Not Sure What I Have, But It Looks Like Everyone Else's

o1darcie1o · February 2008

I have two new icons on the desktop (Help & Support and Windows Update). Internet Explorer went berserk. Then windows stopped loading (XP, Pro, SP2). Used the install disk & repaired windows to load.

I loaded HJT to a jump drive from work and ran it. Log is here.

Please help!!!!

Logfile of Trend Micro HijackThis v2.0.0 (BETA)

Scan saved at 5:44:27 PM, on 2/27/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\WINDOWS\system32\cisvc.exe

C:\WINDOWS\IA\command.exe

C:\WINDOWS\system32\sdpasvc.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\alg.exe

C:\WINDOWS\system32\dllhost.exe

C:\WINDOWS\system32\msdtc.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

E:\iTunes\iTunesHelper.exe

C:\WINDOWS\Fonts\svchost.exe

C:\WINDOWS\system32\rundll32.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\windows

C:\WINDOWS\system32\cidaemon.exe

H:\HiJackThis_v2.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www6.comcast.net/a/

O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 8\SnagItBHO.dll

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: RabioBHO - {1C2E5D27-A17C-4D89-85DD-3553C189380D} - C:\Program Files\RABCO\RABCO.dll

O2 - BHO: (no name) - {45C2A50F-8F4A-496E-AF02-D0207525BF5A} - C:\WINDOWS\system32\xxyvvut.dll

O2 - BHO: (no name) - {5572363F-F2D9-41F5-8B4D-DE96E76FFDE7} - C:\Program Files\folder.js\cymawigu89104.dll (file missing)

O2 - BHO: (no name) - {87526773-6e7b-4187-8aa2-d1221f2213a9} - C:\WINDOWS\system32\gvrgyyw.dll

O2 - BHO: (no name) - {94E7FB49-508F-4BF5-B21B-273DB57B373A} - C:\Program Files\folder.js\cymawigu89104.dll (file missing)

O2 - BHO: (no name) - {A95B2816-1D7E-4561-A202-68C0DE02353A} - C:\WINDOWS\system32\grxnofvn.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)

O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll

O2 - BHO: (no name) - {C4C75055-666C-4065-81CB-F3F79CF52E4D} - C:\WINDOWS\system32\qopno.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll

O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll

O4 - HKLM\..\Run: [DVDUpgrade] DVDUpgrd.exe /async

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "E:\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [Host Process] C:\WINDOWS\Fonts\svchost.exe

O4 - HKLM\..\Run: [runner1] C:\WINDOWS\mrofinu1000106.exe 61A847B5BBF72813329B385772FF01F0B3E35B6638993F4661AA4EBD86D67C56389B284534F310

O4 - HKLM\..\Run: [2863b2a6] rundll32.exe "C:\WINDOWS\system32\grfrfmxy.dll",b

O4 - HKLM\..\Run: [bM2b50813a] Rundll32.exe "C:\WINDOWS\system32\xlnerxff.dll",s

O4 - HKLM\..\RunServices: [MOSearch] C:\PROGRA~1\COMMON~1\System\MOSearch\Bin\mosearch.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [WebBuying] C:\Program Files\Web Buying\v1.8.8\webbuying.exe

O4 - HKCU\..\Run: [sUPERAntiSpyware] G:\SUPERAntiSpyware.exe

O4 - HKUS\S-1-5-19\..\Run: [ctfmon.exe] ctfmon.exe (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [ctfmon.exe] ctfmon.exe (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] ctfmon.exe (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] ctfmon.exe (User 'Default user')

O4 - Startup: RABCO - Auto Update.lnk = C:\Program Files\RABCO\RABCOse.exe

O4 - Global Startup: Microsoft Office.lnk = G:\Office\OSA9.EXE

O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = \Palm\Hotsync.exe

O8 - Extra context menu item: &Google Search - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmsearch.html

O8 - Extra context menu item: &Translate English Word - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmwordtrans.html

O8 - Extra context menu item: Backward Links - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmbacklinks.html

O8 - Extra context menu item: Cached Snapshot of Page - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmcache.html

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE10\EXCEL.EXE/3000

O8 - Extra context menu item: Similar Pages - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmsimilar.html

O8 - Extra context menu item: Translate Page into English - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmtrans.html

