|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| HijackThis Log Help Get Rid Of Malware With Help From Our Analysts. Follow the "First Steps" link at the top right of each page before posting for help. |
 |
|
|
Thread Tools |
05-17-2008, 12:55 AM
|
#1 (permalink) |
|
Registered User
Join Date: May 2008
Posts: 7
OS: Windows Vista
|
I keep getting popups and I can't seem to get rid of it!
Hello Everybody!
I would like to start by giving you my appreciation for your assistance and help with my problem. My computer keeps getting pop up and regardless of what I do I can't seem to get rid of it. I have tried SpyBot, and Adaware and it still hasn't worked. I even tried to do that in safe mode and deleting the files it says are infected. However, it still keeps coming back. At the bottom is my Hijackthis log! and any assistance you can provide me would be more than greatly appreciated. I just simply ran out of options. Thank you again. -Tom ------------------------ Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:27:54 PM, on 5/16/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\WINDOWS\system32\AvidSDMService.exe C:\WINDOWS\system32\CTsvcCDA.exe C:\Program Files\PrevxCSI\PrevxCSI.exe C:\Program Files\Symantec AntiVirus\DefWatch.exe C:\Program Files\PrevxCSI\PrevxCSI.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe c:\program files\mcafee.com\agent\mcdetect.exe c:\PROGRA~1\mcafee.com\vso\mcshield.exe c:\PROGRA~1\mcafee.com\agent\mctskshd.exe c:\PROGRA~1\mcafee.com\vso\OasClnt.exe c:\program files\mcafee.com\vso\mcvsshld.exe C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe c:\progra~1\mcafee.com\vso\mcvsescn.exe C:\Program Files\Symantec AntiVirus\SavRoam.exe C:\Program Files\Dell Support Center\bin\sprtsvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe C:\PROGRA~1\SYMANT~1\VPTray.exe C:\WINDOWS\stsystra.exe c:\program files\mcafee.com\agent\mcagent.exe C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe C:\PROGRA~1\mcafee.com\mps\mscifapp.exe C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe C:\WINDOWS\ehome\ehtray.exe C:\Program Files\Dell\Media Experience\DMXLauncher.exe C:\WINDOWS\System32\DLA\DLACTRLW.EXE C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe C:\WINDOWS\eHome\ehmsas.exe C:\Program Files\Creative\VoiceCenter\AndreaVC.exe C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe C:\Program Files\Dell Support Center\bin\sprtcmd.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe C:\Program Files\XemiComputers\Active Desktop Calendar\ADC.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe C:\Program Files\3M\PSNLite\PsnLite.exe c:\progra~1\mcafee.com\vso\mcvsftsn.exe C:\PROGRA~1\3M\PSNLite\PSNGive.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\AIM\aim.exe C:\Program Files\AIM\aim.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = http://www.google.com/ig/dell?hl=en&...suk&channel=us R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn7\yt.dll O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn7\yt.dll O2 - BHO: (no name) - {14683BA8-4D5A-4392-813E-9AA2F07F5FA3} - (no file) O2 - BHO: McBrwHelper Class - {227B8AA8-DAF2-4892-BD1D-73F568BCB24E} - c:\PROGRA~1\mcafee.com\mps\mcbrhlpr.dll O2 - BHO: McAfee Privacy Service Popup Blocker - {3EC8255F-E043-4cae-8B3B-B191550C2A22} - c:\program files\mcafee.com\mps\popupkiller.dll O2 - BHO: McAfee AntiPhishing Filter - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - c:\PROGRA~1\mcafee\SPAMKI~1\mcapfbho.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL O2 - BHO: (no name) - {68FC27B6-06C4-48C7-8E26-AB9F17765B70} - (no file) O2 - BHO: (no name) - {98B1E64C-DC93-4633-8547-CF144E9BC92B} - C:\WINDOWS\system32\yaywvusr.dll (file missing) O2 - BHO: (no name) - {A03AB7B4-62D1-45D4-9AB1-23BF8254F491} - C:\WINDOWS\system32\fccabbxw.dll (file missing) O2 - BHO: (no name) - {BADC37DC-2B48-4CEF-9BF1-EDFA40896900} - (no file) O2 - BHO: (no name) - {F15F14C6-C3E1-486B-98B9-446274ED05E2} - C:\WINDOWS\system32\fccbawvu.dll (file missing) O2 - BHO: (no name) - {F33AA66D-A110-4133-9785-65183D701920} - (no file) O2 - BHO: (no name) - {FB422E7B-3D5E-4D9B-84C2-91B6C888CDE2} - C:\WINDOWS\system32\khfdabyy.dll O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn7\yt.dll O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe" O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe O4 - HKLM\..\Run: [MPSExe] c:\PROGRA~1\mcafee.com\mps\mscifapp.exe /embedding O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" O4 - HKLM\..\Run: [VoiceCenter] "C:\Program Files\Creative\VoiceCenter\AndreaVC.exe" /tray O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\RunOnce: [Spybot - Search & Destroy] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck O4 - HKLM\..\RunOnce: [SpybotDeletingC1899] cmd /c del "C:\WINDOWS\system32\wyxsnqvo.dll_old" O4 - HKLM\..\RunOnce: [SpybotDeletingA6494] command /c del "C:\WINDOWS\system32\yaywvusr.dll_old" O4 - HKLM\..\RunOnce: [SpybotDeletingC573] cmd /c del "C:\WINDOWS\system32\yaywvusr.dll_old" O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R O4 - HKCU\..\Run: [Active Desktop Calendar] C:\Program Files\XemiComputers\Active Desktop Calendar\ADC.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: NETGEAR WG311v3 Wireless Assistant.lnk = ? O4 - Global Startup: Post-it® Software Notes Lite.lnk = C:\Program Files\3M\PSNLite\PsnLite.exe O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\PROGRA~1\mcafee\SPAMKI~1\mcapfbho.dll O9 - Extra 'Tools' menuitem: McAfee AntiPhishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\PROGRA~1\mcafee\SPAMKI~1\mcapfbho.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {2019DC25-D1C0-11D6-97B3-0008A124F542} (StreamPlug Class) - http://www.streamplug.com/StreamPlug/beta/SP.cab O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab56986.cab O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/sh...1/mcinsctl.cab O16 - DPF: {58172624-85DD-4482-9E64-02ADCA637E96} (shizmoo Class) - http://www.kungfuchess.com/activex/web665.cab O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://games.pogo.com/online2/pogo/z...ploader_v5.cab O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = usc.edu O17 - HKLM\System\CS3\Services\Tcpip\Parameters: SearchList = usc.edu O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = usc.edu O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: khfdabyy - C:\WINDOWS\SYSTEM32\khfdabyy.dll O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Avid SDM Service (AvidSDMService) - Avid Technology, Inc. - C:\WINDOWS\system32\AvidSDMService.exe O23 - Service: Avid Startup (AvidStartup) - Unknown owner - C:\WINDOWS\system32\AvidStartup.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: CSIScanner - Prevx - C:\Program Files\PrevxCSI\\PrevxCSI.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe -- End of file - 15897 bytes |
|
     
|
|
05-20-2008, 12:28 AM
|
#2 (permalink) |
|
Analyst, Security Team
|
Re: I keep getting popups and I can't seem to get rid of it!
