a-squared Anti-Malware\a2guard.exe" /d=60


    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime


    O4 - HKLM\..\Run: [98f87c1a] rundll32.exe "C:\WINDOWS\system32\cjhcymeb.dll",b


    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP


    O4 - HKLM\..\RunOnce: [spybot - Search & Destroy] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck


    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe


    O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe"


    O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe


    O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')


    O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')


    O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')


    O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')


    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE


    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000


    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll


    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll


    O9 - Extra button: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Finesse\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk


    O9 - Extra 'Tools' menuitem: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Finesse\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk


    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll


    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll


    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\Office12\REFIEBAR.DLL


    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll


    O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)


    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll


    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll


    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe


    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe


    O16 - DPF: PUFLITE - http://www.hinesville-homes.com/Office/Col...rol/PUFLITE.CAB


    O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab55579.cab


    O16 - DPF: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} (Microsoft VM) - https://www.topproduceronline.com/downloads/msjavx86.exe


    O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab


    O16 - DPF: {11865A2A-649F-4FA1-8B99-B97DF8070B7C} (IWSystemchecks Control) - http://elliemae.interwise.com/elliemae/Eng...ystemchecks.cab


    O16 - DPF: {13EC55CF-D993-475B-9ACA-F4A384957956} (Controller Class) - https://www.windowsonecare.com/install/cli/...nSSWebAgent.CAB


    O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - https://citrix.exitrealty.com/CitrixSession...ca32/wficat.cab


    O16 - DPF: {254AA86E-5655-4518-AA87-185D7CC41801} (LogMeIn Rescue Technician Console) - https://secure.logmeinrescue.com/TechConsol...scueControl.cab


    O16 - DPF: {284DAE3C-A691-11D3-AD58-00E0B8107A24} (SISCtrl Class) - http://sav.mlxchange.com/Control/SISC.cab


    O16 - DPF: {2EB1E425-74DC-4DC0-A9E1-03A4C852E1F2} (CPlayFirstTriJinxControl Object) - http://zone.msn.com/bingame/trix/default/T...nx.1.0.0.87.cab


    O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (MSN Games – Buddy Invite) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab55579.cab


    O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab


    O16 - DPF: {4989312D-58CF-11D5-A7D7-00E02911103E} (Interealty MultiSelect) - http://sav.mlxchange.com/Control/MultiSelectComboBox.cab


    O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m...01/mcinsctl.cab


    O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab55579.cab


    O16 - DPF: {64D01C7F-810D-446E-A07E-16C764235644} (AtlAtomadersCtlAttrib Class) - http://zone.msn.com/bingame/amad/default/atomaders.cab


    O16 - DPF: {664088B0-6AF3-4514-AF9D-A0DC3A3DF24A} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols3beta/fscax.cab


    O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab


    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1167029388656


    O16 - DPF: {6FD482A3-7B57-438B-B040-52CAA30147EE} (MLXchange Client Utils) - http://sav.mlxchange.com/Control/MLXClientUtils.cab


    O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://zone.msn.com/bingame/amun/default/mjolauncher.cab


    O16 - DPF: {809A6301-7B40-4436-A02C-87B8D3D7D9E3} (ZPA_DMNO Object) - http://zone.msn.com/bingame/zpagames/zpa_dmno.cab55579.cab


    O16 - DPF: {80B626D6-BC34-4BCF-B5A1-7149E4FD9CFA} (UnoCtrl Class) - http://zone.msn.com/bingame/zpagames/GAME_UNO1.cab60096.cab


    O16 - DPF: {83AB6E4D-CDD7-11D3-B5E7-00104B9AFF6E} (GeacRevw Control) - http://sav.mlxchange.com/3.0.09.83/Control/IRCSharc.cab


    O16 - DPF: {8569D715-FF88-44BA-8D1D-AD3E59543DDE} (ActiveReports Viewer2) - https://www.topproduceronline.com/Downloads/arview2.cab


    O16 - DPF: {95B5D20C-BD31-4489-8ABF-F8C8BE748463} (MSN Games – Hearts) - http://zone.msn.com/bingame/zpagames/zpa_hrtz.cab70018.cab


    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab


    O16 - DPF: {9BDF4724-10AA-43D5-BD15-AEA0D2287303} (ZPA_TexasHoldem Object) - http://zone.msn.com/bingame/zpagames/zpa_txhe.cab55579.cab


    O16 - DPF: {A4110378-789B-455F-AE86-3A1BFC402853} (ZPA_SHVL Object) - http://zone.msn.com/bingame/zpagames/zpa_shvl.cab55579.cab


    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/...ro.cab56649.cab


    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab


    O16 - DPF: {C487F60B-59B9-47D9-BFDF-AB26786F8823} - http://zone.msn.com/bingame/zpagames/zpa_stoo.cab62201.cab


    O16 - DPF: {C86FF4B0-AA1D-46D4-8612-025FB86583C7} (AstoundLauncher Control) - http://zone.msn.com/bingame/jobo/default/A...ersion=1,0,0,10


    O16 - DPF: {CBD8B1CB-2F5F-415F-93E8-A297B33DCBB2} (CentrinoCheck Control) - http://entriq.vo.llnwd.net/o1/NBCUniversal...eck_1_0_0_5.cab


    O16 - DPF: {CE7D2BF2-D173-4CE2-9DAF-15EA153B5B43} - http://entriq.vo.llnwd.net/o1/NBCUniversal..._2_2_Silent.cab


    O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (MSN Games – Game Communicator) - http://zone.msn.com/binframework/v10/StProxy.cab55579.cab


    O16 - DPF: {DE0FB644-C59B-46D1-B650-88BA945BC98F} - http://entriq.vo.llnwd.net/o1/NBCUniversal...sal_1_0_0_7.cab


    O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/popcaploader_v10.cab


    O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://flagstar.webex.com/client/T23L/training/ieatgpc.cab


    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MI1933~1\Office12\GR99D3~1.DLL


    O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Malware\a2service.exe


    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe


    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe


    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe


    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe


    O23 - Service: dlcq_device - - C:\WINDOWS\system32\dlcqcoms.exe


    O23 - Service: GoToMyPC - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToMyPC\g2svc.exe


    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe


    O23 - Service: JavaLOG - Unknown owner - C:\Documents and Settings\Finesse\Desktop\Th3x\services.exe (file missing)


    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE


    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE


    O23 - Service: MSSQL$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (file missing)


    O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe


    O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe


    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe


    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe


    O23 - Service: SQLAgent$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE (file missing)


    O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE


    --


    End of file - 15036 bytes

  • farbar
    farbar ✭
    edited February 2008

    You should fix this one with Hijackthis.Run hijackthis.click "Do a system scan only", check the item close all windows including this one and click on fix checked. You may also fix all entries with (missing file).


    O4 - HKLM\..\Run: [98f87c1a] rundll32.exe "C:\WINDOWS\system32\cjhcymeb.dll",b


    You may also fix all entries with (missing file)


    Then remove file in bold :C:\WINDOWS\system32\cjhcymeb.dll


    It may be hidden. To Search for the file first unhide the file by going to start-control panel- folder options- click view tab:


    check display the contents of system folders.


    check show hidden files and folders.


    uncheck hide extension for known files types.


    uncheck the Hide protected operating system files (recommended) – click Yes


    then click apply then OK.


    After cleaning your system reset the settings to default.


    If you removed the file remove also Vundofix. You can still send the backup made by Vundofix ( archived and password protected as attachment) and then remove the backup.


    While your internet explorer is closed go to start-control panel- Internet options- Under privacy check and reset your privacy to default. It is lowerd by Vundo malware.


    Under general- click delete- delete all- check 'Also delete files and settings stored by add-ons'. Click YES.


    Empty your Temp folder, to do this:


    Reboot. Then go directly after reboot to start-run- type "%temp%" (without "), click OK it opens temp folder.


    select one of the files inside it in the right panel, then Ctrl+A to select all the contents and then Shift+delete to empty your Temp folder bypassing Recycle Bin. Click Ok to confirm.


    Go to start-run- type "cleanmgr.exe" (without "), click OK it shows C drive to be cleaned, click OK, at least Temporary Internet files, Temporary files and Recycle Bin. Click Ok to confirm.


    Reboot and check if your computer is running fine. Then empty your system volume information to get rid of recreation of infection by windows recovery. To do that: go to start-control panel- system- system restore- check turn off system restore on all drives. Click apply. By doing this you loose all your (often infected) restore points. Reboot and uncheck "turn off system restore on all drives' to create a clean restore point.


    After that you can run an online BitDefender scan.


    Reboot and check if your computer is running fine. Then empty your system volume information to get rid of recreation of infection by windows recovery. To do that: go to start-control panel- system- system restore- check turn off system restore on all drives. Click apply. By doing this you loose all your (often infected) restore points. Reboot and uncheck "turn off system restore on all drives' to create a clean restore point.


    After that you can run an online BitDefender scan.

  • farbar
    farbar ✭
    edited February 2008

    I could not edit fully.


    Fix this item alos with Hijackthis right from the beginning:


    O4 - HKCU\..\Run: [ktipfomdg] c:\documents and settings\finesse\local settings\application data\ktipfomdg.exe ktipfomdg


    Then open Taskmanager (Shift+Ctrl+Del), processes, select it, end task.


    Then while the files are still unhidden go to c:\documents and settings\finesse\local settings\application data\ktipfomdg.exe ktipfomdg and remove ktipfomdg.exe


    Before making a clean restore point do the following.


    Check your firewall (windows or other), note the suspicious allowed entries and remove them.


    Remove old Java versions due to serious security vulnerability (specially for Vundo family malware): Download the latest version of JRE from here: http://java.sun.com/javase/downloads/index.jsp


    Click download button right to Java Runtime Environment (JRE) 6 Update 4


    Then select platform: windows - check licence agreement -click continue-download windows offline installation.


    But don't install it yet.


    Go to control panel -add/remove programs – uninstall/remove all the old versions of Java, or any item with Java (JRE or J2SE) in the name and remove the folders from program files.


    Reboot once all Java components are removed.


    Install Java you have downloaded.

  • farbar
    farbar ✭
    Fix this item alos with Hijackthis right from the beginning:


    O4 - HKCU\..\Run: [ktipfomdg] c:\documents and settings\finesse\local settings\application data\ktipfomdg.exe ktipfomdg


    Then open Taskmanager (Shift+Ctrl+Del), processes, select it, end task.


    Then while the files are still unhidden go to c:\documents and settings\finesse\local settings\application data\ktipfomdg.exe ktipfomdg and remove ktipfomdg.exe


    Sorry this is already gone. I got back and saw your first log. If you wanted make a fresh log and post the log along with the BitDefender log into your reply.