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O20 - Winlogon Notify: !SASWinLogon - G:\SASWINLO.dll

O20 - Winlogon Notify: grxnofvn - C:\WINDOWS\SYSTEM32\grxnofvn.dll

O20 - Winlogon Notify: xxyvvut - C:\WINDOWS\SYSTEM32\xxyvvut.dll

O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\IA\command.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Microsoft cache control (MSControlService) - Unknown owner - C:\WINDOWS\system32\windows

O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: SDPAUMS server service (SDPASVC) - Matsushita Electric Industrial Co.,Ltd. - C:\WINDOWS\system32\sdpasvc.exe

--

End of file - 7330 bytes

Chesda · February 2008

o1darcie1o,

You are infected with Trojan.Vundo. This is a nasty virus to get rid of so my instructions may only temporary fix your computer.

Run Hijackthis, do a System Scan Only.

Check and fix the following entires:

O2 - BHO: (no name) - {45C2A50F-8F4A-496E-AF02-D0207525BF5A} - C:\WINDOWS\system32\xxyvvut.dll
O2 - BHO: (no name) - {5572363F-F2D9-41F5-8B4D-DE96E76FFDE7} - C:\Program Files\folder.js\cymawigu89104.dll (file missing)
O2 - BHO: (no name) - {87526773-6e7b-4187-8aa2-d1221f2213a9} - C:\WINDOWS\system32\gvrgyyw.dll
O2 - BHO: (no name) - {94E7FB49-508F-4BF5-B21B-273DB57B373A} - C:\Program Files\folder.js\cymawigu89104.dll (file missing)
O2 - BHO: (no name) - {A95B2816-1D7E-4561-A202-68C0DE02353A} - C:\WINDOWS\system32\grxnofvn.dll
O2 - BHO: (no name) - {C4C75055-666C-4065-81CB-F3F79CF52E4D} - C:\WINDOWS\system32\qopno.dll
O4 - HKLM\..\Run: [2863b2a6] rundll32.exe "C:\WINDOWS\system32\grfrfmxy.dll",b
O4 - HKLM\..\Run: [BM2b50813a] Rundll32.exe "C:\WINDOWS\system32\xlnerxff.dll",s
O4 - HKCU\..\Run: [WebBuying] C:\Program Files\Web Buying\v1.8.8\webbuying.exe
O20 - Winlogon Notify: grxnofvn - C:\WINDOWS\SYSTEM32\grxnofvn.dll
O20 - Winlogon Notify: xxyvvut - C:\WINDOWS\SYSTEM32\xxyvvut.dll

After you've fix these please download Atribune's VundoFix from this site:

http://www.atribune.org/ccount/click.php?id=4 and place it on your desktop.

Double-click

VundoFix.exe

to run it.

Click the

Scan

for Vundo button.

Once it's done scanning, click the Remove Vundo button.

You will receive a prompt asking if you want to remove the files,

click

YES

Once you click yes, your desktop will go blank as it starts removing

Vundo.

When completed, it will prompt that it will reboot your computer,

click

OK

.

Post a fresh Hijackthis log after you've done all the procedures mentioned above.

Best of luck.

o1darcie1o · February 2008

My post is showing up empty, so I'm trying to split it into a few:

This will be a HUGE post, as I've run a lot of scans, and don't know enough about all of this to know which lines can be removed from the listing to still give a complete picture...

The modem driver on the infected computer was uninstalled by something, so it's not connected to the internet. I'm working off a laptop to post, using a jump drive to transfer any programs and logs back & forth.

After my first post last night, I was given a program by a tech friend: Trend Micro Sysclean Package. This took what seemed like forever to run. I ran it from the flash drive (H:)

Sysclean Log2008-02-27, 19:29:55, Auto-clean mode specified.

2008-02-27, 19:29:55, Running scanner "H:\TSC.BIN"...

2008-02-27, 19:33:11, Scanner "H:\TSC.BIN" has finished running.

2008-02-27, 19:33:11, TSC Log:

2008-02-27, 19:35:00, An error was detected on "G:\System Volume Information\*.*": Access is denied.

