Trojan.Zlob clean up help needed please!!

David · August 2008

Yes, i was careless and downloaded a file embedded with this virus. I have followed all the steps in your website for...
Removing Trojan.Zlob in all its forms

by Robert Hallock published Aug 14, 2007.

I'm at the step down where I need help with the post clean up. Here are
the log files per the process. The one file I can't seem to upload is the "hijackthis log file. I keep getting "invalid file" error from the uploader. So I am now editing my original post and pasting the log file info to it rather than attaching the file

Please review and advise. Thank you so much for your help so far!!!

David

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:41: VIRUS ALERT!, on 8/9/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\PROMon.exe
C:\Program Files\lg_fwupdate\fwupdate.exe
C:\WINDOWS\GWMDMMSG.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\NMSSvc.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\Comporium\Caller ID on PC\CallerIDOnPC.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.gatewaybiz.com/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O4 - HKLM\..\Run: [XoftSpySE] C:\Program Files\XoftSpySE\xoftspy.exe -s
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [PROMon.exe] PROMon.exe
O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe" blrun
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [GWMDMMSG] GWMDMMSG.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Caller ID on PC.lnk = C:\Program Files\Comporium\Caller ID on PC\CallerIDOnPC.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: Yahoo! Spades - http://download2.games.yahoo.com/games/clients/y/st3_x.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {511073AD-BE56-4D43-AE68-93390514385E} (TechToolsActivex.TechTools) - hcp://system/TechTools.CAB
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1199246376890
O16 - DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} (RunExeActiveX.RunExe) - hcp://system/RunExeActiveX.CAB
O16 - DPF: {99CDFD87-F97A-42E1-9C13-D18220D90AD1} (StartFirstControl.CheckFirst) - hcp://system/StartFirstControl.CAB
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\system32\NMSSvc.exe
O23 - Service: PictureTaker - LANovation - C:\WINDOWS\System32\PCTKRNT.SYS
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: PrismXL - Lanovation - C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
O24 - Desktop Component 0: Privacy Protection - [URL]file:///C:\WINDOWS\privacy_danger\index.htm[/URL]
--
End of file - 7502 bytes

Katana · August 2008

Please note that all instructions given are customised for this computer only, the tools used may cause damage if used on a computer with different infections.

If you think you have similar problems, please post a log in the HJT forum and wait for help.

Hello and welcome to the forums

My name is Katana and I will be helping you to remove any infection(s) that you may have.

Please observe these rules while we work:
1. If you don't know, stop and ask! Don't keep going on.
2. Please reply to this thread. Do not start a new topic.
3. Please continue to respond until I give you the "All Clear"
(Just because you can't see a problem doesn't mean it isn't there)

If you can do those three things, everything should go smoothly

Please Note, your security programs may give warnings for some of the tools I will ask you to use.
Be assured, any links I give are safe

Malwarebytes' Anti-Malware

Please download Malwarebytes' Anti-Malware to your desktop.

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to
- Update Malwarebytes' Anti-Malware
- and Launch Malwarebytes' Anti-Malware
then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform full scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. please copy and paste the log into your next reply
- If you accidently close it, the log file is saved here and will be named like this:
- C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt

Installed Programs

Please could you give me a list of the programs that are installed.

Start HijackThis
Click on the Misc Tools button
Click on the Open Uninstall Manager button.

You will see a list with the programs installed in your computer.
Click on save list button and specify where you would like to save this file.
When you press Save button a notepad will open with the contents of that file.
Simply copy and paste the contents of that notepad into your next post.

David · August 2008

Thank you so much Latana! One more thing I noticed is my clock. It shows the time but right next to it says VIRUS ALERT! All software that I use shows times stamps fo completions of scans etc show VIRUS ALERT! right next to the time stamps.

Here is the data that you requested.

Malwarebyts's Log info...

