Malware and Pop-ups and Trojans, OH MY!

Achmanage · 10-27-2006, 03:48 PM

OK guys, here we go!

We got your basic dish of malware symptoms, computer's running slow, pop-ups on the browser, ridiculously annoying pace where I'm sitting here for about ten seconds before Firefox loads. Boot-up's real slow. You know the combo meal I'm talking about.

I did a little digging online before I found this site and found out that the pop-ups I was getting matched that of some nefarious Vundo virus thing. So I got Symantec's Vundo removal program an ran that and now I guess it's gone but I still get pop-ups! Now, granted the pop-up doesn't load a page anymore (it says the connection timed out or something), there's an IP address it's trying to reach. I'm not sure if I'm supposed to post it here but I will and if the admins don't like it, they can remove it (I hope) 202.67.220.227. Google has it named as "evil cockroach spyware" which is really kind of funny. But I digress.

I've done the routine check-ups. I ran spybot, I ran AVG, I ran Symantec. I took care of everything they found, but obviously the problem is still there, somewhere. Here's my Hijackthis log, let me know if I'm leaving out anything or if you need any more information.

And thanks in advance!

PS. I was wrong, right before I ran a scan, it seems the diabolical WinAntiVirusPro pop-up ads are back! Nooooooooo!

Logfile of HijackThis v1.99.1
Scan saved at 5:46:09 PM, on 10/27/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\brsvc01a.exe
C:\WINNT\system32\brss01a.exe
C:\WINNT\system32\spoolsv.exe
D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\WINNT\Explorer.EXE
D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINNT\system32\Brmfrmps.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\QuickTime\qttask.exe
C:\WINNT\system32\nvraidservice.exe
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\SOUNDMAN.EXE
D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINNT\system32\ctfmon.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
E:\PROGRA~1\MICROS~2\wcescomm.exe
C:\WINNT\system32\mspmspsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
E:\PROGRA~1\MICROS~2\rapimgr.exe
D:\Program Files\D-Link AirPlus\AIRPLUS.EXE
C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
D:\Program Files\Raxco\PerfectDisk\PDSched.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Brother\Brmfcmon\BrMfcmon.exe
C:\WINNT\system32\wbem\unsecapp.exe
C:\WINNT\system32\wuauclt.exe
D:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &VSToolBar - {821F87FF-8245-4972-9E28-732E92EC2F51} - C:\Program Files\VSToolbar\VSToolBar.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl04b\BrStDvPt.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NVRaidService] C:\WINNT\system32\nvraidservice.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SW20] C:\WINNT\system32\sw20.exe
O4 - HKLM\..\Run: [SW24] C:\WINNT\system32\sw24.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG7_CC] D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [H/PC Connection Agent] "E:\PROGRA~1\MICROS~2\wcescomm.exe"
O4 - Startup: BitTorrent.lnk.disabled
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: D-Link AirPlus Utility.lnk = D:\Program Files\D-Link AirPlus\AIRPLUS.EXE
O4 - Global Startup: Microsoft Office.lnk = E:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Status Monitor.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - E:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - E:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - E:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Dwighty\Start Menu\Programs\IMVU\Run IMVU.lnk
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O15 - Trusted Zone: http://aimexpress.aim.com
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINNT\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Brother Popup Suspend service for Resource manager (brmfrmps) - Unknown owner - C:\WINNT\system32\Brmfrmps.exe" -service (file missing)
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINNT\system32\brsvc01a.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
O23 - Service: PDEngine - Raxco Software, Inc. - D:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: PDScheduler (PDSched) - Raxco Software, Inc. - D:\Program Files\Raxco\PerfectDisk\PDSched.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

fredmh · 10-28-2006, 02:37 PM

Hello Achmanage, and welcome to TSF.

I am currently reviewing your log. Please note that this is under the supervision of an expert analyst,
and I will be back with a fix for your problem as soon as possible.

You may wish to Subscribe to this thread (Thread Tools) so that you are notified when you receive a reply.

Please be patient with me during this time.

fredmh · 10-28-2006, 03:54 PM

The infection you have, a variant of vundo, recognizes HijackThis and prevents HJT from reading the registry locations where it resides as well as
hiding other infections in those locations.

I'd like you to rename HijackThis.exe to manage.exe.

Navigate to C:\Path of HJT
Right click on HijackThis.exe
Select 'Rename'
Type in manage.exe
Press Enter.

Please run a scan with the newly renamed phatzilla.exe and post the new log here.

Achmanage · 10-28-2006, 04:27 PM

Hey Fred,

First of all, thank you so much for helping me out with this

Here's what "manage.exe" has reported:

Logfile of HijackThis v1.99.1
Scan saved at 6:25:53 PM, on 10/28/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\brsvc01a.exe
C:\WINNT\system32\brss01a.exe
C:\WINNT\system32\spoolsv.exe
D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINNT\Explorer.EXE
D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINNT\system32\Brmfrmps.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINNT\system32\mspmspsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
D:\Program Files\Raxco\PerfectDisk\PDSched.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINNT\system32\nvraidservice.exe
C:\WINNT\SOUNDMAN.EXE
C:\WINNT\system32\RUNDLL32.EXE
D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINNT\system32\ctfmon.exe
C:\WINNT\System32\svchost.exe
E:\PROGRA~1\MICROS~2\wcescomm.exe
E:\PROGRA~1\MICROS~2\rapimgr.exe
C:\WINNT\system32\wbem\unsecapp.exe
D:\Program Files\D-Link AirPlus\AIRPLUS.EXE
C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
C:\Program Files\Brother\Brmfcmon\BrMfcmon.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINNT\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\HJT\manage.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1DAEFCB9-06C8-47c6-8F20-3FB54B244DAA} - C:\WINNT\system32\jsnuytbr.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {F04154D0-8037-40AD-B9A5-ECFC14813AAC} - C:\WINNT\Drivers\ssp.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &VSToolBar - {821F87FF-8245-4972-9E28-732E92EC2F51} - C:\Program Files\VSToolbar\VSToolBar.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl04b\BrStDvPt.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NVRaidService] C:\WINNT\system32\nvraidservice.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SW20] C:\WINNT\system32\sw20.exe
O4 - HKLM\..\Run: [SW24] C:\WINNT\system32\sw24.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG7_CC] D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [H/PC Connection Agent] "E:\PROGRA~1\MICROS~2\wcescomm.exe"
O4 - Startup: BitTorrent.lnk.disabled
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: D-Link AirPlus Utility.lnk = D:\Program Files\D-Link AirPlus\AIRPLUS.EXE
O4 - Global Startup: Microsoft Office.lnk = E:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Status Monitor.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - E:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - E:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - E:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Dwighty\Start Menu\Programs\IMVU\Run IMVU.lnk
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O15 - Trusted Zone: http://aimexpress.aim.com
O20 - Winlogon Notify: NavLogon - C:\WINNT\system32\NavLogon.dll
O20 - Winlogon Notify: ssp - C:\WINNT\Drivers\ssp.dll
O20 - Winlogon Notify: winccf32 - winccf32.dll (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINNT\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Brother Popup Suspend service for Resource manager (brmfrmps) - Unknown owner - C:\WINNT\system32\Brmfrmps.exe" -service (file missing)
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINNT\system32\brsvc01a.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
O23 - Service: PDEngine - Raxco Software, Inc. - D:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: PDScheduler (PDSched) - Raxco Software, Inc. - D:\Program Files\Raxco\PerfectDisk\PDSched.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

fredmh · 10-28-2006, 09:36 PM

Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools,
then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe.

Please read this post completely before begining the fix. If there's anything that you do not understand, kindly ask your questions before proceeding.
Please ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this
webpage would not be available when you're carrying out the fix.

IT IS IMPORTANT THAT YOU DON'T MISS A STEP & PERFORM EVERYTHING IN THE RIGHT ORDER.

----------------------------------------

The fixes we will use are specific to your problems and should only be used for this issue on this machine.

Please only use this topic to reply to. Do not start another thread.
If any other issues arise let me know.

The process is not instant. Please continue to review my answers until I tell you your machine is clear.
Absence of symptoms does not mean that everything is clear. So lets do this to the end!

Please make every effort to reply to my posts in a timely manner. Malware breeds malware and the longer an infection remains on a system, the more
likely additional infections will result.

----------------------------------------

DOWNLOADS

CLEANUP! version 4.52 – TEMP FILE CLEANING

Please download Cleanup! and install it. You will use this later.

*NOTE* Cleanup deletes EVERYTHING out of temporary folders and does not make backups.

AVG Anti-Spyware 7.5

Please download AVG Anti-Spyware 7.5

Install AVG Anti-Spyware 7.5.
Double-click the icon on Desktop to launch AVG A-S 7.5
On the top of the main screen click Shield
Click the word active to change it to inactive
On the top of the main screen click Update.
Then click on Start Update. The update will start and a progress bar will show the updates being installed.
I also recommend changing the "Update interval" to something more reasonable like 12 hours.

ComboFix

1. Download this file - You MUST save it to your desktop

http://download.bleepingcomputer.com/sUBs/combofix.exe

or

http://www.techsupportforum.com/sectools/combofix.exe

Do not run it yet.

----------------------------------------

SAFE MODE RE-BOOT

Please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Use the up arrow key to highlight Safe Mode and press Enter.
5) Login with your usual account. Make sure to close any open browsers.

----------------------------------------

FIXES AND DELETIONS

Uninstall the following via the Add/Remove Panel (Start->(Settings)->Control Panel->Add/Remove Programs) if they exist:

VSToolbar

----------------------------------------

Open HijackThis and click on 'Do a System Scan Only'. Check the following entries (If they still exist, make sure you do not miss any)

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {1DAEFCB9-06C8-47c6-8F20-3FB54B244DAA} - C:\WINNT\system32\jsnuytbr.dll (file missing)
O3 - Toolbar: &VSToolBar - {821F87FF-8245-4972-9E28-732E92EC2F51} - C:\Program Files\VSToolbar\VSToolBar.dll
O20 - Winlogon Notify: winccf32 - winccf32.dll (file missing)

Please remember to close all other windows, including browsers then click Fix checked.

----------------------------------------

UNHIDE HIDDEN FILES

Go to My Computer->Tools->Folder Options->View tab:
* Under the Hidden files and folders heading, select Show hidden files and folders.
* Uncheck the Hide protected operating system files (recommended) option.
* Also make sure there is no checkmark beside Hide file extensions for known file types
* Click Yes to confirm and then click OK.

----------------------------------------
Delete the following Files indicated in RED and Folders indicated in BLUE if they still exist.

C:\Program Files\VSToolbar

----------------------------------------

RUNNING SCANNERS

Cleanup

Open Cleanup! by double-clicking the icon on your desktop (or from the Start > All Programs menu).
Set the program up as follows:

Click "Options..."
Move the arrow down to "Custom CleanUp!"
Put a check next to the following (Make sure nothing else is checked!):

Empty Recycle Bins
Delete Cookies
Delete Prefetch files (if present)
Cleanup! All Users
Click on the Temporary Files tab and uncheck the box for Scan drives for files matching if it’s checked.

Click OK
Press the CleanUp! button to start the program and DO NOT reboot when prompted.

AVG Anti-Spyware 7.5

Run AVG A-s with it's updated definitions: (...it's important that all windows must be closed)
This scan can take quite a while to run, so be prepared.
Click Scanner
Click on the Scan tab
Click Complete System Scan to begin scanning.
When the scan is complete click Recommended Action and change it to Quarantine.
Then click Apply all actions.

Note: DO NOT USE the computer while AVG A/S is scanning. If Explorer or the Control Panel are opened some malware types will
reinfect your system or will not be cleaned properly.

Once finished, click the Save report button, then click Save Report As and save it to your desktop.

----------------------------------------
SYSTEM RE-BOOT

Reboot into Normal Mode.

----------------------------------------

ON-LINE SCANS

Perform an online scan with Internet Explorer with Panda ActiveScan

Click on the "Free To Use ActiveScan" located on the top right hand corner

Click Check Now and a "pop up" window will appear. * Please ensure that your pop up blocker doesn't block it *
Enter your e-mail address, country, and state & click Scan Now * The download of the 8 MB Panda's ActiveX control will take place *

Begin the scan by selecting My Computer

If it finds any malware, it will offer you a report.

Please ignore any entry it finds and the offer to buy the program to remove the entry, as we will address this later.

Click on See report then click Save report

* You needn't remain online while it's doing the scan but you have to re-connect after it has finished to see the report.
* Turn off the real time scanner of any existing antivirus program while performing the online scan

----------------------------------------

ComboFix

2. Double click combofix.exe & follow the prompts.

3. When finished, it shall produce a log for you. Post that log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

----------------------------------------

FOLLOW-UP

Please return and post these items:

AVG A/S scan
Panda scan
ComboFix.txt
A new HJT log run in Normal Mode

Please note: In order to properly see what is on your system, all HJT logs must be run in the normal mode

Please let me know how your system is behaving.

Achmanage · 10-29-2006, 02:24 PM

OK! Lots of stuff but I did it all :D Here's the results:

---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 8:10:53 AM 10/29/2006

+ Scan result:

:mozilla.314:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.315:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.316:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.317:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.110:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.111:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.112:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.113:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.96:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
:mozilla.18:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Bfast : Cleaned.
:mozilla.283:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Bluestreak : Cleaned.
:mozilla.416:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Burstbeacon : Cleaned.
:mozilla.406:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.414:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.415:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.128:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.129:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.130:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.131:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.132:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.57:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
:mozilla.172:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.173:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.174:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.228:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.
:mozilla.432:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.433:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.75:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Mediaplex : Cleaned.
:mozilla.194:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.195:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.196:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.197:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.94:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.95:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.259:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.261:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.263:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.264:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.265:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.266:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.267:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.268:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.410:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.411:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.413:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.134:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.135:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.136:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.137:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.138:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.139:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.140:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.141:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.326:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.66:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.67:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.69:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.156:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.157:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.158:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.159:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.160:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.321:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Zedo : Cleaned.
:mozilla.322:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Zedo : Cleaned.
:mozilla.323:C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt -> TrackingCookie.Zedo : Cleaned.

::Report end

Panda Scan
Incident Status Location

Adware:adware/searchrelevancy Not disinfected c:\program files\SearchRelevant
Adware:adware/exact.bargainbuddy Not disinfected Windows Registry
Adware:adware/sqwire Not disinfected Windows Registry
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt[.realmedia.com/]
Spyware:Cookie/Maxserving Not disinfected C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt[.maxserving.com/]
Spyware:Cookie/DriveCleaner Not disinfected C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt[stats.drivecleaner.com/]
Spyware:Cookie/DriveCleaner Not disinfected C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt[.drivecleaner.com/]
Spyware:Cookie/DriveCleaner Not disinfected C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt[stats.drivecleaner.com/]
Spyware:Cookie/DriveCleaner Not disinfected C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt[.drivecleaner.com/]
Spyware:Cookie/DriveCleaner Not disinfected C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt[]DriveCleaner - Page not found
Spyware:Cookie/DriveCleaner Not disinfected C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt[stats.drivecleaner.com/]
Spyware:Cookie/DriveCleaner Not disinfected C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt[.drivecleaner.com/]
Spyware:Cookie/DriveCleaner Not disinfected C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt[]DriveCleaner - Page not found
Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt[.belnk.com/]
Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt[.go.com/]
Spyware:Cookie/Winantivirus Not disinfected C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt[.winantivirus.com/]
Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt[.atwola.com/]
Spyware:Cookie/FortuneCity Not disinfected C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt[.fortunecity.com/]
Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt[.xiti.com/]
Spyware:Cookie/Buzztone Not disinfected C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt[www.buzztone.com/]
Spyware:Cookie/Toplist Not disinfected C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt[.toplist.cz/]
Spyware:Cookie/Apmebf Not disinfected C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt[.apmebf.com/]
Spyware:Cookie/GoStats Not disinfected C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cookies.txt[.gostats.com/]
Adware:Adware/IST.ISTBar Not disinfected C:\Documents and Settings\Dwighty\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\javainstaller.jar-3cc46f89-404f4370.zip[javainstaller/InstallerApplet.class]
Adware:Adware/IST.ISTBar Not disinfected C:\Documents and Settings\Dwighty\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\javainstaller.jar-5ad1bcbe-335c20f7.zip[javainstaller/InstallerApplet.class]
Adware:Adware/SearchRelevancy Not disinfected C:\Program Files\SearchRelevant\uninstall.exe
Possible Virus. Not disinfected C:\Program Files\TrueLaunchBar\int\1029\Uninstall.exe[tlbref.exe]
Possible Virus. Not disinfected C:\Program Files\TrueLaunchBar\int\1031\Uninstall.exe[tlbref.exe]
Possible Virus. Not disinfected C:\Program Files\TrueLaunchBar\int\1036\Uninstall.exe[tlbref.exe]
Possible Virus. Not disinfected C:\Program Files\TrueLaunchBar\int\1038\Uninstall.exe[tlbref.exe]
Possible Virus. Not disinfected C:\Program Files\TrueLaunchBar\int\1040\Uninstall.exe[tlbref.exe]
Possible Virus. Not disinfected C:\Program Files\TrueLaunchBar\int\1043\Uninstall.exe[tlbref.exe]
Possible Virus. Not disinfected C:\Program Files\TrueLaunchBar\int\1045\Uninstall.exe[tlbref.exe]
Possible Virus. Not disinfected C:\Program Files\TrueLaunchBar\int\1049\Uninstall.exe[tlbref.exe]
Possible Virus. Not disinfected C:\Program Files\TrueLaunchBar\int\1053\Uninstall.exe[tlbref.exe]
Possible Virus. Not disinfected C:\Program Files\TrueLaunchBar\int\1058\Uninstall.exe[tlbref.exe]
Potentially unwanted tool:Application/VSToolbar Not disinfected C:\VundoFix Backups\rflnuwfd.exe.bad
Possible Virus. Not disinfected C:\VundoFix Backups\ssp.dll.bad
Potentially unwanted tool:Application/VSToolbar Not disinfected C:\WINNT\system32\xiabechx.exe

Combofix Report
Dwighty - 06-10-29 10:47:58.75 Service Pack 2
ComboFix 06.10.19 - Running from: "C:\Documents and Settings\Dwighty\Desktop"

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\WINNT\system32\winsys.exe
C:\Program Files\Common Files\{D00AC438-07D9-1033-0813-040311280001}

((((((((((((((((((((((((((((((( Files Created from 2006-09-29 to 2006-10-29 ))))))))))))))))))))))))))))))))))

2006-10-20 10:20 3,968 --a------ C:\WINNT\system32\drivers\AvgAsCln.sys
2006-10-20 10:18 816,288 --a------ C:\WINNT\system32\drivers\avg7core.sys
2006-10-20 10:18 4,960 --a------ C:\WINNT\system32\drivers\avgtdi.sys
2006-10-20 10:18 4,224 --a------ C:\WINNT\system32\drivers\avg7rsw.sys
2006-10-20 10:18 3,968 --a------ C:\WINNT\system32\drivers\avgclean.sys
2006-10-20 10:18 28,416 --a------ C:\WINNT\system32\drivers\avg7rsxp.sys
2006-10-20 09:59 67,604 --a------ C:\WINNT\system32\xiabechx.exe