2008-02-27, 20:57:53, Files Detected:

Report Date : 2/27/2008 19:35:03

VSAPI Engine Version : 8.000-1001

VSCANTM Version : 1.1-1001

Virus Pattern Version : 125 (243493 Patterns) (2008/02/26) (512500)

Command Line: H:\VSCANTM.BIN /NBPM /S /CLEANALL /DCEGENCLEAN /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 C:\*.* /P=H:

C:\WINDOWS\SYSTEM\msmsgs.exe [TROJ_ZLOB.GEN]

C:\WINDOWS\SYSTEM32\urqqolk.dll [Mal_Vundo-3]

C:\WINDOWS\SYSTEM32\ssqppno.dll [Mal_Vundo-3]

C:\WINDOWS\SYSTEM32\csatr.exe [TROJ_AGENT.VIX]

C:\WINDOWS\SYSTEM32\ogop.dll [TROJ_STARTPAG.SZ]

C:\WINDOWS\SYSTEM32\ax3\dincomsdll3.exe [TROJ_DLOADER.DTK]

C:\WINDOWS\SYSTEM32\ryyeidyb.dll [TROJ_VUNDO.YEK]

C:\WINDOWS\SYSTEM32\grxnofvn.dll [TROJ_VUNDO.YEK]

C:\WINDOWS\Downloaded Program Files\load.exe [TROJ_SMALL.ITN]

C:\WINDOWS\ac3_0018.exe [TROJ_DLOADER.BRG]

C:\WINDOWS\aff_0006.exe [TSPY_SOFTOMATE.A]

C:\WINDOWS\srvedruxqh.exe [TROJ_DYFUCA.AI]

C:\WINDOWS\uni_e6h.exe [TROJ_VB.VV]

C:\WINDOWS\uninst108.exe [TROJ_VB.BKB]

C:\System Volume Information\_restore{83AB1DBD-1764-458F-85AC-7FD4B0EFCBD8}\RP1\A0000016.exe [TROJ_DLOADER.HGW]

C:\System Volume Information\_restore{83AB1DBD-1764-458F-85AC-7FD4B0EFCBD8}\RP1\A0000017.exe [TROJ_DLOADER.HGW]

C:\System Volume Information\_restore{83AB1DBD-1764-458F-85AC-7FD4B0EFCBD8}\RP3\A0001022.exe [TROJ_AGENT.VIX]

C:\System Volume Information\_restore{83AB1DBD-1764-458F-85AC-7FD4B0EFCBD8}\RP3\A0001023.dll [TROJ_STARTPAG.SZ]

C:\System Volume Information\_restore{83AB1DBD-1764-458F-85AC-7FD4B0EFCBD8}\RP3\A0001024.exe [TROJ_DLOADER.DTK]

C:\System Volume Information\_restore{83AB1DBD-1764-458F-85AC-7FD4B0EFCBD8}\RP3\A0001025.dll [TROJ_VUNDO.YEK]

C:\System Volume Information\_restore{83AB1DBD-1764-458F-85AC-7FD4B0EFCBD8}\RP3\A0001026.exe [TROJ_DLOADER.BRG]

C:\System Volume Information\_restore{83AB1DBD-1764-458F-85AC-7FD4B0EFCBD8}\RP3\A0001027.exe [TSPY_SOFTOMATE.A]

C:\System Volume Information\_restore{83AB1DBD-1764-458F-85AC-7FD4B0EFCBD8}\RP3\A0001028.exe [TROJ_DYFUCA.AI]

C:\System Volume Information\_restore{83AB1DBD-1764-458F-85AC-7FD4B0EFCBD8}\RP3\A0001029.exe [TROJ_VB.VV]

C:\System Volume Information\_restore{83AB1DBD-1764-458F-85AC-7FD4B0EFCBD8}\RP3\A0001030.exe [TROJ_VB.BKB]

C:\ms32.sys [TROJ_SMALL.FES]

83079 files have been read.

83079 files have been checked.

73315 files have been scanned.

103663 files have been scanned. (including files in archived)

26 files containing viruses.

Found 26 viruses totally.

Maybe 0 viruses totally.

