Welcome to Tech Support Forum home to more then 136,000 problems solved. Issues have included: Spyware, Malware, Virus Issues, Windows, Microsoft, Linux, Networking, Security, Hardware, and Gaming Getting your problem solved is as easy as:
1. Registering for a free account
2. Asking your question
3. Receiving an answer

Registered members:
* Get free support
* Communicate privately with other members (PM).
* Removal of this message
* See fewer ads.
* And much more..

 


Want to know how to post a question? click here Having problems with spyware and pop-ups? First Steps
Go Back   Tech Support Forum > Security Center > Virus/Trojan/Spyware Help > Resolved HJT Threads
Reload this Page Winfixer HELP!!!!
User Name
Password
Site Map Register Donate Rules Blogs Mark Forums Read


Resolved HJT Threads Resolved spyware and popup issues.

 
Page 2 of 3 1 2 3
 
LinkBack Thread Tools
Old 07-05-2007, 01:26 PM   #21 (permalink)
Registered User
 
Join Date: Jul 2007
Posts: 22
OS: windows xp


Re: Winfixer HELP!!!!
Yes, it all worked, but i just can't copy it for you. What I meant was everything was ok.
dangvirus is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Important Information
Join the #1 Tech Support Forum Today - It's Totally Free!

TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free.

Join TechSupportforum.com Today - Click Here

Old 07-05-2007, 01:28 PM   #22 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,479
OS: 2000 Pro; XP Pro; XP Home


Re: Winfixer HELP!!!!
Sorry, but I'm not following you.

If you were able to run ComboFix by using the script I had you create, it should have run and eventually created a new log, C:\ComboFix.txt

Why can you not post that?
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 07-05-2007, 01:34 PM   #23 (permalink)
Registered User
 
Join Date: Jul 2007
Posts: 22
OS: windows xp


Re: Winfixer HELP!!!!
Oh, sorry, the combo worked, but after that the script for the notepad did not appear for some reason so I tried to copy paste the combo screen but it did not let me, sorry
dangvirus is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 07-05-2007, 01:35 PM   #24 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,479
OS: 2000 Pro; XP Pro; XP Home


Re: Winfixer HELP!!!!
Erm, please locate and post C:\ComboFix.txt
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 07-05-2007, 01:40 PM   #25 (permalink)
Registered User
 
Join Date: Jul 2007
Posts: 22
OS: windows xp


Re: Winfixer HELP!!!!
Dang it, im so sorry, I got it now, i accidently saved it under a different name here ya go. Sorry again, you sure got patience.

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-05 14:30:12
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
dangvirus is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 07-05-2007, 01:45 PM   #26 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,479
OS: 2000 Pro; XP Pro; XP Home


Re: Winfixer HELP!!!!
Ok, let's try this again....

What you've posted is a partial copy.

press Ctrl+A to select all, Ctrl+C to copy all, then Ctrl+V to paste all into a thread.
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 07-05-2007, 01:51 PM   #27 (permalink)
Registered User
 
Join Date: Jul 2007
Posts: 22
OS: windows xp


Re: Winfixer HELP!!!!
That is all there was but I found this on another script called combofix-quarantine-files.txt, otherwise thats all that came up. Again sorry for the inconvenience.