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2006-10-29 10:48 -------- d-a------ C:\Program Files\Common Files
2006-10-29 08:40 -------- d-a------ C:\Program Files\Symantec AntiVirus
2006-10-29 08:40 -------- d-------- C:\Program Files\QuickTime
2006-10-29 08:37 -------- d-a------ C:\Program Files\Internet Explorer
2006-10-29 08:37 -------- d-a------ C:\Program Files\Google
2006-10-29 08:37 -------- d-a------ C:\Program Files\Common Files\Symantec Shared
2006-10-29 08:37 -------- d-a------ C:\Program Files\Common Files\Raxco
2006-10-29 01:18 -------- d-------- C:\Program Files\CleanUp!
2006-10-24 09:21 -------- d-------- C:\Program Files\MetaStream
2006-10-24 09:20 -------- d-a------ C:\Program Files\Viewpoint
2006-10-21 08:52 -------- d-------- C:\Documents and Settings\Dwighty\Application Data\AVG7
2006-10-20 12:20 -------- d-------- C:\Program Files\SearchRelevant
2006-10-20 10:18 -------- d-------- C:\Program Files\Grisoft
2006-10-20 10:00 -------- d-------- C:\Documents and Settings\Dwighty\Application Data\SearchToolbarCorp
2006-09-15 21:09 -------- d--h----- C:\Program Files\InstallShield Installation Information
2006-08-21 07:21 16896 --a------ C:\WINNT\system32\fltlib.dll
2006-08-21 04:14 23040 --a------ C:\WINNT\system32\fltmc.exe
2006-08-16 16:55 208896 --a--c--- C:\WINNT\system32\nvusmb.exe
2006-08-16 16:55 208896 --a--c--- C:\WINNT\system32\nvunrm.exe
2006-08-16 16:55 208896 --a--c--- C:\WINNT\system32\NVUNINST.EXE
2006-08-16 16:55 208896 --a--c--- C:\WINNT\system32\nvuide.exe
2006-08-16 16:55 208896 --a--c--- C:\WINNT\system32\nvugart.exe
2006-08-16 16:55 208896 --a--c--- C:\WINNT\system32\nvuaudio.exe
2006-08-16 16:55 208896 --a------ C:\WINNT\system32\nvudisp.exe
2006-08-11 20:45 888832 --a------ C:\WINNT\system32\nvmobls.dll
2006-08-11 20:45 581632 --a------ C:\WINNT\system32\nvhwvid.dll
2006-08-11 20:45 5611520 --a------ C:\WINNT\system32\nvdisps.dll
2006-08-11 20:45 5251072 --a------ C:\WINNT\system32\nvdispsr.dll
2006-08-11 20:45 458752 --a------ C:\WINNT\system32\nvmccssr.dll
2006-08-11 20:45 45056 --a------ C:\WINNT\system32\nvmccsrs.dll
2006-08-11 20:45 3039232 --a------ C:\WINNT\system32\nvgames.dll
2006-08-11 20:45 2953216 --a------ C:\WINNT\system32\nvvitvsr.dll
2006-08-11 20:45 2928640 --a------ C:\WINNT\system32\nvgamesr.dll
2006-08-11 20:45 2904064 --a------ C:\WINNT\system32\nvvitvs.dll
2006-08-11 20:45 2859008 --a------ C:\WINNT\system32\nvmoblsr.dll
2006-08-11 20:45 229376 --a------ C:\WINNT\system32\nvmccs.dll
2006-08-11 20:45 188416 --a------ C:\WINNT\system32\nvmccss.dll
2006-08-11 20:45 1732608 --a------ C:\WINNT\system32\nvwssr.dll
2006-08-11 20:45 1236992 --a------ C:\WINNT\system32\nvwss.dll
2006-08-11 20:44 147456 --a------ C:\WINNT\system32\nvcolor.exe
2006-08-11 20:43 86016 --a------ C:\WINNT\system32\nvmctray.dll
2006-08-11 20:43 81920 --a------ C:\WINNT\system32\nvwddi.dll
2006-08-11 20:43 794624 --a------ C:\WINNT\system32\nvcplui.exe
2006-08-11 20:43 7630848 --a------ C:\WINNT\system32\nvcpl.dll
2006-08-11 20:43 466944 --a------ C:\WINNT\system32\nvshell.dll
2006-08-11 20:43 442368 --a------ C:\WINNT\system32\nvappbar.exe
2006-08-11 20:43 425984 --a------ C:\WINNT\system32\keystone.exe
2006-08-11 20:43 311296 --a------ C:\WINNT\system32\nvexpbar.dll
2006-08-11 20:43 286720 --a------ C:\WINNT\system32\nvnt4cpl.dll
2006-08-11 20:43 196608 --a------ C:\WINNT\system32\nvapi.dll
2006-08-11 20:43 1662976 --a------ C:\WINNT\system32\nvwdmcpl.dll
2006-08-11 20:43 1519616 --a------ C:\WINNT\system32\nwiz.exe
2006-08-11 20:43 1470464 --a------ C:\WINNT\system32\nview.dll
2006-08-11 20:43 1339392 --a------ C:\WINNT\system32\nvdspsch.exe
2006-08-11 20:43 1019904 --a------ C:\WINNT\system32\nvwimg.dll
2006-08-11 20:43 1011712 --a------ C:\WINNT\system32\nvcpluir.dll
2006-08-11 20:42 5636096 --a------ C:\WINNT\system32\nvoglnt.dll
2006-08-11 20:42 4496128 --a------ C:\WINNT\system32\nv4_disp.dll
2006-08-11 20:42 35840 --a------ C:\WINNT\system32\nvcodins.dll
2006-08-11 20:42 35840 --a------ C:\WINNT\system32\nvcod.dll
2006-08-11 20:42 155715 --a------ C:\WINNT\system32\nvsvc32.exe

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"ctfmon.exe"="C:\\WINNT\\system32\\ctfmon.exe"
"Yahoo! Pager"="C:\\Program Files\\Yahoo!\\Messenger\\ypager.exe -quiet"
"H/PC Connection Agent"="\"E:\\PROGRA~1\\MICROS~2\\wcescomm.exe\""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"NeroFilterCheck"="C:\\WINNT\\system32\\NeroCheck.exe"
"IndexSearch"="C:\\Program Files\\ScanSoft\\PaperPort\\IndexSearch.exe"
"ControlCenter2.0"="C:\\Program Files\\Brother\\ControlCenter2\\brctrcen.exe /autorun"
"SetDefPrt"="C:\\Program Files\\Brother\\Brmfl04b\\BrStDvPt.exe"
"ATICCC"="\"C:\\Program Files\\ATI Technologies\\ATI.ACE\\cli.exe\" runtime -Delay"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"NVRaidService"="C:\\WINNT\\system32\\nvraidservice.exe"
"SoundMan"="SOUNDMAN.EXE"
"NvCplDaemon"="RUNDLL32.EXE C:\\WINNT\\system32\\NvCpl.dll,NvStartup"
"SW20"="C:\\WINNT\\system32\\sw20.exe"
"SW24"="C:\\WINNT\\system32\\sw24.exe"
"nwiz"="nwiz.exe /install"
"NvMediaCenter"="RUNDLL32.EXE C:\\WINNT\\system32\\NvMcTray.dll,NvTaskbarInit"
"AVG7_CC"="D:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe /STARTUP"
"!AVG Anti-Spyware"="\"D:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonceex]
"Flag"=dword:00000002

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000004

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,00,01,00,00,00,00,00,00,00,04,00,00,e2,03,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,c0
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,f0,01,00,00,1f,00,00,00,80,00,00,00,76,00,\
00,00,01,00,00,00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"AVG7_Run"="D:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"="C:\\Program Files\\Internet Explorer\\Connection Wizard\\icwconn1.exe /desktop"
"tscuninstall"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,65,6d,\
33,32,5c,74,73,63,75,70,67,72,64,2e,65,78,65,00

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"AVG7_Run"="D:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"="C:\\Program Files\\Internet Explorer\\Connection Wizard\\icwconn1.exe /desktop"
"tscuninstall"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,65,6d,\
33,32,5c,74,73,63,75,70,67,72,64,2e,65,78,65,00

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
"CDRAutoRun"=dword:00000000

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:000000b5

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"UPnPMonitor"="{e57ce738-33e8-4c51-8354-bb4de9d215d1}"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Yahoo! Pager"="C:\\Program Files\\Yahoo!\\Messenger\\ypager.exe -quiet"
"msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background"
"SpybotSD TeaTimer"="C:\\Program Files\\Spybot - Search & Destroy\\TeaTimer.exe"
"ctfmon.exe"="C:\\WINNT\\system32\\ctfmon.exe"
"Skype"="\"D:\\Program Files\\Skype\\Phone\\Skype.exe\" /nosplash /minimized"
"MySpaceIM"="C:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"ATIPTA"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe"
"BullsEye Network"="C:\\Program Files\\BullsEye Network\\bin\\bargains.exe"
"CloneCDElbyCDFL"="\"D:\\Program Files\\Elaborate Bytes\\CloneCD\\ElbyCheck.exe\" /L ElbyCDFL"
"WinampAgent"="D:\\Program Files\\Winamp\\winampa.exe"
"NVRaidService"="C:\\WINNT\\System32\\nvraidservice.exe"
"SunJavaUpdateSched"="C:\\Program Files\\Java\\j2re1.4.2_05\\bin\\jusched.exe"
"vptray"="C:\\PROGRA~1\\SYMANT~1\\VPTray.exe"
"Zone Labs Client"="\"D:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe\""
"BearShare"="\"C:\\Program Files\\BearShare\\BearShare.exe\" /pause"
"TkBellExe"="\"D:\\Program Files\\Real Alternative\\Update_OB\\realsched.exe\" -osboot"
"WinFast Schedule"="E:\\Program Files\\WinFast\\WFTVFM\\WFWIZ.exe"
"Tweak UI"="RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp"
"Synchronization Manager"="mobsync.exe /logon"
"KernelFaultCheck"="%systemroot%\\system32\\dumprep 0 -k"
"SSBkgdUpdate"="\"C:\\Program Files\\Common Files\\Scansoft Shared\\SSBkgdUpdate\\SSBkgdupdate.exe\" -Embedding -boot"
"SoundMan"="SOUNDMAN.EXE"
"PaperPort PTD"="C:\\Program Files\\ScanSoft\\PaperPort\\pptd40nt.exe"
"iTunesHelper"="\"E:\\Program Files\\iTunes\\iTunesHelper.exe\""
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"nwiz"="nwiz.exe /install"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^DOCUME~1^ALLUSE~1^Start Menu^Programs^Startup^Microsoft Office.lnk.disabled]
"path"="C:\\DOCUME~1\\ALLUSE~1\\Start Menu\\Programs\\Startup\\Microsoft Office.lnk.disabled"
"backup"="C:\\WINNT\\pss\\Microsoft Office.lnk.disabledCommon Startup"
"location"="Common Startup"
"command"="C:\\DOCUME~1\\ALLUSE~1\\Start Menu\\Programs\\Startup\\Microsoft Office.lnk.disabled"
"item"="Microsoft Office.lnk"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

~ ~ ~ ~ ~ ~ ~ ~ Hijackthis Backups ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

backup-20061029-012826-473
O20 - Winlogon Notify: winccf32 - winccf32.dll (file missing)
backup-20061029-012826-381
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
backup-20061029-012826-298
O2 - BHO: (no name) - {1DAEFCB9-06C8-47c6-8F20-3FB54B244DAA} - C:\WINNT\system32\jsnuytbr.dll (file missing)
Completion time: 06-10-29 10:48:58.68
C:\ComboFix.txt ... 06-10-29 10:48

Logfile of HijackThis v1.99.1
Scan saved at 4:22:12 PM, on 10/29/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\brsvc01a.exe
C:\WINNT\system32\brss01a.exe
C:\WINNT\system32\spoolsv.exe
D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINNT\system32\Brmfrmps.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINNT\system32\mspmspsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
D:\Program Files\Raxco\PerfectDisk\PDSched.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINNT\system32\wuauclt.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINNT\system32\nvraidservice.exe
C:\WINNT\SOUNDMAN.EXE
C:\WINNT\system32\RUNDLL32.EXE
D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINNT\system32\ctfmon.exe
E:\PROGRA~1\MICROS~2\wcescomm.exe
C:\WINNT\System32\svchost.exe
E:\PROGRA~1\MICROS~2\rapimgr.exe
C:\WINNT\system32\wbem\unsecapp.exe
D:\Program Files\D-Link AirPlus\AIRPLUS.EXE
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
D:\Program Files\Mozilla Firefox\firefox.exe
C:\HJT\manage.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {FEC84C2A-9614-4290-B2BB-6447D92B884B} - C:\WINNT\Drivers\ssp.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl04b\BrStDvPt.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NVRaidService] C:\WINNT\system32\nvraidservice.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SW20] C:\WINNT\system32\sw20.exe
O4 - HKLM\..\Run: [SW24] C:\WINNT\system32\sw24.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG7_CC] D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [H/PC Connection Agent] "E:\PROGRA~1\MICROS~2\wcescomm.exe"
O4 - Startup: BitTorrent.lnk.disabled
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: D-Link AirPlus Utility.lnk = D:\Program Files\D-Link AirPlus\AIRPLUS.EXE
O4 - Global Startup: Microsoft Office.lnk = E:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Status Monitor.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - E:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - E:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - E:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Dwighty\Start Menu\Programs\IMVU\Run IMVU.lnk
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O15 - Trusted Zone: http://aimexpress.aim.com
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O20 - Winlogon Notify: NavLogon - C:\WINNT\system32\NavLogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINNT\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Brother Popup Suspend service for Resource manager (brmfrmps) - Unknown owner - C:\WINNT\system32\Brmfrmps.exe" -service (file missing)
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINNT\system32\brsvc01a.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
O23 - Service: PDEngine - Raxco Software, Inc. - D:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: PDScheduler (PDSched) - Raxco Software, Inc. - D:\Program Files\Raxco\PerfectDisk\PDSched.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

I didn't realize that AVG was already set to "Delete" until it showed the action taken after the report was made. I set to Quarantine but I think it was a little too late for that. I hope that's not a big problem :(

Let me know if I'm missing anything. And thank you so much!

fredmh · 10-29-2006, 09:41 PM

You should have a ComboFix2.txt Could you please post that.

Deleting from AVG is not a problem.

Achmanage · 10-30-2006, 05:53 PM

ComboFix2.txt showed this:

Dwighty - 06-10-29 10:47:58.75 Service Pack 2
ComboFix 06.10.19 - Running from: "C:\Documents and Settings\Dwighty\Desktop"

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\WINNT\system32\winsys.exe
C:\Program Files\Common Files\{D00AC438-07D9-1033-0813-040311280001}

((((((((((((((((((((((((((((((( Files Created from 2006-09-29 to 2006-10-29 ))))))))))))))))))))))))))))))))))

2006-10-20 10:20 3,968 --a------ C:\WINNT\system32\drivers\AvgAsCln.sys
2006-10-20 10:18 816,288 --a------ C:\WINNT\system32\drivers\avg7core.sys
2006-10-20 10:18 4,960 --a------ C:\WINNT\system32\drivers\avgtdi.sys
2006-10-20 10:18 4,224 --a------ C:\WINNT\system32\drivers\avg7rsw.sys
2006-10-20 10:18 3,968 --a------ C:\WINNT\system32\drivers\avgclean.sys
2006-10-20 10:18 28,416 --a------ C:\WINNT\system32\drivers\avg7rsxp.sys
2006-10-20 09:59 67,604 --a------ C:\WINNT\system32\xiabechx.exe

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2006-10-29 10:48 -------- d-a------ C:\Program Files\Common Files
2006-10-29 08:40 -------- d-a------ C:\Program Files\Symantec AntiVirus
2006-10-29 08:40 -------- d-------- C:\Program Files\QuickTime
2006-10-29 08:37 -------- d-a------ C:\Program Files\Internet Explorer
2006-10-29 08:37 -------- d-a------ C:\Program Files\Google
2006-10-29 08:37 -------- d-a------ C:\Program Files\Common Files\Symantec Shared
2006-10-29 08:37 -------- d-a------ C:\Program Files\Common Files\Raxco
2006-10-29 01:18 -------- d-------- C:\Program Files\CleanUp!
2006-10-24 09:21 -------- d-------- C:\Program Files\MetaStream
2006-10-24 09:20 -------- d-a------ C:\Program Files\Viewpoint
2006-10-21 08:52 -------- d-------- C:\Documents and Settings\Dwighty\Application Data\AVG7
2006-10-20 12:20 -------- d-------- C:\Program Files\SearchRelevant
2006-10-20 10:18 -------- d-------- C:\Program Files\Grisoft
2006-10-20 10:00 -------- d-------- C:\Documents and Settings\Dwighty\Application Data\SearchToolbarCorp
2006-09-15 21:09 -------- d--h----- C:\Program Files\InstallShield Installation Information
2006-08-21 07:21 16896 --a------ C:\WINNT\system32\fltlib.dll
2006-08-21 04:14 23040 --a------ C:\WINNT\system32\fltmc.exe
2006-08-16 16:55 208896 --a--c--- C:\WINNT\system32\nvusmb.exe
2006-08-16 16:55 208896 --a--c--- C:\WINNT\system32\nvunrm.exe
2006-08-16 16:55 208896 --a--c--- C:\WINNT\system32\NVUNINST.EXE
2006-08-16 16:55 208896 --a--c--- C:\WINNT\system32\nvuide.exe
2006-08-16 16:55 208896 --a--c--- C:\WINNT\system32\nvugart.exe
2006-08-16 16:55 208896 --a--c--- C:\WINNT\system32\nvuaudio.exe
2006-08-16 16:55 208896 --a------ C:\WINNT\system32\nvudisp.exe
2006-08-11 20:45 888832 --a------ C:\WINNT\system32\nvmobls.dll
2006-08-11 20:45 581632 --a------ C:\WINNT\system32\nvhwvid.dll
2006-08-11 20:45 5611520 --a------ C:\WINNT\system32\nvdisps.dll
2006-08-11 20:45 5251072 --a------ C:\WINNT\system32\nvdispsr.dll
2006-08-11 20:45 458752 --a------ C:\WINNT\system32\nvmccssr.dll
2006-08-11 20:45 45056 --a------ C:\WINNT\system32\nvmccsrs.dll
2006-08-11 20:45 3039232 --a------ C:\WINNT\system32\nvgames.dll
2006-08-11 20:45 2953216 --a------ C:\WINNT\system32\nvvitvsr.dll
2006-08-11 20:45 2928640 --a------ C:\WINNT\system32\nvgamesr.dll
2006-08-11 20:45 2904064 --a------ C:\WINNT\system32\nvvitvs.dll
2006-08-11 20:45 2859008 --a------ C:\WINNT\system32\nvmoblsr.dll
2006-08-11 20:45 229376 --a------ C:\WINNT\system32\nvmccs.dll
2006-08-11 20:45 188416 --a------ C:\WINNT\system32\nvmccss.dll
2006-08-11 20:45 1732608 --a------ C:\WINNT\system32\nvwssr.dll
2006-08-11 20:45 1236992 --a------ C:\WINNT\system32\nvwss.dll
2006-08-11 20:44 147456 --a------ C:\WINNT\system32\nvcolor.exe
2006-08-11 20:43 86016 --a------ C:\WINNT\system32\nvmctray.dll
2006-08-11 20:43 81920 --a------ C:\WINNT\system32\nvwddi.dll
2006-08-11 20:43 794624 --a------ C:\WINNT\system32\nvcplui.exe
2006-08-11 20:43 7630848 --a------ C:\WINNT\system32\nvcpl.dll
2006-08-11 20:43 466944 --a------ C:\WINNT\system32\nvshell.dll
2006-08-11 20:43 442368 --a------ C:\WINNT\system32\nvappbar.exe
2006-08-11 20:43 425984 --a------ C:\WINNT\system32\keystone.exe
2006-08-11 20:43 311296 --a------ C:\WINNT\system32\nvexpbar.dll
2006-08-11 20:43 286720 --a------ C:\WINNT\system32\nvnt4cpl.dll
2006-08-11 20:43 196608 --a------ C:\WINNT\system32\nvapi.dll
2006-08-11 20:43 1662976 --a------ C:\WINNT\system32\nvwdmcpl.dll
2006-08-11 20:43 1519616 --a------ C:\WINNT\system32\nwiz.exe
2006-08-11 20:43 1470464 --a------ C:\WINNT\system32\nview.dll
2006-08-11 20:43 1339392 --a------ C:\WINNT\system32\nvdspsch.exe
2006-08-11 20:43 1019904 --a------ C:\WINNT\system32\nvwimg.dll
2006-08-11 20:43 1011712 --a------ C:\WINNT\system32\nvcpluir.dll
2006-08-11 20:42 5636096 --a------ C:\WINNT\system32\nvoglnt.dll
2006-08-11 20:42 4496128 --a------ C:\WINNT\system32\nv4_disp.dll
2006-08-11 20:42 35840 --a------ C:\WINNT\system32\nvcodins.dll
2006-08-11 20:42 35840 --a------ C:\WINNT\system32\nvcod.dll
2006-08-11 20:42 155715 --a------ C:\WINNT\system32\nvsvc32.exe