Stop At : 2/27/2008 20:57:51

---------*---------*---------*---------*---------*---------*---------*---------*

2008-02-27, 20:57:53, Files Clean:

Report Date : 2/27/2008 19:35:03

VSAPI Engine Version : 8.000-1001

VSCANTM Version : 1.1-1001

Virus Pattern Version : 125 (243493 Patterns) (2008/02/26) (512500)

Command Line: H:\VSCANTM.BIN /NBPM /S /CLEANALL /DCEGENCLEAN /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 C:\*.* /P=H:

Success Clean [ TROJ_AGENT.VIX]( 1) from C:\WINDOWS\SYSTEM32\csatr.exe

Success Clean [TROJ_STARTPAG.SZ]( 1) from C:\WINDOWS\SYSTEM32\ogop.dll

Success Clean [TROJ_DLOADER.DTK]( 1) from C:\WINDOWS\SYSTEM32\ax3\dincomsdll3.exe

Success Clean [ TROJ_VUNDO.YEK]( 1) from C:\WINDOWS\SYSTEM32\ryyeidyb.dll

Success Clean [ TROJ_SMALL.ITN]( 1) from C:\WINDOWS\Downloaded Program Files\load.exe

Success Clean [TROJ_DLOADER.BRG]( 1) from C:\WINDOWS\ac3_0018.exe

Success Clean [TSPY_SOFTOMATE.A]( 1) from C:\WINDOWS\aff_0006.exe

Success Clean [ TROJ_DYFUCA.AI]( 1) from C:\WINDOWS\srvedruxqh.exe

Success Clean [ TROJ_VB.VV]( 1) from C:\WINDOWS\uni_e6h.exe

Success Clean [ TROJ_VB.BKB]( 1) from C:\WINDOWS\uninst108.exe

Success Clean [TROJ_DLOADER.HGW]( 1) from C:\System Volume Information\_restore{83AB1DBD-1764-458F-85AC-7FD4B0EFCBD8}\RP1\A0000016.exe

Success Clean [TROJ_DLOADER.HGW]( 1) from C:\System Volume Information\_restore{83AB1DBD-1764-458F-85AC-7FD4B0EFCBD8}\RP1\A0000017.exe

Success Clean [ TROJ_AGENT.VIX]( 1) from C:\System Volume Information\_restore{83AB1DBD-1764-458F-85AC-7FD4B0EFCBD8}\RP3\A0001022.exe

Success Clean [TROJ_STARTPAG.SZ]( 1) from C:\System Volume Information\_restore{83AB1DBD-1764-458F-85AC-7FD4B0EFCBD8}\RP3\A0001023.dll

Success Clean [TROJ_DLOADER.DTK]( 1) from C:\System Volume Information\_restore{83AB1DBD-1764-458F-85AC-7FD4B0EFCBD8}\RP3\A0001024.exe

Success Clean [ TROJ_VUNDO.YEK]( 1) from C:\System Volume Information\_restore{83AB1DBD-1764-458F-85AC-7FD4B0EFCBD8}\RP3\A0001025.dll

Success Clean [TROJ_DLOADER.BRG]( 1) from C:\System Volume Information\_restore{83AB1DBD-1764-458F-85AC-7FD4B0EFCBD8}\RP3\A0001026.exe

Success Clean [TSPY_SOFTOMATE.A]( 1) from C:\System Volume Information\_restore{83AB1DBD-1764-458F-85AC-7FD4B0EFCBD8}\RP3\A0001027.exe

Success Clean [ TROJ_DYFUCA.AI]( 1) from C:\System Volume Information\_restore{83AB1DBD-1764-458F-85AC-7FD4B0EFCBD8}\RP3\A0001028.exe

Success Clean [ TROJ_VB.VV]( 1) from C:\System Volume Information\_restore{83AB1DBD-1764-458F-85AC-7FD4B0EFCBD8}\RP3\A0001029.exe

Success Clean [ TROJ_VB.BKB]( 1) from C:\System Volume Information\_restore{83AB1DBD-1764-458F-85AC-7FD4B0EFCBD8}\RP3\A0001030.exe

Success Clean [ TROJ_SMALL.FES]( 1) from C:\ms32.sys

83079 files have been read.

83079 files have been checked.

73315 files have been scanned.

103663 files have been scanned. (including files in archived)

26 files containing viruses.

Found 26 viruses totally.

Maybe 0 viruses totally.

Stop At : 2/27/2008 20:57:51 1 hour 22 minutes 23 seconds (4943.02 seconds) has elapsed.

