Constant random pop ups.

[HyperMatt]

Hello everyone. I'm new to these forums and recently, yesterday, I started to experience random pop ups from time to time. I never experienced anything like this before so I assume something is wrong and my computer may be infected. Unfortunately, I do NOT have an antivirus software but I followed your 5 step process laid out to viewers before posting. The ad's themselves are random and they are all like advertisements that pop up when you enter some websites. I scanned my computer with Deckard's System Scanner and I hope you guys can help me out. Thanks so much in advance.

Deckard's System Scanner v20071014.68
Run by Matthew on 2008-06-17 19:00:35
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.


-- Last 5 Restore Point(s) --
26: 2008-06-17 23:00:47 UTC - RP647 - Deckard's System Scanner Restore Point
25: 2008-06-17 01:11:47 UTC - RP646 - System Checkpoint
24: 2008-06-16 00:26:05 UTC - RP645 - System Checkpoint
23: 2008-06-14 23:53:50 UTC - RP644 - System Checkpoint
22: 2008-06-13 23:30:15 UTC - RP643 - System Checkpoint


-- First Restore Point --
1: 2008-05-22 03:29:05 UTC - RP622 - System Checkpoint


Backed up registry hives.
Performed disk cleanup.

Total Physical Memory: 510 MiB (512 MiB recommended).
System Drive C: has 4.31 GiB (less than 15%) free.


-- HijackThis Clone ------------------------------------------------------------


Emulating logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2008-06-17 19:07:10
Platform: Windows XP Service Pack 2 (5.01.2600)
MSIE: Internet Explorer (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\WINDOWS\system32\ico.exe
C:\Program Files\Lexmark X5100 Series\lxbabmgr.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Lexmark X5100 Series\lxbabmon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Nikon\NkView6\NkvMon.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\SynCor.exe
C:\Documents and Settings\Matthew\Desktop\dss.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/keyword/%s
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: (no name) - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - (no file)
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe irprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [Tgcmd] "C:\Program Files\Support.com\bin\tgcmd.exe /server"
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [Lexmark X5100 Series] "C:\Program Files\Lexmark X5100 Series\lxbabmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Elements 5.0\apdproxy.exe"
O4 - HKLM\..\Run: [SMSTray] C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [ROAM REAL CLOSE OBJ] C:\Documents and Settings\All Users\Application Data\Bait nurb roam real\Audio find.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [multimeta] C:\DOCUME~1\Matthew\APPLIC~1\BAT16F~1\plus does.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: NkvMon.exe.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} (Microsoft Office Template and Media Control) - http://office.microsoft.com/templates/ieawsdc.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
O16 - DPF: {33564D57-9980-0010-8000-00AA00389B71} () - http://download.microsoft.com/downlo...0C/wmv9dmo.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://matt-hui.spaces.live.com//Pho...d/MsnPUpld.cab
O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} (ijjiPlugin2 Class) - http://gamedownload.ijjimax.com/game...lugin11USA.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/...toUploader.cab
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} () - http://download.shockwave.com/pub/otoy/OTOYAX.cab
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} () - http://fpdownload.macromedia.com/get.../ultrashim.cab
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/sof...iveXPlugin.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAV...oadManager.ocx
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/game...Plugin9USA.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/get...nt/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary...r.cab56986.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Desktop Manager 5.7.802.22438 (GoogleDesktopManager-022208-143751) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_2.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\system32\NMSSvc.Exe
O23 - Service: PLSRemote Service (PLSRemoteSvc) - Unknown owner - C:\WINDOWS\system32\PLSRemote.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe


--
End of file - 11022 bytes

-- File Associations -----------------------------------------------------------

All associations okay.


