Winfixer has invaded my computer... HELP!!

Unknown
edited March 2006 in Spyware & Virus Removal
Hi,

I've tried everything to get rid of WINFIXER... however nothing has worked so far.... please see below my HijackThis log:

Logfile of HijackThis v1.99.1
Scan saved at 1:53:52 PM, on 3/17/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\Program Files\CA\eTrust Antivirus\InoRpc.exe
C:\Program Files\CA\eTrust Antivirus\InoRT.exe
C:\Program Files\CA\eTrust Antivirus\InoTask.exe
C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\CASIO\Photo Loader\Plauto.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\Kendra\LOCALS~1\Temp\Rar$EX00.703\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R3 - URLSearchHook: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {912B6D25-8069-0D93-8E67-A84F4A06AA82} - C:\PROGRA~1\flawroad\dvdphone.exe (file missing)
O2 - BHO: ATLDistrib Object - {93C6313C-9DB4-4694-8BD0-E378C573A9AD} - C:\WINDOWS\system32\jkklm.dll
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.lnk.disabled
O4 - Global Startup: Adobe Reader Speed Launch.lnk.disabled
O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\E_SRCV02.EXE
O4 - Global Startup: logon.bat
O4 - Global Startup: Photo Loader supervisory.lnk = C:\Program Files\CASIO\Photo Loader\Plauto.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=48835
O16 - DPF: {2253F320-AB68-4A07-917D-4F12D8884A06} (ChainCast VMR Client Proxy) - http://www.streamaudio.com/download/ccpm_0237.cab
O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://www.pestscan.com/scanner/axscanner.cab
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - http://www.live365.com/players/play365.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: jkklm - C:\WINDOWS\system32\jkklm.dll
O20 - Winlogon Notify: pmnnk - C:\WINDOWS\system32\pmnnk.dll (file missing)
O23 - Service: CA License Client (CA_LIC_CLNT) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe
O23 - Service: CA License Server (CA_LIC_SRVR) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmtd.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: eTrust Antivirus RPC Server (InoRPC) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRpc.exe
O23 - Service: eTrust Antivirus Realtime Server (InoRT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRT.exe
O23 - Service: eTrust Antivirus Job Server (InoTask) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoTask.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Event Log Watch (LogWatch) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe


.... I really appreciate your help on this!!!

Wizard ^__^

Comments

  • TroganTrogan London, UK
    edited March 2006
    Hi, Welcome to Short-Media :)

    Before we remove that nasty infection, you need to move HJT to a permanent location such as your C: or desktop. Its currently in your temp folder and thats never a good place to put HijackThis. However, you can do the following which will automatically put HJT into the right folder.

    Click here to download HJTsetup.exe
    Save HJTsetup.exe to your desktop.
    • Double click on the HJTsetup.exe icon on your desktop.
    • By default it will install to C:\Program Files\Hijack This.
    • Continue to click Next in the setup dialogue boxes until you get to the "Select Addition Tasks" dialogue.
    • Put a check by Create a desktop icon then click Next again.
    • Continue to follow the rest of the prompts from there.
    • At the final dialogue box click Finish and it will launch Hijack This.
    • Exit for now
    DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required.
    ==========

    To remove WinFixer, please do the following:

    Download VundoFix.exe to your desktop.
    • Double-click VundoFix.exe to run it.
    • Click the Scan for Vundo button.
    • Once it's done scanning, click the Remove Vundo button.
    • You will receive a prompt asking if you want to remove the files, click YES
    • Once you click yes, your desktop will go blank as it starts removing Vundo.
    • When completed, it will prompt that it will shutdown your computer, click OK.
    • Turn your computer back on.
    • Please post the contents of C:\vundofix.txt and a new HiJackThis log.
  • Wizard
    edited March 2006
    Thank you for your help Trogan_1000

    Here is my Vundofix.txt

    VundoFix V4.2.34

    Checking Java version...

    Scan started at 1:44:33 PM 3/17/2006

    Listing files found while scanning....

    C:\WINDOWS\system32\jkklm.dll
    C:\WINDOWS\system32\mlkkj.ini
    C:\WINDOWS\system32\mlkkj.bak1
    C:\WINDOWS\system32\mlkkj.bak2
    C:\WINDOWS\system32\mlkkj.ini2
    C:\WINDOWS\system32\mlkkj.tmp

    C:\WINDOWS\SYSTEM32\knnmp.bak1
    C:\WINDOWS\SYSTEM32\knnmp.bak2
    C:\WINDOWS\SYSTEM32\knnmp.tmp
    C:\WINDOWS\SYSTEM32\knnmp.ini
    C:\WINDOWS\SYSTEM32\knnmp.ini2
    C:\WINDOWS\SYSTEM32\mlkkj.bak1
    C:\WINDOWS\SYSTEM32\mlkkj.bak2
    C:\WINDOWS\SYSTEM32\mlkkj.tmp
    C:\WINDOWS\SYSTEM32\mlkkj.ini
    C:\WINDOWS\SYSTEM32\mlkkj.ini2
    C:\WINDOWS\SYSTEM32\jkklm.dll
    C:\WINDOWS\SYSTEM32\knnmp.ini2
    C:\WINDOWS\SYSTEM32\knnmp.bak2
    C:\WINDOWS\SYSTEM32\knnmp.tmp
    C:\WINDOWS\SYSTEM32\knnmp.ini
    C:\WINDOWS\SYSTEM32\knnmp.ini2
    C:\WINDOWS\SYSTEM32\mlkkj.ini2
    C:\WINDOWS\SYSTEM32\mlkkj.bak2
    C:\WINDOWS\SYSTEM32\mlkkj.tmp
    C:\WINDOWS\SYSTEM32\mlkkj.ini
    C:\WINDOWS\SYSTEM32\mlkkj.ini2
    C:\WINDOWS\SYSTEM32\jkklm.dll
    Attempting to delete C:\WINDOWS\system32\jkklm.dll
    C:\WINDOWS\system32\jkklm.dll Could not be deleted.

    Attempting to delete C:\WINDOWS\system32\mlkkj.ini
    C:\WINDOWS\system32\mlkkj.ini Has been deleted!

    Attempting to delete C:\WINDOWS\system32\mlkkj.bak1
    C:\WINDOWS\system32\mlkkj.bak1 Has been deleted!

    Attempting to delete C:\WINDOWS\system32\mlkkj.bak2
    C:\WINDOWS\system32\mlkkj.bak2 Has been deleted!

    Attempting to delete C:\WINDOWS\system32\mlkkj.ini2
    C:\WINDOWS\system32\mlkkj.ini2 Has been deleted!

    Attempting to delete C:\WINDOWS\system32\mlkkj.tmp
    C:\WINDOWS\system32\mlkkj.tmp Has been deleted!

    Attempting to delete C:\WINDOWS\SYSTEM32\knnmp.bak1
    C:\WINDOWS\SYSTEM32\knnmp.bak1 Has been deleted!

    Attempting to delete C:\WINDOWS\SYSTEM32\knnmp.bak2
    C:\WINDOWS\SYSTEM32\knnmp.bak2 Has been deleted!

    Attempting to delete C:\WINDOWS\SYSTEM32\knnmp.tmp
    C:\WINDOWS\SYSTEM32\knnmp.tmp Has been deleted!

    Attempting to delete C:\WINDOWS\SYSTEM32\knnmp.ini
    C:\WINDOWS\SYSTEM32\knnmp.ini Has been deleted!

    Attempting to delete C:\WINDOWS\SYSTEM32\knnmp.ini2
    C:\WINDOWS\SYSTEM32\knnmp.ini2 Has been deleted!

    Attempting to delete C:\WINDOWS\SYSTEM32\jkklm.dll
    C:\WINDOWS\SYSTEM32\jkklm.dll Could not be deleted.

    Attempting to delete C:\WINDOWS\SYSTEM32\jkklm.dll
    C:\WINDOWS\SYSTEM32\jkklm.dll Could not be deleted.

    Performing Repairs to the registry.
    Done!

    VundoFix V4.2.34

    Checking Java version...

    Scan started at 2:39:02 PM 3/17/2006

    Listing files found while scanning....

    C:\WINDOWS\system32\jkklm.dll
    C:\WINDOWS\system32\mlkkj.ini
    C:\WINDOWS\system32\mlkkj.ini2

    C:\WINDOWS\SYSTEM32\mlkkj.ini2
    C:\WINDOWS\SYSTEM32\mlkkj.ini
    C:\WINDOWS\SYSTEM32\mlkkj.ini2
    C:\WINDOWS\SYSTEM32\jkklm.dll
    Attempting to delete C:\WINDOWS\system32\jkklm.dll
    C:\WINDOWS\system32\jkklm.dll Could not be deleted.

    Attempting to delete C:\WINDOWS\system32\mlkkj.ini
    C:\WINDOWS\system32\mlkkj.ini Has been deleted!

    Attempting to delete C:\WINDOWS\system32\mlkkj.ini2
    C:\WINDOWS\system32\mlkkj.ini2 Has been deleted!