Code:
2005-10-07 09:00      1239    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\ALLUSE~1\APPLIC~1\Starware\buttons\referencehotxp.png.vir
2005-10-07 09:00      1267    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\ALLUSE~1\APPLIC~1\Starware\buttons\highlightxp.png.vir
2005-10-07 09:00      1272    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\ALLUSE~1\APPLIC~1\Starware\buttons\HighlightHot.bmp.vir
2005-10-07 09:00      1286    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\ALLUSE~1\APPLIC~1\Starware\buttons\Highlight.bmp.vir
2005-10-07 09:00      1392    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\ALLUSE~1\APPLIC~1\Starware\buttons\Reference.bmp.vir
2005-10-07 09:00      1392    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\ALLUSE~1\APPLIC~1\Starware\buttons\ReferenceHot.bmp.vir
2005-10-07 09:00      1420    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\ALLUSE~1\APPLIC~1\Starware\buttons\FindIt.bmp.vir
2005-10-07 09:00      1420    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\ALLUSE~1\APPLIC~1\Starware\buttons\FindItHot.bmp.vir
2005-10-07 09:00      1492    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\ALLUSE~1\APPLIC~1\Starware\buttons\finditxp.png.vir
2005-10-07 09:00      1568    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\ALLUSE~1\APPLIC~1\Starware\buttons\weatherxp.png.vir
2005-10-07 09:00      372    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\ALLUSE~1\APPLIC~1\Starware\buttons\logo.bmp.vir
2005-10-07 09:00      372    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\ALLUSE~1\APPLIC~1\Starware\buttons\logoxp.bmp.vir
2005-10-07 09:00      553    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\ALLUSE~1\APPLIC~1\Starware\buttons\highlighthotxp.png.vir
2005-10-07 09:00      596    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\ALLUSE~1\APPLIC~1\Starware\buttons\screensaver.bmp.vir
2005-10-07 09:00      837    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\ALLUSE~1\APPLIC~1\Starware\buttons\findithotxp.png.vir
2005-10-07 09:00      862    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\ALLUSE~1\APPLIC~1\Starware\buttons\weatherhotxp.png.vir
2005-10-07 09:00      924    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\ALLUSE~1\APPLIC~1\Starware\buttons\referencexp.png.vir
2005-10-14 17:06      1016    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\ALLUSE~1\APPLIC~1\Starware\buttons\Weather.bmp.vir
2005-10-14 17:06      1412    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\ALLUSE~1\APPLIC~1\Starware\buttons\games.bmp.vir
2005-10-14 17:06      322    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\ALLUSE~1\APPLIC~1\Starware\buttons\cursorcafe.bmp.vir
2006-02-10 17:06      344    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\ALLUSE~1\APPLIC~1\Starware\contexts\error.xml.vir
2006-07-05 17:58      3832    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\ALLUSE~1\APPLIC~1\Starware\SimpleUpdate\SimpleUpdateConfig.xml.backup.vir
2006-07-05 17:58      3832    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\ALLUSE~1\APPLIC~1\Starware\SimpleUpdate\SimpleUpdateConfig.xml.vir
2006-07-05 17:58      52680    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\ALLUSE~1\APPLIC~1\Starware\contexts\travel.xml.vir
2006-07-05 17:58      64672    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\ALLUSE~1\APPLIC~1\Starware\contexts\related.xml.vir
2006-07-05 17:58      944    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\ALLUSE~1\APPLIC~1\Starware\images\walertXP.bmp.vir
2006-07-08 22:47      112    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\dad\APPLIC~1\Starware\Weather\AlertArchive.xml.vir
2006-07-08 22:47      1192    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\dad\APPLIC~1\Starware\Manager\ManagerOptions.xml.backup.vir
2006-07-08 22:47      1192    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\dad\APPLIC~1\Starware\Manager\ManagerOptions.xml.vir
2006-07-08 22:47      14120    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\dad\APPLIC~1\Starware\Weather\WeatherOptions.xml.backup.vir
2006-07-08 22:47      14120    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\dad\APPLIC~1\Starware\Weather\WeatherOptions.xml.vir
2006-07-08 22:47      2632    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\dad\APPLIC~1\Starware\ErrorSearch\ErrorSearchOptions.xml.backup.vir
