Explore topic-wise InterviewSolutions in .

Ok so i got hijackthis and superantispyware logs

Thanks

by the way is the Antivirus XP 2008 virus

[recovering disk space -- attachment deleted by admin]You need to run Malwarebytes, post its log, and then, fresh HJT log.ok Malwarebyte log and fresh HJT log



[recovering disk space -- attachment deleted by admin]You're running Sympatico Security Advisor, which I BELIEVE comes from Bell, includes antivirus, and a firewall, and I see some Norton leftovers.
What's the story behind this?what do u mean by that

my mom clicked on a fake antivirus wich is named XP antivirus 2008
i believe i got it REMOVED
but i just wana double checkLet me rephrase....Is Sympatico Security Advisor your current antivirus, and firewall?yesVery well. Let me proceed with your logs.
Download, and run Norton Removal Tool: http://service1.symantec.com/Support/tsgeninfo.nsf/docid/2005033108162039
Post new HJT log.ok

[recovering disk space -- attachment deleted by admin]*** You need to update Java:
http://java.sun.com/javase/downloads/index.jsp
Java Runtime Environment (JRE) 6 Update 7
Uninstall all previous versions of Java through Add\Remove.

*** Download, and run CTFMON-Remover: http://www.gerhard-schlager.at/en/projects/ctfmonremover/
The CTFMON-Remover helps you removing the annoying CTFMON.EXE from your Windows operating system. The program is easy to use and displays whether the CTFMON.EXE is installed and running or not. If it was found then you can remove it within seconds. Just in case that you need the CTFMON sometime in the future there is also an option to restore the original one.
Note:The CTFMON.EXE is among other things responsible for changing the language schema of your keyboard (e.g. for switching between the German and English keyboard layout). So in case you are using this feature you shouldn't remove or disable the CTFMON.EXE!

*** Disable TeaTimer, as it'll INTERFERE with the cleaning process:
Right click Spybot's TeaTimer System Tray Icon.
Click Exit Spybot-S&D Resident.
TeaTimer closes.

*** Disable Windows Defender, as it'll interfere with cleaning process:
* Open Windows Defender
* Click Tools
* Click General SETTINGS
* Scroll down to Real Time Protection Options
* Uncheck Turn on Real Time Protection
* After you uncheck this, click on the Save button
* Close Windows Defender

1. Print this post out, since you won't have an access to it, at some point.

2. Close all windows, except for HijackThis.

3. Put a checkmark NEXT to the following HijackThis entries (some entries will be checkmarked to disable unnecessary startups; in those cases [marked with *], no actual program will be removed):

- O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
- *O4 - HKLM\..\Run: [HPHUPD08] "c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe"
- *O4 - HKLM\..\Run: [DISCover] "C:\Program Files\DISC\DISCover.exe"
- *O4 - HKLM\..\Run: [DiscUpdateManager] "C:\Program Files\DISC\DiscUpdateMgr.exe"
- *O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
- *O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
- O4 - HKLM\..\Run: [SMrhc5v5j0e14r] C:\Program Files\rhc5v5j0e14r\rhc5v5j0e14r.exe
- *O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
- *O4 - HKCU\..\Run: [BitComet] "C:\Program Files\BitComet\BitComet.exe" /tray
- *O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe
- O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.1.11.30.dll/206 (file missing)
- *O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll


4. Click on Fix checked button.

5. Restart computer in Safe Mode (keep tapping F8 key, when your computer starts, until menu appears)

6. Open Windows Explorer. Go Tools>Folder Options>View tab, put a checkmark next to Show hidden files, and folders.

7. Delete following files/folders (if present):

- rhc5v5j0e14r folder from C:\Program Files

8. Restart in Normal Mode.

9. Post new HijackThis log.



[recovering disk space -- attachment deleted by admin]Your computer is clean

1. Download, and install CCleaner: http://www.ccleaner.com/download/builds. Get "Slim" version.
Read CCleaner instruction here: http://www.jahewi.nl/ccleaner/ccleaner.html.
Run CCleaner.

2. Turn off System Restore:

- Windows XP:
1. Click Start.
2. Right-click the My Computer icon, and then click Properties.
3. Click the System Restore tab.
4. Check "Turn off System Restore".
5. Click Apply.
6. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this.
7. Click OK.
- Windows Vista:
1. Click Start.
2. Right-click the Computer icon, and then click Properties.
3. Click on System Protection under the Tasks column on the left side
4. Click on Continue on the "User Account Control" window that pops up
5. Under the System Protection tab, find Available Disks
6. Uncheck the box for any drive you wish to disable system restore on (in most cases, drive "C:")
7. When turning off System Restore, the existing restore points will be deleted. Click "Turn System Restore Off" on the popup window to do this.
8. Click OK

3. Restart computer.

4. Turn System Restore on.

5. Download, and install McAfee SiteAdvisor: http://www.siteadvisor.com/download/ff.html. It'll warn you (in most cases) about dangerous web sites.

6. (optional) Download, and install free version of ThreatFire: http://www.threatfire.com/. It'll give you an extra protection against malwares. It won't interfere with your antivirus program

7. Read "So how did I get infected in the first place?": http://www.castlecops.com/postlite7736-.html

8. Let me know, how your computer is doing.

Is this the annoying popup with the red circle and the X saying windows has detected spyware infection? If so this is what i have and will follow the list above if someone can review the logs - JTJtquad it is not advised to use someone elses thread for reference.

Start here and post the logs in your own thread when complete, not this one.

No problem, except i can get a super anti spyware log it wont let the program run - JTI moved this into a new THREAD so we can work from here.

Can you get MBAM to run? If not then just post the HijackThis log.I can not get Superanti spyware or hi jack this to run - JT
P.S. Can you delete the other thread i just posted thanksDo you get any errors when you try to run them? If so what are the errors.

Try this.

Download Deckard's System Scanner (DSS) to your Desktop.
Note: You must be logged onto an account with administrator privileges.
Vista users RIGHT click DSS and Run as Administrator.

• Close all applications and windows.
  
• Double-click on dss.exe to run it, and follow the prompts.
  
• When the scan is complete, two text files will open.
• main.txt <- this one will be maximized
  
• extra.txt <- this one will be minimized
• Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of main.txt and extra.txt in your reply.

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
• Instead of Windows loading as normal, the Advanced Options Menu should appear;
• Select the first option, to run Windows in Safe Mode, then press Enter.
  
• Choose your usual account.
• Open the extracted SDFix folder and double click RunThis.bat to start the script.
  
• Type Y to begin the cleanup PROCESS.
  
• It will REMOVE any Trojan Services and Registry Entries that it FINDS then prompt you to press any key to Reboot.
• Press any Key and it will restart the PC.
• When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
  
• Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
  (Report.txt will also be copied to Clipboard).
  
• Finally copy and paste the contents of the results file Report.txt with a NEW HijackThis log in your next reply.

Also, running time for AVG, Superantispyware, and Malwarebytes can easily exceed 1 hour. Nothing strange here.Well, I'll be dipped in chocolate and painted green....THAT downloaded!

Thank you.

Could I trouble you to explain about System Restore?

grazie Not at all...
Go Start>Run, copy, and paste this:
%systemroot%\system32\restore\rstrui.exe
I'll bring you right into System Restore window.
Select some date from the past, and run System Restore.Well, as this continues to be a challenge that is getting RATHER tiresome, did copy and paste, pulled up the system restore window...and then it said that there was no dates available to choose from.

This annoys and perplexes me, as I know that I have done the System Restore thing now at LEAST three times, after help from you and others here on CH.

*sigh*...my brain is hurting, it's nearly four in the morning...I'm going to bed. I'll try again tomorrow...

Thanks Broni... buona notteWhen you are up, go Start>Run, type in:
sfc /scannow
Click OK.
Have Windows CD handy.Sorry again...but I don't have a Windows CD. *sigh* You see, I bought this laptop used, and I think it was probably not the WISEST purchase. I've had a mountain of problems, what with WGA thinking that my copy of Windows is pirated, tho the gentlemen at the computer store assured me it isn't. They said that it was used in an office before, and was connected to a network of computers there, apparently all logged into one main computer, that being the one with the registered ID number. Does that sound reasonable to you?

Along those lines, I have a friend that recently bought a new computer and is now using Vista, and he said that he still has a registered copy of Windows XP that he would be willing to give me. He said that we can wipe my computer clean, and start over with his copy of XP. This seems appealing to me on the one hand, but on the other, I will lose everything on my computer as a result, correct? And as far as backing up...I suppose I could do that (actually SHOULD do that, considering the wacky nature of my computer anyway), but as of this moment, I have no idea how to do that. I'm sure my friend can show me, but I'm wondering if it's even reasonable to go to all that hassle?

At any rate, for now, things seem to be fairly ok. Most of the time the CPU is running at a normal usage, but now and again, RUNS up to 100% and stays there for an hour or so, before coming back down. When the CPU usage is high, I often get kicked OFFLINE as well. At that point, I've taken to just giving up, and coming back to the computer the next day.

It will oftentimes SHOOT up to 100% for seemingly no reason. However, the two things I've noticed that consistently wonk-out the CPU usage are if I try to play any kind of online games (flash probs?...I don't have problems when watching YouTube tho...), or if I log into Yahoo messenger. Both those things seem to activate some kind of weirdness.

Anyway, things are definately not right, but are running much better than they have for quite some time, so I do thank you for getting me this far. I'd definitely go fro clean install with your friend's CD.
As for backing up your data, here is a very nice little program, Fab's Autobackup: http://fabs.dyndns.org/index2.php?lang=en&section=freewares, which should backup most of your stuff. When it's done with backing, you can manually double check other folders for any files, you may need.Thank you Broni.

I'll see what we can do about getting things backed up, and then installing the new version of XP. If things go well, I'll let you know. If not...well, I'll be back asking for new advice I'm sure.

Thank you again SO MUCH for all your help!You're welcome
Remember, our help will be here for you, anytime

I hate bringin OLD TOPICS back, but id RATHER do this than start a new one...

I SAW that people are still having probems with the new AVG. Its on my gf's computer. Should I use a different one? she hasnt complained about anything wrong with it.Apparently, it works fine for some people, but not for others.
If it works, let her keep it, but if any trouble, you'll know what the first SUSPECT is.

Can anyone check and help me get my desktop icons and toolbars back?
Ive been using task manager to open pages.


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:58:36 PM, on 7/25/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam10\QuickCam10.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Brother\ControlCenter2\brctrcen.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\LVComSX.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Ulead Systems\Ulead Photo Express 3.0 SE\CalCheck.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files\Brother\Brmfcmon\BrMfcmon.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.planetprepaid.com.au
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.planetprepaid.com.au
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.planetprepaid.com.au
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\ntos.exe,
O2 - BHO: (no name) - {15A862F9-AF7A-45B2-850F-9A7576C4A2AA} - C:\WINDOWS\system32\awtspnKD.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: {049fe1cb-83af-78f8-8fe4-8234223759f8} - {8f957322-4328-4ef8-8f87-fa38bc1ef940} - C:\WINDOWS\system32\xydewz.dll (file missing)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Ulead AutoDetector v2] C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl05a\BrStDvPt.exe
O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun
O4 - HKLM\..\Run: [BM4bf8b83b] Rundll32.exe "C:\WINDOWS\system32\qiaxpalt.dll",s
O4 - HKLM\..\Run: [48cb8ba7] rundll32.exe "C:\WINDOWS\system32\dgoxpiyx.dll",b
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [scheduler_monitor] C:\Program Files\ReaConverter 5.5 Pro\init_scheduler.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Picture Package Menu.lnk = ?
O4 - Global Startup: Picture Package VCD Maker.lnk = ?
O4 - Global Startup: Status Monitor.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
O4 - Global Startup: Ulead Photo Express 3.0 SE Calendar Checker.lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 3.0 SE\CalCheck.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O20 - AppInit_DLLs: C:\WINDOWS\system32\__c00C4254.dat
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - SERVICE: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: ReaConverter scheduler service (rcp_service) - ReaSoft - C:\Program Files\ReaConverter 5.5 Pro\rcp_scheduler.exe

--
End of file - 8025 bytes
Your computer is infected by at least one Keylogger and various Backdoor Trojans. Please read all of this carefully.

Backdoor Trojans, IRCBots and rootkits are very dangerous because they provide a means of accessing a computer system that bypasses security mechanisms and steal sensitive information like passwords, personal and financial data which they send back to the hacker. Remote attackers use Backdoor Trojans as part of an exploit to to gain unauthorized access to a computer and take control of it without your knowledge.

Read this article: Danger: Remote Access Trojans.

If your computer was used for online banking, has credit card information or other sensitive data on it, all passwords should be changed immediately to include those used for banking, email, eBay and forums. You should consider them to be compromised. They should be changed by using a different computer and not the infected one! If not, an attacker may get the new passwords and transaction information. Banking and credit card institutions should be notified of the possible security breach.

Your PC has likely been compromised and there is no way to be SURE the computer can ever be trusted again. It is dangerous and incorrect to assume that because the Backdoor Trojan has been removed the computer is now secure. Many experts in the security community believe that once infected with this type of malware, the best course of action is to reformat and reinstall the OS.

When should I re-format? How should I reinstall?.
How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?

Should you decide not to follow that advice, we will do our best to help clean the computer of any infections but we cannot guarantee it will be 100% secure afterwards or that the removal will be successful.

Should you have any questions, please feel free to ask.

Let me know what you have decided to do in your next post. that sounds really bad. I use my comp for everything.
Ive decided to re format and re-install, would my comp
be clean from everything and EVERYONE after i do that?Formatting your laptop will remove everything from it, including viruses yes.
Check out Evilfantasy's link.

Quote from: evilfantasy on July 25, 2008, 05:06:03 PM

Banking and credit card institutions should be notified of the possible security breach.

I'm on my other computer which I never use, but my brother does, and he hardly knows how to turn a computer on, let alone keep it clean. So here I am, on it and it is not going as well as it should.
It is an Hp Pavilion a1400e
~512mb RAM shared
~256mb Nvidia Graphics
~Amd Sempron 1.8Ghz
Avast home
Spyware Terminator
Super antispyware

Here is the hjt log


Logfile of Trend Micro HIJACKTHIS v2.0.2
Scan saved at 5:31:38 PM, on 22/07/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe
C:\Documents and Settings\HP_Owner\Local Settings\Temporary Internet Files\Content.IE5\ACHJ937A\zlsSetup_70_483_000_en[1].exe
C:\DOCUME~1\HP_Owner\LOCALS~1\Temp\GLB7.tmp
c:\windows\SYSTEM\hpsysdrv.exe
C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_CA&c=63&bd=PAVILION&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_CA&c=63&bd=PAVILION&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_CA&c=63&bd=PAVILION&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_CA&c=63&bd=PAVILION&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_CA&c=63&bd=PAVILION&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: HpWebHelper - {AAAE832A-5FFF-4661-9C8F-369692D1DCB9} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\WebHelper.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - Global Startup: Updates From HP.lnk = C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 6504 bytes


I really need help with this computer..

Thx




Download ATF Cleaner by Atribune and save it to your Desktop.
Alternate Download link

Windows Vista users: ATF-Cleaner must be Run as an Administrator

Double click ATF-Cleaner.exe to run the program.
Check the boxes to the left of:

• Windows Temp
  
• Current User Temp
  
• All Users Temp
  
• Temporary Internet Files
  
• Prefetch
  
• Java Cache
  
• Recycle bin

• Start
• Run
• type: CLEANMGR.EXE
  
• Press Enter.
  

• Temporary Internet Files
• Downloaded Program Files
• Recycle Bin
• Temporary Files

• Go to Start > Programs > Accessories > System Tools and click System Restore
  
• Choose the radio button marked Create a Restore Point on the first screen then click Next Give the Restore Point a name then click Create.
  
• The new restore point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
• Next go to Start > Run and type Cleanmgr
  
• Click OK
  
• Click the More Options Tab.
  
• Click Clean Up in the System Restore section to remove all previous restore points except the newly created clean one.

• Go to add/remove programs and uninstall all old versions.
• Be sure not to remove the new version that was just installed.
  
• Download JavaRa.zip and unzip the file to your Desktop.
  
• Open JavaRA.exe and choose Remove Older Versions
  
• Once complete exit JavaRA and delete the program.
• Run CCleaner.

• Click on SCAN NOW
  
• Click Accept.
  
• The program will then begin downloading the latest definition files.
• Once the files have been downloaded locate the Scan Settings and have it scan My Computer.
  
• The scan will take a while, so be patient and let it finish.

• Next, in the Save as prompt, Save in area, select: Desktop.
  
• In the File name area use KScan, or something similar.
  
• In Save as type: click the drop arrow and select: Text file [*.txt]
  
• Then, click: Save

• Click Start Now
  
• Check the box next to Enable thorough system inspection.
  
• Click Start
  
• Allow the scan to finish and scroll down to see if any updates are needed.
• Update anything listed.

Quote from: evilfantasy on July 22, 2008, 11:43:17 PM

Hmm, I THOUGHT it added to the Hosts file but the more I read on it I'm realizing it doesn't. Looks like it adds changes to the Registry.

I've never had any problems with it. I like that you can add clamwin to it and scan for virus and spyware. I don't recommend it to people because some of the settings can be confusing. It gives almost too much information lol. It's a good program from what I know.

*JS_REDIR is a Java Script Redirector Trojan. These usually sit in your temporary internet files folder. If you purge this folder or if the software quanartined it, its likely GONE. If you do a rescan and nothing detected, I'd say it may have removed it on its own.

I would however go with a better antivirus as well than that package if your DATA is very important. I havent heard BAD things about the Trend MICRO AV, but their hardware is generally not top of the LINE quality so the AV may also be questionable quality programming wise.You can go ahead and re-post your log file and one of our Malware Specialists will see if you're still infected if you want.

