mvnaaaaa.exe and assorted trojans

[kraakus]

My son recently went to some skanky porn site (found out by looking at IE History) and AVG started detecting trojans.

xpladv499(1).wmf
slide499(1).wmf
loaderadv499_5(1).exe

Went through the 5 step prior to posting.
AVG does detect anything anymore, but Panda ActiveScan does detect Spyware Cookies.

Appreciate any help.


ComboScan v20070212.14 run by Default on 2007-02-19 at 17:15:46
Computer is in Normal Mode.
--------------------------------------------------------------------------------

Successfully created restore point.
Performed disk cleanup.


-- HijackThis log (run as Default.com) ------------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 5:16:43 PM, on 2/19/2007
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\SiteAdvisor\6009\SAService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\AOL\1151985757\ee\AOLSoftware.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\verizon\SMARTB~1\MotiveSB.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFREE.EXE
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\SiteAdvisor\6009\SiteAdv.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Grisoft\AVG Free\avgcc.exe
C:\Documents and Settings\Default\Desktop\comboscan.exe
C:\DOCUME~1\Default\LOCALS~1\Temp\~zjpqpmy.tmp\Default.com

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.netcenter.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://us.f840.mail.yahoo.com/ym/Sho...ad=b&box=Inbox
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://verizon.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://verizon.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\windows\SYSTEM\blank.htm
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: (no name) - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - (no file)
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6009\SiteAdv.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: TwcToolbarBhoApp Class - {AA1F9DDB-E605-4ba6-81D4-E427DEE012AD} - C:\WINDOWS\SYSTEM32\TwcToolbarBho.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6009\SiteAdv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: The Weather Channel Toolbar - {2E5E800E-6AC0-411E-940A-369530A35E43} - C:\WINDOWS\SYSTEM32\TwcToolbarIe7.dll
O3 - Toolbar: (no name) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - (no file)
O4 - HKLM\..\Run: [SystemTray] systray.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1151985757\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\verizon\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [mvnaaaaa] C:\WINDOWS\System32\mvnaaaaa.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFREE.EXE"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [mvnaaaaa] C:\WINDOWS\System32\mvnaaaaa.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: Microsoft Office Shortcut Bar.lnk = C:\Program Files\Microsoft Office\Office\MSOFFICE.EXE
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: The Weather Channel - {2E5E800E-6AC0-411E-940A-369530A35E43} - (no file)
O9 - Extra 'Tools' menuitem: The Weather Channel - {2E5E800E-6AC0-411E-940A-369530A35E43} - (no file)
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://activatemydsl.verizon.net/sd...SL/tgctlcm.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\6009\SiteAdv.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: SiteAdvisor Service - McAfee, Inc. - C:\Program Files\SiteAdvisor\6009\SAService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe


-- File Associations ------------------------------------------------------------

.bat - batfile - "%1" %*
.chm - chm.file - "C:\WINDOWS\hh.exe" %1
.com - comfile - "%1" %*
.exe - exefile - "%1" %*
.hlp - hlpfile - %SystemRoot%\System32\winhlp32.exe %1
.inf - inffile - %SystemRoot%\System32\NOTEPAD.EXE %1
.ini - inifile - %SystemRoot%\System32\NOTEPAD.EXE %1
.js - JSFile - %SystemRoot%\System32\WScript.exe "%1" %*
.lnk - lnkfile - {00021401-0000-0000-C000-000000000046}
.pif - piffile - "%1" %*
.reg - regfile - regedit.exe "%1"
.scr - scrfile - "%1" /S
.txt - txtfile - %SystemRoot%\system32\NOTEPAD.EXE %1
.vbs - VBSFile - %SystemRoot%\System32\WScript.exe "%1" %*


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ----------------------

3 ati2mpaa - System32\DRIVERS\ati2mpaa.sys
1 Avg7Core (AVG7 Kernel) - \SystemRoot\System32\Drivers\avg7core.sys
1 Avg7RsW (AVG7 Wrap Driver) - \SystemRoot\System32\Drivers\avg7rsw.sys
1 Avg7RsXP (AVG7 Resident Driver XP) - \SystemRoot\System32\Drivers\avg7rsxp.sys
1 AvgClean (AVG7 Clean Driver) - \SystemRoot\System32\Drivers\avgclean.sys
2 AvgTdi (AVG Network Redirector) - \SystemRoot\System32\Drivers\avgtdi.sys
2 BrPar - \SystemRoot\System32\drivers\BrPar.sys
3 CO_Mon - \??\C:\WINDOWS\System32\Drivers\CO_Mon.sys
3 cwcspud (Crystal SoundFusion(tm) Driver) - system32\drivers\cwcspud.sys
3 cwcwdm (Crystal SoundFusion(tm) WDM Driver) - system32\drivers\cwcwdm.sys
3 GEARAspiWDM - System32\Drivers\GEARAspiWDM.sys
3 ltmodem5 (LT Modem Driver) - System32\DRIVERS\ltmdmnt.sys
3 MREMPR5 (MREMPR5 NDIS Protocol Driver) - \??\C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS
3 MRENDIS5 (MRENDIS5 NDIS Protocol Driver) - \??\C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS
3 NtApm (NT Apm/Legacy Interface Driver) - System32\DRIVERS\NtApm.sys
0 PxHelp20 - System32\Drivers\PxHelp20.sys
3 rtl8139 (Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver) - System32\DRIVERS\RTL8139.SYS
0 srescan - System32\ZoneLabs\srescan.sys
3 usbscan - System32\DRIVERS\usbscan.sys
3 USBSTOR (USB Mass Storage Driver) - System32\DRIVERS\USBSTOR.SYS
1 vsdatant - System32\vsdatant.sys