Malwarebytes' Anti-Malware 1.24
Database version: 1038
Windows 5.1.2600 Service Pack 2
3:23:22 PM 8/10/2008
mbam-log-8-10-2008 (15-23-22).txt
Scan type: Full Scan (C:\|)
Objects scanned: 87401
Time elapsed: 1 hour(s), 4 minute(s), 35 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 5
Registry Values Infected: 1
Registry Data Items Infected: 4
Folders Infected: 11
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\tdss (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tdssserv (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VSPlugin (Trojan.FakeAlert) -> Quarantined and deleted successfully.
Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\0\source (Trojan.FakeAlert) -> Quarantined and deleted successfully.
Registry Data Items Infected:
HKEY_CURRENT_USER\Control Panel\International\sTimeFormat (Trojan.FakeAlert) -> Bad: (HH

VIRUS ALERT!) Good: (h

ss tt) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\StartMenuLogOff (Hijack.StartMenu) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives (Hijack.Drives) -> Bad: (12) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoToolbarCustomize (Hijack.Explorer) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
Folders Infected:
C:\Documents and Settings\Owner\Application Data\rhc1pcj0evc1 (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Application Data\rhc1pcj0evc1\Quarantine (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Application Data\rhc1pcj0evc1\Quarantine\Autorun (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Application Data\rhc1pcj0evc1\Quarantine\Autorun\HKCU (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Application Data\rhc1pcj0evc1\Quarantine\Autorun\HKCU\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Application Data\rhc1pcj0evc1\Quarantine\Autorun\HKLM (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Application Data\rhc1pcj0evc1\Quarantine\Autorun\HKLM\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Application Data\rhc1pcj0evc1\Quarantine\Autorun\StartMenuAllUsers (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Application Data\rhc1pcj0evc1\Quarantine\Autorun\StartMenuCurrentUser (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Application Data\rhc1pcj0evc1\Quarantine\BrowserObjects (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Application Data\rhc1pcj0evc1\Quarantine\Packages (Rogue.Multiple) -> Quarantined and deleted successfully.
Files Infected:
(No malicious items detected)

Hijackthis Uninstall Manager text info...

Ad-Aware
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)
Adobe Flash Player ActiveX
Adobe Reader 8.1.2
ATI - Software Uninstall Utility
ATI Catalyst Control Center
ATI Display Driver
Audit Support Center 1.0
Caller ID on PC
CDDRV_Installer
Command & Conquer 3
Command & Conquer Red Alert 2
Counter-Strike: Source
Counter-Strike: Source
Day of Defeat: Source
Do More 6.0
Driver Detective
DVD Solution
Free Games Offer, Desktop Shortcut
Gateway Desktop Manager
Gateway Download Assistant
Gateway Drivers and Applications Recovery
Gateway IE Customizations
Gateway Power Management
Google Earth
Google Updater
GTW V.92 Voicemodem
Half-Life 2: Deathmatch
Half-Life 2: Lost Coast
HelpSpot
HijackThis 2.0.2
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB914440)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB926239)
HP Document Viewer 7.0
HP Imaging Device Functions 7.0
HP Photosmart Essential
HP Photosmart Premier Software 6.5
HP Photosmart, Officejet and Deskjet 7.0.A
HP Solution Center 7.0
Intel Application Accelerator
Intel(R) PRO Ethernet Adapter and Software
Intel(R) Processor ID Utility
Intel(R) PROSet II
J2SE Runtime Environment 5.0 Update 11
Java(TM) 6 Update 5
Java(TM) 6 Update 7
Kaspersky Internet Security 7.0
Kaspersky Internet Security 7.0
KhalInstallWrapper
LG ODD Auto Firmware Update
Logitech Harmony Remote Software 7
Logitech SetPoint
Malwarebytes' Anti-Malware
Malwarebytes' RogueRemover
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Halo
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
Microsoft National Language Support Downlevel APIs
Microsoft Office Standard Edition 2003
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 Parser and SDK
Multimedia Launcher
Nero OEM
OCR Software by I.R.I.S 7.0
Panda ActiveScan 2.0
PC-Doctor for Windows
PhoneTools
PowerDVD
PowerProducer
RealPlayer Basic
RegCure 1.5.0.0
Remote Control USB Driver
Security Update for CAPICOM (KB931906)
Security Update for CAPICOM (KB931906)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 8 (KB917734)
Security Update for Windows Media Player 9 (KB911565)
Security Update for Windows Media Player 9 (KB936782)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933729)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB938127)
Security Update for Windows XP (KB938829)
Security Update for Windows XP (KB941202)
Security Update for Windows XP (KB941568)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB941644)
Security Update for Windows XP (KB941693)
Security Update for Windows XP (KB942615)
Security Update for Windows XP (KB943055)
Security Update for Windows XP (KB943460)
Security Update for Windows XP (KB943485)
Security Update for Windows XP (KB944653)
Security Update for Windows XP (KB945553)
Security Update for Windows XP (KB946026)
Security Update for Windows XP (KB948590)
Security Update for Windows XP (KB948881)
Security Update for Windows XP (KB950749)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Spybot - Search & Destroy
SpywareBlaster 4.1
Steam(TM)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB904942)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB927891)
Update for Windows XP (KB930916)
Update for Windows XP (KB932823-v3)
Update for Windows XP (KB936357)
Update for Windows XP (KB938828)
Update for Windows XP (KB942763)
Ventrilo Client
Westwood Shared Internet Components
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
Windows XP Service Pack 2
WinZip 11.1
XoftSpySE