From ZA website. There is a FIX with an update I think.

Workaround to SUDDEN Loss of INTERNET Access ProblemThank you.

older computer, 386 RAM, ME OPER. SYSTEM. Only when I go online using dialup AOL as ISP, as I retrieve my email, programs start running that slow the system. When i CONT/ALT/DEL to check what is running, there are many "winoldap" programs, plus a program identified only by 9 numbers. When I highlight the 9-number program and click "end task" - very SHORTLY, a different 9-number program comes on. As I keep trying to end the programs by clicking cont/alt/del and end task, the programs start multiplying, more and more 9-digit and even 10-digit number programs show up, and sometimes a program called "lcf", and rarely, a program called .
All of these winoldap programs, and the 9-digit programs, and lcf -- quickly use up so much operating memory, that i get a warning window, saying my system is dangerously low on resources, or doesn't have the resources to continue. my only recourse is to restart the computer and start over.
It's as if a hacker out there, or his/her computer slave, has malware that notifies them that I have just gotten online, and sends these harassing programs to use up my operating memory and shut me down.
by the way, sometimes i access the internet through a high-speed connection using an external antenna and program - and it doesn't happen then. Only when i go through my dialup AOL.
I have run spybot which tells me i am clean.
anyone know of this problem, and how to cure?Print these instructions out.

1. Download SUPERAntiSpyware Free for Home Users:
http://www.superantispyware.com/

* Double-click SUPERAntiSpyware.exe and use the default settings for installation.
* An icon will be created on your desktop. Double-click that icon to launch the program.
* If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by SELECTING "Check for Updates". (If you encounter any problems while downloading the updates, manually download and unzip them from here: http://www.superantispyware.com/definitions.html.)
* Close SUPERAntiSpyware.

Restart computer in Safe Mode.
To enter Safe Mode, restart computer, and keep tapping F8 key, until menu appears; select Safe Mode; you'll see "Safe Mode" in all four corners of your screen

* Open SUPERAntiSpyware.
* Under "Configuration and Preferences", click the Preferences button.
* Click the Scanning Control tab.
* Under Scanner Options make sure the following are checked (leave all others unchecked):
o Close browsers before scanning.
o Scan for tracking cookies.
o Terminate memory threats before quarantining.
* Click the "Close" button to leave the control center screen.
* Back on the main screen, under "Scan for Harmful Software" click Scan your computer.
* On the left, make sure you check C:\Fixed Drive.
* On the right, under "Complete Scan", choose Perform Complete Scan.
* Click "Next" to start the scan. Please be patient while it scans your computer.
* After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
* Make sure everything has a checkmark next to it and click "Next".
* A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
* If asked if you want to reboot, click "Yes".
* To retrieve the removal information after reboot, launch SUPERAntispyware again.
o Click Preferences, then click the Statistics/Logs tab.
o Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
o If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
o Please copy and paste the Scan Log results in your next reply.
* Click Close to exit the program.
Post SUPERAntiSpyware log.

RESTART COMPUTER!

2. Download Malwarebytes' Anti-Malware: http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html to your desktop.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

RESTART COMPUTER!

3. Download HijackThis:
http://www.snapfiles.com/get/hijackthis.html
Post HijackThis log.Broni, Thank you for your help. Your reply recommended i download three programs. After many tries for each, I was SUCCESSFUL in downloading two of them: Superantispyware, and Hijack this. Each time I tried to install Malwarebytes, i got an error window saying: "Mbam has caused an error in KERNEL32.DLL" i couldn't get past that.
You asked me to post the scan logs, so below are the scanlogs for Superantispyware and Hijack this. I did fix the problems revealed in the Superantispyware scan. thank you again. i presume you will review this and give your expert opinion on further action, if any?
Lovetodance - a newbie

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:14:54 AM, on 4/26/2008
Platform: Windows ME (Win9x 4.90.3000A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\AVSYNMGR.EXE
C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
C:\PROGRAM FILES\COMPACT WIRELESS-G USB ADAPTER WIRELESS NETWORK MONITOR\WUSB54GC.EXE
C:\WINDOWS\SYSTEM\KB918547\KB918547.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\WINDOWS\SYSTEM\ICF.EXE
C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\TEATIMER.EXE
C:\PROGRAM FILES\SUPERANTISPYWARE\SUPERANTISPYWARE.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\VSSTAT.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\AVCONSOL.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\WEBSCANX.EXE
C:\WINDOWS\WUAUCLT.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\TREND MICRO\HIJACKTHIS\HIJACKTHIS.EXE
C:\WINDOWS\SYSTEM\WBEM\WINMGMT.EXE
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.netcenter.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YT.DLL
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YT.DLL
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YT.DLL
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [QuickTime Task] C:\WINDOWS\SYSTEM\QTTASK.EXE
O4 - HKLM\..\Run: [icf] c:\windows\system\icf.exe
O4 - HKLM\..\RunServices: [McAfeeVirusScanService] C:\Program Files\McAfee\McAfee VirusScan\AVSYNMGR.EXE
O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
O4 - HKLM\..\RunServices: [WUSB54GC] C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WUSB54GC.exe
O4 - HKLM\..\RunServices: [KB918547] C:\WINDOWS\SYSTEM\KB918547\KB918547.EXE
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\PROGRAM FILES\SUPERANTISPYWARE\SUPERANTISPYWARE.EXE
O4 - HKUS\.DEFAULT\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\Run: [SUPERAntiSpyware] C:\PROGRAM FILES\SUPERANTISPYWARE\SUPERANTISPYWARE.EXE (User 'Default user')
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: MSN Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O12 - Plugin for .mov: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.e4me.com/start.html
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/2,0,0,4482/mcfscan.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab
O16 - DPF: {8436FE12-31DB-48BF-83BF-FE682F9160B4} (NanoInstaller Class) - http://www.nanoscan.com/cabs/nanoinst.cab
O16 - DPF: {410A8B3C-7CCB-40E8-8B11-28B099E5C488} (Trend Micro Security Services Control) - http://tmss.trendmicro.com/Dashboard/controls/activex_10/TMSSReport.CAB
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = aoldsl.net
O20 - Winlogon Notify: !SASWinLogon - C:\PROGRAM FILES\SUPERANTISPYWARE\SASWINLO.DLL
--
End of file - 5328 bytes

SUPERAntiSpyware Scan Log
http://www.superantispyware.com
Generated 04/25/2008 at 05:45 PM
Application Version : 4.0.1154
Core Rules Database Version : 3412
Trace Rules Database Version: 1440
Scan type : Complete Scan
Total Scan Time : 02:45:24
Memory items scanned : 78
Memory threats detected : 0
Registry items scanned : 2788
Registry threats detected : 0
File items scanned : 93083
File threats detected : 318
Adware.Tracking Cookie
C:\WINDOWS\Cookies\[emailprotected][3].txt
C:\WINDOWS\Cookies\[emailprotected][3].txt
C:\WINDOWS\Cookies\[emailprotected][2].txt
C:\WINDOWS\Cookies\[emailprotected][2].txt
C:\WINDOWS\Cookies\[emailprotected][1].txt
C:\WINDOWS\Cookies\[emailprotected][3].txt
C:\WINDOWS\Cookies\[emailprotected][3].txt
C:\WINDOWS\Cookies\[emailprotected][2].txt
C:\WINDOWS\Cookies\[emailprotected][1].txt
C:\WINDOWS\Cookies\[emailprotected][1].txt
C:\WINDOWS\Cookies\[emailprotected][2].txt
C:\WINDOWS\Cookies\[emailprotected][2].txt
C:\WINDOWS\Cookies\[emailprotected][2].txt
C:\WINDOWS\Cookies\[emailprotected][1].txt
C:\WINDOWS\Cookies\[emailprotected][3].txt
C:\WINDOWS\Cookies\[emailprotected][2].txt
c:\WINDOWS\Cookies\[emailprotected][1].txt
c:\WINDOWS\Cookies\[emailprotected][1].txt
c:\WINDOWS\Cookies\[emailprotected][1].txt
c:\WINDOWS\Cookies\[emailprotected][2].txt
c:\WINDOWS\Cookies\[emailprotected][1].txt
c:\WINDOWS\Cookies\[emailprotected][1].txt
c:\WINDOWS\Cookies\[emailprotected][2].txt
c:\WINDOWS\Cookies\[emailprotected][2].txt
Trojan.Downloader-CounterMeasures
C:\WINDOWS\TEMP\1783461810.EXE
C:\WINDOWS\TEMP\116607120.EXE
C:\WINDOWS\TEMP\497114715.EXE
C:\WINDOWS\TEMP\226565080.EXE
C:\WINDOWS\TEMP\2064817459.EXE
C:\WINDOWS\TEMP\25417723.EXE
C:\WINDOWS\TEMP\1747663756.EXE
C:\WINDOWS\TEMP\857084248.EXE
C:\WINDOWS\TEMP\1753131485.EXE
C:\WINDOWS\TEMP\192667731.EXE
C:\WINDOWS\TEMP\1677266996.EXE
C:\WINDOWS\TEMP\1527001250.EXE
C:\WINDOWS\TEMP\1381021729.EXE
C:\WINDOWS\TEMP\128165402.EXE
C:\WINDOWS\TEMP\248703477.EXE
C:\WINDOWS\TEMP\2031814652.EXE
C:\WINDOWS\TEMP\850056738.EXE
C:\WINDOWS\TEMP\111115232.EXE
C:\WINDOWS\TEMP\243217668.EXE
C:\WINDOWS\TEMP\985131022.EXE
C:\WINDOWS\TEMP\1091753169.EXE
C:\WINDOWS\TEMP\1691555916.EXE
C:\WINDOWS\TEMP\427845405.EXE
C:\WINDOWS\TEMP\808891721.EXE
C:\WINDOWS\TEMP\1033571203.EXE
C:\WINDOWS\TEMP\1871884576.EXE
C:\WINDOWS\TEMP\574680213.EXE
C:\WINDOWS\TEMP\245275572.EXE
C:\WINDOWS\TEMP\185296495.EXE
C:\WINDOWS\TEMP\794643484.EXE
C:\WINDOWS\TEMP\940385718.EXE
C:\WINDOWS\TEMP\1903574919.EXE
C:\WINDOWS\TEMP\566402021.EXE
C:\WINDOWS\TEMP\1592199453.EXE
C:\WINDOWS\TEMP\425656949.EXE
C:\WINDOWS\TEMP\681817648.EXE
C:\WINDOWS\TEMP\463580536.EXE
C:\WINDOWS\TEMP\1652406392.EXE
C:\WINDOWS\TEMP\1557278300.EXE
C:\WINDOWS\TEMP\1104594359.EXE
C:\WINDOWS\TEMP\686226940.EXE
C:\WINDOWS\TEMP\1803777637.EXE
C:\WINDOWS\TEMP\1030396019.EXE
C:\WINDOWS\TEMP\881183940.EXE
C:\WINDOWS\TEMP\1401328552.EXE
C:\WINDOWS\TEMP\1468893358.EXE
C:\WINDOWS\TEMP\1724155919.EXE
C:\WINDOWS\TEMP\224800123.EXE
C:\WINDOWS\TEMP\979177663.EXE
C:\WINDOWS\TEMP\1646385628.EXE
C:\WINDOWS\TEMP\1888443144.EXE
C:\WINDOWS\TEMP\TEMPORARY INTERNET FILES\CONTENT.IE5\8LLVKOD6\N2_21_09_07_0[1].EXE
C:\WINDOWS\TEMP\TEMPORARY INTERNET FILES\CONTENT.IE5\8LLVKOD6\MUN1_26_11_070[1].EXE
C:\WINDOWS\TEMP\883388576.EXE
C:\WINDOWS\TEMP\1995744544.EXE
C:\WINDOWS\TEMP\797888104.EXE
C:\WINDOWS\TEMP\823724944.EXE
C:\WINDOWS\TEMP\1195428889.EXE
C:\WINDOWS\TEMP\351049212.EXE
C:\WINDOWS\TEMP\1929578738.EXE
C:\WINDOWS\TEMP\164029912.EXE
C:\WINDOWS\TEMP\1048552821.EXE
C:\WINDOWS\TEMP\718143316.EXE
C:\WINDOWS\TEMP\149601261.EXE
C:\WINDOWS\TEMP\2015354910.EXE
C:\WINDOWS\TEMP\1651329155.EXE
C:\WINDOWS\TEMP\1705759227.EXE
C:\WINDOWS\TEMP\1034695850.EXE
C:\WINDOWS\TEMP\361810599.EXE
C:\WINDOWS\TEMP\983624423.EXE
C:\WINDOWS\TEMP\995011927.EXE
C:\WINDOWS\TEMP\300535267.EXE
C:\WINDOWS\TEMP\1996309425.EXE
C:\WINDOWS\TEMP\1615837304.EXE
C:\WINDOWS\TEMP\1772834805.EXE
C:\WINDOWS\TEMP\738425988.EXE
C:\WINDOWS\TEMP\1341740041.EXE
C:\WINDOWS\TEMP\386053685.EXE
C:\WINDOWS\TEMP\1295878583.EXE
C:\WINDOWS\TEMP\1783561729.EXE
C:\WINDOWS\TEMP\603101180.EXE
C:\WINDOWS\TEMP\2089265122.EXE
C:\WINDOWS\TEMP\656415497.EXE
C:\WINDOWS\TEMP\1294431606.EXE
C:\WINDOWS\TEMP\240400285.EXE
C:\WINDOWS\TEMP\450701862.EXE
C:\WINDOWS\TEMP\956250694.EXE
C:\WINDOWS\TEMP\1658541624.EXE
C:\WINDOWS\TEMP\2087124551.EXE
C:\WINDOWS\TEMP\677410116.EXE
C:\WINDOWS\TEMP\947328951.EXE
C:\WINDOWS\TEMP\2121376641.EXE
C:\WINDOWS\TEMP\1988165569.EXE
C:\WINDOWS\TEMP\442609994.EXE
C:\WINDOWS\TEMP\1557750878.EXE
C:\WINDOWS\TEMP\1992838175.EXE
C:\WINDOWS\TEMP\2073680032.EXE
C:\WINDOWS\TEMP\1189050570.EXE
C:\WINDOWS\TEMP\852507429.EXE
C:\WINDOWS\TEMP\740539713.EXE
C:\WINDOWS\TEMP\126494284.EXE
C:\WINDOWS\TEMP\2080014793.EXE
C:\WINDOWS\TEMP\541476132.EXE
C:\WINDOWS\TEMP\1591287222.EXE
C:\WINDOWS\TEMP\1727404724.EXE
C:\WINDOWS\TEMP\553978405.EXE
C:\WINDOWS\TEMP\1580214671.EXE
C:\WINDOWS\TEMP\1629932814.EXE
C:\WINDOWS\TEMP\1903848543.EXE
C:\WINDOWS\TEMP\1856011470.EXE
C:\WINDOWS\TEMP\1706184932.EXE
C:\WINDOWS\TEMP\885603543.EXE
C:\WINDOWS\TEMP\2141927667.EXE
C:\WINDOWS\TEMP\1104037648.EXE
C:\WINDOWS\TEMP\2047333949.EXE
C:\WINDOWS\TEMP\1200113612.EXE
C:\WINDOWS\TEMP\873651765.EXE
C:\WINDOWS\TEMP\394041053.EXE
C:\WINDOWS\TEMP\2135144844.EXE
C:\WINDOWS\TEMP\2026810824.EXE
C:\WINDOWS\TEMP\199153595.EXE
C:\WINDOWS\TEMP\353138128.EXE
C:\WINDOWS\TEMP\501352008.EXE
C:\WINDOWS\TEMP\1013563911.EXE
C:\WINDOWS\TEMP\498860695.EXE
C:\WINDOWS\TEMP\796833231.EXE
C:\WINDOWS\TEMP\903272850.EXE
C:\WINDOWS\TEMP\1106438600.EXE
C:\WINDOWS\TEMP\338258924.EXE
C:\WINDOWS\TEMP\1743649742.EXE
C:\WINDOWS\TEMP\1604711391.EXE
C:\WINDOWS\TEMP\1773622609.EXE
C:\WINDOWS\TEMP\36175615.EXE
C:\WINDOWS\TEMP\1021212171.EXE
C:\WINDOWS\TEMP\694580450.EXE
C:\WINDOWS\TEMP\305738688.EXE
C:\WINDOWS\TEMP\727107768.EXE
C:\WINDOWS\TEMP\1062500794.EXE
C:\WINDOWS\TEMP\948000871.EXE
C:\WINDOWS\TEMP\1576227941.EXE
C:\WINDOWS\TEMP\312733638.EXE
C:\WINDOWS\TEMP\192137425.EXE
C:\WINDOWS\TEMP\1307780432.EXE
C:\WINDOWS\TEMP\393872833.EXE
C:\WINDOWS\TEMP\1537071879.EXE
C:\WINDOWS\TEMP\577173495.EXE
C:\WINDOWS\TEMP\1409181888.EXE
C:\WINDOWS\TEMP\1297503350.EXE
C:\WINDOWS\TEMP\1294519278.EXE
C:\WINDOWS\TEMP\374536230.EXE
C:\WINDOWS\TEMP\253275134.EXE
C:\WINDOWS\TEMP\1056901638.EXE
C:\WINDOWS\TEMP\1121155218.EXE
C:\WINDOWS\TEMP\2012915916.EXE
C:\WINDOWS\TEMP\2000342918.EXE
C:\WINDOWS\TEMP\1798261627.EXE
C:\WINDOWS\TEMP\629732237.EXE
C:\WINDOWS\TEMP\141220456.EXE
C:\WINDOWS\TEMP\1277225550.EXE
C:\WINDOWS\TEMP\447830807.EXE
C:\WINDOWS\TEMP\196833965.EXE
C:\WINDOWS\TEMP\467587296.EXE
C:\WINDOWS\TEMP\1663038582.EXE
C:\WINDOWS\TEMP\1454731974.EXE
C:\WINDOWS\TEMP\155730963.EXE
C:\WINDOWS\TEMP\1468874206.EXE
C:\WINDOWS\TEMP\519222298.EXE
C:\WINDOWS\TEMP\1155224580.EXE
C:\WINDOWS\TEMP\902495874.EXE
C:\WINDOWS\TEMP\1548618164.EXE
C:\WINDOWS\TEMP\1879167743.EXE
C:\WINDOWS\TEMP\758582975.EXE
C:\WINDOWS\TEMP\1720065934.EXE
C:\WINDOWS\TEMP\1889635645.EXE
C:\WINDOWS\TEMP\724008402.EXE
C:\WINDOWS\TEMP\1749819921.EXE
C:\WINDOWS\TEMP\559654817.EXE
C:\WINDOWS\TEMP\1548074364.EXE
C:\WINDOWS\TEMP\461000619.EXE
C:\WINDOWS\TEMP\1401304279.EXE
C:\WINDOWS\TEMP\685729430.EXE
C:\WINDOWS\TEMP\1190060941.EXE
C:\WINDOWS\TEMP\925127392.EXE
C:\WINDOWS\TEMP\1244167452.EXE
C:\WINDOWS\TEMP\701747115.EXE
C:\WINDOWS\TEMP\1475097384.EXE
C:\WINDOWS\TEMP\1605222081.EXE
C:\WINDOWS\TEMP\548531169.EXE
C:\WINDOWS\TEMP\179641900.EXE
C:\WINDOWS\TEMP\1117017547.EXE
C:\WINDOWS\TEMP\574251572.EXE
C:\WINDOWS\TEMP\379014259.EXE
C:\WINDOWS\TEMP\341346903.EXE
C:\WINDOWS\TEMP\1232915079.EXE
C:\WINDOWS\TEMP\1944798515.EXE
C:\WINDOWS\TEMP\1324496912.EXE
C:\WINDOWS\TEMP\1700032886.EXE
C:\WINDOWS\TEMP\523321960.EXE
C:\WINDOWS\TEMP\933682476.EXE
C:\WINDOWS\TEMP\1519783249.EXE
C:\WINDOWS\TEMP\1466616894.EXE
C:\WINDOWS\TEMP\868649713.EXE
C:\WINDOWS\TEMP\1041515000.EXE
C:\WINDOWS\TEMP\339595423.EXE
C:\WINDOWS\TEMP\1960428149.EXE
C:\WINDOWS\TEMP\788922347.EXE
C:\WINDOWS\TEMP\931004790.EXE
C:\WINDOWS\TEMP\1065339651.EXE
C:\WINDOWS\TEMP\2127863161.EXE
C:\WINDOWS\TEMP\633369841.EXE
C:\WINDOWS\TEMP\1570446159.EXE
C:\WINDOWS\TEMP\1244276680.EXE
C:\WINDOWS\TEMP\378364822.EXE
C:\WINDOWS\TEMP\634815060.EXE
C:\WINDOWS\TEMP\1240410851.EXE
C:\WINDOWS\TEMP\1657556769.EXE
C:\WINDOWS\TEMP\1452253732.EXE
C:\WINDOWS\TEMP\904252060.EXE
C:\WINDOWS\TEMP\1865761204.EXE
C:\WINDOWS\TEMP\875745760.EXE
C:\WINDOWS\TEMP\1659794345.EXE
C:\WINDOWS\TEMP\1294778947.EXE
C:\WINDOWS\TEMP\583819388.EXE
C:\WINDOWS\TEMP\1607971730.EXE
C:\WINDOWS\TEMP\1332993152.EXE
C:\WINDOWS\TEMP\227065640.EXE
C:\WINDOWS\TEMP\467296176.EXE
C:\WINDOWS\TEMP\1138057378.EXE
C:\WINDOWS\TEMP\1463319338.EXE
C:\WINDOWS\TEMP\2134659209.EXE
C:\WINDOWS\TEMP\1295623186.EXE
C:\WINDOWS\TEMP\1691256261.EXE
C:\WINDOWS\TEMP\1202758815.EXE
C:\WINDOWS\TEMP\1462138988.EXE
C:\WINDOWS\TEMP\386688466.EXE
C:\WINDOWS\TEMP\1403761852.EXE
C:\WINDOWS\TEMP\833091513.EXE
C:\WINDOWS\TEMP\604820707.EXE
C:\WINDOWS\TEMP\1144270734.EXE
C:\WINDOWS\TEMP\1872512701.EXE
C:\WINDOWS\TEMP\796178611.EXE
C:\WINDOWS\TEMP\1803863233.EXE
C:\WINDOWS\TEMP\1767460363.EXE
C:\WINDOWS\TEMP\168824278.EXE
C:\WINDOWS\TEMP\577610588.EXE
C:\WINDOWS\TEMP\145772399.EXE
C:\WINDOWS\TEMP\1591078409.EXE
C:\WINDOWS\TEMP\1276210648.EXE
C:\WINDOWS\TEMP\1547463941.EXE
C:\WINDOWS\TEMP\238429684.EXE
C:\WINDOWS\TEMP\1244279795.EXE
C:\WINDOWS\TEMP\948522789.EXE
C:\WINDOWS\TEMP\461783995.EXE
C:\WINDOWS\TEMP\374010561.EXE
C:\WINDOWS\TEMP\1030921599.EXE
C:\WINDOWS\TEMP\1373336898.EXE
C:\WINDOWS\TEMP\1996429664.EXE
C:\WINDOWS\TEMP\1383957323.EXE
C:\WINDOWS\TEMP\1037419389.EXE
C:\WINDOWS\TEMP\88421448.EXE
C:\WINDOWS\TEMP\687979530.EXE
C:\WINDOWS\TEMP\1514822543.EXE
C:\WINDOWS\TEMP\1257596660.EXE
C:\WINDOWS\TEMP\1900247045.EXE
C:\WINDOWS\TEMP\2039777676.EXE
C:\WINDOWS\TEMP\2010166493.EXE
C:\WINDOWS\TEMP\375852463.EXE
C:\WINDOWS\TEMP\2004408143.EXE
C:\WINDOWS\TEMP\1731702606.EXE
C:\WINDOWS\TEMP\1240417269.EXE
C:\WINDOWS\TEMP\366129353.EXE
C:\WINDOWS\TEMP\5636449.EXE
C:\WINDOWS\TEMP\587472105.EXE
C:\WINDOWS\TEMP\1868004981.EXE
C:\WINDOWS\TEMP\2115581590.EXE
C:\WINDOWS\TEMP\286012072.EXE
C:\WINDOWS\TEMP\1335519833.EXE
C:\WINDOWS\TEMP\1944766562.EXE
C:\WINDOWS\TEMP\430142298.EXE
C:\WINDOWS\TEMP\412195269.EXE
C:\WINDOWS\TEMP\1929699942.EXE
C:\WINDOWS\TEMP\1849685769.EXE
C:\WINDOWS\TEMP\895913854.EXE
C:\WINDOWS\TEMP\2118840552.EXE
C:\WINDOWS\TEMP\813868102.EXE
C:\WINDOWS\TEMP\798787136.EXE
C:\WINDOWS\TEMP\426801159.EXE
C:\WINDOWS\TEMP\749075629.EXE
C:\WINDOWS\TEMP\394188147.EXE
C:\WINDOWS\TEMP\1275496277.EXE
C:\WINDOWS\TEMP\2074726245.EXE
C:\WINDOWS\TEMP\790411404.EXE
C:\WINDOWS\TEMP\1237909462.EXE
C:\WINDOWS\TEMP\50961291.EXE