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"ctfmon.exe"="C:\\WINNT\\system32\\ctfmon.exe"
"Yahoo! Pager"="C:\\Program Files\\Yahoo!\\Messenger\\ypager.exe -quiet"
"H/PC Connection Agent"="\"E:\\PROGRA~1\\MICROS~2\\wcescomm.exe\""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"NeroFilterCheck"="C:\\WINNT\\system32\\NeroCheck.exe"
"IndexSearch"="C:\\Program Files\\ScanSoft\\PaperPort\\IndexSearch.exe"
"ControlCenter2.0"="C:\\Program Files\\Brother\\ControlCenter2\\brctrcen.exe /autorun"
"SetDefPrt"="C:\\Program Files\\Brother\\Brmfl04b\\BrStDvPt.exe"
"ATICCC"="\"C:\\Program Files\\ATI Technologies\\ATI.ACE\\cli.exe\" runtime -Delay"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"NVRaidService"="C:\\WINNT\\system32\\nvraidservice.exe"
"SoundMan"="SOUNDMAN.EXE"
"NvCplDaemon"="RUNDLL32.EXE C:\\WINNT\\system32\\NvCpl.dll,NvStartup"
"SW20"="C:\\WINNT\\system32\\sw20.exe"
"SW24"="C:\\WINNT\\system32\\sw24.exe"
"nwiz"="nwiz.exe /install"
"NvMediaCenter"="RUNDLL32.EXE C:\\WINNT\\system32\\NvMcTray.dll,NvTaskbarInit"
"AVG7_CC"="D:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe /STARTUP"
"!AVG Anti-Spyware"="\"D:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonceex]
"Flag"=dword:00000002

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000004

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,00,01,00,00,00,00,00,00,00,04,00,00,e2,03,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,c0
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,f0,01,00,00,1f,00,00,00,80,00,00,00,76,00,\
00,00,01,00,00,00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"AVG7_Run"="D:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"="C:\\Program Files\\Internet Explorer\\Connection Wizard\\icwconn1.exe /desktop"
"tscuninstall"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,65,6d,\
33,32,5c,74,73,63,75,70,67,72,64,2e,65,78,65,00

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"AVG7_Run"="D:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"="C:\\Program Files\\Internet Explorer\\Connection Wizard\\icwconn1.exe /desktop"
"tscuninstall"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,65,6d,\
33,32,5c,74,73,63,75,70,67,72,64,2e,65,78,65,00

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
"CDRAutoRun"=dword:00000000

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:000000b5

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"UPnPMonitor"="{e57ce738-33e8-4c51-8354-bb4de9d215d1}"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Yahoo! Pager"="C:\\Program Files\\Yahoo!\\Messenger\\ypager.exe -quiet"
"msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background"
"SpybotSD TeaTimer"="C:\\Program Files\\Spybot - Search & Destroy\\TeaTimer.exe"
"ctfmon.exe"="C:\\WINNT\\system32\\ctfmon.exe"
"Skype"="\"D:\\Program Files\\Skype\\Phone\\Skype.exe\" /nosplash /minimized"
"MySpaceIM"="C:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"ATIPTA"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe"
"BullsEye Network"="C:\\Program Files\\BullsEye Network\\bin\\bargains.exe"
"CloneCDElbyCDFL"="\"D:\\Program Files\\Elaborate Bytes\\CloneCD\\ElbyCheck.exe\" /L ElbyCDFL"
"WinampAgent"="D:\\Program Files\\Winamp\\winampa.exe"
"NVRaidService"="C:\\WINNT\\System32\\nvraidservice.exe"
"SunJavaUpdateSched"="C:\\Program Files\\Java\\j2re1.4.2_05\\bin\\jusched.exe"
"vptray"="C:\\PROGRA~1\\SYMANT~1\\VPTray.exe"
"Zone Labs Client"="\"D:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe\""
"BearShare"="\"C:\\Program Files\\BearShare\\BearShare.exe\" /pause"
"TkBellExe"="\"D:\\Program Files\\Real Alternative\\Update_OB\\realsched.exe\" -osboot"
"WinFast Schedule"="E:\\Program Files\\WinFast\\WFTVFM\\WFWIZ.exe"
"Tweak UI"="RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp"
"Synchronization Manager"="mobsync.exe /logon"
"KernelFaultCheck"="%systemroot%\\system32\\dumprep 0 -k"
"SSBkgdUpdate"="\"C:\\Program Files\\Common Files\\Scansoft Shared\\SSBkgdUpdate\\SSBkgdupdate.exe\" -Embedding -boot"
"SoundMan"="SOUNDMAN.EXE"
"PaperPort PTD"="C:\\Program Files\\ScanSoft\\PaperPort\\pptd40nt.exe"
"iTunesHelper"="\"E:\\Program Files\\iTunes\\iTunesHelper.exe\""
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"nwiz"="nwiz.exe /install"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^DOCUME~1^ALLUSE~1^Start Menu^Programs^Startup^Microsoft Office.lnk.disabled]
"path"="C:\\DOCUME~1\\ALLUSE~1\\Start Menu\\Programs\\Startup\\Microsoft Office.lnk.disabled"
"backup"="C:\\WINNT\\pss\\Microsoft Office.lnk.disabledCommon Startup"
"location"="Common Startup"
"command"="C:\\DOCUME~1\\ALLUSE~1\\Start Menu\\Programs\\Startup\\Microsoft Office.lnk.disabled"
"item"="Microsoft Office.lnk"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

~ ~ ~ ~ ~ ~ ~ ~ Hijackthis Backups ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

backup-20061029-012826-473
O20 - Winlogon Notify: winccf32 - winccf32.dll (file missing)
backup-20061029-012826-381
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
backup-20061029-012826-298
O2 - BHO: (no name) - {1DAEFCB9-06C8-47c6-8F20-3FB54B244DAA} - C:\WINNT\system32\jsnuytbr.dll (file missing)
Completion time: 06-10-29 10:48:58.68
C:\ComboFix.txt ... 06-10-29 10:48

fredmh · 10-30-2006, 09:33 PM

Please read this post completely before begining the fix. If there's anything that you do not understand, kindly ask your questions before proceeding.
Please ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this
webpage would not be available when you're carrying out the fix.

IT IS IMPORTANT THAT YOU DON'T MISS A STEP & PERFORM EVERYTHING IN THE RIGHT ORDER.

----------------------------------------

P2P - I see you have P2P software installed on your machine. We are not here to pass judgment on file-sharing as a concept.
However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more
susceptible to re-infections. It may be contributing to your current situation. This page will give you further information.

These programs are:

Bear Share
BitTorrent

----------------------------------------

Please submit the following file to Jotti File Scan

C:\Program Files\TrueLaunchBar\int

At the top of the window you should see "File to Upload & Scan" and a blank box. Copy and paste the red text from above into the box.
Then click "submit".

When it is finished, please copy and paste the information listed under "Service" and "Scanner Results" back in this thread.

----------------------------------------

DOWNLOADS

Download the attached ach.zip file at the bottom of this post to your desktop. Double click on the zip folder,
then double click on the .reg file within.
Click yes to allow it to merge into your registry.

ISTBAR REMOVAL TOOL

Please download the ISTBar removal tool
from Symantec into it's own folder. Do not run it yet.

Run the ISTBar removal Tool.

----------------------------------------

SAFE MODE RE-BOOT

Please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Use the up arrow key to highlight Safe Mode and press Enter.
5) Login with your usual account. Make sure to close any open browsers.

----------------------------------------

FIXES AND DELETIONS

Open HijackThis and click on 'Do a System Scan Only'. Check the following entries (If they still exist, make sure you do not miss any)

O2 - BHO: (no name) - {FEC84C2A-9614-4290-B2BB-6447D92B884B} - C:\WINNT\Drivers\ssp.dll (file missing)

Please remember to close all other windows, including browsers then click Fix checked.

----------------------------------------

UNHIDE HIDDEN FILES

Go to My Computer->Tools->Folder Options->View tab:
* Under the Hidden files and folders heading, select Show hidden files and folders.
* Uncheck the Hide protected operating system files (recommended) option.
* Also make sure there is no checkmark beside Hide file extensions for known file types
* Click Yes to confirm and then click OK.

----------------------------------------
Delete the following Files indicated in RED and Folders indicated in BLUE if they still exist.

C:\VundoFix Backups

C:\Program Files\Viewpoint
c:\program files\SearchRelevant

C:\Documents and Settings\Dwighty\Application Data\SearchToolbarCorp

----------------------------------------
SYSTEM RE-BOOT

Reboot into Normal Mode.

----------------------------------------

CLEAR JAVA CACHE

See this page for instructions on how to clear java's cache.

Go into the Control Panel and double-click the Java Icon. (looks like a coffee cup

)

Under Temporary Internet Files, click the Delete Files button.
There are three options in the window to clear the cache - Leave ALL 3 Checked
- Downloaded Applets
  Downloaded Applications
  Other Files
Click OK on Delete Temporary Files Window
Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
Click OK to leave the Java Control Panel.

----------------------------------------

Clear Firefox' Cookies

Open Firefox.
Click Tools » Options.
Click the Privacy tab, then the Cookies tab.
Click the Clear Cookies Now button.
Then click OK to exit.

----------------------------------------

ON-LINE SCANS

Kaspersky - Extended

Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner

Answer Yes, when prompted to install an ActiveX component.

The program will then begin downloading the latest definition files.
Once the files have been downloaded click on NEXT
Locate the Scan Settings button & configure to:
- Scan using the following Anti-Virus database:
  - Extended
- Scan Options:
  - Scan Archives
  - Scan Mail Bases
Click OK & have it scan My Computer
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect.
We only require a report from it.
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

* Turn off the real time scanner of any existing antivirus program while performing the online scan

----------------------------------------

FOLLOW-UP

Please return and post these items:

Jotti scan
Kaspersky scan
A new HJT log run in Normal Mode

Please note: In order to properly see what is on your system, all HJT logs must be run in the normal mode

Please let me know how your system is behaving.

Achmanage · 10-31-2006, 06:25 AM

All righty, first off I ran the jotti scan and it said the file was 0 bytes and that it could be a firewall or mal-ware. I am plugged into a Linksys router with built-in firewall but I wasn't feeling that was the issue (still it could be). I did a manual navigation to the file through the "browse" option and found that the "int" isn't a file at all, but a folder. And the scanner doesn't allow selecting a folder so I'm not sure if that's what's really the case.

Here's what Kaspersky picked up:

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Tuesday, October 31, 2006 8:18:14 AM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 31/10/2006
Kaspersky Anti-Virus database records: 236519
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\
F:\
G:\

Scan Statistics:
Total number of scanned objects: 126250
Number of viruses found: 29
Number of infected objects: 155 / 0
Number of suspicious objects: 8
Duration of the scan process: 02:01:59

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\AVG7\Log\emc.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy1.zip/msexreg.exe Suspicious: Password-protected-EXE skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy1.zip ZIP: suspicious - 1 skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy18.zip/msexreg.exe Suspicious: Password-protected-EXE skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy18.zip ZIP: suspicious - 1 skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy35.zip/msexreg.exe Suspicious: Password-protected-EXE skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy35.zip ZIP: suspicious - 1 skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy53.zip/msexreg.exe Suspicious: Password-protected-EXE skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy53.zip ZIP: suspicious - 1 skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\00A40000.VBN Infected: Trojan.Win32.BHO.g skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\00A40001.VBN Infected: Trojan.Win32.BHO.g skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\00A40002.VBN Infected: Packed.Win32.Klone.k skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\00A40003.VBN Infected: Trojan-Downloader.JS.Agent.ab skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\00A40004.VBN Infected: Exploit.HTML.IESlice.c skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\00A40005.VBN Infected: Trojan-Downloader.Win32.Agent.acd skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\00A40006.VBN Infected: Packed.Win32.Klone.k skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\00A40007.VBN Infected: Packed.Win32.Klone.k skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\00A40008.VBN Infected: Packed.Win32.Klone.k skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\00A40009.VBN Infected: Packed.Win32.Klone.k skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\00A4000A.VBN Infected: Trojan.Win32.BHO.g skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\00A4000B.VBN Infected: Trojan.Win32.BHO.g skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\00A4000C.VBN Infected: Packed.Win32.Klone.k skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\00B00000.VBN Infected: Packed.Win32.Klone.k skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\01700000.VBN/Planetarion-calc.exe Infected: Backdoor.Win32.SubSeven.213.bonus skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\01700000.VBN ZIP: infected - 1 skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\01700000.VBN CryptZ: infected - 1 skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\01700001.VBN/Planetarion-calc.exe Infected: Backdoor.Win32.SubSeven.213.bonus skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\01700001.VBN ZIP: infected - 1 skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\01700001.VBN CryptZ: infected - 1 skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04080000.VBN/Counter.class Infected: Trojan.Java.ClassLoader.h skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04080000.VBN/Matrix.class Infected: Trojan-Downloader.Java.OpenConnection.ad skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04080000.VBN/Parser.class Infected: Trojan.Java.ClassLoader.d skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04080000.VBN ZIP: infected - 3 skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04080000.VBN CryptZ: infected - 3 skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04080001.VBN/Counter.class Infected: Trojan.Java.ClassLoader.h skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04080001.VBN/Matrix.class Infected: Trojan-Downloader.Java.OpenConnection.ad skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04080001.VBN/Parser.class Infected: Trojan.Java.ClassLoader.d skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04080001.VBN ZIP: infected - 3 skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04080001.VBN CryptZ: infected - 3 skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04080002.VBN/Matrix.class Infected: Trojan-Downloader.Java.OpenStream.c skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04080002.VBN/Counter.class Infected: Trojan.Java.ClassLoader.h skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04080002.VBN/Parser.class Infected: Trojan.Java.ClassLoader.d skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04080002.VBN ZIP: infected - 3 skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04080002.VBN CryptZ: infected - 3 skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04080003.VBN/Matrix.class Infected: Trojan-Downloader.Java.OpenStream.c skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04080003.VBN/Counter.class Infected: Trojan.Java.ClassLoader.h skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04080003.VBN/Parser.class Infected: Trojan.Java.ClassLoader.d skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04080003.VBN ZIP: infected - 3 skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04080003.VBN CryptZ: infected - 3 skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\043C0000.VBN Infected: Packed.Win32.Klone.g skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04600000.VBN Infected: Trojan.Win32.BHO.g skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\049C0000.VBN Infected: Trojan-Downloader.Win32.Small.dod skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05340000.VBN Infected: Trojan-Downloader.Java.OpenStream.w skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05340001.VBN Infected: Trojan-Downloader.Java.OpenStream.w skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05340002.VBN Infected: Trojan-Downloader.Java.OpenStream.w skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05340003.VBN Infected: Trojan-Downloader.Java.OpenStream.w skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05340004.VBN Infected: Trojan-Downloader.Java.OpenStream.w skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05340005.VBN Infected: Trojan-Downloader.Java.OpenStream.w skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05EC0000.VBN Infected: Trojan-Downloader.Java.OpenStream.w skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05EC0001.VBN Infected: Trojan-Downloader.Java.OpenStream.w skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\06140000.VBN Infected: Packed.Win32.Klone.g skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\06440000.VBN/Planetarion-calc.exe Infected: Backdoor.Win32.SubSeven.213.bonus skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\06440000.VBN ZIP: infected - 1 skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\06440000.VBN CryptZ: infected - 1 skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\06440001.VBN/Planetarion-calc.exe Infected: Backdoor.Win32.SubSeven.213.bonus skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\06440001.VBN ZIP: infected - 1 skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\06440001.VBN CryptZ: infected - 1 skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\06640000.VBN/New Folder/exe files/getrgt.exe/WISE0032.BIN Infected: not-a-virus:AdWare.Win32.TimeSinc skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\06640000.VBN/New Folder/exe files/getrgt.exe Infected: not-a-virus:AdWare.Win32.TimeSinc skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\06640000.VBN/New Folder/ICQ/Received Files/Hex/Planetarion-calc.zip/Planetarion-calc.exe Infected: Backdoor.Win32.SubSeven.213.bonus skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\06640000.VBN/New Folder/ICQ/Received Files/Hex/Planetarion-calc.zip Infected: Backdoor.Win32.SubSeven.213.bonus skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\06640000.VBN ZIP: infected - 4 skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\06640000.VBN CryptZ: infected - 4 skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\06640001.VBN/Received Files/Hex/Planetarion-calc.zip/Planetarion-calc.exe Infected: Backdoor.Win32.SubSeven.213.bonus skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\06640001.VBN/Received Files/Hex/Planetarion-calc.zip Infected: Backdoor.Win32.SubSeven.213.bonus skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\06640001.VBN ZIP: infected - 2 skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\06640001.VBN CryptZ: infected - 2 skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07000000.VBN Infected: Trojan-Downloader.Java.OpenStream.w skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07000001.VBN Infected: Trojan-Downloader.Java.OpenStream.w skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08580000.VBN/Received Files/Hex/Planetarion-calc.zip/Planetarion-calc.exe Infected: Backdoor.Win32.SubSeven.213.bonus skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08580000.VBN/Received Files/Hex/Planetarion-calc.zip Infected: Backdoor.Win32.SubSeven.213.bonus skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08580000.VBN ZIP: infected - 2 skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08580000.VBN CryptZ: infected - 2 skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08580001.VBN/Received Files/Hex/Planetarion-calc.zip/Planetarion-calc.exe Infected: Backdoor.Win32.SubSeven.213.bonus skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08580001.VBN/Received Files/Hex/Planetarion-calc.zip Infected: Backdoor.Win32.SubSeven.213.bonus skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08580001.VBN ZIP: infected - 2 skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08580001.VBN CryptZ: infected - 2 skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A280000.VBN Infected: Exploit.HTML.Mht skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A440000.VBN Infected: Exploit.HTML.Mht skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A600000.VBN Infected: Trojan-Downloader.Java.OpenStream.w skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A600001.VBN Infected: Trojan.Java.ClassLoader.h skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A600002.VBN Infected: Trojan.Java.ClassLoader.d skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A600003.VBN Infected: Trojan.Java.ClassLoader.h skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A600004.VBN Infected: Trojan.Java.ClassLoader.d skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A940000.VBN Infected: Packed.Win32.Klone.g skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A940001.VBN Infected: Packed.Win32.Klone.g skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A940002.VBN Infected: not-a-virus:AdWare.Win32.Virtumonde.de skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A940003.VBN Infected: Packed.Win32.Klone.k skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A940004.VBN Infected: Packed.Win32.Klone.k skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A940005.VBN Infected: Trojan-Downloader.Java.OpenConnection.aj skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A940006.VBN Infected: Trojan-Downloader.Java.OpenConnection.aj skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A940007.VBN Infected: Trojan-Downloader.Java.OpenStream.w skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A940008.VBN Infected: Trojan-Downloader.Java.OpenStream.w skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A940009.VBN Infected: Trojan-Downloader.Java.OpenConnection.aj skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A94000A.VBN Infected: Trojan-Downloader.Java.OpenConnection.aj skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A94000B.VBN Infected: Trojan-Downloader.Java.OpenStream.w skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A94000C.VBN Infected: Trojan-Downloader.Java.OpenStream.w skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A94000D.VBN Infected: Trojan-Downloader.Java.OpenConnection.aj skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A94000E.VBN Infected: Trojan-Downloader.Java.OpenConnection.aj skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A94000F.VBN Infected: Trojan-Downloader.Java.OpenStream.w skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A940010.VBN Infected: Trojan-Downloader.Java.OpenStream.w skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A940011.VBN Infected: Packed.Win32.Klone.k skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A940012.VBN Infected: Trojan-Downloader.Java.OpenConnection.aj skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A940013.VBN Infected: Trojan-Downloader.Java.OpenConnection.aj skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A940014.VBN Infected: Trojan-Downloader.Java.OpenStream.w skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A940015.VBN Infected: Trojan-Downloader.Java.OpenStream.w skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A940016.VBN Infected: Trojan-Downloader.Java.OpenConnection.aj skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A940017.VBN Infected: Trojan-Downloader.Java.OpenConnection.aj skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A940018.VBN Infected: Trojan-Downloader.Java.OpenStream.w skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A940019.VBN Infected: Trojan-Downloader.Java.OpenStream.w skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A94001A.VBN Infected: Packed.Win32.Klone.k skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A94001B.VBN Infected: Trojan-Downloader.Java.OpenConnection.aj skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A94001C.VBN Infected: Trojan-Downloader.Java.OpenConnection.aj skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A94001D.VBN Infected: Trojan-Downloader.Java.OpenStream.w skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A94001E.VBN Infected: Trojan-Downloader.Java.OpenStream.w skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0AA00000.VBN Infected: Trojan-Downloader.HTML.Agent.g skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0AA00001.VBN Infected: Trojan-Downloader.Win32.Small.ts skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0AA00002.VBN Infected: Trojan-Downloader.HTML.Agent.g skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0AA00003.VBN/Counter.class Infected: Trojan.Java.Femad skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0AA00003.VBN/web.exe Infected: Trojan-Downloader.Win32.Small.ts skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0AA00003.VBN/VerifierBug.class Infected: Trojan.Java.Femad skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0AA00003.VBN/Worker.class Infected: Trojan.Java.Femad skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0AA00003.VBN/Xeyond.class Infected: Trojan.Java.Femad skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0AA00003.VBN ZIP: infected - 5 skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0AA00003.VBN CryptZ: infected - 5 skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0AA00004.VBN/Counter.class Infected: Trojan.Java.Femad skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0AA00004.VBN/web.exe Infected: Trojan-Downloader.Win32.Small.ts skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0AA00004.VBN/VerifierBug.class Infected: Trojan.Java.Femad skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0AA00004.VBN/Worker.class Infected: Trojan.Java.Femad skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0AA00004.VBN/Xeyond.class Infected: Trojan.Java.Femad skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0AA00004.VBN ZIP: infected - 5 skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0AA00004.VBN CryptZ: infected - 5 skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0AB40000.VBN Infected: Exploit.HTML.Mht skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0AB80000.VBN Infected: Trojan-Downloader.JS.Agent.ak skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0AB80001.VBN Infected: Trojan-Downloader.Win32.Small.agq skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0AB80002.VBN/BlackBox.class Infected: Exploit.Java.ByteVerify skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0AB80002.VBN/VerifierBug.class Infected: Exploit.Java.ByteVerify skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0AB80002.VBN/Beyond.class Infected: Trojan-Downloader.Java.OpenConnection.aa skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0AB80002.VBN ZIP: infected - 3 skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0AB80002.VBN CryptZ: infected - 3 skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0EF00000.VBN/GetAccess.class Infected: Trojan-Downloader.Java.OpenConnection.aj skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0EF00000.VBN/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.aj skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0EF00000.VBN ZIP: infected - 2 skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0EF00000.VBN CryptZ: infected - 2 skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0EF00001.VBN/GetAccess.class Infected: Trojan-Downloader.Java.OpenConnection.aj skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0EF00001.VBN/Installer.class Infected: Trojan-Downloader.Java.OpenConnection.aj skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0EF00001.VBN ZIP: infected - 2 skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0EF00001.VBN CryptZ: infected - 2 skipped
C:\Documents and Settings\Dwighty\Application Data\$_hpcst$.hpc Object is locked skipped
C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cert8.db Object is locked skipped
C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\formhistory.dat Object is locked skipped
C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\history.dat Object is locked skipped
C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\key3.db Object is locked skipped
C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\parent.lock Object is locked skipped
C:\Documents and Settings\Dwighty\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Dwighty\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Dwighty\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Dwighty\Local Settings\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\Cache\_CACHE_001_ Object is locked skipped
C:\Documents and Settings\Dwighty\Local Settings\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\Cache\_CACHE_002_ Object is locked skipped
C:\Documents and Settings\Dwighty\Local Settings\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\Cache\_CACHE_003_ Object is locked skipped
C:\Documents and Settings\Dwighty\Local Settings\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\Cache\_CACHE_MAP_ Object is locked skipped
C:\Documents and Settings\Dwighty\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Dwighty\Local Settings\Temp\WCESLog.log Object is locked skipped
C:\Documents and Settings\Dwighty\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Dwighty\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Dwighty\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT.LOG Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{A2ABDB74-DCA4-4F98-B140-576F82D20398}\RP512\A0097836.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ek skipped
C:\System Volume Information\_restore{A2ABDB74-DCA4-4F98-B140-576F82D20398}\RP512\A0098289.dll Infected: not-a-virus:AdWare.Win32.Searchcolor.a skipped
C:\System Volume Information\_restore{A2ABDB74-DCA4-4F98-B140-576F82D20398}\RP515\change.log Object is locked skipped
C:\WINNT\Debug\PASSWD.LOG Object is locked skipped
C:\WINNT\SchedLgU.Txt Object is locked skipped
C:\WINNT\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINNT\Sti_Trace.log Object is locked skipped
C:\WINNT\system32\CatRoot2\edb.log Object is locked skipped
C:\WINNT\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINNT\system32\config\ACEEvent.evt Object is locked skipped
C:\WINNT\system32\config\AppEvent.Evt Object is locked skipped
C:\WINNT\system32\config\default Object is locked skipped
C:\WINNT\system32\config\default.LOG Object is locked skipped
C:\WINNT\system32\config\SAM Object is locked skipped
C:\WINNT\system32\config\SAM.LOG Object is locked skipped
C:\WINNT\system32\config\SecEvent.Evt Object is locked skipped
C:\WINNT\system32\config\SECURITY Object is locked skipped
C:\WINNT\system32\config\SECURITY.LOG Object is locked skipped
C:\WINNT\system32\config\software Object is locked skipped
C:\WINNT\system32\config\software.LOG Object is locked skipped
C:\WINNT\system32\config\SysEvent.Evt Object is locked skipped
C:\WINNT\system32\config\system Object is locked skipped
C:\WINNT\system32\config\system.LOG Object is locked skipped
C:\WINNT\system32\h323log.txt Object is locked skipped
C:\WINNT\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINNT\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINNT\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINNT\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINNT\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINNT\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINNT\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINNT\system32\xiabechx.exe Infected: not-a-virus:AdWare.Win32.Searchcolor.a skipped
C:\WINNT\wiadebug.log Object is locked skipped
C:\WINNT\wiaservc.log Object is locked skipped
C:\WINNT\WindowsUpdate.log Object is locked skipped
D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
D:\System Volume Information\_restore{A2ABDB74-DCA4-4F98-B140-576F82D20398}\RP515\change.log Object is locked skipped
E:\Misc\Backup\WAV to MP3 Encoder\m3_bbi6009.exe/data0002 Infected: not-a-virus:AdWare.Win32.BargainBuddy.v skipped
E:\Misc\Backup\WAV to MP3 Encoder\m3_bbi6009.exe/data0003 Infected: not-a-virus:AdWare.Win32.BargainBuddy.a skipped
E:\Misc\Backup\WAV to MP3 Encoder\m3_bbi6009.exe NSIS: infected - 2 skipped
E:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