Thanks, David

Katana · August 2008

Download and Run ComboFix (by sUBs)
Please visit this webpage for instructions for downloading and running ComboFix:

Bleeping Computer ComboFix Tutorial

Post the log from ComboFix when you've accomplished that, along with a new HijackThis log.

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own. This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper

David · August 2008

Katana,

I apparently goofed up on the first precautionary piece of the Windows Recovery instructions from bleepingcomputer.com. I could not create the Windows Recovery from my original Windows CD as it is Windows original version, I have service Pak 2. I was instructed to go to the Windows site and download the Recovery Program for Service Pak 2. I saved that to my desk top and per the directions from bleepingcomputer.com, I dragged the Icon for the Recovery program over top of the ComboFix Icon. Once I did that, the program started up. I thought per the instructions it would not only add the Recovery Program as a boot up option (which it did) but that it would walk me through creating the back up floppy disks. It did not, rather started working on scanning. At that point I was worried as I had no Recovery Disks, but I could not stop the process, too late.

For my second goof up, on this first run of Combofix I forgot to turn off my Kasperskis program (sorry!). Combofix went through the motions (step 1 through 48) but did not display the log file. My computer then turned off and back on, then the auto checkdisk program wanted to run, I did not stop it so it ran. The computer booted up, I saw a quick flash of a Combofix screen, but only for a second. It never came back up. I let the computer set there for 15 minutes, nothing happened so I went and found the ComboFix log file at C:\ComboFix.txt. The log showed that I had the virus protection on, no other log listings, so it must have errored out. I am attaching that log screen first. I then turned off my virus protection and ran ComboFix again. The 2nd set of data is from that log file. Finally I ran a new HijackThis log. It is below as well. I hope I'm ok, the computer seems to be running fine.

Your next instructions?

Thanks, David

1st ComboFix Log

ComboFix 08-08-10.02 - Owner 2008-08-10 18:53:05.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.632 [GMT -4:00]
Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Owner\Desktop\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
* Created a new restore point
* Resident AV is active

2nd ComboFix Log

ComboFix 08-08-10.02 - Owner 2008-08-10 19:29:11.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.689 [GMT -4:00]
Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

\Legacy_TDSSSERV

((((((((((((((((((((((((( Files Created from 2008-07-10 to 2008-08-10 )))))))))))))))))))))))))))))))
.
2008-08-10 19:03 . 2008-08-10 19:03 <DIR> d--hs---- C:\found.015
2008-08-10 14:04 . 2008-08-10 14:04 <DIR> d

C:\Program Files\Malwarebytes' Anti-Malware
2008-08-10 14:04 . 2008-08-10 14:04 <DIR> d