    Attempting to delete C:\WINDOWS\SYSTEM32\jkklm.dll
    C:\WINDOWS\SYSTEM32\jkklm.dll Could not be deleted.

    Performing Repairs to the registry.
    Done!




    This is my new HijackThis log

    Logfile of HijackThis v1.99.1
    Scan saved at 2:48:17 PM, on 3/17/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
    C:\Program Files\CA\eTrust Antivirus\InoRpc.exe
    C:\Program Files\CA\eTrust Antivirus\InoRT.exe
    C:\Program Files\CA\eTrust Antivirus\InoTask.exe
    C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\dla\tfswctrl.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\CASIO\Photo Loader\Plauto.exe
    C:\PROGRA~1\MICROS~2\OFFICE11\OUTLOOK.EXE
    C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Hijackthis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    R3 - URLSearchHook: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - (no file)
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {912B6D25-8069-0D93-8E67-A84F4A06AA82} - C:\PROGRA~1\flawroad\dvdphone.exe (file missing)
    O2 - BHO: ATLDistrib Object - {93C6313C-9DB4-4694-8BD0-E378C573A9AD} - C:\WINDOWS\system32\jkklm.dll
    O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - Global Startup: Adobe Gamma Loader.lnk.disabled
    O4 - Global Startup: Adobe Reader Speed Launch.lnk.disabled
    O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\E_SRCV02.EXE
    O4 - Global Startup: logon.bat
    O4 - Global Startup: Photo Loader supervisory.lnk = C:\Program Files\CASIO\Photo Loader\Plauto.exe
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
    O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=48835
    O16 - DPF: {2253F320-AB68-4A07-917D-4F12D8884A06} (ChainCast VMR Client Proxy) - http://www.streamaudio.com/download/ccpm_0237.cab
    O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://www.pestscan.com/scanner/axscanner.cab
    O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
    O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - http://www.live365.com/players/play365.cab
    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
    O20 - Winlogon Notify: jkklm - C:\WINDOWS\system32\jkklm.dll
    O20 - Winlogon Notify: pmnnk - C:\WINDOWS\system32\pmnnk.dll (file missing)
    O23 - Service: CA License Client (CA_LIC_CLNT) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe
    O23 - Service: CA License Server (CA_LIC_SRVR) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmtd.exe
    O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: eTrust Antivirus RPC Server (InoRPC) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRpc.exe
    O23 - Service: eTrust Antivirus Realtime Server (InoRT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRT.exe
    O23 - Service: eTrust Antivirus Job Server (InoTask) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoTask.exe
    O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Event Log Watch (LogWatch) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe


    THANK YOU!!!
  • TroganTrogan London, UK
    edited March 2006
    Could you run VundoFix again but this time in Safe Mode. Save a new log file please.

    Reboot back into Normal Mode and post a new HJT log and the Vundo txt. :)
  • Wizard
    edited March 2006
    Hi,

    Sorry for not posting the logs earlier, but I've been really busy here. I run VundoFix in safe mode and below is the log:


    VundoFix V4.2.34

    Checking Java version...

    Scan started at 1:44:33 PM 3/17/2006

    Listing files found while scanning....

    C:\WINDOWS\system32\jkklm.dll
    C:\WINDOWS\system32\mlkkj.ini
    C:\WINDOWS\system32\mlkkj.bak1
    C:\WINDOWS\system32\mlkkj.bak2
    C:\WINDOWS\system32\mlkkj.ini2
    C:\WINDOWS\system32\mlkkj.tmp

    C:\WINDOWS\SYSTEM32\knnmp.bak1
    C:\WINDOWS\SYSTEM32\knnmp.bak2
    C:\WINDOWS\SYSTEM32\knnmp.tmp
    C:\WINDOWS\SYSTEM32\knnmp.ini
    C:\WINDOWS\SYSTEM32\knnmp.ini2
    C:\WINDOWS\SYSTEM32\mlkkj.bak1
    C:\WINDOWS\SYSTEM32\mlkkj.bak2
    C:\WINDOWS\SYSTEM32\mlkkj.tmp
    C:\WINDOWS\SYSTEM32\mlkkj.ini
    C:\WINDOWS\SYSTEM32\mlkkj.ini2
    C:\WINDOWS\SYSTEM32\jkklm.dll
    C:\WINDOWS\SYSTEM32\knnmp.ini2
    C:\WINDOWS\SYSTEM32\knnmp.bak2
    C:\WINDOWS\SYSTEM32\knnmp.tmp
    C:\WINDOWS\SYSTEM32\knnmp.ini
    C:\WINDOWS\SYSTEM32\knnmp.ini2
    C:\WINDOWS\SYSTEM32\mlkkj.ini2
    C:\WINDOWS\SYSTEM32\mlkkj.bak2
    C:\WINDOWS\SYSTEM32\mlkkj.tmp
    C:\WINDOWS\SYSTEM32\mlkkj.ini
    C:\WINDOWS\SYSTEM32\mlkkj.ini2
    C:\WINDOWS\SYSTEM32\jkklm.dll
    Attempting to delete C:\WINDOWS\system32\jkklm.dll
    C:\WINDOWS\system32\jkklm.dll Could not be deleted.

    Attempting to delete C:\WINDOWS\system32\mlkkj.ini
    C:\WINDOWS\system32\mlkkj.ini Has been deleted!

    Attempting to delete C:\WINDOWS\system32\mlkkj.bak1
    C:\WINDOWS\system32\mlkkj.bak1 Has been deleted!

    Attempting to delete C:\WINDOWS\system32\mlkkj.bak2
    C:\WINDOWS\system32\mlkkj.bak2 Has been deleted!

    Attempting to delete C:\WINDOWS\system32\mlkkj.ini2
    C:\WINDOWS\system32\mlkkj.ini2 Has been deleted!

    Attempting to delete C:\WINDOWS\system32\mlkkj.tmp
    C:\WINDOWS\system32\mlkkj.tmp Has been deleted!

    Attempting to delete C:\WINDOWS\SYSTEM32\knnmp.bak1
    C:\WINDOWS\SYSTEM32\knnmp.bak1 Has been deleted!

    Attempting to delete C:\WINDOWS\SYSTEM32\knnmp.bak2
    C:\WINDOWS\SYSTEM32\knnmp.bak2 Has been deleted!

    Attempting to delete C:\WINDOWS\SYSTEM32\knnmp.tmp
    C:\WINDOWS\SYSTEM32\knnmp.tmp Has been deleted!

    Attempting to delete C:\WINDOWS\SYSTEM32\knnmp.ini
    C:\WINDOWS\SYSTEM32\knnmp.ini Has been deleted!

    Attempting to delete C:\WINDOWS\SYSTEM32\knnmp.ini2
    C:\WINDOWS\SYSTEM32\knnmp.ini2 Has been deleted!

    Attempting to delete C:\WINDOWS\SYSTEM32\jkklm.dll
    C:\WINDOWS\SYSTEM32\jkklm.dll Could not be deleted.

    Attempting to delete C:\WINDOWS\SYSTEM32\jkklm.dll
    C:\WINDOWS\SYSTEM32\jkklm.dll Could not be deleted.

    Performing Repairs to the registry.
    Done!

    VundoFix V4.2.34

    Checking Java version...

    Scan started at 2:39:02 PM 3/17/2006

    Listing files found while scanning....

    C:\WINDOWS\system32\jkklm.dll
    C:\WINDOWS\system32\mlkkj.ini
    C:\WINDOWS\system32\mlkkj.ini2

    C:\WINDOWS\SYSTEM32\mlkkj.ini2
    C:\WINDOWS\SYSTEM32\mlkkj.ini
    C:\WINDOWS\SYSTEM32\mlkkj.ini2
    C:\WINDOWS\SYSTEM32\jkklm.dll
    Attempting to delete C:\WINDOWS\system32\jkklm.dll
    C:\WINDOWS\system32\jkklm.dll Could not be deleted.

    Attempting to delete C:\WINDOWS\system32\mlkkj.ini
    C:\WINDOWS\system32\mlkkj.ini Has been deleted!

    Attempting to delete C:\WINDOWS\system32\mlkkj.ini2
    C:\WINDOWS\system32\mlkkj.ini2 Has been deleted!

    Attempting to delete C:\WINDOWS\SYSTEM32\jkklm.dll
    C:\WINDOWS\SYSTEM32\jkklm.dll Could not be deleted.

    Performing Repairs to the registry.
    Done!

    VundoFix V4.2.34

    Checking Java version...

    Scan started at 2:02:00 PM 3/20/2006

    Listing files found while scanning....

    C:\WINDOWS\system32\jkklm.dll
    C:\WINDOWS\system32\mlkkj.ini
    C:\WINDOWS\system32\mlkkj.bak1
    C:\WINDOWS\system32\mlkkj.bak2

    C:\WINDOWS\SYSTEM32\mlkkj.bak1
    C:\WINDOWS\SYSTEM32\mlkkj.bak2
    C:\WINDOWS\SYSTEM32\mlkkj.ini
    C:\WINDOWS\SYSTEM32\jkklm.dll
    Attempting to delete C:\WINDOWS\system32\jkklm.dll
    C:\WINDOWS\system32\jkklm.dll Could not be deleted.