Scan process completed.

Logfile of HijackThis v1.99.1
Scan saved at 8:24:42 AM, on 10/31/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\brsvc01a.exe
C:\WINNT\system32\brss01a.exe
C:\WINNT\system32\spoolsv.exe
D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINNT\system32\Brmfrmps.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINNT\system32\mspmspsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
D:\Program Files\Raxco\PerfectDisk\PDSched.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\wuauclt.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINNT\system32\nvraidservice.exe
C:\WINNT\SOUNDMAN.EXE
C:\WINNT\system32\RUNDLL32.EXE
D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINNT\system32\ctfmon.exe
C:\WINNT\System32\svchost.exe
E:\PROGRA~1\MICROS~2\wcescomm.exe
C:\WINNT\system32\wbem\unsecapp.exe
E:\PROGRA~1\MICROS~2\rapimgr.exe
D:\Program Files\D-Link AirPlus\AIRPLUS.EXE
C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
C:\Program Files\Brother\Brmfcmon\BrMfcmon.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
D:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
D:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe
C:\HJT\manage.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl04b\BrStDvPt.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NVRaidService] C:\WINNT\system32\nvraidservice.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SW20] C:\WINNT\system32\sw20.exe
O4 - HKLM\..\Run: [SW24] C:\WINNT\system32\sw24.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG7_CC] D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [H/PC Connection Agent] "E:\PROGRA~1\MICROS~2\wcescomm.exe"
O4 - Startup: BitTorrent.lnk.disabled
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: D-Link AirPlus Utility.lnk = D:\Program Files\D-Link AirPlus\AIRPLUS.EXE
O4 - Global Startup: Microsoft Office.lnk = E:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Status Monitor.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - E:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - E:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - E:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Dwighty\Start Menu\Programs\IMVU\Run IMVU.lnk
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O15 - Trusted Zone: http://aimexpress.aim.com
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O20 - Winlogon Notify: NavLogon - C:\WINNT\system32\NavLogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINNT\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Brother Popup Suspend service for Resource manager (brmfrmps) - Unknown owner - C:\WINNT\system32\Brmfrmps.exe" -service (file missing)
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINNT\system32\brsvc01a.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
O23 - Service: PDEngine - Raxco Software, Inc. - D:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: PDScheduler (PDSched) - Raxco Software, Inc. - D:\Program Files\Raxco\PerfectDisk\PDSched.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

Thank you for your continued help :)

fredmh · 10-31-2006, 12:43 PM

Please read this post completely before begining the fix. If there's anything that you do not understand, kindly ask your questions before proceeding.
Please ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this
webpage would not be available when you're carrying out the fix.

IT IS IMPORTANT THAT YOU DON'T MISS A STEP & PERFORM EVERYTHING IN THE RIGHT ORDER.

----------------------------------------

Let's go a little deeper with Jotti:

Please submit the following file to Jotti File Scan

C:\Program Files\TrueLaunchBar\int\1029\Uninstall.exe

At the top of the window you should see "File to Upload & Scan" and a blank box. Copy and paste the red text from above into the box.
Then click "submit".

When it is finished, please copy and paste the information listed under "Service" and "Scanner Results" back in this thread.

----------------------------------------

Delete the following Files indicated in RED and Folders indicated in BLUE if they still exist.

E:\Misc\Backup\WAV to MP3 Encoder\m3_bbi6009.exe

C:\WINNT\system32\xiabechx.exe

----------------------------------------

Please clean out your Norton Quarantine.

Visit this site Norton quarantine for directions.

----------------------------------------

ComboFix

Please run ComboFix one more time

2. Double click combofix.exe & follow the prompts.

3. When finished, it shall produce a log for you. Post that log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

----------------------------------------

FOLLOW-UP

Please return and post these items:

Jotti scan
ComboFix.txt

Please let me know how your system is behaving.

Achmanage · 11-01-2006, 08:52 PM

I'm sorry for the delayed reply. I've been in Tampa on business. here's the scan reports:

Service

File: Uninstall.exe
Status: OK
MD5 : 8386a9913bfba6b66020847010b1146e
Packers detected: -

Scanner results
AntiVir: Found nothing
ArcaVir: Found nothing
Avast: Found nothing
AVG Antivirus: Found nothing
BitDefender: Found nothing
ClamAV: Found nothing
Dr.Web: Found nothing
F-Prot Antivirus: Found nothing
Fortinet: Found nothing
Kaspersky Anti-Virus: Found nothing
NOD32: Found nothing
Norman Virus Control: Found nothing
VirusBuster: Found nothing
VBA32: Found nothing

Combo Fix report:

Dwighty - 06-11-01 22:48:03.68 Service Pack 2
ComboFix 06.10.19 - Running from: "C:\Documents and Settings\Dwighty\Desktop"

((((((((((((((((((((((((((((((( Files Created from 2006-10-01 to 2006-11-01 ))))))))))))))))))))))))))))))))))

2006-10-20 10:20 3,968 --a------ C:\WINNT\system32\drivers\AvgAsCln.sys
2006-10-20 10:18 816,672 --a------ C:\WINNT\system32\drivers\avg7core.sys
2006-10-20 10:18 4,960 --a------ C:\WINNT\system32\drivers\avgtdi.sys
2006-10-20 10:18 4,224 --a------ C:\WINNT\system32\drivers\avg7rsw.sys
2006-10-20 10:18 3,968 --a------ C:\WINNT\system32\drivers\avgclean.sys
2006-10-20 10:18 28,416 --a------ C:\WINNT\system32\drivers\avg7rsxp.sys

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2006-10-31 10:41 -------- d-a------ C:\Program Files\Symantec AntiVirus
2006-10-31 04:50 -------- d-a------ C:\Program Files\Java
2006-10-29 10:48 -------- d-a------ C:\Program Files\Common Files
2006-10-29 08:40 -------- d-------- C:\Program Files\QuickTime
2006-10-29 08:37 -------- d-a------ C:\Program Files\Internet Explorer
2006-10-29 08:37 -------- d-a------ C:\Program Files\Google
2006-10-29 08:37 -------- d-a------ C:\Program Files\Common Files\Symantec Shared
2006-10-29 08:37 -------- d-a------ C:\Program Files\Common Files\Raxco
2006-10-29 01:18 -------- d-------- C:\Program Files\CleanUp!
2006-10-24 09:21 -------- d-------- C:\Program Files\MetaStream
2006-10-21 08:52 -------- d-------- C:\Documents and Settings\Dwighty\Application Data\AVG7
2006-10-20 10:18 -------- d-------- C:\Program Files\Grisoft
2006-09-15 21:09 -------- d--h----- C:\Program Files\InstallShield Installation Information
2006-08-21 07:21 16896 --a------ C:\WINNT\system32\fltlib.dll
2006-08-21 04:14 23040 --a------ C:\WINNT\system32\fltmc.exe
2006-08-16 16:55 208896 --a--c--- C:\WINNT\system32\nvusmb.exe
2006-08-16 16:55 208896 --a--c--- C:\WINNT\system32\nvunrm.exe
2006-08-16 16:55 208896 --a--c--- C:\WINNT\system32\NVUNINST.EXE
2006-08-16 16:55 208896 --a--c--- C:\WINNT\system32\nvuide.exe
2006-08-16 16:55 208896 --a--c--- C:\WINNT\system32\nvugart.exe
2006-08-16 16:55 208896 --a--c--- C:\WINNT\system32\nvuaudio.exe
2006-08-16 16:55 208896 --a------ C:\WINNT\system32\nvudisp.exe
2006-08-11 20:45 888832 --a------ C:\WINNT\system32\nvmobls.dll
2006-08-11 20:45 581632 --a------ C:\WINNT\system32\nvhwvid.dll
2006-08-11 20:45 5611520 --a------ C:\WINNT\system32\nvdisps.dll
2006-08-11 20:45 5251072 --a------ C:\WINNT\system32\nvdispsr.dll
2006-08-11 20:45 458752 --a------ C:\WINNT\system32\nvmccssr.dll
2006-08-11 20:45 45056 --a------ C:\WINNT\system32\nvmccsrs.dll
2006-08-11 20:45 3039232 --a------ C:\WINNT\system32\nvgames.dll
2006-08-11 20:45 2953216 --a------ C:\WINNT\system32\nvvitvsr.dll
2006-08-11 20:45 2928640 --a------ C:\WINNT\system32\nvgamesr.dll
2006-08-11 20:45 2904064 --a------ C:\WINNT\system32\nvvitvs.dll
2006-08-11 20:45 2859008 --a------ C:\WINNT\system32\nvmoblsr.dll
2006-08-11 20:45 229376 --a------ C:\WINNT\system32\nvmccs.dll
2006-08-11 20:45 188416 --a------ C:\WINNT\system32\nvmccss.dll
2006-08-11 20:45 1732608 --a------ C:\WINNT\system32\nvwssr.dll
2006-08-11 20:45 1236992 --a------ C:\WINNT\system32\nvwss.dll
2006-08-11 20:44 147456 --a------ C:\WINNT\system32\nvcolor.exe
2006-08-11 20:43 86016 --a------ C:\WINNT\system32\nvmctray.dll
2006-08-11 20:43 81920 --a------ C:\WINNT\system32\nvwddi.dll
2006-08-11 20:43 794624 --a------ C:\WINNT\system32\nvcplui.exe
2006-08-11 20:43 7630848 --a------ C:\WINNT\system32\nvcpl.dll
2006-08-11 20:43 466944 --a------ C:\WINNT\system32\nvshell.dll
2006-08-11 20:43 442368 --a------ C:\WINNT\system32\nvappbar.exe
2006-08-11 20:43 425984 --a------ C:\WINNT\system32\keystone.exe
2006-08-11 20:43 311296 --a------ C:\WINNT\system32\nvexpbar.dll
2006-08-11 20:43 286720 --a------ C:\WINNT\system32\nvnt4cpl.dll
2006-08-11 20:43 196608 --a------ C:\WINNT\system32\nvapi.dll
2006-08-11 20:43 1662976 --a------ C:\WINNT\system32\nvwdmcpl.dll
2006-08-11 20:43 1519616 --a------ C:\WINNT\system32\nwiz.exe
2006-08-11 20:43 1470464 --a------ C:\WINNT\system32\nview.dll
2006-08-11 20:43 1339392 --a------ C:\WINNT\system32\nvdspsch.exe
2006-08-11 20:43 1019904 --a------ C:\WINNT\system32\nvwimg.dll
2006-08-11 20:43 1011712 --a------ C:\WINNT\system32\nvcpluir.dll
2006-08-11 20:42 5636096 --a------ C:\WINNT\system32\nvoglnt.dll
2006-08-11 20:42 4496128 --a------ C:\WINNT\system32\nv4_disp.dll
2006-08-11 20:42 35840 --a------ C:\WINNT\system32\nvcodins.dll
2006-08-11 20:42 35840 --a------ C:\WINNT\system32\nvcod.dll
2006-08-11 20:42 155715 --a------ C:\WINNT\system32\nvsvc32.exe