2006-07-08 22:47      2632    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\dad\APPLIC~1\Starware\ErrorSearch\ErrorSearchOptions.xml.vir
2006-07-08 22:47      2632    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\dad\APPLIC~1\Starware\TravelSearch\TravelSearchOptions.xml.backup.vir
2006-07-08 22:47      2632    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\dad\APPLIC~1\Starware\TravelSearch\TravelSearchOptions.xml.vir
2006-07-08 22:47      2784    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\dad\APPLIC~1\Starware\Layouts\ToolbarLayout.xml.backup.vir
2006-07-08 22:47      2784    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\dad\APPLIC~1\Starware\Layouts\ToolbarLayout.xml.vir
2006-07-08 22:47      2808    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\dad\APPLIC~1\Starware\RelatedSearch\RelatedSearchOptions.xml.backup.vir
2006-07-08 22:47      2808    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\dad\APPLIC~1\Starware\RelatedSearch\RelatedSearchOptions.xml.vir
2006-07-08 22:47      2840    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\dad\APPLIC~1\Starware\SearchMatch\SearchMatchOptions.xml.backup.vir
2006-07-08 22:47      2840    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\dad\APPLIC~1\Starware\SearchMatch\SearchMatchOptions.xml.vir
2006-07-08 22:47      2928    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\dad\APPLIC~1\Starware\SearchAssistPlus\SearchAssistPlusOptions.xml.backup.vir
2006-07-08 22:47      2928    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\dad\APPLIC~1\Starware\SearchAssistPlus\SearchAssistPlusOptions.xml.vir
2006-07-08 22:47      4000    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\dad\APPLIC~1\Starware\Reference\ReferenceOptions.xml.backup.vir
2006-07-08 22:47      4000    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\dad\APPLIC~1\Starware\Reference\ReferenceOptions.xml.vir
2006-07-08 22:47      4008    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\dad\APPLIC~1\Starware\BrowserSearch\BrowserSearch.xml.backup.vir
2006-07-08 22:47      4008    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\dad\APPLIC~1\Starware\BrowserSearch\BrowserSearch.xml.vir
2006-07-08 22:47      4528    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\dad\APPLIC~1\Starware\Layouts\PreferencesLayout.xml.backup.vir
2006-07-08 22:47      4528    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\dad\APPLIC~1\Starware\Layouts\PreferencesLayout.xml.vir
2006-07-08 22:47      6208    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\dad\APPLIC~1\Starware\ToolbarSearch\ToolbarSearchOptions.xml.backup.vir
2006-07-08 22:47      6208    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\dad\APPLIC~1\Starware\ToolbarSearch\ToolbarSearchOptions.xml.vir
2006-07-08 22:47      7304    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\dad\APPLIC~1\Starware\ToolbarLogo\ToolbarLogoOptions.xml.backup.vir
2006-07-08 22:47      7304    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\dad\APPLIC~1\Starware\ToolbarLogo\ToolbarLogoOptions.xml.vir
2006-07-08 22:47      888    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\dad\APPLIC~1\Starware\Toolbar\TBProductsOptions.xml.backup.vir
2006-07-08 22:47      888    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\dad\APPLIC~1\Starware\Toolbar\TBProductsOptions.xml.vir
2006-07-10 11:28      336    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\ALLUSE~1\APPLIC~1\Starware\SimpleUpdate\ProductMessagingConfig.xml.backup.vir
2006-07-10 11:28      336    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\ALLUSE~1\APPLIC~1\Starware\SimpleUpdate\ProductMessagingConfig.xml.vir
2006-07-21 22:32      2104    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\dad\APPLIC~1\Starware\Movies\MoviesOptions.xml.backup.vir
2006-07-21 22:32      2104    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\dad\APPLIC~1\Starware\Movies\MoviesOptions.xml.vir
2006-07-21 22:32      2760    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\dad\APPLIC~1\Starware\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml.backup.vir
2006-07-21 22:32      2760    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\dad\APPLIC~1\Starware\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml.vir
2006-07-21 22:32      3192    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\dad\APPLIC~1\Starware\Screensavers\ScreensaversOptions.xml.backup.vir
