Options

Virus Alert Next to clock in taskbar: similar

Unknown
edited September 2008 in Spyware & Virus Removal
I am running windows xp service pack 3 and I recently downloaded an active x plugin which when enabled let a whole load of unwanted spyware an malware into my system :(

I used CA antivirus and antispyware to get rid of what I could, although i am still left with "VIRUS ALERT!" next to my clock on the task bar, and a lot of my shortcuts are missing including my hard drive icons in My Computer, making it rather annoying to access my hard drives. There are also icons missing from my start menu e.g. control panel. I don't have the run command in my start menu, even in safe mde. The c: drive is not visible either. It sems like it really has blocke dme out from doing anything. I can't connect to theweb either. Anything I do has to come from my USB drive. It keeps coming up with Antivirus XP 2008 and Reg Cure. It also says that antivirus found 1609 viruses on my computer. When all this malware was getting into my system I stopped the process midway through. It did want $118 for antivirus removal tool and all sorts of virus scare tactics. Any suggestions as to where to start?

Thanks, Bob

Comments

  • KatanaKatana
    edited August 2008
    Please note that all instructions given are customised for this computer only, the tools used may cause damage if used on a computer with different infections.

    If you think you have similar problems, please post a log in the HJT forum and wait for help.
    Hello and welcome to the forums

    My name is Katana and I will be helping you to remove any infection(s) that you may have.

    Please observe these rules while we work:
    1. If you don't know, stop and ask! Don't keep going on.
    2. Please reply to this thread. Do not start a new topic.
    3. Please continue to respond until I give you the "All Clear"
    (Just because you can't see a problem doesn't mean it isn't there)

    If you can do those three things, everything should go smoothly :D

    Please Note, your security programs may give warnings for some of the tools I will ask you to use.
    Be assured, any links I give are safe


    Malwarebytes' Anti-Malware

    Please download Malwarebytes' Anti-Malware to your desktop.

    • Double-click mbam-setup.exe and follow the prompts to install the program.
    • At the end, be sure a checkmark is placed next to
      • Update Malwarebytes' Anti-Malware
      • and Launch Malwarebytes' Anti-Malware
    • then click Finish.
    • If an update is found, it will download and install the latest version.
    • Once the program has loaded, select Perform full scan, then click Scan.
    • When the scan is complete, click OK, then Show Results to view the results.
    • Be sure that everything is checked, and click Remove Selected.
    • When completed, a log will open in Notepad. please copy and paste the log into your next reply
      • If you accidently close it, the log file is saved here and will be named like this:
      • C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt


    Click here to download HJTinstall.exe
    • Save HJTinstall.exe to your desktop.
    • Double click on the HJTinstall.exe icon on your desktop.
    • By default it will install to C:\Program Files\Trend Micro\Hijack This.
    • Click I accept
    • Click on the Do a system scan and save a log file button. It will scan and then ask you to save the log.
    • Click Save to save the log file and then the log will open in notepad.
    • Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
    • Come back here to this thread and Paste the log in your next reply.
    • DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required.



    Installed Programs

    Please could you give me a list of the programs that are installed.
    • Start HijackThis
    • Click on the Misc Tools button
    • Click on the Open Uninstall Manager button.

    You will see a list with the programs installed in your computer.
    Click on save list button and specify where you would like to save this file.
    When you press Save button a notepad will open with the contents of that file.
    Simply copy and paste the contents of that notepad into your next post.
  • BobZ
    edited August 2008
    Below as requested. Just a note, I was able to get most things onthe startup to appear again except for the programs list. Also, in My Computer, it does not see the C: drive.

    - Logfile of Trend Micro HijackThis v2.0.2
    - Scan saved at 19:02: VIRUS ALERT!, on 8/14/2008
    - Platform: Windows XP SP3 (WinNT 5.01.2600)
    - MSIE: Internet Explorer v7.00 (7.00.6000.16705)
    - Boot mode: Normal
    -
    - Running processes:
    - C:\WINDOWS\System32\smss.exe
    - C:\WINDOWS\system32\winlogon.exe
    - C:\WINDOWS\system32\services.exe
    - C:\WINDOWS\system32\lsass.exe
    - C:\WINDOWS\system32\svchost.exe
    - C:\WINDOWS\Explorer.EXE
    - C:\WINDOWS\system32\ctfmon.exe
    - C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
    - C:\WINDOWS\system32\explorer32\winsysmngr32.exe
    - C:\WINDOWS\SOUNDMAN.EXE
    - C:\Program Files\QuickTime\qttask.exe
    - C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
    - C:\WINDOWS\system32\LVCOMSX.EXE
    - C:\Program Files\Logitech\Video\LogiTray.exe
    - C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
    - C:\Program Files\Internet Explorer\IEXPLORE.EXE
    - C:\WINDOWS\system32\hphmon05.exe
    - C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
    - C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
    - C:\Program Files\Logitech\Video\FxSvr2.exe
    - C:\WINDOWS\system32\dla\tfswctrl.exe
    - C:\Program Files\Brother\ControlCenter2\brctrcen.exe
    - C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe
    - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe
    - C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfasem.exe
    - C:\Program Files\rhc99pj0e78t\rhc99pj0e78t.exe
    - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
    - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\CAPPActiveProtection.exe
    - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    - C:\Program Files\Messenger\msmsgs.exe
    - C:\Program Files\Logitech\Video\ManifestEngine.exe
    - C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    - C:\WINDOWS\system32\pphcc9pj0e78t.exe
    - C:\WINDOWS\system32\wpabaln.exe
    - C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    -
    - R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
    - R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    - R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    - R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    - R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    - R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    - R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    - R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
    - R3 - URLSearchHook: (no name) - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file)
    - O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
    - O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    - O2 - BHO: QXK Olive - {36D92B01-22BC-4FB7-A7AC-C574873FDDBE} - C:\WINDOWS\mesdxbrqmnx.dll
    - O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
    - O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    - O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    - O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    - O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    - O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
    - O2 - BHO: CA Toolbar Helper - {FBF2401B-7447-4727-BE5D-C19B2075CA84} - C:\Program Files\CA\CA Internet Security Suite\CA Website Inspector\Toolbar\CallingIDIE.dll
    - O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
    - O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    - O3 - Toolbar: CA Toolbar - {10134636-E7AF-4AC5-A1DC-C7C44BB97D81} - C:\Program Files\CA\CA Internet Security Suite\CA Website Inspector\Toolbar\CallingIDIE.dll
    - O3 - Toolbar: (no name) - {ABA69CF4-20FB-42CE-BB6D-B6171D64B8EC} - (no file)
    - O4 - HKLM\..\Run: [Winload32] C:\WINDOWS\system32\explorer32\winload32.exe
    - O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
    - O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
    - O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    - O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl04g\BrStDvPt.exe
    - O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    - O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    - O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    - O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
    - O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
    - O4 - HKLM\..\Run: [lphcc9pj0e78t] C:\WINDOWS\system32\lphcc9pj0e78t.exe
    - O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
    - O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
    - O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    - O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
    - O4 - HKLM\..\Run: [ISUSPM Startup] c:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
    - O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
    - O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    - O4 - HKLM\..\Run: [HPHUPD05] C:\Program Files\Hewlett-Packard\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\hphupd05.exe
    - O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe
    - O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
    - O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
    - O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
    - O4 - HKLM\..\Run: [ErrorSmart] C:\Program Files\ErrorSmart\ErrorSmart.exe
    - O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
    - O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun
    - O4 - HKLM\..\Run: [cctray] "C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe"
    - O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe"
    - O4 - HKLM\..\Run: [capfupgrade] C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfupgrade.exe
    - O4 - HKLM\..\Run: [capfasem] C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfasem.exe
    - O4 - HKLM\..\Run: [cafwc] C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\cafw.exe -cl
    - O4 - HKLM\..\Run: [cafw] C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\cafw.exe -cl
    - O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
    - O4 - HKLM\..\Run: [SMrhc99pj0e78t] C:\Program Files\rhc99pj0e78t\rhc99pj0e78t.exe
    - O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    - O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    - O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    - O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
    - O4 - HKUS\S-1-5-21-484763869-1326574676-725345543-1004\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User '?')
    - O4 - HKUS\S-1-5-21-484763869-1326574676-725345543-1004\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User '?')
    - O4 - HKUS\S-1-5-21-484763869-1326574676-725345543-1004\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User '?')
    - O4 - HKUS\S-1-5-21-484763869-1326574676-725345543-1004\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot (User '?')
    - O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    - O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    - O4 - Global Startup: Forget Me Not.lnk = C:\Program Files\Broderbund\AG CreataCard\AGRemind.exe
    - O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    - O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    - O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
    - O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    - O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    - O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    - O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    - O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    - O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    - O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    - O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
    - O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
    - O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
    - O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-CA/a-UNO1/GAME_UNO1.cab
    - O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1181299664265
    - O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1186441192031
    - O16 - DPF: {6F750203-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://www.kodakgallery.ca/downloads/BUM/BUM_WIN_IE_2/axofupld.cab
    - O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
    - O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    - O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    - O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://investools.webex.com/client/T25LSP41EP6/event/ieatgpc.cab
    - O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
    -
    - --
    - End of file - 11735 bytes