    Attempting to delete C:\WINDOWS\system32\mlkkj.ini
    C:\WINDOWS\system32\mlkkj.ini Has been deleted!

    Attempting to delete C:\WINDOWS\system32\mlkkj.bak1
    C:\WINDOWS\system32\mlkkj.bak1 Has been deleted!

    Attempting to delete C:\WINDOWS\system32\mlkkj.bak2
    C:\WINDOWS\system32\mlkkj.bak2 Has been deleted!

    Attempting to delete C:\WINDOWS\SYSTEM32\jkklm.dll
    C:\WINDOWS\SYSTEM32\jkklm.dll Could not be deleted.

    Performing Repairs to the registry.
    Done!


    This is the log from HijackThis:

    Logfile of HijackThis v1.99.1
    Scan saved at 2:10:34 PM, on 3/20/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
    C:\Program Files\CA\eTrust Antivirus\InoRpc.exe
    C:\Program Files\CA\eTrust Antivirus\InoRT.exe
    C:\Program Files\CA\eTrust Antivirus\InoTask.exe
    C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\dla\tfswctrl.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\CASIO\Photo Loader\Plauto.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Hijackthis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    R3 - URLSearchHook: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - (no file)
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {912B6D25-8069-0D93-8E67-A84F4A06AA82} - C:\PROGRA~1\flawroad\dvdphone.exe (file missing)
    O2 - BHO: ATLDistrib Object - {93C6313C-9DB4-4694-8BD0-E378C573A9AD} - C:\WINDOWS\system32\jkklm.dll
    O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - Global Startup: Adobe Gamma Loader.lnk.disabled
    O4 - Global Startup: Adobe Reader Speed Launch.lnk.disabled
    O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\E_SRCV02.EXE
    O4 - Global Startup: logon.bat
    O4 - Global Startup: Photo Loader supervisory.lnk = C:\Program Files\CASIO\Photo Loader\Plauto.exe
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
    O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=48835
    O16 - DPF: {2253F320-AB68-4A07-917D-4F12D8884A06} (ChainCast VMR Client Proxy) - http://www.streamaudio.com/download/ccpm_0237.cab
    O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://www.pestscan.com/scanner/axscanner.cab
    O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
    O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - http://www.live365.com/players/play365.cab
    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
    O20 - Winlogon Notify: jkklm - C:\WINDOWS\system32\jkklm.dll
    O20 - Winlogon Notify: pmnnk - C:\WINDOWS\system32\pmnnk.dll (file missing)
    O23 - Service: CA License Client (CA_LIC_CLNT) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe
    O23 - Service: CA License Server (CA_LIC_SRVR) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmtd.exe
    O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: eTrust Antivirus RPC Server (InoRPC) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRpc.exe
    O23 - Service: eTrust Antivirus Realtime Server (InoRT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRT.exe
    O23 - Service: eTrust Antivirus Job Server (InoTask) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoTask.exe
    O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Event Log Watch (LogWatch) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe




    Thank you again for all your help!!!!

    Wizard ^__^
  • TroganTrogan London, UK
    edited March 2006
    Could you open the VundoFix tool and tell me what version you have please?

    I'm sorry about this, but you have a Vundo Infection that is being very stubborn. It should be removed with the VundoFix. :(
  • Wizard
    edited March 2006
    Hi,

    It is V4.2.34 ... is there a newer one?
  • TroganTrogan London, UK
    edited March 2006
    There is a newer version that came out just after I posted my first message.

    Could you follow the instructions from my first post again please? The version you should now get is v4.2.35.
  • Wizard
    edited March 2006
    Hi,

    Ok... I downloaded the new version of VundoFix and run it in normal mode, here is the log:


    VundoFix V4.2.34

    Checking Java version...

    Scan started at 1:44:33 PM 3/17/2006

    Listing files found while scanning....

    C:\WINDOWS\system32\jkklm.dll
    C:\WINDOWS\system32\mlkkj.ini
    C:\WINDOWS\system32\mlkkj.bak1
    C:\WINDOWS\system32\mlkkj.bak2
    C:\WINDOWS\system32\mlkkj.ini2
    C:\WINDOWS\system32\mlkkj.tmp

    C:\WINDOWS\SYSTEM32\knnmp.bak1
    C:\WINDOWS\SYSTEM32\knnmp.bak2
    C:\WINDOWS\SYSTEM32\knnmp.tmp
    C:\WINDOWS\SYSTEM32\knnmp.ini
    C:\WINDOWS\SYSTEM32\knnmp.ini2
    C:\WINDOWS\SYSTEM32\mlkkj.bak1
    C:\WINDOWS\SYSTEM32\mlkkj.bak2
    C:\WINDOWS\SYSTEM32\mlkkj.tmp
    C:\WINDOWS\SYSTEM32\mlkkj.ini
    C:\WINDOWS\SYSTEM32\mlkkj.ini2
    C:\WINDOWS\SYSTEM32\jkklm.dll
    C:\WINDOWS\SYSTEM32\knnmp.ini2
    C:\WINDOWS\SYSTEM32\knnmp.bak2
    C:\WINDOWS\SYSTEM32\knnmp.tmp
    C:\WINDOWS\SYSTEM32\knnmp.ini
    C:\WINDOWS\SYSTEM32\knnmp.ini2
    C:\WINDOWS\SYSTEM32\mlkkj.ini2
    C:\WINDOWS\SYSTEM32\mlkkj.bak2
    C:\WINDOWS\SYSTEM32\mlkkj.tmp
    C:\WINDOWS\SYSTEM32\mlkkj.ini
    C:\WINDOWS\SYSTEM32\mlkkj.ini2
    C:\WINDOWS\SYSTEM32\jkklm.dll
    Attempting to delete C:\WINDOWS\system32\jkklm.dll
    C:\WINDOWS\system32\jkklm.dll Could not be deleted.

    Attempting to delete C:\WINDOWS\system32\mlkkj.ini
    C:\WINDOWS\system32\mlkkj.ini Has been deleted!

    Attempting to delete C:\WINDOWS\system32\mlkkj.bak1
    C:\WINDOWS\system32\mlkkj.bak1 Has been deleted!

    Attempting to delete C:\WINDOWS\system32\mlkkj.bak2
    C:\WINDOWS\system32\mlkkj.bak2 Has been deleted!

    Attempting to delete C:\WINDOWS\system32\mlkkj.ini2
    C:\WINDOWS\system32\mlkkj.ini2 Has been deleted!

    Attempting to delete C:\WINDOWS\system32\mlkkj.tmp
    C:\WINDOWS\system32\mlkkj.tmp Has been deleted!

    Attempting to delete C:\WINDOWS\SYSTEM32\knnmp.bak1
    C:\WINDOWS\SYSTEM32\knnmp.bak1 Has been deleted!

    Attempting to delete C:\WINDOWS\SYSTEM32\knnmp.bak2
    C:\WINDOWS\SYSTEM32\knnmp.bak2 Has been deleted!

    Attempting to delete C:\WINDOWS\SYSTEM32\knnmp.tmp
    C:\WINDOWS\SYSTEM32\knnmp.tmp Has been deleted!

    Attempting to delete C:\WINDOWS\SYSTEM32\knnmp.ini
    C:\WINDOWS\SYSTEM32\knnmp.ini Has been deleted!

    Attempting to delete C:\WINDOWS\SYSTEM32\knnmp.ini2
    C:\WINDOWS\SYSTEM32\knnmp.ini2 Has been deleted!

    Attempting to delete C:\WINDOWS\SYSTEM32\jkklm.dll
    C:\WINDOWS\SYSTEM32\jkklm.dll Could not be deleted.

    Attempting to delete C:\WINDOWS\SYSTEM32\jkklm.dll
    C:\WINDOWS\SYSTEM32\jkklm.dll Could not be deleted.

    Performing Repairs to the registry.
    Done!

    VundoFix V4.2.34

    Checking Java version...

    Scan started at 2:39:02 PM 3/17/2006

    Listing files found while scanning....

    C:\WINDOWS\system32\jkklm.dll
    C:\WINDOWS\system32\mlkkj.ini
    C:\WINDOWS\system32\mlkkj.ini2

    C:\WINDOWS\SYSTEM32\mlkkj.ini2
    C:\WINDOWS\SYSTEM32\mlkkj.ini
    C:\WINDOWS\SYSTEM32\mlkkj.ini2
    C:\WINDOWS\SYSTEM32\jkklm.dll
    Attempting to delete C:\WINDOWS\system32\jkklm.dll
    C:\WINDOWS\system32\jkklm.dll Could not be deleted.

    Attempting to delete C:\WINDOWS\system32\mlkkj.ini
    C:\WINDOWS\system32\mlkkj.ini Has been deleted!

    Attempting to delete C:\WINDOWS\system32\mlkkj.ini2
    C:\WINDOWS\system32\mlkkj.ini2 Has been deleted!