*** You're not using any firewall, which is not good.
Download, and install Jetico Personal Firewall v.1 freeware: http://www.jetico.com/index.htm#/jpfirewall.htm

*** Disable TeaTimer, as it'll interfere with the cleaning process:
Right click Spybot's TeaTimer System Tray Icon.
Click Exit Spybot-S&D Resident.
TeaTimer closes.

1. Print this post out, since you won't have an access to it, at some point.

2. Close all windows, except for HijackThis.

3. Put a checkmark next to the following HijackThis entries (some entries will be checkmarked to disable unnecessary startups; in those cases (marked with *), no actual program will be removed):

- *O4 - HKLM\..\Run: [QuickTime Task] C:\WINDOWS\SYSTEM\QTTASK.EXE
- O4 - HKLM\..\Run: [icf] c:\windows\system\icf.exe
- *O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\PROGRAM FILES\SUPERANTISPYWARE\SUPERANTISPYWARE.EXE
- *O4 - HKUS\.DEFAULT\..\Run: [SUPERAntiSpyware] C:\PROGRAM FILES\SUPERANTISPYWARE\SUPERANTISPYWARE.EXE (User 'Default user')
- *O20 - Winlogon Notify: !SASWinLogon - C:\PROGRAM FILES\SUPERANTISPYWARE\SASWINLO.DLL

4. Click on Fix checked button.

5. Restart your computer in Safe Mode (keep tapping F8 key, when your computer starts, until menu appears)

6. Open Windows Explorer. Go Tools>Folder Options>View tab, put a checkmark next to Show hidden files, and folders.

7. Delete following files/folders (if present):

- icf.exe from c:\windows\system

8. Restart in Normal Mode.

9. Post new HijackThis log.I accomplished all of the above, BUT BIG PROBLEM. Now I cannot get online with my AOL dialup. it hangs up at step 5 - "Talking to Network" and almost everything freezes. Cursor moves, but nothing responds to clicks or keys. when i hit "Contol - alt-delete" even once, it immediately starts rebooting. I have tried many times, cannot get past this. (I am sending this from a friend's computer) help!I am happy to report that I solved this problem. I just uninstalled the Jetico Firewall, and everything SEEMS to work fine now. whew! ... needless to say, i am not a fan of Jetico Firewall.That's the only free firewall available for ME. You can't be safe on the internet without firewall.
I also need fresh HJT log.Here's the fresh HJT log, hot out of the oven (by the way, thanks for your time and expertise. the other actions you recomended cured the other problem.)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:52:41 AM, on 4/29/2008
Platform: Windows ME (Win9x 4.90.3000A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\AVSYNMGR.EXE
C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
C:\PROGRAM FILES\COMPACT WIRELESS-G USB ADAPTER WIRELESS NETWORK MONITOR\WUSB54GC.EXE
C:\WINDOWS\SYSTEM\KB918547\KB918547.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\TEATIMER.EXE
C:\PROGRAM FILES\SUPERANTISPYWARE\SUPERANTISPYWARE.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\VSSTAT.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\AVCONSOL.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\WEBSCANX.EXE
C:\WINDOWS\WUAUCLT.EXE
C:\PROGRAM FILES\TREND MICRO\HIJACKTHIS\HIJACKTHIS.EXE
C:\WINDOWS\SYSTEM\WBEM\WINMGMT.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.netcenter.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YT.DLL
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YT.DLL
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YT.DLL
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [QuickTime Task] C:\WINDOWS\SYSTEM\QTTASK.EXE
O4 - HKLM\..\RunServices: [McAfeeVirusScanService] C:\Program Files\McAfee\McAfee VirusScan\AVSYNMGR.EXE
O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
O4 - HKLM\..\RunServices: [WUSB54GC] C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WUSB54GC.exe
O4 - HKLM\..\RunServices: [KB918547] C:\WINDOWS\SYSTEM\KB918547\KB918547.EXE
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\PROGRAM FILES\SUPERANTISPYWARE\SUPERANTISPYWARE.EXE
O4 - HKUS\.DEFAULT\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\Run: [SUPERAntiSpyware] C:\PROGRAM FILES\SUPERANTISPYWARE\SUPERANTISPYWARE.EXE (User 'Default user')
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: MSN Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O12 - Plugin for .mov: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.e4me.com/start.html
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/2,0,0,4482/mcfscan.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab
O16 - DPF: {8436FE12-31DB-48BF-83BF-FE682F9160B4} (NanoInstaller Class) - http://www.nanoscan.com/cabs/nanoinst.cab
O16 - DPF: {410A8B3C-7CCB-40E8-8B11-28B099E5C488} (Trend Micro Security Services Control) - http://tmss.trendmicro.com/Dashboard/controls/activex_10/TMSSReport.CAB
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = aoldsl.net
O20 - Winlogon Notify: !SASWinLogon - C:\PROGRAM FILES\SUPERANTISPYWARE\SASWINLO.DLL

--
End of file - 5171 bytes
The log is clean, now.

Download, and install CCleaner: http://www.ccleaner.com/download/builds. Get "Slim" version.
Read CCleaner instruction here: http://www.jahewi.nl/ccleaner/ccleaner.html, and run CCleaner

Turn System Restore off: http://download.nai.com/products/mcafee-avert/SystemHelpDocs/DisableSysRestore.htm

Restart computer.

Turn System Restore on.

Try to install Jetico again.
Im just wanted to thank Broni VERY much, who solved the problem with the advice in this topic.You're very welcome
Thank you for posting back.

Several days ago,I received a windows update notice for SP3;as normal,I complied and thought no more about it.Since then,I am constantly recieving a warning box stating "DLL C:\WINDOWS\system32\MSACM32.dll". It makes a reference to some windows image being unable to load,and states that I need to match it up against some diskette.At the same time,I have lost all audio.I have checked and rechecked wires,plug-ins,sound card,mixer settings,etc;nothing seems amiss.The only info I found out about MSACM32 on the net was that it might be some kind of audio compression file.HELP! Is this a bug,or do I need to get in a different topic.Any reply is greatly appreciated...Thanks...CNReddMSACM32.dll - msacm32.dll is a module containing functions for audio compression for 32-bit applications.

I will move this topic to the Computer software forum. I don't think this is malware related.I appreciate that you put this in the right category...I wasn't sure.Could this have anything to do with the Windows SP3 download? I hate to think that,but thats when it started.I am also leary of removing that without some more educated opinions.Thanks in advance....CNReddNot sure whats causing it. A few things to try.

Try running sfc /scannow, Start > Run type sfc /scannow then click OK. Make sure that the Windows XP installation cd is in the computer.

Try downloading the msacm32.dll file from http://www.webzila.com/?wz=dll then register it with your system by following these instructions: http://forum.webzila.com/index.php?showtopic=543OK....XP was already installed when I purchased the PC,so all I have is the back-up that was suggested I make.I placed it in the pc and followed the "run" commands and got nothing.It verified that all windows files were intact and then did nada.As for step 2, that hasn't resolved anything either.I considered restoring to factory specs,but this issue will not allow me to burn a cd or dvd.Now what?Post a HJT log so we can do a quick check for malware. Although I don't think it is malware it won't hurt to look real fast.

Download and rename TrendMicro HijackThis.exe (HJT)

• Double-click on HJTInstall.
• Click on the Install button.
  
• It will automatically place HJT in C:\Program Files\TrendMicro\HijackThis\HijackThis.exe.
  
• Upon install, HijackThis should open for you.

• Close HijackThis and rename it.
  
• Go to C:\Program Files\TREND Micro\HijackThis.exe
  
• Right click on HijackThis.exe and select Rename.
  
• Type in sniper.exe and press Enter.
  
• Right-click on sniper.exe and select Send To > Desktop (create shortcut)

• From the desktop open HijackThis.
• If using Windows Vista, Right-click and Run As Administrator.
  
• Click on the Do a system scan and save a log file button
  
• Hijackthis will scan and then a log will open in notepad.
• Copy and then paste the entire contents of the log in your post.
  
• Do not have HijackThis fix anything yet. Most of what it finds will be harmless or even required.

Hi all,

I have a PC with has been seriously infected with all sorts of rubbish. I have done the USUAL scans, and most of it seems to have been deleted. I have attached the log files.

Cheers

Nick

[recovering disk space -- ATTACHMENT deleted by admin]You're right, it looks like just about everything has been removed. You should close all windows (including this one) and fix the following entries with HijackThis...

O3 - Toolbar: (no name) - {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - (no file)
O20 - Winlogon Notify: pMdcdBtQ - pMdcdBtQ.dll (file missing)

Then if you're up to it, you should run the three scans again just to be sure.

While you're at it, you need a firewall. Without it, you are leaving yourself vulnerable. My suggestion would be Comodo.

Also...
Your Java is out of date.

Older versions have vulnerabilities that malicious sites can use to infect your system.

First install the new SUN Java Runtime Environment

Be sure to close all browser windows before beginning the install.

Remove the old version(s)

• Go to add/remove programs and uninstall all old versions.
• Be sure not to remove the new version that was just installed.
  
• Download JavaRa.zip and UNZIP the file to your Desktop.
  
• Open JavaRA.exe and choose Remove Older Versions
  
• Once complete exit JavaRA and delete the program.
• Run CCleaner.

Press Ctrl+Alt+DELETE (all at once)

Copy this "%userprofile%\desktop\combofix.exe" /killall

In Task Manager go to File > New Task (Run...) then paste in the "%userprofile%\desktop\combofix.exe" /killall and click OK.when i go into safemode, an extra user comes up.
it says administrator and requires a password
usually i am the main account
but when i try to control alt delete, it says that the task has been disabled by your administratorI'm about of ideas,

Download this registry file to the Desktop.

RIGHT click it and and choose Merge.

Now try to run Combofix.

You may have to restart the computer for it to take effect.I'll be signing off shortly but will try to check back in here in a few hours or so. maybe not until tomorrow. You may try running this Antivirus from the flash drive. It might clean enough to get some functions back.