2006-07-21 22:32      3192    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\dad\APPLIC~1\Starware\Screensavers\ScreensaversOptions.xml.vir
2006-08-02 23:18      2616    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\dad\APPLIC~1\Starware\Games\GamesOptions.xml.backup.vir
2006-08-02 23:18      2616    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\dad\APPLIC~1\Starware\Games\GamesOptions.xml.vir
2006-08-09 13:33      1208    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\ALLUSE~1\APPLIC~1\Starware\buttons\gamesA.bmp.vir
2006-08-09 13:33      1654    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\ALLUSE~1\APPLIC~1\Starware\buttons\moviesA.bmp.vir
2006-08-09 13:33      584    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\ALLUSE~1\APPLIC~1\Starware\buttons\cursorcafeA.bmp.vir
2006-08-09 13:33      648    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\ALLUSE~1\APPLIC~1\Starware\buttons\screensaverA.bmp.vir
2006-08-10 11:27      1560    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\ALLUSE~1\APPLIC~1\Starware\SimpleUpdate\TimerManagerConfig.xml.backup.vir
2006-08-10 11:27      1560    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\ALLUSE~1\APPLIC~1\Starware\SimpleUpdate\TimerManagerConfig.xml.vir
2007-01-20 15:50      0    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\steve\APPLIC~1\Install.dat.vir
2007-01-23 09:25      0    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\dad\APPLIC~1\Install.dat.vir
2007-02-13 18:11      27607    --a------    C:\Qoobox\Quarantine\C\Program Files\Video ActiveX Object\uninst.exe.vir
2007-02-13 18:11      4286    --a------    C:\Qoobox\Quarantine\C\Program Files\Video ActiveX Object\ot.ico.vir
2007-02-13 18:11      4286    --a------    C:\Qoobox\Quarantine\C\Program Files\Video ActiveX Object\ts.ico.vir
2007-04-18 18:54      2    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\netstat.com.vir
2007-04-18 18:54      2    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\taskkill.com.vir
2007-05-14 20:39      398    --a------    C:\Qoobox\Quarantine\C\WINDOWS\wr.txt.vir
2007-05-18 04:39      23870    --a------    C:\Qoobox\Quarantine\C\WINDOWS\privacy_danger\images\capt.gif.vir
2007-05-18 04:39      47318    --a------    C:\Qoobox\Quarantine\C\WINDOWS\privacy_danger\images\danger.jpg.vir
2007-05-18 04:40      14916    --a------    C:\Qoobox\Quarantine\C\WINDOWS\privacy_danger\images\down.gif.vir
2007-05-18 04:44      43    --a------    C:\Qoobox\Quarantine\C\WINDOWS\privacy_danger\images\spacer.gif.vir
2007-06-18 20:39      1127    --a------    C:\Qoobox\Quarantine\C\WINDOWS\privacy_danger\index.htm.vir
2007-06-29 05:59      217088    --a------    C:\Qoobox\Quarantine\C\WINDOWS\ddesupport.dll.vir
2007-06-29 05:59      22016    --a------    C:\Qoobox\Quarantine\C\WINDOWS\main_uninstaller.exe.vir
2007-06-29 05:59      53760    --a------    C:\Qoobox\Quarantine\C\WINDOWS\msole.dll.vir
2007-06-29 05:59      74752    --a------    C:\Qoobox\Quarantine\C\WINDOWS\msdde.dll.vir
2007-06-29 11:50      4286    --a------    C:\Qoobox\Quarantine\C\Program Files\NewMediaCodec\install.ico.vir
2007-06-29 13:27      153600    --a------    C:\Qoobox\Quarantine\C\Program Files\NewMediaCodec\NewMediaCodec.ocx.vir
2007-06-29 13:27      37033    --a------    C:\Qoobox\Quarantine\C\Program Files\NewMediaCodec\Uninstall.exe.vir
2007-06-29 13:31      21504    --a------    C:\Qoobox\Quarantine\C\WINDOWS\avp.exe.vir
2007-06-29 13:32      12288    --a------    C:\Qoobox\Quarantine\C\WINDOWS\mgrs.exe.vir
2007-06-29 14:59      226    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\dad\FAVORI~1\Error Cleaner.url.vir
2007-06-29 14:59      226    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\dad\FAVORI~1\Privacy Protector.url.vir
2007-06-29 14:59      226    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\dad\FAVORI~1\Spyware&Malware Protection.url.vir
2007-07-04 17:12      18250    --a------    C:\Qoobox\Quarantine\C\WINDOWS\rs.txt.vir
2007-07-05 11:45      226    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\dad\Desktop\Error Cleaner.url.vir
2007-07-05 11:45      226    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\dad\Desktop\Privacy Protector.url.vir
2007-07-05 11:45      226    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\dad\Desktop\Spyware&Malware Protection.url.vir
2007-07-05 12:21      3309    --a------    C:\Qoobox\Quarantine\C\WINDOWS\dat.txt.vir