    Attempting to delete C:\WINDOWS\SYSTEM32\jkklm.dll
    C:\WINDOWS\SYSTEM32\jkklm.dll Could not be deleted.

    Performing Repairs to the registry.
    Done!

    VundoFix V4.2.34

    Checking Java version...

    Scan started at 2:02:00 PM 3/20/2006

    Listing files found while scanning....

    C:\WINDOWS\system32\jkklm.dll
    C:\WINDOWS\system32\mlkkj.ini
    C:\WINDOWS\system32\mlkkj.bak1
    C:\WINDOWS\system32\mlkkj.bak2

    C:\WINDOWS\SYSTEM32\mlkkj.bak1
    C:\WINDOWS\SYSTEM32\mlkkj.bak2
    C:\WINDOWS\SYSTEM32\mlkkj.ini
    C:\WINDOWS\SYSTEM32\jkklm.dll
    Attempting to delete C:\WINDOWS\system32\jkklm.dll
    C:\WINDOWS\system32\jkklm.dll Could not be deleted.

    Attempting to delete C:\WINDOWS\system32\mlkkj.ini
    C:\WINDOWS\system32\mlkkj.ini Has been deleted!

    Attempting to delete C:\WINDOWS\system32\mlkkj.bak1
    C:\WINDOWS\system32\mlkkj.bak1 Has been deleted!

    Attempting to delete C:\WINDOWS\system32\mlkkj.bak2
    C:\WINDOWS\system32\mlkkj.bak2 Has been deleted!

    Attempting to delete C:\WINDOWS\SYSTEM32\jkklm.dll
    C:\WINDOWS\SYSTEM32\jkklm.dll Could not be deleted.

    Performing Repairs to the registry.
    Done!

    VundoFix V4.2.35

    Checking Java version...

    Scan started at 3:03:26 PM 3/20/2006

    Listing files found while scanning....

    C:\WINDOWS\system32\jkklm.dll
    C:\WINDOWS\system32\mlkkj.ini
    C:\WINDOWS\system32\mlkkj.bak1

    C:\WINDOWS\SYSTEM32\mlkkj.bak1
    C:\WINDOWS\SYSTEM32\mlkkj.ini
    C:\WINDOWS\SYSTEM32\jkklm.dll
    Attempting to delete C:\WINDOWS\system32\jkklm.dll
    C:\WINDOWS\system32\jkklm.dll Could not be deleted.

    Attempting to delete C:\WINDOWS\system32\mlkkj.ini
    C:\WINDOWS\system32\mlkkj.ini Has been deleted!

    Attempting to delete C:\WINDOWS\system32\mlkkj.bak1
    C:\WINDOWS\system32\mlkkj.bak1 Has been deleted!

    Attempting to delete C:\WINDOWS\SYSTEM32\jkklm.dll
    C:\WINDOWS\SYSTEM32\jkklm.dll Could not be deleted.

    Performing Repairs to the registry.
    Done!

    VundoFix V4.2.35

    Checking Java version...

    Scan started at 3:31:33 PM 3/20/2006

    Listing files found while scanning....

    C:\WINDOWS\system32\jkklm.dll
    C:\WINDOWS\system32\mlkkj.ini

    Attempting to delete C:\WINDOWS\system32\jkklm.dll
    C:\WINDOWS\system32\jkklm.dll Could not be deleted.

    Attempting to delete C:\WINDOWS\system32\mlkkj.ini
    C:\WINDOWS\system32\mlkkj.ini Has been deleted!

    Performing Repairs to the registry.
    Done!


    Here is the log for HijackThis:

    Logfile of HijackThis v1.99.1
    Scan saved at 3:08:31 PM, on 3/20/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
    C:\Program Files\CA\eTrust Antivirus\InoRpc.exe
    C:\Program Files\CA\eTrust Antivirus\InoRT.exe
    C:\Program Files\CA\eTrust Antivirus\InoTask.exe
    C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\dla\tfswctrl.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\CASIO\Photo Loader\Plauto.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Hijackthis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    R3 - URLSearchHook: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - (no file)
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {912B6D25-8069-0D93-8E67-A84F4A06AA82} - C:\PROGRA~1\flawroad\dvdphone.exe (file missing)
    O2 - BHO: ATLDistrib Object - {93C6313C-9DB4-4694-8BD0-E378C573A9AD} - C:\WINDOWS\system32\jkklm.dll
    O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - Global Startup: Adobe Gamma Loader.lnk.disabled
    O4 - Global Startup: Adobe Reader Speed Launch.lnk.disabled
    O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\E_SRCV02.EXE
    O4 - Global Startup: logon.bat
    O4 - Global Startup: Photo Loader supervisory.lnk = C:\Program Files\CASIO\Photo Loader\Plauto.exe
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
    O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=48835
    O16 - DPF: {2253F320-AB68-4A07-917D-4F12D8884A06} (ChainCast VMR Client Proxy) - http://www.streamaudio.com/download/ccpm_0237.cab
    O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://www.pestscan.com/scanner/axscanner.cab
    O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
    O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - http://www.live365.com/players/play365.cab
    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
    O20 - Winlogon Notify: jkklm - C:\WINDOWS\system32\jkklm.dll
    O20 - Winlogon Notify: pmnnk - C:\WINDOWS\system32\pmnnk.dll (file missing)
    O23 - Service: CA License Client (CA_LIC_CLNT) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe
    O23 - Service: CA License Server (CA_LIC_SRVR) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmtd.exe
    O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: eTrust Antivirus RPC Server (InoRPC) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRpc.exe
    O23 - Service: eTrust Antivirus Realtime Server (InoRT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRT.exe
    O23 - Service: eTrust Antivirus Job Server (InoTask) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoTask.exe
    O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Event Log Watch (LogWatch) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe

    THANK YOU!!!
  • TroganTrogan London, UK
    edited March 2006
    Could you enable everything on startup please?
    • Go to Start > Run > Type msconfig
    • Click the Startup Tab
    • Click Enable All
    • Click Apply and then Close
    • Reboot when prompted

    Post a new HJT log after :)
  • Wizard
    edited March 2006
    Hi,

    Everything was already enabled... here is the HijackThis Log anyway:

    Logfile of HijackThis v1.99.1
    Scan saved at 3:08:31 PM, on 3/20/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
    C:\Program Files\CA\eTrust Antivirus\InoRpc.exe
    C:\Program Files\CA\eTrust Antivirus\InoRT.exe
    C:\Program Files\CA\eTrust Antivirus\InoTask.exe
    C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\dla\tfswctrl.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\CASIO\Photo Loader\Plauto.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Hijackthis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    R3 - URLSearchHook: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - (no file)
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {912B6D25-8069-0D93-8E67-A84F4A06AA82} - C:\PROGRA~1\flawroad\dvdphone.exe (file missing)
    O2 - BHO: ATLDistrib Object - {93C6313C-9DB4-4694-8BD0-E378C573A9AD} - C:\WINDOWS\system32\jkklm.dll
    O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - Global Startup: Adobe Gamma Loader.lnk.disabled
    O4 - Global Startup: Adobe Reader Speed Launch.lnk.disabled
    O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\E_SRCV02.EXE
    O4 - Global Startup: logon.bat
    O4 - Global Startup: Photo Loader supervisory.lnk = C:\Program Files\CASIO\Photo Loader\Plauto.exe
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
    O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=48835
    O16 - DPF: {2253F320-AB68-4A07-917D-4F12D8884A06} (ChainCast VMR Client Proxy) - http://www.streamaudio.com/download/ccpm_0237.cab
    O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://www.pestscan.com/scanner/axscanner.cab
    O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
    O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - http://www.live365.com/players/play365.cab
    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
    O20 - Winlogon Notify: jkklm - C:\WINDOWS\system32\jkklm.dll
    O20 - Winlogon Notify: pmnnk - C:\WINDOWS\system32\pmnnk.dll (file missing)
    O23 - Service: CA License Client (CA_LIC_CLNT) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe
    O23 - Service: CA License Server (CA_LIC_SRVR) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmtd.exe
    O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: eTrust Antivirus RPC Server (InoRPC) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRpc.exe
    O23 - Service: eTrust Antivirus Realtime Server (InoRT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRT.exe
    O23 - Service: eTrust Antivirus Job Server (InoTask) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoTask.exe
    O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Event Log Watch (LogWatch) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
  • TroganTrogan London, UK
    edited March 2006
    Download VirtumundoBegone and save it to your desktop.

    VirtumundoBegone

    Reboot your computer into Safe Mode

    Then double click VirtumundoBeGone.exe you just downloaded and follow the instructions.

    Exit when it has finished.

    Reboot back in Normal Mode and post a new HJT log :)
  • Wizard
    edited March 2006
    Hi, ok, I downloaded Virtumundobegone and followed your instructions. Here is the VBG log


    [03/20/2006, 18:10:41] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Kendra\Desktop\VirtumundoBeGone.exe" )
    [03/20/2006, 18:10:51] - User choose NOT to continue. Exiting...