    3D MP3 Sound Recorder 3.8.15 DS
    AC3Filter (remove only)
    Ad-Aware
    Adobe Flash Player ActiveX
    Adobe Photoshop 6.0
    Adobe Reader 7.1.0
    Adobe Reader Chinese Simplified Fonts
    Adobe Reader Japanese Fonts
    American Greetings?CreataCard?Gold 5
    AnswerWorks 5.0 English Runtime
    AntivirXP08
    A-PDF Merger 3.0
    Apple Mobile Device Support
    Apple Software Update
    ATI - Software Uninstall Utility
    ATI Display Driver
    BB FlashBack
    BB FlashBack
    Brother MFL-Pro Suite
    CA Anti-Spyware
    CA Anti-Virus
    CA Internet Security Suite
    CA Pest Patrol Realtime Protection
    CA Website Inspector
    Command & Conquer Red Alert 2
    Cucusoft Ultimate DVD + Video Converter Suite 7.13.7.7
    DVD-CLONER V5.30 Build 969
    ErrorSmart
    EZ Vinyl Converter 2.0.0 by MixMeister
    Google Toolbar for Internet Explorer
    Google Toolbar for Internet Explorer
    HijackThis 2.0.2
    Hotfix for Windows Internet Explorer 7 (KB947864)
    Hotfix for Windows Media Format 11 SDK (KB929399)
    Hotfix for Windows Media Player 11 (KB939683)
    Hotfix for Windows XP (KB952287)
    HP Memories Disc
    HP Software Update
    InterVideo WinDVD 4
    InterVideo WinDVD Creator 2
    iolo technologies' Search and Recover 4
    iPod for Windows 2005-10-12
    IrfanView (remove only)
    iTunes
    Java(TM) 6 Update 2
    Java(TM) 6 Update 3
    Java(TM) SE Runtime Environment 6 Update 1
    Logitech Print Service
    Logitech QuickCam Software
    Logitech?Camera Driver
    Macrogaming SweetIM 2.1
    Malwarebytes' Anti-Malware
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 Hotfix (KB928366)
    Microsoft .NET Framework 2.0 Service Pack 1
    Microsoft .NET Framework 3.0 Service Pack 1
    Microsoft Base Smart Card Cryptographic Service Provider Package
    Microsoft Compression Client Pack 1.0 for Windows XP
    Microsoft Internationalized Domain Names Mitigation APIs
    Microsoft MPEG-4 VKI Video Codec V1/V2/V3
    Microsoft National Language Support Downlevel APIs
    Microsoft Office 2000 SR-1 Professional
    Microsoft Office Live Meeting 2005 Replay Wrapper
    Microsoft Silverlight
    Microsoft User-Mode Driver Framework Feature Pack 1.0
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Web Publishing Wizard 1.52
    Mozilla Firefox (2.0)
    Mp3/Tag Studio 3.5 (beta 16)
    Mp3-Tag Studio 3.05
    MSXML 4.0 SP2 (KB927978)
    MSXML 4.0 SP2 (KB936181)
    MSXML 6.0 Parser (KB933579)
    Network Recording Player
    Ots Studio 1.0.16
    OtsAV DJ 1.85.001
    OtsAV Pro 1.77.001
    OtsDJ 1.75.008
    OtsTurntables 1.00.009
    overland
    PaperPort
    Photo Organizer
    Photosmart 140,240,7200,7600,7700,7900 Series
    QuickBooks Pro Edition 2007
    Quicken 2008
    QuickTime
    R/C Pilot Simulator
    RealFlight Add-ons Volume 1
    RealFlight Add-ons Volume 2
    RealFlight G2 Simulator
    RealFlight G3 R/C Simulator
    Realtek AC'97 Audio
    Recorder
    RegCure 1.5.0.0
    Safari
    Secure Viewer 2.6.0.0
    Security Update for CAPICOM (KB931906)
    Security Update for CAPICOM (KB931906)
    Security Update for Windows Internet Explorer 7 (KB931768)
    Security Update for Windows Internet Explorer 7 (KB933566)
    Security Update for Windows Internet Explorer 7 (KB937143)
    Security Update for Windows Internet Explorer 7 (KB938127)
    Security Update for Windows Internet Explorer 7 (KB939653)
    Security Update for Windows Internet Explorer 7 (KB942615)
    Security Update for Windows Internet Explorer 7 (KB944533)
    Security Update for Windows Internet Explorer 7 (KB950759)
    Security Update for Windows Internet Explorer 7 (KB953838)
    Security Update for Windows Media Player 11 (KB936782)
    Security Update for Windows Media Player 9 (KB917734)
    Security Update for Windows XP (KB941569)
    Security Update for Windows XP (KB946648)
    Security Update for Windows XP (KB950760)
    Security Update for Windows XP (KB950762)
    Security Update for Windows XP (KB950974)
    Security Update for Windows XP (KB951066)
    Security Update for Windows XP (KB951376)
    Security Update for Windows XP (KB951376-v2)
    Security Update for Windows XP (KB951698)
    Security Update for Windows XP (KB951748)
    Security Update for Windows XP (KB952954)
    Security Update for Windows XP (KB953839)
    Sonic DLA
    Sonic RecordNow! Deluxe
    Sonic Simple Backup
    Sonic Update Manager
    SweetIM For Internet Explorer 3.0b
    thinkorswim
    Update for Windows XP (KB951072-v2)
    Update for Windows XP (KB951978)
    WebEx
    WebEx Record and Playback
    Westwood Shared Internet Components
    WillExpert
    Windows Imaging Component
    Windows Live installer
    Windows Live Messenger
    Windows Live Sign-in Assistant
    Windows Media Format 11 runtime
    Windows Media Format 11 runtime
    Windows Media Format SDK Hotfix - KB891122
    Windows Media Player 11
    Windows Media Player 11
    Windows Presentation Foundation
    Windows XP Service Pack 3
    WinRAR archiver
    Yahoo! Extras
    Yahoo! Internet Mail
    Yahoo! Toolbar
  • KatanaKatana
    edited August 2008
    Do you have the MalwareBytes Log ?