C:\Documents and Settings\Owner\Application Data\Malwarebytes
2008-08-10 14:04 . 2008-08-10 14:04 <DIR> d

C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-10 14:04 . 2008-07-30 20:07 38,472 --a

C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-10 14:04 . 2008-07-30 20:07 17,144 --a

C:\WINDOWS\system32\drivers\mbam.sys
2008-08-09 17:38 . 2008-08-09 17:38 <DIR> d

C:\Documents and Settings\All Users\Application Data\PC Drivers HeadQuarters
2008-08-09 17:19 . 2008-08-09 17:31 <DIR> d

C:\WINDOWS\system32\NtmsData
2008-08-09 14:08 . 2008-08-09 14:08 <DIR> d

C:\Program Files\Trend Micro
2008-08-09 09:51 . 2008-08-09 09:51 <DIR> d

C:\Program Files\Panda Security
2008-08-09 09:51 . 2008-06-19 17:24 28,544 --a

C:\WINDOWS\system32\drivers\pavboot.sys
2008-08-09 09:31 . 2008-08-09 15:42 <DIR> d

C:\Program Files\SpywareBlaster
2008-08-09 09:31 . 2008-08-10 19:28 <DIR> d-a

C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-09 05:27 . 2008-08-09 05:27 <DIR> d

C:\Program Files\Spybot - Search & Destroy
2008-08-09 05:27 . 2008-08-09 16:52 <DIR> d

C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-08-09 05:04 . 2008-08-09 05:04 <DIR> d--hs---- C:\found.014
2008-08-09 04:29 . 2008-08-09 04:29 <DIR> d

C:\Program Files\Lavasoft
2008-08-09 04:29 . 2008-08-09 04:30 <DIR> d

C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-08-09 03:52 . 2008-08-09 03:52 <DIR> d

C:\Documents and Settings\Administrator
2008-08-09 03:47 . 2008-08-09 03:57 <DIR> d

C:\Program Files\RogueRemover FREE
2008-08-09 03:29 . 2008-08-09 03:29 <DIR> d--hs---- C:\found.013
2008-08-09 03:23 . 2008-08-09 03:23 <DIR> d--hs---- C:\found.012
2008-08-09 00:46 . 2008-08-09 00:46 <DIR> d--hs---- C:\found.011
2008-08-08 03:01 . 2008-08-08 03:01 <DIR> d--hs---- C:\found.010
2008-08-08 02:25 . 2008-08-08 03:12 1,972 --a

C:\WINDOWS\system32\tmp.reg
2008-08-08 02:07 . 2008-08-09 06:11 <DIR> d

C:\Program Files\Enigma Software Group
2008-08-08 01:28 . 2008-08-08 01:28 <DIR> d

C:\Documents and Settings\Test\Application Data\TmpRecentIcons
2008-08-08 01:28 . 2008-08-08 01:28 <DIR> d

C:\Documents and Settings\Test\Application Data\ATI
2008-08-08 01:26 . 2008-08-08 04:24 <DIR> d

C:\Documents and Settings\Test
2008-08-07 23:41 . 2008-08-08 00:09 23,392 --a

C:\WINDOWS\system32\nscompat.tlb
2008-08-07 23:41 . 2008-08-08 00:09 16,832 --a

C:\WINDOWS\system32\amcompat.tlb
2008-08-07 23:39 . 2008-08-07 23:39 <DIR> d--hs---- C:\found.009
2008-08-07 22:22 . 2004-08-04 03:56 221,184 --a

C:\WINDOWS\system32\wmpns.dll
2008-08-07 20:10 . 2008-08-07 20:10 <DIR> d--hs---- C:\found.008
2008-07-28 01:59 . 2008-07-28 02:18 24,200 --ah

C:\WINDOWS\system32\PROSetp.GID
2008-07-20 00:55 . 2008-08-08 03:32 <DIR> d

C:\Program Files\XoftSpySE
2008-07-20 00:36 . 2008-07-20 00:50 <DIR> d

C:\Program Files\RegCure
2008-07-13 21:12 . 2008-07-13 21:12 <DIR> d

C:\Documents and Settings\Owner\Application Data\Ventrilo
2008-07-13 21:11 . 2008-07-13 21:11 <DIR> d