    [03/20/2006, 18:11:04] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Kendra\Desktop\VirtumundoBeGone.exe" )
    [03/20/2006, 18:11:06] - Detected System Information:
    [03/20/2006, 18:11:06] - Windows Version: 5.1.2600, Service Pack 2
    [03/20/2006, 18:11:06] - Current Username: Kendra (Admin)
    [03/20/2006, 18:11:06] - Windows is in SAFE mode with Networking.
    [03/20/2006, 18:11:06] - Searching for Browser Helper Objects:
    [03/20/2006, 18:11:06] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
    [03/20/2006, 18:11:06] - BHO 2: {912B6D25-8069-0D93-8E67-A84F4A06AA82} ()
    [03/20/2006, 18:11:06] - WARNING: BHO has no default name. Checking for Winlogon reference.
    [03/20/2006, 18:11:06] - Checking for HKLM\...\Winlogon\Notify\dvdphone
    [03/20/2006, 18:11:06] - Key not found: HKLM\...\Winlogon\Notify\dvdphone, continuing.
    [03/20/2006, 18:11:06] - BHO 3: {93C6313C-9DB4-4694-8BD0-E378C573A9AD} (ATLDistrib Object)
    [03/20/2006, 18:11:06] - ALERT: Found ATLDistrib Object!
    [03/20/2006, 18:11:06] - Finished Searching Browser Helper Objects
    [03/20/2006, 18:11:06] - *** Detected ATLDistrib Object
    [03/20/2006, 18:11:06] - Trying to remove ATLDistrib Object...
    [03/20/2006, 18:11:07] - Terminating Process: IEXPLORE.EXE
    [03/20/2006, 18:11:07] - Terminating Process: RUNDLL32.EXE
    [03/20/2006, 18:11:07] - Disabling Automatic Shell Restart
    [03/20/2006, 18:11:07] - Terminating Process: EXPLORER.EXE
    [03/20/2006, 18:11:07] - Suspending the NT Session Manager System Service
    [03/20/2006, 18:11:07] - Terminating Windows NT Logon/Logoff Manager
    [03/20/2006, 18:11:08] - Re-enabling Automatic Shell Restart
    [03/20/2006, 18:11:08] - File to disable: C:\WINDOWS\system32\jkklm.dll
    [03/20/2006, 18:11:08] - Renaming C:\WINDOWS\system32\jkklm.dll -> C:\WINDOWS\system32\jkklm.dll.vir
    [03/20/2006, 18:11:08] - ! File rename was unsucessful.
    [03/20/2006, 18:11:08] - Attempting to Deny Access to C:\WINDOWS\system32\jkklm.dll
    [03/20/2006, 18:11:08] - *** IMPORTANT: Delete/Rename/Move on reboot (like Killbox) MAY NOT work.
    [03/20/2006, 18:11:08] - processed file: C:\WINDOWS\system32\jkklm.dll

    [03/20/2006, 18:11:08] - *** IMPORTANT: The file is disabled and will need to be deleted by the user.
    [03/20/2006, 18:11:08] - Removing HKLM\...\Browser Helper Objects\{93C6313C-9DB4-4694-8BD0-E378C573A9AD}
    [03/20/2006, 18:11:08] - Removing HKCR\CLSID\{93C6313C-9DB4-4694-8BD0-E378C573A9AD}
    [03/20/2006, 18:11:08] - Adding Kill Bit for ActiveX for GUID: {93C6313C-9DB4-4694-8BD0-E378C573A9AD}
    [03/20/2006, 18:11:08] - Deleting ATLEvents/MSEvents Registry entries
    [03/20/2006, 18:11:08] - Removing HKLM\...\Winlogon\Notify\jkklm
    [03/20/2006, 18:11:10] - Searching for Browser Helper Objects:
    [03/20/2006, 18:11:10] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
    [03/20/2006, 18:11:10] - BHO 2: {912B6D25-8069-0D93-8E67-A84F4A06AA82} ()
    [03/20/2006, 18:11:10] - WARNING: BHO has no default name. Checking for Winlogon reference.
    [03/20/2006, 18:11:10] - Checking for HKLM\...\Winlogon\Notify\dvdphone
    [03/20/2006, 18:11:10] - Key not found: HKLM\...\Winlogon\Notify\dvdphone, continuing.
    [03/20/2006, 18:11:10] - Finished Searching Browser Helper Objects
    [03/20/2006, 18:11:10] - Finishing up...
    [03/20/2006, 18:11:10] - A restart is needed.
    [03/20/2006, 18:11:10] - Automatic Reboot on STOP Error is not set. User will have to manually restart.
    [03/20/2006, 18:11:31] - Attempting to Restart via STOP error (Blue Screen!)

    [03/21/2006, 8:37:36] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Kendra\Desktop\VirtumundoBeGone.exe" )
    [03/21/2006, 8:37:43] - Detected System Information:
    [03/21/2006, 8:37:43] - Windows Version: 5.1.2600, Service Pack 2
    [03/21/2006, 8:37:43] - Current Username: Kendra (Admin)
    [03/21/2006, 8:37:43] - Windows is in SAFE mode with Networking.
    [03/21/2006, 8:37:43] - Searching for Browser Helper Objects:
    [03/21/2006, 8:37:43] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
    [03/21/2006, 8:37:43] - BHO 2: {912B6D25-8069-0D93-8E67-A84F4A06AA82} ()
    [03/21/2006, 8:37:43] - WARNING: BHO has no default name. Checking for Winlogon reference.
    [03/21/2006, 8:37:43] - Checking for HKLM\...\Winlogon\Notify\dvdphone
    [03/21/2006, 8:37:43] - Key not found: HKLM\...\Winlogon\Notify\dvdphone, continuing.
    [03/21/2006, 8:37:43] - BHO 3: {93C6313C-9DB4-4694-8BD0-E378C573A9AD} (ATLDistrib Object)
    [03/21/2006, 8:37:43] - ALERT: Found ATLDistrib Object!
    [03/21/2006, 8:37:43] - Finished Searching Browser Helper Objects
    [03/21/2006, 8:37:43] - *** Detected ATLDistrib Object
    [03/21/2006, 8:37:43] - Trying to remove ATLDistrib Object...
    [03/21/2006, 8:37:44] - Terminating Process: IEXPLORE.EXE
    [03/21/2006, 8:37:44] - Terminating Process: RUNDLL32.EXE
    [03/21/2006, 8:37:44] - Disabling Automatic Shell Restart
    [03/21/2006, 8:37:44] - Terminating Process: EXPLORER.EXE
    [03/21/2006, 8:37:44] - Suspending the NT Session Manager System Service
    [03/21/2006, 8:37:45] - Terminating Windows NT Logon/Logoff Manager
    [03/21/2006, 8:37:45] - Re-enabling Automatic Shell Restart
    [03/21/2006, 8:37:45] - File to disable: C:\WINDOWS\system32\jkklm.dll
    [03/21/2006, 8:37:45] - Renaming C:\WINDOWS\system32\jkklm.dll -> C:\WINDOWS\system32\jkklm.dll.vir
    [03/21/2006, 8:37:45] - ! File rename was unsucessful.
    [03/21/2006, 8:37:45] - Attempting to Deny Access to C:\WINDOWS\system32\jkklm.dll
    [03/21/2006, 8:37:45] - *** IMPORTANT: Delete/Rename/Move on reboot (like Killbox) MAY NOT work.
    [03/21/2006, 8:37:45] - processed file: C:\WINDOWS\system32\jkklm.dll

    [03/21/2006, 8:37:45] - *** IMPORTANT: The file is disabled and will need to be deleted by the user.
    [03/21/2006, 8:37:45] - Removing HKLM\...\Browser Helper Objects\{93C6313C-9DB4-4694-8BD0-E378C573A9AD}
    [03/21/2006, 8:37:45] - Removing HKCR\CLSID\{93C6313C-9DB4-4694-8BD0-E378C573A9AD}
    [03/21/2006, 8:37:45] - Adding Kill Bit for ActiveX for GUID: {93C6313C-9DB4-4694-8BD0-E378C573A9AD}
    [03/21/2006, 8:37:45] - Deleting ATLEvents/MSEvents Registry entries
    [03/21/2006, 8:37:45] - Removing HKLM\...\Winlogon\Notify\jkklm
    [03/21/2006, 8:37:45] - Searching for Browser Helper Objects:
    [03/21/2006, 8:37:45] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
    [03/21/2006, 8:37:45] - BHO 2: {912B6D25-8069-0D93-8E67-A84F4A06AA82} ()
    [03/21/2006, 8:37:45] - WARNING: BHO has no default name. Checking for Winlogon reference.
    [03/21/2006, 8:37:45] - Checking for HKLM\...\Winlogon\Notify\dvdphone
    [03/21/2006, 8:37:45] - Key not found: HKLM\...\Winlogon\Notify\dvdphone, continuing.
    [03/21/2006, 8:37:45] - Finished Searching Browser Helper Objects
    [03/21/2006, 8:37:45] - Finishing up...
    [03/21/2006, 8:37:45] - A restart is needed.
    [03/21/2006, 8:37:45] - Automatic Reboot on STOP Error is not set. User will have to manually restart.
    [03/21/2006, 8:37:50] - Attempting to Restart via STOP error (Blue Screen!)