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

2 Avg7Alrt (AVG7 Alert Manager Server) - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
2 Avg7UpdSvc (AVG7 Update Service) - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
2 AVGEMS (AVG E-mail Scanner) - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
3 IDriverT (InstallDriver Table Manager) - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
3 iPod Service - "C:\Program Files\iPod\bin\iPodService.exe"
3 SCardDrv (Smart Card Helper) - %SystemRoot%\System32\SCardSvr.exe
2 SiteAdvisor Service - C:\Program Files\SiteAdvisor\6009\SAService.exe
2 UMWdf (Windows User Mode Driver Framework) - C:\WINDOWS\System32\wdfmgr.exe
2 uploadmgr (Upload Manager) - %SystemRoot%\System32\svchost.exe -k netsvcs
2 vsmon (TrueVector Internet Monitor) - C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe -service


-- Scheduled Tasks --------------------------------------------------------------

2007-02-16 11:00:08 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job<APPLES~1.JOB>
2007-02-07 23:00:02 502 -----n--- C:\WINDOWS\Tasks\Tune-up Application Start.job<TUNE-U~1.JOB>


-- Files created between 2007-01-19 and 2007-02-19 ------------------------------

2007-02-19 17:16:14 0 d-------- C:\Program Files\HijackThis<HIJACK~1>
2007-02-19 16:47:10 0 dr------- C:\Documents and Settings\Default\Application Data\Brother
2007-02-19 16:37:09 0 d-------- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage<WINDOW~1>
2007-02-19 16:35:27 0 d-------- C:\WINDOWS\LastGood
2007-02-19 16:22:56 0 d-------- C:\Program Files\SpywareGuard<SPYWAR~2>
2007-02-19 16:11:38 118784 --a------ C:\WINDOWS\System32\MSSTDFMT.DLL<Unsigned: Microsoft Corporation>
2007-02-19 16:11:36 0 d-------- C:\Program Files\SpywareBlaster<SPYWAR~1>
2007-02-18 20:47:58 28672 --a------ C:\WINDOWS\System32\drivers\CO_Mon.sys<Unsigned: n/a>
2007-02-18 19:51:40 0 d-------- C:\WINDOWS\McAfee.com
2007-02-18 12:37:46 0 d-------- C:\Documents and Settings\Default\.housecall6.6<HOUSEC~1.6>
2007-02-18 10:58:09 0 d-------- C:\WINDOWS\System32\ActiveScan<ACTIVE~1>
2007-02-14 12:23:56 0 --a------ C:\ylxewb.exe<Unsigned: n/a>
2007-02-14 12:23:39 0 --a------ C:\vrnx.exe<Unsigned: n/a>
2007-02-14 12:23:22 0 --a------ C:\shciiuml.exe<Unsigned: n/a>
2007-02-14 12:23:04 0 --a------ C:\gufk.exe<Unsigned: n/a>
2007-02-14 12:22:46 0 --a------ C:\psodgona.exe<Unsigned: n/a>
2007-02-14 12:22:29 0 --a------ C:\mxxv.exe<Unsigned: n/a>
2007-02-14 12:22:11 0 --a------ C:\wmopnqy.exe<Unsigned: n/a>
2007-02-14 12:21:54 0 --a------ C:\rrcxhj.exe<Unsigned: n/a>
2007-02-08 16:27:30 36864 --a------ C:\WINDOWS\System32\BRVPDNTA.DLL<Unsigned: brother Industries Ltd>
2007-02-08 16:27:30 40960 --a------ C:\WINDOWS\System32\BRVPD95A.DLL<Unsigned: brother industries, ltd >
2007-02-08 16:27:30 196608 --a------ C:\WINDOWS\System32\Brdiag2.exe<Unsigned: brother Industries, Ltd>
2007-02-08 16:27:29 26624 --a------ C:\WINDOWS\System32\BRGSRC32.DLL<Unsigned: n/a>
2007-02-08 16:27:29 4608 --a------ C:\WINDOWS\System32\BRGSRC16.DLL<Unsigned: n/a>
2007-02-08 16:27:28 73728 --a------ C:\WINDOWS\System32\BRRBTOOL.EXE<Unsigned: Brother Industries Ltd>
2007-02-08 16:27:28 77824 --a------ C:\WINDOWS\System32\BROSNMP.DLL<Unsigned: n/a>