Download ClamWin Portable to a portable device and make sure to update it.

Now put the flash drive in to the infected computer.
To start up ClamWin Portable, just double-click PortableClamWin.exe file where you installed Portable ClamWin on your portable drive.
Select the drive(s) you want to scan and click Scan.
Let ClamWin fix whatever it finds.

Removing Your Drive - When you're done, exit ClamWin.
Then select the Safely Remove Hardware option from the icon in the system tray.
If you remove the drive while it is writing, you may lose data.ok ill try that
thaksIf you can get Combofix to run it will be a huge help. The log is also very important. If you do get it to run and loose the log for some reason it can be found in c:\combofix.txt

GOOD luck, I'll be back later...
i think im just gonna have SOMEBODY come fix it
thanks for all the help thoughIt may be a good idea to reinstall the Operating System.

i'm using WINDOWS XP, downloaded a malware once that triggered a trojan-outbreak ... had to reformat my PC. while Windows was already installing the monitor's brightness option kept popping-out and adjusts itself. i even deleted, created, & reformatted the partitions...it's still there, during start-ups til i shut down!

then i installed AVG, while pressing the monitor button down- it somehow stops it. however it proceeds whenever i leave it alone. it became worse, toying with all the monitor controls?!? i also had to install SP2, then it stopped from selecting all of the controls and only the "brightness/contrast" options were manipulated. i scanned the whole computer with AVG, but it didn't detect anything unusual!

Now the 'brightness' control's the only one that pops-out, from start-ups til shut-down, and avg still doesn't detect anything... please help ASAP, am an out-of-school-youngster and i have to study a lot even just online and all... i don't know if this sort of malfunction would infect my tablet, this hinders me from my drawing/animating practices... badly... please help.Welcome to CH.

Download and rename TrendMicro HijackThis.exe (HJT)

• Double-click on HJTInstall.
• Click on the Install button.
  
• It will automatically place HJT in C:\Program Files\TrendMicro\HijackThis\HijackThis.exe.
  
• Upon install, HijackThis should open for you.

• Close HijackThis and rename it.
  
• Go to C:\Program Files\Trend Micro\HijackThis.exe
  
• Right click on HijackThis.exe and select Rename.
  
• Type in sniper.exe and press Enter.
  
• Right-click on sniper.exe and select Send To > Desktop (CREATE shortcut)

• From the desktop open HijackThis.
• If using Windows Vista, Right-click and Run As Administrator.
  
• Click on the Do a system scan and save a log file button
  
• HijackThis will scan and then a log will open in notepad.
• Copy and then paste the entire contents of the log in your post.
  
• Do not have HijackThis fix anything yet. Most of what it finds will be harmless or even required.

Now the 'brightness' control's the only one that pops-out, from start-ups til shut-down

Now the 'brightness' control's the only one that pops-out, from start-ups til shut-down

If the menu keeps coming up the monitor thinks you pressed a button. A button is just a way of completing an electrical circuit. If dust accumulates on a circuit it can cause the circuit to act strangely. Purchasing some canned air from your local office supply store can solve this problem in most cases. Just blow the air in all the vent holes of the monitor to blow the dust out. Be sure to FOLLOW the directions on the can.[/qoute]

Cookies are nothing to worry about.

I'm with evilfantasy on this one...it doesn't sound like a malware issue. By the looks of it, your monitor is probably on the fritz. Your graphics card could also be the culprit, but I think that's not as likely. Do you have another monitor you can try? And can you hook your monitor up to a different computer? This is always the first thing you want to try when having significant monitor problems.

If the menu keeps coming up the monitor thinks you pressed a button. A button is just a way of completing an electrical circuit. If dust accumulates on a circuit it can cause the circuit to act strangely. Purchasing some canned air from your local office supply store can solve this problem in most cases. Just blow the air in all the vent holes of the monitor to blow the dust out. Be sure to follow the directions on the can.[/qoute]

I remembered something like that! only they taught me the exact opposite.. anyway, it's proven that dust can be that kind of conductor. somebody dusted the fans on this PC, last month... is it likely? (canned air isn't available here)

and Spyware's done:

[recovering disk space -- attachment deleted by admin]

Yes I think you need to get inside of the monitor and clean it out.

Don't worry about the cookies, they are just .txt files so they can't do anything malicious.

Hi! Thankies for clicking!

Okay well i recently have been attacked by a virus (cleaned it up w/ smitfraud) but now i have 2 major problems, if anyone can help i give you 100000 hugs!!!

Okay so like the subject is, i can only open Internet Explorer or Safari. I CANNOT open Opera or Firefox! Those are my main browsers, and i just downloaded Safari to see if that worked and it has, but i want my Firefox back!

SECOND problem, i cannot open .exe files!!! I used a computer at my sister's house to export .exe registry files onto a flash drive and things like that, i deleted the reg. on my laptop, and imported those ones. It hasn't worked Major help please!!

Also, randomly i was unable to open "Notepad" and "Internet Explorer" I have found it was on the list of Data Execution Prevention files (Control Panel>System>Performance Options) however Firefox was not on it, but nevertheless i did remove them from the list, and now they randomly pop up on it again and i'm continuously having to remove them when i start up my laptop and stuff.

Once again, .exe files don't work, so i cant download Hijack this or Malware Bytes, but however i to have Smitfraud and SUPERANTIVIRUS installed, and for some reason both do work, but ive deleted all threats found on Super anti virus, hasn't help.

Print these instructions out.

1. Download SUPERAntiSpyware Free for Home Users:
http://www.superantispyware.com/

* Double-click SUPERAntiSpyware.exe and use the default settings for installation.
* An icon will be created on your desktop. Double-click that icon to launch the program.
* If asked to update the program DEFINITIONS, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while DOWNLOADING the updates, manually download and unzip them from here: http://www.superantispyware.com/definitions.html.)
* Close SUPERAntiSpyware.

PHYSICALLY DISCONNECT FROM THE INTERNET

Restart computer in Safe Mode.
To enter Safe Mode, restart computer, and keep tapping F8 key, until menu appears; select Safe Mode; you'll see "Safe Mode" in all four corners of your screen

* Open SUPERAntiSpyware.
* Under "Configuration and Preferences", click the Preferences button.
* Click the Scanning Control tab.
* Under Scanner Options make sure the following are checked (leave all OTHERS unchecked):
o Close browsers before scanning.
o Scan for tracking cookies.
o Terminate memory threats before quarantining.
* Click the "Close" button to leave the control center screen.
* Back on the main screen, under "Scan for Harmful Software" click Scan your computer.
* On the left, make sure you check C:\Fixed Drive.
* On the right, under "Complete Scan", choose Perform Complete Scan.
* Click "Next" to start the scan. Please be patient while it scans your computer.
* After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
* Make sure everything has a checkmark next to it and click "Next".
* A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
* If asked if you want to reboot, click "Yes".
* To retrieve the removal information after reboot, launch SUPERAntispyware again.
o Click Preferences, then click the Statistics/Logs tab.
o Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
o If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
o Please copy and paste the Scan Log results in your next reply.
* Click Close to exit the program.
Post SUPERAntiSpyware log.

RECONNECT TO THE INTERNET

RESTART COMPUTER!

2. Download Malwarebytes' Anti-Malware: http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html to your desktop.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

RESTART COMPUTER!

3. Download HijackThis:
http://www.snapfiles.com/get/hijackthis.html
Post HijackThis log.Quote

Once again, .exe files don't work, so i cant download Hijack this or Malware Bytes

• Rename daft.exe to daft.com and double click on it to run.
  
• Read the disclaimer and click OK.
• Click on the Scan button.
  
• If it finds faulty file associations, they will appear in red beside a checkbox. If this occurs, just place a checkmark (tick) in the boxes in question.
• Click the Fix button.

I have attached SAS/MBAM/HiJack logs.

I'd like to know:

1) Is the computter functioning properly based on the results?
2) What steps to take and resolve?
3) Also I have:
CCleaner/avast/SAS/MBAM/HiJack/Wpsetup/Avenger/Scotty on Patrol
-Do I need any more protection...if so what...or do I need all of these?


Thanks.

[recovering disk space -- attachment deleted by admin]I want to check something as one of the entries is questionable.

Download FindAWF.exe by Noadfear to your Desktop.

• Double-click FindAWF.exe to START the tool.
  
  
• If a Security Alert shows, allow the program to run.
• As instructed, press any key to continue.
• Select option #1 - Scan for bak folders by typing 1 and press 'Enter'
  
• When the tool has COMPLETED, a report will open up in notepad.
• Please post the results of the awf.txt in your reply.

• Click Accept.
  
• Answer Yes, when prompted to install an ActiveX component.

• The program will then begin downloading the latest definition files.
• Once the files have been downloaded click on NEXT
  
• Locate the Scan Settings button & CONFIGURE to:
  • Scan using the following Anti-Virus database:
  • Extended
• Scan Options:
• Scan Archives
  
• Scan Mail Bases

• Click OK & have it scan My Computer

• Next, in the Save as prompt, Save in area, select: Desktop.
  
• In the File name area, use KScan, or something similar.
  
• In Save as type: click the drop arrow and select: Text file [*.txt]
  
• Then, click: Save

I didn't find the scan settings...only scan options...hopefully this wasn't a problem.

• Save it to your desktop.

• Double-click OTMoveIt2.exe to run it.
  
• Copy the lines in the codebox below.

• Return to OTMoveIt2, right click in the Paste List of Files/Folders to Move window (under the yellow bar) and choose Paste

• Click the red Moveit! button.
  
• Copy everything in the Results window (under the green bar) and paste it in your next reply.
  
• Close OTMoveIt2

• Go to Start > Programs > Accessories > System Tools and click System Restore
  
• Choose the radio button marked Create a Restore Point on the first screen then click Next Give the Restore Point a name then click Create.
  
• The new restore point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
• Next go to Start > Run and type Cleanmgr
  
• Click OK
  
• Click the More Options Tab.
  
• Click Clean Up in the System Restore section to remove all previous restore POINTS except the newly created clean one.

• Click Start Now
  
• Check the box next to Enable thorough system inspection.
  
• Click Start
  
• Allow the scan to finish and scroll down to see if any updates are needed.
• Update anything listed.

i'm facing de same problem with Kain's and trying to solve it by following evilfantasy's method:

""Open Hijackthis and select Do a system scan only then place a check mark next to:
- O2 - BHO:.....................Exit Hijackthis and run CCleaner.""

But..................

i can't find these items in my Hijackthis Scan Result:

- O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
- O4 - Startup: PowerReg Scheduler.exe
- O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://cid-be3dfe2fec863c6b.spaces.live.com/PhotoUpload/MsnPUpld.cab
- O20 - Winlogon Notify: tuvWNFYr - tuvWNFYr.dll (file missing).

Here's the Log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:27:57 PM, on 7/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\system32\ctfmon.exe
D:\WINDOWS\SOUNDMAN.EXE
D:\PROGRA~1\AVG\AVG8\avgtray.exe
D:\Program Files\Unlocker\UnlockerAssistant.exe
D:\Program Files\K-Lite Codec Pack\Real\Update_OB\realsched.exe
D:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
D:\Program Files\Messenger\msmsgs.exe
D:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
D:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
D:\Program Files\Common Files\LightScribe\LSSrvc.exe
D:\PROGRA~1\AVG\AVG8\avgrsx.exe
D:\PROGRA~1\AVG\AVG8\avgemc.exe
D:\WINDOWS\system32\wscntfy.exe
D:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
E:\Program Files\Opera 9.25\Opera.exe
D:\WINDOWS\system32\rundll32.exe
D:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
D:\Program Files\Trend Micro\HijackThis\HijackThis.exe
D:\Program Files\AVG\AVG8\avgui.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com.my/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: 778670 helper - {1B12F639-CBA9-45DD-89FE-9FA7D4340716} - D:\WINDOWS\system32\778670\778670.dll (file missing)
O2 - BHO: (no name) - {30AA1511-5129-41F3-AE22-F13FC9470116} - D:\WINDOWS\system32\mlJDttsR.dll (file missing)
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - E:\Program Files\BitComet 0.98\BitComet\tools\BitCometBHO_1.2.1.2.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - D:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {5B4B28C0-9623-4B9A-A001-7AF2B47336FE} - D:\WINDOWS\system32\hgGyvsqp.dll (file missing)
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - D:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - D:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "D:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] D:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] D:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AVG8_TRAY] D:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [UnlockerAssistant] "D:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\K-Lite Codec Pack\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [000000af] rundll32.exe "D:\WINDOWS\system32\wjjbrcvj.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "D:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &D&ownload &with BitComet - res://E:\Program Files\BitComet 0.98\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://E:\Program Files\BitComet 0.98\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://E:\Program Files\BitComet 0.98\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Convert link target to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://E:\Program Files\BitComet 0.98\BitComet\tools\BitCometBHO_1.2.1.2.dll/206 (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{37B57CAC-1FF1-4410-B56D-C444A633B5FD}: NameServer = 202.188.0.133 202.188.1.5
O17 - HKLM\System\CS1\Services\Tcpip\..\{37B57CAC-1FF1-4410-B56D-C444A633B5FD}: NameServer = 202.188.0.133 202.188.1.5
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - D:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: avgrsstx.dll
O20 - Winlogon Notify: mlJDttsR - mlJDttsR.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - D:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - D:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - D:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: hpdj - HP - D:\DOCUME~1\aaa\LOCALS~1\Temp\hpdj.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - D:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NMIndexingService - Nero AG - D:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

--
End of file - 7490 bytes

Hope evilfantasy can advise me on this if there is something more serious problem had occured to my p c OR i have to 'check-mark" on other item.

P.S.-What is CCleaner? A software? Whr to dl?

Your help will be highly appreciated.

Thanks.
I moved this to a new topic so we aren't interfering with the fixes in the other thread.

Welcome to CH.

Open Hijackthis and select Do a system scan only.

Place a check mark next to the following entries: (if there)

- O2 - BHO: 778670 helper - {1B12F639-CBA9-45DD-89FE-9FA7D4340716} - D:\WINDOWS\system32\778670\778670.dll (file missing)
- O2 - BHO: (no name) - {30AA1511-5129-41F3-AE22-F13FC9470116} - D:\WINDOWS\system32\mlJDttsR.dll (file missing)
- O2 - BHO: (no name) - {5B4B28C0-9623-4B9A-A001-7AF2B47336FE} - D:\WINDOWS\system32\hgGyvsqp.dll (file missing)
- O20 - Winlogon Notify: mlJDttsR - mlJDttsR.dll (file missing)

Important: Close all windows except for Hijackthis and then click Fix checked.

Exit Hijackthis and run CCleaner.

Download instructions for CCleaner are found > here <

Be sure to uncheck Install Yahoo Toolbar during the install of CCleaner to avoid installing the Yahoo Toolbar.

----------

Download Malwarebytes' Anti-Malware from here or here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.
  

• Start
• Run
• type: CLEANMGR.EXE
  
• Press Enter.
  

• Temporary Internet Files
• Downloaded Program Files
• Recycle Bin
• Temporary Files

• Click Accept.
  
• Answer Yes, when prompted to install an ActiveX component.

• The program will then begin downloading the latest definition files.
• Once the files have been downloaded click on NEXT
  
• Locate the Scan Settings button & configure to:
  • Scan using the following Anti-Virus database:
  • Extended
• Scan Options:
• Scan Archives
  
• Scan Mail Bases[/COLOR]

• Click OK & have it scan My Computer

• Next, in the Save as prompt, Save in AREA, select: Desktop.
  
• In the File name area, use KScan, or something similar.
  
• In Save as type: click the drop arrow and select: Text file [*.txt]
  
• Then, click: Save

• Go to Start > Programs > Accessories > System Tools and click System Restore
  
• Choose the radio button marked Create a Restore Point on the first screen then click Next Give the Restore Point a name then click Create.
  
• The new restore point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
• Next go to Start > Run and type Cleanmgr
  
• Click OK
  
• Click the More Options Tab.
  
• Click Clean Up in the System Restore section to remove all previous restore points except the newly created clean one.

• Click Start Now
  
• Check the box next to Enable thorough system inspection.
  
• Click Start
  
• Allow the scan to finish and scroll down to see if any updates are needed.
• Update anything listed.

Hey EVERYONE,

What is a better Anti Virus AVAST or Avira?

If someone says Avast? How do I USE it to scan? When you click on it in the right on my task bar. It's scanning but won't tell me anything. I had to switch to Avira. How do I use Avast if it's a better program?You right click on Avast icon, and click "START Avast Antivirus".
Memory scan starts:



When done, main scanner window opens:



You click on "Start scan" (indicated by me with red arrow), and scan starts:

Thank you. Let me TRY it. Is Home free?Yes.

and here's a fresh log of HJT

[recovering disk space -- ATTACHMENT deleted by admin]Download HostsXpert (http://www.majorgeeks.com/Hoster_d4626.html) and then follow the steps below:

* Unzip HostsXpert.zip
* It will create a folder named HostsXpert in whatever folder you extract it to.
* Run HostsXpert.exe by double clicking on it.
* click the MAKE Writeable? button.
* click Restore Microsoft's Hosts File and then click OK.
* Click the X to exit the program

Post new HJT log.all the help is really much appreciated guys
here's the new log for HJT

[recovering disk space -- attachment deleted by admin]*** Are you familiar with Windows Vista Ultimate Keygen? I'm aware, it's a torrent download, but my question is, if you downloaded it, and why do you need to run it on Windows XP?