    Download and Run ComboFix (by sUBs)
    Please visit this webpage for instructions for downloading and running ComboFix:

    Bleeping Computer ComboFix Tutorial

    Post the log from ComboFix when you've accomplished that, along with a new HijackThis log.

    A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own. This tool is not a toy and not for everyday use.
    ComboFix SHOULD NOT be used unless requested by a forum helper
  • BobZ
    edited August 2008
    Sorry I missed that one. Here it is. FYI,
    my USB drive works, but not my wireless mouse and keyboard stopped working.


    Malwarebytes' Anti-Malware 1.24
    Database version: 1012
    Windows 5.1.2600 Service Pack 3
    8:12:50 AM 8/15/2008
    mbam-log-8-15-2008 (08-12-32).txt
    Scan type: Full Scan (C:\|F:\|G:\|H:\|I:\|)
    Objects scanned: 152463
    Time elapsed: 1 hour(s), 3 minute(s), 35 second(s)
    Memory Processes Infected: 2
    Memory Modules Infected: 4
    Registry Keys Infected: 15
    Registry Values Infected: 6
    Registry Data Items Infected: 10
    Folders Infected: 12
    Files Infected: 26
    Memory Processes Infected:
    C:\Program Files\rhc99pj0e78t\rhc99pj0e78t.exe (Rogue.Multiple) -> No action taken.
    C:\WINDOWS\system32\pphcc9pj0e78t.exe (Trojan.FakeAlert) -> No action taken.
    Memory Modules Infected:
    C:\Program Files\rhc99pj0e78t\MFC71.dll (Rogue.Multiple) -> No action taken.
    C:\Program Files\rhc99pj0e78t\MFC71ENU.DLL (Rogue.Multiple) -> No action taken.
    C:\Program Files\rhc99pj0e78t\msvcp71.dll (Rogue.Multiple) -> No action taken.
    C:\Program Files\rhc99pj0e78t\msvcr71.dll (Rogue.Multiple) -> No action taken.
    Registry Keys Infected:
    HKEY_CLASSES_ROOT\codecbho.codecplugin (Trojan.FakeAlert) -> No action taken.
    HKEY_CLASSES_ROOT\codecbho.codecplugin.1 (Trojan.FakeAlert) -> No action taken.
    HKEY_CLASSES_ROOT\AppID\{f4406238-983a-4845-9053-f1d0007fd135} (Trojan.FakeAlert) -> No action taken.
    HKEY_CLASSES_ROOT\codecbho.xmldomdocumenteventssink (Trojan.FakeAlert) -> No action taken.
    HKEY_CLASSES_ROOT\codecbho.xmldomdocumenteventssink.1 (Trojan.FakeAlert) -> No action taken.
    HKEY_CLASSES_ROOT\CLSID\{d37d6c1a-7ba4-47f4-9bf2-75031e257df6} (Trojan.FakeAlert) -> No action taken.
    HKEY_CLASSES_ROOT\Interface\{48e92754-2daf-4de4-8385-34f631580e9b} (Trojan.FakeAlert) -> No action taken.
    HKEY_CLASSES_ROOT\Interface\{a1c23ba2-8f20-4c01-b663-7ff2b3421194} (Trojan.FakeAlert) -> No action taken.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\rhc99pj0e78t (Rogue.Multiple) -> No action taken.
    HKEY_LOCAL_MACHINE\SOFTWARE\rhc99pj0e78t (Rogue.Multiple) -> No action taken.
    HKEY_CURRENT_USER\SOFTWARE\uninstall (Fake.Dropped.Malware) -> No action taken.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> No action taken.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VSPlugin (Trojan.FakeAlert) -> No action taken.
    HKEY_CLASSES_ROOT\AppID\CodecBHO.DLL (Trojan.FakeAlert) -> No action taken.
    HKEY_CURRENT_USER\SOFTWARE\RichVideoCodec (Trojan.FakeAlert) -> No action taken.
    Registry Values Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smrhc99pj0e78t (Rogue.Multiple) -> No action taken.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lphcc9pj0e78t (Trojan.FakeAlert) -> No action taken.
    HKEY_CURRENT_USER\Control Panel\Desktop\wallpaper (Hijack.Wallpaper) -> No action taken.
    HKEY_CURRENT_USER\Control Panel\Desktop\originalwallpaper (Hijack.Wallpaper) -> No action taken.
    HKEY_CURRENT_USER\Control Panel\Desktop\convertedwallpaper (Hijack.Wallpaper) -> No action taken.
    HKEY_CURRENT_USER\Control Panel\Desktop\scrnsave.exe (Hijack.Wallpaper) -> No action taken.
    Registry Data Items Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductId (Trojan.FakeAlert) -> Bad: (VIRUS ALERT!) Good: (76477-OEM-0062562-22989) -> No action taken.
    HKEY_CURRENT_USER\Control Panel\International\sTimeFormat (Trojan.FakeAlert) -> Bad: (HH:mm: VIRUS ALERT!) Good: (h:mm:ss tt) -> No action taken.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuMorePrograms (Hijack.StartMenu) -> Bad: (1) Good: (0) -> No action taken.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\StartMenuLogOff (Hijack.StartMenu) -> Bad: (1) Good: (0) -> No action taken.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives (Hijack.Drives) -> Bad: (12) Good: (0) -> No action taken.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoToolbarCustomize (Hijack.Explorer) -> Bad: (1) Good: (0) -> No action taken.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetFolders (Hijack.Explorer) -> Bad: (1) Good: (0) -> No action taken.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispBackgroundPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> No action taken.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispScrSavPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> No action taken.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispCPL (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> No action taken.