---------*---------*---------*---------*---------*---------*---------*---------*

2008-02-27, 20:57:53, Clean Fail:

Report Date : 2/27/2008 19:35:03

VSAPI Engine Version : 8.000-1001

VSCANTM Version : 1.1-1001

Virus Pattern Version : 125 (243493 Patterns) (2008/02/26) (512500)

Command Line: H:\VSCANTM.BIN /NBPM /S /CLEANALL /DCEGENCLEAN /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 C:\*.* /P=H:

83079 files have been read.

83079 files have been checked.

73315 files have been scanned.

103663 files have been scanned. (including files in archived)

26 files containing viruses.

Found 26 viruses totally.

Maybe 0 viruses totally.

Stop At : 2/27/2008 20:57:51 1 hour 22 minutes 23 seconds (4943.02 seconds) has elapsed.

---------*---------*---------*---------*---------*---------*---------*---------*

2008-02-27, 20:57:53, Scanner "H:\VSCANTM.BIN" has finished running.

2008-02-27, 21:12:41, Files Detected:

Report Date : 2/27/2008 20:58:04

VSAPI Engine Version : 8.000-1001

VSCANTM Version : 1.1-1001

Virus Pattern Version : 125 (243493 Patterns) (2008/02/26) (512500)

Command Line: H:\VSCANTM.BIN /NBPM /S /CLEANALL /DCEGENCLEAN /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 \*.* /P=H:

26914 files have been read.

26914 files have been checked.

22826 files have been scanned.

52874 files have been scanned. (including files in archived)

0 files containing viruses.

Found 0 viruses totally.

Maybe 0 viruses totally.

Stop At : 2/27/2008 21:12:39

---------*---------*---------*---------*---------*---------*---------*---------*

2008-02-27, 21:12:42, Files Clean:

Report Date : 2/27/2008 20:58:04

VSAPI Engine Version : 8.000-1001

VSCANTM Version : 1.1-1001

Virus Pattern Version : 125 (243493 Patterns) (2008/02/26) (512500)

Command Line: H:\VSCANTM.BIN /NBPM /S /CLEANALL /DCEGENCLEAN /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 \*.* /P=H:

26914 files have been read.

26914 files have been checked.

22826 files have been scanned.

52874 files have been scanned. (including files in archived)

0 files containing viruses.

Found 0 viruses totally.

Maybe 0 viruses totally.

Stop At : 2/27/2008 21:12:39 14 minutes 17 seconds (857.15 seconds) has elapsed.

---------*---------*---------*---------*---------*---------*---------*---------*

2008-02-27, 21:12:42, Clean Fail:

Report Date : 2/27/2008 20:58:04

VSAPI Engine Version : 8.000-1001

VSCANTM Version : 1.1-1001

Virus Pattern Version : 125 (243493 Patterns) (2008/02/26) (512500)

Command Line: H:\VSCANTM.BIN /NBPM /S /CLEANALL /DCEGENCLEAN /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 \*.* /P=H:

26914 files have been read.

26914 files have been checked.

22826 files have been scanned.

52874 files have been scanned. (including files in archived)

0 files containing viruses.

Found 0 viruses totally.

Maybe 0 viruses totally.

Stop At : 2/27/2008 21:12:39 14 minutes 17 seconds (857.15 seconds) has elapsed.

---------*---------*---------*---------*---------*---------*---------*---------*

2008-02-27, 21:12:42, Scanner "H:\VSCANTM.BIN" has finished running.

2008-02-27, 21:14:59, Files Detected:

Report Date : 2/27/2008 21:12:56

VSAPI Engine Version : 8.000-1001

VSCANTM Version : 1.1-1001

Virus Pattern Version : 125 (243493 Patterns) (2008/02/26) (512500)

Command Line: H:\VSCANTM.BIN /NBPM /S /CLEANALL /DCEGENCLEAN /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 E:\*.* /P=H:

2516 files have been read.

2516 files have been checked.

1473 files have been scanned.

9402 files have been scanned. (including files in archived)

0 files containing viruses.

Found 0 viruses totally.

Maybe 0 viruses totally.