*** Download, and run CTFMON-Remover: http://www.gerhard-schlager.at/en/projects/ctfmonremover/
The CTFMON-Remover helps you removing the annoying CTFMON.EXE from your Windows OPERATING system. The program is easy to use and displays whether the CTFMON.EXE is installed and running or not. If it was found then you can remove it within seconds. Just in case that you need the CTFMON sometime in the future there is ALSO an option to restore the original one.
Note:The CTFMON.EXE is among other things responsible for changing the language schema of your keyboard (e.g. for switching between the German and English keyboard layout). So in case you are using this feature you shouldn't remove or disable the CTFMON.EXE!

1. Print this post out, since you won't have an access to it, at some point.

2. Close all windows, except for HijackThis.

3. Put a checkmark next to the following HijackThis entries (some entries will be checkmarked to disable unnecessary startups; in those cases [marked with *], no actual program will be removed):

- O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
- *O4 - HKLM\..\Run: [win.exe] G:\Windows Vista Ultimate Keygen.exe
- *O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
- *O4 - HKCU\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
- *O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
- *O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
- *O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
- *O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
- *O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
- O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Register/Branding/olr3313/OCX/flashax.cab
- *O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll


4. Click on Fix checked button.

5. Restart computer.

6. Post new HijackThis log.*** Are you familiar with Windows Vista Ultimate Keygen? I'm aware, it's a torrent download, but my question is, if you downloaded it, and why do you need to run it on Windows XP?


so is that where it came from........ a neighbour was round using my computer a few days ago whilst i was at work and later that night told me they had been searching / researching stuff on vista ultimate !!!!!!!!
now i know what she was doing....... god *censored* BEEAAATCCCHHHH
i'll be givin her a mouthful (literally )this is the new HJT log

[recovering disk space -- attachment deleted by admin]Quote

now i know what she was doing....... god *censored* BEEAAATCCCHHHH

I have/had a virus/spyware/malware PROBLEM and upon doing an internet search I found your forum. I have followed the steps in "Read this before requesting malware removal help".

Background - I mistakenly authorized a download (my AVE internet security warned me) and immediately knew it was loading bad software. Being a novice I panicked and tried to shutdown my computer and disconnected my high speed internet. When I restarted I had several anti-spyware icons on my desk top. I ran my AVE virus checker and it was finding viruses, but was running very slow. As it continued additional windows popped up warning that software was trying access the internet. At first I clicked OK to not allow access, but then Internet explorer would open. I decided not to click any more windows and just let my virus scan run. At one point the scan stopped before completing it's check. It had removed and placed Trojans and other viruses in the vault. So I cancelled the scan. I was still receiving software unauthorized internet access windows popping up. I decided to run my Max Registry Cleaner to restore a prior registry. Following this no more unauthorized accesses OCCURRED. I reran my virus scan and it ran fast. The only issue I have now is Windows Automatic Update is off and I can't turn it on. It will also not run manually. I received a error code 0x8DDD0018, but Microsoft does not have info on this code.

I complete all the steps as described in Malware removal help. The logs are attached:
SUPERANTISPYWARE log, Malwarebytes Log, Hijackthis log.

[recovering disk space -- attachment deleted by admin]Open Hijackthis and select Do a system scan only then place a check mark next to:

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

Now click Fix checked, exit Hijackthis and run CCleaner.

The logs look fine, any more signs of malware?

-----

Look here for your error message. http://support.microsoft.com/kb/910337ALRIGHT. You are the BEST. No more signs of malware. Thanks for the Microsoft link, as that fixed the last issue.Glad to help.

Set a New Restore Point to prevent possible reinfection from an old one
Setting a new restore point AFTER cleaning your system will enable your computer to roll-back to a clean working state if needed.

• Go to Start > Programs > Accessories > System Tools and click System Restore
  
• Choose the radio button marked Create a Restore Point on the first screen then click Next Give the Restore Point a name then click Create.
  
• The new restore point will be stamped with the CURRENT date and time. Keep a log of this so you can find it easily should you need to use System Restore.
• Next go to Start > Run and type Cleanmgr
  
• Click OK
  
• Click the More Options Tab.
  
• Click Clean Up in the System Restore section to remove all previous restore points except the newly created clean one.

• Click Start Now
  
• Check the box next to Enable thorough system inspection.
  
• Click Start
  
• Allow the scan to finish and scroll down to see if any updates are needed.
• Update anything listed.

Not sure if this is where i need to be.. Perhaps you could redirect me if i you cannot help me,

I run Windows Vista on my Laptop

I have been experiencing some strange behavior on my computer..

Random bits of text seem to vanish from anywhere and everywhere on my computer.. Whether it be from the start menu or folder names. I also EXPERIENCE this on messenger and on some various websites.
On occasion some "windows" seem to take on obscure lengths or widths

This doesn't happen all the time though. Restarting the computer can temporarily fix the problem but it either returns soon after or it could be many days before it happens again.
I have run 3 different virus DETECTORS including kaspersky, and windows live one care.. These DETECTED absolutely nothing.. A clean system.. I have also TRIED a disk defrag and still the problem prevails..
I've search what seems like every page on the web but cannot find a single thing resembling my issue..
I have tried formatting.. The problem returned.
I wondered if it were something wrong with the hardware because soon after the issue occurred my systems performance has diminished. But i was told that a hardware issue won't produce problems like this.

The only thing I could link to ANY of my computer issues was my D-link wireless adapter.. Not a single thing was wrong with my com till i installed it..

Can anybody help??

Anyone that can help would be a godsend!!Have you gone and gotten all Windows updates?I had all windows updates till recently.. And now I cannot install SP1 for Vista. But i was fully up to date when this FIRST occured..

I was on a fan forum for my favorite online game when I clicked on an outside link that supposedly had humour on it. When the site started to load a popup window came up that said something like: Your internet has been running slower than usual install Microsoft Vista Anti-Virus to scan for problems. There were two BUTTONS "OK" and "Cancel". (more or less the message, wish I written it down) I panicked because my father said he got something similar and had (I think) chosen "Cancel" but still ended up with a huge virus that Microsoft had to help him quarantine (but couldn't remove completely). Instead of hitting any of the buttons I touched nothing and powered down my computer completely using the on/off button waited a bit, powered it back on and immediately ran my CCleaner, AVG Free, and Ad-Aware. It found nothing, but worried, I still found your site and followed your instructions down to and including installing and running HijackThis, SuperAntiSpyware, and Malwarebytes. SuperAntiSpyware and Malwarebytes found no problems either but Hijackthis came up with the following log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:29:47 AM, on 7/12/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe
C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WUSB54Gv42.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AVG\AVG8\avgui.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Opera\opera.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Trend Micro\HijackThis\sniper.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=0080423
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=0080423
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=0080423
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: ADOBE PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AVG Safe Search - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [ECenter] C:\Dell\E-Center\EULALauncher.exe
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL,avgrsstx.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Google Desktop Manager 5.7.801.7324 (GoogleDesktopManager-010708-104812) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: WUSB54Gv42SVC - GEMTEKS - C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe

--
End of file - 7239 bytes


Am I infected with anything? My computer is less than 2 months old and I am worried. I have not been experiencing any symptoms but it has only been about 4 hours since I got the popup window.

If it helps to know, I run Windows XP. My web browser is Opera, but I was previously using Mozilla Firefox. I have never used Internet Explorer on this computer because I heard it is more likely to get viruses than many other browsers.Welcome to CH.

I don't see any malware but there are a few things to fix.

Open Hijackthis and select Do a system scan only.

Place a check mark next to the following entries: (if there)

O2 - BHO: (no name) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)

Important: Close all windows except for Hijackthis and then click Fix checked.

Exit Hijackthis and run CCleaner.

----------

Your Java is out of date.

Older versions have vulnerabilities that malicious sites can use to infect your system.

First install the new Sun Java Runtime Environment

Remove the old version(s)

• Go to add/remove programs and uninstall all old versions.
• Be sure not to remove the new version that was just installed.
  
• Download JavaRa and unzip the file to your Desktop.
  
• Open JavaRA.exe and CHOOSE Remove Older Versions
  
• Once complete exit JavaRA and delete the program.
• Run CCleaner.

• Click Start Now
  
• Check the box next to Enable thorough system inspection.
  
• Click Start
  
• Allow the scan to finish and scroll down to see if any updates are needed.
• Update anything listed.

Hello,

I found a topic about how do I stop false positives with AVG but not sure what they are talking about.

Here is the link: HTTP://answers.yahoo.com/question/index?qid=20080511134332AAEl2fO

The part I am not understand is this part: You need to go to Tools > Advanced Settings, and then under Resident Shield go to Exceptions and ADD the path that ePSXe is in.

I tried using the search to scan my entire hard DISK for ePSXe and it found no results so I am not sure what to do. Even if it did find results. I am not sure how to add the path. Thank you for any replies.Do you have AVG 8.0? If you do, id reccommend either downloading avast or avira free antivirus in place of it. But, if you do like AVG, id say wait for a malware specialist to help you out The reason I say replace it is because I have heard that a lot of problems have risen since AVG came out wih 8.0Quote from: iamtonsoffun247 on July 08, 2008, 09:52:39 AM

Do you have AVG 8.0? If you do, id reccommend either downloading avast or avira free antivirus in place of it. But, if you do like AVG, id say wait for a malware specialist to help you out The reason I say replace it is because I have heard that a lot of problems have risen since AVG came out wih 8.0

hi I have a Compaq computer and it is running office 2000. Something really strange happened, one day I booted it up and there was this really weird Aztec looking background and as soon as it got to the screen where all my icons are my regular display screen came back to normal. However, my web browsers are not working and i cant install any software. An error message comes up something about kernel. I am really confused. I have AVG free edition for anti virus could i still have gotten a virus? Any help would be appreciated. Post exact error message.okay I should have explained this a BIT better. I am still connected to online through a router and it will let aim come up. However the message when the web BROWSER pops up is webpage you request is not available offline. The other message that popped up was when i tried to install windows live on care and I cant remember what it was because I am using a different computer right now and the computer that has these problems is in someones room which i dont have access to at the moment. (if needed I will try to get this info. for you) Also when i ran avg a new thing came up that said wsock32.dll but it just changed it. I dont know if that is something to be concerned with or not. This is the error message I'm talking about:
Quote

An error message comes up something about kernel

This is a log, not of my own computer but of someone else's.
It had a lot of issues at first but me and my friend have fixed them all.
I uninstalled Norton and installed AVG and Spybot.
Spybot found nothing, AVG found 3 viruses and two threats - if I remember correctly the viruses were named as w32.heur and the threats were adware.generic and something like adware/cc3.generic, I can't recall the exact names.
The viruses APPEARED to be remnants of Norton which I found odd.
The computer wasn't showing any signs of virus infection - no popups etc.
The OS is XP Home - it started off with SP1, I had to update to SP2 to install AVG, and then after it appeared fine it was updated to SP3.
Anyway, I'd be grateful if someone can take a look at the HJT log for me and see if anything is wrong with it.

Thanks in advance.

[Log follows]


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:40:06, on 09/07/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\DRIVERS\dcfssvc.exe
C:\Program Files\KODAK\KODAK Picture Transfer Software\PTSsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\UPHClean\uphclean.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\Logi_MwX.Exe
C:\Program Files\iRiver\HSeries\iHPDetect.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.orange.co.uk
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.orange.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: (no name) - {4FBACD73-F67C-42AE-B46A-03960AFE3DFB} - C:\PROGRA~1\ORANGE~1\TOOLBA~2.DLL
O2 - BHO: Adobe PDF Reader LINK Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: PopupKiller Class - {49E489BF-C4B8-11D6-9547-00C0DFF1DE9E} - C:\PROGRA~1\NoPops\NoPops.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O3 - Toolbar: Wanadoo - {8B68564D-53FD-4293-B80C-993A9F3988EE} - C:\PROGRA~1\Wanadoo\WSBar\WSBar.dll
O3 - Toolbar: Orange Toolbar - {E97B5F2E-CA8E-4D34-BDA3-44EEC4ED2B12} - C:\Program Files\Orange Toolbar UK\ToolbarContainer230.dll
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [iHP-100] C:\Program Files\iRiver\HSeries\iHPDetect.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Search with Wanadoo - res://C:\PROGRA~1\Wanadoo\WSBar\WSBar.dll/VSearch.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: MESSENGER - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {05CA9FB0-3E3E-4b36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/277b50a32e3d02c1dc18/netzip/RdxIE601.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1150198831734
O16 - DPF: {B020B534-4AA2-4B99-BD6D-5F6EE286DF5C} - https://a248.e.akamai.net/f/248/5462/2h/www.symantecstore.com/v2.0-img/operations/symbizpr/xcontrol/SymDlBrg.cab
O23 - Service: dcfssvc (Dcfssvc) - Eastman Kodak Company - C:\WINDOWS\System32\DRIVERS\dcfssvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ptssvc - Unknown owner - C:\Program Files\KODAK\KODAK Picture Transfer Software\PTSsvc.exe

--
End of file - 5710 bytesI don't see any antivirus installed?

C:\PROGRA~1\NoPops\NoPops.dll <- This program has had some questionable tactics in the past and the company (SpyBlocs) is listed on http://www.spywarewarrior.com/rogue_anti-spyware.htm

Look in add/remove programs for PopupKiller or NoPops and uninstall it. (if there)

Have HJT fix these entries.

- O2 - BHO: PopupKiller Class - {49E489BF-C4B8-11D6-9547-00C0DFF1DE9E} - C:\PROGRA~1\NoPops\NoPops.dll
- O8 - Extra context menu item: Search with Wanadoo - res://C:\PROGRA~1\Wanadoo\WSBar\WSBar.dll/VSearch.htm

----------

Delete the folder C:\Program Files\NoPops

----------

I think it would be wise to run MBAM

Download Malwarebytes' Anti-Malware from here or here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to VIEW the results.
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.
  

Hello. Let me start out by saying that I am not the most Tech-Savy guy out there, but I do know a bit about computers. My computer is custom built and has not had any major problems until now.

Last night, i rebooted my computer because it was acting funky, when i tried to reaccess the websites i was on (myspace, dictionary.com, google) there was no action taken at all. I am currently using the latest version of Modzilla firefox. I will go to open firefox, and it will load my homepage with ease, then when i type in a URL, it just sits there, with the 'loading' action in the upper righthand corner. What websites usually load in less than 2 seconds, now will not load within 3 hours.

What's worse, is that some websites do infact work with ease, like youtube, this one, and several other 'low traffic' websites.

I have pinged myspace, dictionary.com, and google, all returning packets within a short amount of time. It was then that I did a virus scan and discovered I was infected with the Vundo Trojan. I figured that this would be the problem, so I spent the past 5 hours getting it off my machine with a combination of Spybot Search & Destroy and manual removal. I am 95% sure that it is fully removed as Spybot doesn't list anything, and I haven't gotten any annoying popups lately.

After I removed Vundo, I attempted to retry accessing myspace again, but the same thing happened. I tried opening firefox in SAFEMODE, and i also tried PUTTING the entire computer in safemode, both of which didn't work.

This problem occurs with Firefox and with Windows Internet Explorer. Please help.

Thanks for reading!Let's make sure, your computer is clean, first.

Print these instructions out.

1. Download SUPERAntiSpyware Free for Home Users:
http://www.superantispyware.com/

* Double-click SUPERAntiSpyware.exe and use the default settings for installation.
* An icon will be created on your desktop. Double-click that icon to launch the program.
* If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download and unzip them from here: http://www.superantispyware.com/definitions.html.)
* Close SUPERAntiSpyware.

PHYSICALLY DISCONNECT FROM THE INTERNET

Restart computer in Safe Mode.
To enter Safe Mode, restart computer, and keep tapping F8 key, until menu appears; select Safe Mode; you'll see "Safe Mode" in all four corners of your screen

* Open SUPERAntiSpyware.
* Under "Configuration and Preferences", click the Preferences button.
* Click the Scanning Control tab.
* Under SCANNER Options make sure the following are checked (leave all others unchecked):
o Close browsers before scanning.
o Scan for tracking COOKIES.
o Terminate memory threats before quarantining.
* Click the "Close" button to leave the control center screen.
* Back on the main screen, under "Scan for Harmful Software" click Scan your computer.
* On the left, make sure you check C:\Fixed Drive.
* On the RIGHT, under "Complete Scan", choose Perform Complete Scan.
* Click "Next" to start the scan. Please be patient while it scans your computer.
* After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
* Make sure everything has a checkmark next to it and click "Next".
* A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
* If asked if you want to reboot, click "Yes".
* To retrieve the removal information after reboot, launch SUPERAntispyware again.
o Click Preferences, then click the Statistics/Logs tab.
o Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
o If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
o Please copy and paste the Scan Log results in your next reply.
* Click Close to exit the program.
Post SUPERAntiSpyware log.

RECONNECT TO THE INTERNET

RESTART COMPUTER!

2. Download Malwarebytes' Anti-Malware: http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html to your desktop.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

RESTART COMPUTER!

3. Download HijackThis:
http://www.snapfiles.com/get/hijackthis.html
Post HijackThis log.

Everytime I run Spybot S&AMP;D, I GET this item. should I FIX it or not?
Microsoft.WindowsSecurityCenter.AntiVir usOverride: [SBI $3604910C] Settings (Registry change, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusOverride
Read here: http://forums.spybot.info/archive/index.php/t-205.htmlThanks Broni, but all my protection is updated and functioning. I wonder what is this message trying to tell me?What version of Spybot do you have?

To find out open Spybot and click Help > About.

Post what all of the numbers say here. It will either start with 1.4 or 1.5.1.5.2.20Uninstall that version in add/remove programs then install the new 1.6 version. http://filehippo.com/download_spybot_search_destroy/

Run a new SCAN and see if it still reports the Registry change.I upgrade Spybot on my laptop and my PC. The laptop with Vista didn't show this item but it showed up on my PC.They probably won't show on Vista but will on XP.