  • Darkumas
    Darkumas

    I believe I have done everything you said so far. I still have that red "X" where my HD should be, I still get those pop ups not as much as before but they are there, and i have a bunch of TMP files under the C drive (when I click to go to program files i see hundreds of them). Below is the new hijackthis log file, and attached is the bitdefender scan log and the vundo fix backup archived and password protected. Thanks


    Logfile of Trend Micro HijackThis v2.0.2


    Scan saved at 10:56:59 PM, on 2/16/2008


    Platform: Windows XP SP2 (WinNT 5.01.2600)


    MSIE: Internet Explorer v7.00 (7.00.6000.16608)


    Boot mode: Normal


    Running processes:


    C:\WINDOWS\System32\smss.exe


    C:\WINDOWS\system32\csrss.exe


    C:\WINDOWS\system32\winlogon.exe


    C:\WINDOWS\system32\services.exe


    C:\WINDOWS\system32\lsass.exe


    C:\WINDOWS\system32\svchost.exe


    C:\WINDOWS\system32\svchost.exe


    C:\Program Files\Windows Defender\MsMpEng.exe


    C:\WINDOWS\System32\svchost.exe


    C:\WINDOWS\system32\svchost.exe


    C:\WINDOWS\system32\svchost.exe


    C:\WINDOWS\System32\WLTRYSVC.EXE


    C:\WINDOWS\System32\bcmwltry.exe


    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe


    C:\WINDOWS\system32\LEXBCES.EXE


    C:\WINDOWS\system32\spoolsv.exe


    C:\WINDOWS\system32\LEXPPS.EXE


    C:\Program Files\a-squared Anti-Malware\a2service.exe


    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe


    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe


    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe


    C:\WINDOWS\system32\dlcqcoms.exe


    C:\Program Files\Citrix\GoToMyPC\g2svc.exe


    C:\Program Files\Citrix\GoToMyPC\g2comm.exe


    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE


    C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe


    C:\Program Files\Citrix\GoToMyPC\g2pre.exe


    C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe


    C:\WINDOWS\system32\HPZipm12.exe


    C:\WINDOWS\system32\svchost.exe


    C:\Program Files\Citrix\GoToMyPC\g2tray.exe


    C:\WINDOWS\system32\wbem\wmiprvse.exe


    C:\WINDOWS\Explorer.EXE


    C:\WINDOWS\System32\alg.exe


    C:\Program Files\Common Files\Real\Update_OB\realsched.exe


    C:\Program Files\Dell Photo AIO Printer 966\dlcqmon.exe


    C:\Program Files\a-squared Anti-Malware\a2guard.exe


    C:\Program Files\QuickTime\qttask.exe


    C:\PROGRA~1\Grisoft\AVG7\avgcc.exe


    C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe


    C:\WINDOWS\system32\ctfmon.exe


    C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe


    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe


    C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe


    C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe


    C:\WINDOWS\system32\wuauclt.exe


    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe


    C:\WINDOWS\system32\wbem\wmiprvse.exe


    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=6060913


    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.msn.com/


    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157


    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896


    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896


    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157


    R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=6060913


    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll


    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll


    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll


    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MI1933~1\Office12\GRA8E1~1.DLL


    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll


    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll


    O2 - BHO: {b70a8eff-816e-875b-c964-da94e25f62da} - {ad26f52e-49ad-469c-b578-e618ffe8a07b} - C:\WINDOWS\system32\ddjdpdfn.dll (file missing)


    O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll


    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot


    O4 - HKLM\..\Run: [dlcqmon.exe] "C:\Program Files\Dell Photo AIO Printer 966\dlcqmon.exe"


    O4 - HKLM\..\Run: [DLCQCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCQtime.dll,_RunDLLEntry@16


    O4 - HKLM\..\Run: [a-squared] "C:\Program Files\a-squared Anti-Malware\a2guard.exe" /d=60


    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime


    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP


    O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"


    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe


    O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe"


    O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe


    O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')


    O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')


    O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')


    O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')


    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE


    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000


    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll


    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll


    O9 - Extra button: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Finesse\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk


    O9 - Extra 'Tools' menuitem: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Finesse\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk


    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll


    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll


    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe


    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe


    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\Office12\REFIEBAR.DLL


    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll


    O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)


    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll


    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll


    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe


    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe


    O16 - DPF: PUFLITE - http://www.hinesville-homes.com/Office/Col...rol/PUFLITE.CAB


    O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab55579.cab


    O16 - DPF: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} (Microsoft VM) - https://www.topproduceronline.com/downloads/msjavx86.exe


    O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab


    O16 - DPF: {11865A2A-649F-4FA1-8B99-B97DF8070B7C} (IWSystemchecks Control) - http://elliemae.interwise.com/elliemae/Eng...ystemchecks.cab


    O16 - DPF: {13EC55CF-D993-475B-9ACA-F4A384957956} (Controller Class) - https://www.windowsonecare.com/install/cli/...nSSWebAgent.CAB


    O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - https://citrix.exitrealty.com/CitrixSession...ca32/wficat.cab


    O16 - DPF: {254AA86E-5655-4518-AA87-185D7CC41801} (LogMeIn Rescue Technician Console) - https://secure.logmeinrescue.com/TechConsol...scueControl.cab


    O16 - DPF: {284DAE3C-A691-11D3-AD58-00E0B8107A24} (SISCtrl Class) - http://sav.mlxchange.com/Control/SISC.cab


    O16 - DPF: {2EB1E425-74DC-4DC0-A9E1-03A4C852E1F2} (CPlayFirstTriJinxControl Object) - http://zone.msn.com/bingame/trix/default/T...nx.1.0.0.87.cab


    O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (MSN Games – Buddy Invite) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab55579.cab


    O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab


    O16 - DPF: {4989312D-58CF-11D5-A7D7-00E02911103E} (Interealty MultiSelect) - http://sav.mlxchange.com/Control/MultiSelectComboBox.cab


    O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m...01/mcinsctl.cab


    O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab55579.cab


    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab


    O16 - DPF: {64D01C7F-810D-446E-A07E-16C764235644} (AtlAtomadersCtlAttrib Class) - http://zone.msn.com/bingame/amad/default/atomaders.cab


    O16 - DPF: {664088B0-6AF3-4514-AF9D-A0DC3A3DF24A} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols3beta/fscax.cab


    O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab


    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1167029388656


    O16 - DPF: {6FD482A3-7B57-438B-B040-52CAA30147EE} (MLXchange Client Utils) - http://sav.mlxchange.com/Control/MLXClientUtils.cab


    O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://zone.msn.com/bingame/amun/default/mjolauncher.cab


    O16 - DPF: {809A6301-7B40-4436-A02C-87B8D3D7D9E3} (ZPA_DMNO Object) - http://zone.msn.com/bingame/zpagames/zpa_dmno.cab55579.cab


    O16 - DPF: {80B626D6-BC34-4BCF-B5A1-7149E4FD9CFA} (UnoCtrl Class) - http://zone.msn.com/bingame/zpagames/GAME_UNO1.cab60096.cab


    O16 - DPF: {83AB6E4D-CDD7-11D3-B5E7-00104B9AFF6E} (GeacRevw Control) - http://sav.mlxchange.com/3.0.09.83/Control/IRCSharc.cab


    O16 - DPF: {8569D715-FF88-44BA-8D1D-AD3E59543DDE} (ActiveReports Viewer2) - https://www.topproduceronline.com/Downloads/arview2.cab


    O16 - DPF: {95B5D20C-BD31-4489-8ABF-F8C8BE748463} (MSN Games – Hearts) - http://zone.msn.com/bingame/zpagames/zpa_hrtz.cab70018.cab


    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab


    O16 - DPF: {9BDF4724-10AA-43D5-BD15-AEA0D2287303} (ZPA_TexasHoldem Object) - http://zone.msn.com/bingame/zpagames/zpa_txhe.cab55579.cab


    O16 - DPF: {A4110378-789B-455F-AE86-3A1BFC402853} (ZPA_SHVL Object) - http://zone.msn.com/bingame/zpagames/zpa_shvl.cab55579.cab


    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/...ro.cab56649.cab


    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab


    O16 - DPF: {C487F60B-59B9-47D9-BFDF-AB26786F8823} - http://zone.msn.com/bingame/zpagames/zpa_stoo.cab62201.cab


    O16 - DPF: {C86FF4B0-AA1D-46D4-8612-025FB86583C7} (AstoundLauncher Control) - http://zone.msn.com/bingame/jobo/default/A...ersion=1,0,0,10


    O16 - DPF: {CBD8B1CB-2F5F-415F-93E8-A297B33DCBB2} (CentrinoCheck Control) - http://entriq.vo.llnwd.net/o1/NBCUniversal...eck_1_0_0_5.cab


    O16 - DPF: {CE7D2BF2-D173-4CE2-9DAF-15EA153B5B43} - http://entriq.vo.llnwd.net/o1/NBCUniversal..._2_2_Silent.cab


    O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (MSN Games – Game Communicator) - http://zone.msn.com/binframework/v10/StProxy.cab55579.cab


    O16 - DPF: {DE0FB644-C59B-46D1-B650-88BA945BC98F} - http://entriq.vo.llnwd.net/o1/NBCUniversal...sal_1_0_0_7.cab


    O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/popcaploader_v10.cab


    O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://flagstar.webex.com/client/T23L/training/ieatgpc.cab


    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MI1933~1\Office12\GR99D3~1.DLL


    O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Malware\a2service.exe


    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe


    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe


    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe


    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe


    O23 - Service: dlcq_device - - C:\WINDOWS\system32\dlcqcoms.exe


    O23 - Service: GoToMyPC - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToMyPC\g2svc.exe


    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe


    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE


    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE


    O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe


    O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe


    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe


    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe


    O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE


    --


    End of file - 14764 bytes

    /applications/core/interface/file/attachment.php?id=1518" data-fileid="1518" rel="">VundoFix_Backups.rar

    /applications/core/interface/file/attachment.php?id=1519" data-fileid="1519" rel="">bitdefender_scan_log.html

  • Darkumas
    Darkumas

    After my last post I went back to check my settings under the privacy tab in internet options and it was lowered again by itself.

  • pcbugfixer
    pcbugfixer ✭✭✭
    edited February 2008

    G’Day “darkumas“


    A bit difficult to know where to start when reading you posts, but here it goes, mind you all this may not be specifically your problem, however I have had 23 similar cases in the last 6 month and successfully cleaned the systems.