    Folders Infected:
    C:\Program Files\rhc99pj0e78t (Rogue.Multiple) -> No action taken.
    C:\Documents and Settings\Bob\Application Data\rhc99pj0e78t (Rogue.Multiple) -> No action taken.
    C:\Documents and Settings\Bob\Application Data\rhc99pj0e78t\Quarantine (Rogue.Multiple) -> No action taken.
    C:\Documents and Settings\Bob\Application Data\rhc99pj0e78t\Quarantine\Autorun (Rogue.Multiple) -> No action taken.
    C:\Documents and Settings\Bob\Application Data\rhc99pj0e78t\Quarantine\Autorun\HKCU (Rogue.Multiple) -> No action taken.
    C:\Documents and Settings\Bob\Application Data\rhc99pj0e78t\Quarantine\Autorun\HKCU\RunOnce (Rogue.Multiple) -> No action taken.
    C:\Documents and Settings\Bob\Application Data\rhc99pj0e78t\Quarantine\Autorun\HKLM (Rogue.Multiple) -> No action taken.
    C:\Documents and Settings\Bob\Application Data\rhc99pj0e78t\Quarantine\Autorun\HKLM\RunOnce (Rogue.Multiple) -> No action taken.
    C:\Documents and Settings\Bob\Application Data\rhc99pj0e78t\Quarantine\Autorun\StartMenuAllUsers (Rogue.Multiple) -> No action taken.
    C:\Documents and Settings\Bob\Application Data\rhc99pj0e78t\Quarantine\Autorun\StartMenuCurrentUser (Rogue.Multiple) -> No action taken.
    C:\Documents and Settings\Bob\Application Data\rhc99pj0e78t\Quarantine\BrowserObjects (Rogue.Multiple) -> No action taken.
    C:\Documents and Settings\Bob\Application Data\rhc99pj0e78t\Quarantine\Packages (Rogue.Multiple) -> No action taken.
    Files Infected:
    C:\WINDOWS\edpw.exe (Trojan.FakeAlert) -> No action taken.
    C:\Program Files\rhc99pj0e78t\database.dat (Rogue.Multiple) -> No action taken.
    C:\Program Files\rhc99pj0e78t\license.txt (Rogue.Multiple) -> No action taken.
    C:\Program Files\rhc99pj0e78t\MFC71.dll (Rogue.Multiple) -> No action taken.
    C:\Program Files\rhc99pj0e78t\MFC71ENU.DLL (Rogue.Multiple) -> No action taken.
    C:\Program Files\rhc99pj0e78t\msvcp71.dll (Rogue.Multiple) -> No action taken.
    C:\Program Files\rhc99pj0e78t\msvcr71.dll (Rogue.Multiple) -> No action taken.
    C:\Program Files\rhc99pj0e78t\rhc99pj0e78t.exe (Rogue.Multiple) -> No action taken.
    C:\Program Files\rhc99pj0e78t\rhc99pj0e78t.exe.local (Rogue.Multiple) -> No action taken.
    C:\Program Files\rhc99pj0e78t\Uninstall.exe (Rogue.Multiple) -> No action taken.
    C:\WINDOWS\Downloaded Program Files\atmgr.exe (Trojan.Agent) -> No action taken.
    C:\Documents and Settings\Bob\Local Settings\Temp\.tt15.tmp (Trojan.Agent) -> No action taken.
    C:\Documents and Settings\Bob\Local Settings\Temp\.tt7.tmp (Trojan.Downloader) -> No action taken.
    C:\Documents and Settings\Bob\Local Settings\Temp\.tt8.tmp (Trojan.Downloader) -> No action taken.
    C:\Documents and Settings\Bob\Local Settings\Temp\.tt9.tmp (Trojan.Downloader) -> No action taken.
    C:\Documents and Settings\Bob\Local Settings\Temp\.ttA.tmp (Trojan.Downloader) -> No action taken.
    C:\Documents and Settings\Bob\Local Settings\Temp\.ttB.tmp (Trojan.Downloader) -> No action taken.
    C:\Documents and Settings\Bob\Local Settings\Temp\.ttC.tmp (Trojan.Downloader) -> No action taken.
    C:\Documents and Settings\Bob\Local Settings\Temp\.ttD.tmp (Trojan.Downloader) -> No action taken.
    C:\Documents and Settings\Bob\Local Settings\Temp\.ttE.tmp (Trojan.Downloader) -> No action taken.
    C:\Documents and Settings\Bob\Local Settings\Temp\.ttF.tmp (Trojan.Downloader) -> No action taken.
    C:\WINDOWS\system32\blphcc9pj0e78t.scr (Trojan.FakeAlert) -> No action taken.
    C:\WINDOWS\system32\phcc9pj0e78t.bmp (Trojan.FakeAlert) -> No action taken.
    C:\WINDOWS\system32\pphcc9pj0e78t.exe (Trojan.FakeAlert) -> No action taken.
    C:\Documents and Settings\Bob\Local Settings\Temp\bindsrv2.exe (Trojan.FakeAlert) -> No action taken.
    C:\WINDOWS\system32\Explorer32 (Stolen.Data) -> No action taken.
  • KatanaKatana
    edited August 2008
    No action taken.

    Did you let MBAM remove the items it found ?
  • BobZ
    edited August 2008
    Yes I did. It seems I have now regained control, but this ordeal has left a mess behind. Right not it does not have internet connection and it just doesn't want to recognize the USB wireless mouse and keyboard. Should I just reistall over Windows?
  • KatanaKatana
    edited August 2008
    Download and Run ComboFix (by sUBs)
    Please visit this webpage for instructions for downloading and running ComboFix:

    Bleeping Computer ComboFix Tutorial

    Post the log from ComboFix when you've accomplished that, along with a new HijackThis log.