From the Spybot forums see HERE.

Thanks, Evil. At least Vista is showing me why it is SUPPOSEDLY better than XP.

I've fixed all my problems. I just downloaded sum malware software removal tool.......fixed my problem. Thanks for all you guyz help.Well...we're glad your problem seems to be RESOLVED on your end.

However, based on the STOP error you supplied us, there may have been another ISSUE at fault here.

Please review the following page from Microsoft regarding probable causes and RESOLUTIONS to this particular STOP error code:

http://support.microsoft.com/default.aspx?scid=kb;en-us;137539

You might want to save the above link as a favorite...just in case that STOP error code rears its ugly face again...

Good luck!Quote

I just downloaded sum malware software removal tool.......fixed my problem.

Uh instead of starting a new topic, I'll just use this one I PRETTY much have the same problem as he had, but I can't finish a scan with MalwareBytes, or SuperantiSpyware. I did do the HijackThis scan though, and thus far it seems to be the only one that finishes without the blue screen appearing. I'm currently in Safe Mode with Networking, so that I can try to figure out how to get it off. I don't know if it helps, but I know the approximate location of where it is located, but every time I try to access/delete the file the blue screen pops-up.

Here is the HijackThis log.

Logfile of HijackThis v1.99.1
Scan saved at 11:14:39 AM, on 7/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\HijackThis\Crusty.exe.exe

R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://internetsearchservice.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr7/*http://www.yahoo.com/ext/search/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.BIN\MWSSRCAS.DLL
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Seekmo /fleok=1D8A83A5C5E3147799AB6B2A1FBB39BFE4976E26CAEDA120180A196D6093 - {07AA283A-43D7-4CBE-A064-32A21112D94D} - (no file)
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
O2 - BHO: (no name) - {184746EC-9E9D-4C7D-B9E7-9039EBD801A9} - (no file)
O2 - BHO: MSVPS System - {2D42D689-4B94-4734-92C2-606FC5F4C15D} - C:\WINDOWS\oprevtdp.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: Colej_uk Design Toolbar Helper - {54F3259F-8CF4-496a-9ECC-857410855A50} - C:\Program Files\Colej_uk Design Toolbar\v2.0.0.5\Colej_uk_Design_Toolbar.dll (file missing)
O2 - BHO: (no name) - {554A64A5-4E29-48F0-A729-BDF50CE38199} - C:\WINDOWS\system32\pmkhe.dll (file missing)
O2 - BHO: WarningBHO Class - {56FA7933-DC3E-403b-8D47-BB5E3F345A21} - C:\Program Files\AntiSpyCheck\IEWarning.dll (file missing)
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: (no name) - {5DDE5591-A8AB-4897-93EF-1E4E943F85A7} - (no file)
O2 - BHO: Video BHO - {681147C4-D615-461A-960F-655871E315C3} - C:\WINDOWS\pnop64.dll
O2 - BHO: (no name) - {6A87B991-A31F-4130-AE72-6D0C294BF082} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\program files\mcafee\virusscan\scriptcl.dll
O2 - BHO: (no name) - {99BA268B-4021-4739-9945-3C774217FE75} - C:\Program Files\NetProject\sbmdl.dll
O2 - BHO: Colej_uk Design Toolbar Helper - {A62CB71D-6EC8-4065-8EEC-07B224364A2B} - C:\Program Files\Colej_uk Design Toolbar\v2.0.0.5\Colej_uk_Design_Toolbar.dll (file missing)
O2 - BHO: (no name) - {BBB05D9E-0297-404D-A6BF-D8F2876B84A6} - C:\WINDOWS\system32\fccyvuu.dll (file missing)
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdmcks.dll
O2 - BHO: (no name) - {DE965520-995B-40B9-B0BA-840F79BCCCC7} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O3 - Toolbar: (no name) - {C6139A57-16FB-4FA4-8045-A847FBFFD695} - (no file)
O3 - Toolbar: (no name) - {2E608F70-C430-4bc5-96F6-608E02EBA5B2} - (no file)
O3 - Toolbar: (no name) - {860c2f6b-ca82-4282-9187-beccbb66f0af} - (no file)
O3 - Toolbar: Colej_uk Design Toolbar - {A45D8289-FFA3-4cd8-B83A-F84F7173B2CE} - C:\Program Files\Colej_uk Design Toolbar\v2.0.0.5\Colej_uk_Design_Toolbar.dll (file missing)
O3 - Toolbar: (no name) - {29C5A3B6-9A8D-4FA0-B5AD-3E20F4AA5C00} - (no file)
O3 - Toolbar: (no name) - {F06E2ABE-3A50-4079-BE25-FC100D9EAA25} - (no file)
O3 - Toolbar: (no name) - {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - (no file)
O3 - Toolbar: The bonsws - {CBF19702-9D5B-44E7-8F8A-6750209B76F3} - C:\WINDOWS\bonsws.dll
O3 - Toolbar: Colej_uk Design Toolbar - {7E895BD9-C3B7-4bc2-A7B8-758531866F00} - C:\Program Files\Colej_uk Design Toolbar\v2.0.0.5\Colej_uk_Design_Toolbar.dll (file missing)
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
O3 - Toolbar: Internet Service - {51D81DD5-55B7-497F-95DB-D356429BB54E} - C:\Program Files\NetProject\wamdl.dll
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [VirtualDrive] "C:\Program Files\FarStone\VirtualDrive\VDTask.exe" /AutoRestore
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [RAMDrive] "C:\Program Files\FarStone\VirtualDrive\VHD\RDTask.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\ALLTEL~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [Maplom] "C:\Program Files\SlySoft\Game Jackal\GameJackal.exe" /silent
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [Corel Photo Downloader] "C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKLM\..\Run: [BOC-426] C:\PROGRA~1\Comodo\CBOClean\BOC426.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [cnfgCav] "C:\Program Files\Comodo\Comodo AntiVirus\CMain.exe"
O4 - HKLM\..\Run: [cavUPSDBMaker] "C:\Program Files\Comodo\Comodo AntiVirus\UPSDBMaker.exe"
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZK
O9 - Extra button: (no name) - Software - (no file)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.ietoolpro.com/redirect.php (file missing)
O9 - Extra 'Tools' menuitem: IE Anti-Spyware - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.ietoolpro.com/redirect.php (file missing)
O9 - Extra button: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\cavemlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\cavemlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\cavemlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\cavemlsp.dll
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {0713E8D2-850A-101B-AFC0-4210102A8DA7} (Microsoft ProgressBar Control, VERSION 5.0 (SP2)) - http://download.mcafee.com/molbin/Shared/ComCtl32/6,0,80,22/ComCtl32.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2AF5BD25-90C5-4EEC-88C5-B44DC2905D8B} (DownloadManager Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.0.5.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {321FB770-1FBE-4BFE-BDC1-6F622D4FA499} - https://activation.alltel.com/wizlet/ALLTEL/static/controls/WebflowActiveXInstaller_2-0-0.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.1.2.76.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?972760012750
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1138820922273
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/1,0,0,26/mcgdmgr.cab
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/virtools.download.akamai.com/6712/player/install3.0/installer.exe
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4661/mcfscan.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{012B82A0-78A8-4153-8FED-9AD0B15B07F9}: NameServer = 85.255.115.59,85.255.112.133
O17 - HKLM\System\CCS\Services\Tcpip\..\{5662E96D-9C96-43F6-A6DC-939C5998F76B}: NameServer = 85.255.115.59,85.255.112.133
O17 - HKLM\System\CCS\Services\Tcpip\..\{6B86BE84-DF68-4669-AF92-F283A0FA8B24}: NameServer = 85.255.115.59,85.255.112.133
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.115.59 85.255.112.133
O17 - HKLM\System\CS1\Services\Tcpip\..\{012B82A0-78A8-4153-8FED-9AD0B15B07F9}: NameServer = 85.255.115.59,85.255.112.133
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.115.59 85.255.112.133
O17 - HKLM\System\CS2\Services\Tcpip\..\{012B82A0-78A8-4153-8FED-9AD0B15B07F9}: NameServer = 85.255.115.59,85.255.112.133
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 85.255.115.59 85.255.112.133
O17 - HKLM\System\CS3\Services\Tcpip\..\{012B82A0-78A8-4153-8FED-9AD0B15B07F9}: NameServer = 85.255.115.59,85.255.112.133
O17 - HKLM\System\CS4\Services\Tcpip\Parameters: NameServer = 85.255.115.59 85.255.112.133
O17 - HKLM\System\CS4\Services\Tcpip\..\{012B82A0-78A8-4153-8FED-9AD0B15B07F9}: NameServer = 85.255.115.59,85.255.112.133
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.115.59 85.255.112.133
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (file missing)
O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
O20 - Winlogon Notify: fccyvuu - fccyvuu.dll (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: monln - C:\WINDOWS\SYSTEM32\monln.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - Unknown owner - C:\PROGRA~1\AVG\AVG8\avgemc.exe (file missing)
O23 - Service: AVG Free8 WatchDog (avg8wd) - Unknown owner - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe (file missing)
O23 - Service: BOCore - COMODO - C:\Program Files\Comodo\CBOClean\BOCORE.exe
O23 - Service: Comodo Anti-Virus and Anti-Spyware Service - Comodo Inc. - C:\Program Files\Comodo\common\CAVASpy\cavasm.exe
O23 - Service: DomainService - - C:\WINDOWS\system32\hcekpaim.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6261\SAService.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

Moved to new topic.

It's always best to start a new topic. It gets too confusing working in someone elses thread.

Open Hijackthis and select Do a system scan only then place a check mark next to the following entries.

• R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://internetsearchservice.com
• R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
• O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
• O2 - BHO: Seekmo /fleok=1D8A83A5C5E3147799AB6B2A1FBB39BFE4976E26CAEDA120180A196D6093 - {07AA283A-43D7-4CBE-A064-32A21112D94D} - (no file)
• O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
• O2 - BHO: (no name) - {184746EC-9E9D-4C7D-B9E7-9039EBD801A9} - (no file)
• O2 - BHO: MSVPS System - {2D42D689-4B94-4734-92C2-606FC5F4C15D} - C:\WINDOWS\oprevtdp.dll
• O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
• O2 - BHO: Colej_uk Design Toolbar Helper - {54F3259F-8CF4-496a-9ECC-857410855A50} - C:\Program Files\Colej_uk Design Toolbar\v2.0.0.5\Colej_uk_Design_Toolbar.dll (file missing)
• O2 - BHO: (no name) - {554A64A5-4E29-48F0-A729-BDF50CE38199} - C:\WINDOWS\system32\pmkhe.dll (file missing)
• O2 - BHO: WarningBHO Class - {56FA7933-DC3E-403b-8D47-BB5E3F345A21} - C:\Program Files\AntiSpyCheck\IEWarning.dll (file missing)
• O2 - BHO: (no name) - {5DDE5591-A8AB-4897-93EF-1E4E943F85A7} - (no file)
• O2 - BHO: Video BHO - {681147C4-D615-461A-960F-655871E315C3} - C:\WINDOWS\pnop64.dll
• O2 - BHO: (no name) - {6A87B991-A31F-4130-AE72-6D0C294BF082} - (no file)
• O2 - BHO: (no name) - {99BA268B-4021-4739-9945-3C774217FE75} - C:\Program Files\NetProject\sbmdl.dll
• O2 - BHO: Colej_uk Design Toolbar Helper - {A62CB71D-6EC8-4065-8EEC-07B224364A2B} - C:\Program Files\Colej_uk Design Toolbar\v2.0.0.5\Colej_uk_Design_Toolbar.dll (file missing)
• O2 - BHO: (no name) - {BBB05D9E-0297-404D-A6BF-D8F2876B84A6} - C:\WINDOWS\system32\fccyvuu.dll (file missing)
• O2 - BHO: (no name) - {DE965520-995B-40B9-B0BA-840F79BCCCC7} - (no file)
• O3 - Toolbar: (no name) - {C6139A57-16FB-4FA4-8045-A847FBFFD695} - (no file)
• O3 - Toolbar: (no name) - {2E608F70-C430-4bc5-96F6-608E02EBA5B2} - (no file)
• O3 - Toolbar: (no name) - {860c2f6b-ca82-4282-9187-beccbb66f0af} - (no file)
• O3 - Toolbar: Colej_uk Design Toolbar - {A45D8289-FFA3-4cd8-B83A-F84F7173B2CE} - C:\Program Files\Colej_uk Design Toolbar\v2.0.0.5\Colej_uk_Design_Toolbar.dll (file missing)
• O3 - Toolbar: (no name) - {29C5A3B6-9A8D-4FA0-B5AD-3E20F4AA5C00} - (no file)
• O3 - Toolbar: (no name) - {F06E2ABE-3A50-4079-BE25-FC100D9EAA25} - (no file)
• O3 - Toolbar: (no name) - {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - (no file)
• O3 - Toolbar: Colej_uk Design Toolbar - {7E895BD9-C3B7-4bc2-A7B8-758531866F00} - C:\Program Files\Colej_uk Design Toolbar\v2.0.0.5\Colej_uk_Design_Toolbar.dll (file missing)
• O9 - Extra button: (no name) - Software - (no file)
• O9 - Extra button: (no name) - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.ietoolpro.com/redirect.php (file missing)
• O9 - Extra 'Tools' menuitem: IE Anti-Spyware - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.ietoolpro.com/redirect.php (file missing)
• O20 - Winlogon Notify: fccyvuu - fccyvuu.dll (file missing)

• Start
• Run
• type: CLEANMGR.EXE
  
• Press Enter.
  

• Temporary Internet Files
• Downloaded Program Files
• Recycle Bin
• Temporary Files

• Link #1
  
• Link #2

• Run Fixwareout.
• Click Next
  
• then Install
  
• Make sure Run fixit is checked
  
• Click Finish.
  
• The fix will begin; follow the prompts.
• You will be asked to reboot your computer; please do so.
• Your system may take longer than usual to load; this is normal.

• Go into Control Panel > Network Connections.
  
• Right click on your connection
  
• and click Properties.
  
• On the Properties page, highlight Internet Protocol(TCP/IP)
  
• Click Properties. This will bring up another page.
  
• Select Obtain DNS Server Automatically.
  
• Click the ok button. The page will close.
  
• Press ok on the page in front of you.
  
• Restart the computer.
  
• Reconnect to the Internet using Internet Explorer.
• Add the log from fixwareout in your next reply.
• It will be located at c:\fixwareout\report.txt

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
• Instead of Windows loading as normal, the Advanced Options Menu should appear;
• Select the first option, to run Windows in Safe Mode, then press Enter.
  
• Choose your usual account.
• Open the extracted SDFix folder and double click RunThis.bat to start the script.
  
• Type Y to begin the cleanup process.
  
• It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
• Press any Key and it will restart the PC.
• When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
  
• Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
  (Report.txt will also be copied to Clipboard).
  
• Finally copy and paste the contents of the results file Report.txt with a NEW HijackThis log in your next reply.

It doesn't seem to have worked. The blue screen keeps coming up.

• Close all applications and windows.
  
• Double-click on dss.exe to run it, and follow the prompts.
  
• When the scan is complete, two text files will open.
• main.txt <- this one will be maximized
  
• extra.txt <- this one will be minimized
• Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of main.txt and extra.txt in your reply.

This actually may be good news, because it means "sfc" found some corrupted files.
You'll have slipstream SP2, and create bootable CD. Here it's how to do it: http://www.helpwithwindows.com/WindowsXP/winxp-sp2-bootcd.htmlIn the link you posted, when it says copy the DISC to my computer, does that mean make an image of the CD or just select everything in Windows Explorer?You mean this?
QUOTE

Next copy your Windows XP CD to your hard drive. Just create a folder (I used \XP-CD), and copy all the contents of your Windows XP CD in that folder.

I'm thinking its because the XP disc I used was a XP Home disc. It wants an XP Professional one instead.

Here is some interesting trivia: I have installed trial versions of Bitdefender and Nod32 on my systems. I only run one at a TIME.
When I disable Nod 32, Bitdefender will run perfectly and not jam up. When I exit out of bitdefender and use Nod 32 the entire system freezes. I know you are not supposed to run two AV's at the same time, but does this ALSO mean not having two installed on my system at the same time?

What I'm trying to do is compare them side by side. Run Nod and see how it reacts to virus's then turn it off and run Bitdefender and see how it goes. Both have worked quite well although I noticed when I CLICK on a virus Bitdefender will say it has blocked it, but will still come up with those 'Run or Save' options, while Nod will just stop it completely (Nods test was done before downloading Bitdefender trial). On the other hand Bitdefender FOUND 2 infected items on its first quick scan (Netsonic adware, and something else) that Nod missed.(Again Nods Full scan was done before Bitdefender was downloaded) Full Scan time for nod is 41 mins which is about 1/2 of Norton (Norton is completly off the system)*Yay* I have yet to do a full scan of with Bitdefender but will report BACK when I do. (In the next 24 hours)Quote

I know you are not supposed to run two AV's at the same time, but does this also mean not having two installed on my system at the same time?

Windows XP automatic updates is turning off automatically. I get a message, please turn automatic updates on manually. I do so, and it changes for a few seconds, then turns off again. No viruses. dowload hijackthis program from here http://download.hijackthis.eu/HJTInstall.exe and run.

post logs back to here.Quote

copy and paste your LOG here

copy and paste your log here - then ANALYZE

Quote

copy and paste your log here - then analyze

Please, do NOT advice anyone to analyze HJT log by themselves! It's dangerous!

I had a trojan virus (perhaps multiple I don't know much about these things) on my computer. A friend told me about this site so I am asking for help.

I have already performed all the steps found here, and have attached all the logs I was asked to create to this post.