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"ctfmon.exe"="C:\\WINNT\\system32\\ctfmon.exe"
"Yahoo! Pager"="C:\\Program Files\\Yahoo!\\Messenger\\ypager.exe -quiet"
"H/PC Connection Agent"="\"E:\\PROGRA~1\\MICROS~2\\wcescomm.exe\""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"NeroFilterCheck"="C:\\WINNT\\system32\\NeroCheck.exe"
"IndexSearch"="C:\\Program Files\\ScanSoft\\PaperPort\\IndexSearch.exe"
"ControlCenter2.0"="C:\\Program Files\\Brother\\ControlCenter2\\brctrcen.exe /autorun"
"SetDefPrt"="C:\\Program Files\\Brother\\Brmfl04b\\BrStDvPt.exe"
"ATICCC"="\"C:\\Program Files\\ATI Technologies\\ATI.ACE\\cli.exe\" runtime -Delay"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"NVRaidService"="C:\\WINNT\\system32\\nvraidservice.exe"
"SoundMan"="SOUNDMAN.EXE"
"NvCplDaemon"="RUNDLL32.EXE C:\\WINNT\\system32\\NvCpl.dll,NvStartup"
"SW20"="C:\\WINNT\\system32\\sw20.exe"
"SW24"="C:\\WINNT\\system32\\sw24.exe"
"nwiz"="nwiz.exe /install"
"NvMediaCenter"="RUNDLL32.EXE C:\\WINNT\\system32\\NvMcTray.dll,NvTaskbarInit"
"AVG7_CC"="D:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe /STARTUP"
"!AVG Anti-Spyware"="\"D:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_09\\bin\\jusched.exe\""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonceex]
"Flag"=dword:00000002

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000005

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,77,01,00,00,00,00,00,00,89,03,00,00,e2,03,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,c0
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,f0,01,00,00,1f,00,00,00,80,00,00,00,76,00,\
00,00,01,00,00,00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"AVG7_Run"="D:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"="C:\\Program Files\\Internet Explorer\\Connection Wizard\\icwconn1.exe /desktop"
"tscuninstall"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,65,6d,\
33,32,5c,74,73,63,75,70,67,72,64,2e,65,78,65,00

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"AVG7_Run"="D:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"="C:\\Program Files\\Internet Explorer\\Connection Wizard\\icwconn1.exe /desktop"
"tscuninstall"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,65,6d,\
33,32,5c,74,73,63,75,70,67,72,64,2e,65,78,65,00

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
"CDRAutoRun"=dword:00000000

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:000000b5

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"UPnPMonitor"="{e57ce738-33e8-4c51-8354-bb4de9d215d1}"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Yahoo! Pager"="C:\\Program Files\\Yahoo!\\Messenger\\ypager.exe -quiet"
"msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background"
"SpybotSD TeaTimer"="C:\\Program Files\\Spybot - Search & Destroy\\TeaTimer.exe"
"ctfmon.exe"="C:\\WINNT\\system32\\ctfmon.exe"
"Skype"="\"D:\\Program Files\\Skype\\Phone\\Skype.exe\" /nosplash /minimized"
"MySpaceIM"="C:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"ATIPTA"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe"
"CloneCDElbyCDFL"="\"D:\\Program Files\\Elaborate Bytes\\CloneCD\\ElbyCheck.exe\" /L ElbyCDFL"
"WinampAgent"="D:\\Program Files\\Winamp\\winampa.exe"
"NVRaidService"="C:\\WINNT\\System32\\nvraidservice.exe"
"SunJavaUpdateSched"="C:\\Program Files\\Java\\j2re1.4.2_05\\bin\\jusched.exe"
"vptray"="C:\\PROGRA~1\\SYMANT~1\\VPTray.exe"
"Zone Labs Client"="\"D:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe\""
"BearShare"="\"C:\\Program Files\\BearShare\\BearShare.exe\" /pause"
"TkBellExe"="\"D:\\Program Files\\Real Alternative\\Update_OB\\realsched.exe\" -osboot"
"WinFast Schedule"="E:\\Program Files\\WinFast\\WFTVFM\\WFWIZ.exe"
"Tweak UI"="RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp"
"Synchronization Manager"="mobsync.exe /logon"
"KernelFaultCheck"="%systemroot%\\system32\\dumprep 0 -k"
"SSBkgdUpdate"="\"C:\\Program Files\\Common Files\\Scansoft Shared\\SSBkgdUpdate\\SSBkgdupdate.exe\" -Embedding -boot"
"SoundMan"="SOUNDMAN.EXE"
"PaperPort PTD"="C:\\Program Files\\ScanSoft\\PaperPort\\pptd40nt.exe"
"iTunesHelper"="\"E:\\Program Files\\iTunes\\iTunesHelper.exe\""
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"nwiz"="nwiz.exe /install"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^DOCUME~1^ALLUSE~1^Start Menu^Programs^Startup^Microsoft Office.lnk.disabled]
"path"="C:\\DOCUME~1\\ALLUSE~1\\Start Menu\\Programs\\Startup\\Microsoft Office.lnk.disabled"
"backup"="C:\\WINNT\\pss\\Microsoft Office.lnk.disabledCommon Startup"
"location"="Common Startup"
"command"="C:\\DOCUME~1\\ALLUSE~1\\Start Menu\\Programs\\Startup\\Microsoft Office.lnk.disabled"
"item"="Microsoft Office.lnk"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

Completion time: 06-11-01 22:48:47.28
C:\ComboFix.txt ... 06-11-01 22:48
C:\ComboFix2.txt ... 06-11-01 11:06
C:\ComboFix3.txt ... 06-10-30 19:53

I didn't even know I had Norton on this machine because I don't use it and I don't remember installing it and I can't find it on here. Was there something in the HJT log that suggested it is present?

The computer's acting a whole lot better!

I don't get any more pop-ups and the machine is moving fast again. AVG and Symantec are still reporting viruses, though. One in particular is something like Trogan.Byte.Verify but that was last night's report. I'll see if it shows up tomorrow.

fredmh · 11-02-2006, 09:28 PM

I'm glad your computer is running better. What you see is left over junk. The below steps. should clean this up

----------------------------------------

MULTIPLE ANTI-VIRUS PROGRAMS

You are currently running multiple Anti Virus programs names.

You have Norton which is Symantic and AVG.

Unlike firewalls, anti-virus programs have conflicts co-existing with each other
This can cause conflicts and confusion between the AV programs as well as system instability.
Please choose and run only 1 and uninstall the other.

ALL the antivirus programs must be removed via Start>Control Panel>Add/Remove program. Exception: See next section for Norton

For any program that doesn't have an add/remove entry, you will have to do this:
Re-install the program -> Reboot -> Uninstall

----------------------------------------

To uninstall Norton, navigate to the Program File folder: C:\Program Files\Symantec AntiVirus and see if it shows which version
you have as you willll need to know that for the Norton Uninstaller:

Here is a guide for uninstalling Norton, including uninstallers. Be sure to use the uninstaller for the version of Norton/Symantec that
is active on your system. Symantec Removal

----------------------------------------

Clear Firefox' Cookies

Open Firefox.
Click Tools » Options.
Click the Privacy tab, then the Cookies tab.
Click the Clear Cookies Now button.
Then click OK to exit.

----------------------------------------

CLEAR JAVA CACHE

The Trogan.Byte.Verify which you saw is in Java Cache. Clearing Java will get rid of it.

See this page for instructions on how to clear java's cache.

Go into the Control Panel and double-click the Java Icon. (looks like a coffee cup

)

Under Temporary Internet Files, click the Delete Files button.
There are three options in the window to clear the cache - Leave ALL 3 Checked
- Downloaded Applets
  Downloaded Applications
  Other Files
Click OK on Delete Temporary Files Window
Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
Click OK to leave the Java Control Panel.

----------------------------------------

Kaspersky - Extended

After completing the above steps, please run Kaspersky again.

Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner

Answer Yes, when prompted to install an ActiveX component.

The program will then begin downloading the latest definition files.
Once the files have been downloaded click on NEXT
Locate the Scan Settings button & configure to:
- Scan using the following Anti-Virus database:
  - Extended
- Scan Options:
  - Scan Archives
  - Scan Mail Bases
Click OK & have it scan My Computer
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect.
We only require a report from it.
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

* Turn off the real time scanner of any existing antivirus program while performing the online scan

----------------------------------------

FOLLOW-UP

Please return and post these items:

Kaspersky scan
A new HJT log run in Normal Mode

Please note: In order to properly see what is on your system, all HJT logs must be run in the normal mode

Please let me know how your system is behaving.

Achmanage · 11-04-2006, 10:25 PM

Kaspersky wouldn't load for me yesterday. I think it was my internet being weird. We're good now, though.

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Sunday, November 05, 2006 12:22:05 AM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 5/11/2006
Kaspersky Anti-Virus database records: 238359
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\
F:\
G:\

Scan Statistics:
Total number of scanned objects: 126545
Number of viruses found: 5
Number of infected objects: 6 / 0
Number of suspicious objects: 8
Duration of the scan process: 01:42:50

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\AVG7\Log\emc.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy1.zip/msexreg.exe Suspicious: Password-protected-EXE skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy1.zip ZIP: suspicious - 1 skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy18.zip/msexreg.exe Suspicious: Password-protected-EXE skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy18.zip ZIP: suspicious - 1 skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy35.zip/msexreg.exe Suspicious: Password-protected-EXE skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy35.zip ZIP: suspicious - 1 skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy53.zip/msexreg.exe Suspicious: Password-protected-EXE skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy53.zip ZIP: suspicious - 1 skipped
C:\Documents and Settings\Dwighty\Application Data\$_hpcst$.hpc Object is locked skipped
C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cert8.db Object is locked skipped
C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\formhistory.dat Object is locked skipped
C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\history.dat Object is locked skipped
C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\key3.db Object is locked skipped
C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\parent.lock Object is locked skipped
C:\Documents and Settings\Dwighty\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Dwighty\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Dwighty\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Dwighty\Local Settings\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\Cache\_CACHE_001_ Object is locked skipped
C:\Documents and Settings\Dwighty\Local Settings\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\Cache\_CACHE_002_ Object is locked skipped
C:\Documents and Settings\Dwighty\Local Settings\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\Cache\_CACHE_003_ Object is locked skipped
C:\Documents and Settings\Dwighty\Local Settings\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\Cache\_CACHE_MAP_ Object is locked skipped
C:\Documents and Settings\Dwighty\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Dwighty\Local Settings\History\History.IE5\MSHist012006110420061105\index.dat Object is locked skipped
C:\Documents and Settings\Dwighty\Local Settings\Temp\WCESLog.log Object is locked skipped
C:\Documents and Settings\Dwighty\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Dwighty\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Dwighty\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Dwighty\UserData\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT.LOG Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{A2ABDB74-DCA4-4F98-B140-576F82D20398}\RP512\A0097836.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ek skipped
C:\System Volume Information\_restore{A2ABDB74-DCA4-4F98-B140-576F82D20398}\RP512\A0098289.dll Infected: not-a-virus:AdWare.Win32.Searchcolor.a skipped
C:\System Volume Information\_restore{A2ABDB74-DCA4-4F98-B140-576F82D20398}\RP516\A0099519.exe Infected: not-a-virus:AdWare.Win32.Searchcolor.a skipped
C:\System Volume Information\_restore{A2ABDB74-DCA4-4F98-B140-576F82D20398}\RP518\change.log Object is locked skipped
C:\WINNT\Debug\PASSWD.LOG Object is locked skipped
C:\WINNT\SchedLgU.Txt Object is locked skipped
C:\WINNT\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINNT\Sti_Trace.log Object is locked skipped
C:\WINNT\system32\config\ACEEvent.evt Object is locked skipped
C:\WINNT\system32\config\AppEvent.Evt Object is locked skipped
C:\WINNT\system32\config\default Object is locked skipped
C:\WINNT\system32\config\default.LOG Object is locked skipped
C:\WINNT\system32\config\SAM Object is locked skipped
C:\WINNT\system32\config\SAM.LOG Object is locked skipped
C:\WINNT\system32\config\SecEvent.Evt Object is locked skipped
C:\WINNT\system32\config\SECURITY Object is locked skipped
C:\WINNT\system32\config\SECURITY.LOG Object is locked skipped
C:\WINNT\system32\config\software Object is locked skipped
C:\WINNT\system32\config\software.LOG Object is locked skipped
C:\WINNT\system32\config\SysEvent.Evt Object is locked skipped
C:\WINNT\system32\config\system Object is locked skipped
C:\WINNT\system32\config\system.LOG Object is locked skipped
C:\WINNT\system32\h323log.txt Object is locked skipped
C:\WINNT\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINNT\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINNT\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINNT\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINNT\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINNT\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINNT\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINNT\wiadebug.log Object is locked skipped
C:\WINNT\wiaservc.log Object is locked skipped
C:\WINNT\WindowsUpdate.log Object is locked skipped
D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
D:\System Volume Information\_restore{A2ABDB74-DCA4-4F98-B140-576F82D20398}\RP518\change.log Object is locked skipped
E:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
E:\System Volume Information\_restore{A2ABDB74-DCA4-4F98-B140-576F82D20398}\RP516\A0099522.exe/data0002 Infected: not-a-virus:AdWare.Win32.BargainBuddy.v skipped
E:\System Volume Information\_restore{A2ABDB74-DCA4-4F98-B140-576F82D20398}\RP516\A0099522.exe/data0003 Infected: not-a-virus:AdWare.Win32.BargainBuddy.a skipped
E:\System Volume Information\_restore{A2ABDB74-DCA4-4F98-B140-576F82D20398}\RP516\A0099522.exe NSIS: infected - 2 skipped

Scan process completed.

Logfile of HijackThis v1.99.1
Scan saved at 12:22:53 AM, on 11/5/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\brsvc01a.exe
C:\WINNT\system32\brss01a.exe
C:\WINNT\system32\spoolsv.exe
D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINNT\system32\Brmfrmps.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\mspmspsv.exe
D:\Program Files\Raxco\PerfectDisk\PDSched.exe
C:\WINNT\Explorer.EXE
C:\Program Files\QuickTime\qttask.exe
C:\WINNT\system32\nvraidservice.exe
C:\WINNT\SOUNDMAN.EXE
C:\WINNT\system32\RUNDLL32.EXE
D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\WINNT\system32\ctfmon.exe
E:\PROGRA~1\MICROS~2\wcescomm.exe
E:\PROGRA~1\MICROS~2\rapimgr.exe
C:\WINNT\system32\wbem\unsecapp.exe
D:\Program Files\D-Link AirPlus\AIRPLUS.EXE
C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Brother\Brmfcmon\BrMfcmon.exe
C:\WINNT\system32\wuauclt.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe
C:\HJT\manage.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl04b\BrStDvPt.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NVRaidService] C:\WINNT\system32\nvraidservice.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SW20] C:\WINNT\system32\sw20.exe
O4 - HKLM\..\Run: [SW24] C:\WINNT\system32\sw24.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG7_CC] D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [H/PC Connection Agent] "E:\PROGRA~1\MICROS~2\wcescomm.exe"
O4 - Startup: BitTorrent.lnk.disabled
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: D-Link AirPlus Utility.lnk = D:\Program Files\D-Link AirPlus\AIRPLUS.EXE
O4 - Global Startup: Microsoft Office.lnk = E:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Status Monitor.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - E:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - E:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - E:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Dwighty\Start Menu\Programs\IMVU\Run IMVU.lnk
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll
O15 - Trusted Zone: http://aimexpress.aim.com
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINNT\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Brother Popup Suspend service for Resource manager (brmfrmps) - Unknown owner - C:\WINNT\system32\Brmfrmps.exe" -service (file missing)
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINNT\system32\brsvc01a.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
O23 - Service: PDEngine - Raxco Software, Inc. - D:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: PDScheduler (PDSched) - Raxco Software, Inc. - D:\Program Files\Raxco\PerfectDisk\PDSched.exe

fredmh · 11-05-2006, 10:01 PM

Congratulations. Your logs are now clean. Please complete the next "housekeeping" steps and read through the
information below

----------------------------------------

Windows XP - Reset Hidden Files

Click Start.
Open My Computer.
Select the Tools menu and click Folder Options.
Select the View tab.
Deselect the Show hidden files and folders option.
Select the Hide file extensions for known types option.
Select the Hide protected operating system files option.
Click Yes to confirm.
Click OK.

----------------------------------------

Clean-out and Reset System Restore

This will clean out any junk or malicious files left behind in System Restore

To turn off System Restore click Start > Right Click My Computer > Properties.
Click the System Restore tab and Check
"Turn off System Restore" or "Turn off System Restore on all drives" Click Apply.
When turning off System Restore, the existing restore points will be deleted. Click Yes to do this then Click OK.
Turn on System Restore by Clicking Start. Right-click My Computer, and then click Properties.
Click the System Restore tab. Uncheck "Turn off System Restore" or "Turn off System Restore on all drives."
Click Apply, and then OK.

This will create a new Restore Point.

----------------------------------------

RE-ENABLE ANTI-SPYWARE APPLICATIONS

If you were instructed to dis-able Anti-spyware applications during this fix, you may re-enable them

----------------------------------------

Please read through the following information to help protect your computer in the future.

KEEP YOUR OPERATING SYSTEM UPDATED

Please ensure that you have already patched your system against the recent WMF exploit. Go to this page to get the KB912919 patch

MICROSOFT UPDATES

It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser
up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft
and download all the critical updates to help prevent possible re-infection.

ENABLE WINDOWS AUTO UPDATE

Go to Start>Run - type wuaucpl.cpl
tick on the checkbox - "Keep my computer up to date"
Under settings, choose "Automatically download the updates, and install them on the schedule that I specify".
Click on "OK".

TOOLS TO HELP KEEP YOUR SYSTEM CLEAN

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programs:

SpywareBlaster to help prevent spyware from installing in the first place.

Install & update SpywareBlaster with the latest definitions.
After you have updated, click the button - enable protection for all unprotected items

SpywareGuard to catch and block spyware before it can execute.

SPYBOT - SEARCH & DESTROY Download and install Spybot - Search & Destroy with its
TeaTimer option.
This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with
the program on a regular basis just as you would an antivirus software. A tutorial on installing & using this product can be found here

AD-AWARE Download and install Ad-Aware. You should use this program to scan
your computer on a regular basis just as you would an antivirus software in conjunction with Spybot. A tutorial on installing & using this product
can be found here

IE-SPYAD IE/Spyad places more than 4000 dubious websites and domains in the IE Restricted list. This severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites.

Download IE-SpyAD - Extract the contents to a new folder
From within the folder, double-click install.bat
Select Option #2 - Install the new IE-SPYAD list.
Then return to the main menu.
Select option #4 - Add the old porn sites domain

A tutorial for IE-SPYAD can be found here

MVPS HOST FILE The MVPS Hosts file replaces your current HOSTS file
with one that will restrict known ad sites form serving you unsolicited advertisements. Basically, this prevents your computer from connecting to
those sites by redirecting them to 127.0.0.1 which is the IP of your local computer.

Download Host.zip to your desktop.
From your Desktop right-click (hosts.zip) and select:
Extract All from the menu.
Click Next, click Next, select the option:
"Show Extracted files"
Click Finish

This will open the newly created hosts folder on your Desktop.

Double-click on the included mvps.bat file, this will rename the existing HOSTS file to HOSTS.MVP, then it will copy the included updated
HOSTS file to the correct location on your machine.

MCAFEE SITE ADVISOR SITE ADVISOR is a free IE plug-in (also suport for Firefox browser)
which is used in conjunction with the Google search engine. It advises which web sites are considered safe and which sites could pose a problem.
It also shows what problems were encountered with each site, such as malicious downloads, spam, and related links.

ANTI-VIRUS AND FIREWALL PROGRAMS

ANTIVIRUS SOFTWARE It is very important that you have anti-virus software running on your machine.
This alone can save you a lot of trouble with malware in the future.
See this link for a listing of some online antivirus scanners: Anti-Spyware Tutorial

Here are some very good free Antivirus products which are available:

Avast!
AVG

If you do not have a firewall, here are 4 free ones available for personal use:

Understanding and Using Firewalls

INFORMATIONAL READING

In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles:

PC SAFETY AND SECURITY
HOW DID I GET INFECTED IN THE FIRST PLACE?
THE ANTI-SPYWARE TUTORIAL
MAKING INTERNET EXPLORER SAFER
INVASION OF THE COMPUTER SNATCHERS
The Cookie Concept

Please respond one more time and let me know you received this post so it can be marked resolved

Achmanage · 11-05-2006, 10:51 PM

Awesome!

