Virus on computer and popups

Unknown
edited January 2008 in Spyware & Virus Removal
I can't seem to remove a virus from the computer after running several programs. Below is the hijackthis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:13:56 AM, on 12/26/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\mcshield.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Common Files\Network Associates\TalkBack\tbmon.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MIT\Kerberos\bin\krbcc32s.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Network Associates\Common Framework\McScript_InUse.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.inebraska.com/
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\tbmon.exe"
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-21-2983326078-1860911046-1423744002-1007\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User '?')
O4 - Global Startup: SideCar.lnk = C:\Program Files\MIT\Kerberos\bin\SideCar.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{B4C1E2A6-D7FA-4AC4-8145-C539EA7BF35B}: NameServer = 199.184.119.1 199.2.252.10
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\vstskmgr.exe

--
End of file - 4322 bytes

Thanks for your assistance.

jkir

Comments

  • Baabiouz
    edited December 2007
    Hi jkir!

    Step #1
    Please download ComboFix to your Desktop.
    • Double click on Combofix.exe & follow the prompts.
    • When the scan has finished, it shall produce a log for you. Post that log in your next reply

    Do not mouseclick combofix's window whilst it's running. That may cause it to stall

    Step #2
    Rename HijackThis.exe

    1. Right click on the HijackThis icon.

    hjtrename1.jpg

    2. Select Rename.

    hjtrename2.jpg

    3. Now type the following scanner.exe <<< NOTE: make sure to put period before exe when typing.
    Hit the enter key on keyboard.

    hjtrename3.jpg

    Double click on Scanner.exe.
    Click on Do a system scan and save a logfile. Post log in next reply.

    Step #3
    Please post a fresh HijackThis log and Combofix log back here ;)
  • jkir
    edited January 2008
    Here are the 2 file logs requested:

    ComboFix 08-01-04.1 - Willa Kirts 2008-01-05 19:23:06.1 - NTFSx86
    Running from: C:\Documents and Settings\Willa Kirts\Local Settings\Temporary Internet Files\Content.IE5\ETBDYZ76\ComboFix[1].exe
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Documents and Settings\All Users\Start Menu\Live Safety Center.lnk
    C:\Documents and Settings\Willa Kirts\Favorites\Online Security Guide.lnk
    C:\Program Files\Temporary
    C:\Program Files\WinAble
    C:\Temp\1cb
    C:\Temp\1cb\syscheck.log
    C:\temp\tn3
    C:\WINDOWS\cookies.ini
    C:\WINDOWS\system32\a1
    C:\WINDOWS\SYSTEM32\dcbeg.bak2
    C:\WINDOWS\SYSTEM32\dcbeg.ini
    C:\WINDOWS\SYSTEM32\dcbeg.ini2
    C:\WINDOWS\SYSTEM32\dcbeg.tmp
    C:\WINDOWS\system32\drivers\core.cache.dsk
    C:\WINDOWS\system32\drivers\core.sys
    C:\WINDOWS\system32\drivers\fad.sys
    C:\WINDOWS\system32\g2
    C:\WINDOWS\system32\h1
    C:\WINDOWS\system32\mcrh.tmp
    C:\WINDOWS\SYSTEM32\mhmvcetr.ini
    C:\WINDOWS\SYSTEM32\mkhuphyd.ini
    C:\WINDOWS\system32\mlzgnjqc.dllbox
    C:\WINDOWS\system32\oicpqwut.dllbox
    C:\WINDOWS\system32\pac.txt
    C:\WINDOWS\system32\r2
    C:\WINDOWS\SYSTEM32\smjworuy.ini
    C:\WINDOWS\system32\v8
    C:\WINDOWS\uninstall_nmon.vbs

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

    .
    \LEGACY_CORE
    \LEGACY_DOMAINSERVICE
    \core


    ((((((((((((((((((((((((( Files Created from 2007-12-06 to 2008-01-06 )))))))))))))))))))))))))))))))
    .