    I recognise the symptoms and suggest that you got hit by multiple variation (variants) of Trojans and Worms. This is in regard to the infected CrapCleaner file which a customer also had problems with and after not cleaning the infection for several weeks, the system was almost totally compromised and useless to work with, as the Trojan Downloader just kept downloading more and more viruses and worms and installing them.


    You have 2 choices,


    A. If there is nothing important on the infected system and you have a backup of your data (Documents etc) then Format the HDD and perform a complete fresh installation of the OS.


    I say that, because getting rid of most virus infections particularly Trojan and Worm, is not easy.


    B. If you need to recover the system from the infection, then do this:


    !! This will take at least 6 to 8+ hours. But you should end up with a clean system.


    (These options are repeated as part of the instructions)


    The result of the infection is not good and part of the culprit, buried under many levels in the registry when it installed itself, are variations of the Smitfraud and related Trojan and other downloader’s that then create havoc on your system.


    The master culprit does not reveal itself until you peal back (fix by removing) all the top layers and then finally the main loader of the continuing infector.


    The file location from which you downloaded the CrapCleaner (CC or CCleaner v2.04.543) does not sound right and should I think Have been from this location – (better anyway) http://www.filehippo.com/download_ccleaner/ in that I recall some month back I did (my network Firewall and PC Firewall BDIS 2008) did detect one of the CC download locations with a virus infection.


    Related reading ONLY of your problem, you may have variants of these, but may all stem from the master infection.


    One of the Trojans is the “Trojan-pushu” which is suggested to cause the following – PLEASE READ THE RECOMMENDATIONS – actions you should take to secure your Bank and other confidential information that may have also been compromised !!


    Info. On this link = http://research.spysweeper.com/search.php?...amp;x=0&y=0


    Extract from this article;


    Consequences This Trojan may open a port on your computer that may enable a hacker to gain remote control of your computer. Additional Comments: It is recommended that you change all of your passwords after removing this program. If you bank online, you might consider changing your credit card and bank account numbers. You should also monitor your credit card and bank statements carefully over the next several months for signs of fraudulent activity.


    Other information on this search result (note that the PCTools does not get rid of this Trojan)


    http://www.google.com.au/search?hl=en&...pushu&meta=


    The other major Trojan is the “Trojan.gen” – information read it on this link;


    http://research.spysweeper.com/search.php?...number=7KJNLY2H


    other info. On this search result - http://www.google.com.au/search?hl=en&...n.gen&meta=


    Extract;


    Consequences This is a generic detection for a suspicious piece of software. This definition may detect multiple software packages, and specific information may vary based on the exact files detected.


    Now to help you to try and get rit of this infection do the following;


    A. If there is nothing important on the infected system and you have a backup of your data (Documents etc) then Format the HDD and perform a complete fresh installation of the OS.


    I say that, because getting rid of most virus infections particularly Trojan and Worm, is not easy.


    B. If you need to recover the system from the infection, then do this:


    !! This will take at least 6 to 8+ hours. But you should end up with a clean system.


    1. Disable the System Restore (in the System Properties) on all hard drives on your PC.


    2. If you have BD Internet Security installed, then boot up in safe mode and perform a manual scan ( listed in the Programs > BitDefender 2008 > BitDefender Manual Scan) and remove any infections that it finds.


    3. If by chance you also have Spybot Search and Destroy v1.5.2 installed , the after the BD scan, also run a SpyBot scan while in safe mode and again remove any infections found.


    Note that the severity may prompt you that further automatic scans by SpyBot are needed to remove some of the intruders from memory which while they are active, can not be done the 1st time.


    !! Should this be the case, do not boot up normally but again boot up in safe mode and the SB utility will automatically perform another scan before you get to the desktop, just follow the instruction in the popup screens.


    After this is done, i.e. SpyBot has performed further cleaning actions and has finished, again while in safe mode, perform another manual BD scan.


    4. Now again re-boot in safe mode BUT THIS TIME WITH NETWORK SUPPORT. This will give us access to the internet (obviously a Cable or ADSL connection needs to be active and connected to the PC) and then go to this location - http://www.hitmanpro.nl/hitmanpro/ and download the Hitmanpro utility.


    5. While you are at it – very carefully read the instructions and help files so you know what to do after this utility is installed. The program is totally self installing when run and automatically perform all required functions and tasks, however this is totally reliant on you having read the instruction !!


    http://www.hitmanpro.nl/hitmanpro/content/...n/1/12/lang,en/


    • Installation ( 2 items )


    • Settings ( 2 items )


    • Expert ( 2 items )


    • Frequently asked questions ( 12 items )


    6. Now install the Hitman Pro program and allow it to run.


    7. The program will install all related scanners and cleaners and also automatically clean and remove all infections that the respective programs find, and give you a report at the end which you should save.


    8. The Hitman program may also prompt you that it requires further scans, which as in the case of the SpyBot program, it will perform automatically when the system re-boot_s or is rebooted. In this instance, allow the system to boot in normal mode where it will perform any secondary required scans and cleaning functions.


    9. If you then perform further scans with Hitman, then the resulting report will tell you that no infections have been found i.e. Infections: 0 (zero)


    10. you then should run BD scan in normal mode and another SpyBot scan . If you have AdAware 2007 installed, then it is also a good idea to run that scanner as well.


    NB: and this is important ! look at the list of the programs that Hitman will install, and if you already have any of these installed, then uninstall them first so that Hitman can install its latest versions and not conflict with other installations of the same program. The other method is to un-tick these programs that are duplicated from the Hitman installation list (custom setting)


    After the System has been cleaned. I suggest you un-install Hitman and then re-install the latest 2nd level protection programs of your choice like SpyBot v1.5.2 and AdAware 2007 (just remember not to use the AdWatch utility as it creates a conflict with BitDefender if run simultaneously with BDIS 2008 and other BD programs.

  • farbar
    farbar ✭

    darkumas,


    All the problems you mentioned would be taken care of. I advise you not to turn off your system restore unless you know what you are doing. A reinstall is also a drastic step. I think in the coming two posts we get rid of the infection like many others. But I would like more feedback from you than that you have done anything. Specially when it comes to removing a particular file I would like to read if you have found and removed that file. I see the hijackthis entry is removed but I want to make sure the file is also removed.


    As for the attachments: thank you for attaching the Vundofix back up. But for the BD scan just the virus researchers and the moderators are allowed to download the attachments to prevent members from being infected. so I could not see that.


    Step 1.


    Remove vundofix and its backup if they are still there.


    Step2.


    Run hijackthis.click "Do a system scan only", check the following items, close all windows including this one and click on fix checked.


    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=6060913


    R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=6060913


    Step 3.


    Download ComboFix.exe to your desktop using this link:


    bleepingcomputer


    Close any open browsers.


    Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. After Combofix is finished turn on/enable your anti virus again.


    You have to turn off Windows Defender also.


    To do that Go to Start-Control Panel- Windows Defender-Tools-Options- Uncheck Use Windows Defender -click Save – click Continue.


    Double click on combofix.exe to run the programme & then follow the prompts.


    When finished, it will produce a report for you. Please post the content of this log ("C:\ComboFix.txt") into your next post.


    ComboFix may need to reboot to finish its work. Let it.


    Note:Do not mouseclick combofix's window while it's running. That may cause it to stall


    Step 4.


    Please download ATF Cleaner by Atribune.


    Double-click ATF-Cleaner.exe to run the program.


    Under Main choose: Select All


    Click the Empty Selected button.


    Step 5.


    Please post a fresh HJT log into your reply.



  • Darkumas
    Darkumas

    I have attached the bitdefender scan log as an archived password protected file, maybe you can see it this way. I have fixed the 2 files you mentioned after the HJT scan. I see you mentioned disabling windows defender, that program was uninstalled off my laptop abot 2 months ago so i no longer have it. The hundreds of TMP files are now gone, thank you. There is still however that red "X". Below is the combofix log.


    ComboFix 08-02-17.2 - Finesse 2008-02-17 10:10:20.1 - NTFSx86


    Running from: C:\Documents and Settings\Finesse\Desktop\ComboFix.exe


    * Created a new restore point


    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!


    .


    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


    .


    C:\Documents and Settings\Finesse\Local Settings\Application Data\ktipfomdg.dat


    C:\Documents and Settings\Finesse\Local Settings\Application Data\ktipfomdg.exe


    c:\Documents and Settings\Finesse\Local Settings\Application Data\ktipfomdg_nav.dat


    C:\Documents and Settings\Finesse\Local Settings\Application Data\ktipfomdg_navps.dat


    C:\Documents and Settings\Finesse\Start Menu\Programs\InternetGameBox


    C:\Documents and Settings\Finesse\Start Menu\Programs\InternetGameBox\InternetGameBox.lnk


    C:\Documents and Settings\Finesse\Start Menu\Programs\InternetGameBox\Privacy Policy.lnk


    C:\Documents and Settings\Finesse\Start Menu\Programs\InternetGameBox\Terms and conditions.lnk


    C:\Documents and Settings\Finesse\Start Menu\Programs\InternetGameBox\Website.lnk


    C:\WINDOWS\cookies.ini


    C:\WINDOWS\system32\bbulktwx.ini


    C:\WINDOWS\system32\dcbeg.ini


    C:\WINDOWS\system32\dcbeg.ini2


    C:\WINDOWS\system32\etifxbfm.ini


    C:\WINDOWS\system32\gbyijhqc.ini


    C:\WINDOWS\system32\ijllm.ini


    C:\WINDOWS\system32\ijllm.ini2


    C:\WINDOWS\system32\iujwsmcm.ini


    C:\WINDOWS\system32\jxtmeuee.ini


    C:\WINDOWS\system32\mcrh.tmp


    C:\WINDOWS\system32\mpqss.ini


    C:\WINDOWS\system32\mpqss.ini2


    C:\WINDOWS\system32\ndombowo.ini


    C:\WINDOWS\system32\rqsiipat.ini


    C:\WINDOWS\system32\vbhgcsbt.ini


    C:\WINDOWS\system32\vmrmmxvs.ini


    C:\WINDOWS\system32\wuusdbhr.ini


    C:\WINDOWS\system32\xrukrjwn.ini


    C:\WINDOWS\system32\yolbcnin.ini


    .


    ((((((((((((((((((((((((( Files Created from 2008-01-17 to 2008-02-17 )))))))))))))))))))))))))))))))


    .