2007-02-08 16:27:28 24223 --a------ C:\WINDOWS\System32\brlm03a.dll<Unsigned: brother Industries Ltd>
2007-02-08 16:27:26 19537 -----n--- C:\WINDOWS\System32\drivers\BRPAR.SYS<Unsigned: Brother Industries Ltd.>
2007-02-08 16:27:23 0 d-------- C:\Program Files\Brownie
2007-02-08 16:26:59 34 --a------ C:\WINDOWS\System32\BD2040.DAT
2007-02-08 16:26:28 0 d-------- C:\Program Files\Brother
2007-02-08 16:26:27 188416 --a------ C:\WINDOWS\System32\Pdrvinst.dll<Unsigned: brother>
2007-02-08 16:26:27 81920 --a------ C:\WINDOWS\System32\BrWebIns.dll<Unsigned: brother>
2007-02-08 16:26:26 65536 --a------ C:\WINDOWS\System32\BRWEBUP.EXE<Unsigned: brother>
2007-02-07 11:40:15 0 d-------- C:\WINDOWS\.jagex_cache_32<JAGEX_~1>
2007-02-01 18:04:54 0 d-------- C:\Program Files\Microsoft Works<MICROS~3>
2007-02-01 0013 0 d-------- C:\Program Files\Mozilla Firefox<MOZILL~1>
2007-01-31 16:39:48 0 d--hs---- C:\FOUND.000
2007-01-25 15:01:28 0 d-------- C:\WINDOWS\.file_store_32<FILE_S~1>
2007-01-21 15:08:49 46352 --a------ C:\WINDOWS\setdebug.exe<Unsigned: Microsoft Corporation>
2007-01-21 15:08:46 171280 --a------ C:\WINDOWS\System32\jit.dll<Unsigned: Microsoft Corporation>
2007-01-21 15:08:42 139536 --a------ C:\WINDOWS\System32\javaee.dll<Unsigned: Microsoft Corporation>
2007-01-21 15:08:38 6550 --a------ C:\WINDOWS\jautoexp.dat
2007-01-21 15:08:32 313856 --a------ C:\WINDOWS\System32\dx3j.dll<Unsigned: Microsoft Corporation>
2007-01-21 15:07:38 113 --a------ C:\WINDOWS\System32\zonedon.reg
2007-01-21 15:07:38 113 --a------ C:\WINDOWS\System32\zonedoff.reg
2007-01-21 15:07:37 171792 --a------ C:\WINDOWS\System32\wjview.exe<Unsigned: Microsoft Corporation>
2007-01-21 15:07:37 286992 --a------ C:\WINDOWS\System32\vmhelper.dll<Unsigned: Microsoft Corporation>
2007-01-21 15:07:36 21264 --a------ C:\WINDOWS\System32\msjdbc10.dll<Unsigned: Microsoft Corporation>
2007-01-21 15:07:34 947472 --a------ C:\WINDOWS\System32\msjava.dll<Unsigned: Microsoft Corporation>
2007-01-21 15:07:33 154384 --a------ C:\WINDOWS\System32\msawt.dll<Unsigned: Microsoft Corporation>
2007-01-21 15:07:33 172304 --a------ C:\WINDOWS\System32\jview.exe<Unsigned: Microsoft Corporation>
2007-01-21 15:07:32 15120 --a------ C:\WINDOWS\System32\jdbgmgr.exe<Unsigned: Microsoft Corporation>
2007-01-21 15:07:31 404752 --a------ C:\WINDOWS\System32\javart.dll<Unsigned: Microsoft Corporation>
2007-01-21 15:07:30 63248 --a------ C:\WINDOWS\System32\javaprxy.dll<Unsigned: Microsoft Corporation>
2007-01-21 15:07:30 187152 --a------ C:\WINDOWS\System32\javacypt.dll<Unsigned: Microsoft Corporation>
2007-01-21 15:07:26 49424 --a------ C:\WINDOWS\System32\clspack.exe<Unsigned: Microsoft Corporation>
2007-01-21 15:02:32 262144 --a------ C:\Documents and Settings\All Users\ntuser.dat
2007-01-21 14:55:05 0 d-------- C:\Program Files\MSXML 4.0<MSXML4~1.0>
2007-01-21 14:54:10 26112 --a------ C:\WINDOWS\System32\xpsp1hfm.exe<Unsigned: Microsoft Corporation>
2007-01-21 14:54:10 0 d--h----- C:\WINDOWS\$xpsp1hfm$<$XPSP1~1>
2007-01-19 10:55:02 188960 --a------ C:\WINDOWS\system\WINGDE.DLL<Unsigned: Microsoft Corporation>
2007-01-19 10:55:02 92208 --a------ C:\WINDOWS\system\WING.DLL<Unsigned: Microsoft Corporation>
2007-01-19 10:55:02 0 d-------- C:\LBTMATH
2007-01-19 08:24:22 0 d-------- C:\WINDOWS\System32\bits