Stop At : 2/27/2008 21:14:58

---------*---------*---------*---------*---------*---------*---------*---------*

2008-02-27, 21:14:59, Files Clean:

Report Date : 2/27/2008 21:12:56

VSAPI Engine Version : 8.000-1001

VSCANTM Version : 1.1-1001

Virus Pattern Version : 125 (243493 Patterns) (2008/02/26) (512500)

Command Line: H:\VSCANTM.BIN /NBPM /S /CLEANALL /DCEGENCLEAN /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 E:\*.* /P=H:

2516 files have been read.

2516 files have been checked.

1473 files have been scanned.

9402 files have been scanned. (including files in archived)

0 files containing viruses.

Found 0 viruses totally.

Maybe 0 viruses totally.

Stop At : 2/27/2008 21:14:58 1 minute 47 seconds (106.96 seconds) has elapsed.

---------*---------*---------*---------*---------*---------*---------*---------*

2008-02-27, 21:14:59, Clean Fail:

Report Date : 2/27/2008 21:12:56

VSAPI Engine Version : 8.000-1001

VSCANTM Version : 1.1-1001

Virus Pattern Version : 125 (243493 Patterns) (2008/02/26) (512500)

Command Line: H:\VSCANTM.BIN /NBPM /S /CLEANALL /DCEGENCLEAN /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 E:\*.* /P=H:

2516 files have been read.

2516 files have been checked.

1473 files have been scanned.

9402 files have been scanned. (including files in archived)

0 files containing viruses.

Found 0 viruses totally.

Maybe 0 viruses totally.

Stop At : 2/27/2008 21:14:58 1 minute 47 seconds (106.96 seconds) has elapsed.

---------*---------*---------*---------*---------*---------*---------*---------*

2008-02-27, 21:14:59, Scanner "H:\VSCANTM.BIN" has finished running.

2008-02-27, 21:15:30, Files Detected:

Report Date : 2/27/2008 21:15:17

VSAPI Engine Version : 8.000-1001

VSCANTM Version : 1.1-1001

Virus Pattern Version : 125 (243493 Patterns) (2008/02/26) (512500)

Command Line: H:\VSCANTM.BIN /NBPM /S /CLEANALL /DCEGENCLEAN /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 F:\*.* /P=H:

10 files have been read.

10 files have been checked.

9 files have been scanned.

9 files have been scanned. (including files in archived)

0 files containing viruses.

Found 0 viruses totally.

Maybe 0 viruses totally.

Stop At : 2/27/2008 21:15:30

---------*---------*---------*---------*---------*---------*---------*---------*

2008-02-27, 21:15:30, Files Clean:

Report Date : 2/27/2008 21:15:16

VSAPI Engine Version : 8.000-1001

VSCANTM Version : 1.1-1001

Virus Pattern Version : 125 (243493 Patterns) (2008/02/26) (512500)

Command Line: H:\VSCANTM.BIN /NBPM /S /CLEANALL /DCEGENCLEAN /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 F:\*.* /P=H:

10 files have been read.

10 files have been checked.

9 files have been scanned.

9 files have been scanned. (including files in archived)

0 files containing viruses.

Found 0 viruses totally.

Maybe 0 viruses totally.

Stop At : 2/27/2008 21:15:30 1 second (0.59 seconds) has elapsed.

---------*---------*---------*---------*---------*---------*---------*---------*

2008-02-27, 21:15:30, Clean Fail:

Report Date : 2/27/2008 21:15:17

VSAPI Engine Version : 8.000-1001

VSCANTM Version : 1.1-1001

Virus Pattern Version : 125 (243493 Patterns) (2008/02/26) (512500)

Command Line: H:\VSCANTM.BIN /NBPM /S /CLEANALL /DCEGENCLEAN /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 F:\*.* /P=H:

10 files have been read.

10 files have been checked.

9 files have been scanned.

9 files have been scanned. (including files in archived)

0 files containing viruses.

Found 0 viruses totally.

Maybe 0 viruses totally.

Stop At : 2/27/2008 21:15:30 1 second (0.59 seconds) has elapsed.

---------*---------*---------*---------*---------*---------*---------*---------*

2008-02-27, 21:15:30, Scanner "H:\VSCANTM.BIN" has finished running.