Hello tputs001, and welcome to TSF.
My apologies for the delay. We're all volunteers, and we've been swamped. We'll begin with ComboFix.exe. Please visit this webpage for download links, and instructions for running the tool: http://www.bleepingcomputer.com/comb...o-use-combofix
-screen317
__________________
I will be gone from July 22nd until August 22nd. †Gospodine, smiluj se nama†
  |
|
|
|
|
05-20-2008, 02:05 AM
|
#3 (permalink) |
|
Registered User
Join Date: May 2008
Posts: 7
OS: Windows Vista
|
Re: I keep getting popups and I can't seem to get rid of it!
Hello Screen317
Don't worry about the delay. I was actually expecting an even longer response since I know you guys are volunteers and have your own lives to attend too. But anyways, I just want to say I'm truly appreciative of your quick response. The following below is the log after using combo fix. Thank you again! _________ ComboFix 08-05-19.4 - Jeremy 2008-05-20 0:58:32.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.323 [GMT -7:00] Running from: C:\Documents and Settings\Jeremy\Desktop\ComboFix.exe * Created a new restore point * Resident AV is active WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Jeremy\Application Data\macromedia\Flash Player\#SharedObjects\L8NS42WS\www.broadcaster.com C:\Documents and Settings\Jeremy\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com C:\Documents and Settings\Jeremy\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol C:\WINDOWS\cookies.ini C:\WINDOWS\Downloaded Program Files\setup.inf C:\WINDOWS\pskt.ini C:\WINDOWS\system32\byxwuvst.dll C:\WINDOWS\system32\calkcikp.ini C:\WINDOWS\system32\cfrgrsqt.ini C:\WINDOWS\system32\cgvcijpm.dll C:\WINDOWS\system32\fchcbvcw.dll C:\WINDOWS\system32\feibsxui.ini C:\WINDOWS\system32\giltpckv.ini C:\WINDOWS\system32\hipttpfv.ini C:\WINDOWS\system32\hkojwrqb.ini C:\WINDOWS\system32\hpjvwegk.dll C:\WINDOWS\system32\hserlxkt.ini C:\WINDOWS\system32\jqhhfioj.ini C:\WINDOWS\system32\jspyruim.ini C:\WINDOWS\system32\kiqtncoc.dll C:\WINDOWS\system32\lujgaaek.dll C:\WINDOWS\system32\lxgkempd.ini C:\WINDOWS\system32\mcrh.tmp C:\WINDOWS\system32\media C:\WINDOWS\system32\media\AvidRender.wav C:\WINDOWS\system32\moakxiek.ini C:\WINDOWS\system32\mpjicvgc.ini C:\WINDOWS\system32\MSINET.oca C:\WINDOWS\system32\nsdegxsm.ini C:\WINDOWS\system32\pgnljwxq.ini C:\WINDOWS\system32\qvahiemd.ini C:\WINDOWS\system32\rsuvwyay.ini C:\WINDOWS\system32\rsuvwyay.ini2 C:\WINDOWS\system32\rytxjtyh.ini C:\WINDOWS\system32\tsvuwxyb.ini C:\WINDOWS\system32\tsvuwxyb.ini2 C:\WINDOWS\system32\tyhvkmrh.ini C:\WINDOWS\system32\uvwabccf.ini C:\WINDOWS\system32\uvwabccf.ini2 C:\WINDOWS\system32\vodmvksu.ini C:\WINDOWS\system32\wgljwwoa.ini C:\WINDOWS\system32\wtcsoagf.ini C:\WINDOWS\system32\wxbbaccf.ini C:\WINDOWS\system32\wxbbaccf.ini2 C:\WINDOWS\system32\xirtjamw.ini C:\WINDOWS\system32\ydrbuelt.ini . ((((((((((((((((((((((((( Files Created from 2008-04-20 to 2008-05-20 ))))))))))))))))))))))))))))))) . 2008-05-19 16:19 . 2008-05-19 16:19 2,624 --a------ C:\WINDOWS\system32\ekeslnbf.exe 2008-05-19 00:31 . 2008-05-19 03:06 <DIR> d-------- C:\Program Files\CA Yahoo! Anti-Spy 2008-05-16 19:42 . 2008-05-16 19:42 32,989 --a------ C:\VETlog.dmp 2008-05-16 17:46 . 2008-05-16 17:46 4,128 --a------ C:\INFCACHE.1 2008-05-14 03:45 . 2008-05-18 23:43 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-05-14 03:45 . 2008-05-14 03:45 1,409 --a------ C:\WINDOWS\QTFont.for 2008-05-13 21:11 . 2008-05-13 21:11 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer 2008-05-13 21:10 . 2008-05-13 21:10 <DIR> d-------- C:\Program Files\Apple Software Update 2008-05-13 21:10 . 2008-05-13 21:10 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple 2008-05-13 20:32 . 2003-12-04 05:33 873,984 --a------ C:\WINDOWS\system32\AvidAVdvCodec.qtx 2008-05-13 20:32 . 2000-10-17 11:16 289,280 --a------ C:\WINDOWS\system32\AvidQTCodec.qtx 2008-05-13 20:32 . 2003-07-02 10:31 241,664 --a------ C:\WINDOWS\system32\AvidStartup.exe 2008-05-13 20:32 . 2003-12-04 05:24 208,384 --a------ C:\WINDOWS\system32\AvidQTAVJICodec.qtx 2008-05-13 20:32 . 2003-10-27 11:23 184,320 --a------ C:\WINDOWS\system32\AvidSDM.dll 2008-05-13 20:32 . 2003-12-04 05:24 100,352 --a------ C:\WINDOWS\system32\AvidQTAVUICodec.qtx 2008-05-13 20:32 . 2003-05-08 19:06 61,440 --a------ C:\WINDOWS\system32\AvidQTUpdater.dll 2008-05-13 20:32 . 2003-12-04 05:27 54,272 --a------ C:\WINDOWS\system32\drivers\AvidXPSerial.sys 2008-05-13 20:31 . 2008-05-13 20:32 <DIR> d-------- C:\Program Files\Avid 2008-05-13 13:56 . 2008-05-13 20:39 474 --ahs---- C:\WINDOWS\system32\bpjhlmps.ini 2008-05-12 18:41 . 2008-05-12 18:41 <DIR> d-------- C:\Documents and Settings\Jeremy\Application Data\McAfee 2008-05-12 17:40 . 2008-05-13 12:34 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy 2008-05-12 17:40 . 2008-05-13 21:14 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-05-12 12:53 . 2008-05-12 12:53 <DIR> d-------- C:\Program Files\Lavasoft 2008-05-11 22:58 . 2008-05-11 22:58 294 --ahs---- C:\WINDOWS\system32\acrmaspb.ini 2008-05-09 12:23 . 2008-05-09 12:23 70 --ah----- C:\aaw7boot.cmd 2008-05-08 23:16 . 2008-05-08 23:16 <DIR> d-------- C:\Program Files\Rainbow Technologies 2008-05-08 19:58 . 2008-05-08 19:58 <DIR> d-------- C:\Program Files\Common Files\Digidesign 2008-05-08 19:57 . 2001-02-01 15:10 45,056 --a------ C:\WINDOWS\system32\wnaspi32.dll 2008-05-08 19:57 . 2001-02-01 15:10 25,244 --a------ C:\WINDOWS\system32\drivers\aspi32.sys 2008-05-08 19:57 . 