-- Find3M Report ----------------------------------------------------------------

2007-02-19 08:50:22 0 --a------ C:\Documents and Settings\Default\Application Data\sversion.ini
2007-02-09 02:19:18 27776 --a------ C:\WINDOWS\System32\drivers\avg7rsxp.sys<Unsigned: GRISOFT, s.r.o.>
2007-02-09 02:19:16 18432 --a------ C:\WINDOWS\System32\drivers\avgmfx86.sys<Unsigned: GRISOFT, s.r.o.>
2007-02-09 02:19:16 839936 --a------ C:\WINDOWS\System32\drivers\avg7core.sys<Unsigned: GRISOFT, s.r.o.>
2007-01-15 17:49:36 0 d-------- C:\Documents and Settings\Default\Application Data\Viewpoint<VIEWPO~1>
2006-12-24 01:34:34 0 d-------- C:\Documents and Settings\Default\Application Data\acccore
2006-12-24 01:32:50 0 d-------- C:\Program Files\Common Files\Nullsoft
2006-12-24 01:31:50 0 d-------- C:\Program Files\AIM6


-- Registry Dump ----------------------------------------------------------------


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"PopUpStopperFreeEdition"="\"C:\\PROGRA~1\\PANICW~1\\POP-UP~1\\PSFREE.EXE\""
"SpybotSD TeaTimer"="C:\\Program Files\\Spybot - Search & Destroy\\TeaTimer.exe"
"Yahoo! Pager"="\"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe\" -quiet"
"Aim6"="\"C:\\Program Files\\AIM6\\aim6.exe\" /d locale=en-US ee://aol/imApp"
"mvnaaaaa"="C:\\WINDOWS\\System32\\mvnaaaaa.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"SystemTray"="systray.exe"
"AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe /STARTUP"
"HostManager"="C:\\Program Files\\Common Files\\AOL\\1151985757\\ee\\AOLSoftware.exe"
"Zone Labs Client"="\"C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe\""
"Motive SmartBridge"="C:\\PROGRA~1\\verizon\\SMARTB~1\\MotiveSB.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"mvnaaaaa"="C:\\WINDOWS\\System32\\mvnaaaaa.exe"
"KernelFaultCheck"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,\
65,6d,33,32,5c,64,75,6d,70,72,65,70,20,30,20,2d,6b,00

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonceex]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys]
"LoadPowerProfile"="Rundll32.exe powrprof.dll,LoadCurrentPwrScheme"
"Easykey"="C:\\Program Files\\Easy Keyboard\\Easykey.exe"
"SoundFusion"="RunDll32 cwcprops.cpl,CrystalControlWnd"
"ATIGART"="c:\\ati\\gart\\atigart.exe"
"AtiPTA"="Atiptaaa.exe"
"AtiCwd32"="Aticwd32.exe"
"AtiQiPcl"="AtiQiPcl.exe"
"SO5 Integrator Pass Two"="C:\\OFFICE51\\SOINTGR.EXE"


[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{81559C35-8464-49F7-BB0E-07A383BEF910}"=""

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0



-- End of ComboScan: finished at 2007-02-19 at 17:19:08 -------------------------

[fredmh]

Hello kraakus, and welcome to TSF


Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools,
then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe.


Please read this post completely before begining the fix. If there's anything that you do not understand, kindly ask your questions before proceeding.
Please ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this
webpage would not be available when you're carrying out the fix.


IT IS IMPORTANT THAT YOU DON'T MISS A STEP & PERFORM EVERYTHING IN THE RIGHT ORDER.

----------------------------------------

The fixes we will use are specific to your problems and should only be used for this issue on this machine.

Please only use this topic to reply to. Do not start another thread.
If any other issues arise let me know.

The process is not instant. Please continue to review my answers until I tell you your machine is clear.
Absence of symptoms does not mean that everything is clear. So lets do this to the end!