Folder PATH listing
Volume serial number is 00F3-C005
C:\QOOBOX
\---Quarantine
    +---C
    |   +---DOCUME~1
    |   |   +---ALLUSE~1
    |   |   |   \---APPLIC~1
    |   |   |       \---Starware
    |   |   |           +---buttons
    |   |   |           |       cursorcafe.bmp.vir
    |   |   |           |       cursorcafeA.bmp.vir
    |   |   |           |       FindIt.bmp.vir
    |   |   |           |       FindItHot.bmp.vir
    |   |   |           |       findithotxp.png.vir
    |   |   |           |       finditxp.png.vir
    |   |   |           |       games.bmp.vir
    |   |   |           |       gamesA.bmp.vir
    |   |   |           |       Highlight.bmp.vir
    |   |   |           |       HighlightHot.bmp.vir
    |   |   |           |       highlighthotxp.png.vir
    |   |   |           |       highlightxp.png.vir
    |   |   |           |       logo.bmp.vir
    |   |   |           |       logoxp.bmp.vir
    |   |   |           |       moviesA.bmp.vir
    |   |   |           |       Reference.bmp.vir
    |   |   |           |       ReferenceHot.bmp.vir
    |   |   |           |       referencehotxp.png.vir
    |   |   |           |       referencexp.png.vir
    |   |   |           |       screensaver.bmp.vir
    |   |   |           |       screensaverA.bmp.vir
    |   |   |           |       Weather.bmp.vir
    |   |   |           |       weatherhotxp.png.vir
    |   |   |           |       weatherxp.png.vir
    |   |   |           |       
    |   |   |           +---contexts
    |   |   |           |       error.xml.vir
    |   |   |           |       related.xml.vir
    |   |   |           |       travel.xml.vir
    |   |   |           |       
    |   |   |           +---images
    |   |   |           |       walertXP.bmp.vir
    |   |   |           |       
    |   |   |           \---SimpleUpdate
    |   |   |                   ProductMessagingConfig.xml.backup.vir
    |   |   |                   ProductMessagingConfig.xml.vir
    |   |   |                   SimpleUpdateConfig.xml.backup.vir
    |   |   |                   SimpleUpdateConfig.xml.vir
    |   |   |                   TimerManagerConfig.xml.backup.vir
    |   |   |                   TimerManagerConfig.xml.vir
    |   |   |                   
    |   |   +---dad
    |   |   |   +---APPLIC~1
    |   |   |   |   |   Install.dat.vir
    |   |   |   |   |   
    |   |   |   |   \---Starware
    |   |   |   |       +---BrowserSearch
    |   |   |   |       |       BrowserSearch.xml.backup.vir
    |   |   |   |       |       BrowserSearch.xml.vir
    |   |   |   |       |       
    |   |   |   |       +---ErrorSearch
    |   |   |   |       |       ErrorSearchOptions.xml.backup.vir
    |   |   |   |       |       ErrorSearchOptions.xml.vir
    |   |   |   |       |       
    |   |   |   |       +---Games
    |   |   |   |       |       GamesOptions.xml.backup.vir
    |   |   |   |       |       GamesOptions.xml.vir
    |   |   |   |       |       
    |   |   |   |       +---Layouts
    |   |   |   |       |       PreferencesLayout.xml.backup.vir
    |   |   |   |       |       PreferencesLayout.xml.vir
    |   |   |   |       |       ToolbarLayout.xml.backup.vir
    |   |   |   |       |       ToolbarLayout.xml.vir
    |   |   |   |       |       
    |   |   |   |       +---Manager
    |   |   |   |       |       ManagerOptions.xml.backup.vir
    |   |   |   |       |       ManagerOptions.xml.vir
    |   |   |   |       |       
    |   |   |   |       +---Movies
    |   |   |   |       |       MoviesOptions.xml.backup.vir
    |   |   |   |       |       MoviesOptions.xml.vir
    |   |   |   |       |       
    |   |   |   |       +---Reference
    |   |   |   |       |       ReferenceOptions.xml.backup.vir
    |   |   |   |       |       ReferenceOptions.xml.vir
    |   |   |   |       |       
    |   |   |   |       +---RelatedSearch
    |   |   |   |       |       RelatedSearchOptions.xml.backup.vir
    |   |   |   |       |       RelatedSearchOptions.xml.vir
    |   |   |   |       |       
    |   |   |   |       +---Screensavers
    |   |   |   |       |       ScreensaversOptions.xml.backup.vir
    |   |   |   |       |       ScreensaversOptions.xml.vir
    |   |   |   |       |       
    |   |   |   |       +---ScreensaversMarketingSitePager
    |   |   |   |       |       ScreensaversMarketingSitePagerOptions.xml.backup.vir
    |   |   |   |       |       ScreensaversMarketingSitePagerOptions.xml.vir
    |   |   |   |       |       
    |   |   |   |       +---SearchAssistPlus
    |   |   |   |       |       SearchAssistPlusOptions.xml.backup.vir
    |   |   |   |       |       SearchAssistPlusOptions.xml.vir
    |   |   |   |       |       
    |   |   |   |       +---SearchMatch
    |   |   |   |       |       SearchMatchOptions.xml.backup.vir
    |   |   |   |       |       SearchMatchOptions.xml.vir
    |   |   |   |       |       
    |   |   |   |       +---Toolbar
    |   |   |   |       |       TBProductsOptions.xml.backup.vir
    |   |   |   |       |       TBProductsOptions.xml.vir
    |   |   |   |       |       
    |   |   |   |       +---ToolbarLogo
    |   |   |   |       |       ToolbarLogoOptions.xml.backup.vir
    |   |   |   |       |       ToolbarLogoOptions.xml.vir
    |   |   |   |       |       
    |   |   |   |       +---ToolbarSearch
    |   |   |   |       |       ToolbarSearchOptions.xml.backup.vir
    |   |   |   |       |       ToolbarSearchOptions.xml.vir
    |   |   |   |       |       
    |   |   |   |       +---TravelSearch
    |   |   |   |       |       TravelSearchOptions.xml.backup.vir
    |   |   |   |       |       TravelSearchOptions.xml.vir
    |   |   |   |       |       
    |   |   |   |       \---Weather
    |   |   |   |               AlertArchive.xml.vir
    |   |   |   |               WeatherOptions.xml.backup.vir
    |   |   |   |               WeatherOptions.xml.vir
    |   |   |   |               
    |   |   |   +---Desktop
    |   |   |   |       Error Cleaner.url.vir
    |   |   |   |       Privacy Protector.url.vir
    |   |   |   |       Spyware&Malware Protection.url.vir
    |   |   |   |       
    |   |   |   \---FAVORI~1
    |   |   |           Error Cleaner.url.vir
    |   |   |           Privacy Protector.url.vir
    |   |   |           Spyware&Malware Protection.url.vir
    |   |   |           
    |   |   \---steve
    |   |       \---APPLIC~1
    |   |               Install.dat.vir
    |   |               
    |   +---Program Files
    |   |   +---NewMediaCodec
    |   |   |       install.ico.vir
    |   |   |       NewMediaCodec.ocx.vir
    |   |   |       Uninstall.exe.vir
    |   |   |       
    |   |   \---Video ActiveX Object
    |   |           ot.ico.vir
    |   |           ts.ico.vir
    |   |           uninst.exe.vir
    |   |           
    |   \---WINDOWS
    |       |   avp.exe.vir
    |       |   dat.txt.vir
    |       |   ddesupport.dll.vir
    |       |   main_uninstaller.exe.vir
    |       |   mgrs.exe.vir
    |       |   msdde.dll.vir
    |       |   msole.dll.vir
    |       |   rs.txt.vir
    |       |   wr.txt.vir
    |       |   
    |       +---privacy_danger
    |       |   |   index.htm.vir
    |       |   |   
    |       |   \---images
    |       |           capt.gif.vir
    |       |           danger.jpg.vir
    |       |           down.gif.vir
    |       |           spacer.gif.vir
    |       |           
    |       \---system32
    |               netstat.com.vir
    |               taskkill.com.vir
    |               
    \---Registry_backups
Last edited by dangvirus; 07-05-2007 at 01:53 PM.
dangvirus is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 07-05-2007, 01:58 PM   #28 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,479
OS: 2000 Pro; XP Pro; XP Home