The viruses that were on my computer as defined by AVG are as follows;

Trojan Horse Generic10.ASBQ
Trojan Horse Generic10.ASFN
Trojan Horse Generic10.ASPK
Trojan Horse Generic10.ATLN
Trojan Horse Generic10.ATPA
Trojan Horse Generic10.AVJA
Trojan Horse Generic10.AVUU
Trojan Horse Generic10.AVID
Trojan Horse Generic10.AWVP
Trojan Horse Generic10.AXQR
Trojan Horse Generic10.BABF
Trojan Horse Downloader.Zlob.XTN
Trojan Horse Downloader.Zlob
Trojan Horse Downloader.Generic7.XBU
Trojan Horse Agent.XGB
Trojan Horse SHeur.BSKV
Trojan Horse SHeur.BROU
Trojan Horse BHO.EPI
Trojan Horse BHO.EQL
Potential harmful program Fake_AntiSpyware.WI

Thanks for your help.

[recovering disk space -- attachment deleted by admin]Looks like the scans got rid of the majority of malware but there is still some work to do.

Open Hijackthis and select Do a system scan only then place a check mark next to:

- O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
- O4 - Startup: PowerReg Scheduler.exe
- O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://cid-be3dfe2fec863c6b.spaces.live.com/PhotoUpload/MsnPUpld.cab
- O20 - Winlogon Notify: tuvWNFYr - tuvWNFYr.dll (file missing)

Now close all windows except for Hijackthis and then click Fix checked.

Exit Hijackthis and run CCleaner.

----------

Download SDFix.exe and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Now then reboot your computer in Safe Mode by doing the following:

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
• Instead of Windows loading as normal, the Advanced Options Menu should appear;
• Select the first option, to run Windows in Safe Mode, then press Enter.
  
• Choose your usual account.
• Open the extracted SDFix folder and double click RunThis.bat to start the script.
  
• Type Y to begin the cleanup process.
  
• It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
• Press any Key and it will restart the PC.
• When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
  
• Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
  (Report.txt will also be copied to Clipboard).
  
• Finally copy and paste the contents of the results file Report.txt with a NEW HijackThis log in your next reply.

• When finished exit out of OTMoveIt2

• Start
• Run
• type: CLEANMGR.EXE
  
• Press Enter.
  

• Temporary Internet Files
• Downloaded Program Files
• Recycle Bin
• Temporary Files

• Click Accept.
  
• Answer Yes, when prompted to install an ActiveX component.

• The program will then begin downloading the latest definition files.
• Once the files have been downloaded click on NEXT
  
• Locate the Scan Settings button & configure to:
  • Scan using the following Anti-Virus database:
  • Extended
• Scan Options:
• Scan Archives
  
• Scan Mail BASES

• Click OK & have it scan My Computer

• Next, in the Save as prompt, Save in area, select: Desktop.
  
• In the File name area, use KScan, or something similar.
  
• In Save as type: click the drop arrow and select: Text file [*.txt]
  
• Then, click: Save

If you don't use the iMesh or would rather not use it as it is spyware follow these instructions to remove it.

Download

• Save it to your desktop.

• Double-click OTMoveIt2.exe to run it.
  
• Copy the lines in the codebox below.

• Return to OTMoveIt2, right click in the Paste List of Files/Folders to Move window (under the yellow bar) and choose Paste

• Click the red Moveit! button.
  
• Copy everything in the Results window (under the green bar) and paste it in your next reply.
  
• Close OTMoveIt2

• Go to Start &GT; Programs > Accessories > System Tools and click System Restore
  
• Choose the radio button marked Create a Restore Point on the first screen then click Next Give the Restore Point a name then click Create.
  
• The new restore point will be stamped with the current date and TIME. Keep a log of this so you can find it easily should you need to use System Restore.
• Next go to Start > Run and type Cleanmgr
  
• Click OK
  
• Click the More Options Tab.
  
• Click Clean Up in the System Restore section to remove all previous restore points except the newly created clean one.

• Click Start Now
  
• Check the box next to Enable thorough system inspection.
  
• Click Start
  
• Allow the scan to finish and scroll down to see if any updates are needed.
• Update anything listed.

To all with a computer PROBLEM, stay with this site and follow the instructions given to you. I had a problem, and thought it was not FIXABLE, but, to my amazement, it was FIXED!!! I recommend you all stick with it and have patience. Take care and GOOD luck to you all.Thank you for accolades

Hi!!! I'm having the exact same problem!!!
Icons, Toolbar won't load...
Only way to get around it is like they said ctrl, alt, delete, run new task
It's rather annoying...
and i get an userinit error and a rundll.exe error

Please help...

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:02:04 PM, on 7/7/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\lxddserv.exe
C:\WINDOWS\system32\lxddcoms.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
C:\Program Files\Flock\flock\flock.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com/avcenter/fix_homepage/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com/avcenter/fix_homepage/
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: {c1ae7fc7-b4b9-f878-9134-94e2b184eaf6} - {6fae481b-2e49-4319-878f-9b4b7cf7ea1c} - C:\WINDOWS\system32\kktjxygu.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: (no name) - {9914230F-8C55-45A5-9D8B-599153897A7C} - C:\WINDOWS\system32\iifddbcD.dll (file missing)
O2 - BHO: (no name) - {A40C6E93-B163-4F6D-B71F-89662A0534A8} - C:\WINDOWS\system32\efcARkkH.dll (file missing)
O2 - BHO: (no name) - {AC213B6E-001F-40B3-AFDE-DF964289B9E5} - C:\WINDOWS\system32\tuvWqNFw.dll
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKLM\..\Run: [lxddmon.exe] "C:\Program Files\Lexmark 2500 Series\lxddmon.exe"
O4 - HKLM\..\Run: [lxddamon] "C:\Program Files\Lexmark 2500 Series\lxddamon.exe"
O4 - HKLM\..\Run: [Lexmark 1200 Series] "C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe"
O4 - HKLM\..\Run: [dbar_starter] C:\Documents and Settings\Mark Buffaloe\Application Data\Deskbar_{9B45545C-9B0B-4caf-A30B-F21C4128173D}\starter.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [BM834b42a3] Rundll32.exe "C:\WINDOWS\system32\ocwecxja.dll",s
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [8078713f] rundll32.exe "C:\WINDOWS\system32\rbqmcwih.dll",b
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\RunOnce: [SymLnch] "C:\Documents and Settings\Mark Buffaloe\Application Data\Symantec\Layouts\NSW-Norton AntiVirus\15.0\SymAllLanguages\NAVCD_RETAIL\20070826\Support\SymLnch\SymLnch.exe" "C:\Documents and Settings\Mark Buffaloe\Application Data\Symantec\Layouts\NSW-Norton AntiVirus\15.0\SymAllLanguages\NAVCD_RETAIL\20070826\Setup.exe" "/SCANUPREBOOT /temp /patched"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WinUpdater] "C:\Program Files\winvi\update.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks\Norton Cleanup\WCQuick.lnk (file missing)
O9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks\Norton Cleanup\WCQuick.lnk (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O20 - AppInit_DLLs: fdpssmsh.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: lxddCATSCustConnectService - Lexmark International, Inc. - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxddserv.exe
O23 - Service: lxdd_device - - C:\WINDOWS\system32\lxddcoms.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe

--
End of file - 7180 bytes
Next time, start your own topic. I just CREATED it for you, this time.Is your Norton paid for, and up to date, because it doesn't look active to me?Yes, we installed it about two MONTHS ago and it automatically updates.There is some infection.

Print these instructions out.

1. Download SUPERAntiSpyware Free for Home Users:
http://www.superantispyware.com/

* Double-click SUPERAntiSpyware.exe and use the default settings for installation.
* An icon will be created on your desktop. Double-click that icon to launch the program.
* If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download and unzip them from here: http://www.superantispyware.com/definitions.html.)
* Close SUPERAntiSpyware.

PHYSICALLY DISCONNECT FROM THE INTERNET

Restart computer in Safe Mode.
To enter Safe Mode, restart computer, and keep tapping F8 key, until menu appears; select Safe Mode; you'll see "Safe Mode" in all four corners of your screen

* Open SUPERAntiSpyware.
* Under "Configuration and Preferences", click the Preferences button.
* Click the Scanning Control tab.
* Under Scanner Options make sure the following are checked (leave all others unchecked):
o Close browsers before scanning.
o Scan for TRACKING cookies.
o Terminate memory threats before quarantining.
* Click the "Close" button to leave the control center screen.
* Back on the main screen, under "Scan for Harmful Software" click Scan your computer.
* On the left, make sure you check C:\Fixed Drive.
* On the right, under "Complete Scan", choose Perform Complete Scan.
* Click "Next" to start the scan. Please be patient while it scans your computer.
* After the scan is complete, a Scan Summary box will appear with POTENTIALLY harmful items that were detected. Click "OK".
* Make sure everything has a checkmark next to it and click "Next".
* A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
* If asked if you want to reboot, click "Yes".
* To retrieve the removal information after reboot, launch SUPERAntispyware again.
o Click Preferences, then click the Statistics/Logs tab.
o Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
o If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
o Please copy and paste the Scan Log results in your next reply.
* Click Close to exit the program.
Post SUPERAntiSpyware log.

RECONNECT TO THE INTERNET

RESTART COMPUTER!

2. Download Malwarebytes' Anti-Malware: http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html to your desktop.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

RESTART COMPUTER!

3. Post new HijackThis log.Going on to step two...


SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 07/09/2008 at 03:08 PM

Application Version : 4.15.1000

Core Rules Database Version : 3501
Trace Rules Database Version: 1492

Scan type : Complete Scan
Total Scan Time : 01:08:49

Memory items scanned : 430
Memory threats detected : 0
Registry items scanned : 4172
Registry threats detected : 0
File items scanned : 37625
File threats detected : 77

Adware.Tracking Cookie
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][2].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][4].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][2].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][2].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][2].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\mark [emailprotected]
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][3].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][2].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][2].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][2].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected]tclick[2].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][2].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][2].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][2].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][2].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][2].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][2].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][2].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][2].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][2].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][2].txt

Adware.Vundo Variant
C:\SYSTEM VOLUME INFORMATION\_RESTORE{2BC39B7D-A042-4934-938E-CF559E073197}\RP12\A0010895.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{2BC39B7D-A042-4934-938E-CF559E073197}\RP12\A0010896.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{2BC39B7D-A042-4934-938E-CF559E073197}\RP16\A0013978.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{2BC39B7D-A042-4934-938E-CF559E073197}\RP16\A0014046.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{2BC39B7D-A042-4934-938E-CF559E073197}\RP16\A0014063.DLL
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\AUOCPKIW.DLL.VIR
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\RDGVSCNJ.DLL.VIR
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\VPWMHASN.DLL.VIR

Trojan.Dropper/Gen-Packed
C:\SYSTEM VOLUME INFORMATION\_RESTORE{2BC39B7D-A042-4934-938E-CF559E073197}\RP12\A0010901.EXE

Unclassified.Unknown Origin
C:\SYSTEM VOLUME INFORMATION\_RESTORE{2BC39B7D-A042-4934-938E-CF559E073197}\RP16\A0013993.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{2BC39B7D-A042-4934-938E-CF559E073197}\RP16\A0013995.DLL
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\ENTZHG.DLL.VIR
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\GAAKSKWY.DLL.VIR

Trojan.Unknown Origin
C:\SYSTEM VOLUME INFORMATION\_RESTORE{2BC39B7D-A042-4934-938E-CF559E073197}\RP16\A0014050.DLL
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\RVGIJKMB.DLL.VIR

Adware.Vundo-Variant/I
C:\SYSTEM VOLUME INFORMATION\_RESTORE{2BC39B7D-A042-4934-938E-CF559E073197}\RP19\A0017264.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{2BC39B7D-A042-4934-938E-CF559E073197}\RP19\A0017265.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{2BC39B7D-A042-4934-938E-CF559E073197}\RP19\A0017266.DLL

Trojan.Dropper/Gen-MultiPacked
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\BVCTWWEB.DLL.VIR
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\HCUYSFKU.DLL.VIR
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\KSBPJSYA.DLL.VIR
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\MDMBITSN.DLL.VIR
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\MJUSEIIJ.DLL.VIR
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\NHMJLHBB.DLL.VIR
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\NJPNWELS.DLL.VIR
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\PYUBDMPT.DLL.VIR
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\XXDUGQNI.DLL.VIR
SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 07/09/2008 at 03:08 PM

Application Version : 4.15.1000

Core Rules Database Version : 3501
Trace Rules Database Version: 1492

Scan type : Complete Scan
Total Scan Time : 01:08:49

Memory items scanned : 430
Memory threats detected : 0
Registry items scanned : 4172
Registry threats detected : 0
File items scanned : 37625
File threats detected : 77

Adware.Tracking Cookie
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][2].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][4].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][2].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][2].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][2].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\mark [emailprotected]
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][3].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][2].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][2].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][2].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][2].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][2].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][2].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][2].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][2].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][2].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][2].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][2].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][2].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][2].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Mark Buffaloe\Cookies\[emailprotected][2].txt

Adware.Vundo Variant
C:\SYSTEM VOLUME INFORMATION\_RESTORE{2BC39B7D-A042-4934-938E-CF559E073197}\RP12\A0010895.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{2BC39B7D-A042-4934-938E-CF559E073197}\RP12\A0010896.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{2BC39B7D-A042-4934-938E-CF559E073197}\RP16\A0013978.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{2BC39B7D-A042-4934-938E-CF559E073197}\RP16\A0014046.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{2BC39B7D-A042-4934-938E-CF559E073197}\RP16\A0014063.DLL
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\AUOCPKIW.DLL.VIR
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\RDGVSCNJ.DLL.VIR
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\VPWMHASN.DLL.VIR

Trojan.Dropper/Gen-Packed
C:\SYSTEM VOLUME INFORMATION\_RESTORE{2BC39B7D-A042-4934-938E-CF559E073197}\RP12\A0010901.EXE

Unclassified.Unknown Origin
C:\SYSTEM VOLUME INFORMATION\_RESTORE{2BC39B7D-A042-4934-938E-CF559E073197}\RP16\A0013993.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{2BC39B7D-A042-4934-938E-CF559E073197}\RP16\A0013995.DLL
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\ENTZHG.DLL.VIR
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\GAAKSKWY.DLL.VIR

Trojan.Unknown Origin
C:\SYSTEM VOLUME INFORMATION\_RESTORE{2BC39B7D-A042-4934-938E-CF559E073197}\RP16\A0014050.DLL
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\RVGIJKMB.DLL.VIR

Adware.Vundo-Variant/I
C:\SYSTEM VOLUME INFORMATION\_RESTORE{2BC39B7D-A042-4934-938E-CF559E073197}\RP19\A0017264.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{2BC39B7D-A042-4934-938E-CF559E073197}\RP19\A0017265.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{2BC39B7D-A042-4934-938E-CF559E073197}\RP19\A0017266.DLL

Trojan.Dropper/Gen-MultiPacked
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\BVCTWWEB.DLL.VIR
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\HCUYSFKU.DLL.VIR
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\KSBPJSYA.DLL.VIR
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\MDMBITSN.DLL.VIR
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\MJUSEIIJ.DLL.VIR
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\NHMJLHBB.DLL.VIR
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\NJPNWELS.DLL.VIR
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\PYUBDMPT.DLL.VIR
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\XXDUGQNI.DLL.VIR
Topics merged, please keep all replies in the same thread.

Go to Start > Run and type c:\combofix.txt then click OK.

Post the contents of the log back here.You posted Superantispyware log twice.
I need Malwarebytes, and HJT logs.Malwarebytes' Anti-Malware 1.20
Database version: 937
Windows 5.1.2600 Service Pack 3

6:59:02 AM 7/10/2008
mbam-log-7-10-2008 (06-59-02).txt

Scan type: Full Scan (C:\|)
Objects scanned: 70384
Time elapsed: 36 minute(s), 17 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 4
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 5
Files Infected: 9

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\DBReg (Adware.SoftMate) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\Extensions\{59a40ac9-e67d-4155-b31d-4b7330fcd2d6} (Adware.PurityScan) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\WINDOWS\system32\1036a (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\MUI2 (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\spoolX (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\winRem (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\cdfig (Trojan.Agent) -> Quarantined and deleted successfully.