C:\Program Files\Ventrilo
2008-07-13 21:11 . 2008-08-09 04:27 <DIR> d

C:\Program Files\Common Files\Wise Installation Wizard
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-10 23:34 599,072 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-08-10 23:34 19,441,440 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-08-10 23:26

d

w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-08-10 22:58 57,044 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-08-10 22:58 261,188 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-08-10 10:18

d

w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-08-09 22:28

d--h--w C:\Program Files\InstallShield Installation Information
2008-08-09 20:40

d

w C:\Program Files\lg_fwupdate
2008-08-09 16:50

d

w C:\Program Files\Java
2008-08-08 04:32 96,976 ----a-w C:\WINDOWS\system32\drivers\klin.dat
2008-08-05 05:16

d

w C:\Program Files\Google
2008-07-25 07:22 87,855 ----a-w C:\WINDOWS\system32\drivers\klick.dat
2008-07-20 01:11

d

w C:\Program Files\Steam
2008-07-09 23:39

d

w C:\Documents and Settings\All Users\Application Data\LogiShrd
2008-07-09 23:33 0 ---ha-w C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-07-09 23:33 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
2008-07-09 23:30

d

w C:\Program Files\Common Files\Logishrd
2008-07-09 23:29

d

w C:\Program Files\Common Files\Logitech
2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-15 02:59

d

w C:\Documents and Settings\Owner\Application Data\Command & Conquer 3 Tiberium Wars
2008-06-15 02:54 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-06-15 01:46

d--h--r C:\Documents and Settings\Owner\Application Data\SecuROM
2008-06-15 01:33

d

w C:\Program Files\Electronic Arts
2008-06-13 13:10 272,128

w C:\WINDOWS\system32\drivers\bthport.sys
2008-05-16 15:58 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe
2004-10-01 20:00 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:56 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-02-29 03:12 76304 C:\WINDOWS\KHALMNPR.Exe]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Caller ID on PC.lnk - C:\Program Files\Comporium\Caller ID on PC\CallerIDOnPC.exe [2007-10-16 15:34:54 4145315]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2008-05-02 02:42 72208 c:\Program Files\Common Files\Logitech\Bluetooth\LBTWLgn.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""
path=
backup=
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Photosmart Premier Fast Start.lnk]
backup=C:\WINDOWS\pss\HP Photosmart Premier Fast Start.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech SetPoint.lnk]
backup=C:\WINDOWS\pss\Logitech SetPoint.lnkCommon Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lphc5pcj0evc1
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMrhc1pcj0evc1
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a

2008-01-11 23:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a

2001-07-09 11:50 155648 C:\WINDOWS\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--a

2004-11-02 21:24 32768 C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
--a

2008-04-05 20:11 1271032 c:\Program Files\Steam\steam.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a

2008-02-22 04:25 144784 C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"GWMDMMSG"=GWMDMMSG.exe
"LGODDFU"="C:\Program Files\lg_fwupdate\fwupdate.exe" blrun
"PROMon.exe"=PROMon.exe
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
"XoftSpySE"=C:\Program Files\XoftSpySE\xoftspy.exe -s
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"C:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"=
"C:\\Program Files\\Comporium\\Caller ID on PC\\CallerIDOnPC.exe"=
"C:\\Program Files\\Electronic Arts\\Command & Conquer 3\\RetailExe\\1.9\\cnc3game.dat"=
R0 pavboot;pavboot;C:\WINDOWS\system32\drivers\pavboot.sys [2008-06-19 17:24]
R2 LBeepKE;LBeepKE;C:\WINDOWS\system32\Drivers\LBeepKE.sys [2006-06-30 01:53]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-04-04 14:58]
S3 PCDRDRV;Pcdr Helper Driver;C:\PROGRA~1\PC-DOC~1\DIAGNO~1\PCDRDRV.sys []
.
Contents of the 'Scheduled Tasks' folder
2008-08-10 C:\WINDOWS\Tasks\RegCure Program Check.job
- C:\Program Files\RegCure\RegCure.exe [2007-08-14 17:10]
2008-08-10 C:\WINDOWS\Tasks\RegCure.job
- C:\Program Files\RegCure\RegCure.exe [2007-08-14 17:10]
2008-08-10 C:\WINDOWS\Tasks\XoftSpySE 2.job
- C:\Program Files\XoftSpySE\XoftSpy.exe [2008-07-16 15:17]
2008-08-10 C:\WINDOWS\Tasks\XoftSpySE.job
- C:\Program Files\XoftSpySE\XoftSpy.exe [2008-07-16 15:17]
.
.