Re: Winfixer HELP!!!!
Ok, I'm going to go on the assumption that it did not run correctly last time.

I've attached a file to this post, CFScript.txt

Download it to your desktop, drag it onto ComboFix.exe and allow ComboFix to run

When ComboFix has finished running, a notepad file (log.txt) shall appear. Copy/paste the content of that file in your next reply.

If for some reason you close log.txt before posting it, the file will then be located at C:\ComboFix.txt
Attached Files
File Type: txt CFScript.txt (726 Bytes, 3 views)
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 07-05-2007, 02:33 PM   #29 (permalink)
Registered User
 
Join Date: Jul 2007
Posts: 22
OS: windows xp


Re: Winfixer HELP!!!!
I dragged the script to the catchme x, and it worked. it did the scan on th c:\ black box and when it finished it showed this. I still cant give it to ya, but i'll type it out.

c:\ComboFix\catchme.cfexe
catchme 0.3.915 W2K/XP/Vista-rootkit detector by Gmer, http://www.gmer.net windows 5.1.2600 service pack 2 NTFS

scanning hidden processes...

scanning hidden services...

scanning hidden autostart entries...

scanning hidden files...

scan completed successfully
hidden processes:0
hidden services:0
hidden files:0

thats all I can do if i dragged the script to the right place, but the catchme.cfexe looked like the right one, there were other red x's to drag to but they didn't look right. I just can't get anymore than this
Last edited by dangvirus; 07-05-2007 at 02:36 PM.
dangvirus is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 07-05-2007, 02:41 PM   #30 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,479
OS: 2000 Pro; XP Pro; XP Home


Re: Winfixer HELP!!!!
Ok, here's the thing.

A while back, you had ComboFix.exe on your desktop, right? One big red X.

For some reason now, you're looking at C:\ComboFix folder, which should not be present unless you interrupted ComboFix's run.

Please delete C:\ComboFix folder.

Do you still have the ComboFix.exe big red X on your desktop?
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 07-05-2007, 02:50 PM   #31 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,479
OS: 2000 Pro; XP Pro; XP Home


Re: Winfixer HELP!!!!
Right....this is proving a bit more difficult than it should, so let's change tactics, OK?

I have attached a file to this post - dangvirusfix.zip Download this file to your desktop. Double click on the zip folder, then double click on the reg file within. Click yes to allow it to merge into your registry.

Delete these folders if they still exist:

C:\WINDOWS\privacy_danger(2)
C:\WINDOWS\privacy_danger(3)
C:\Program Files\Seekmo Programs

Run Deckard's System Scanner once again, and post it's resulting log, main.txt
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
Last edited by tetonbob; 10-17-2007 at 08:48 PM.
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 07-05-2007, 02:57 PM   #32 (permalink)
Registered User
 
Join Date: Jul 2007
Posts: 22
OS: windows xp


Re: Winfixer HELP!!!!
Done.
dangvirus is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 07-05-2007, 02:59 PM   #33 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,479
OS: 2000 Pro; XP Pro; XP Home


Re: Winfixer HELP!!!!
Note quite


Quote:
Run Deckard's System Scanner once again, and post it's resulting log, main.txt
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 07-05-2007, 03:04 PM   #34 (permalink)
Registered User
 
Join Date: Jul 2007
Posts: 22
OS: windows xp


Re: Winfixer HELP!!!!
got it

Deckard's System Scanner v20070611.50
Run by dad on 2007-07-05 at 17:01:08
Computer is in Normal Mode.
--------------------------------------------------------------------------------