    A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own. This tool is not a toy and not for everyday use.
    ComboFix SHOULD NOT be used unless requested by a forum helper
  • BobZ
    edited August 2008
    Windows won't let me install the recovery console from cd because I have a newer version of windows installed. I recently updated to SP3. It says I would have to restart, bot from cd and follow instructions for a new installation. What should I do now?
  • BobZ
    edited August 2008
    I clicked ok to the message I previously mentioned and managed to get the recovery console installed. When I reboot now, I get the choice to use the recovery console, but when I choose it, the screen goes black and only a blinking underline cursor is in the upper lefthand corner and nothing responds keyboardwise.
  • KatanaKatana
    edited August 2008
    You shouldn't boot to the recovery console, that is only for use in emergency.
    Reboot your machine to your normal account, and double click ComboFix.exe
  • BobZ
    edited August 2008
    Here are the new files:

    At present, it doesn't recognize my USB external backup hard drive or USB wireless mouse and keyboard. Also, the device manager is blank and I can't add new hardware or an internet connection. It's like there are pieces missing all over.

    ComboFix 08-08-13.05 - Bob 2008-08-16 17:41:58.1 - NTFSx86
    Running from: C:\Documents and Settings\Bob\Desktop\ComboFix.exe
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    C:\Documents and Settings\Bob\Application Data\macromedia\Flash Player\#SharedObjects\6UCRHR9T\interclick.com
    C:\Documents and Settings\Bob\Application Data\macromedia\Flash Player\#SharedObjects\6UCRHR9T\interclick.com\ud.sol
    C:\Documents and Settings\Bob\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com
    C:\Documents and Settings\Bob\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol
    C:\WINDOWS\mesdxbrqmnx.dll
    C:\WINDOWS\system32\tdssadw.dll
    C:\WINDOWS\system32\tdssinit.dll
    C:\WINDOWS\system32\tdssl.dll
    C:\WINDOWS\system32\tdsslog.dll
    C:\WINDOWS\system32\tdssmain.dll
    C:\WINDOWS\system32\tdssservers.dat
    C:\WINDOWS\winhelp.ini
    .
    ((((((((((((((((((((((((( Files Created from 2008-07-16 to 2008-08-16 )))))))))))))))))))))))))))))))
    .
    2008-08-14 18:59 . 2008-08-14 18:59 <DIR> d
    C:\Program Files\Trend Micro
    2008-08-14 08:20 . 2008-08-14 08:20 <DIR> d
    C:\Program Files\Malwarebytes' Anti-Malware
    2008-08-14 08:20 . 2008-08-14 08:20 <DIR> d
    C:\Documents and Settings\Bob\Application Data\Malwarebytes
    2008-08-14 08:20 . 2008-08-14 08:20 <DIR> d
    C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-08-14 08:20 . 2008-07-30 20:07 38,472 --a
    C:\WINDOWS\system32\drivers\mbamswissarmy.sys
    2008-08-14 08:20 . 2008-07-30 20:07 17,144 --a
    C:\WINDOWS\system32\drivers\mbam.sys
    2008-08-13 21:56 . 2008-08-13 21:56 <DIR> d
    C:\Program Files\Lavasoft
    2008-08-13 21:56 . 2008-08-13 21:57 <DIR> d
    C:\Documents and Settings\All Users\Application Data\Lavasoft
    2008-08-13 20:50 . 2008-08-14 06:43 94,208 --a
    C:\WINDOWS\system32\9.tmp
    2008-08-13 20:50 . 2008-08-13 21:39 94,208 --a
    C:\WINDOWS\system32\21.tmp
    2008-08-13 20:50 . 2008-08-13 20:50 0 --a
    C:\WINDOWS\system32\8A.tmp
    2008-08-13 07:20 . 2008-08-13 07:20 524 --a
    C:\WINDOWS\system32\MRT.INI
    2008-08-13 06:48 . 2008-08-13 07:20 <DIR> d
    C:\Documents and Settings\All Users\Application Data\qzaxknix
    2008-08-13 06:48 . 2008-08-13 05:02 86,016 --a
    C:\WINDOWS\ateqoflr.exe
    2008-08-13 06:07 . 2008-04-11 15:04 691,712
    c--- C:\WINDOWS\system32\dllcache\inetcomm.dll
    2008-08-13 06:07 . 2008-05-01 10:33 331,776
    c--- C:\WINDOWS\system32\dllcache\msadce.dll
    2008-08-08 21:03 . 2008-08-08 21:03 <DIR> d
    C:\Program Files\Apple Software Update
    2008-08-08 08:21 . 2008-08-08 08:21 <DIR> d
    C:\WINDOWS\system32\scripting
    2008-08-08 08:21 . 2008-08-08 08:21 <DIR> d
    C:\WINDOWS\system32\en
    2008-08-08 08:21 . 2008-08-08 08:21 <DIR> d
    C:\WINDOWS\system32\bits
    2008-08-08 08:21 . 2008-08-08 08:21 <DIR> d
    C:\WINDOWS\l2schemas
    2008-08-08 08:19 . 2008-08-08 08:21 <DIR> d
    C:\WINDOWS\ServicePackFiles
    2008-08-08 08:15 . 2008-08-08 08:15 <DIR> d
    C:\WINDOWS\EHome
    2008-08-08 07:42 . 2004-08-03 22:41 1,041,536
    C:\WINDOWS\system32\drivers\hsfdpsp2.sys
    2008-08-06 21:06 . 2001-08-17 13:48 12,160 --a
    C:\WINDOWS\system32\drivers\mouhid.sys
    2008-08-06 21:06 . 2001-08-17 13:48 12,160 --a--c--- C:\WINDOWS\system32\dllcache\mouhid.sys
    2008-08-06 21:05 . 2008-04-13 14:39 14,592 --a
    C:\WINDOWS\system32\drivers\kbdhid.sys
    2008-08-01 16:05 . 2008-08-01 16:05 <DIR> d
    C:\Program Files\iTunes
    2008-08-01 16:04 . 2008-08-01 16:04 <DIR> d
    C:\Program Files\QuickTime
    2008-08-01 15:57 . 2008-08-01 15:57 <DIR> d
    C:\Program Files\Safari
    2008-07-29 21:06 . 2008-07-29 21:06 <DIR> d
    C:\Program Files\PRING
    2008-07-29 21:05 . 2008-07-29 21:05 0 --a
    C:\WINDOWS\asym.ini
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-08-16 21:20 64 ----a-w C:\WINDOWS\system32\drivers\kmxcfg.u2k7
    2008-08-16 21:20 64 ----a-w C:\WINDOWS\system32\drivers\kmxcfg.u2k6
    2008-08-16 21:20 64 ----a-w C:\WINDOWS\system32\drivers\kmxcfg.u2k5
    2008-08-16 21:20 64 ----a-w C:\WINDOWS\system32\drivers\kmxcfg.u2k4
    2008-08-16 21:20 64 ----a-w C:\WINDOWS\system32\drivers\kmxcfg.u2k3
    2008-08-16 21:20 64 ----a-w C:\WINDOWS\system32\drivers\kmxcfg.u2k2
    2008-08-16 21:20 64 ----a-w C:\WINDOWS\system32\drivers\kmxcfg.u2k1
    2008-08-16 21:20 261,192 ----a-w C:\WINDOWS\system32\drivers\kmxcfg.u2k0
    2008-08-14 01:56
    d
    w C:\Program Files\Common Files\Wise Installation Wizard
    2008-08-01 20:05
    d
    w C:\Program Files\iPod
    2008-07-30 19:16
    d
    w C:\Documents and Settings\Bob\Application Data\CallingID
    2008-07-30 11:20
    d
    w C:\Program Files\WebEx
    2008-07-25 02:04 626 ----a-w C:\Program Files\Common Files\tempeml.html
    2008-07-24 01:08
    d
    w C:\Documents and Settings\Bob\Application Data\WebEx
    2008-07-24 00:43 1,696 ----a-w C:\Program Files\Common Files\temp.html
    2008-07-20 21:33
    d
    w C:\Program Files\Dvd-cloner
    2008-07-17 02:13
    d
    w C:\Program Files\thinkorswim
    2008-07-14 10:57
    d
    w C:\Documents and Settings\Bob\Application Data\Recorder
    2008-07-14 10:51
    d
    w C:\Program Files\Recorder
    2008-07-12 23:08
    d
    w C:\Program Files\A-PDF Merger
    2008-07-08 10:25
    d
    w C:\Program Files\Common Files\Adobe
    2008-07-08 10:24
    d
    w C:\Documents and Settings\Bob\Application Data\AdobeUM
    2008-07-07 20:26 253,952 ----a-w C:\WINDOWS\system32\es.dll
    2008-06-24 23:10 256,528 ----a-w C:\WINDOWS\system32\UmxSbxw.dll
    2008-06-24 23:10 117,264 ----a-w C:\WINDOWS\system32\UmxSbxExw.dll
    2008-06-24 23:08 93,712 ----a-w C:\WINDOWS\system32\drivers\KmxStart.sys
    2008-06-24 23:08 88,816 ----a-w C:\WINDOWS\system32\drivers\KmxCfg.sys
    2008-06-24 23:08 66,576 ----a-w C:\WINDOWS\system32\drivers\KmxSbx.sys
    2008-06-24 23:08 63,504 ----a-w C:\WINDOWS\system32\drivers\KmxAgent.sys
    2008-06-24 23:08 45,584 ----a-w C:\WINDOWS\system32\drivers\KmxFile.sys
    2008-06-24 23:08 134,648 ----a-w C:\WINDOWS\system32\drivers\KmxCF.sys
    2008-06-24 23:08 115,216 ----a-w C:\WINDOWS\system32\drivers\KmxFw.sys
    2008-06-24 16:43 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
    2008-06-23 23:50
    d
    w C:\Program Files\ErrorSmart
    2008-06-23 16:57 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
    2008-06-20 17:46 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
    2008-06-20 11:51 361,600 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