Supplementary Scan

.
R0 -: HKCU-Main,Start Page = hxxp://www.msn.com
R0 -: HKLM-Main,Start Page = hxxp://www.msn.com
R1 -: HKCU-Internet Connection Wizard,ShellNext = hxxp://www.gatewaybiz.com/
O16 -: DirectAnimation Java Classes - [URL]file://C:\WINDOWS\Java\classes\dajava.cab[/URL]
C:\WINDOWS\Downloaded Program Files\DirectAnimation Java Classes.osd
O16 -: Microsoft XML Parser for Java - [URL]file://C:\WINDOWS\Java\classes\xmldso.cab[/URL]
C:\WINDOWS\Downloaded Program Files\Microsoft XML Parser for Java.osd
O16 -: {511073AD-BE56-4D43-AE68-93390514385E} - hcp://system/TechTools.CAB
C:\WINDOWS\Downloaded Program Files\TechTools.INF
C:\WINDOWS\system32\scrrun.dll
C:\WINDOWS\system32\msvcrt.dll
C:\WINDOWS\system32\MSSTKPRP.DLL
C:\WINDOWS\system32\msvbvm60.dll
C:\WINDOWS\system32\oleaut32.dll
C:\WINDOWS\system32\olepro32.dll
C:\WINDOWS\system32\asycfilt.dll
C:\WINDOWS\system32\stdole2.tlb
C:\WINDOWS\system32\comcat.dll
C:\WINDOWS\Downloaded Program Files\TechTools.ocx

**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-10 19:34:38
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-08-10 19:38:34
ComboFix-quarantined-files.txt 2008-08-10 23:38:13
Pre-Run: 11,754,032,128 bytes free
Post-Run: 11,741,849,088 bytes free
207 --- E O F --- 2008-07-09 23:51:56

Fresh HijackThis Log...