    2008-02-16 12:24 . 2008-02-16 22:41 <DIR> d-------- C:\WINDOWS\BDOSCAN8


    2008-02-16 12:08 . 2007-12-14 01:59 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl


    2008-02-16 12:07 . 2008-02-16 12:08 <DIR> d-------- C:\Program Files\Java


    2008-02-16 12:07 . 2008-02-16 12:07 <DIR> d-------- C:\Program Files\Common Files\Java


    2008-02-15 14:53 . 2008-02-15 15:05 <DIR> d-------- C:\WINDOWS\system32\ActiveScan


    2008-02-15 14:53 . 2008-02-15 14:53 30,590 --a------ C:\WINDOWS\system32\pavas.ico


    2008-02-15 14:53 . 2008-02-15 14:53 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico


    2008-02-15 14:53 . 2008-02-15 14:53 1,406 --a------ C:\WINDOWS\system32\Help.ico


    2008-02-15 14:47 . 2008-02-15 14:47 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\AVG7


    2008-02-15 14:47 . 2008-02-17 08:00 <DIR> d-------- C:\Documents and Settings\Finesse\Application Data\AVG7


    2008-02-15 14:46 . 2008-02-15 14:46 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft


    2008-02-15 14:46 . 2008-02-16 08:00 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg7


    2008-02-15 13:57 . 2008-02-15 13:57 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy


    2008-02-15 13:57 . 2008-02-15 14:21 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy


    2008-02-15 11:48 . 2008-02-15 11:48 <DIR> d-------- C:\Program Files\Lavasoft


    2008-02-15 11:46 . 2008-02-15 11:46 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard


    2008-02-15 10:26 . 2008-02-15 10:26 <DIR> d-------- C:\Program Files\Trend Micro


    2008-02-13 09:34 . 2008-02-13 09:38 1,374 --a------ C:\WINDOWS\imsins.BAK


    2008-02-11 19:06 . 2008-02-11 19:06 <DIR> d-------- C:\fsaua.data


    2008-02-11 01:31 . 2008-02-11 01:32 1,058 ---hs---- C:\WINDOWS\system32\gqsrcoel.ini


    2008-02-10 01:30 . 2008-02-11 01:31 998 ---hs---- C:\WINDOWS\system32\ahrsqshg.ini


    2008-02-09 01:25 . 2008-02-10 01:25 758 ---hs---- C:\WINDOWS\system32\tgsrkhno.ini


    2008-02-06 03:24 . 2008-02-06 03:24 9 --a------ C:\WINDOWS\system32\98f86e94


    2008-02-05 10:21 . 2008-02-05 10:21 0 --a------ C:\WINDOWS\system32\xrukrjwn.tmp


    2008-01-29 20:18 . 2008-02-01 12:31 <DIR> d-------- C:\Program Files\a-squared Anti-Malware


    2008-01-28 18:53 . 2007-03-22 13:38 215,144 -ra------ C:\WINDOWS\patchw32.dll


    2008-01-28 18:51 . 2007-03-22 13:38 215,144 -ra------ C:\WINDOWS\pw32a.dll


    2008-01-27 22:39 . 2008-01-27 22:39 <DIR> d-------- C:\Program Files\PowerISO


    2008-01-26 15:49 . 2008-02-08 19:42 <DIR> d-------- C:\Program Files\Dl_cats


    2008-01-26 15:49 . 2008-01-26 15:49 <DIR> d-------- C:\Documents and Settings\All Users\dl_cats


    2008-01-26 15:47 . 2006-11-07 12:30 344,064 --a------ C:\WINDOWS\system32\dlcqcoin.dll


    2008-01-26 15:47 . 2006-04-25 03:11 40,960 --a------ C:\WINDOWS\system32\dlcqvs.dll


    2008-01-26 15:46 . 2006-08-08 15:58 692,224 --a------ C:\WINDOWS\system32\dlcqdrs.dll


    2008-01-26 15:46 . 2001-08-17 22:36 87,040 --a------ C:\WINDOWS\system32\wiafbdrv.dll


    2008-01-26 15:46 . 2001-08-17 22:36 87,040 --a------ C:\WINDOWS\system32\dllcache\wiafbdrv.dll


    2008-01-26 15:46 . 2006-08-14 17:32 65,536 --a------ C:\WINDOWS\system32\dlcqcaps.dll


    2008-01-26 15:46 . 2006-05-09 10:10 61,440 --a------ C:\WINDOWS\system32\dlcqcnv4.dll


    2008-01-26 15:44 . 2008-01-26 15:46 <DIR> d-------- C:\Program Files\Dell Photo AIO Printer 966


    2008-01-26 15:43 . 2006-10-11 17:48 684,032 --a------ C:\WINDOWS\system32\dlcqcomc.dll


    2008-01-26 15:43 . 2006-12-12 04:22 381,832 --a------ C:\WINDOWS\system32\dlcqcfg.exe


    2008-01-26 15:43 . 2006-09-06 06:12 77,824 --a------ C:\WINDOWS\system32\DLCQcfg.dll


    2008-01-26 15:43 . 2006-12-11 08:58 2,069 --a------ C:\WINDOWS\system32\dlcq.loc


    2008-01-25 17:28 . 2008-01-25 19:42 <DIR> d-------- C:\Documents and Settings\Finesse\Application Data\Lavasoft


    2008-01-21 23:14 . 2008-01-21 23:14 <DIR> d-------- C:\Documents and Settings\Finesse\Application Data\PlayFirst


    2008-01-21 23:14 . 2008-01-21 23:14 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\PlayFirst


    2008-01-21 09:14 . 2008-02-15 11:48 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft


    2008-01-20 02:07 . 2008-01-20 02:07 33,292 --a------ C:\WINDOWS\system32\drivers\scdemu.sys


    2008-01-17 23:01 . 2008-01-17 23:01 <DIR> d-------- C:\Documents and Settings\Finesse\Application Data\FastStone


    .


    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))


    .


    2008-02-13 14:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help


    2008-02-12 04:06 --------- d-----w C:\Program Files\Common Files\Symantec Shared


    2008-02-12 04:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec


    2008-02-11 18:02 --------- d-----w C:\Program Files\Symantec


    2008-02-11 17:38 --------- d-----w C:\Documents and Settings\Finesse\Application Data\uTorrent


    2008-02-09 21:34 --------- d-----w C:\Program Files\mIRC


    2008-01-31 19:26 --------- d-----w C:\Program Files\Norton Ghost


    2008-01-30 03:36 --------- d-----w C:\Program Files\iMesh Applications


    2008-01-29 06:15 --------- d-----w C:\Program Files\Absolute Poker


    2008-01-16 02:35 --------- d-----w C:\Program Files\FastStone Image Viewer


    2008-01-13 20:24 --------- d-----w C:\Documents and Settings\Finesse\Application Data\YouSendIt


    2008-01-09 20:01 53,248 ----a-w C:\WINDOWS\bdoscandel.exe


    2008-01-09 00:32 --------- d--h--w C:\Program Files\InstallShield Installation Information


    2008-01-09 00:32 --------- d-----w C:\Program Files\YouSendIt


    2008-01-08 20:13 --------- d-----w C:\Documents and Settings\All Users\Application Data\Winamp Toolbar


    2008-01-08 13:50 --------- d-----w C:\Program Files\MSN Games


    2008-01-08 13:34 --------- d-----w C:\Program Files\Winamp Remote


    2008-01-08 04:22 --------- d-----w C:\Program Files\Common Files\NSV


    2008-01-07 01:23 --------- d-----w C:\Program Files\ReflexiveArcade


    2008-01-06 15:10 --------- d-----w C:\Program Files\Hasbro


    2008-01-06 04:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\Zylom


    2007-12-27 00:19 --------- d-----w C:\Program Files\Common Files\Adobe


    2007-12-27 00:19 --------- d-----w C:\Documents and Settings\All Users\Application Data\FLEXnet


    2007-12-25 06:14 --------- d-----w C:\Documents and Settings\Finesse\Application Data\Big Fish Games


    2007-12-25 03:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\PopCap


    2007-12-23 23:35 --------- d-----w C:\Documents and Settings\Finesse\Application Data\FloodLightGames


    2007-12-23 23:35 --------- d-----w C:\Documents and Settings\All Users\Application Data\FloodLightGames


    2007-12-23 23:34 --------- d-----w C:\Program Files\Reflexive


    2007-12-18 09:51 179,584 ----a-w C:\WINDOWS\system32\drivers\mrxdav.sys


    2007-07-06 19:38 69,784 ----a-w C:\Documents and Settings\Finesse\Application Data\GDIPFONTCACHEV1.DAT


    2007-10-22 02:42 88 --sh--r C:\WINDOWS\system32\51A3A397F4.sys


    2007-10-22 02:42 3,766 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys


    .


    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


    .


    .


    *Note* empty entries & legit default entries are not shown


    REGEDIT4


    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ad26f52e-49ad-469c-b578-e618ffe8a07b}]


    C:\WINDOWS\system32\ddjdpdfn.dll


    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]


    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:00 15360]


    "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe" [2007-10-23 14:18 202024]


    "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]


    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]


    "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-07-20 08:42 185896]


    "dlcqmon.exe"="C:\Program Files\Dell Photo AIO Printer 966\dlcqmon.exe" [2007-06-29 11:47 292080]


    "DLCQCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCQtime.dll" [2006-10-16 01:31 106496]


    "a-squared"="C:\Program Files\a-squared Anti-Malware\a2guard.exe" [2008-01-29 20:27 1816208]


    "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 10:54 282624]


    "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-02-15 14:48 579072]


    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe" [2007-12-14 03:42 144784]


    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]


    "DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 08:01 437160]


    "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-02-15 14:46 219136]


    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\


    Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 00:01:04 83360]


    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToMyPC]


    C:\Program Files\Citrix\GoToMyPC\G2WinLogon.dll 2007-01-12 16:45 10800 C:\Program Files\Citrix\GoToMyPC\G2WinLogon.dll


    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]


    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk


    backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup


    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]


    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk


    backup=C:\WINDOWS\pss\Digital Line Detect.lnkCommon Startup


    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^eFax 4.2.lnk]


    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\eFax 4.2.lnk


    backup=C:\WINDOWS\pss\eFax 4.2.lnkCommon Startup


    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Service Manager.lnk]


    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Service Manager.lnk


    backup=C:\WINDOWS\pss\Service Manager.lnkCommon Startup


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Broadcom Wireless Manager UI]


    --a------ 2005-12-19 08:08 1347584 C:\WINDOWS\system32\WLTRAY.exe


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]


    C:\Program Files\Common Files\Symantec Shared\ccApp.exe


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Corel Photo Downloader]


    --a------ 2006-02-09 17:34 106496 C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]


    --a------ 2004-08-04 05:00 15360 C:\WINDOWS\system32\ctfmon.exe


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]


    --a------ 2005-05-15 02:04 332800 C:\Program Files\Dell Support\DSAgnt.exe


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dla]


    --a------ 2004-12-06 01:05 127035 C:\WINDOWS\system32\dla\tfswctrl.exe


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]


    --------- 2005-12-09 20:29 49152 C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eFax 4.2]