    This is the HJT log:

    Logfile of HijackThis v1.99.1
    Scan saved at 8:41:24 AM, on 3/21/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
    C:\Program Files\CA\eTrust Antivirus\InoRpc.exe
    C:\Program Files\CA\eTrust Antivirus\InoRT.exe
    C:\Program Files\CA\eTrust Antivirus\InoTask.exe
    C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\dla\tfswctrl.exe
    C:\Program Files\Common Files\Dell\EUSW\Support.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
    C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
    C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
    C:\PROGRA~1\PESTPA~1\PPControl.exe
    C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Dell\Media Experience\PCMService.exe
    C:\PROGRA~1\CA\ETRUST~1\realmon.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    C:\Program Files\CASIO\Photo Loader\Plauto.exe
    C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
    C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
    C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Hijackthis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    R3 - URLSearchHook: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - (no file)
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {912B6D25-8069-0D93-8E67-A84F4A06AA82} - C:\PROGRA~1\flawroad\dvdphone.exe (file missing)
    O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
    O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
    O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
    O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
    O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
    O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
    O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
    O4 - HKLM\..\Run: [PestPatrol Control Center] C:\PROGRA~1\PESTPA~1\PPControl.exe
    O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
    O4 - HKLM\..\Run: [Realtime Monitor] C:\PROGRA~1\CA\ETRUST~1\realmon.exe -s
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\E_SRCV02.EXE
    O4 - Global Startup: logon.bat
    O4 - Global Startup: Photo Loader supervisory.lnk = C:\Program Files\CASIO\Photo Loader\Plauto.exe
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
    O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=48835
    O16 - DPF: {2253F320-AB68-4A07-917D-4F12D8884A06} (ChainCast VMR Client Proxy) - http://www.streamaudio.com/download/ccpm_0237.cab
    O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://www.pestscan.com/scanner/axscanner.cab
    O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
    O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - http://www.live365.com/players/play365.cab
    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
    O20 - Winlogon Notify: pmnnk - C:\WINDOWS\system32\pmnnk.dll (file missing)
    O23 - Service: CA License Client (CA_LIC_CLNT) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe
    O23 - Service: CA License Server (CA_LIC_SRVR) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmtd.exe
    O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: eTrust Antivirus RPC Server (InoRPC) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRpc.exe
    O23 - Service: eTrust Antivirus Realtime Server (InoRT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRT.exe
    O23 - Service: eTrust Antivirus Job Server (InoTask) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoTask.exe
    O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Event Log Watch (LogWatch) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe

    THANKS!! :)
  • TroganTrogan London, UK
    edited March 2006
    Excellent! That worked :)

    Open HijackThis
    - Click the Do a system scan only button
    - Check the following entries (below)

    R3 - URLSearchHook: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - (no file)

    O2 - BHO: (no name) - {912B6D25-8069-0D93-8E67-A84F4A06AA82} - C:\PROGRA~1\flawroad\dvdphone.exe (file missing)     << this file does not look legit, so I think we should remove it. Unless you know what it is?

    O20 - Winlogon Notify: pmnnk - C:\WINDOWS\system32\pmnnk.dll (file missing)

    - Close ALL open windows (especially Internet Explorer!)
    Click Fix Checked


    Next, please find and delete the following:

    C:\Program Files\flawroad << this folder
    =====


    Reboot your computer and post a new HJT log :)

    How is your computer now?
    Do you have a Firewall on your computer?
  • Wizard
    edited March 2006
    HI :)

    It seems like it worked!!! You are awesome!!! here is the new HJT log:

    Logfile of HijackThis v1.99.1
    Scan saved at 10:51:25 AM, on 3/21/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
    C:\Program Files\CA\eTrust Antivirus\InoRpc.exe
    C:\Program Files\CA\eTrust Antivirus\InoRT.exe
    C:\Program Files\CA\eTrust Antivirus\InoTask.exe
    C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
    C:\Program Files\Common Files\Microsoft

    Shared\VS7DEBUG\MDM.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\dla\tfswctrl.exe
    C:\Program Files\Common Files\Dell\EUSW\Support.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\MUSICMATCH\MUSICMATCH

    Jukebox\mmtask.exe
    C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
    C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
    C:\PROGRA~1\PESTPA~1\PPControl.exe
    C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\Program Files\Dell\Media Experience\PCMService.exe
    C:\PROGRA~1\CA\ETRUST~1\realmon.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
    C:\Program Files\CASIO\Photo Loader\Plauto.exe
    C:\Program Files\Hijackthis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet

    Explorer\Main,Default_Page_URL = http://www.dellnet.com
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

    http://www.yahoo.com/
    O2 - BHO: AcroIEHlprObj Class -

    {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program

    Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
    O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common

    Files\Dell\EUSW\Support.exe
    O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows

    Defender\MSASCui.exe" -hide
    O4 - HKLM\..\Run: [iTunesHelper] C:\Program

    Files\iTunes\iTunesHelper.exe
    O4 - HKLM\..\Run: [mmtask] C:\Program

    Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
    O4 - HKLM\..\Run: [CookiePatrol]

    C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
    O4 - HKLM\..\Run: [PPMemCheck]

    C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
    O4 - HKLM\..\Run: [PestPatrol Control Center]

    C:\PROGRA~1\PESTPA~1\PPControl.exe
    O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common

    Files\Sonic\Update Manager\sgtray.exe" /r
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program

    Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds]

    C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media

    Experience\PCMService.exe"
    O4 - HKLM\..\Run: [Realtime Monitor]

    C:\PROGRA~1\CA\ETRUST~1\realmon.exe -s
    O4 - HKLM\..\Run: [NeroFilterCheck]

    C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program

    Files\Yahoo!\Messenger\ypager.exe -quiet
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program

    Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program

    Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: EPSON Status Monitor 3 Environment Check

    2.lnk =

    C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\E_SRCV

    02.EXE
    O4 - Global Startup: logon.bat
    O4 - Global Startup: Photo Loader supervisory.lnk = C:\Program

    Files\CASIO\Photo Loader\Plauto.exe
    O6 - HKCU\Software\Policies\Microsoft\Internet

    Explorer\Restrictions present
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control

    Panel present
    O8 - Extra context menu item: E&xport to Microsoft Excel -

    res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) -

    {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -

    C:\WINDOWS\System32\msjava.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console -

    {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -

    C:\WINDOWS\System32\msjava.dll
    O9 - Extra button: Research -

    {92780B25-18CC-41C8-B9BE-3C9C571A8263} -

    C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Yahoo! Messenger -

    {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} -

    C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
    O9 - Extra 'Tools' menuitem: Yahoo! Messenger -

    {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} -

    C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
    O9 - Extra button: Messenger -

    {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

    Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger -

    {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

    Files\Messenger\msmsgs.exe
    O16 - DPF: ppctlcab -

    http://www.pestscan.com/scanner/ppctlcab.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700}

    (Windows Genuine Advantage Validation Tool) -

    http://go.microsoft.com/fwlink/?linkid=48835
    O16 - DPF: {2253F320-AB68-4A07-917D-4F12D8884A06}

    (ChainCast VMR Client Proxy) -

    http://www.streamaudio.com/download/ccpm_0237.cab
    O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13}

    (PPSDKActiveXScanner.MainScreen) -

    http://www.pestscan.com/scanner/axscanner.cab
    O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE}

    (Symantec RuFSI Registry Information Class) -

    http://security.symantec.com/sscv6/SharedContent/common/bin/cab

    sa.cab
    O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF}

    (Live365Player Class) - http://www.live365.com/players/play365.cab
    O20 - Winlogon Notify: igfxcui -

    C:\WINDOWS\SYSTEM32\igfxsrvc.dll
    O23 - Service: CA License Client (CA_LIC_CLNT) - Computer

    Associates - C:\Program

    Files\CA\SharedComponents\CA_LIC\lic98rmt.exe
    O23 - Service: CA License Server (CA_LIC_SRVR) - Computer

    Associates - C:\Program

    Files\CA\SharedComponents\CA_LIC\lic98rmtd.exe
    O23 - Service: EPSON Printer Status Agent2

    (EPSONStatusAgent2) - SEIKO EPSON CORPORATION -

    C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision

    Corporation - C:\Program Files\Common

    Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: eTrust Antivirus RPC Server (InoRPC) - Computer

    Associates International, Inc. - C:\Program Files\CA\eTrust

    Antivirus\InoRpc.exe
    O23 - Service: eTrust Antivirus Realtime Server (InoRT) - Computer

    Associates International, Inc. - C:\Program Files\CA\eTrust

    Antivirus\InoRT.exe
    O23 - Service: eTrust Antivirus Job Server (InoTask) - Computer

    Associates International, Inc. - C:\Program Files\CA\eTrust

    Antivirus\InoTask.exe
    O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. -

    C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Event Log Watch (LogWatch) - Computer Associates

    - C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe



    I do have a firewall... I don't really know how my computer got infected :(
    any other suggestions on how to keep it away from Winfixer?