Ad-Aware
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)
Adobe Flash Player ActiveX
Adobe Reader 8.1.2
ATI - Software Uninstall Utility
ATI Catalyst Control Center
ATI Display Driver
Audit Support Center 1.0
Caller ID on PC
CDDRV_Installer
Command & Conquer 3
Command & Conquer Red Alert 2
Counter-Strike: Source
Counter-Strike: Source
Day of Defeat: Source
Do More 6.0
Driver Detective
DVD Solution
Free Games Offer, Desktop Shortcut
Gateway Desktop Manager
Gateway Download Assistant
Gateway Drivers and Applications Recovery
Gateway IE Customizations
Gateway Power Management
Google Earth
Google Updater
GTW V.92 Voicemodem
Half-Life 2: Deathmatch
Half-Life 2: Lost Coast
HelpSpot
HijackThis 2.0.2
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB914440)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB926239)
HP Document Viewer 7.0
HP Imaging Device Functions 7.0
HP Photosmart Essential
HP Photosmart Premier Software 6.5
HP Photosmart, Officejet and Deskjet 7.0.A
HP Solution Center 7.0
Intel Application Accelerator
Intel(R) PRO Ethernet Adapter and Software
Intel(R) Processor ID Utility
Intel(R) PROSet II
J2SE Runtime Environment 5.0 Update 11
Java(TM) 6 Update 5
Java(TM) 6 Update 7
Kaspersky Internet Security 7.0
Kaspersky Internet Security 7.0
KhalInstallWrapper
LG ODD Auto Firmware Update
Logitech Harmony Remote Software 7
Logitech SetPoint
Malwarebytes' Anti-Malware
Malwarebytes' RogueRemover
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Halo
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
Microsoft National Language Support Downlevel APIs
Microsoft Office Standard Edition 2003
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 Parser and SDK
Multimedia Launcher
Nero OEM
OCR Software by I.R.I.S 7.0
Panda ActiveScan 2.0
PC-Doctor for Windows
PhoneTools
PowerDVD
PowerProducer
RealPlayer Basic
RegCure 1.5.0.0
Remote Control USB Driver
Security Update for CAPICOM (KB931906)
Security Update for CAPICOM (KB931906)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 8 (KB917734)
Security Update for Windows Media Player 9 (KB911565)
Security Update for Windows Media Player 9 (KB936782)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933729)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB938127)
Security Update for Windows XP (KB938829)
Security Update for Windows XP (KB941202)
Security Update for Windows XP (KB941568)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB941644)
Security Update for Windows XP (KB941693)
Security Update for Windows XP (KB942615)
Security Update for Windows XP (KB943055)
Security Update for Windows XP (KB943460)
Security Update for Windows XP (KB943485)
Security Update for Windows XP (KB944653)
Security Update for Windows XP (KB945553)
Security Update for Windows XP (KB946026)
Security Update for Windows XP (KB948590)
Security Update for Windows XP (KB948881)
Security Update for Windows XP (KB950749)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Spybot - Search & Destroy
SpywareBlaster 4.1
Steam(TM)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB904942)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB927891)
Update for Windows XP (KB930916)
Update for Windows XP (KB932823-v3)
Update for Windows XP (KB936357)
Update for Windows XP (KB938828)
Update for Windows XP (KB942763)
Ventrilo Client
Westwood Shared Internet Components
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
Windows XP Service Pack 2
WinZip 11.1
XoftSpySE

Katana · August 2008

With the recovery console that ComboFix installs you don't need any other recovery disks

Custom CFScript

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

KillAll::
Driver::
PCDRDRV
Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lphc5pcj0evc1]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMrhc1pcj0evc1]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
ADS::

Save this as CFScript.txt and place it on your desktop.
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it will produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own. This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper

Update Adobe Acrobat Reader

There is a newer version of Adobe Acrobat Reader available.

Please go to this link Adobe Acrobat Reader Download Link
Click Download
On the right Untick Adobe Phototshop Album Starter Edition if you do not wish to include this in the installation.
Click the Continue button
Click Run, and click Run again
Next click the Install Now button and follow the on screen prompts

Now click Start---Control Panel. Double click Add or Remove Programs (XP) / Programs and Features (Vista) . If any of the following programs are listed there,
click on the program to highlight it, and click on remove.

J2SE Runtime Environment 5.0 Update 11
Java(TM) 6 Update 5

Now close the Control Panel.

Active Scan
Your Antivirus and/or Antispyware may give a warning during the scan. This is perfectly normal
NOTE:- Vista users should start IE by Start(Vista Orb) >> Internet Explorer >> Right-Click Run As Admin
Please go to this site Link >> ActiveScan << LINK

Click the Scan Now button
Follow the prompts to install the Active X if necessary
Go and make a cup of tea/coffee/beverage of your choice and watch some TV
When the scan is finished, a report will be generated
Next to Scan Details click the small Save button and save the report to your desktop.
Please post the report in your reply.

Logs/Information to Post in Reply
Please post the following logs/Information in your reply

ComboFix Log
A Fresh HJT Log (not an installed Programs list)
Active Scan Log
How are things running now ?

David · August 2008

Katana, after I sent the last data to you, I rebooted my computer and I had a couple of problems. IE Explorer 7 would not open. I double click on the Icon and I got an hour glass cursor for 2 seconds, then the hour glass went away and IE Explorer never came up. I eneded up having to remove IE Explorer 7 from my program files. Then I guess the system reverted back to IE Explorer 6. I clicked on that Icon and I was then able to get to the internet. I then downloaded IE 7 and all its updates and it is now woking fine.