2001-02-01 15:10 5,600 --a------ C:\WINDOWS\system\winaspi.dll 2008-05-08 19:57 . 2001-02-01 15:10 4,672 --a------ C:\WINDOWS\system\wowpost.exe 2008-05-05 16:38 . 2008-05-05 16:47 <DIR> d-------- C:\Program Files\SopCast 2008-05-05 16:33 . 2008-04-30 17:09 3,187,458 --a------ C:\Program Files\Setup-SopCast-3.0.3-2008-4-30.exe 2008-04-24 22:42 . 2008-04-24 22:42 <DIR> d-------- C:\Program Files\Trend Micro 2008-04-23 01:59 . 2008-04-23 01:59 <DIR> d-------- C:\Program Files\PrevxCSI 2008-04-23 01:59 . 2008-05-19 14:25 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\PrevxCSI 2008-04-23 01:59 . 2008-05-14 10:13 17,408 --a------ C:\WINDOWS\system32\drivers\pxark.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-05-20 05:04 --------- d-----w C:\Program Files\Warcraft III 2008-05-19 07:31 --------- d-----w C:\Program Files\Yahoo! 2008-05-19 07:31 --------- d-----w C:\Program Files\Common Files\Scanner 2008-05-14 04:12 --------- d-----w C:\Program Files\QuickTime 2008-05-14 03:31 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-05-13 11:03 4,392 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys 2008-05-13 01:58 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-05-13 01:54 --------- d-----w C:\Documents and Settings\All Users\Application Data\GTek 2008-05-01 00:07 3,813 ----a-w C:\Program Files\changeLog.txt 2008-04-18 22:17 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2008-04-18 22:17 --------- d-----w C:\Documents and Settings\Jeremy\Application Data\SUPERAntiSpyware.com 2008-04-18 21:52 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-04-18 21:48 --------- d-----w C:\Documents and Settings\Jeremy\Application Data\Move Networks 2008-04-18 21:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com 2008-04-18 20:09 --------- d-----w C:\Program Files\Windows Defender 2008-04-18 05:52 34,099 ----a-w C:\WINDOWS\system32\khfdabyy.dll 2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys 2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\dllcache\win32k.sys 2008-03-02 01:36 3,591,680 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll 2008-02-29 08:55 70,656 ----a-w C:\WINDOWS\system32\dllcache\ie4uinit.exe 2008-02-29 08:55 625,664 ----a-w C:\WINDOWS\system32\dllcache\iexplore.exe 2008-02-22 10:00 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe 2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll 2008-02-20 06:51 282,624 ------w C:\WINDOWS\system32\dllcache\gdi32.dll 2008-02-20 05:32 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll 2008-02-20 05:32 45,568 ----a-w C:\WINDOWS\system32\dllcache\dnsrslvr.dll 2008-02-20 05:32 148,992 ------w C:\WINDOWS\system32\dllcache\dnsapi.dll 2007-01-09 08:38 73,759 ----a-w C:\Program Files\UninstallMM.exe 2006-08-01 23:15 4,608 ----a-w C:\Program Files\idlemon.dll.bak 2005-09-23 10:56 479,232 ----a-w C:\Program Files\msvcm80.dll 2005-09-23 03:22 522 ----a-w C:\Program Files\Microsoft.VC80.CRT.manifest 2005-09-23 03:05 626,688 ----a-w C:\Program Files\msvcr80.dll 2005-09-23 03:05 548,864 ----a-w C:\Program Files\msvcp80.dll 2005-07-07 18:13 2,152 ----a-w C:\Program Files\mm_readme.txt 2005-07-04 15:20 165,376 ----a-w C:\Program Files\middle_man.ocm 2005-03-22 23:51 53,248 ----a-w C:\Program Files\idlemon.dll 2001-09-28 21:00 164,864 ----a-w C:\Program Files\unwise32.exe 2007-03-27 06:06 56 --sh--r C:\WINDOWS\system32\C9DC4ACB29.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{98B1E64C-DC93-4633-8547-CF144E9BC92B}] C:\WINDOWS\system32\yaywvusr.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A03AB7B4-62D1-45D4-9AB1-23BF8254F491}] C:\WINDOWS\system32\fccabbxw.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C0EE30A3-93BF-4532-88EA-920AAE038EEA}] 2008-05-20 01:10 276992 --a------ C:\WINDOWS\system32\ddcywurp.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F15F14C6-C3E1-486B-98B9-446274ED05E2}] C:\WINDOWS\system32\fccbawvu.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FB422E7B-3D5E-4D9B-84C2-91B6C888CDE2}] 2008-04-17 22:52 34099 --a------ C:\WINDOWS\system32\khfdabyy.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SetDefaultMIDI"="MIDIDef.exe" [2004-12-22 08:40 24576 C:\WINDOWS\MIDIDEF.EXE] "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54 5674352] "DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [2007-11-15 10:23 202544] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 03:00 15360] "Creative Detector"="C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 16:23 102400] "Active Desktop Calendar"="C:\Program Files\XemiComputers\Active Desktop Calendar\ADC.exe" [2005-12-21 13:56 2109440] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "YSearchProtection"="C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe" [2007-06-08 07:59 224248] "VSOCheckTask"="C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" [2005-07-08 18:18 151552] "vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2006-09-27 20:33 125168] "VirusScan Online"="C:\Program Files\McAfee.com\VSO\mcvsshld.exe" [2005-08-10 10:49 163840] "UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-10 23:00 90112] "SigmatelSysTrayApp"="stsystra.exe" [2005-03-22 15:20 339968 C:\WINDOWS\stsystra.exe] "OASClnt"="C:\Program Files\McAfee.com\VSO\oasclnt.exe" [2005-08-11 20:02 53248] "MSKDetectorExe"="C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe" [2005-08-12 16:16 1121792] "MSKAGENTEXE"="C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe" [2005-09-26 10:26 110592] "MPSExe"="c:\PROGRA~1\mcafee.com\mps\mscifapp.exe" [2006-03-30 14:31 