    Wizard
  • TroganTrogan London, UK
    edited March 2006
    I will give you some instructions on staying more secure when your log is clean. For now, could you post a new HJT log? The one above is hard to read :)
  • Wizard
    edited March 2006
    Hi,

    here it is:

    Logfile of HijackThis v1.99.1
    Scan saved at 1:47:31 PM, on 3/21/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
    C:\Program Files\CA\eTrust Antivirus\InoRpc.exe
    C:\Program Files\CA\eTrust Antivirus\InoRT.exe
    C:\Program Files\CA\eTrust Antivirus\InoTask.exe
    C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
    C:\Program Files\Common Files\Microsoft

    Shared\VS7DEBUG\MDM.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\dla\tfswctrl.exe
    C:\Program Files\Common Files\Dell\EUSW\Support.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\MUSICMATCH\MUSICMATCH

    Jukebox\mmtask.exe
    C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
    C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
    C:\PROGRA~1\PESTPA~1\PPControl.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\Program Files\Dell\Media Experience\PCMService.exe
    C:\PROGRA~1\CA\ETRUST~1\realmon.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\CASIO\Photo Loader\Plauto.exe
    C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
    C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
    C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE
    C:\Program Files\Impact IS\Bin\Impwin.exe
    C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
    C:\WINDOWS\SYSTEM32\CALC.EXE
    C:\Program Files\Adobe\Photoshop 7.0\Photoshop.exe
    C:\Program Files\Hijackthis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet

    Explorer\Main,Default_Page_URL = http://www.dellnet.com
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

    http://www.yahoo.com/
    O2 - BHO: AcroIEHlprObj Class -

    {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program

    Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
    O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common

    Files\Dell\EUSW\Support.exe
    O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows

    Defender\MSASCui.exe" -hide
    O4 - HKLM\..\Run: [iTunesHelper] C:\Program

    Files\iTunes\iTunesHelper.exe
    O4 - HKLM\..\Run: [mmtask] C:\Program

    Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
    O4 - HKLM\..\Run: [CookiePatrol]

    C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
    O4 - HKLM\..\Run: [PPMemCheck]

    C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
    O4 - HKLM\..\Run: [PestPatrol Control Center]

    C:\PROGRA~1\PESTPA~1\PPControl.exe
    O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common

    Files\Sonic\Update Manager\sgtray.exe" /r
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program

    Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds]

    C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media

    Experience\PCMService.exe"
    O4 - HKLM\..\Run: [Realtime Monitor]

    C:\PROGRA~1\CA\ETRUST~1\realmon.exe -s
    O4 - HKLM\..\Run: [NeroFilterCheck]

    C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program

    Files\Yahoo!\Messenger\ypager.exe -quiet
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program

    Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program

    Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: EPSON Status Monitor 3 Environment Check

    2.lnk =

    C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\E_SRCV

    02.EXE
    O4 - Global Startup: logon.bat
    O4 - Global Startup: Photo Loader supervisory.lnk = C:\Program

    Files\CASIO\Photo Loader\Plauto.exe
    O6 - HKCU\Software\Policies\Microsoft\Internet

    Explorer\Restrictions present
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control

    Panel present
    O8 - Extra context menu item: E&xport to Microsoft Excel -

    res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) -

    {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -

    C:\WINDOWS\System32\msjava.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console -

    {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -

    C:\WINDOWS\System32\msjava.dll
    O9 - Extra button: Research -

    {92780B25-18CC-41C8-B9BE-3C9C571A8263} -

    C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Yahoo! Messenger -

    {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} -

    C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
    O9 - Extra 'Tools' menuitem: Yahoo! Messenger -

    {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} -

    C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
    O9 - Extra button: Messenger -

    {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

    Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger -

    {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

    Files\Messenger\msmsgs.exe
    O16 - DPF: ppctlcab -

    http://www.pestscan.com/scanner/ppctlcab.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700}

    (Windows Genuine Advantage Validation Tool) -

    http://go.microsoft.com/fwlink/?linkid=48835
    O16 - DPF: {2253F320-AB68-4A07-917D-4F12D8884A06}

    (ChainCast VMR Client Proxy) -

    http://www.streamaudio.com/download/ccpm_0237.cab
    O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13}

    (PPSDKActiveXScanner.MainScreen) -

    http://www.pestscan.com/scanner/axscanner.cab
    O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE}

    (Symantec RuFSI Registry Information Class) -

    http://security.symantec.com/sscv6/SharedContent/common/bin/cab

    sa.cab
    O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF}

    (Live365Player Class) - http://www.live365.com/players/play365.cab
    O20 - Winlogon Notify: igfxcui -

    C:\WINDOWS\SYSTEM32\igfxsrvc.dll
    O23 - Service: CA License Client (CA_LIC_CLNT) - Computer

    Associates - C:\Program

    Files\CA\SharedComponents\CA_LIC\lic98rmt.exe
    O23 - Service: CA License Server (CA_LIC_SRVR) - Computer

    Associates - C:\Program

    Files\CA\SharedComponents\CA_LIC\lic98rmtd.exe
    O23 - Service: EPSON Printer Status Agent2

    (EPSONStatusAgent2) - SEIKO EPSON CORPORATION -

    C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision

    Corporation - C:\Program Files\Common

    Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: eTrust Antivirus RPC Server (InoRPC) - Computer

    Associates International, Inc. - C:\Program Files\CA\eTrust

    Antivirus\InoRpc.exe
    O23 - Service: eTrust Antivirus Realtime Server (InoRT) - Computer

    Associates International, Inc. - C:\Program Files\CA\eTrust

    Antivirus\InoRT.exe
    O23 - Service: eTrust Antivirus Job Server (InoTask) - Computer

    Associates International, Inc. - C:\Program Files\CA\eTrust

    Antivirus\InoTask.exe
    O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. -

    C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Event Log Watch (LogWatch) - Computer Associates

    - C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
  • TroganTrogan London, UK
    edited March 2006
    Again!? :(

    Can you uncheck Word Wrap (Under Format) in Notepad please.
  • Wizard
    edited March 2006
    I'm sorry about that... here it goes again:

    Logfile of HijackThis v1.99.1
    Scan saved at 1:47:31 PM, on 3/21/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
    C:\Program Files\CA\eTrust Antivirus\InoRpc.exe
    C:\Program Files\CA\eTrust Antivirus\InoRT.exe
    C:\Program Files\CA\eTrust Antivirus\InoTask.exe
    C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\dla\tfswctrl.exe
    C:\Program Files\Common Files\Dell\EUSW\Support.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
    C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
    C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
    C:\PROGRA~1\PESTPA~1\PPControl.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\Program Files\Dell\Media Experience\PCMService.exe
    C:\PROGRA~1\CA\ETRUST~1\realmon.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\CASIO\Photo Loader\Plauto.exe
    C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
    C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
    C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE
    C:\Program Files\Impact IS\Bin\Impwin.exe
    C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
    C:\WINDOWS\SYSTEM32\CALC.EXE
    C:\Program Files\Adobe\Photoshop 7.0\Photoshop.exe
    C:\Program Files\Hijackthis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
    O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
    O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
    O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
    O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
    O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
    O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
    O4 - HKLM\..\Run: [PestPatrol Control Center] C:\PROGRA~1\PESTPA~1\PPControl.exe
    O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
    O4 - HKLM\..\Run: [Realtime Monitor] C:\PROGRA~1\CA\ETRUST~1\realmon.exe -s
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\E_SRCV02.EXE
    O4 - Global Startup: logon.bat
    O4 - Global Startup: Photo Loader supervisory.lnk = C:\Program Files\CASIO\Photo Loader\Plauto.exe
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
    O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=48835
    O16 - DPF: {2253F320-AB68-4A07-917D-4F12D8884A06} (ChainCast VMR Client Proxy) - http://www.streamaudio.com/download/ccpm_0237.cab
    O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://www.pestscan.com/scanner/axscanner.cab
    O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
    O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - http://www.live365.com/players/play365.cab
    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
    O23 - Service: CA License Client (CA_LIC_CLNT) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe
    O23 - Service: CA License Server (CA_LIC_SRVR) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmtd.exe
    O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: eTrust Antivirus RPC Server (InoRPC) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRpc.exe
    O23 - Service: eTrust Antivirus Realtime Server (InoRT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRT.exe
    O23 - Service: eTrust Antivirus Job Server (InoTask) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoTask.exe
    O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Event Log Watch (LogWatch) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
  • TroganTrogan London, UK
    edited March 2006
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    ...(Unless you've set these with an anti-spyware program like SpyBot's Immunize feature, have HiJackThis fix this.)


    Your log is clean now but there is one entry that seems a bit strange to me.

    O4 - Global Startup: logon.bat

    I would like you to do a search for that fle please.