    --a------ 2006-07-14 15:36 107008 C:\Program Files\eFax Messenger 4.2\J2GDllCmd.exe


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]


    --a------ 2005-12-13 16:41 77824 C:\WINDOWS\system32\hkcmd.exe


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]


    --a------ 2005-12-13 16:45 118784 C:\WINDOWS\system32\igfxpers.exe


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]


    --a------ 2005-12-13 16:44 98304 C:\WINDOWS\system32\igfxtray.exe


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]


    --a------ 2005-06-10 10:44 249856 c:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]


    --a------ 2005-06-10 10:44 81920 C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]


    --a------ 2007-03-14 18:05 257088 C:\Program Files\iTunes\iTunesHelper.exe


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ModemOnHold]


    --------- 2003-09-10 02:24 20480 C:\Program Files\NetWaiting\netWaiting.exe


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKDetectorExe]


    --a------ 2006-11-07 14:49 1121280 C:\Program Files\McAfee\SpamKiller\MSKDetct.exe


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]


    --a------ 2007-01-19 12:54 5674352 C:\Program Files\MSN Messenger\MsnMsgr.exe


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Norton Ghost 10.0]


    C:\Program Files\Norton Ghost\Agent\GhostTray.exe


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OneCareUI]


    C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService]


    --------- 2004-04-11 20:15 290816 C:\Program Files\Dell\Media Experience\PCMService.exe


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]


    --a------ 2007-02-16 10:54 282624 C:\Program Files\QuickTime\qttask.exe


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]


    --a------ 2007-07-20 08:42 214560 C:\Program Files\Real\RealPlayer\RealPlay.exe


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]


    --a------ 2006-03-24 16:30 282624 C:\WINDOWS\stsystra.exe


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]


    C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]


    --a------ 2006-03-08 11:48 761947 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UserFaultCheck]


    C:\WINDOWS\system32\dumprep 0 -u


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]


    --a------ 2006-11-03 18:20 866584 C:\Program Files\Windows Defender\MSASCui.exe


    R2 dlcq_device;dlcq_device;C:\WINDOWS\system32\dlcqcoms.exe [2006-12-12 04:22]


    S4 JavaLOG;JavaLOG;C:\Documents and Settings\Finesse\Desktop\Th3x\services.exe []


    .


    Contents of the 'Scheduled Tasks' folder


    "2008-02-17 12:11:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"


    - C:\Program Files\Apple Software Update\SoftwareUpdate.exe


    "2006-12-03 21:45:33 C:\WINDOWS\Tasks\ISP signup reminder 1.job"


    - C:\WINDOWS\system32\OOBE\oobebaln.exe


    "2008-01-28 18:04:31 C:\WINDOWS\Tasks\MP Scheduled Quick Scan.job"


    - C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MpCmdRun.exe%Scan -RestrictPrivileges -ScanType 1


    "2008-02-17 15:20:12 C:\WINDOWS\Tasks\MP Scheduled Scan.job"


    - C:\Program Files\Windows Defender\MpCmdRun.exe


    .


    **************************************************************************


    catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net


    Rootkit scan 2008-02-17 10:17:55


    Windows 5.1.2600 Service Pack 2 NTFS


    scanning hidden processes ...


    scanning hidden autostart entries ...


    scanning hidden files ...


    scan completed successfully


    hidden files: 0


    **************************************************************************


    .


    ------------------------ Other Running Processes ------------------------


    .


    C:\Program Files\Windows Defender\MsMpEng.exe


    C:\WINDOWS\System32\WLTRYSVC.EXE


    C:\WINDOWS\System32\bcmwltry.exe


    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe


    C:\WINDOWS\system32\LEXBCES.EXE


    C:\WINDOWS\system32\LEXPPS.EXE


    C:\Program Files\a-squared Anti-Malware\a2service.exe


    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe


    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe


    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe


    C:\Program Files\Citrix\GoToMyPC\g2svc.exe


    C:\Program Files\Citrix\GoToMyPC\g2comm.exe


    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE


    C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe


    C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe


    C:\Program Files\Citrix\GoToMyPC\g2pre.exe


    C:\WINDOWS\system32\HPZipm12.exe


    C:\Program Files\Citrix\GoToMyPC\g2tray.exe


    C:\WINDOWS\system32\imapi.exe


    .


    **************************************************************************


    .


    Completion time: 2008-02-17 10:21:07 - machine was rebooted


    ComboFix-quarantined-files.txt 2008-02-17 15:21:03


    .


    2008-02-15 15:26:34 --- E O F ---


    Below here is the fresh HJT log


    Logfile of Trend Micro HijackThis v2.0.2


    Scan saved at 10:30:01 AM, on 2/17/2008


    Platform: Windows XP SP2 (WinNT 5.01.2600)


    MSIE: Internet Explorer v7.00 (7.00.6000.16608)


    Boot mode: Normal


    Running processes:


    C:\WINDOWS\System32\smss.exe


    C:\WINDOWS\system32\winlogon.exe


    C:\WINDOWS\system32\services.exe


    C:\WINDOWS\system32\lsass.exe


    C:\WINDOWS\system32\svchost.exe


    C:\Program Files\Windows Defender\MsMpEng.exe


    C:\WINDOWS\System32\svchost.exe


    C:\WINDOWS\System32\WLTRYSVC.EXE


    C:\WINDOWS\System32\bcmwltry.exe


    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe


    C:\WINDOWS\system32\LEXBCES.EXE


    C:\WINDOWS\system32\spoolsv.exe


    C:\WINDOWS\system32\LEXPPS.EXE


    C:\Program Files\a-squared Anti-Malware\a2service.exe


    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe


    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe


    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe


    C:\WINDOWS\system32\dlcqcoms.exe


    C:\Program Files\Citrix\GoToMyPC\g2svc.exe


    C:\Program Files\Citrix\GoToMyPC\g2comm.exe


    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE


    C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe


    C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe


    C:\Program Files\Citrix\GoToMyPC\g2pre.exe


    C:\WINDOWS\system32\HPZipm12.exe


    C:\WINDOWS\system32\svchost.exe


    C:\Program Files\Citrix\GoToMyPC\g2tray.exe


    C:\WINDOWS\explorer.exe


    C:\WINDOWS\system32\ctfmon.exe


    C:\Program Files\Grisoft\AVG7\avgcc.exe


    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe


    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.msn.com/


    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157


    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896


    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896


    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157


    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll


    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll


    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll


    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MI1933~1\Office12\GRA8E1~1.DLL


    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll


    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll


    O2 - BHO: {b70a8eff-816e-875b-c964-da94e25f62da} - {ad26f52e-49ad-469c-b578-e618ffe8a07b} - C:\WINDOWS\system32\ddjdpdfn.dll (file missing)


    O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll


    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot


    O4 - HKLM\..\Run: [dlcqmon.exe] "C:\Program Files\Dell Photo AIO Printer 966\dlcqmon.exe"


    O4 - HKLM\..\Run: [DLCQCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCQtime.dll,_RunDLLEntry@16


    O4 - HKLM\..\Run: [a-squared] "C:\Program Files\a-squared Anti-Malware\a2guard.exe" /d=60


    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime


    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP


    O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"


    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe


    O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe"


    O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe


    O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')


    O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')


    O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')


    O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')


    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE


    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000


    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll


    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll


    O9 - Extra button: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Finesse\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk


    O9 - Extra 'Tools' menuitem: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Finesse\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk


    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll


    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll


    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe


    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe


    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\Office12\REFIEBAR.DLL


    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll


    O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)


    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll


    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll


    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe


    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe


    O16 - DPF: PUFLITE - http://www.hinesville-homes.com/Office/Col...rol/PUFLITE.CAB


    O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab55579.cab


    O16 - DPF: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} (Microsoft VM) - https://www.topproduceronline.com/downloads/msjavx86.exe


    O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab


    O16 - DPF: {11865A2A-649F-4FA1-8B99-B97DF8070B7C} (IWSystemchecks Control) - http://elliemae.interwise.com/elliemae/Eng...ystemchecks.cab


    O16 - DPF: {13EC55CF-D993-475B-9ACA-F4A384957956} (Controller Class) - https://www.windowsonecare.com/install/cli/...nSSWebAgent.CAB


    O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - https://citrix.exitrealty.com/CitrixSession...ca32/wficat.cab


    O16 - DPF: {254AA86E-5655-4518-AA87-185D7CC41801} (LogMeIn Rescue Technician Console) - https://secure.logmeinrescue.com/TechConsol...scueControl.cab


    O16 - DPF: {284DAE3C-A691-11D3-AD58-00E0B8107A24} (SISCtrl Class) - http://sav.mlxchange.com/Control/SISC.cab


    O16 - DPF: {2EB1E425-74DC-4DC0-A9E1-03A4C852E1F2} (CPlayFirstTriJinxControl Object) - http://zone.msn.com/bingame/trix/default/T...nx.1.0.0.87.cab


    O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (MSN Games – Buddy Invite) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab55579.cab


    O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab


    O16 - DPF: {4989312D-58CF-11D5-A7D7-00E02911103E} (Interealty MultiSelect) - http://sav.mlxchange.com/Control/MultiSelectComboBox.cab


    O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m...01/mcinsctl.cab


    O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab55579.cab


    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab


    O16 - DPF: {64D01C7F-810D-446E-A07E-16C764235644} (AtlAtomadersCtlAttrib Class) - http://zone.msn.com/bingame/amad/default/atomaders.cab


    O16 - DPF: {664088B0-6AF3-4514-AF9D-A0DC3A3DF24A} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols3beta/fscax.cab


    O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab


    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1167029388656


    O16 - DPF: {6FD482A3-7B57-438B-B040-52CAA30147EE} (MLXchange Client Utils) - http://sav.mlxchange.com/Control/MLXClientUtils.cab


    O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://zone.msn.com/bingame/amun/default/mjolauncher.cab


    O16 - DPF: {809A6301-7B40-4436-A02C-87B8D3D7D9E3} (ZPA_DMNO Object) - http://zone.msn.com/bingame/zpagames/zpa_dmno.cab55579.cab


    O16 - DPF: {80B626D6-BC34-4BCF-B5A1-7149E4FD9CFA} (UnoCtrl Class) - http://zone.msn.com/bingame/zpagames/GAME_UNO1.cab60096.cab


    O16 - DPF: {83AB6E4D-CDD7-11D3-B5E7-00104B9AFF6E} (GeacRevw Control) - http://sav.mlxchange.com/3.0.09.83/Control/IRCSharc.cab


    O16 - DPF: {8569D715-FF88-44BA-8D1D-AD3E59543DDE} (ActiveReports Viewer2) - https://www.topproduceronline.com/Downloads/arview2.cab