    2008-01-05 16:44 . 2000-08-31 08:00 51,200 --a
    C:\WINDOWS\NirCmd.exe
    2007-12-22 19:22 . 2007-12-22 19:22 <DIR> d
    C:\Program Files\Trend Micro
    2007-12-22 18:55 . 1997-03-12 23:00 142,848
    C:\WINDOWS\SYSTEM32\Xceedzip.ocx
    2007-12-22 18:55 . 1998-07-30 01:00 90,728
    C:\WINDOWS\SYSTEM32\Cswsk32.ocx
    2007-12-22 18:55 . 2003-06-24 08:59 73,728
    C:\WINDOWS\SYSTEM32\ISUkrb32.dll
    2007-12-22 18:55 . 2002-07-05 15:21 69,632
    C:\WINDOWS\SYSTEM32\ScoutUtil.dll
    2007-12-22 18:55 . 1997-12-01 14:34 69,104
    C:\WINDOWS\SYSTEM32\Cstim32.ocx
    2007-12-22 18:55 . 1997-01-16 12:42 6,114
    C:\WINDOWS\SYSTEM32\ShellLnk.tlb
    2007-12-22 17:29 . 2007-12-22 17:29 <DIR> d
    C:\rscache
    2007-12-08 13:37 . 2007-10-10 17:55 6,065,664
    C:\WINDOWS\SYSTEM32\DLLCACHE\ieframe.dll
    2007-12-08 13:37 . 2007-04-17 03:32 2,455,488
    C:\WINDOWS\SYSTEM32\DLLCACHE\ieapfltr.dat
    2007-12-08 13:37 . 2007-03-07 23:10 991,232
    C:\WINDOWS\SYSTEM32\DLLCACHE\ieframe.dll.mui
    2007-12-08 13:37 . 2007-10-10 17:55 459,264
    C:\WINDOWS\SYSTEM32\DLLCACHE\msfeeds.dll
    2007-12-08 13:37 . 2007-10-10 17:55 383,488
    C:\WINDOWS\SYSTEM32\DLLCACHE\ieapfltr.dll
    2007-12-08 13:37 . 2007-10-10 17:55 267,776
    C:\WINDOWS\SYSTEM32\DLLCACHE\iertutil.dll
    2007-12-08 13:37 . 2007-10-10 17:55 63,488
    C:\WINDOWS\SYSTEM32\DLLCACHE\icardie.dll
    2007-12-08 13:37 . 2007-10-10 17:55 52,224
    C:\WINDOWS\SYSTEM32\DLLCACHE\msfeedsbs.dll
    2007-12-08 13:37 . 2007-10-10 04:59 13,824
    C:\WINDOWS\SYSTEM32\DLLCACHE\ieudinit.exe
    2007-12-08 13:20 . 2007-08-13 18:54 33,792 --a
    C:\WINDOWS\SYSTEM32\DLLCACHE\custsat.dll

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2007-12-24 15:33
    d
    w C:\Documents and Settings\Willa Kirts\Application Data\AVG7
    2007-12-23 00:55
    d
    w C:\Program Files\Scout
    2007-11-25 00:51
    d
    w C:\Documents and Settings\Willa Kirts\Application Data\Lavasoft
    2007-11-25 00:49
    d
    w C:\Program Files\Lavasoft
    2007-11-25 00:45
    d
    w C:\Program Files\Common Files\Wise Installation Wizard
    2007-11-23 18:31
    d
    w C:\Documents and Settings\All Users\Application Data\avg7
    2007-11-23 18:15
    d
    w C:\Documents and Settings\LocalService\Application Data\AVG7
    2007-11-23 18:13
    d
    w C:\Documents and Settings\All Users\Application Data\Grisoft
    2007-11-22 16:05
    d--h--w C:\Program Files\InstallShield Installation Information
    2007-11-22 16:04
    d
    w C:\Program Files\iPod
    2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
    2005-07-29 22:24 472 --sha-r C:\WINDOWS\V2lsbGEgIEtpcnRz\pZ5Pv3H0KHQDwBlW.vbs
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:56 15360]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ShStatEXE"="C:\Program Files\Network Associates\VirusScan\SHSTAT.exe" [2004-09-22 08:00 94208]
    "RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2004-06-03 23:45 26112]
    "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-11-24 09:10 98304]
    "PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2003-08-26 18:47 204800]
    "Network Associates Error Reporting Service"="C:\Program Files\Common Files\Network Associates\TalkBack\tbmon.exe" [2003-10-07 09:48 147514]
    "MMTray"="C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe" [2003-10-06 09:05 118784]
    "mmtask"="c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe" [2003-10-06 09:05 53248]
    "McAfeeUpdaterUI"="C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" [2005-12-07 03:55 131072]
    "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2005-05-04 17:21 278528]
    "IntelMeM"="C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-03 19:12 221184]
    "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-10-19 07:59 155648]
    "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-10-19 07:59 126976]
    "combofix"="C:\WINDOWS\system32\cmd.exe" [2004-08-04 01:56 388608]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    SideCar.lnk - C:\Program Files\MIT\Kerberos\bin\SideCar.exe [2006-11-25 12:46:36]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "SymWSC"=2 (0x2)
    "SNDSrvc"=2 (0x2)
    "SBService"=2 (0x2)
    "SAVScan"=3 (0x3)
    "navapsvc"=2 (0x2)
    "ccSetMgr"=2 (0x2)
    "ccPwdSvc"=3 (0x3)
    "ccProxy"=2 (0x2)
    "ccEvtMgr"=2 (0x2)