296488] "MPFExe"="C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe" [2005-11-11 17:00 1005096] "MCUpdateExe"="C:\PROGRA~1\mcafee.com\agent\McUpdate.exe" [2006-01-11 12:05 212992] "MCAgentExe"="c:\PROGRA~1\mcafee.com\agent\mcagent.exe" [2005-09-22 18:29 303104] "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 08:44 81920] "ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 08:44 249856] "IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2005-06-17 05:56 139264] "ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-09-29 12:01 67584] "dscactivate"="C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 10:24 16384] "DMXLauncher"="C:\Program Files\Dell\Media Experience\DMXLauncher.exe" [2005-10-05 01:12 94208] "DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-09-08 03:20 122940] "CTSysVol"="C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-09-15 07:47 57344] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-09-03 00:04 84640] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 19:05 344064] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06 40048] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 11:09 63712] "VoiceCenter"="C:\Program Files\Creative\VoiceCenter\AndreaVC.exe" [2005-09-19 05:42 1159168] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-31 23:13 385024] "DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [2007-11-15 10:23 202544] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2000-01-21 01:15:54 65588] NETGEAR WG311v3 Wireless Assistant.lnk - C:\WINDOWS\Installer\{70014586-7BBA-4A92-A610-CDC896C48F8F}\NewShortcut1_1.exe [2006-07-29 15:22:33 2238] Post-itr Software Notes Lite.lnk - C:\Program Files\3M\PSNLite\PsnLite.exe [2004-06-02 13:04:58 1622016] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles "InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{FB422E7B-3D5E-4D9B-84C2-91B6C888CDE2}"= C:\WINDOWS\system32\khfdabyy.dll [2008-04-17 22:52 34099] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\khfdabyy] khfdabyy.dll 2008-04-17 22:52 34099 C:\WINDOWS\system32\khfdabyy.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Authentication Packages REG_MULTI_SZ msv1_0 C:\WINDOWS\system32\ddcywurp [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^LCDPlayer.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\LCDPlayer.lnk backup=C:\WINDOWS\pss\LCDPlayer.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6] --a------ 2006-11-07 08:29 50736 C:\Program Files\AIM6\aim6.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BMefc6a1ad] C:\WINDOWS\system32\gtufuies.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] --a------ 2005-12-10 07:57 133016 C:\Program Files\DAEMON Tools\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ecf59231] C:\WINDOWS\system32\dmeihavq.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search] C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MBMon] --a------ 2005-05-18 23:54 1345520 C:\WINDOWS\system32\CTMBHA.DLL [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer] --------- 2008-01-28 11:43 2097488 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpyHunter Security Suite] C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VoiceCenter] --------- 2005-09-19 05:42 1159168 C:\Program Files\Creative\VoiceCenter\AndreaVC.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" "BMefc6a1ad"=Rundll32.exe "C:\WINDOWS\system32\tqyahvyk.dll",s [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\AIM\\aim.exe"= "C:\\Program Files\\Internet Explorer\\iexplore.exe"= "C:\\Program Files\\Warcraft III\\Warcraft III.exe"= "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"= "C:\\Program Files\\MSN Messenger\\livecall.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= "C:\\Program Files\\SopCast\\adv\\SopAdver.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "7384:TCP"= 7384:TCP:BitComet 7384 TCP "7384:UDP"= 7384:UDP:BitComet 7384 UDP R0 pxark;pxark;C:\WINDOWS\system32\drivers\pxark.sys [2008-05-14 10:13] R1 LIKECDN2;LIKECDN2;C:\WINDOWS\system32\DRIVERS\LIKECDN2.sys [2002-02-15 13:33] R1 XSPACEWG;XSPACEWG;C:\WINDOWS\system32\drivers\XSpaceWg.sys [2001-12-11 10:46] R2 CSIScanner;CSIScanner;"C:\Program Files\PrevxCSI\\PrevxCSI.exe" /service [] R2 sprtsvc_dellsupportcenter;SupportSoft Sprocket Service (dellsupportcenter);C:\Program Files\Dell Support Center\bin\sprtsvc.exe [2007-11-15 10:23] R2 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" [2007-01-04 14:38] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G] \Shell\AutoRun\command - G:\Autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H] \Shell\AutoRun\command - H:\autoplay.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\I] \Shell\AutoRun\command - I:\autoplay.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}] \Shell\AutoRun\command - E:\setup.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8338942e-c00b-11dc-9839-001372da1478}] \Shell\AutoRun\command - J:\wd_windows_tools\setup.exe . Contents of the 'Scheduled Tasks' folder "2008-05-20 08:05:12 C:\WINDOWS\Tasks\McAfee.com Scan for Viruses - My Computer (D4VW9HB1-Jeremy).job" - c:\program files\mcafee.com\vso\mcmnhdlr.exe "2008-05-19 09:05:00 C:\WINDOWS\Tasks\MP Scheduled Scan.job" - C:\Program Files\Windows Defender\MpCmdRun.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-20 01  10Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... C:\WINDOWS\TEMP\MSVBVM60.DLL 1388544 bytes executable scan completed successfully hidden files: 1 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\winlogon.exe -> C:\WINDOWS\system32\khfdabyy.dll PROCESS: C:\WINDOWS\explorer.exe -> C:\WINDOWS\system32\mbinbnpt.dll -> C:\WINDOWS\system32\ddcywurp.dll -> C:\Program Files\XemiComputers\Active Desktop Calendar\MouseHook.dll . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\system32\ati2evxx.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe C:\WINDOWS\system32\AvidSDMService.exe C:\WINDOWS\system32\CTSVCCDA.EXE C:\Program Files\PrevxCSI\prevxcsi.exe C:\Program Files\Symantec AntiVirus\DefWatch.exe C:\Program Files\PrevxCSI\prevxcsi.exe C:\WINDOWS\ehome\ehrecvr.exe C:\WINDOWS\ehome\ehSched.exe C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe C:\Program Files\McAfee.com\Agent\Mcdetect.exe C:\PROGRA~1\McAfee.com\VSO\McShield.exe C:\PROGRA~1\McAfee.com\Agent\McTskshd.exe C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe C:\PROGRA~1\McAfee.com\VSO\oasclnt.exe C:\PROGRA~1\McAfee.com\VSO\McVSEscn.exe C:\Program Files\Symantec AntiVirus\SavRoam.exe C:\WINDOWS\ehome\mcrdsvc.exe C:\WINDOWS\system32\dllhost.exe C:\Program Files\McAfee.com\Agent\mcagent.exe C:\WINDOWS\ehome\ehmsas.exe C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe C:\PROGRA~1\McAfee.com\VSO\mcvsftsn.exe C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\Program Files\Messenger\msmsgs.exe C:\PROGRA~1\3M\PSNLite\PSNGive.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\rundll32.exe . ************************************************************************** . Completion time: 2008-05-20 1:12:26 - machine was rebooted ComboFix-quarantined-files.txt 2008-05-20 08:12:16 Pre-Run: 15,481,597,952 bytes free Post-Run: 16,202,797,056 bytes free 334 --- E O F --- 2008-04-09 18:27:44 _________________________ |
|
|
|
|
05-20-2008, 09:28 AM
|
#4 (permalink) |
|
Analyst, Security Team
|
Re: I keep getting popups and I can't seem to get rid of it!
Hi tputs001,
Please download this file and save it as it's originally named, next to ComboFix.exe.  Now close all open windows and programs, then drag the setup package onto ComboFix.exe and drop it. Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console. When complete, it will ask you whether or not to continue with the malware scan. Select Yes, and post the resultant log. -screen317
__________________
I will be gone from July 22nd until August 22nd. †Gospodine, smiluj se nama†
|
|
|
|
|
05-21-2008, 01:20 AM
|
#5 (permalink) |
|
Registered User
Join Date: May 2008
Posts: 7
OS: Windows Vista
|
Re: I keep getting popups and I can't seem to get rid of it!
Hello Screen317
I did what you asked and the following is the log that was produced. Thank you again for your time and assistance.  _____________________________________________________________ ComboFix 08-05-19.4 - Jeremy 2008-05-21 0:37:04.4 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.471 [GMT -7:00] Running from: C:\Documents and Settings\Jeremy\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Jeremy\Desktop\WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe * Created a new restore point * Resident AV is active . ((((((((((((((((((((((((( Files Created from 2008-04-21 to 2008-05-21 ))))))))))))))))))))))))))))))) . 2008-05-20 01:51 . 2008-05-20 01:51 127 --a------ C:\WINDOWS\system32\MRT.INI 2008-05-20 01:12 . 2008-05-20 01:12 2,624 --a------ C:\WINDOWS\system32\vcqxwjiw.exe 2008-05-19 00:31 . 2008-05-19 03:06 <DIR> d-------- C:\Program Files\CA Yahoo! Anti-Spy 2008-05-16 19:42 . 2008-05-16 19:42 32,989 --a------ C:\VETlog.dmp 2008-05-16 17:46 . 2008-05-16 17:46 4,128 --a------ C:\INFCACHE.1 2008-05-14 03:45 . 2008-05-18 23:43 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-05-14 03:45 . 2008-05-14 03:45 1,409 --a------ C:\WINDOWS\QTFont.for 2008-05-13 21:11 . 2008-05-13 21:11 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer 2008-05-13 21:10 . 2008-05-13 21:10 <DIR> d-------- C:\Program Files\Apple Software Update 2008-05-13 21:10 . 2008-05-13 21:10 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple 2008-05-13 20:32 . 2003-12-04 05:33 873,984 --a------ C:\WINDOWS\system32\AvidAVdvCodec.qtx 2008-05-13 20:32 . 2000-10-17 11:16 289,280 --a------ C:\WINDOWS\system32\AvidQTCodec.qtx 2008-05-13 20:32 . 2003-07-02 10:31 241,664 --a------ C:\WINDOWS\system32\AvidStartup.exe 2008-05-13 20:32 . 2003-12-04 05:24 208,384 --a------ C:\WINDOWS\system32\AvidQTAVJICodec.qtx 2008-05-13 20:32 . 2003-10-27 11:23 184,320 --a------ C:\WINDOWS\system32\AvidSDM.dll 2008-05-13 20:32 . 2003-12-04 05:24 100,352 --a------ C:\WINDOWS\system32\AvidQTAVUICodec.qtx 2008-05-13 20:32 . 2003-05-08 19:06 61,440 --a------ C:\WINDOWS\system32\AvidQTUpdater.dll 2008-05-13 20:32 . 2003-12-04 05:27 54,272 --a------ C:\WINDOWS\system32\drivers\AvidXPSerial.sys 2008-05-13 20:31 . 2008-05-13 20:32 <DIR> d-------- C:\Program Files\Avid 2008-05-13 13:56 . 2008-05-13 20:39 474 --ahs---- C:\WINDOWS\system32\bpjhlmps.ini 2008-05-12 18:41 . 2008-05-12 18:41 <DIR> d-------- C:\Documents and Settings\Jeremy\Application Data\McAfee 2008-05-12 17:40 . 2008-05-13 12:34 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy 2008-05-12 17:40 . 2008-05-13 21:14 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-05-12 12:53 . 2008-05-12 12:53 <DIR> d-------- C:\Program Files\Lavasoft 2008-05-11 22:58 . 2008-05-11 22:58 294 --ahs---- C:\WINDOWS\system32\acrmaspb.ini 2008-05-09 12:23 . 2008-05-09 12:23 70 --ah----- C:\aaw7boot.cmd 2008-05-08 23:16 . 2008-05-08 23:16 <DIR> d-------- C:\Program Files\Rainbow Technologies 2008-05-08 19:58 . 