Please make every effort to reply to my posts in a timely manner. Malware breeds malware and the longer an infection remains on a system, the more
likely additional infections will result.

----------------------------------------

Please submit the following file to Jotti File Scan

C:\WINDOWS\System32\Drivers\CO_Mon.sys


At the top of the window you should see "File to Upload & Scan" and a blank box. Copy and paste the red text from above into the box.
Then click "submit".

When it is finished, please copy and paste the information listed under "Service" and "Scanner Results" back in this thread.

----------------------------------------

DOWNLOADS




AVG Anti-Spyware 7.5



Please download AVG Anti Spyware

Use the link at the bottom of the page under "AVG Anti-Spyware Free for Windows"

1. Install AVG Anti-Spyware 7.5.
2. Double-click the icon on Desktop to launch AVG A-S 7.5
3. On the top of the main screen click Shield
4. Click the word active to change it to inactive
5. On the top of the main screen click Update.
6. Then click on Start Update. The update will start and a progress bar will show the updates being installed.
7. I also recommend changing the "Update interval" to something more reasonable like 12 hours.

----------------------------------------

DISABLE ANTI-SPYWARE APPLICATIONS

Please disable these Anti-Spyware programs as they may interfere with this fix. You may re-enable them after we clean your system.


S& D Spybot's Tea Timer


While TeaTimer is an excellent tool for the prevention of spyware, it can sometimes prevent HijackThis from fixing certain things.
Please disable TeaTimer for now until you are clean. TeaTimer can be re-activated once your HijackThis log is clean.

• Open Spybot Search & Destroy.
• In the Mode menu click "Advanced mode" if not already selected.
• Choose "Yes" at the Warning prompt.
• Expand the "Tools" menu.
• Click "Resident".
• Uncheck the "Resident "TeaTimer" (Protection of overall system settings) active." box.
• In the File menu click "Exit" to exit Spybot Search & Destroy.

----------------------------------------

SAFE MODE RE-BOOT

Please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Use the up arrow key to highlight Safe Mode and press Enter.
5) Login with your usual account. Make sure to close any open browsers.

----------------------------------------

FIXES AND DELETIONS


Open HijackThis and click on 'Do a System Scan Only'. Check the following entries (If they still exist, make sure you do not miss any)


R3 - URLSearchHook: (no name) - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - (no file)
O3 - Toolbar: (no name) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - (no file)
O4 - HKLM\..\Run: [mvnaaaaa] C:\WINDOWS\System32\mvnaaaaa.exe
O4 - HKCU\..\Run: [mvnaaaaa] C:\WINDOWS\System32\mvnaaaaa.exe



Please remember to close all other windows, including browsers then click Fix checked.

----------------------------------------

UNHIDE HIDDEN FILES

Go to My Computer->Tools->Folder Options->View tab:
* Under the Hidden files and folders heading, select Show hidden files and folders.
* Uncheck the Hide protected operating system files (recommended) option.
* Also make sure there is no checkmark beside Hide file extensions for known file types
* Click Yes to confirm and then click OK.

----------------------------------------
Delete the following Files indicated in RED and Folders indicated in BLUE if they still exist.


C:\ylxewb.exe
C:\vrnx.exe
C:\shciiuml.exe
C:\gufk.exe
C:\psodgona.exe
C:\mxxv.exe
C:\wmopnqy.exe
C:\rrcxhj.exe
C:\FOUND.000

C:\WINDOWS\System32\mvnaaaaa.exe

----------------------------------------

RUNNING SCANNERS



AVG Anti-Spyware 7.5

• Run AVG A-s with it's updated definitions: (...it's important that all windows must be closed)
  This scan can take quite a while to run, so be prepared.
• Click Scanner
• Click on the Scan tab
• Click Complete System Scan to begin scanning.
  
  
  
  
• When the scan is complete click Recommended Action and change it to Quarantine (1),
• If not click Recommended Action and choose Quarantine from the popup menu. (2)
• At the bottom of the window click on the Apply all Actions button. (3)

When done, click the Save Scan Report button. (4) then click Save Report As and save it to your desktop.

IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button.



Note: DO NOT USE the computer while AVG A/S is scanning. If Explorer or the Control Panel are opened some malware types will
reinfect your system or will not be cleaned properly.

----------------------------------------

SYSTEM RE-BOOT

Reboot into Normal Mode.

----------------------------------------


ON-LINE SCANS


Kaspersky - Extended

Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner

Answer Yes, when prompted to install an ActiveX component.