-- HijackThis (run as dad.exe) -------------------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 5:01:13 PM, on 7/5/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\System32\GEARSec.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\PROGRA~1\McAfee\MPS\mps.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\Program Files\Norton Ghost\Agent\VProSvc.exe
C:\Program Files\McAfee\MPS\mpsevh.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\CTHELPER.EXE
C:\WINDOWS\system32\CTXFIHLP.EXE
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Norton Ghost\Agent\GhostTray.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Dell Photo AIO Printer 944\dlcdmon.exe
C:\Program Files\Dell Photo AIO Printer 944\memcard.exe
C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE
C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\McAfee\MSK\MskAgent.exe
C:\Program Files\SiteAdvisor\6066\SiteAdv.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\SiteAdvisor\6066\SAService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\dlcdcoms.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\dad\Local Settings\Temporary Internet Files\Content.IE5\25O3ED25\dss[1].exe
C:\PROGRA~1\HIJACK~1\dad.exe

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\program files\mcafee\virusscan\scriptcl.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [AudioDrvEmulator] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Norton Ghost 10.0] "C:\Program Files\Norton Ghost\Agent\GhostTray.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [dlcdmon.exe] "C:\Program Files\Dell Photo AIO Printer 944\dlcdmon.exe"
O4 - HKLM\..\Run: [MemoryCardManager] "C:\Program Files\Dell Photo AIO Printer 944\memcard.exe"
O4 - HKLM\..\Run: [CTDVDDET] "C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE"
O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe" /r
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MskAgentexe] C:\Program Files\McAfee\MSK\MskAgent.exe
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6066\SiteAdv.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/sh...1/mcinsctl.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Black Box Installer (BlackBoxInstallerService) - Unknown owner - C:\Program Files\M-Audio Black Box\Install\BlackBoxInst.exe (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: dlcd_device - - C:\WINDOWS\system32\dlcdcoms.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe
O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Norton Ghost\Agent\VProSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SiteAdvisor Service - McAfee, Inc. - C:\Program Files\SiteAdvisor\6066\SAService.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe


-- Files created between 2007-06-05 and 2007-07-05 -----------------------------

2007-07-05 14:58:43 53248 --a------ C:\WINDOWS\system32\Process.exe <Not Verified; http://www.beyondlogic.org; Command Line Process Utility>
2007-07-05 13:51:27 0 d-------- C:\WINDOWS\system32\appmgmt
2007-07-05 13:15:39 3726 --a------ C:\WINDOWS\system32\tmp.reg
2007-07-05 13:14:50 288417 --a------ C:\WINDOWS\system32\SrchSTS.exe <Not Verified; S!Ri; SrchSTS>
2007-07-05 13:14:50 51200 --a------ C:\WINDOWS\system32\dumphive.exe
2007-07-05 11:37:26 0 d-------- C:\WINDOWS\privacy_danger(2)
2007-07-05 11:15:06 0 d-------- C:\WINDOWS\privacy_danger(3)
2007-07-01 21:21:33 0 d-------- C:\Documents and Settings\steve\Application Data\McAfee


-- Find3M Report ---------------------------------------------------------------

2007-07-05 15:21:18 4184 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys
2007-07-05 15:21:18 56 -r-hs---- C:\WINDOWS\system32\7C27710655.sys
2007-07-05 14:04:58 0 d-------- C:\Program Files\thriXXX
2007-07-05 12:34:59 14498 --a------ C:\Program Files\ComboFix2.txt
2007-07-05 11:19:20 0 d-------- C:\Program Files\McAfee
2007-07-04 14:57:15 0 d-------- C:\Program Files\AWS
2007-06-30 15:22:18 0 d-------- C:\Program Files\Maxis
2007-06-21 20:03:37 0 d-------- C:\Program Files\Dl_cats
2007-06-14 1655 0 d-------- C:\Program Files\ArtMoney
2007-06-03 13:50:10 0 d-------- C:\Program Files\Microsoft Games
2007-05-09 22:58:37 0 d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-04-16 12:14:59 30 --a------ C:\WINDOWS\popcinfo.dat