    *Newly Created Service* - ENTDRV51
    .
    Contents of the 'Scheduled Tasks' folder
    "2007-12-28 16:34:00 C:\WINDOWS\Tasks\Disk Cleanup.job"
    - C:\WINDOWS\SYSTEM32\cleanmgr.exe
    .
    **************************************************************************

    catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-01-05 19:40:04
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-01-05 19:46:19 - machine was rebooted [Willa Kirts]
    ComboFix-quarantined-files.txt 2008-01-06 01:46:12
    .
    2007-12-13 05:24:42 --- E O F ---

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 8:29:24 PM, on 1/5/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16574)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\LEXBCES.EXE
    C:\WINDOWS\system32\LEXPPS.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
    C:\Program Files\Network Associates\VirusScan\mcshield.exe
    C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
    C:\Program Files\Real\RealPlayer\RealPlay.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Dell\Media Experience\PCMService.exe
    C:\Program Files\Common Files\Network Associates\TalkBack\tbmon.exe
    C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
    C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
    C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\MIT\Kerberos\bin\SideCar.exe
    C:\Program Files\MIT\Kerberos\bin\krbcc32s.exe
    C:\Program Files\Trend Micro\scanner.exe\scanner.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.inebraska.com/
    O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
    O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
    O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\tbmon.exe"
    O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
    O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
    O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKUS\S-1-5-21-2983326078-1860911046-1423744002-1007\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User '?')
    O4 - Global Startup: SideCar.lnk = C:\Program Files\MIT\Kerberos\bin\SideCar.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
    O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
    O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\mcshield.exe
    O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\vstskmgr.exe

    --
    End of file - 4056 bytes
  • Baabiouz
    edited January 2008
    Hi!

    Please rename your Scanner.exe to Jkir.exe and run it. Please save the logfile and post back here ;)
  • jkir
    edited January 2008
    Here is the log after renaming to jkir:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 9:02:11 PM, on 1/6/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16574)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\LEXBCES.EXE
    C:\WINDOWS\system32\LEXPPS.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
    C:\Program Files\Network Associates\VirusScan\mcshield.exe
    C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
    C:\Program Files\Real\RealPlayer\RealPlay.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\WINDOWS\system32\fxssvc.exe
    C:\Program Files\Dell\Media Experience\PCMService.exe
    C:\Program Files\Common Files\Network Associates\TalkBack\tbmon.exe
    C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
    C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
    C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\MIT\Kerberos\bin\SideCar.exe
    C:\Program Files\MIT\Kerberos\bin\krbcc32s.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Trend Micro\scanner.exe\jkir.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.inebraska.com/
    O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
    O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
    O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\tbmon.exe"
    O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
    O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
    O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKUS\S-1-5-21-2983326078-1860911046-1423744002-1007\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User '?')
    O4 - Global Startup: SideCar.lnk = C:\Program Files\MIT\Kerberos\bin\SideCar.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
    O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
    O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\mcshield.exe
    O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\vstskmgr.exe

    --
    End of file - 4085 bytes
  • Baabiouz
    edited January 2008
    Hi!


    Please visit Virustotal
    * Click the Browse... button
    * Navigate to the file C:\WINDOWS\V2lsbGEgIEtpcnRz\pZ5Pv3H0KHQDwBlW.vbs
    * Click the Open button
    * Click the Send button
    * Copy and paste the results back here

    Have you uninstalled McAfee?
    What Firewall do you use?

    Please post Virustotal results back here in your next reply :)
  • jkir
    edited January 2008
    McAfee is still installed on this computer. It has the windows firewall that was installed from the factory.

    I went to the Virustotal site, but couldn't find this file on the browse:
    C:\WINDOWS\V2lsbGEgIEtpcnRz\pZ5Pv3H0KHQDwBlW.vbs


    Thanks.
    jkir
This discussion has been closed.