Files Infected:
C:\System Volume Information\_restore{2BC39B7D-A042-4934-938E-CF559E073197}\RP15\A0013899.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{2BC39B7D-A042-4934-938E-CF559E073197}\RP16\A0013964.dll (Adware.SoftMate) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{2BC39B7D-A042-4934-938E-CF559E073197}\RP16\A0014007.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{2BC39B7D-A042-4934-938E-CF559E073197}\RP16\A0014014.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\Program Files\dbar\deskbar.dll.vir (Adware.SoftMate) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\icetublt.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\jnvhfc.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\BM834b42a3.xml (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\clkcnt.txt (Trojan.Vundo) -> Quarantined and deleted successfully.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:15:39 AM, on 7/10/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\lxddserv.exe
C:\WINDOWS\system32\lxddcoms.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Lexmark 2500 Series\lxddmon.exe
C:\Program Files\Lexmark 2500 Series\lxddamon.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\sistray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Flock\flock\flock.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\SoftwareDistribution\Download\Install\windows-kb890830-v2.0-delta.exe
c:\3aa1db0dd83b3e7e2467f3\mrtstub.exe
C:\WINDOWS\system32\MRT.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com/avcenter/fix_homepage/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com/avcenter/fix_homepage/
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKLM\..\Run: [lxddmon.exe] "C:\Program Files\Lexmark 2500 Series\lxddmon.exe"
O4 - HKLM\..\Run: [lxddamon] "C:\Program Files\Lexmark 2500 Series\lxddamon.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\RunOnce: [SymLnch] "C:\Documents and Settings\Mark Buffaloe\Application Data\Symantec\Layouts\NSW-Norton AntiVirus\15.0\SymAllLanguages\NAVCD_RETAIL\20070826\Support\SymLnch\SymLnch.exe" "C:\Documents and Settings\Mark Buffaloe\Application Data\Symantec\Layouts\NSW-Norton AntiVirus\15.0\SymAllLanguages\NAVCD_RETAIL\20070826\Setup.exe" "/SCANUPREBOOT /temp /patched"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks\Norton Cleanup\WCQuick.lnk (file missing)
O9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks\Norton Cleanup\WCQuick.lnk (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O20 - AppInit_DLLs: fdpssmsh.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: lxddCATSCustConnectService - Lexmark International, Inc. - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxddserv.exe
O23 - Service: lxdd_device - - C:\WINDOWS\system32\lxddcoms.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe

--
End of file - 6910 bytes
*** Download, and run CTFMON-Remover: http://www.gerhard-schlager.at/en/projects/ctfmonremover/
The CTFMON-Remover helps you removing the annoying CTFMON.EXE from your Windows operating system. The program is easy to use and displays whether the CTFMON.EXE is installed and running or not. If it was found then you can remove it within seconds. Just in case that you need the CTFMON sometime in the future there is also an option to restore the original one.
Note:The CTFMON.EXE is among other things responsible for changing the language schema of your keyboard (e.g. for switching between the German and English keyboard layout). So in case you are using this feature you shouldn't remove or disable the CTFMON.EXE!

*** You need to update Java:
http://java.sun.com/javase/downloads/index.jsp
Java Runtime Environment (JRE) 6 Update 7
Uninstall all previous versions of Java through Add\Remove.

1. Print this post out, since you won't have an access to it, at some point.

2. Close all windows, except for HijackThis.

3. Put a checkmark next to the following HijackThis entries (some entries will be checkmarked to disable UNNECESSARY startups; in those cases [marked with *], no actual program will be removed):

- *O4 - HKLM\..\RunOnce: [SymLnch] "C:\Documents and Settings\Mark Buffaloe\Application Data\Symantec\Layouts\NSW-Norton AntiVirus\15.0\SymAllLanguages\NAVCD_RETAIL\20070826\Support\SymLnch\SymLnch.exe " "C:\Documents and Settings\Mark Buffaloe\Application Data\Symantec\Layouts\NSW-Norton AntiVirus\15.0\SymAllLanguages\NAVCD_RETAIL\20070826\Setup.exe" "/SCANUPREBOOT /temp /patched"
- *O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
- *O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
- *O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
- *O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
- O9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks\Norton Cleanup\WCQuick.lnk (file missing)
- O9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks\Norton Cleanup\WCQuick.lnk (file missing)
- O20 - AppInit_DLLs: fdpssmsh.dll

4. Click on Fix checked button.

5. Restart computer in Safe Mode (keep tapping F8 key, when your computer starts, until menu appears)

6. Open Windows Explorer. Go Tools>Folder Options>View tab, put a checkmark next to Show hidden files, and folders.

7. Delete following files/folders (if present):

- search your computer for fdpssmsh.dll, and delete all instances

8. Restart in Normal Mode.

9. Post new HijackThis log.

Yesterday morning, I woke up to the computer being turned off (in my house, it's almost always left on). When I turned it on and logged onto the main account, the toolbar and desktop icons flashed on and then were gone. I tried unplugging and restarting the computer, alas neither worked. I'm at a loss for what to do!

If anyone has a chance, I would appreciate it if they would kindly help me solve this problem. It's frustrating me very much.

Thank you for your time!What information should I ADD when submitting a question?Quote from: Broni on July 03, 2008, 08:30:27 PM

What information should I add when submitting a question?

I can run certain things by bringing up the Windows Task Manager and running programs like Firefox and iTunes,

hi, i have the same problem with one of my computers, i know how to restore the icon etc, press ctrl+alt+delete, then click file, click run, and then type control and enter. this is as far as i have gotten, i plan to just run a malware seacher to remove the virus. let me know how you go!
charlie

Was it the Explorer.exe thing that got it working?

All Right.

Wait, so it happens every time?

Hello,

I just pulled 6 computers out of operation that got nailed by a virus that appeared to be dormant for 2 years and triggered on 7/4. Bought a Windows XP Key Finder from a guy on ebay for like $3 2 years ago and this program was clean and ran clean up until its recent ATTACK on systems.

Up until now it has operated correctly in displaying the Key for auditing systems to make sure that no 2 systems have the same XP key.

Recently on 7/4 this was now tagged as viral by Norton Corporate Edition 10 with latest definitions, as well as a Cruzer Mini Thumb Drive utility that was backed up in teh archive of software, HP Drivers to a HP 1320TN printer, and a few other programs that were clean and now infected according to NAV.

Looking up this Windows XP Key Finder on google I found that there are numerous complaints about dirty copies of it with Trojans and a Trojan is what I had in my quarantine..... But what makes no sense is how a file in an Read-Only archive SINCE August 2006 all of a sudden WENT viral on 7/4 according to Symantecs Virus scan, along with other drivers. And this file had to have been scanned hundreds of times over the last 2 years without any issue.

Using Wireshark to probe the corporate network to see if there are any other troubled systems out there, I found that Wireshark displayed Kazaa port 1214 to 15.192.45.139 , so I looked up the IP to see where 15.192.45.139 resides and it hits as www.hp.com ??

Google search for Port 1214 shows it being used maliciously as well as with Kazaa, but no links to HP using port 1214? So What is going on here???

The system at 192.168.5.114 should be a clean system being that its NAV definitions up to date and the system scan is clean and is running correctly.

Any suggestions to why HP would use port 1214 and what for when the browser is not open to the HP site? Any suggestions on any better network probes other than Wireshark?

The computer by the way is a HP Compaq, but the systems were built clean to XP Pro SP2 and not the MFR image that use to be on the HP before RIS clean to XP Pro SP2 slip stream clean install. The HP MFR images to their drives usually have bundled crap with it like adware/spyware, and crappy registries.

Thanks,

DaveQuote

Any suggestions to why HP would use port 1214 and what for when the browser is not open to the HP site? Any suggestions on any better network probes other than Wireshark?

My task manager Is showing that I have Isass.exe running. Is this Bad, relative to being a virus or SPYWARE. Are you sure it's Isass and not Lsass.Hmmm, I think your on to something. It Is Lsass ( SHOWS up like this-lsass). So Is lsass good or bad?Lsass is good.

Isass is the Sasser worm. But any PC with Windows SP1 and above should never be infected by the Sasser worm. MS has released multiple patches so USERS won't get infected by it.

Thanks again evilfantasy.No problem.

since it's so LATE TONIGHT, i'll have to finished the scan tomorrow. but as soon as i do i'll send you the new log. THANKS so MUCH for all your HELP!!No problem

Go to add/remove programs and uninstall:

PC-Doctor 5 for Windows < See if the performance improves after REMOVING this. It has been known to be a resource hog.

----------

We can cut down on some of the startup programs to see if it helps.

Open Hijackthis and select Do a system SCAN only.

Place a check mark next to the following entries: (if there)

O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - GLOBAL Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: My Web Search Service (MyWebSearchService) - Unknown owner - C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwssvc.exe (file missing)

Close all windows except for Hijackthis and then click Fix checked.

Exit Hijackthis and run CCLEANER.

Go to Start &GT; Run and then type or copy and paste:

sc stop MyWebSearchService

Then press Enter on the keyboard.

Next go to Start > Run and do the same with:

sc delete MyWebSearchService

Restart the computer.

Has anything improved?

Yesterday and today I have not been able to update AVG. I try to do so by right clicking the icon in the taskbar, left click update (Same as usual!). But after a few minutes a box comes up telling me the update failed saying:
"Update Manager:
@ update_result_Short_missing_ctf"
Nothing changed on my computer recently. All scans in safe mode show it to be clear of malware . I am not sure what to try now except just leave it another day? All other programs update okay.

Win XP Pro SP2
Online Armor Free Firewall
AVG free Antivirus 8.0.134
Spyware Blaster
WinPatrol
Malwarebytes
A-Squared free
Super Anti-Spyware
Advanced Windows Care V2
CCleanerI have had the same problem earlier today. I kept trying and eventually it did update.

Now my problem is that it keeps saying update needs to restart my comp and I have already restarted twice and did one complete shut down yet it still tells me I need to restart.Looks like it is not just me? I have had the same thing, restarting three times, and then tells me again as above.AVG ver. 8.0 has been having all kind of problems, since the day one, it was released.
It's advisable to switch to some other free antivirus program:
- AVAST! free antivirus: http://filehippo.com/download_avast_antivirus/
- Avira free antivirus: http://www.free-av.com/en/download/index.html
Thanks BroniYou're welcome Thanks for the info Broni. I will give one of the ones you suggest a try.Sure thing Hello Forum: I also am having a problem with AVG 8.0 I am running a Dell dimension 2400 WinXP, IE6.0 . Also using AdAware, CCleaner, SpywareBlaster and have all the latest updates for Windows and other programs. After I downloaded the latest AVG update a popup said I must restart computer. I did(5X)!. Yet AVG the tray icon kept warning that Update Manager was not up to date. I kept UPDATING it but the problem remained. After a day of this I decided to Uninstall AVG and download a new copy. AVG Uninstall would not work. Kept getting message " Warning, internal error, Dialog with ID 'AVG4ESDLG' was not found in Setup". Now what? I downloaded REVO. It REMOVED AVG 8. I downloaded another copy of AVG from Download.com in order to obtain it from another source other than AVG. All was well so far. I checked the AVG uninstall UTILITY and it was working. No more error message. But then AVG told me to update latest definitions. After I downloaded the following update the problems with update manager and AVG Uninstall reappeared. This is a 6.9 or 7.9 MB update: "update/F8UI134R100vibin 15/16" Anybody have any ideas.? Will AVG update a fix? OBTW , REVO did the job when Windows ADD/Remove couldn't. Thanks. Any HELP is appreciated.See my reply #3.
That's all I can say in this matter.I know you warned me before about AVG, Broni. I really had no problem with AVG until this latest download. It seems like all definitions are downloading properly. I think it is a problem with the User Interface feature: Update Manager. It really bugs me that the Uninstall feature won't work. But I guess I can REVO it again. Also I did download Avast. I ran it once and then Uninstalled it ,so as to not have 2 antivirus programs running simultaneaously. I still have the Setup file on my desktop. Is the Avira program as good or better than Avast?. I had a little problem navigating with Avast. I guess I can get used to it. Thanks for your help.My credo: if any program doesn't want to work properly, I don't use it, if I have other options.
In this case, you have other options, so why bother with AVG.
Avira, and Avast are both very good programs. I have no preferences.I will re-install Avast. Thanks again for your helpYou're welcome

First of all, THANK YOU for this website and I have LEARNED so much from this experience although this virus STUFF has alarmed me, as I use all freebies with virus protection.

Like a similar topic, I have this trojan horse agent 2 JCS affecting my C:\Windows\system 32\logagent.exe

I found it using AVG 8.5 free software. As similarly reported, I couldnt remove it either. I have run all the steps that evilfantasy said, from the CCLeaner to the Hijack this programs. I have all the logs to report here. But have read in the other topic concerning this that it is a false positive. Does that mean that it isnt really on my computer or just not on the other ones that you have looked at? If this is really a trojan, I will begin the log reporting etc. If not, then, at least this has led me to having found a great new website to learn more about computers from...

Thanks for your replies to this,

highpoint7Yes it's a false positive. An update fixing this false is currently being prepared and should be released soon if not already. You might try updating AVG as it should be released by now.Thanks again for your help and for this website!!! I believe these websites where everyone works together to fight malware is the key to ending them quicker. It causes novices like me to learn what is going on and take an active role in what is going on with fixing the problems. It shares computer knowledge as opposed to just taking your computer in to a shop and having someone else just "fix" the problem. I learned so much from just reading the issues you have solved with other folks on this potential problem and LOOK FORWARD to reading others issues and LEARNING as well.

Thanks evilfantasy for your time and to the others as well for creating this website.

- highpoint7Your welcome!

Everytime I click a click on a link from Google I get redirected to some advertisement. I can mange to open the links in a new window by right clicking on them and opening them in a new window/tab. I do not get redireted when I'm using Yahoo. And I seem to have another symptom...random out of no where popups. This started in Firefox and I was still able to USE IE. But after I ran my AVG and restarted my computer IE started doing the same thing. I downloaded Superantispyware and malwarebytes, but neither of them will run. HijackThis worked, though. Here is the log from that:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:33:29 PM, on 6/4/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\dhcp\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\System32\avast!Antivirus.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bradford Networks\Client Security Agent\bndaemon.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\Olympus\DeviceDetector\DM1Service.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\sopidkc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\Program Files\Bradford Networks\Client Security Agent\bncsaui.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe
C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Internet Explorer\Iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.gateway.com/g/sidepanel.html?Ch=Retail&Br=GTW&Loc=ENG_US&Sys=PTB&M=MX6930
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gateway.com/g/startpage.html?Ch=Retail&Br=GTW&Loc=ENG_US&Sys=PTB&M=MX6930
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.com/g/startpage.html?Ch=Retail&Br=GTW&Loc=ENG_US&Sys=PTB&M=MX6930
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.gateway.com/g/sidepanel.html?Ch=Retail&Br=GTW&Loc=ENG_US&Sys=PTB&M=MX6930
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://127.0.0.1:4664/first_usage&s=JBRm44EO4OUF2SEqTaREOszWL1k
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\sdra64.exe,
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [bncsaui.exe] %ProgramFiles%\Bradford Networks\Client Security Agent\bncsaui.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [DW6] "C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe"
O4 - HKCU\..\Run: [A00F637369.exe] C:\WINDOWS\TEMP\_A00F637369.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [WUAppSetup] C:\Program Files\Common Files\logishrd\WUApp32.exe -v 0x046d -P 0x092e -f video -m logitech -d 11.1.0.2016 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [WUAppSetup] C:\Program Files\Common Files\logishrd\WUApp32.exe -v 0x046d -p 0x092e -f video -m logitech -d 11.1.0.2016 (User 'Default user')
O4 - Global Startup: Device Detector 3.lnk = C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O20 - Winlogon Notify: __c0086B90 - C:\WINDOWS\system32\__c0086B90.dat
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast!antivirus - Unknown owner - C:\WINDOWS\System32\avast!Antivirus.exe
O23 - Service: avast!avscontrolservice - Unknown owner - C:\WINDOWS\System32\avast!AVSControlService.exe (file missing)
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Background Intelligent Transfer Service (BITS) - Unknown owner - C:\WINDOWS\
O23 - Service: Client Security Agent Service (BNPagent) - Bradford Networks - C:\Program Files\Bradford Networks\Client Security Agent\bndaemon.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Dhcp server (dhcpsrv) - Unknown owner - C:\WINDOWS\dhcp\svchost.exe
O23 - Service: DM1Service - OLYMPUS Corporation - C:\Program Files\Olympus\DeviceDetector\DM1Service.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: sopidkc Service (sopidkc) - Unknown owner - C:\WINDOWS\system32\sopidkc.exe
O23 - Service: Automatic Updates (wuauserv) - Unknown owner - C:\WINDOWS\

--
End of file - 10348 bytes

Can you help me?

Thanks,
KatThe logs show that you are infected by an infection called Virut or Sality. Virut/Sality is a virus that infects all executable files and screensavers. Virut also opens a back door providing the attacker with unauthorized remote access to the infected computer. Definition: Polymorphic virus.

There is no way to cure this infection. Your only option is to perform a full reformat. Do NOT attempt a repair install. TRYING to fix this infection will only leave the computer unusable. See Virut on the Rise and Virut and other File infectors - Throwing in the Towel? for more information.

Note that if you decide to try and clean this you must be extremely careful on what is backed up as these new infections can get into many different file extensions ( DLL, EXE, SCR, HTM, HTML, MP3, AVI, WMV, PDF.....etc). A complete reformat and reinstall is highly suggested! Avoid backing up compressed files (zip/cab/rar.....etc). Virut can also penetrate compressed files that have .exe or .scr inside them.

Backing up files before formatting

If you backup any files they should be scanned from a clean properly protected PC before restoring. Also be careful what scanner is used as some are very poor at detecting and even worse at protecting from this infection. In fact due to the nature of these new infections there are probably no tools that will properly protect you from the infection. Be very selective and only backup files you can not replace like text documents and personal photos.

Do not back up to another machine! It will likely become infected by Virut. Burn to DVD/CD, a flash drive or to an external drive which has nothing else on it and which you can format should it become infected from the backups.

I suggest running at least 3 of the below scanners on the backup files. Run the first scan then reboot before running the second then reboot after the second before running the third.

-) Dr.Web CureIt!
-) AVG Win32/Virut Removal Tool
-) Symantwc W32.Virut Removal Tool
-) McAfee Avert Stinger
-) Microsoft Windows Malicious Software Removal Tool

If you do not know how to perform a fresh install, use this website -> http://www.windowsreinstall.com/

Very important, do the following immediately or as soon as POSSIBLE!

If you have done any online transactions, call all of your banks, credit card companies, financial institutions and inform them that you may be a victim of identity theft and to put a watch on your accounts and/or change all of your account numbers.

From a clean computer change all of your online passwords including for email, banks, financial accounts, PayPal, EBAY, online credit card companies and any online forums or groups you belong to etc.

DO NOT change passwords or do any transactions while using the infected computer. The attacker will get the new passwords and transaction information.Thanks bunches...I'll get right now it.