• The program will then begin downloading the latest definition files.
• Once the files have been downloaded click on NEXT
• Locate the Scan Settings button & configure to:
  • Scan using the following Anti-Virus database:
    • Extended
  • Scan Options:
    • Scan Archives
    • Scan Mail Bases
• Click OK & have it scan My Computer
• Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect.
  We only require a report from it.
• Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

* Turn off the real time scanner of any existing antivirus program while performing the online scan

----------------------------------------


IMPORTANT!: NO WINDOWS SERVICE PACKS


Before we can proceed any further, please visit the Microsoft's Windows Update Page
and install ALL Critical Updates for your system (except service pack 2) (SP2).
SP2 should only be installed on a fully disinfected system. At the minimum install at least SP1a for both XP and IE6.

Without these updates your system is wide open to re-infection and we are both wasting our efforts to clean your system.
After we have completed your clean-up, we will have you return to the Windows Update page and install SP2.
We will also then advise you on how to better protect yourself online.

Please apply those updates BEFORE posting your next log. It is this forum's policy to stop the disinfection process until these basic updates are done.

If during the updating process you get a message that your product key is invalid ....then you may not have a legitimate copy of Windows XP.
Unfortunately it’s also this forums policy that we only address users with a legal copy of Windows XP.... therefore if you can not update Windows XP to SP1
we must stop the cleansing process here.

**Note** If you're having trouble locating the service pack SP1a here is a direct link to download it from..

http://download.microsoft.com/downlo...p1a_en_x86.exe

----------------------------------------

FOLLOW-UP

Please return and post these items in the order listed after installing the above updates:

Jotti Report
AVG A/S
Kaspersky scan
A new HJT log run in Normal Mode

Please note: In order to properly see what is on your system, all HJT logs must be run in the normal mode

Please let me know how your system is behaving.

[kraakus]

Thank You for your Help and Time !


Jotti Report

Service
Service load:
0% 100%
File: CO_Mon.sys Status:
OK(Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database) MD5 6be1d6403727bdd8a2b2568dbe6bfb8b Packers detected:
-
Scanner results
Scan taken on 21 Feb 2007 14:02:54 (GMT) AntiVir
Found nothing ArcaVir
Found nothing Avast
Found nothing AVG Antivirus
Found nothing BitDefender
Found nothing ClamAV
Found nothing Dr.Web
Found nothing F-Prot Antivirus
Found nothing F-Secure Anti-Virus
Found nothing Fortinet
Found nothing Kaspersky Anti-Virus
Found nothing NOD32
Found nothing Norman Virus Control
Found nothing VirusBuster
Found nothing VBA32
Found nothing

______________________________________________________________________________________
---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 10:03:32 AM 2/21/2007

+ Scan result:



C:\Documents and Settings\Default\Cookies\default@www.burstbeacon[2].txt -> TrackingCookie.Burstbeacon : Cleaned.
C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\default@www.burstbeacon[1].txt -> TrackingCookie.Burstbeacon : Cleaned.
C:\Documents and Settings\Default\Cookies\default@burstnet[1].txt -> TrackingCookie.Burstnet : Cleaned.
C:\Documents and Settings\Default\Cookies\default@www.burstnet[2].txt -> TrackingCookie.Burstnet : Cleaned.
C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\default@burstnet[2].txt -> TrackingCookie.Burstnet : Cleaned.
C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\default@burstnet[3].txt -> TrackingCookie.Burstnet : Cleaned.
C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\default@www.burstnet[2].txt -> TrackingCookie.Burstnet : Cleaned.
C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\default@vip.clickzs[2].txt -> TrackingCookie.Clickzs : Cleaned.
C:\Documents and Settings\Default\Cookies\default@com[1].txt -> TrackingCookie.Com : Cleaned.
C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\default@com[1].txt -> TrackingCookie.Com : Cleaned.
C:\Documents and Settings\Default\Cookies\default@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Cleaned.
C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\default@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Cleaned.
C:\Documents and Settings\Default\Cookies\default@adopt.specificclick[1].txt -> TrackingCookie.Specificclick : Cleaned.
C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\default@adopt.specificclick[1].txt -> TrackingCookie.Specificclick : Cleaned.
C:\Documents and Settings\Default\Cookies\default@anad.tacoda[2].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\Default\Cookies\default@anat.tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\Default\Cookies\default@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned.
C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\default@anad.tacoda[2].txt -> TrackingCookie.Tacoda : Cleaned.
C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\default@anat.tacoda[2].txt -> TrackingCookie.Tacoda : Cleaned.


::Report end
___________________________________________________________________________________

When I try to run the Kaspesky Online Scan, it says “Kaspesky Online Scan licience is expired!”