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R2 npkcrypt - c:\nexon\maplestory\npkcrypt.sys <Not Verified; INCA Internet Co., Ltd.; nProtect KeyCrypt Driver>
R2 PMEM - c:\windows\system32\drivers\pmemnt.sys <Not Verified; Microsoft Corporation; Microsoft(R) Windows NT(TM) Operating System>

S3 EGATHDRV (IBM Access Support) - c:\windows\system32\egathdrv.sys
S3 XTrapD12 - c:\windows\system32\xtrapd12.sys (file missing)


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 Bonjour Service (##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##) - "c:\program files\bonjour\mdnsresponder.exe" <Not Verified; Apple Computer, Inc.; Bonjour>

S2 LiveUpdate Notice Ex (LiveUpdate Notice Service Ex) - "c:\program files\common files\symantec shared\ccsvchst.exe" /h cccommon (file missing)
S2 NMSSvc (Intel(R) NMS) - c:\windows\system32\nmssvc.exe <Not Verified; Intel Corporation; NMS>
S3 FLEXnet Licensing Service - "c:\program files\common files\macrovision shared\flexnet publisher\fnplicensingservice.exe" <Not Verified; Macrovision Europe Ltd.; FLEXnet Publisher (32 bit)>
S3 PLSRemoteSvc (PLSRemote Service) - c:\windows\system32\plsremote.exe


-- Device Manager: Disabled ----------------------------------------------------

No disabled devices found.


-- Scheduled Tasks -------------------------------------------------------------

2008-06-17 19:00:00 280 --ah----- C:\WINDOWS\Tasks\AFAF32CB9100A4CB.job
2008-06-10 14:21:00 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job


-- Files created between 2008-05-17 and 2008-06-17 -----------------------------

2008-06-17 09:02:11 0 d-------- C:\Documents and Settings\Vincent Hui\Application Data\Bat16Five
2008-06-16 18:37:19 0 d-------- C:\Documents and Settings\All Users\Application Data\Messenger Plus!
2008-06-16 18:28:40 0 d-------- C:\Documents and Settings\All Users\Application Data\Bait nurb roam real
2008-06-16 18:28:22 0 d-------- C:\Program Files\Bat16Five
2008-06-16 18:28:22 0 d-------- C:\Documents and Settings\Matthew\Application Data\Bat16Five
2008-06-16 18:27:56 0 d-------- C:\Program Files\Circle Developement
2008-06-16 18:27:52 0 d-------- C:\Program Files\Windows Live
2008-06-16 18:27:51 0 d-------- C:\Program Files\Messenger Plus! Live
2008-06-15 19:57:26 0 d-------- C:\Program Files\Red Kawa
2008-05-25 20:24:40 552 --a------ C:\WINDOWS\system32\d3d8caps.dat
2008-05-24 18:45:14 0 d-------- C:\Program Files\Boilsoft MP4 Converter
2008-05-21 22:45:03 0 d-------- C:\Program Files\YASAMP4Converter


-- Find3M Report ---------------------------------------------------------------

2008-06-16 18:27:52 0 d-------- C:\Program Files\MSN Messenger
2008-06-08 18:48:44 0 d-------- C:\Documents and Settings\Matthew\Application Data\Adobe
2008-05-21 21:32:24 0 d-------- C:\Program Files\Windows Live Safety Center
2008-05-02 21:19:07 0 d-------- C:\Program Files\LimeWire
2008-05-01 22:19:40 0 d-------- C:\Program Files\Sony
2008-05-01 21:39:59 0 d-------- C:\Program Files\Game Cam Lite v1.4
2008-05-01 21:39:02 0 d-------- C:\Program Files\BlazeScape
2008-04-20 20:54:52 0 d-------- C:\Program Files\HyCam2