Thank you so much for helping me clean my system!

fredmh · 11-05-2006, 10:52 PM

You're quite welcome.

10-27-2006, 03:48 PM	#1 (permalink)
Achmanage Registered User Join Date: Oct 2006 Posts: 9 OS: XP	Malware and Pop-ups and Trojans, OH MY! OK guys, here we go! We got your basic dish of malware symptoms, computer's running slow, pop-ups on the browser, ridiculously annoying pace where I'm sitting here for about ten seconds before Firefox loads. Boot-up's real slow. You know the combo meal I'm talking about. I did a little digging online before I found this site and found out that the pop-ups I was getting matched that of some nefarious Vundo virus thing. So I got Symantec's Vundo removal program an ran that and now I guess it's gone but I still get pop-ups! Now, granted the pop-up doesn't load a page anymore (it says the connection timed out or something), there's an IP address it's trying to reach. I'm not sure if I'm supposed to post it here but I will and if the admins don't like it, they can remove it (I hope) 202.67.220.227. Google has it named as "evil cockroach spyware" which is really kind of funny. But I digress. I've done the routine check-ups. I ran spybot, I ran AVG, I ran Symantec. I took care of everything they found, but obviously the problem is still there, somewhere. Here's my Hijackthis log, let me know if I'm leaving out anything or if you need any more information. And thanks in advance! PS. I was wrong, right before I ran a scan, it seems the diabolical WinAntiVirusPro pop-up ads are back! Nooooooooo! Logfile of HijackThis v1.99.1 Scan saved at 5:46:09 PM, on 10/27/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\svchost.exe C:\WINNT\system32\brsvc01a.exe C:\WINNT\system32\brss01a.exe C:\WINNT\system32\spoolsv.exe D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\WINNT\Explorer.EXE D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\WINNT\system32\Brmfrmps.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Symantec AntiVirus\DefWatch.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\QuickTime\qttask.exe C:\WINNT\system32\nvraidservice.exe C:\WINNT\system32\nvsvc32.exe C:\WINNT\SOUNDMAN.EXE D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\WINNT\system32\ctfmon.exe C:\WINNT\system32\svchost.exe C:\Program Files\Symantec AntiVirus\Rtvscan.exe E:\PROGRA~1\MICROS~2\wcescomm.exe C:\WINNT\system32\mspmspsv.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe E:\PROGRA~1\MICROS~2\rapimgr.exe D:\Program Files\D-Link AirPlus\AIRPLUS.EXE C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe D:\Program Files\Raxco\PerfectDisk\PDSched.exe C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe C:\Program Files\Brother\Brmfcmon\BrMfcmon.exe C:\WINNT\system32\wbem\unsecapp.exe C:\WINNT\system32\wuauclt.exe D:\PROGRA~1\MOZILL~1\FIREFOX.EXE C:\HJT\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: &VSToolBar - {821F87FF-8245-4972-9E28-732E92EC2F51} - C:\Program Files\VSToolbar\VSToolBar.dll O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl04b\BrStDvPt.exe O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [NVRaidService] C:\WINNT\system32\nvraidservice.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [SW20] C:\WINNT\system32\sw20.exe O4 - HKLM\..\Run: [SW24] C:\WINNT\system32\sw24.exe O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [AVG7_CC] D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [!AVG Anti-Spyware] "D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\system32\ctfmon.exe O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet O4 - HKCU\..\Run: [H/PC Connection Agent] "E:\PROGRA~1\MICROS~2\wcescomm.exe" O4 - Startup: BitTorrent.lnk.disabled O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: D-Link AirPlus Utility.lnk = D:\Program Files\D-Link AirPlus\AIRPLUS.EXE O4 - Global Startup: Microsoft Office.lnk = E:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: Status Monitor.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - E:\PROGRA~1\MICROS~2\INetRepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - E:\PROGRA~1\MICROS~2\INetRepl.dll O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - E:\PROGRA~1\MICROS~2\INetRepl.dll O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Dwighty\Start Menu\Programs\IMVU\Run IMVU.lnk O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll O15 - Trusted Zone: http://aimexpress.aim.com O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINNT\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe O23 - Service: Brother Popup Suspend service for Resource manager (brmfrmps) - Unknown owner - C:\WINNT\system32\Brmfrmps.exe" -service (file missing) O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINNT\system32\brsvc01a.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe O23 - Service: PDEngine - Raxco Software, Inc. - D:\Program Files\Raxco\PerfectDisk\PDEngine.exe O23 - Service: PDScheduler (PDSched) - Raxco Software, Inc. - D:\Program Files\Raxco\PerfectDisk\PDSched.exe O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

10-28-2006, 03:54 PM	#3 (permalink)
fredmh Analyst, Security Team ; TSF Supporter Join Date: May 2006 Location: Phila,Pa Posts: 2,335 OS: XP	The infection you have, a variant of vundo, recognizes HijackThis and prevents HJT from reading the registry locations where it resides as well as hiding other infections in those locations. I'd like you to rename HijackThis.exe to manage.exe. Navigate to C:\Path of HJT Right click on HijackThis.exe Select 'Rename' Type in manage.exe Press Enter. Please run a scan with the newly renamed phatzilla.exe and post the new log here.

10-28-2006, 09:36 PM	#5 (permalink)
fredmh Analyst, Security Team ; TSF Supporter Join Date: May 2006 Location: Phila,Pa Posts: 2,335 OS: XP	Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe. Please read this post completely before begining the fix. If there's anything that you do not understand, kindly ask your questions before proceeding. Please ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix. IT IS IMPORTANT THAT YOU DON'T MISS A STEP & PERFORM EVERYTHING IN THE RIGHT ORDER. ---------------------------------------- The fixes we will use are specific to your problems and should only be used for this issue on this machine. Please only use this topic to reply to. Do not start another thread. If any other issues arise let me know. The process is not instant. Please continue to review my answers until I tell you your machine is clear. Absence of symptoms does not mean that everything is clear. So lets do this to the end! Please make every effort to reply to my posts in a timely manner. Malware breeds malware and the longer an infection remains on a system, the more likely additional infections will result. ---------------------------------------- DOWNLOADS CLEANUP! version 4.52 – TEMP FILE CLEANING Please download Cleanup! and install it. You will use this later. NOTE Cleanup deletes EVERYTHING out of temporary folders and does not make backups. AVG Anti-Spyware 7.5 Please download AVG Anti-Spyware 7.5 Install AVG Anti-Spyware 7.5. Double-click the icon on Desktop to launch AVG A-S 7.5 On the top of the main screen click Shield Click the word active to change it to inactive On the top of the main screen click Update. Then click on Start Update. The update will start and a progress bar will show the updates being installed. I also recommend changing the "Update interval" to something more reasonable like 12 hours. ComboFix 1. Download this file - You MUST save it to your desktop http://download.bleepingcomputer.com/sUBs/combofix.exe or http://www.techsupportforum.com/sectools/combofix.exe Do not run it yet. ---------------------------------------- SAFE MODE RE-BOOT Please reboot your computer in Safe Mode by doing the following: 1) Restart your computer 2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8. 3) Instead of Windows loading as normal, a menu should appear 4) Use the up arrow key to highlight Safe Mode and press Enter. 5) Login with your usual account. Make sure to close any open browsers. ---------------------------------------- FIXES AND DELETIONS Uninstall the following via the Add/Remove Panel (Start->(Settings)->Control Panel->Add/Remove Programs) if they exist: VSToolbar ---------------------------------------- Open HijackThis and click on 'Do a System Scan Only'. Check the following entries (If they still exist, make sure you do not miss any) R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O2 - BHO: (no name) - {1DAEFCB9-06C8-47c6-8F20-3FB54B244DAA} - C:\WINNT\system32\jsnuytbr.dll (file missing) O3 - Toolbar: &VSToolBar - {821F87FF-8245-4972-9E28-732E92EC2F51} - C:\Program Files\VSToolbar\VSToolBar.dll O20 - Winlogon Notify: winccf32 - winccf32.dll (file missing) *Please remember to close all other windows, including browsers then click Fix checked.* ---------------------------------------- UNHIDE HIDDEN FILES Go to My Computer->Tools->Folder Options->View tab: * Under the Hidden files and folders heading, select Show hidden files and folders. * Uncheck the Hide protected operating system files (recommended) option. * Also make sure there is no checkmark beside Hide file extensions for known file types * Click Yes to confirm and then click OK. ---------------------------------------- Delete the following Files indicated in RED and Folders indicated in BLUE if they still exist. C:\Program Files\VSToolbar ---------------------------------------- RUNNING SCANNERS Cleanup Open Cleanup! by double-clicking the icon on your desktop (or from the Start > All Programs menu). Set the program up as follows: Click "Options..." Move the arrow down to "Custom CleanUp!" Put a check next to the following (Make sure nothing else is checked!): Empty Recycle Bins Delete Cookies Delete Prefetch files (if present) Cleanup! All Users Click on the Temporary Files tab and uncheck the box for Scan drives for files matching if it’s checked. Click OK Press the CleanUp! button to start the program and DO NOT reboot when prompted. AVG Anti-Spyware 7.5 Run AVG A-s with it's updated definitions: (...it's important that all windows must be closed) This scan can take quite a while to run, so be prepared. Click Scanner Click on the Scan tab Click Complete System Scan to begin scanning. When the scan is complete click Recommended Action and change it to Quarantine. Then click Apply all actions. Note: DO NOT USE the computer while AVG A/S is scanning. If Explorer or the Control Panel are opened some malware types will reinfect your system or will not be cleaned properly. Once finished, click the Save report button, then click Save Report As and save it to your desktop. ---------------------------------------- SYSTEM RE-BOOT Reboot into Normal Mode. ---------------------------------------- ON-LINE SCANS Perform an online scan with Internet Explorer with Panda ActiveScan Click on the "Free To Use ActiveScan" located on the top right hand corner Click Check Now and a "pop up" window will appear. * Please ensure that your pop up blocker doesn't block it * Enter your e-mail address, country, and state & click Scan Now * The download of the 8 MB Panda's ActiveX control will take place * Begin the scan by selecting My Computer If it finds any malware, it will offer you a report. Please ignore any entry it finds and the offer to buy the program to remove the entry, as we will address this later. Click on See report then click Save report * You needn't remain online while it's doing the scan but you have to re-connect after it has finished to see the report. * Turn off the real time scanner of any existing antivirus program while performing the online scan ---------------------------------------- ComboFix 2. Double click combofix.exe & follow the prompts. 3. When finished, it shall produce a log for you. Post that log in your next reply Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall ---------------------------------------- FOLLOW-UP Please return and post these items: AVG A/S scan Panda scan ComboFix.txt A new HJT log run in Normal Mode Please note: In order to properly see what is on your system, all HJT logs must be run in the normal mode Please let me know how your system is behaving.

11-02-2006, 09:28 PM	#13 (permalink)
fredmh Analyst, Security Team ; TSF Supporter Join Date: May 2006 Location: Phila,Pa Posts: 2,335 OS: XP	I'm glad your computer is running better. What you see is left over junk. The below steps. should clean this up ---------------------------------------- MULTIPLE ANTI-VIRUS PROGRAMS You are currently running multiple Anti Virus programs names. You have Norton which is Symantic and AVG. Unlike firewalls, anti-virus programs have conflicts co-existing with each other This can cause conflicts and confusion between the AV programs as well as system instability. Please choose and run only 1 and uninstall the other. ALL the antivirus programs must be removed via Start>Control Panel>Add/Remove program. Exception: See next section for Norton For any program that doesn't have an add/remove entry, you will have to do this: Re-install the program -> Reboot -> Uninstall ---------------------------------------- To uninstall Norton, navigate to the Program File folder: C:\Program Files\Symantec AntiVirus and see if it shows which version you have as you willll need to know that for the Norton Uninstaller: Here is a guide for uninstalling Norton, including uninstallers. Be sure to use the uninstaller for the version of Norton/Symantec that is active on your system. Symantec Removal ---------------------------------------- Clear Firefox' Cookies Open Firefox. Click Tools » Options. Click the Privacy tab, then the Cookies tab. Click the Clear Cookies Now button. Then click OK to exit. ---------------------------------------- CLEAR JAVA CACHE The Trogan.Byte.Verify which you saw is in Java Cache. Clearing Java will get rid of it. See this page for instructions on how to clear java's cache. Go into the Control Panel and double-click the Java Icon. (looks like a coffee cup ) Under Temporary Internet Files, click the Delete Files button. There are three options in the window to clear the cache - Leave ALL 3 Checked Downloaded Applets Downloaded Applications Other Files Click OK on Delete Temporary Files Window Note: This deletes ALL the Downloaded Applications and Applets from the CACHE. Click OK to leave the Java Control Panel. ---------------------------------------- Kaspersky - Extended After completing the above steps, please run Kaspersky again. Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner Answer Yes, when prompted to install an ActiveX component. The program will then begin downloading the latest definition files. Once the files have been downloaded click on NEXT Locate the Scan Settings button & configure to: Scan using the following Anti-Virus database: Extended Scan Options: Scan Archives Scan Mail Bases Click OK & have it scan My Computer Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it. Click the Save as Text button to save the file to your desktop so that you may post it in your next reply * Turn off the real time scanner of any existing antivirus program while performing the online scan ---------------------------------------- FOLLOW-UP Please return and post these items: Kaspersky scan A new HJT log run in Normal Mode Please note: In order to properly see what is on your system, all HJT logs must be run in the normal mode Please let me know how your system is behaving.

11-05-2006, 10:01 PM	#15 (permalink)
fredmh Analyst, Security Team ; TSF Supporter Join Date: May 2006 Location: Phila,Pa Posts: 2,335 OS: XP	Congratulations. Your logs are now clean. Please complete the next "housekeeping" steps and read through the information below ---------------------------------------- Windows XP - Reset Hidden Files Click Start. Open My Computer. Select the Tools menu and click Folder Options. Select the View tab. Deselect the Show hidden files and folders option. Select the Hide file extensions for known types option. Select the Hide protected operating system files option. Click Yes to confirm. Click OK. ---------------------------------------- Clean-out and Reset System Restore This will clean out any junk or malicious files left behind in System Restore To turn off System Restore click Start > Right Click My Computer > Properties. Click the System Restore tab and Check "Turn off System Restore" or "Turn off System Restore on all drives" Click Apply. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this then Click OK. Turn on System Restore by Clicking Start. Right-click My Computer, and then click Properties. Click the System Restore tab. Uncheck "Turn off System Restore" or "Turn off System Restore on all drives." Click Apply, and then OK. This will create a new Restore Point. ---------------------------------------- RE-ENABLE ANTI-SPYWARE APPLICATIONS If you were instructed to dis-able Anti-spyware applications during this fix, you may re-enable them ---------------------------------------- Please read through the following information to help protect your computer in the future. KEEP YOUR OPERATING SYSTEM UPDATED Please ensure that you have already patched your system against the recent WMF exploit. Go to this page to get the KB912919 patch MICROSOFT UPDATES It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft and download all the critical updates to help prevent possible re-infection. ENABLE WINDOWS AUTO UPDATE Go to Start>Run - type wuaucpl.cpl tick on the checkbox - "Keep my computer up to date" Under settings, choose "Automatically download the updates, and install them on the schedule that I specify". Click on "OK". TOOLS TO HELP KEEP YOUR SYSTEM CLEAN Now that you are clean, to help protect your computer in the future I recommend that you get the following free programs: SpywareBlaster to help prevent spyware from installing in the first place. Install & update SpywareBlaster with the latest definitions. After you have updated, click the button - enable protection for all unprotected items SpywareGuard to catch and block spyware before it can execute. SPYBOT - SEARCH & DESTROY Download and install Spybot - Search & Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with the program on a regular basis just as you would an antivirus software. A tutorial on installing & using this product can be found here AD-AWARE Download and install Ad-Aware. You should use this program to scan your computer on a regular basis just as you would an antivirus software in conjunction with Spybot. A tutorial on installing & using this product can be found here IE-SPYAD IE/Spyad places more than 4000 dubious websites and domains in the IE Restricted list. This severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites. Download IE-SpyAD - Extract the contents to a new folder From within the folder, double-click install.bat Select Option #2 - Install the new IE-SPYAD list. Then return to the main menu. Select option #4 - Add the old porn sites domain A tutorial for IE-SPYAD can be found here MVPS HOST FILE The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites form serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer. Download Host.zip to your desktop. From your Desktop right-click (hosts.zip) and select: Extract All from the menu. Click Next, click Next, select the option: "Show Extracted files" Click Finish This will open the newly created hosts folder on your Desktop. Double-click on the included mvps.bat file, this will rename the existing HOSTS file to HOSTS.MVP, then it will copy the included updated HOSTS file to the correct location on your machine. MCAFEE SITE ADVISOR SITE ADVISOR is a free IE plug-in (also suport for Firefox browser) which is used in conjunction with the Google search engine. It advises which web sites are considered safe and which sites could pose a problem. It also shows what problems were encountered with each site, such as malicious downloads, spam, and related links. ANTI-VIRUS AND FIREWALL PROGRAMS ANTIVIRUS SOFTWARE It is very important that you have anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future. See this link for a listing of some online antivirus scanners: Anti-Spyware Tutorial Here are some very good free Antivirus products which are available: Avast! AVG If you do not have a firewall, here are 4 free ones available for personal use: Understanding and Using Firewalls ZoneAlarm Avast Antivirus/Firewall Tiny Personal Firewall OutPost Firewall INFORMATIONAL READING In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles: PC SAFETY AND SECURITY HOW DID I GET INFECTED IN THE FIRST PLACE? THE ANTI-SPYWARE TUTORIAL MAKING INTERNET EXPLORER SAFER INVASION OF THE COMPUTER SNATCHERS The Cookie Concept Please respond one more time and let me know you received this post so it can be marked resolved

10-28-2006, 02:37 PM	#2 (permalink)
fredmh Analyst, Security Team ; TSF Supporter Join Date: May 2006 Location: Phila,Pa Posts: 2,335 OS: XP	Hello Achmanage, and welcome to TSF. I am currently reviewing your log. Please note that this is under the supervision of an expert analyst, and I will be back with a fix for your problem as soon as possible. You may wish to Subscribe to this thread (Thread Tools) so that you are notified when you receive a reply. Please be patient with me during this time.