    2008-06-20 11:40 138,496 ----a-w C:\WINDOWS\system32\drivers\afd.sys
    2008-06-20 11:08 225,856 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
    2008-06-16 10:14
    d
    w C:\Program Files\MixMeister EZ Vinyl Converter
    2008-06-13 23:06 91,376 ----a-w C:\WINDOWS\system32\isafprod.dll
    2008-05-23 00:55 75,354 ----a-w C:\WINDOWS\system32\mfc45.dll
    2008-05-16 15:58 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe
    2007-06-08 12:33 800,272 ----a-w C:\Documents and Settings\Bob\ppctl.dll
    2006-05-31 13:14 108,056 ----a-w C:\Program Files\Common Files\secman.dll
    2006-03-11 23:09 626,176 ----a-w C:\Program Files\Common Files\osmax.ocx
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 20:12 15360]
    "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-17 06:26 68856]
    "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2008-04-13 20:12 1695232]
    "LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [2005-06-08 14:44 196608]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Winload32"="C:\WINDOWS\system32\explorer32\winload32.exe" [2008-02-26 14:20 64784]
    "SweetIM"="C:\Program Files\Macrogaming\SweetIM\SweetIM.exe" [2007-08-12 11:02 103712]
    "SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 10:22 155648]
    "SetDefPrt"="C:\Program Files\Brother\Brmfl04g\BrStDvPt.exe" [2004-11-11 17:14 49152]
    "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-05-27 10:50 413696]
    "PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 08:00 455168]
    "PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 08:00 455168]
    "PaperPort PTD"="C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe" [2004-04-14 14:46 57393]
    "LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2005-07-19 17:32 221184]
    "LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2005-06-08 15:14 217088]
    "LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2005-06-08 15:24 458752]
    "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-30 10:47 289064]
    "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 17:50 81920]
    "ISUSPM Startup"="c:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2004-07-27 17:50 221184]
    "IndexSearch"="C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe" [2004-04-14 15:04 40960]
    "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 08:00 208952]
    "HPHUPD05"="C:\Program Files\Hewlett-Packard\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\hphupd05.exe" [2004-04-01 00:34 49152]
    "HPHmon05"="C:\WINDOWS\system32\hphmon05.exe" [2004-05-04 18:17 491520]
    "HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe" [2004-05-04 03:21 176128]
    "HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2003-12-05 15:41 49152]
    "HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 16:18 241664]
    "ErrorSmart"="C:\Program Files\ErrorSmart\ErrorSmart.exe" [2008-05-30 15:51 18666744]
    "dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-08-03 02:05 122939]
    "ControlCenter2.0"="C:\Program Files\Brother\ControlCenter2\brctrcen.exe" [2004-11-11 22:00 864256]
    "cctray"="C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe" [2008-07-31 06:14 181488]
    "CAVRID"="C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe" [2008-06-13 19:06 234736]
    "capfupgrade"="C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfupgrade.exe" [2008-07-31 06:14 259312]
    "capfasem"="C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfasem.exe" [2008-07-31 06:14 173296]
    "cafwc"="C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\cafw.exe" [2008-07-31 06:14 771312]
    "cafw"="C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\cafw.exe" [2008-07-31 06:14 771312]
    "AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-22 20:42 116040]
    "SoundMan"="SOUNDMAN.EXE" [2005-04-14 23:01 77824 C:\WINDOWS\SOUNDMAN.EXE]
    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Adobe Gamma Loader.exe.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-05-27 16:58:05 113664]
    Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 03:38:16 29696]
    Forget Me Not.lnk - C:\Program Files\Broderbund\AG CreataCard\AGRemind.exe [2007-06-14 18:25:10 323584]
    InterVideo WinCinema Manager.lnk - C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe [2008-03-14 06:52:20 184320]
    Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2000-01-21 04:15:54 65588]
    QuickBooks Update Agent.lnk - C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2007-07-06 17:37:36 811008]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
    "EnableShellExecuteHooks"= 1 (0x1)
    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{1869181A-9F50-4FCF-8BFF-1B8588ECB85C}"= "C:\Program Files\CA\CA Internet Security Suite\CA Website Inspector\LinkAdvisor\CIDLinkAdvisor.dll" [2008-06-23 06:52 1373624]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PFW]
    2007-01-31 15:00 79368 C:\WINDOWS\system32\UmxWNP.dll
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "msacm.ac3filter"= ac3filter.acm
    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusOverride"=dword:00000001
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\CA Personal Firewall]
    "DisableMonitoring"=dword:00000001
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ComputerAssociatesAntiVirus]
    "DisableMonitoring"=dword:00000001
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "C:\\Program Files\\Messenger\\msmsgs.exe"=
    "C:\\WINDOWS\\system32\\dpnsvr.exe"=
    "C:\\Program Files\\RealFlightG3\\RealFlight.exe"=
    "<NO NAME>"= "C:\\Documents and Settings\\Baby\\My Documents\\pps\\PPStream\\PPStream.exe" "C:\\Documents and Settings\\Baby\\My Documents\\pps\\PPStream\\PPStream.exe
    "C:\\Program Files\\iTunes\\iTunes.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "3587:TCP"= 3587:TCP:Windows Peer-to-Peer Grouping
    "3540:UDP"= 3540:UDP:Peer Name Resolution Protocol (PNRP)
    "3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
    "AllowInboundEchoRequest"= 1 (0x1)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc
    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4980183b-0889-11dd-a344-0013d36284f5}]
    \Shell\1\Command - J:\RUNAUT~1\autorun.pif
    \Shell\2\Command - J:\RUNAUT~1\autorun.pif
    \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RUNAUT~1\autorun.pif
    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b6eb92f6-3138-11dc-a0d6-0013d36284f5}]
    \Shell\AutoRun\command - L:\setupSNK.exe
    *Newly Created Service* - PROCEXP90
    .
    Contents of the 'Scheduled Tasks' folder
    2008-08-10 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
    - C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
    2008-06-24 C:\WINDOWS\Tasks\CAAntiSpywareScan_Daily as Bob at 9 16 AM.job
    - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\CAAntiSpyware.exe [2008-05-24 09:31]
    2008-05-26 C:\WINDOWS\Tasks\ErrorSmart Scheduled Scan.job
    - C:\Program Files\ErrorSmart\ErrorSmart.exe [2008-05-30 15:51]
    2008-05-26 C:\WINDOWS\Tasks\ErrorSmart Scheduled Scan.job
    - C:\Program Files\ErrorSmart [2008-06-23 19:50]
    2008-08-14 C:\WINDOWS\Tasks\HP Usg Daily.job
    - C:\Program Files\Hewlett-Packard\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\pexpress\hphped05.exe [2004-04-01 00:35]
    2008-08-14 C:\WINDOWS\Tasks\RegCure Program Check.job
    - C:\Program Files\RegCure\RegCure.exe [2007-08-14 17:10]
    2007-09-23 C:\WINDOWS\Tasks\RegCure.job
    - C:\Program Files\RegCure\RegCure.exe [2007-08-14 17:10]
    2008-08-14 C:\WINDOWS\Tasks\User_Feed_Synchronization-{737DE310-B91D-413E-A210-153E0D4D59D7}.job
    - C:\WINDOWS\system32\msfeedssync.exe [2006-10-17 11:58]
    .
    - - - - ORPHANS REMOVED - - - -
    ShellIconOverlayIdentifiers-hex(2):7b,38,41,34,32,44,46,42,46,2d,37,38,36,38,2d,34,30,32,39,2d,39,35,38,\ - (no file)