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [24/01/2003 03:17 AM]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [24/01/2003 03:05 AM]
"BluetoothAuthenticationAgent"="irprops.cpl" [04/08/2004 03:56 AM C:\WINDOWS\system32\irprops.cpl]
"Smapp"="C:\Program Files\Analog Devices\SoundMAX\Smtray.exe" [26/06/2002 07:36 PM]
"Tgcmd"="C:\Program Files\Support.com\bin\tgcmd.exe" [07/11/2001 06:50 AM]
"UC_SMB"="" []
"Mouse Suite 98 Daemon"="ICO.EXE" [14/03/2002 07:46 PM C:\WINDOWS\system32\ico.exe]
"Lexmark X5100 Series"="C:\Program Files\Lexmark X5100 Series\lxbabmgr.exe" [04/03/2003 08:49 AM]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [11/05/2005 11:12 PM]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Elements 5.0\apdproxy.exe" []
"SMSTray"="C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe" [20/09/2007 08:23 AM]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [27/04/2007 09:41 AM]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [28/06/2007 09:14 AM]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [12/03/2007 07:30 PM]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [10/03/2008 09:43 PM]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [22/02/2008 04:25 AM]
"ROAM REAL CLOSE OBJ"="C:\Documents and Settings\All Users\Application Data\Bait nurb roam real\Audio find.exe" [17/06/2008 06:34 PM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [19/01/2007 12:54 PM]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [04/08/2004 03:56 AM]
"multimeta"="C:\DOCUME~1\Matthew\APPLIC~1\BAT16F~1\plus does.exe" [16/06/2008 06:28 PM]

C:\Documents and Settings\Matthew\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [16/03/2005 8:16:50 PM]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [11/05/2005 11:23:26 PM]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [17/02/1999 4:05:56 PM]
NkvMon.exe.lnk - C:\Program Files\Nikon\NkView6\NkvMon.exe [02/09/2006 9:15:13 PM]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{88485281-8b4b-4f8d-9ede-82e29a064277}"= C:\PROGRA~1\MarkAny\CONTEN~1\MACSMA~1.DLL [23/11/2004 05:51 PM 192512]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"




-- End of Deckard's System Scanner: finished at 2008-06-17 19:08:56 ------------

[HyperMatt]

Hello everyone. I wanted to carry out another scan with HijackThis on my computer but it won't let me anymore. Whenever I click yes, it says HijackThis is unable to be downloaded. When I click no, I cannot find the program file (Searched for it already). When I clicked cancel, or did not reply for 30 seconds, only the main.txt showed up- what happend to the extra.txt?

Please help me. I understand that everyone will have problems similar to mine but I hope someone can help me out as soon as possible!
Thanks in advance,
Matt

[tetonbob]

Hello and Welcome. Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe.

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

---------------------------------------------------------------------------------------------

Uninstall the following via the Add/Remove Panel (Start->(Settings)->Control Panel->Add or Remove Programs) if they exist:

Messenger Plus! Live & Sponsor (CiD)

You have installed Messenger Plus! Live. This program is known to install the malware that you have, a LOP infection. If the program is a must have, reinstall it after we're done, and decline when asked to install the sponsor's software.

---------------------------------------------------------------------------------------------

P2P - I see you have P2P software ( Limewire ) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares.

References for the risk of these programs are here,
here and here.

I would strongly recommend that you uninstall them, however that choice is up to you. If you choose to remove these programs, you can do so via Control Panel >> Add or Remove Programs.

---------------------------------------------------------------------------------------------



Please download OTMoveIt2 by OldTimer.

• Save it to your desktop.
• Please double-click OTMoveIt2.exe to run it.
  
• Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  

  [kill explorer]
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\ROAM REAL CLOSE OBJ
  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\multimeta
  C:\WINDOWS\Tasks\AFAF32CB9100A4CB.job
  C:\Documents and Settings\Vincent Hui\Application Data\Bat16Five
  C:\Documents and Settings\All Users\Application Data\Bait nurb roam real
  C:\Program Files\Bat16Five
  C:\Documents and Settings\Matthew\Application Data\Bat16Five
  EmptyTemp
  [start explorer]

• Return to OTMoveIt2, right click in the "Paste List Of Files/Patterns To Search For and Move" window (under the yellow bar) and choose Paste.
  
• Click the red Moveit! button.
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
• Close OTMoveIt2

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

If the machine reboots, the Results log can be found here:

c:\_OTMoveIt\MovedFiles\mmddyyyy_hhmmss.log

Where mmddyyyy_hhmmss is the date of the tool run.