Another problem. I kept getting an error when opening MS Outlook, control panel settings etc. There were two errors that bounced back and forth continuously when I would hit the "ok" button. This was contiuous until I would ctrl alt delete and go to the program running, KAV something, then I would right click to go to the process and kill the process. This was the only way I could do anything other than listen to the 2 error messages "bonk" back and forth.

Here are the two error messages

1) The application or DLL C:\windows\system32\jscript.dll is a non valid windows image. Please check this against your installation diskette

I would then hit "ok" and I would get...

2) KAV checker screen
cannot load library for language Jscript Path c:\windows\system32\jscript.dll

Please contact Kaspersy lab for the solution (err000000c1)

I hit "ok" and it goes back to the first error message and the process repeats eternally. Again, had to ctrl alt delete and go to the program running, KAV something, then I would right click, select go to process and then I would kill the process. This was the only way I could do anything other than listen to the 2 error messages "bonk" back and forth.

Since the first message said the file was a non valid windows image and the second message said it was a Kaspersky related file, I took a risk and went to windows explorer, found the file and deleted it. The error messages went away then. I left the file in my trash can for future reference, to reinstall if you tell me too. I then decided to uninstall Kaspersky and reinstall it.

After doing these two actions (uninstall and reinstall IE 7, uninstall and reinstall Kaspersky) I was back up and running.

Any input on this?

By the way, my system seems to be running far better now, thank you. I would like assistance on making it boot up faster and run games faster as it seems a little slow booting up, maybe all the crap I have starting up and back ground process. But I dont know waht to kill and how to kill it.

Now back to your last request. Here are the data files you requested.

Thanks, David

ComboFix 08-08-10.05 - Owner 2008-08-11 14:11:54.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.673 [GMT -4:00]
Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Owner\Desktop\CFScript.txt
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run

.
C:\WINDOWS\system32\tdssinit.dll
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

\Service_PCDRDRV

((((((((((((((((((((((((( Files Created from 2008-07-11 to 2008-08-11 )))))))))))))))))))))))))))))))
.
2008-08-11 13:26 . 2008-08-11 13:26 <DIR> d--hs---- C:\found.017
2008-08-11 02:34 . 2008-08-11 02:34 <DIR> d

C:\tmp
2008-08-11 02:32 . 2008-08-11 02:32 0 --a

C:\_test.html
2008-08-11 02:22 . 2003-09-19 19:54 315,392 --a

C:\WINDOWS\1ClickImageExtractor.exe
2008-08-11 02:22 . 2003-09-19 19:54 139,264 --a

C:\WINDOWS\1cie.dll
2008-08-11 02:22 . 2003-09-19 19:51 126,976 --a

C:\WINDOWS\ieiebho.dll
2008-08-11 02:21 . 2008-08-11 02:21 <DIR> d

C:\_ok2delete
2008-08-11 00:14 . 2008-08-11 00:22 96,976 --a

C:\WINDOWS\system32\drivers\klin.dat
2008-08-11 00:14 . 2008-08-11 00:22 87,855 --a

C:\WINDOWS\system32\drivers\klick.dat
2008-08-11 00:13 . 2008-08-11 00:13 <DIR> d

C:\Program Files\Kaspersky Lab
2008-08-11 00:13 . 2008-08-11 14:22 3,429,920 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-08-11 00:13 . 2008-08-11 14:17 46,988 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-08-11 00:13 . 2008-08-11 14:18 25,120 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2008-08-11 00:13 . 2008-08-11 14:17 3,380 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx
2008-08-10 20:48 . 2008-08-10 20:48 <DIR> d--hs---- C:\found.016
2008-08-10 19:03 . 2008-08-10 19:03 <DIR> d--hs---- C:\found.015
2008-08-10 14:04 . 2008-08-10 14:04 <DIR> d