    .
    Supplementary Scan
    .
    FireFox -: Profile - C:\Documents and Settings\Bob\Application Data\Mozilla\Firefox\Profiles\badmk4vf.default\
    FireFox -: prefs.js - STARTUP.HOMEPAGE - about:blank

    **************************************************************************
    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-08-16 17:53:32
    Windows 5.1.2600 Service Pack 3 NTFS
    scanning hidden processes ...
    scanning hidden autostart entries ...
    scanning hidden files ...
    scan completed successfully
    hidden files: 0
    **************************************************************************
    [HKEY_LOCAL_MACHINE\system\ControlSet003\Services\tdssserv]
    .
    Completion time: 2008-08-16 17:56:59
    ComboFix-quarantined-files.txt 2008-08-16 21:56:32
    Pre-Run: 86,392,303,616 bytes free
    Post-Run: 86,642,712,576 bytes free
    233 --- E O F --- 2008-08-13 11:23:24

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 9:41:47 PM, on 8/16/2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16705)
    Boot mode: Normal
    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
    C:\WINDOWS\system32\LVCOMSX.EXE
    C:\Program Files\Logitech\Video\LogiTray.exe
    C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
    C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
    C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
    C:\WINDOWS\system32\dla\tfswctrl.exe
    C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe
    C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe
    C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfasem.exe
    C:\WINDOWS\system32\explorer32\winsysmngr32.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Logitech\Video\FxSvr2.exe
    C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\CAPPActiveProtection.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\explorer.exe
    C:\WINDOWS\system32\wpabaln.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
    R3 - URLSearchHook: (no name) - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file)
    O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
    O2 - BHO: CA Toolbar Helper - {FBF2401B-7447-4727-BE5D-C19B2075CA84} - C:\Program Files\CA\CA Internet Security Suite\CA Website Inspector\Toolbar\CallingIDIE.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O3 - Toolbar: CA Toolbar - {10134636-E7AF-4AC5-A1DC-C7C44BB97D81} - C:\Program Files\CA\CA Internet Security Suite\CA Website Inspector\Toolbar\CallingIDIE.dll
    O4 - HKLM\..\Run: [Winload32] C:\WINDOWS\system32\explorer32\winload32.exe
    O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
    O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl04g\BrStDvPt.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
    O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
    O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
    O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
    O4 - HKLM\..\Run: [ISUSPM Startup] c:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
    O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [HPHUPD05] C:\Program Files\Hewlett-Packard\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\hphupd05.exe
    O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
    O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
    O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
    O4 - HKLM\..\Run: [ErrorSmart] C:\Program Files\ErrorSmart\ErrorSmart.exe
    O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
    O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun
    O4 - HKLM\..\Run: [cctray] "C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe"
    O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe"
    O4 - HKLM\..\Run: [capfupgrade] C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfupgrade.exe
    O4 - HKLM\..\Run: [capfasem] C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfasem.exe
    O4 - HKLM\..\Run: [cafwc] C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\cafw.exe -cl
    O4 - HKLM\..\Run: [cafw] C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\cafw.exe -cl
    O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
    O4 - HKUS\S-1-5-21-484763869-1326574676-725345543-1004\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User '?')
    O4 - HKUS\S-1-5-21-484763869-1326574676-725345543-1004\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User '?')
    O4 - HKUS\S-1-5-21-484763869-1326574676-725345543-1004\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User '?')
    O4 - HKUS\S-1-5-21-484763869-1326574676-725345543-1004\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot (User '?')
    O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Forget Me Not.lnk = C:\Program Files\Broderbund\AG CreataCard\AGRemind.exe
    O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra button: (no name) - Cmdmapping - (no file) (HKCU)
    O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
    O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
    O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-CA/a-UNO1/GAME_UNO1.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1181299664265
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1186441192031
    O16 - DPF: {6F750203-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://www.kodakgallery.ca/downloads/BUM/BUM_WIN_IE_2/axofupld.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://investools.webex.com/client/T25LSP41EP6/event/ieatgpc.cab
    O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
    --
    End of file - 10844 bytes
  • KatanaKatana
    edited August 2008
    ==============================WARNING==============================
    There is some evidence of what may be a very nasty infection.
    If the Computer has been used for any important data, you are strongly advised to do the following, immediately:
    • If you have ever used this computer for shopping, banking, or any transactions relating to your financial well being:
      Call all of your banks, credit card companies, and financial institutions, informing them that you may be a victim of identity theft, and to put a watch on your accounts or change all your account numbers.
    • From a clean computer, change ALL your online passwords -- for ISP login, email, banks, financial accounts, PayPal, eBay, online companies, and any online forums or groups you belong to.
    • DO NOT change passwords or do any transactions while using the infected computer because the attacker will get the new password and transaction information.
    • Take any other steps you think appropriate for an attempted identity theft.
    ==============================WARNING==============================