    O16 - DPF: {95B5D20C-BD31-4489-8ABF-F8C8BE748463} (MSN Games – Hearts) - http://zone.msn.com/bingame/zpagames/zpa_hrtz.cab70018.cab


    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab


    O16 - DPF: {9BDF4724-10AA-43D5-BD15-AEA0D2287303} (ZPA_TexasHoldem Object) - http://zone.msn.com/bingame/zpagames/zpa_txhe.cab55579.cab


    O16 - DPF: {A4110378-789B-455F-AE86-3A1BFC402853} (ZPA_SHVL Object) - http://zone.msn.com/bingame/zpagames/zpa_shvl.cab55579.cab


    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/...ro.cab56649.cab


    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab


    O16 - DPF: {C487F60B-59B9-47D9-BFDF-AB26786F8823} - http://zone.msn.com/bingame/zpagames/zpa_stoo.cab62201.cab


    O16 - DPF: {C86FF4B0-AA1D-46D4-8612-025FB86583C7} (AstoundLauncher Control) - http://zone.msn.com/bingame/jobo/default/A...ersion=1,0,0,10


    O16 - DPF: {CBD8B1CB-2F5F-415F-93E8-A297B33DCBB2} (CentrinoCheck Control) - http://entriq.vo.llnwd.net/o1/NBCUniversal...eck_1_0_0_5.cab


    O16 - DPF: {CE7D2BF2-D173-4CE2-9DAF-15EA153B5B43} - http://entriq.vo.llnwd.net/o1/NBCUniversal..._2_2_Silent.cab


    O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (MSN Games – Game Communicator) - http://zone.msn.com/binframework/v10/StProxy.cab55579.cab


    O16 - DPF: {DE0FB644-C59B-46D1-B650-88BA945BC98F} - http://entriq.vo.llnwd.net/o1/NBCUniversal...sal_1_0_0_7.cab


    O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/popcaploader_v10.cab


    O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://flagstar.webex.com/client/T23L/training/ieatgpc.cab


    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MI1933~1\Office12\GR99D3~1.DLL


    O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Malware\a2service.exe


    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe


    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe


    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe


    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe


    O23 - Service: dlcq_device - - C:\WINDOWS\system32\dlcqcoms.exe


    O23 - Service: GoToMyPC - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToMyPC\g2svc.exe


    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe


    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE


    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE


    O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe


    O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe


    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe


    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe


    O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE


    --


    End of file - 13720 bytes

    /applications/core/interface/file/attachment.php?id=1524" data-fileid="1524" rel="">bitdefender_scan_log.rar

  • farbar
    farbar ✭
    edited February 2008

    Darkumas,


    I can't download any attachment.


    It was not easy checking all those installed active x but I checked everything.


    Please give step by step feedback. The red x should be fixed by doing step 2.


    Step 1


    Uninstall any p2p file sharing (utorrent, etc) and remove its folder from program files. When we finished you can install them if you wanted.


    Step 2


    Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. After Combofix is finished turn on/enable your anti virus again.


    Open a notepad (start menu-all programs-accessorie-notepad).


    Copy and paste the text in the code box below into it.


    * Select save in:desktop


    * Fill in File name: CFScript.txt


    * save as type: All file types (*.*)


    * click save Open notepad and copy/paste into it: 


    File::
    C:\WINDOWS\system32\ddjdpdfn.dll
    C:\WINDOWS\system32\xrukrjwn.tmp
    C:\WINDOWS\system32\gqsrcoel.ini
    C:\WINDOWS\system32\ahrsqshg.ini
    C:\WINDOWS\system32\tgsrkhno.ini
    C:\Documents and Settings\Finesse\Desktop\Th3x\services.exe

    Folder::
    C:\Program Files\Windows Defender

    Registry::
    [-KEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\DriveIcons] 
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\DriveIcons\c] 
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\DriveIcons\c\DefaultIcon]
    [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ad26f52e-49ad-469c-b578-e618ffe8a07b}]
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "QuickTime Task"=-
    "TkBellExe"=-

    Dirlook::
    C:\WINDOWS\system32\98f86e94

    Driver::
    JavaLOG


    Drag CFScript.txt into ComboFix.exe. You can see the image showing this here: http://www.fromsej.saknet.dk/billeder/cfscript.gif


    Please post the combofix log and I think for the last time a fresh HJT log.

  • Darkumas
    Darkumas

    All p2p programs have been removed. I am moving on to step 2 now

  • Darkumas
    Darkumas

    I dragged the .txt file into combofix. It ran and is rebooting the system now. When it comes back up I will post the log then run HJT one more time.

  • Darkumas
    Darkumas
    Darkumas,


    I can't download any attachment.


    It was not easy checking all those installed active x but I checked everything.


    Please give step by step feedback. The red x should be fixed by doing step 2.


    Step 1


    Uninstall any p2p file sharing (utorrent, etc) and remove its folder from program files. When we finished you can install them if you wanted.


    Step 2


    Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. After Combofix is finished turn on/enable your anti virus again.


    Open a notepad (start menu-all programs-accessorie-notepad).


    Copy and paste the text in the code box below into it.


    * Select save in:desktop


    * Fill in File name: CFScript.txt


    * save as type: All file types (*.*)


    * click save Open notepad and copy/paste into it: 


    File::
    C:\WINDOWS\system32\ddjdpdfn.dll
    C:\WINDOWS\system32\xrukrjwn.tmp
    C:\WINDOWS\system32\gqsrcoel.ini
    C:\WINDOWS\system32\ahrsqshg.ini
    C:\WINDOWS\system32\tgsrkhno.ini
    C:\Documents and Settings\Finesse\Desktop\Th3x\services.exe

    Folder::
    C:\Program Files\Windows Defender

    Registry::
    [-KEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\DriveIcons] 
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\DriveIcons\c] 
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\DriveIcons\c\DefaultIcon]
    [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ad26f52e-49ad-469c-b578-e618ffe8a07b}]
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "QuickTime Task"=-
    "TkBellExe"=-

    Dirlook::
    C:\WINDOWS\system32\98f86e94

    Driver::
    JavaLOG


    Drag CFScript.txt into ComboFix.exe. You can see the image showing this here: http://www.fromsej.saknet.dk/billeder/cfscript.gif


    Please post the combofix log and I think for the last time a fresh HJT log.


    Here is the combofix log file below.


    ComboFix 08-02-17.2 - Finesse 2008-02-17 18:03:09.2 - NTFSx86


    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.152 [GMT -5:00]


    Running from: C:\Documents and Settings\Finesse\Desktop\ComboFix.exe


    Command switches used :: C:\Documents and Settings\Finesse\Desktop\CFScript.txt


    * Created a new restore point


    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!


    FILE ::


    C:\Documents and Settings\Finesse\Desktop\Th3x\services.exe


    C:\WINDOWS\system32\ahrsqshg.ini


    C:\WINDOWS\system32\ddjdpdfn.dll


    C:\WINDOWS\system32\gqsrcoel.ini


    C:\WINDOWS\system32\tgsrkhno.ini


    C:\WINDOWS\system32\xrukrjwn.tmp


    .


    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


    .


    C:\WINDOWS\system32\ahrsqshg.ini


    C:\WINDOWS\system32\gqsrcoel.ini


    C:\WINDOWS\system32\tgsrkhno.ini


    C:\WINDOWS\system32\xrukrjwn.tmp


    .


    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


    .


    -------\LEGACY_JAVALOG


    -------\JavaLOG


    ((((((((((((((((((((((((( Files Created from 2008-01-17 to 2008-02-17 )))))))))))))))))))))))))))))))


    .


    2008-02-16 12:24 . 2008-02-16 22:41 <DIR> d-------- C:\WINDOWS\BDOSCAN8


    2008-02-16 12:08 . 2007-12-14 01:59 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl


    2008-02-16 12:07 . 2008-02-16 12:08 <DIR> d-------- C:\Program Files\Java


    2008-02-16 12:07 . 2008-02-16 12:07 <DIR> d-------- C:\Program Files\Common Files\Java


    2008-02-15 14:53 . 2008-02-15 15:05 <DIR> d-------- C:\WINDOWS\system32\ActiveScan


    2008-02-15 14:53 . 2008-02-15 14:53 30,590 --a------ C:\WINDOWS\system32\pavas.ico


    2008-02-15 14:53 . 2008-02-15 14:53 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico


    2008-02-15 14:53 . 2008-02-15 14:53 1,406 --a------ C:\WINDOWS\system32\Help.ico


    2008-02-15 14:47 . 2008-02-15 14:47 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\AVG7


    2008-02-15 14:47 . 2008-02-17 08:00 <DIR> d-------- C:\Documents and Settings\Finesse\Application Data\AVG7


    2008-02-15 14:46 . 2008-02-15 14:46 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft


    2008-02-15 14:46 . 2008-02-16 08:00 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg7


    2008-02-15 13:57 . 2008-02-15 13:57 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy


    2008-02-15 13:57 . 2008-02-15 14:21 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy


    2008-02-15 11:48 . 2008-02-15 11:48 <DIR> d-------- C:\Program Files\Lavasoft


    2008-02-15 11:46 . 2008-02-15 11:46 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard


    2008-02-15 10:26 . 2008-02-15 10:26 <DIR> d-------- C:\Program Files\Trend Micro


    2008-02-13 09:34 . 2008-02-13 09:38 1,374 --a------ C:\WINDOWS\imsins.BAK


    2008-02-11 19:06 . 2008-02-11 19:06 <DIR> d-------- C:\fsaua.data


    2008-02-06 03:24 . 2008-02-06 03:24 9 --a------ C:\WINDOWS\system32\98f86e94


    2008-01-29 20:18 . 2008-02-01 12:31 <DIR> d-------- C:\Program Files\a-squared Anti-Malware


    2008-01-28 18:53 . 2007-03-22 13:38 215,144 -ra------ C:\WINDOWS\patchw32.dll


    2008-01-28 18:51 . 2007-03-22 13:38 215,144 -ra------ C:\WINDOWS\pw32a.dll


    2008-01-27 22:39 . 2008-01-27 22:39 <DIR> d-------- C:\Program Files\PowerISO


    2008-01-26 15:49 . 2008-02-08 19:42 <DIR> d-------- C:\Program Files\Dl_cats


    2008-01-26 15:49 . 2008-01-26 15:49 <DIR> d-------- C:\Documents and Settings\All Users\dl_cats


    2008-01-26 15:47 . 2006-11-07 12:30 344,064 --a------ C:\WINDOWS\system32\dlcqcoin.dll


    2008-01-26 15:47 . 2006-04-25 03:11 40,960 --a------ C:\WINDOWS\system32\dlcqvs.dll