___________________________________________________________________________________
Logfile of HijackThis v1.99.1
Scan saved at 3:26:22 AM, on 2/22/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\SiteAdvisor\6009\SAService.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Common Files\AOL\1151985757\ee\AOLSoftware.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\verizon\SMARTB~1\MotiveSB.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFREE.EXE
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\HijackThis\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.netcenter.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://us.f840.mail.yahoo.com/ym/Sho...ad=b&box=Inbox
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://verizon.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://verizon.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\windows\SYSTEM\blank.htm
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6009\SiteAdv.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: TwcToolbarBhoApp Class - {AA1F9DDB-E605-4ba6-81D4-E427DEE012AD} - C:\WINDOWS\SYSTEM32\TwcToolbarBho.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6009\SiteAdv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: The Weather Channel Toolbar - {2E5E800E-6AC0-411E-940A-369530A35E43} - C:\WINDOWS\SYSTEM32\TwcToolbarIe7.dll
O4 - HKLM\..\Run: [SystemTray] systray.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1151985757\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\verizon\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFREE.EXE"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: Microsoft Office Shortcut Bar.lnk = C:\Program Files\Microsoft Office\Office\MSOFFICE.EXE
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: The Weather Channel - {2E5E800E-6AC0-411E-940A-369530A35E43} - (no file)
O9 - Extra 'Tools' menuitem: The Weather Channel - {2E5E800E-6AC0-411E-940A-369530A35E43} - (no file)
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://activatemydsl.verizon.net/sd...SL/tgctlcm.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\6009\SiteAdv.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: SiteAdvisor Service - McAfee, Inc. - C:\Program Files\SiteAdvisor\6009\SAService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
_______________________________________________________________

System seems to run a little slower since installing SP1, which also took a long time to install.

[fredmh]

Computer speed can be caused by a number of issues (items running, memory, etc). If you would like, you can post about the speed issue
in the [url=http://www.techsupportforum.com/microsoft-support/windows-xp-support/]Windows XP Support [/url forum. The folks in there are knowledgeable
in this area and can provide assistance.

SP1 is a rather large file and depending on connection speed can take awhile to download.

Regarding your initial comment about dubious sites, I see you have Site Advisor installed. This is an excellent program for helping determine which
sites may harm yuor computer.

Your logs are now clean. Please complete the next "housekeeping" steps and read through the information below.


----------------------------------------

Clear IE's Cookies and Cache

• Close all instances of Outlook Express and Internet Explorer.
• Go to Control Panel » Internet Options » General tab.
• Click the Delete Cookies.
• Next to it, Click the Delete Files button.
• When prompted, place a check in: Delete all offline content, click OK.

----------------------------------------

Windows XP - Reset Hidden Files

• Click Start.
• Open My Computer.
• Select the Tools menu and click Folder Options.
• Select the View tab.
• Deselect the Show hidden files and folders option.
• Select the Hide file extensions for known types option.
• Select the Hide protected operating system files option.
• Click Yes to confirm.
• Click OK.

----------------------------------------

Clean-out and Reset System Restore

This will clean out any junk or malicious files left behind in System Restore

• To turn off System Restore click Start > Right Click My Computer > Properties.
• Click the System Restore tab and Check
• "Turn off System Restore" or "Turn off System Restore on all drives" Click Apply.
• When turning off System Restore, the existing restore points will be deleted. Click Yes to do this then Click OK.
  
  
• Turn on System Restore by Clicking Start. Right-click My Computer, and then click Properties.
• Click the System Restore tab. Uncheck "Turn off System Restore" or "Turn off System Restore on all drives."
• Click Apply, and then OK.

This will create a new Restore Point.

----------------------------------------

RE-ENABLE ANTI-SPYWARE APPLICATIONS

If you were instructed to dis-able Anti-spyware applications during this fix, you may re-enable them

----------------------------------------

Please read through the following information to help protect your computer in the future.


KEEP YOUR OPERATING SYSTEM UPDATED

Please ensure that you have already patched your system against the recent WMF exploit. Go to this page to get the KB912919 patch

MICROSOFT UPDATES

It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser
up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft
and download all the critical updates to help prevent possible re-infection.


ENABLE WINDOWS AUTO UPDATE

Go to Start>Run - type wuaucpl.cpl
tick on the checkbox - "Keep my computer up to date"
Under settings, choose "Automatically download the updates, and install them on the schedule that I specify".
Click on "OK".


ENABLE WINDOWS AUTO UPDATE

From within Internet Explorer click on the Tools menu and then click on Internet Options.

• Select the Security tab
  • Click once on the Internet icon so it becomes highlighted.
  • Select Custom Level .
    • Change 'Download signed ActiveX controls' to Prompt
    • Change 'Download unsigned ActiveX controls' to Disable
    • Change 'Initialize and script ActiveX controls not marked as safe' to Disable
    • Change 'Installation of desktop items' to Prompt
    • Change 'Launching programs and files in an IFRAME' to Prompt
    • Change 'Navigate sub-frames across different domains' to Prompt
    • When all these changes have been made, click on the OK button.
  • If it prompts you as to whether or not you want to save the settings, press the Yes button.
• Select OK to exit the Internet Properties page.