2008-02-27, 21:17:34, Files Detected:

Report Date : 2/27/2008 21:15:39

VSAPI Engine Version : 8.000-1001

VSCANTM Version : 1.1-1001

Virus Pattern Version : 125 (243493 Patterns) (2008/02/26) (512500)

Command Line: H:\VSCANTM.BIN /NBPM /S /CLEANALL /DCEGENCLEAN /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 G:\*.* /P=H:

3729 files have been read.

3729 files have been checked.

3412 files have been scanned.

3413 files have been scanned. (including files in archived)

0 files containing viruses.

Found 0 viruses totally.

Maybe 0 viruses totally.

Stop At : 2/27/2008 21:17:31

---------*---------*---------*---------*---------*---------*---------*---------*

2008-02-27, 21:17:35, Files Clean:

Report Date : 2/27/2008 21:15:39

VSAPI Engine Version : 8.000-1001

VSCANTM Version : 1.1-1001

Virus Pattern Version : 125 (243493 Patterns) (2008/02/26) (512500)

Command Line: H:\VSCANTM.BIN /NBPM /S /CLEANALL /DCEGENCLEAN /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 G:\*.* /P=H:

3729 files have been read.

3729 files have been checked.

3412 files have been scanned.

3413 files have been scanned. (including files in archived)

0 files containing viruses.

Found 0 viruses totally.

Maybe 0 viruses totally.

Stop At : 2/27/2008 21:17:31 1 minute 45 seconds (105.82 seconds) has elapsed.

---------*---------*---------*---------*---------*---------*---------*---------*

2008-02-27, 21:17:35, Clean Fail:

Report Date : 2/27/2008 21:15:39

VSAPI Engine Version : 8.000-1001

VSCANTM Version : 1.1-1001

Virus Pattern Version : 125 (243493 Patterns) (2008/02/26) (512500)

Command Line: H:\VSCANTM.BIN /NBPM /S /CLEANALL /DCEGENCLEAN /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 G:\*.* /P=H:

3729 files have been read.

3729 files have been checked.

3412 files have been scanned.

3413 files have been scanned. (including files in archived)

0 files containing viruses.

Found 0 viruses totally.

Maybe 0 viruses totally.

Stop At : 2/27/2008 21:17:31 1 minute 45 seconds (105.82 seconds) has elapsed.

---------*---------*---------*---------*---------*---------*---------*---------*

2008-02-27, 21:17:35, Scanner "H:\VSCANTM.BIN" has finished running.

Then we went to bed & ran HiJack first thing this morning.

HJT Log 5:14AM, 2-28-08

Logfile of Trend Micro HijackThis v2.0.0 (BETA)

Scan saved at 5:34:46 AM, on 2/28/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\WINDOWS\system32\cisvc.exe

C:\WINDOWS\IA\command.exe

C:\Program Files\Network Monitor\netmon.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\WINDOWS\system32\sdpasvc.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\MsPMSPSv.exe

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

E:\iTunes\iTunesHelper.exe

C:\WINDOWS\Fonts\svchost.exe

C:\WINDOWS\system32\rundll32.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\System32\alg.exe

C:\Program Files\Messenger\msmsgs.exe

\Palm\Hotsync.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\system32\cidaemon.exe

C:\WINDOWS\system32\windows

C:\WINDOWS\explorer.exe

C:\Documents and Settings\Windows User\Desktop\moon.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www6.comcast.net/a/

O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 8\SnagItBHO.dll

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: RabioBHO - {1C2E5D27-A17C-4D89-85DD-3553C189380D} - C:\Program Files\RABCO\RABCO.dll

O2 - BHO: (no name) - {377C2660-3320-4CCB-917B-6671A3E55888} - C:\WINDOWS\system32\qopno.dll

O2 - BHO: (no name) - {45C2A50F-8F4A-496E-AF02-D0207525BF5A} - C:\WINDOWS\system32\xxyvvut.dll

O2 - BHO: (no name) - {5572363F-F2D9-41F5-8B4D-DE96E76FFDE7} - (no file)

O2 - BHO: (no name) - {87526773-6e7b-4187-8aa2-d1221f2213a9} - C:\WINDOWS\system32\gvrgyyw.dll

O2 - BHO: (no name) - {94E7FB49-508F-4BF5-B21B-273DB57B373A} - (no file)