2008-05-08 19:58 <DIR> d-------- C:\Program Files\Common Files\Digidesign 2008-05-08 19:57 . 2001-02-01 15:10 45,056 --a------ C:\WINDOWS\system32\wnaspi32.dll 2008-05-08 19:57 . 2001-02-01 15:10 25,244 --a------ C:\WINDOWS\system32\drivers\aspi32.sys 2008-05-08 19:57 . 2001-02-01 15:10 5,600 --a------ C:\WINDOWS\system\winaspi.dll 2008-05-08 19:57 . 2001-02-01 15:10 4,672 --a------ C:\WINDOWS\system\wowpost.exe 2008-05-05 16:38 . 2008-05-05 16:47 <DIR> d-------- C:\Program Files\SopCast 2008-05-05 16:33 . 2008-04-30 17:09 3,187,458 --a------ C:\Program Files\Setup-SopCast-3.0.3-2008-4-30.exe 2008-04-24 22:42 . 2008-04-24 22:42 <DIR> d-------- C:\Program Files\Trend Micro 2008-04-23 01:59 . 2008-04-23 01:59 <DIR> d-------- C:\Program Files\PrevxCSI 2008-04-23 01:59 . 2008-05-20 03:00 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\PrevxCSI 2008-04-23 01:59 . 2008-05-14 10:13 17,408 --a------ C:\WINDOWS\system32\drivers\pxark.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-05-21 06:18 --------- d-----w C:\Program Files\Warcraft III 2008-05-19 07:31 --------- d-----w C:\Program Files\Yahoo! 2008-05-19 07:31 --------- d-----w C:\Program Files\Common Files\Scanner 2008-05-14 04:12 --------- d-----w C:\Program Files\QuickTime 2008-05-14 03:31 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-05-13 11:03 4,392 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys 2008-05-13 01:58 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-05-13 01:54 --------- d-----w C:\Documents and Settings\All Users\Application Data\GTek 2008-05-01 00:07 3,813 ----a-w C:\Program Files\changeLog.txt 2008-04-18 22:17 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2008-04-18 22:17 --------- d-----w C:\Documents and Settings\Jeremy\Application Data\SUPERAntiSpyware.com 2008-04-18 21:52 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-04-18 21:48 --------- d-----w C:\Documents and Settings\Jeremy\Application Data\Move Networks 2008-04-18 21:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com 2008-04-18 20:09 --------- d-----w C:\Program Files\Windows Defender 2008-03-27 08:12 151,583 ----a-w C:\WINDOWS\system32\msjint40.dll 2008-03-27 08:12 151,583 ----a-w C:\WINDOWS\system32\dllcache\msjint40.dll 2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys 2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\dllcache\win32k.sys 2008-03-02 01:36 3,591,680 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll 2008-02-29 08:55 70,656 ----a-w C:\WINDOWS\system32\dllcache\ie4uinit.exe 2008-02-29 08:55 625,664 ----a-w C:\WINDOWS\system32\dllcache\iexplore.exe 2008-02-22 10:00 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe 2007-01-09 08:38 73,759 ----a-w C:\Program Files\UninstallMM.exe 2006-08-01 23:15 4,608 ----a-w C:\Program Files\idlemon.dll.bak 2005-09-23 10:56 479,232 ----a-w C:\Program Files\msvcm80.dll 2005-09-23 03:22 522 ----a-w C:\Program Files\Microsoft.VC80.CRT.manifest 2005-09-23 03:05 626,688 ----a-w C:\Program Files\msvcr80.dll 2005-09-23 03:05 548,864 ----a-w C:\Program Files\msvcp80.dll 2005-07-07 18:13 2,152 ----a-w C:\Program Files\mm_readme.txt 2005-07-04 15:20 165,376 ----a-w C:\Program Files\middle_man.ocm 2005-03-22 23:51 53,248 ----a-w C:\Program Files\idlemon.dll 2001-09-28 21:00 164,864 ----a-w C:\Program Files\unwise32.exe 2007-03-27 06:06 56 --sh--r C:\WINDOWS\system32\C9DC4ACB29.sys . ((((((((((((((((((((((((((((( snapshot_2008-05-20_ 1.58.34.57 ))))))))))))))))))))))))))))))))))))))))) . - 2008-05-20 08:43:04 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2008-05-21 07:25:45 2,048 --s-a-w C:\WINDOWS\bootstat.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{98B1E64C-DC93-4633-8547-CF144E9BC92B}] C:\WINDOWS\system32\yaywvusr.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A03AB7B4-62D1-45D4-9AB1-23BF8254F491}] C:\WINDOWS\system32\fccabbxw.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F15F14C6-C3E1-486B-98B9-446274ED05E2}] C:\WINDOWS\system32\fccbawvu.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SetDefaultMIDI"="MIDIDef.exe" [2004-12-22 08:40 24576 C:\WINDOWS\MIDIDEF.EXE] "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54 5674352] "DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [2007-11-15 10:23 202544] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 03:00 15360] "Creative Detector"="C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 16:23 102400] "Active Desktop Calendar"="C:\Program Files\XemiComputers\Active Desktop Calendar\ADC.exe" [2005-12-21 13:56 2109440] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "YSearchProtection"="C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe" [2007-06-08 07:59 224248] "VSOCheckTask"="C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" [2005-07-08 18:18 151552] "vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2006-09-27 20:33 125168] "VirusScan Online"="C:\Program Files\McAfee.com\VSO\mcvsshld.exe" [2005-08-10 10:49 163840] "UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-10 23:00 90112] "SigmatelSysTrayApp"="stsystra.exe" [2005-03-22 15:20 339968 C:\WINDOWS\stsystra.exe] "OASClnt"="C:\Program Files\McAfee.com\VSO\oasclnt.exe" [2005-08-11 20:02 53248] "MSKDetectorExe"="C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe" [2005-08-12 16:16 1121792] "MSKAGENTEXE"="C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe" [2005-09-26 10:26 110592] "MPSExe"="c:\PROGRA~1\mcafee.com\mps\mscifapp.exe" [2006-03-30 14:31 296488] "MPFExe"="C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe" [2005-11-11 