    2008-01-26 15:46 . 2006-08-08 15:58 692,224 --a------ C:\WINDOWS\system32\dlcqdrs.dll


    2008-01-26 15:46 . 2001-08-17 22:36 87,040 --a------ C:\WINDOWS\system32\wiafbdrv.dll


    2008-01-26 15:46 . 2001-08-17 22:36 87,040 --a------ C:\WINDOWS\system32\dllcache\wiafbdrv.dll


    2008-01-26 15:46 . 2006-08-14 17:32 65,536 --a------ C:\WINDOWS\system32\dlcqcaps.dll


    2008-01-26 15:46 . 2006-05-09 10:10 61,440 --a------ C:\WINDOWS\system32\dlcqcnv4.dll


    2008-01-26 15:44 . 2008-01-26 15:46 <DIR> d-------- C:\Program Files\Dell Photo AIO Printer 966


    2008-01-26 15:43 . 2006-10-11 17:48 684,032 --a------ C:\WINDOWS\system32\dlcqcomc.dll


    2008-01-26 15:43 . 2006-12-12 04:22 381,832 --a------ C:\WINDOWS\system32\dlcqcfg.exe


    2008-01-26 15:43 . 2006-09-06 06:12 77,824 --a------ C:\WINDOWS\system32\DLCQcfg.dll


    2008-01-26 15:43 . 2006-12-11 08:58 2,069 --a------ C:\WINDOWS\system32\dlcq.loc


    2008-01-25 17:28 . 2008-01-25 19:42 <DIR> d-------- C:\Documents and Settings\Finesse\Application Data\Lavasoft


    2008-01-21 23:14 . 2008-01-21 23:14 <DIR> d-------- C:\Documents and Settings\Finesse\Application Data\PlayFirst


    2008-01-21 23:14 . 2008-01-21 23:14 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\PlayFirst


    2008-01-21 09:14 . 2008-02-15 11:48 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft


    2008-01-20 02:07 . 2008-01-20 02:07 33,292 --a------ C:\WINDOWS\system32\drivers\scdemu.sys


    2008-01-17 23:01 . 2008-01-17 23:01 <DIR> d-------- C:\Documents and Settings\Finesse\Application Data\FastStone


    .


    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))


    .


    2008-02-17 22:52 --------- d-----w C:\Program Files\The KMPlayer


    2008-02-17 22:50 --------- d-----w C:\Program Files\BeamFile


    2008-02-13 14:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help


    2008-02-12 04:06 --------- d-----w C:\Program Files\Common Files\Symantec Shared


    2008-02-12 04:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec


    2008-02-11 18:02 --------- d-----w C:\Program Files\Symantec


    2008-01-31 19:26 --------- d-----w C:\Program Files\Norton Ghost


    2008-01-30 03:36 --------- d-----w C:\Program Files\iMesh Applications


    2008-01-29 06:15 --------- d-----w C:\Program Files\Absolute Poker


    2008-01-16 02:35 --------- d-----w C:\Program Files\FastStone Image Viewer


    2008-01-13 20:24 --------- d-----w C:\Documents and Settings\Finesse\Application Data\YouSendIt


    2008-01-09 20:01 53,248 ----a-w C:\WINDOWS\bdoscandel.exe


    2008-01-09 00:32 --------- d--h--w C:\Program Files\InstallShield Installation Information


    2008-01-09 00:32 --------- d-----w C:\Program Files\YouSendIt


    2008-01-08 20:13 --------- d-----w C:\Documents and Settings\All Users\Application Data\Winamp Toolbar


    2008-01-08 13:50 --------- d-----w C:\Program Files\MSN Games


    2008-01-08 13:34 --------- d-----w C:\Program Files\Winamp Remote


    2008-01-08 04:22 --------- d-----w C:\Program Files\Common Files\NSV


    2008-01-07 01:23 --------- d-----w C:\Program Files\ReflexiveArcade


    2008-01-06 15:10 --------- d-----w C:\Program Files\Hasbro


    2008-01-06 04:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\Zylom


    2007-12-27 00:19 --------- d-----w C:\Program Files\Common Files\Adobe


    2007-12-27 00:19 --------- d-----w C:\Documents and Settings\All Users\Application Data\FLEXnet


    2007-12-25 06:14 --------- d-----w C:\Documents and Settings\Finesse\Application Data\Big Fish Games


    2007-12-25 03:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\PopCap


    2007-12-23 23:35 --------- d-----w C:\Documents and Settings\Finesse\Application Data\FloodLightGames


    2007-12-23 23:35 --------- d-----w C:\Documents and Settings\All Users\Application Data\FloodLightGames


    2007-12-23 23:34 --------- d-----w C:\Program Files\Reflexive


    2007-12-18 09:51 179,584 ----a-w C:\WINDOWS\system32\drivers\mrxdav.sys


    2007-07-06 19:38 69,784 ----a-w C:\Documents and Settings\Finesse\Application Data\GDIPFONTCACHEV1.DAT


    2007-10-22 02:42 88 --sh--r C:\WINDOWS\system32\51A3A397F4.sys


    2007-10-22 02:42 3,766 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys


    .


    (((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))


    .


    ---- Directory of C:\WINDOWS\system32\98f86e94 ----


    C:\WINDOWS\system32\98f86e94\


    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


    .


    .


    *Note* empty entries & legit default entries are not shown


    REGEDIT4


    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]


    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:00 15360]


    "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe" [2007-10-23 14:18 202024]


    "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]


    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]


    "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-07-20 08:42 185896]


    "dlcqmon.exe"="C:\Program Files\Dell Photo AIO Printer 966\dlcqmon.exe" [2007-06-29 11:47 292080]


    "DLCQCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCQtime.dll" [2006-10-16 01:31 106496]


    "a-squared"="C:\Program Files\a-squared Anti-Malware\a2guard.exe" [2008-01-29 20:27 1816208]


    "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 10:54 282624]


    "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-02-15 14:48 579072]


    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe" [2007-12-14 03:42 144784]


    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]


    "DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 08:01 437160]


    "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-02-15 14:46 219136]


    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\


    Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 00:01:04 83360]


    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToMyPC]


    C:\Program Files\Citrix\GoToMyPC\G2WinLogon.dll 2007-01-12 16:45 10800 C:\Program Files\Citrix\GoToMyPC\G2WinLogon.dll


    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]


    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk


    backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup


    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]


    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk


    backup=C:\WINDOWS\pss\Digital Line Detect.lnkCommon Startup


    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^eFax 4.2.lnk]


    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\eFax 4.2.lnk


    backup=C:\WINDOWS\pss\eFax 4.2.lnkCommon Startup


    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Service Manager.lnk]


    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Service Manager.lnk


    backup=C:\WINDOWS\pss\Service Manager.lnkCommon Startup


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Broadcom Wireless Manager UI]


    --a------ 2005-12-19 08:08 1347584 C:\WINDOWS\system32\WLTRAY.exe


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]


    C:\Program Files\Common Files\Symantec Shared\ccApp.exe


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Corel Photo Downloader]


    --a------ 2006-02-09 17:34 106496 C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]


    --a------ 2004-08-04 05:00 15360 C:\WINDOWS\system32\ctfmon.exe


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]


    --a------ 2005-05-15 02:04 332800 C:\Program Files\Dell Support\DSAgnt.exe


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dla]


    --a------ 2004-12-06 01:05 127035 C:\WINDOWS\system32\dla\tfswctrl.exe


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]


    --------- 2005-12-09 20:29 49152 C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eFax 4.2]


    --a------ 2006-07-14 15:36 107008 C:\Program Files\eFax Messenger 4.2\J2GDllCmd.exe


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]


    --a------ 2005-12-13 16:41 77824 C:\WINDOWS\system32\hkcmd.exe


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]


    --a------ 2005-12-13 16:45 118784 C:\WINDOWS\system32\igfxpers.exe


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]


    --a------ 2005-12-13 16:44 98304 C:\WINDOWS\system32\igfxtray.exe


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]


    --a------ 2005-06-10 10:44 249856 c:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]


    --a------ 2005-06-10 10:44 81920 C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]


    --a------ 2007-03-14 18:05 257088 C:\Program Files\iTunes\iTunesHelper.exe


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ModemOnHold]


    --------- 2003-09-10 02:24 20480 C:\Program Files\NetWaiting\netWaiting.exe


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKDetectorExe]


    --a------ 2006-11-07 14:49 1121280 C:\Program Files\McAfee\SpamKiller\MSKDetct.exe


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]


    --a------ 2007-01-19 12:54 5674352 C:\Program Files\MSN Messenger\MsnMsgr.exe


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Norton Ghost 10.0]


    C:\Program Files\Norton Ghost\Agent\GhostTray.exe


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OneCareUI]


    C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService]


    --------- 2004-04-11 20:15 290816 C:\Program Files\Dell\Media Experience\PCMService.exe


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]


    --a------ 2007-02-16 10:54 282624 C:\Program Files\QuickTime\qttask.exe


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]


    --a------ 2007-07-20 08:42 214560 C:\Program Files\Real\RealPlayer\RealPlay.exe


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]


    --a------ 2006-03-24 16:30 282624 C:\WINDOWS\stsystra.exe


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]


    C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]


    --a------ 2006-03-08 11:48 761947 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UserFaultCheck]


    C:\WINDOWS\system32\dumprep 0 -u


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]


    C:\Program Files\Windows Defender\MSASCui.exe


    R2 dlcq_device;dlcq_device;C:\WINDOWS\system32\dlcqcoms.exe [2006-12-12 04:22]


    .


    Contents of the 'Scheduled Tasks' folder


    "2008-02-17 12:11:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"


    - C:\Program Files\Apple Software Update\SoftwareUpdate.exe


    "2006-12-03 21:45:33 C:\WINDOWS\Tasks\ISP signup reminder 1.job"


    - C:\WINDOWS\system32\OOBE\oobebaln.exe


    "2008-01-28 18:04:31 C:\WINDOWS\Tasks\MP Scheduled Quick Scan.job"


    - C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MpCmdRun.exe%Scan -RestrictPrivileges -ScanType 1


    .


    **************************************************************************


    catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net


    Rootkit scan 2008-02-17 18:09:52


    Windows 5.1.2600 Service Pack 2 NTFS


    scanning hidden processes ...


    scanning hidden autostart entries ...


    scanning hidden files ...


    scan completed successfully


    hidden files: 0


    **************************************************************************


    .


    ------------------------ Other Running Processes ------------------------


    .