    Remove Programs

    Now click Start---Control Panel. Double click Add or Remove Programs (XP) / Programs and Features (Vista) . If any of the following programs are listed there,
    click on the program to highlight it, and click on remove.
    • ErrorSmart
    • RegCure 1.5.0.0
    Now close the Control Panel.


    Download and Run SD Fix

    Please download SDFix( by andymanchesta ) and save it to your Desktop.

    Double click SDFix.exe and it will extract the files to %systemdrive%
    (Drive that contains the Windows Directory, typically C:\SDFix)

    Please then reboot your computer in Safe Mode by doing the following :
    • Restart your computer
    • After hearing your computer beep once during startup, but before the Windows icon appears, tap the F5 key continually;
    • Instead of Windows loading as normal, the Advanced Options Menu should appear;
    • Select the first option, to run Windows in Safe Mode, then press Enter.
    • Choose your usual account.
    • Open the extracted SDFix folder and double click RunThis.bat to start the script.
    • Type Y to begin the cleanup process.
    • It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
    • Press any Key and it will restart the PC.
    • When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
    • Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
      (Report.txt will also be copied to Clipboard ready for posting back on the forum).
    • Finally paste the contents of the Report.txt back on the forum with a new HijackThis log


    Custom CFScript
    • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:
      DirLook::
C:\Program Files\PRING

File::
C:\Program Files\Common Files\tempeml.html
C:\Program Files\Common Files\temp.html
C:\WINDOWS\system32\9.tmp
C:\WINDOWS\system32\21.tmp
C:\WINDOWS\system32\8A.tmp
C:\WINDOWS\ateqoflr.exe
C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
C:\WINDOWS\Tasks\ErrorSmart Scheduled Scan.job
C:\WINDOWS\Tasks\ErrorSmart Scheduled Scan.job
C:\WINDOWS\Tasks\RegCure Program Check.job
C:\WINDOWS\Tasks\RegCure.job
Folder::
C:\Program Files\ErrorSmart
C:\Documents and Settings\All Users\Application Data\qzaxknix
C:\WINDOWS\system32\explorer32
C:\Program Files\RegCure

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Winload32"=-
"ISUSScheduler"=-
"ISUSPM Startup"=-
"ErrorSmart"=-

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints 2\{4980183b-0889-11dd-a344-0013d36284f5}]


ADS::
    • Save this as CFScript.txt and place it on your desktop.


      CFScriptb.gif
    • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
    • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
    • When finished, it will produce a log for you. Copy and paste the contents of the log in your next reply.


    CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
    Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

    A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own. This tool is not a toy and not for everyday use.
    ComboFix SHOULD NOT be used unless requested by a forum helper






    Kaspersky Online Scanner .
    Your Antivirus and/or Antispyware may give a warning during the scan. This is perfectly normal
    NOTE:- This scan is best done from IE (Internet Explorer)
    NOTE:- Vista users should start IE by Start(Vista Orb) >> Internet Explorer >> Right-Click Run As Admin
    Go Here http://www.kaspersky.com/kos/eng/partner/default/kavwebscan.html

    Read the Requirements and limitations before you click Accept.
    Once the database has downloaded, click My Computer in the left pane
    Now go and put the kettle on !
    When the scan has completed, click Save Report As...
    Enter a name for the file in the Filename: text box and then click the down arrow to the right of Save as type: and select text file (*.txt)
    Click Save - by default the file will be saved to your Desktop, but you can change this if you wish.


    **Note**

    To optimize scanning time and produce a more sensible report for review:
    • Close any open programs.
    • Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.

    Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.
  • BobZ
    edited August 2008
    I'm toast. This morning my three days to re-activate XP expired and couldn't do anything. Then, later in the morning, my monitor is just black. I tested the monitor on the laptop and it works fine. It seems that something happened on my desktop that was shuting down hardware and thereby causing Windows to think that I had to re-activate because of the changes. Now I can't do a thing. It's like my motherboard is systematically shutting down. I managed to get all data that I need off the C: drive, but I cannot get at my Favorites, Outlook emails, or anything in Documents and Settings. It says 'access denied'. Just so you know, I am doing this by USB on the laptop to transfer to an external hard drive. With the hard drive hooked up via USB, is there anyway to remove the 'access denied' from Documents and Settings?
  • KatanaKatana
    edited August 2008
    It sounds like serious hardware failure there !!

    You need to take ownership of the Documents and Settings folder using the username on the laptop.


    How to take ownership of a file or folder in Windows XP
  • VekaVeka Finland
    edited September 2008
    This topic is now closed due to inactivity. If you wish to reopen your topic, please send a Private Message (PM) to Trogan with a link to your thread.

    If it has been 10 days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, this topic will not be reopened. If you still require help, please start a new topic and include a fresh HijackThis log and a link to this thread in your new topic.

    If you are not the user who started this thread, you must start your own Thread instead :)
Sign In or Register to comment.