TOOLS TO HELP KEEP YOUR SYSTEM CLEAN

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programs:

SpywareBlaster to help prevent spyware from installing in the first place.

• Install & update SpywareBlaster with the latest definitions.
• After you have updated, click the button - enable protection for all unprotected items

SpywareGuard to catch and block spyware before it can execute.


SPYBOT - SEARCH & DESTROY Download and install Spybot - Search & Destroy with its
TeaTimer option.
This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with
the program on a regular basis just as you would an antivirus software. A tutorial on installing & using this product can be found here


AD-AWARE Download and install Ad-Aware. You should use this program to scan
your computer on a regular basis just as you would an antivirus software in conjunction with Spybot. A tutorial on installing & using this product
can be found here


IE-SPYAD IE/Spyad places more than 4000 dubious websites and domains in the IE Restricted list. This severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites.

• Download IE-SpyAD - Extract the contents to a new folder
• From within the folder, double-click install.bat
• Select Option #2 - Install the new IE-SPYAD list.
• Then return to the main menu.
• Select option #4 - Add the old porn sites domain

A tutorial for IE-SPYAD can be found here


MVPS HOST FILE The MVPS Hosts file replaces your current HOSTS file
with one that will restrict known ad sites form serving you unsolicited advertisements. Basically, this prevents your computer from connecting to
those sites by redirecting them to 127.0.0.1 which is the IP of your local computer.

• Download Host.zip to your desktop.
• From your Desktop right-click (hosts.zip) and select:
  Extract All from the menu.
  
• Click Next, click Next, select the option:
  "Show Extracted files"
• Click Finish

This will open the newly created hosts folder on your Desktop.

Double-click on the included mvps.bat file, this will rename the existing HOSTS file to HOSTS.MVP, then it will copy the included updated
HOSTS file to the correct location on your machine.


MCAFEE SITE ADVISOR SITE ADVISOR is a free IE plug-in (also suport for Firefox browser)
which is used in conjunction with the Google search engine. It advises which web sites are considered safe and which sites could pose a problem.
It also shows what problems were encountered with each site, such as malicious downloads, spam, and related links.


ANTI-VIRUS AND FIREWALL PROGRAMS


ANTIVIRUS SOFTWARE It is very important that you have anti-virus software running on your machine.
This alone can save you a lot of trouble with malware in the future.
See this link for a listing of some online antivirus scanners: Anti-Spyware Tutorial

Here are some very good free Antivirus products which are available:

• Avast!
  
• AVG
  

If you do not have a firewall, here are 4 free ones available for personal use:

Understanding and Using Firewalls

• ZoneAlarm
• Avast Antivirus/Firewall
• Tiny Personal Firewall
• OutPost Firewall

INFORMATIONAL READING


In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles:

• PC SAFETY AND SECURITY
• HOW DID I GET INFECTED IN THE FIRST PLACE?
• THE ANTI-SPYWARE TUTORIAL
• MAKING INTERNET EXPLORER SAFER
• INVASION OF THE COMPUTER SNATCHERS
• The Cookie Concept
• The Spam Experiment

Please respond one more time and let me know you received this post so it can be marked resolved



If you feel that we have helped you, please help us keep this site free for all. Please visit our DONATION PAGE.

[kraakus]

Great work !!!

A few Questions:


1) ZoneAlarm
I run ZoneAlarm Firewall, but I’m not sure I have all the settings correct.
When I set Internet Zone Security setting to High (Stealth) “Stealth Mode. Computer is hidden and protected from hackers. Sharing is not allowed. This setting is recommended for the Internet Zone.”,
I can not access the Internet (Verizon DSL).
So I leave it at Medium, , which says “Visible but protected mode. Computers can see your computer but cannot use it’s resources. Incoming NetBIOS is blocked. This setting is recommended for temporary use in the internet zone.”
Where should this be set.

And what is the preferred setting for Trusted Zone Security?

2) Spybot SD
Should I turn Spybot SD Resident back on?
Active X?
BHOs ?
Should I run IE SPYAD in addition to Spybot SD? The Spyad site said there could be conflict and to run only one.

3) Control Panel>Internet Options>Privacy Tab
What should be this setting for cookies?

4) What about XP SP2 ?

Thanks for all your help.

[fredmh]

Since your logs are clean, you can go ahead and d/l SP2, but be aware that this is a very large file and may take some time depending on connection speed

For help with the Zone Alarm FW, please post in the Security and Firewalls forum. The folks in there will help with your questions.

[kraakus]

Thanks Again
Signing off