    C:\WINDOWS\System32\WLTRYSVC.EXE


    C:\WINDOWS\System32\bcmwltry.exe


    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe


    C:\WINDOWS\system32\LEXBCES.EXE


    C:\WINDOWS\system32\LEXPPS.EXE


    C:\Program Files\a-squared Anti-Malware\a2service.exe


    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe


    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe


    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe


    C:\Program Files\Citrix\GoToMyPC\g2svc.exe


    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE


    C:\Program Files\Citrix\GoToMyPC\g2comm.exe


    C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe


    C:\Program Files\Citrix\GoToMyPC\g2pre.exe


    C:\Program Files\Citrix\GoToMyPC\g2tray.exe


    C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe


    C:\WINDOWS\system32\HPZipm12.exe


    .


    **************************************************************************


    .


    Completion time: 2008-02-17 18:13:04 - machine was rebooted


    ComboFix-quarantined-files.txt 2008-02-17 23:13:00


    ComboFix2.txt 2008-02-17 15:21:07


    .


    2008-02-15 15:26:34 --- E O F ---

  • Darkumas
    Darkumas

    Here is the HJT Log below.


    Logfile of Trend Micro HijackThis v2.0.2


    Scan saved at 6:18:49 PM, on 2/17/2008


    Platform: Windows XP SP2 (WinNT 5.01.2600)


    MSIE: Internet Explorer v7.00 (7.00.6000.16608)


    Boot mode: Normal


    Running processes:


    C:\WINDOWS\System32\smss.exe


    C:\WINDOWS\system32\winlogon.exe


    C:\WINDOWS\system32\services.exe


    C:\WINDOWS\system32\lsass.exe


    C:\WINDOWS\system32\svchost.exe


    C:\WINDOWS\System32\svchost.exe


    C:\WINDOWS\System32\WLTRYSVC.EXE


    C:\WINDOWS\System32\bcmwltry.exe


    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe


    C:\WINDOWS\system32\LEXBCES.EXE


    C:\WINDOWS\system32\spoolsv.exe


    C:\WINDOWS\system32\LEXPPS.EXE


    C:\Program Files\a-squared Anti-Malware\a2service.exe


    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe


    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe


    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe


    C:\WINDOWS\system32\dlcqcoms.exe


    C:\Program Files\Citrix\GoToMyPC\g2svc.exe


    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE


    C:\Program Files\Citrix\GoToMyPC\g2comm.exe


    C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe


    C:\Program Files\Citrix\GoToMyPC\g2pre.exe


    C:\Program Files\Citrix\GoToMyPC\g2tray.exe


    C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe


    C:\WINDOWS\system32\HPZipm12.exe


    C:\WINDOWS\system32\svchost.exe


    C:\WINDOWS\explorer.exe


    C:\Program Files\internet explorer\iexplore.exe


    C:\WINDOWS\system32\ctfmon.exe


    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe


    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.msn.com/


    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157


    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896


    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896


    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157


    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll


    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll


    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll


    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MI1933~1\Office12\GRA8E1~1.DLL


    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll


    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll


    O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll


    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot


    O4 - HKLM\..\Run: [dlcqmon.exe] "C:\Program Files\Dell Photo AIO Printer 966\dlcqmon.exe"


    O4 - HKLM\..\Run: [DLCQCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCQtime.dll,_RunDLLEntry@16


    O4 - HKLM\..\Run: [a-squared] "C:\Program Files\a-squared Anti-Malware\a2guard.exe" /d=60


    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime


    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP


    O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"


    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe


    O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe"


    O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe


    O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')


    O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')


    O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')


    O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')


    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE


    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000


    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll


    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll


    O9 - Extra button: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Finesse\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk


    O9 - Extra 'Tools' menuitem: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Finesse\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk


    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll


    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll


    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe


    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe


    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\Office12\REFIEBAR.DLL


    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll


    O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)


    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll


    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll


    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe


    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe


    O16 - DPF: PUFLITE - http://www.hinesville-homes.com/Office/Col...rol/PUFLITE.CAB


    O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab55579.cab


    O16 - DPF: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} (Microsoft VM) - https://www.topproduceronline.com/downloads/msjavx86.exe


    O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab


    O16 - DPF: {11865A2A-649F-4FA1-8B99-B97DF8070B7C} (IWSystemchecks Control) - http://elliemae.interwise.com/elliemae/Eng...ystemchecks.cab


    O16 - DPF: {13EC55CF-D993-475B-9ACA-F4A384957956} (Controller Class) - https://www.windowsonecare.com/install/cli/...nSSWebAgent.CAB


    O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - https://citrix.exitrealty.com/CitrixSession...ca32/wficat.cab


    O16 - DPF: {254AA86E-5655-4518-AA87-185D7CC41801} (LogMeIn Rescue Technician Console) - https://secure.logmeinrescue.com/TechConsol...scueControl.cab


    O16 - DPF: {284DAE3C-A691-11D3-AD58-00E0B8107A24} (SISCtrl Class) - http://sav.mlxchange.com/Control/SISC.cab


    O16 - DPF: {2EB1E425-74DC-4DC0-A9E1-03A4C852E1F2} (CPlayFirstTriJinxControl Object) - http://zone.msn.com/bingame/trix/default/T...nx.1.0.0.87.cab


    O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (MSN Games – Buddy Invite) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab55579.cab


    O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab


    O16 - DPF: {4989312D-58CF-11D5-A7D7-00E02911103E} (Interealty MultiSelect) - http://sav.mlxchange.com/Control/MultiSelectComboBox.cab


    O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m...01/mcinsctl.cab


    O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab55579.cab


    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab


    O16 - DPF: {64D01C7F-810D-446E-A07E-16C764235644} (AtlAtomadersCtlAttrib Class) - http://zone.msn.com/bingame/amad/default/atomaders.cab


    O16 - DPF: {664088B0-6AF3-4514-AF9D-A0DC3A3DF24A} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols3beta/fscax.cab


    O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab


    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1167029388656


    O16 - DPF: {6FD482A3-7B57-438B-B040-52CAA30147EE} (MLXchange Client Utils) - http://sav.mlxchange.com/Control/MLXClientUtils.cab


    O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://zone.msn.com/bingame/amun/default/mjolauncher.cab


    O16 - DPF: {809A6301-7B40-4436-A02C-87B8D3D7D9E3} (ZPA_DMNO Object) - http://zone.msn.com/bingame/zpagames/zpa_dmno.cab55579.cab


    O16 - DPF: {80B626D6-BC34-4BCF-B5A1-7149E4FD9CFA} (UnoCtrl Class) - http://zone.msn.com/bingame/zpagames/GAME_UNO1.cab60096.cab


    O16 - DPF: {83AB6E4D-CDD7-11D3-B5E7-00104B9AFF6E} (GeacRevw Control) - http://sav.mlxchange.com/3.0.09.83/Control/IRCSharc.cab


    O16 - DPF: {8569D715-FF88-44BA-8D1D-AD3E59543DDE} (ActiveReports Viewer2) - https://www.topproduceronline.com/Downloads/arview2.cab


    O16 - DPF: {95B5D20C-BD31-4489-8ABF-F8C8BE748463} (MSN Games – Hearts) - http://zone.msn.com/bingame/zpagames/zpa_hrtz.cab70018.cab


    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab


    O16 - DPF: {9BDF4724-10AA-43D5-BD15-AEA0D2287303} (ZPA_TexasHoldem Object) - http://zone.msn.com/bingame/zpagames/zpa_txhe.cab55579.cab


    O16 - DPF: {A4110378-789B-455F-AE86-3A1BFC402853} (ZPA_SHVL Object) - http://zone.msn.com/bingame/zpagames/zpa_shvl.cab55579.cab


    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/...ro.cab56649.cab


    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab


    O16 - DPF: {C487F60B-59B9-47D9-BFDF-AB26786F8823} - http://zone.msn.com/bingame/zpagames/zpa_stoo.cab62201.cab


    O16 - DPF: {C86FF4B0-AA1D-46D4-8612-025FB86583C7} (AstoundLauncher Control) - http://zone.msn.com/bingame/jobo/default/A...ersion=1,0,0,10


    O16 - DPF: {CBD8B1CB-2F5F-415F-93E8-A297B33DCBB2} (CentrinoCheck Control) - http://entriq.vo.llnwd.net/o1/NBCUniversal...eck_1_0_0_5.cab


    O16 - DPF: {CE7D2BF2-D173-4CE2-9DAF-15EA153B5B43} - http://entriq.vo.llnwd.net/o1/NBCUniversal..._2_2_Silent.cab


    O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (MSN Games – Game Communicator) - http://zone.msn.com/binframework/v10/StProxy.cab55579.cab


    O16 - DPF: {DE0FB644-C59B-46D1-B650-88BA945BC98F} - http://entriq.vo.llnwd.net/o1/NBCUniversal...sal_1_0_0_7.cab


    O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/popcaploader_v10.cab


    O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://flagstar.webex.com/client/T23L/training/ieatgpc.cab


    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MI1933~1\Office12\GR99D3~1.DLL


    O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Malware\a2service.exe


    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe


    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe


    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe


    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe


    O23 - Service: dlcq_device - - C:\WINDOWS\system32\dlcqcoms.exe


    O23 - Service: GoToMyPC - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToMyPC\g2svc.exe


    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe


    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE


    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE


    O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe


    O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe


    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe


    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe


    O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE


    --


    End of file - 13539 bytes

  • Darkumas
    Darkumas

    1. HD is back to normal now. Thx


    2. So far i see no more pop ups. Thx


    3. Let me know what's next. Thank you for all your help so far

  • farbar
    farbar ✭

    You are welcome.


    Everything looks clean now. There is no actual treat any more. You may set your privacy to default.


    1.Uninstall combofix to do that go to: Start >> Run... Type: Combofix /u and click OK.


    If you face any problem with uninstalling manually remove combofix and C:\Qoobox


    2.Remove this folder:C:\WINDOWS\system32\98f86e94 it is empty though, doesn't do any harm. If it is hidden unhide it.


    3. Go to start-search-click all files and folders - click more advanced options and check: search system folders, search hidden files and folders and search subfolders- type in P*.tmp in the upper box click on search. If you find any of those files remove them manually.


    4.Reboot and run ATF cleander right after reboot Check if your computer is running fine. Then empty your system volume information to get rid of recreation of infection by windows recovery. To do that: go to start-control panel- system- system restore- check turn off system restore on all drives. Click apply. By doing this you loose all your (often infected) restore points. Reboot and uncheck “turn off system restore on all drives' to create a clean restore point.


    5.Update and run all the virus fighter and antispyware and antiadware you got in the following days, they may from time to time find a (harmless) leftover and remove it. But before everything I strongly advise you to install a good firewall. Prevention is better than cure.


    If you have any question or saw anything unusual let me know.

All Time Leaders

Categories

Defenders of the month