---------------------------------------------------------------------------------------------

Download fl.zip
Extract the contents to a new folder on your Desktop.
Within the folder, locate & double-click fl.bat.
It should produce a report at c:\findlop.txt. Post the contents of the report in your next reply

---------------------------------------------------------------------------------------------

Run DSS once again, and post it's log. Only main.txt will be produced.

[HyperMatt]

I removed MSN Messenger live along with limewire yesterday after reading up on some of the solved cases in these forums. I also downloaded the free AntiVirus Avira the other day, and I scanned my entire computer and I found 24 Trojans/Unwanted files and 1 worm. I deleted all the files that could have harmed my computer.

Just now I followed your steps, my Start menu has dissapeared now and I can no longer see my desktop. Is this supposed to happen?

Since I deleted some files on my computer, would my original "HijackThis" scan be unaccurate? Perhaps should I give you an updated "HijackThis" scan? (but it will only be the main.txt)

I am unsure of what to do now. I just want to confirm that what I'm about to do will be the right thing because I don't want to do any more damage to my computer :)

Thanks so much for your help in advance,
Matt

[tetonbob]

How are you posting if your desktop is gone?

Did the machine restart?

Can you open task manager? Ctrl + Alt + Del ?

If so, go to File > New Task (Run) and type explorer then Click OK.

Does the desktop return?

[HyperMatt]

Well. I followed your previous instructions beforehand and copied the code and moved it with the program but in the middle of the procedure somewhere- it ended up "not responding." Once I executed the code, my Start bar and my desktop were gone (I could only see the file moving program and the windows explorer browser open with these instructions). But then I logged off using "Ctrl-alt-del" and logged back in and everything was back to normal.

[tetonbob]

Ok, that's good to hear.

This is what I'd like you to do...

Post the log

c:\_OTMoveIt\MovedFiles\mmddyyyy_hhmmss.log

Where mmddyyyy_hhmmss is the date of the tool run.

---------------------------------------------------------------------------------------------

Download fl.zip
Extract the contents to a new folder on your Desktop.
Within the folder, locate & double-click fl.bat.
It should produce a report at c:\findlop.txt. Post the contents of the report in your next reply

---------------------------------------------------------------------------------------------

Run DSS once again, and post it's log. Only main.txt will be produced.

[HyperMatt]

Sorry, I'm not too good with computer :)

How do I obtain the log?

[tetonbob]

Open My Computer from the Start Menu

Double click on C drive

Locate the folder _OTMoveIt double click on it

Open this folder next:

MovedFiles

Inside that folder will be a text file, it will have a long name, numbers which represent the time and date of the run of the tool.

Double click on that text file to open it.

Post the contents of that file in a reply, just like the other logs.

Does that help?

[HyperMatt]

There isn't a log, or a .txt file at all. After the folder "MovedFiles", I get another folder named "06192008_215809". Then I click that and I get "Documents and Settings" and then that leads to two seperate folders named "all users" and "vincent" another user on the computer.

[tetonbob]

That's ok...seems that the interruption to OTMI caused it to not create a log.

The logs from the next two tools will tell me what I need to know.

[HyperMatt]

Alright then. I really appreciate your help so far, you're extremely helpful :)

Here's the log from running fl.bat:

Volume in drive C is IBM_PRELOAD
Volume Serial Number is C893-182C

Directory of C:\Documents and Settings\All Users\Application Data

24/12/2007 03:51 PM <DIR> Adobe
30/03/2007 10:48 PM <DIR> Adobe Systems
25/03/2007 07:01 PM <DIR> Apple Computer
17/06/2008 07:57 PM <DIR> Avira
30/08/2006 06:44 PM <DIR> BVRP Software
16/11/2006 05:57 PM <DIR> espionServerData
07/10/2007 05:19 PM <DIR> FLEXnet
28/04/2007 05:30 PM <DIR> Google
10/10/2006 10:11 PM <DIR> HP
03/02/2008 02:38 PM 2,232 hpzinstall.log
07/01/2008 09:23 PM <DIR> Lavasoft
09/11/2007 11:01 PM 3,142 LUUnInstall.LiveUpdate
09/07/2007 04:03 PM 110 MostFunGameId.bin
23/11/2006 07:06 PM <DIR> MSN6
14/12/2007 07:28 PM <DIR> Musicnotes
01/10/2006 12:25 PM <DIR> NCH Swift Sound
18/05/2007 05:05 PM <DIR> NexonUS
28/12/2006 02:14 PM <DIR> PlayFirst
23/01/2008 10:41 PM 1,755 QTSBandwidthCache
02/09/2006 09:14 PM <DIR> QuickTime
29/06/2007 11:36 AM <DIR> Sandlot Games
24/09/2002 12:30 PM <DIR> SBSI
20/08/2006 12:23 PM <DIR> Support.com
07/04/2007 10:16 PM <DIR> SwiftSwitch
09/11/2007 11:03 PM <DIR> Symantec
13/04/2008 04:01 PM <DIR> TechSmith
05/01/2008 11:52 AM <DIR> TEMP
30/08/2006 06:51 PM <DIR> Windows Genuine Advantage
4 File(s) 7,239 bytes
24 Dir(s) 5,744,590,848 bytes free
Volume in drive C is IBM_PRELOAD
Volume Serial Number is C893-182C

Directory of C:\Documents and Settings\Hillary\Application Data

14/12/2007 09:41 PM <DIR> Adobe
13/02/2008 09:42 PM <DIR> Apple Computer
24/09/2002 12:08 PM <DIR> Identities
06/06/2008 07:50 PM <DIR> LimeWire
18/09/2007 09:03 PM <DIR> Macromedia
11/09/2007 03:56 PM <DIR> Nikon
09/01/2008 05:28 PM <DIR> PC Tools
11/09/2007 04:00 PM <DIR> Sun
06/03/2008 07:39 PM <DIR> WinRAR
0 File(s) 0 bytes
9 Dir(s) 5,744,590,848 bytes free
Volume in drive C is IBM_PRELOAD
Volume Serial Number is C893-182C

Directory of C:\Documents and Settings\Matthew\Application Data

08/06/2008 06:48 PM <DIR> Adobe
25/03/2007 07:50 PM <DIR> Apple Computer
10/09/2006 05:04 PM <DIR> ArcSoft
24/03/2008 10:19 PM <DIR> DataCast
26/04/2007 07:59 PM <DIR> Google
24/12/2007 05:59 PM <DIR> gtk-2.0
14/12/2007 06:41 PM <DIR> Help
10/10/2006 10:15 PM <DIR> HP
30/03/2007 10:46 PM <DIR> IBM
24/09/2002 12:08 PM <DIR> Identities
03/02/2008 02:39 PM <DIR> Image Zone Express
03/09/2006 06:31 PM <DIR> InterTrust
30/08/2006 06:50 PM <DIR> Macromedia
30/08/2006 10:45 PM <DIR> Microsoft Web Folders
01/02/2007 07:26 PM <DIR> Mozilla
23/11/2006 07:06 PM <DIR> MSN6
08/10/2006 03:40 PM <DIR> NCH Swift Sound
02/08/2007 08:30 PM <DIR> Nexon
02/09/2006 09:22 PM <DIR> Nikon
26/09/2007 07:09 PM <DIR> Opera
02/01/2008 01:39 PM <DIR> Publish Providers
16/08/2007 08:51 PM <DIR> Real
10/07/2007 06:05 PM <DIR> Recorder
01/10/2006 12:25 PM <DIR> RecordPad
02/01/2008 01:38 PM <DIR> Sony
03/10/2006 04:41 PM <DIR> Sun
31/08/2006 02:23 PM <DIR> Symantec
01/10/2006 12:26 PM 1,024 WavCodec.wff
16/10/2007 08:33 PM <DIR> WinRAR
25/02/2007 05:42 PM <DIR> Xfire
1 File(s) 1,024 bytes
29 Dir(s) 5,744,590