17:00 1005096] "MCUpdateExe"="C:\PROGRA~1\mcafee.com\agent\McUpdate.exe" [2006-01-11 12:05 212992] "MCAgentExe"="c:\PROGRA~1\mcafee.com\agent\mcagent.exe" [2005-09-22 18:29 303104] "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 08:44 81920] "ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 08:44 249856] "IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2005-06-17 05:56 139264] "ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-09-29 12:01 67584] "dscactivate"="C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 10:24 16384] "DMXLauncher"="C:\Program Files\Dell\Media Experience\DMXLauncher.exe" [2005-10-05 01:12 94208] "DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-09-08 03:20 122940] "CTSysVol"="C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-09-15 07:47 57344] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-09-03 00:04 84640] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 19:05 344064] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06 40048] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 11:09 63712] "VoiceCenter"="C:\Program Files\Creative\VoiceCenter\AndreaVC.exe" [2005-09-19 05:42 1159168] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-31 23:13 385024] "DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [2007-11-15 10:23 202544] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2000-01-21 01:15:54 65588] NETGEAR WG311v3 Wireless Assistant.lnk - C:\WINDOWS\Installer\{70014586-7BBA-4A92-A610-CDC896C48F8F}\NewShortcut1_1.exe [2006-07-29 15:22:33 2238] Post-itr Software Notes Lite.lnk - C:\Program Files\3M\PSNLite\PsnLite.exe [2004-06-02 13:04:58 1622016] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles "InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\khfdabyy] khfdabyy.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^LCDPlayer.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\LCDPlayer.lnk backup=C:\WINDOWS\pss\LCDPlayer.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6] --a------ 2006-11-07 08:29 50736 C:\Program Files\AIM6\aim6.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BMefc6a1ad] C:\WINDOWS\system32\gtufuies.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] --a------ 2005-12-10 07:57 133016 C:\Program Files\DAEMON Tools\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ecf59231] C:\WINDOWS\system32\dmeihavq.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search] C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MBMon] --a------ 2005-05-18 23:54 1345520 C:\WINDOWS\system32\CTMBHA.DLL [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer] --------- 2008-01-28 11:43 2097488 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpyHunter Security Suite] C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VoiceCenter] --------- 2005-09-19 05:42 1159168 C:\Program Files\Creative\VoiceCenter\AndreaVC.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" "BMefc6a1ad"=Rundll32.exe "C:\WINDOWS\system32\tqyahvyk.dll",s [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\AIM\\aim.exe"= "C:\\Program Files\\Internet Explorer\\iexplore.exe"= "C:\\Program Files\\Warcraft III\\Warcraft III.exe"= "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"= "C:\\Program Files\\MSN Messenger\\livecall.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= "C:\\Program Files\\SopCast\\adv\\SopAdver.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "7384:TCP"= 7384:TCP:BitComet 7384 TCP "7384:UDP"= 7384:UDP:BitComet 7384 UDP R0 pxark;pxark;C:\WINDOWS\system32\drivers\pxark.sys [2008-05-14 10:13] R1 LIKECDN2;LIKECDN2;C:\WINDOWS\system32\DRIVERS\LIKECDN2.sys [2002-02-15 13:33] R1 XSPACEWG;XSPACEWG;C:\WINDOWS\system32\drivers\XSpaceWg.sys [2001-12-11 10:46] R2 CSIScanner;CSIScanner;"C:\Program Files\PrevxCSI\\PrevxCSI.exe" /service [] R2 sprtsvc_dellsupportcenter;SupportSoft Sprocket Service (dellsupportcenter);C:\Program Files\Dell Support Center\bin\sprtsvc.exe [2007-11-15 10:23] R2 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" [2007-01-04 14:38] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G] \Shell\AutoRun\command - G:\Autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H] \Shell\AutoRun\command - H:\autoplay.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\I] \Shell\AutoRun\command - I:\autoplay.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}] \Shell\AutoRun\command - E:\setup.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8338942e-c00b-11dc-9839-001372da1478}] \Shell\AutoRun\command - J:\wd_windows_tools\setup.exe . Contents of the 'Scheduled Tasks' folder "2008-05-21 07:26:30 C:\WINDOWS\Tasks\McAfee.com Scan for Viruses - My Computer (D4VW9HB1-Jeremy).job" - c:\program files\mcafee.com\vso\mcmnhdlr.exe "2008-05-20 09:05:01 C:\WINDOWS\Tasks\MP Scheduled Scan.job" - C:\Program Files\Windows Defender\MpCmdRun.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-21 00:39:06 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\explorer.exe -> C:\Program Files\XemiComputers\Active Desktop Calendar\MouseHook.dll . Completion time: 2008-05-21 0:40:18 ComboFix-quarantined-files.txt 2008-05-21 07:40:06 ComboFix2.txt 2008-05-20 08:59:18 ComboFix3.txt 2008-05-20 08:12:27 Pre-Run: 16,047,079,424 bytes free Post-Run: 16,027,144,192 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons 248 --- E O F --- 2008-05-20 08:52:32 |
|
|
|
|
05-22-2008, 11:42 PM
|
#6 (permalink) | |
|
Analyst, Security Team
|
Re: I keep getting popups and I can't seem to get rid of it!