10-28-2006, 04:27 PM	#4 (permalink)
Achmanage Registered User Join Date: Oct 2006 Posts: 9 OS: XP	Hey Fred, First of all, thank you so much for helping me out with this Here's what "manage.exe" has reported: Logfile of HijackThis v1.99.1 Scan saved at 6:25:53 PM, on 10/28/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\svchost.exe C:\WINNT\system32\brsvc01a.exe C:\WINNT\system32\brss01a.exe C:\WINNT\system32\spoolsv.exe D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\WINNT\Explorer.EXE D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\WINNT\system32\Brmfrmps.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Symantec AntiVirus\DefWatch.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\WINNT\system32\nvsvc32.exe C:\WINNT\system32\svchost.exe C:\Program Files\Symantec AntiVirus\Rtvscan.exe C:\WINNT\system32\mspmspsv.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe D:\Program Files\Raxco\PerfectDisk\PDSched.exe C:\Program Files\QuickTime\qttask.exe C:\WINNT\system32\nvraidservice.exe C:\WINNT\SOUNDMAN.EXE C:\WINNT\system32\RUNDLL32.EXE D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\WINNT\system32\ctfmon.exe C:\WINNT\System32\svchost.exe E:\PROGRA~1\MICROS~2\wcescomm.exe E:\PROGRA~1\MICROS~2\rapimgr.exe C:\WINNT\system32\wbem\unsecapp.exe D:\Program Files\D-Link AirPlus\AIRPLUS.EXE C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe C:\Program Files\Brother\Brmfcmon\BrMfcmon.exe C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe C:\WINNT\system32\wuauclt.exe C:\Program Files\Internet Explorer\iexplore.exe C:\HJT\manage.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {1DAEFCB9-06C8-47c6-8F20-3FB54B244DAA} - C:\WINNT\system32\jsnuytbr.dll (file missing) O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: (no name) - {F04154D0-8037-40AD-B9A5-ECFC14813AAC} - C:\WINNT\Drivers\ssp.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: &VSToolBar - {821F87FF-8245-4972-9E28-732E92EC2F51} - C:\Program Files\VSToolbar\VSToolBar.dll O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl04b\BrStDvPt.exe O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [NVRaidService] C:\WINNT\system32\nvraidservice.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [SW20] C:\WINNT\system32\sw20.exe O4 - HKLM\..\Run: [SW24] C:\WINNT\system32\sw24.exe O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [AVG7_CC] D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [!AVG Anti-Spyware] "D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\system32\ctfmon.exe O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet O4 - HKCU\..\Run: [H/PC Connection Agent] "E:\PROGRA~1\MICROS~2\wcescomm.exe" O4 - Startup: BitTorrent.lnk.disabled O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: D-Link AirPlus Utility.lnk = D:\Program Files\D-Link AirPlus\AIRPLUS.EXE O4 - Global Startup: Microsoft Office.lnk = E:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: Status Monitor.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - E:\PROGRA~1\MICROS~2\INetRepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - E:\PROGRA~1\MICROS~2\INetRepl.dll O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - E:\PROGRA~1\MICROS~2\INetRepl.dll O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Dwighty\Start Menu\Programs\IMVU\Run IMVU.lnk O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll O15 - Trusted Zone: http://aimexpress.aim.com O20 - Winlogon Notify: NavLogon - C:\WINNT\system32\NavLogon.dll O20 - Winlogon Notify: ssp - C:\WINNT\Drivers\ssp.dll O20 - Winlogon Notify: winccf32 - winccf32.dll (file missing) O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINNT\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe O23 - Service: Brother Popup Suspend service for Resource manager (brmfrmps) - Unknown owner - C:\WINNT\system32\Brmfrmps.exe" -service (file missing) O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINNT\system32\brsvc01a.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe O23 - Service: PDEngine - Raxco Software, Inc. - D:\Program Files\Raxco\PerfectDisk\PDEngine.exe O23 - Service: PDScheduler (PDSched) - Raxco Software, Inc. - D:\Program Files\Raxco\PerfectDisk\PDSched.exe O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

10-29-2006, 09:41 PM	#7 (permalink)
fredmh Analyst, Security Team ; TSF Supporter Join Date: May 2006 Location: Phila,Pa Posts: 2,335 OS: XP	You should have a ComboFix2.txt Could you please post that. Deleting from AVG is not a problem.

10-30-2006, 05:53 PM	#8 (permalink)
Achmanage Registered User Join Date: Oct 2006 Posts: 9 OS: XP	ComboFix2.txt showed this: Dwighty - 06-10-29 10:47:58.75 Service Pack 2 ComboFix 06.10.19 - Running from: "C:\Documents and Settings\Dwighty\Desktop" (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINNT\system32\winsys.exe C:\Program Files\Common Files\{D00AC438-07D9-1033-0813-040311280001} ((((((((((((((((((((((((((((((( Files Created from 2006-09-29 to 2006-10-29 )))))))))))))))))))))))))))))))))) 2006-10-20 10:20 3,968 --a------ C:\WINNT\system32\drivers\AvgAsCln.sys 2006-10-20 10:18 816,288 --a------ C:\WINNT\system32\drivers\avg7core.sys 2006-10-20 10:18 4,960 --a------ C:\WINNT\system32\drivers\avgtdi.sys 2006-10-20 10:18 4,224 --a------ C:\WINNT\system32\drivers\avg7rsw.sys 2006-10-20 10:18 3,968 --a------ C:\WINNT\system32\drivers\avgclean.sys 2006-10-20 10:18 28,416 --a------ C:\WINNT\system32\drivers\avg7rsxp.sys 2006-10-20 09:59 67,604 --a------ C:\WINNT\system32\xiabechx.exe (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-10-29 10:48 -------- d-a------ C:\Program Files\Common Files 2006-10-29 08:40 -------- d-a------ C:\Program Files\Symantec AntiVirus 2006-10-29 08:40 -------- d-------- C:\Program Files\QuickTime 2006-10-29 08:37 -------- d-a------ C:\Program Files\Internet Explorer 2006-10-29 08:37 -------- d-a------ C:\Program Files\Google 2006-10-29 08:37 -------- d-a------ C:\Program Files\Common Files\Symantec Shared 2006-10-29 08:37 -------- d-a------ C:\Program Files\Common Files\Raxco 2006-10-29 01:18 -------- d-------- C:\Program Files\CleanUp! 2006-10-24 09:21 -------- d-------- C:\Program Files\MetaStream 2006-10-24 09:20 -------- d-a------ C:\Program Files\Viewpoint 2006-10-21 08:52 -------- d-------- C:\Documents and Settings\Dwighty\Application Data\AVG7 2006-10-20 12:20 -------- d-------- C:\Program Files\SearchRelevant 2006-10-20 10:18 -------- d-------- C:\Program Files\Grisoft 2006-10-20 10:00 -------- d-------- C:\Documents and Settings\Dwighty\Application Data\SearchToolbarCorp 2006-09-15 21:09 -------- d--h----- C:\Program Files\InstallShield Installation Information 2006-08-21 07:21 16896 --a------ C:\WINNT\system32\fltlib.dll 2006-08-21 04:14 23040 --a------ C:\WINNT\system32\fltmc.exe 2006-08-16 16:55 208896 --a--c--- C:\WINNT\system32\nvusmb.exe 2006-08-16 16:55 208896 --a--c--- C:\WINNT\system32\nvunrm.exe 2006-08-16 16:55 208896 --a--c--- C:\WINNT\system32\NVUNINST.EXE 2006-08-16 16:55 208896 --a--c--- C:\WINNT\system32\nvuide.exe 2006-08-16 16:55 208896 --a--c--- C:\WINNT\system32\nvugart.exe 2006-08-16 16:55 208896 --a--c--- C:\WINNT\system32\nvuaudio.exe 2006-08-16 16:55 208896 --a------ C:\WINNT\system32\nvudisp.exe 2006-08-11 20:45 888832 --a------ C:\WINNT\system32\nvmobls.dll 2006-08-11 20:45 581632 --a------ C:\WINNT\system32\nvhwvid.dll 2006-08-11 20:45 5611520 --a------ C:\WINNT\system32\nvdisps.dll 2006-08-11 20:45 5251072 --a------ C:\WINNT\system32\nvdispsr.dll 2006-08-11 20:45 458752 --a------ C:\WINNT\system32\nvmccssr.dll 2006-08-11 20:45 45056 --a------ C:\WINNT\system32\nvmccsrs.dll 2006-08-11 20:45 3039232 --a------ C:\WINNT\system32\nvgames.dll 2006-08-11 20:45 2953216 --a------ C:\WINNT\system32\nvvitvsr.dll 2006-08-11 20:45 2928640 --a------ C:\WINNT\system32\nvgamesr.dll 2006-08-11 20:45 2904064 --a------ C:\WINNT\system32\nvvitvs.dll 2006-08-11 20:45 2859008 --a------ C:\WINNT\system32\nvmoblsr.dll 2006-08-11 20:45 229376 --a------ C:\WINNT\system32\nvmccs.dll 2006-08-11 20:45 188416 --a------ C:\WINNT\system32\nvmccss.dll 2006-08-11 20:45 1732608 --a------ C:\WINNT\system32\nvwssr.dll 2006-08-11 20:45 1236992 --a------ C:\WINNT\system32\nvwss.dll 2006-08-11 20:44 147456 --a------ C:\WINNT\system32\nvcolor.exe 2006-08-11 20:43 86016 --a------ C:\WINNT\system32\nvmctray.dll 2006-08-11 20:43 81920 --a------ C:\WINNT\system32\nvwddi.dll 2006-08-11 20:43 794624 --a------ C:\WINNT\system32\nvcplui.exe 2006-08-11 20:43 7630848 --a------ C:\WINNT\system32\nvcpl.dll 2006-08-11 20:43 466944 --a------ C:\WINNT\system32\nvshell.dll 2006-08-11 20:43 442368 --a------ C:\WINNT\system32\nvappbar.exe 2006-08-11 20:43 425984 --a------ C:\WINNT\system32\keystone.exe 2006-08-11 20:43 311296 --a------ C:\WINNT\system32\nvexpbar.dll 2006-08-11 20:43 286720 --a------ C:\WINNT\system32\nvnt4cpl.dll 2006-08-11 20:43 196608 --a------ C:\WINNT\system32\nvapi.dll 2006-08-11 20:43 1662976 --a------ C:\WINNT\system32\nvwdmcpl.dll 2006-08-11 20:43 1519616 --a------ C:\WINNT\system32\nwiz.exe 2006-08-11 20:43 1470464 --a------ C:\WINNT\system32\nview.dll 2006-08-11 20:43 1339392 --a------ C:\WINNT\system32\nvdspsch.exe 2006-08-11 20:43 1019904 --a------ C:\WINNT\system32\nvwimg.dll 2006-08-11 20:43 1011712 --a------ C:\WINNT\system32\nvcpluir.dll 2006-08-11 20:42 5636096 --a------ C:\WINNT\system32\nvoglnt.dll 2006-08-11 20:42 4496128 --a------ C:\WINNT\system32\nv4_disp.dll 2006-08-11 20:42 35840 --a------ C:\WINNT\system32\nvcodins.dll 2006-08-11 20:42 35840 --a------ C:\WINNT\system32\nvcod.dll 2006-08-11 20:42 155715 --a------ C:\WINNT\system32\nvsvc32.exe (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) Note empty entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "ctfmon.exe"="C:\\WINNT\\system32\\ctfmon.exe" "Yahoo! Pager"="C:\\Program Files\\Yahoo!\\Messenger\\ypager.exe -quiet" "H/PC Connection Agent"="\"E:\\PROGRA~1\\MICROS~2\\wcescomm.exe\"" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\"" "NeroFilterCheck"="C:\\WINNT\\system32\\NeroCheck.exe" "IndexSearch"="C:\\Program Files\\ScanSoft\\PaperPort\\IndexSearch.exe" "ControlCenter2.0"="C:\\Program Files\\Brother\\ControlCenter2\\brctrcen.exe /autorun" "SetDefPrt"="C:\\Program Files\\Brother\\Brmfl04b\\BrStDvPt.exe" "ATICCC"="\"C:\\Program Files\\ATI Technologies\\ATI.ACE\\cli.exe\" runtime -Delay" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "NVRaidService"="C:\\WINNT\\system32\\nvraidservice.exe" "SoundMan"="SOUNDMAN.EXE" "NvCplDaemon"="RUNDLL32.EXE C:\\WINNT\\system32\\NvCpl.dll,NvStartup" "SW20"="C:\\WINNT\\system32\\sw20.exe" "SW24"="C:\\WINNT\\system32\\sw24.exe" "nwiz"="nwiz.exe /install" "NvMediaCenter"="RUNDLL32.EXE C:\\WINNT\\system32\\NvMcTray.dll,NvTaskbarInit" "AVG7_CC"="D:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe /STARTUP" "!AVG Anti-Spyware"="\"D:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonceex] "Flag"=dword:00000002 [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000004 [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" "Flags"=dword:00000002 "Position"=hex:2c,00,00,00,00,01,00,00,00,00,00,00,00,04,00,00,e2,03,00,00,00,\ 00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00 "CurrentState"=hex:04,00,00,c0 "OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\ ff,ff,04,00,00,00 "RestoredStateInfo"=hex:18,00,00,00,f0,01,00,00,1f,00,00,00,80,00,00,00,76,00,\ 00,00,01,00,00,00 [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "AVG7_Run"="D:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE" [HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce] "^SetupICWDesktop"="C:\\Program Files\\Internet Explorer\\Connection Wizard\\icwconn1.exe /desktop" "tscuninstall"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,65,6d,\ 33,32,5c,74,73,63,75,70,67,72,64,2e,65,78,65,00 [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run] "AVG7_Run"="D:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE" [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\runonce] "^SetupICWDesktop"="C:\\Program Files\\Internet Explorer\\Connection Wizard\\icwconn1.exe /desktop" "tscuninstall"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,65,6d,\ 33,32,5c,74,73,63,75,70,67,72,64,2e,65,78,65,00 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 "CDRAutoRun"=dword:00000000 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:000000b5 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run] [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}" "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}" "UPnPMonitor"="{e57ce738-33e8-4c51-8354-bb4de9d215d1}" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "Yahoo! Pager"="C:\\Program Files\\Yahoo!\\Messenger\\ypager.exe -quiet" "msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background" "SpybotSD TeaTimer"="C:\\Program Files\\Spybot - Search & Destroy\\TeaTimer.exe" "ctfmon.exe"="C:\\WINNT\\system32\\ctfmon.exe" "Skype"="\"D:\\Program Files\\Skype\\Phone\\Skype.exe\" /nosplash /minimized" "MySpaceIM"="C:\\Program Files\\MySpace\\IM\\MySpaceIM.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "ATIPTA"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe" "BullsEye Network"="C:\\Program Files\\BullsEye Network\\bin\\bargains.exe" "CloneCDElbyCDFL"="\"D:\\Program Files\\Elaborate Bytes\\CloneCD\\ElbyCheck.exe\" /L ElbyCDFL" "WinampAgent"="D:\\Program Files\\Winamp\\winampa.exe" "NVRaidService"="C:\\WINNT\\System32\\nvraidservice.exe" "SunJavaUpdateSched"="C:\\Program Files\\Java\\j2re1.4.2_05\\bin\\jusched.exe" "vptray"="C:\\PROGRA~1\\SYMANT~1\\VPTray.exe" "Zone Labs Client"="\"D:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe\"" "BearShare"="\"C:\\Program Files\\BearShare\\BearShare.exe\" /pause" "TkBellExe"="\"D:\\Program Files\\Real Alternative\\Update_OB\\realsched.exe\" -osboot" "WinFast Schedule"="E:\\Program Files\\WinFast\\WFTVFM\\WFWIZ.exe" "Tweak UI"="RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp" "Synchronization Manager"="mobsync.exe /logon" "KernelFaultCheck"="%systemroot%\\system32\\dumprep 0 -k" "SSBkgdUpdate"="\"C:\\Program Files\\Common Files\\Scansoft Shared\\SSBkgdUpdate\\SSBkgdupdate.exe\" -Embedding -boot" "SoundMan"="SOUNDMAN.EXE" "PaperPort PTD"="C:\\Program Files\\ScanSoft\\PaperPort\\pptd40nt.exe" "iTunesHelper"="\"E:\\Program Files\\iTunes\\iTunesHelper.exe\"" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "nwiz"="nwiz.exe /install" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^DOCUME~1^ALLUSE~1^Start Menu^Programs^Startup^Microsoft Office.lnk.disabled] "path"="C:\\DOCUME~1\\ALLUSE~1\\Start Menu\\Programs\\Startup\\Microsoft Office.lnk.disabled" "backup"="C:\\WINNT\\pss\\Microsoft Office.lnk.disabledCommon Startup" "location"="Common Startup" "command"="C:\\DOCUME~1\\ALLUSE~1\\Start Menu\\Programs\\Startup\\Microsoft Office.lnk.disabled" "item"="Microsoft Office.lnk" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" ~ ~ ~ ~ ~ ~ ~ ~ Hijackthis Backups ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ backup-20061029-012826-473 O20 - Winlogon Notify: winccf32 - winccf32.dll (file missing) backup-20061029-012826-381 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = backup-20061029-012826-298 O2 - BHO: (no name) - {1DAEFCB9-06C8-47c6-8F20-3FB54B244DAA} - C:\WINNT\system32\jsnuytbr.dll (file missing) Completion time: 06-10-29 10:48:58.68 C:\ComboFix.txt ... 06-10-29 10:48

10-31-2006, 12:43 PM	#11 (permalink)
fredmh Analyst, Security Team ; TSF Supporter Join Date: May 2006 Location: Phila,Pa Posts: 2,335 OS: XP	Please read this post completely before begining the fix. If there's anything that you do not understand, kindly ask your questions before proceeding. Please ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix. IT IS IMPORTANT THAT YOU DON'T MISS A STEP & PERFORM EVERYTHING IN THE RIGHT ORDER. ---------------------------------------- Let's go a little deeper with Jotti: Please submit the following file to Jotti File Scan C:\Program Files\TrueLaunchBar\int\1029\Uninstall.exe At the top of the window you should see "File to Upload & Scan" and a blank box. Copy and paste the red text from above into the box. Then click "submit". When it is finished, please copy and paste the information listed under "Service" and "Scanner Results" back in this thread. ---------------------------------------- Delete the following Files indicated in RED and Folders indicated in BLUE if they still exist. E:\Misc\Backup\WAV to MP3 Encoder\m3_bbi6009.exe C:\WINNT\system32\xiabechx.exe ---------------------------------------- Please clean out your Norton Quarantine. Visit this site Norton quarantine for directions. ---------------------------------------- ComboFix Please run ComboFix one more time 2. Double click combofix.exe & follow the prompts. 3. When finished, it shall produce a log for you. Post that log in your next reply Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall ---------------------------------------- FOLLOW-UP Please return and post these items: Jotti scan ComboFix.txt Please let me know how your system is behaving.