    Click Start > Search > All Files and Folders.
    Expand More advanced options and make sure these boxes are checked

    Search system folders
    Search hidden files and folders
    Search subfolders

    Paste this into the Search box at the top:

    logon.bat

    Please tell me if that file is found and what folder it is in. :)
  • Wizard
    edited March 2006
    Hi,

    I found the file three times:

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup
    C:\Backup\IT
    C:\Backup\syc

    I fixed the other items with HJT, here is the log just in case:

    Logfile of HijackThis v1.99.1
    Scan saved at 2:42:13 PM, on 3/21/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
    C:\Program Files\CA\eTrust Antivirus\InoRpc.exe
    C:\Program Files\CA\eTrust Antivirus\InoRT.exe
    C:\Program Files\CA\eTrust Antivirus\InoTask.exe
    C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\dla\tfswctrl.exe
    C:\Program Files\Common Files\Dell\EUSW\Support.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
    C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
    C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
    C:\PROGRA~1\PESTPA~1\PPControl.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\Program Files\Dell\Media Experience\PCMService.exe
    C:\PROGRA~1\CA\ETRUST~1\realmon.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\CASIO\Photo Loader\Plauto.exe
    C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
    C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
    C:\Program Files\Impact IS\Bin\Impwin.exe
    C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\WINDOWS\SYSTEM32\CALC.EXE
    C:\Program Files\Hijackthis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
    O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
    O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
    O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
    O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
    O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
    O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
    O4 - HKLM\..\Run: [PestPatrol Control Center] C:\PROGRA~1\PESTPA~1\PPControl.exe
    O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
    O4 - HKLM\..\Run: [Realtime Monitor] C:\PROGRA~1\CA\ETRUST~1\realmon.exe -s
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\E_SRCV02.EXE
    O4 - Global Startup: logon.bat
    O4 - Global Startup: Photo Loader supervisory.lnk = C:\Program Files\CASIO\Photo Loader\Plauto.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
    O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=48835
    O16 - DPF: {2253F320-AB68-4A07-917D-4F12D8884A06} (ChainCast VMR Client Proxy) - http://www.streamaudio.com/download/ccpm_0237.cab
    O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://www.pestscan.com/scanner/axscanner.cab
    O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
    O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - http://www.live365.com/players/play365.cab
    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
    O23 - Service: CA License Client (CA_LIC_CLNT) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe
    O23 - Service: CA License Server (CA_LIC_SRVR) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmtd.exe
    O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: eTrust Antivirus RPC Server (InoRPC) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRpc.exe
    O23 - Service: eTrust Antivirus Realtime Server (InoRT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRT.exe
    O23 - Service: eTrust Antivirus Job Server (InoTask) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoTask.exe
    O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Event Log Watch (LogWatch) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
  • TroganTrogan London, UK
    edited March 2006
    Could you now scan that file please.
    • Go to Jotti's malware scan
    • Copy and paste the following file path into the "File to upload & scan" box on the top of the page:
    • C:\Documents and Settings\All Users\Start Menu\Programs\Startup\logon.bat
    • Click on the submit button
    • Please post the results in your next reply.
  • Wizard
    edited March 2006
    Hi,

    I did what you told me and these are the results I got from that website:

    Service load: 0% 100%

    File: logon.bat
    Status: OK (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database)
    MD5 6c9b4afe8a6311a5afcdf21dbfbd44e0
    Packers detected: -
    Scanner results
    AntiVir Found nothing
    ArcaVir Found nothing
    Avast Found nothing
    AVG Antivirus Found nothing
    BitDefender Found nothing
    ClamAV Found nothing
    Dr.Web Found nothing
    F-Prot Antivirus Found nothing
    Fortinet Found nothing
    Kaspersky Anti-Virus Found nothing
    NOD32 Found nothing
    Norman Virus Control Found nothing
    UNA Found nothing
    VirusBuster Found nothing
    VBA32 Found nothing


    No idea what that Logon.bat is...??

    Wizard ^__^
  • TroganTrogan London, UK
    edited March 2006
    If the Jotti scan is not showing anything, its probably safe.

    Could you scan these two please and then post the logs here.

    C:\Backup\IT\logon.bat
    C:\Backup\syc\logon.bat
  • Wizard
    edited March 2006
    Hi, here it is:

    C:\Backup\IT\logon.bat

    Service load: 0% 100%

    File: logon.bat
    Status: OK (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database)
    MD5 6c9b4afe8a6311a5afcdf21dbfbd44e0
    Packers detected: -
    Scanner results
    AntiVir Found nothing
    ArcaVir Found nothing
    Avast Found nothing
    AVG Antivirus Found nothing
    BitDefender Found nothing
    ClamAV Found nothing
    Dr.Web Found nothing
    F-Prot Antivirus Found nothing
    Fortinet Found nothing
    Kaspersky Anti-Virus Found nothing
    NOD32 Found nothing
    Norman Virus Control Found nothing
    UNA Found nothing
    VirusBuster Found nothing
    VBA32 Found nothing


    C:\Backup\syc\logon.bat

    Service load: 0% 100%

    File: logon.bat
    Status: OK
    MD5 d2b28095400e3632e448d40d42ce9377
    Packers detected: -
    Scanner results
    AntiVir Found nothing
    ArcaVir Found nothing
    Avast Found nothing
    AVG Antivirus Found nothing
    BitDefender Found nothing
    ClamAV Found nothing
    Dr.Web Found nothing
    F-Prot Antivirus Found nothing
    Fortinet Found nothing
    Kaspersky Anti-Virus Found nothing
    NOD32 Found nothing
    Norman Virus Control Found nothing
    UNA Found nothing
    VirusBuster Found nothing
    VBA32 Found nothing
  • TroganTrogan London, UK
    edited March 2006
    That file seems to be OK as the scans are not finding anything. Are you having any problems? Or can we mark this resolved?
  • Wizard
    edited March 2006
    Hi,

    No other problems... THANK YOU VERY MUCH FOR ALL YOUR HELP!!!! YOU ARE THE BEST!!!!

    Wizard ^__^
  • TroganTrogan London, UK
    edited March 2006
    Your welcome! :cool:

    I'l mark this resolved. Start a new thread, if you need help again :)


    Now that your PC is clean you need to follow these easy steps to keeping it this way:

    Secure your Internet Explorer by going here and following the instructions there.

    Better yet, use an alternative browser! Download FireFox and give it a run. It is far more secure than Internet Explorer. Or, you can get Opera which in my opinion, is better still.

    Use a firewall to help prevent your PC's control being usurped by undesireables. If you don't have a Firewall, then choose ONE below

    Zone Alarm
    Sygate
    Sunbelt Kerio PF

    Install an anti-virus. There are some good, free AV's available today. Make sure that it is updated regularly and have it scan your system often. If you don't have one, choose ONE from below.

    Nod32
    AVG Free Edition
    AntiVir
    avast! 4 Home Edition

    Install and keep updated, Ad-Aware SE, and Spybot Search & Destroy.
    Run them both on a regular basis, following the manufacturer's recommendations.

    Install and keep updated, SpywareBlaster and SpywareGuard

    Check for Windows Updates. Microsoft regularly post updates for your systems safe running. Make sure to take advantage of this. Reboot when installed and return to make sure there are no others.

    Clear your Temp folders.
    Go to Start > Control Panel > Internet Options.
    Under the General tab click the Delete Files... button; check the Delete all offline content box and press OK. Click the Delete Cookies... button and press OK

    Also, go to Start > Find/Search > Files or folders > in the named box, type: *.tmp and choose Edit > select all -> File > delete.

    Empty/delete the entire contents of the C:\Windows\temp folder and C:\temp folder, if you have one. (Contents but not the folder itself.)

    Clear out temp files from the following location. Change "username" to whatever you have on your computer.

    C:\Documents and Settings\username\Local Settings\Temp\

    In order to view these files you may have to select 'show hidden files/folders.' Instructions on how to here.

    Empty the Recycle Bin.


    It is very important that system files and folders are hidden again, so that they DO NOT get deleted by mistake.

    Windows XP
    * Click Start.
    * Open My Computer.
    * Select the Tools menu and click Folder Options.
    * Select the View Tab.
    * Under the Hidden files and folders heading, make sure that the option Do not show hidden files and folders is selected.
    * Make sure there is a TICK next to the Hide protected operating system files (recommended) option.
    * Click Apply to confirm.
    * Click OK.


    For XP users.
    After something like this it is a good idea to Flush the Restore Points and start fresh.
    To flush the XP system Restore Points.

    Go to Start | Run | type msconfig | Press Enter.

    When msconfig opens, click the Launch System Restore Button.
    On the next page, click the System Restore Settings link on the left.

    Check the box labelled 'Turn off System restore'.

    Reboot! Go back in and Turn System Restore Back on. A new Restore Point will be created.

    Note that all previous restore points will be lost.

    ===============

    If you have any more problems, post back.


    Please consider joining the Folding@Home Project :)
    Join our Folding@Home team! Alzheimer's, Parkinson's, cancer... we're trying to cure them with our computers! You've at least read a little about it in the greeting I sent you when you signed up for the site. We're always really pleased to greet new members to the team, and it's a quick way to become an appreciated member of the community.
    MORE INFO: READ THIS
This discussion has been closed.