Hi tputs001,
Please delete your copy of ComboFix, download the latest version from here, and save it to your Desktop. Do not run it yet. Next, please open Notepad - don't use any other text editor than notepad or the script will fail. Copy/paste the text in the quotebox below into Notepad: Quote:
Then drag the CFScript into ComboFix.exe as you see in the screenshot below.  This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log. Also, I notice that you are using more than one antivirus and firewall program (from Norton and McAfee). This is very dangerous, as multiple AVs can interfere with one another and actually allow MORE viruses to get through. I strongly suggest you go to Start -> Control Panel -> Add or Remove Programs and uninstall all but one antivirus and firewall program.[/list] -screen317
__________________
I will be gone from July 22nd until August 22nd. †Gospodine, smiluj se nama†
Last edited by screen317 : 05-22-2008 at 11:43 PM. |
|
|
|
|
|
05-24-2008, 12:58 AM
|
#7 (permalink) |
|
Registered User
Join Date: May 2008
Posts: 7
OS: Windows Vista
|
Re: I keep getting popups and I can't seem to get rid of it!
Hello Screen317 I did what you asked and the following are the new combofix log and highjackthis log. Thanks again for your time and effort =) _______________________________ Combo Fix Log ComboFix 08-05-21.3 - Jeremy 2008-05-23 12:39:36.5 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.383 [GMT -7:00] Running from: C:\Documents and Settings\Jeremy\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Jeremy\Desktop\CFScript.txt * Created a new restore point * Resident AV is active FILE :: C:\WINDOWS\system32\acrmaspb.ini C:\WINDOWS\system32\bpjhlmps.ini C:\WINDOWS\system32\vcqxwjiw.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\BMefc6a1ad.xml C:\WINDOWS\system32\acrmaspb.ini C:\WINDOWS\system32\bpjhlmps.ini . ((((((((((((((((((((((((( Files Created from 2008-04-23 to 2008-05-23 ))))))))))))))))))))))))))))))) . 2008-05-20 01:51 . 2008-05-20 01:51 127 --a------ C:\WINDOWS\system32\MRT.INI 2008-05-19 00:31 . 2008-05-19 03:06 <DIR> d-------- C:\Program Files\CA Yahoo! Anti-Spy 2008-05-16 19:42 . 2008-05-16 19:42 32,989 --a------ C:\VETlog.dmp 2008-05-16 17:46 . 2008-05-16 17:46 4,128 --a------ C:\INFCACHE.1 2008-05-14 03:45 . 2008-05-18 23:43 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-05-14 03:45 . 2008-05-14 03:45 1,409 --a------ C:\WINDOWS\QTFont.for 2008-05-13 21:11 . 2008-05-13 21:11 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer 2008-05-13 21:10 . 2008-05-13 21:10 <DIR> d-------- C:\Program Files\Apple Software Update 2008-05-13 21:10 . 2008-05-13 21:10 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple 2008-05-13 20:32 . 2003-12-04 05:33 873,984 --a------ C:\WINDOWS\system32\AvidAVdvCodec.qtx 2008-05-13 20:32 . 2000-10-17 11:16 289,280 --a------ C:\WINDOWS\system32\AvidQTCodec.qtx 2008-05-13 20:32 . 2003-07-02 10:31 241,664 --a------ C:\WINDOWS\system32\AvidStartup.exe 2008-05-13 20:32 . 2003-12-04 05:24 208,384 --a------ C:\WINDOWS\system32\AvidQTAVJICodec.qtx 2008-05-13 20:32 . 2003-10-27 11:23 184,320 --a------ C:\WINDOWS\system32\AvidSDM.dll 2008-05-13 20:32 . 2003-12-04 05:24 100,352 --a------ C:\WINDOWS\system32\AvidQTAVUICodec.qtx 2008-05-13 20:32 . 2003-05-08 19:06 61,440 --a------ C:\WINDOWS\system32\AvidQTUpdater.dll 2008-05-13 20:32 . 2003-12-04 05:27 54,272 --a------ C:\WINDOWS\system32\drivers\AvidXPSerial.sys 2008-05-13 20:31 . 2008-05-13 20:32 <DIR> d-------- C:\Program Files\Avid 2008-05-12 18:41 . 2008-05-12 18:41 <DIR> d-------- C:\Documents and Settings\Jeremy\Application Data\McAfee 2008-05-12 17:40 . 2008-05-13 12:34 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy 2008-05-12 17:40 . 2008-05-13 21:14 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-05-12 12:53 . 2008-05-12 12:53 <DIR> d-------- C:\Program Files\Lavasoft 2008-05-09 12:23 . 2008-05-09 12:23 70 --ah----- C:\aaw7boot.cmd 2008-05-08 23:16 . 2008-05-08 23:16 <DIR> d-------- C:\Program Files\Rainbow Technologies 2008-05-08 19:58 . 2008-05-08 19:58 <DIR> d-------- C:\Program Files\Common Files\Digidesign 2008-05-08 19:57 . 2001-02-01 15:10 45,056 --a------ C:\WINDOWS\system32\wnaspi32.dll 2008-05-08 19:57 . 2001-02-01 15:10 25,244 --a------ C:\WINDOWS\system32\drivers\aspi32.sys 2008-05-08 19:57 . 2001-02-01 15:10 5,600 --a------ C:\WINDOWS\system\winaspi.dll 2008-05-08 19:57 . 2001-02-01 15:10 4,672 --a------ C:\WINDOWS\system\wowpost.exe 2008-05-05 16:38 . 2008-05-05 |