11-01-2006, 08:52 PM	#12 (permalink)
Achmanage Registered User Join Date: Oct 2006 Posts: 9 OS: XP	I'm sorry for the delayed reply. I've been in Tampa on business. here's the scan reports: Service File: Uninstall.exe Status: OK MD5 : 8386a9913bfba6b66020847010b1146e Packers detected: - Scanner results AntiVir: Found nothing ArcaVir: Found nothing Avast: Found nothing AVG Antivirus: Found nothing BitDefender: Found nothing ClamAV: Found nothing Dr.Web: Found nothing F-Prot Antivirus: Found nothing Fortinet: Found nothing Kaspersky Anti-Virus: Found nothing NOD32: Found nothing Norman Virus Control: Found nothing VirusBuster: Found nothing VBA32: Found nothing Combo Fix report: Dwighty - 06-11-01 22:48:03.68 Service Pack 2 ComboFix 06.10.19 - Running from: "C:\Documents and Settings\Dwighty\Desktop" ((((((((((((((((((((((((((((((( Files Created from 2006-10-01 to 2006-11-01 )))))))))))))))))))))))))))))))))) 2006-10-20 10:20 3,968 --a------ C:\WINNT\system32\drivers\AvgAsCln.sys 2006-10-20 10:18 816,672 --a------ C:\WINNT\system32\drivers\avg7core.sys 2006-10-20 10:18 4,960 --a------ C:\WINNT\system32\drivers\avgtdi.sys 2006-10-20 10:18 4,224 --a------ C:\WINNT\system32\drivers\avg7rsw.sys 2006-10-20 10:18 3,968 --a------ C:\WINNT\system32\drivers\avgclean.sys 2006-10-20 10:18 28,416 --a------ C:\WINNT\system32\drivers\avg7rsxp.sys (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-10-31 10:41 -------- d-a------ C:\Program Files\Symantec AntiVirus 2006-10-31 04:50 -------- d-a------ C:\Program Files\Java 2006-10-29 10:48 -------- d-a------ C:\Program Files\Common Files 2006-10-29 08:40 -------- d-------- C:\Program Files\QuickTime 2006-10-29 08:37 -------- d-a------ C:\Program Files\Internet Explorer 2006-10-29 08:37 -------- d-a------ C:\Program Files\Google 2006-10-29 08:37 -------- d-a------ C:\Program Files\Common Files\Symantec Shared 2006-10-29 08:37 -------- d-a------ C:\Program Files\Common Files\Raxco 2006-10-29 01:18 -------- d-------- C:\Program Files\CleanUp! 2006-10-24 09:21 -------- d-------- C:\Program Files\MetaStream 2006-10-21 08:52 -------- d-------- C:\Documents and Settings\Dwighty\Application Data\AVG7 2006-10-20 10:18 -------- d-------- C:\Program Files\Grisoft 2006-09-15 21:09 -------- d--h----- C:\Program Files\InstallShield Installation Information 2006-08-21 07:21 16896 --a------ C:\WINNT\system32\fltlib.dll 2006-08-21 04:14 23040 --a------ C:\WINNT\system32\fltmc.exe 2006-08-16 16:55 208896 --a--c--- C:\WINNT\system32\nvusmb.exe 2006-08-16 16:55 208896 --a--c--- C:\WINNT\system32\nvunrm.exe 2006-08-16 16:55 208896 --a--c--- C:\WINNT\system32\NVUNINST.EXE 2006-08-16 16:55 208896 --a--c--- C:\WINNT\system32\nvuide.exe 2006-08-16 16:55 208896 --a--c--- C:\WINNT\system32\nvugart.exe 2006-08-16 16:55 208896 --a--c--- C:\WINNT\system32\nvuaudio.exe 2006-08-16 16:55 208896 --a------ C:\WINNT\system32\nvudisp.exe 2006-08-11 20:45 888832 --a------ C:\WINNT\system32\nvmobls.dll 2006-08-11 20:45 581632 --a------ C:\WINNT\system32\nvhwvid.dll 2006-08-11 20:45 5611520 --a------ C:\WINNT\system32\nvdisps.dll 2006-08-11 20:45 5251072 --a------ C:\WINNT\system32\nvdispsr.dll 2006-08-11 20:45 458752 --a------ C:\WINNT\system32\nvmccssr.dll 2006-08-11 20:45 45056 --a------ C:\WINNT\system32\nvmccsrs.dll 2006-08-11 20:45 3039232 --a------ C:\WINNT\system32\nvgames.dll 2006-08-11 20:45 2953216 --a------ C:\WINNT\system32\nvvitvsr.dll 2006-08-11 20:45 2928640 --a------ C:\WINNT\system32\nvgamesr.dll 2006-08-11 20:45 2904064 --a------ C:\WINNT\system32\nvvitvs.dll 2006-08-11 20:45 2859008 --a------ C:\WINNT\system32\nvmoblsr.dll 2006-08-11 20:45 229376 --a------ C:\WINNT\system32\nvmccs.dll 2006-08-11 20:45 188416 --a------ C:\WINNT\system32\nvmccss.dll 2006-08-11 20:45 1732608 --a------ C:\WINNT\system32\nvwssr.dll 2006-08-11 20:45 1236992 --a------ C:\WINNT\system32\nvwss.dll 2006-08-11 20:44 147456 --a------ C:\WINNT\system32\nvcolor.exe 2006-08-11 20:43 86016 --a------ C:\WINNT\system32\nvmctray.dll 2006-08-11 20:43 81920 --a------ C:\WINNT\system32\nvwddi.dll 2006-08-11 20:43 794624 --a------ C:\WINNT\system32\nvcplui.exe 2006-08-11 20:43 7630848 --a------ C:\WINNT\system32\nvcpl.dll 2006-08-11 20:43 466944 --a------ C:\WINNT\system32\nvshell.dll 2006-08-11 20:43 442368 --a------ C:\WINNT\system32\nvappbar.exe 2006-08-11 20:43 425984 --a------ C:\WINNT\system32\keystone.exe 2006-08-11 20:43 311296 --a------ C:\WINNT\system32\nvexpbar.dll 2006-08-11 20:43 286720 --a------ C:\WINNT\system32\nvnt4cpl.dll 2006-08-11 20:43 196608 --a------ C:\WINNT\system32\nvapi.dll 2006-08-11 20:43 1662976 --a------ C:\WINNT\system32\nvwdmcpl.dll 2006-08-11 20:43 1519616 --a------ C:\WINNT\system32\nwiz.exe 2006-08-11 20:43 1470464 --a------ C:\WINNT\system32\nview.dll 2006-08-11 20:43 1339392 --a------ C:\WINNT\system32\nvdspsch.exe 2006-08-11 20:43 1019904 --a------ C:\WINNT\system32\nvwimg.dll 2006-08-11 20:43 1011712 --a------ C:\WINNT\system32\nvcpluir.dll 2006-08-11 20:42 5636096 --a------ C:\WINNT\system32\nvoglnt.dll 2006-08-11 20:42 4496128 --a------ C:\WINNT\system32\nv4_disp.dll 2006-08-11 20:42 35840 --a------ C:\WINNT\system32\nvcodins.dll 2006-08-11 20:42 35840 --a------ C:\WINNT\system32\nvcod.dll 2006-08-11 20:42 155715 --a------ C:\WINNT\system32\nvsvc32.exe (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) Note empty entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "ctfmon.exe"="C:\\WINNT\\system32\\ctfmon.exe" "Yahoo! Pager"="C:\\Program Files\\Yahoo!\\Messenger\\ypager.exe -quiet" "H/PC Connection Agent"="\"E:\\PROGRA~1\\MICROS~2\\wcescomm.exe\"" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\"" "NeroFilterCheck"="C:\\WINNT\\system32\\NeroCheck.exe" "IndexSearch"="C:\\Program Files\\ScanSoft\\PaperPort\\IndexSearch.exe" "ControlCenter2.0"="C:\\Program Files\\Brother\\ControlCenter2\\brctrcen.exe /autorun" "SetDefPrt"="C:\\Program Files\\Brother\\Brmfl04b\\BrStDvPt.exe" "ATICCC"="\"C:\\Program Files\\ATI Technologies\\ATI.ACE\\cli.exe\" runtime -Delay" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "NVRaidService"="C:\\WINNT\\system32\\nvraidservice.exe" "SoundMan"="SOUNDMAN.EXE" "NvCplDaemon"="RUNDLL32.EXE C:\\WINNT\\system32\\NvCpl.dll,NvStartup" "SW20"="C:\\WINNT\\system32\\sw20.exe" "SW24"="C:\\WINNT\\system32\\sw24.exe" "nwiz"="nwiz.exe /install" "NvMediaCenter"="RUNDLL32.EXE C:\\WINNT\\system32\\NvMcTray.dll,NvTaskbarInit" "AVG7_CC"="D:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe /STARTUP" "!AVG Anti-Spyware"="\"D:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized" "SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_09\\bin\\jusched.exe\"" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonceex] "Flag"=dword:00000002 [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000005 [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" "Flags"=dword:00000002 "Position"=hex:2c,00,00,00,77,01,00,00,00,00,00,00,89,03,00,00,e2,03,00,00,00,\ 00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00 "CurrentState"=hex:04,00,00,c0 "OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\ ff,ff,04,00,00,00 "RestoredStateInfo"=hex:18,00,00,00,f0,01,00,00,1f,00,00,00,80,00,00,00,76,00,\ 00,00,01,00,00,00 [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "AVG7_Run"="D:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE" [HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce] "^SetupICWDesktop"="C:\\Program Files\\Internet Explorer\\Connection Wizard\\icwconn1.exe /desktop" "tscuninstall"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,65,6d,\ 33,32,5c,74,73,63,75,70,67,72,64,2e,65,78,65,00 [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run] "AVG7_Run"="D:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE" [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\runonce] "^SetupICWDesktop"="C:\\Program Files\\Internet Explorer\\Connection Wizard\\icwconn1.exe /desktop" "tscuninstall"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,65,6d,\ 33,32,5c,74,73,63,75,70,67,72,64,2e,65,78,65,00 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 "CDRAutoRun"=dword:00000000 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:000000b5 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run] [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}" "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}" "UPnPMonitor"="{e57ce738-33e8-4c51-8354-bb4de9d215d1}" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "Yahoo! Pager"="C:\\Program Files\\Yahoo!\\Messenger\\ypager.exe -quiet" "msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background" "SpybotSD TeaTimer"="C:\\Program Files\\Spybot - Search & Destroy\\TeaTimer.exe" "ctfmon.exe"="C:\\WINNT\\system32\\ctfmon.exe" "Skype"="\"D:\\Program Files\\Skype\\Phone\\Skype.exe\" /nosplash /minimized" "MySpaceIM"="C:\\Program Files\\MySpace\\IM\\MySpaceIM.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "ATIPTA"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe" "CloneCDElbyCDFL"="\"D:\\Program Files\\Elaborate Bytes\\CloneCD\\ElbyCheck.exe\" /L ElbyCDFL" "WinampAgent"="D:\\Program Files\\Winamp\\winampa.exe" "NVRaidService"="C:\\WINNT\\System32\\nvraidservice.exe" "SunJavaUpdateSched"="C:\\Program Files\\Java\\j2re1.4.2_05\\bin\\jusched.exe" "vptray"="C:\\PROGRA~1\\SYMANT~1\\VPTray.exe" "Zone Labs Client"="\"D:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe\"" "BearShare"="\"C:\\Program Files\\BearShare\\BearShare.exe\" /pause" "TkBellExe"="\"D:\\Program Files\\Real Alternative\\Update_OB\\realsched.exe\" -osboot" "WinFast Schedule"="E:\\Program Files\\WinFast\\WFTVFM\\WFWIZ.exe" "Tweak UI"="RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp" "Synchronization Manager"="mobsync.exe /logon" "KernelFaultCheck"="%systemroot%\\system32\\dumprep 0 -k" "SSBkgdUpdate"="\"C:\\Program Files\\Common Files\\Scansoft Shared\\SSBkgdUpdate\\SSBkgdupdate.exe\" -Embedding -boot" "SoundMan"="SOUNDMAN.EXE" "PaperPort PTD"="C:\\Program Files\\ScanSoft\\PaperPort\\pptd40nt.exe" "iTunesHelper"="\"E:\\Program Files\\iTunes\\iTunesHelper.exe\"" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "nwiz"="nwiz.exe /install" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^DOCUME~1^ALLUSE~1^Start Menu^Programs^Startup^Microsoft Office.lnk.disabled] "path"="C:\\DOCUME~1\\ALLUSE~1\\Start Menu\\Programs\\Startup\\Microsoft Office.lnk.disabled" "backup"="C:\\WINNT\\pss\\Microsoft Office.lnk.disabledCommon Startup" "location"="Common Startup" "command"="C:\\DOCUME~1\\ALLUSE~1\\Start Menu\\Programs\\Startup\\Microsoft Office.lnk.disabled" "item"="Microsoft Office.lnk" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" Completion time: 06-11-01 22:48:47.28 C:\ComboFix.txt ... 06-11-01 22:48 C:\ComboFix2.txt ... 06-11-01 11:06 C:\ComboFix3.txt ... 06-10-30 19:53 I didn't even know I had Norton on this machine because I don't use it and I don't remember installing it and I can't find it on here. Was there something in the HJT log that suggested it is present? The computer's acting a whole lot better! I don't get any more pop-ups and the machine is moving fast again. AVG and Symantec are still reporting viruses, though. One in particular is something like Trogan.Byte.Verify but that was last night's report. I'll see if it shows up tomorrow.

11-04-2006, 10:25 PM	#14 (permalink)
Achmanage Registered User Join Date: Oct 2006 Posts: 9 OS: XP	Kaspersky wouldn't load for me yesterday. I think it was my internet being weird. We're good now, though. ------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT Sunday, November 05, 2006 12:22:05 AM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.83.0 Kaspersky Anti-Virus database last update: 5/11/2006 Kaspersky Anti-Virus database records: 238359 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ E:\ F:\ G:\ Scan Statistics: Total number of scanned objects: 126545 Number of viruses found: 5 Number of infected objects: 6 / 0 Number of suspicious objects: 8 Duration of the scan process: 01:42:50 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\All Users\Application Data\AVG7\Log\emc.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy1.zip/msexreg.exe Suspicious: Password-protected-EXE skipped C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy1.zip ZIP: suspicious - 1 skipped C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy18.zip/msexreg.exe Suspicious: Password-protected-EXE skipped C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy18.zip ZIP: suspicious - 1 skipped C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy35.zip/msexreg.exe Suspicious: Password-protected-EXE skipped C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy35.zip ZIP: suspicious - 1 skipped C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy53.zip/msexreg.exe Suspicious: Password-protected-EXE skipped C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy53.zip ZIP: suspicious - 1 skipped C:\Documents and Settings\Dwighty\Application Data\$_hpcst$.hpc Object is locked skipped C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\cert8.db Object is locked skipped C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\formhistory.dat Object is locked skipped C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\history.dat Object is locked skipped C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\key3.db Object is locked skipped C:\Documents and Settings\Dwighty\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\parent.lock Object is locked skipped C:\Documents and Settings\Dwighty\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Dwighty\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Dwighty\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Dwighty\Local Settings\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\Cache\_CACHE_001_ Object is locked skipped C:\Documents and Settings\Dwighty\Local Settings\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\Cache\_CACHE_002_ Object is locked skipped C:\Documents and Settings\Dwighty\Local Settings\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\Cache\_CACHE_003_ Object is locked skipped C:\Documents and Settings\Dwighty\Local Settings\Application Data\Mozilla\Firefox\Profiles\lzsuonfn.Default User2\Cache\_CACHE_MAP_ Object is locked skipped C:\Documents and Settings\Dwighty\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Dwighty\Local Settings\History\History.IE5\MSHist012006110420061105\index.dat Object is locked skipped C:\Documents and Settings\Dwighty\Local Settings\Temp\WCESLog.log Object is locked skipped C:\Documents and Settings\Dwighty\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Dwighty\NTUSER.DAT Object is locked skipped C:\Documents and Settings\Dwighty\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Dwighty\UserData\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT.LOG Object is locked skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{A2ABDB74-DCA4-4F98-B140-576F82D20398}\RP512\A0097836.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ek skipped C:\System Volume Information\_restore{A2ABDB74-DCA4-4F98-B140-576F82D20398}\RP512\A0098289.dll Infected: not-a-virus:AdWare.Win32.Searchcolor.a skipped C:\System Volume Information\_restore{A2ABDB74-DCA4-4F98-B140-576F82D20398}\RP516\A0099519.exe Infected: not-a-virus:AdWare.Win32.Searchcolor.a skipped C:\System Volume Information\_restore{A2ABDB74-DCA4-4F98-B140-576F82D20398}\RP518\change.log Object is locked skipped C:\WINNT\Debug\PASSWD.LOG Object is locked skipped C:\WINNT\SchedLgU.Txt Object is locked skipped C:\WINNT\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINNT\Sti_Trace.log Object is locked skipped C:\WINNT\system32\config\ACEEvent.evt Object is locked skipped C:\WINNT\system32\config\AppEvent.Evt Object is locked skipped C:\WINNT\system32\config\default Object is locked skipped C:\WINNT\system32\config\default.LOG Object is locked skipped C:\WINNT\system32\config\SAM Object is locked skipped C:\WINNT\system32\config\SAM.LOG Object is locked skipped C:\WINNT\system32\config\SecEvent.Evt Object is locked skipped C:\WINNT\system32\config\SECURITY Object is locked skipped C:\WINNT\system32\config\SECURITY.LOG Object is locked skipped C:\WINNT\system32\config\software Object is locked skipped C:\WINNT\system32\config\software.LOG Object is locked skipped C:\WINNT\system32\config\SysEvent.Evt Object is locked skipped C:\WINNT\system32\config\system Object is locked skipped C:\WINNT\system32\config\system.LOG Object is locked skipped C:\WINNT\system32\h323log.txt Object is locked skipped C:\WINNT\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINNT\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINNT\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINNT\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINNT\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINNT\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINNT\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINNT\wiadebug.log Object is locked skipped C:\WINNT\wiaservc.log Object is locked skipped C:\WINNT\WindowsUpdate.log Object is locked skipped D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped D:\System Volume Information\_restore{A2ABDB74-DCA4-4F98-B140-576F82D20398}\RP518\change.log Object is locked skipped E:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped E:\System Volume Information\_restore{A2ABDB74-DCA4-4F98-B140-576F82D20398}\RP516\A0099522.exe/data0002 Infected: not-a-virus:AdWare.Win32.BargainBuddy.v skipped E:\System Volume Information\_restore{A2ABDB74-DCA4-4F98-B140-576F82D20398}\RP516\A0099522.exe/data0003 Infected: not-a-virus:AdWare.Win32.BargainBuddy.a skipped E:\System Volume Information\_restore{A2ABDB74-DCA4-4F98-B140-576F82D20398}\RP516\A0099522.exe NSIS: infected - 2 skipped Scan process completed. Logfile of HijackThis v1.99.1 Scan saved at 12:22:53 AM, on 11/5/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\svchost.exe C:\WINNT\system32\brsvc01a.exe C:\WINNT\system32\brss01a.exe C:\WINNT\system32\spoolsv.exe D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\WINNT\system32\Brmfrmps.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINNT\system32\nvsvc32.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\mspmspsv.exe D:\Program Files\Raxco\PerfectDisk\PDSched.exe C:\WINNT\Explorer.EXE C:\Program Files\QuickTime\qttask.exe C:\WINNT\system32\nvraidservice.exe C:\WINNT\SOUNDMAN.EXE C:\WINNT\system32\RUNDLL32.EXE D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe C:\WINNT\system32\ctfmon.exe E:\PROGRA~1\MICROS~2\wcescomm.exe E:\PROGRA~1\MICROS~2\rapimgr.exe C:\WINNT\system32\wbem\unsecapp.exe D:\Program Files\D-Link AirPlus\AIRPLUS.EXE C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe C:\WINNT\System32\svchost.exe C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe C:\Program Files\Brother\Brmfcmon\BrMfcmon.exe C:\WINNT\system32\wuauclt.exe D:\Program Files\Mozilla Firefox\firefox.exe D:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe C:\HJT\manage.exe O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl04b\BrStDvPt.exe O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [NVRaidService] C:\WINNT\system32\nvraidservice.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [SW20] C:\WINNT\system32\sw20.exe O4 - HKLM\..\Run: [SW24] C:\WINNT\system32\sw24.exe O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [AVG7_CC] D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [!AVG Anti-Spyware] "D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\system32\ctfmon.exe O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet O4 - HKCU\..\Run: [H/PC Connection Agent] "E:\PROGRA~1\MICROS~2\wcescomm.exe" O4 - Startup: BitTorrent.lnk.disabled O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: D-Link AirPlus Utility.lnk = D:\Program Files\D-Link AirPlus\AIRPLUS.EXE O4 - Global Startup: Microsoft Office.lnk = E:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: Status Monitor.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - E:\PROGRA~1\MICROS~2\INetRepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - E:\PROGRA~1\MICROS~2\INetRepl.dll O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - E:\PROGRA~1\MICROS~2\INetRepl.dll O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Dwighty\Start Menu\Programs\IMVU\Run IMVU.lnk O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\winnt\system32\ua_lsp.dll O15 - Trusted Zone: http://aimexpress.aim.com O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINNT\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe O23 - Service: Brother Popup Suspend service for Resource manager (brmfrmps) - Unknown owner - C:\WINNT\system32\Brmfrmps.exe" -service (file missing) O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINNT\system32\brsvc01a.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe O23 - Service: PDEngine - Raxco Software, Inc. - D:\Program Files\Raxco\PerfectDisk\PDEngine.exe O23 - Service: PDScheduler (PDSched) - Raxco Software, Inc. - D:\Program Files\Raxco\PerfectDisk\PDSched.exe

11-05-2006, 10:51 PM	#16 (permalink)
Achmanage Registered User Join Date: Oct 2006 Posts: 9 OS: XP	Awesome! Thank you so much for helping me clean my system!

11-05-2006, 10:52 PM	#17 (permalink)
fredmh Analyst, Security Team ; TSF Supporter Join Date: May 2006 Location: Phila,Pa Posts: 2,335 OS: XP	You're quite welcome.