-- Registry Dump ---------------------------------------------------------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{02478D38-C3F9-4EFB-9B51-7695ECA05670} C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
{089FD14D-132B-48FC-8861-0048AE113215} C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
{5CA3D70E-1895-11CF-8E15-001234567890} C:\WINDOWS\System32\DLA\DLASHX_W.DLL
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
{7DB2D5A0-7241-4E79-B68D-6309F01C5231} c:\program files\mcafee\virusscan\scriptcl.dll
{9030D464-4C02-4ABF-8ECC-5164760863C6} C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
{AA58ED58-01DD-4d91-8333-CF10577473F7} c:\program files\google\googletoolbar4.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"CTHelper"="CTHELPER.EXE"
"CTxfiHlp"="CTXFIHLP.EXE"
"IAAnotif"="C:\\Program Files\\Intel\\Intel Matrix Storage Manager\\iaanotif.exe"
"ATIPTA"="\"C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe\""
"DMXLauncher"="C:\\Program Files\\Dell\\Media Experience\\DMXLauncher.exe"
"AudioDrvEmulator"="\"C:\\Program Files\\Creative\\Shared Files\\Module Loader\\DLLML.exe\" -1 AudioDrvEmulator \"C:\\Program Files\\Creative\\Shared Files\\Module Loader\\Audio Emulator\\AudDrvEm.dll\""
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"Norton Ghost 10.0"="\"C:\\Program Files\\Norton Ghost\\Agent\\GhostTray.exe\""
"ISUSPM Startup"="\"C:\\Program Files\\Common Files\\InstallShield\\UpdateService\\isuspm.exe\" -startup"
"ISUSScheduler"="\"C:\\Program Files\\Common Files\\InstallShield\\UpdateService\\issch.exe\" -start"
"dlcdmon.exe"="\"C:\\Program Files\\Dell Photo AIO Printer 944\\dlcdmon.exe\""
"MemoryCardManager"="\"C:\\Program Files\\Dell Photo AIO Printer 944\\memcard.exe\""
"CTDVDDET"="\"C:\\Program Files\\Creative\\Sound Blaster X-Fi\\DVDAudio\\CTDVDDET.EXE\""
"VolPanel"="\"C:\\Program Files\\Creative\\Sound Blaster X-Fi\\Volume Panel\\VolPanel.exe\" /r"
"MMTray"="\"C:\\Program Files\\Musicmatch\\Musicmatch Jukebox\\mm_tray.exe\""
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"MskAgentexe"="C:\\Program Files\\McAfee\\MSK\\MskAgent.exe"
"SiteAdvisor"="C:\\Program Files\\SiteAdvisor\\6066\\SiteAdv.exe"
"SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_11\\bin\\jusched.exe"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\1.2.1128.5462\\GoogleToolbarNotifier.exe"
"DellSupport"="\"C:\\Program Files\\DellSupport\\DSAgnt.exe\" /startup"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"=hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,52,65,73,6f,75,72,\
63,65,73,5c,54,68,65,6d,65,73,5c,52,6f,79,61,6c,65,5c,52,6f,79,61,6c,65,2e,\
6d,73,73,74,79,6c,65,73,00
"InstallTheme"=hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,52,65,73,6f,75,72,63,65,\
73,5c,54,68,65,6d,65,73,5c,52,6f,79,61,6c,65,2e,74,68,65,6d,65,00

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, xlibgfl254.dll"

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
Authentication Packages REG_MULTI_SZ msv1_0\0\0
Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0
Notification Packages REG_MULTI_SZ scecli\0\0

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\MCODS

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
Usnsvc REG_MULTI_SZ usnsvc\0\0


[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}]
Shell\AutoRun\command E:\setup.exe


-- End of Deckard's System Scanner: finished at 2007-07-05 at 17:01:33 ---------
dangvirus is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 07-05-2007, 03:07 PM   #35 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,479
OS: 2000 Pro; XP Pro; XP Home


Re: Winfixer HELP!!!!
These folders still exist, did you have trouble finding and deleting them before?

C:\WINDOWS\privacy_danger(2)
C:\WINDOWS\privacy_danger(3)

Please locate and delete them, and confirm.
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 07-05-2007, 03:14 PM   #36 (permalink)
Registered User
 
Join Date: Jul 2007
Posts: 22
OS: windows xp


Re: Winfixer HELP!!!!
I deleted both now and I hope they never come back
dangvirus is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 07-05-2007, 03:17 PM   #37 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,479
OS: 2000 Pro; XP Pro; XP Home


Re: Winfixer HELP!!!!
LOL, me too.

Let's use this online scanner to look for any remnants. If you have questions, ask before proceeding, please:

Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner

Answer Yes, when prompted to install an ActiveX component.
  • The program will then begin downloading the latest definition files.
  • Once the files have been downloaded click on NEXT
  • Locate the Scan Settings button & configure to:
    • Scan using the following Anti-Virus database:
      • Extended
    • Scan Options:
      • Scan Archives
      • Scan Mail Bases
  • Click OK & have it scan My Computer
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Click the Save as Text button to save the file to your desktop so that you may post it in your next reply
* Turn off the real time scanner of any existing antivirus program while performing the online scan

Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the licence, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%.

---------------------------------------------------------------------------------------------

Also run Deckard's System Scanner once again, and post it's log.
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 07-05-2007, 05:43 PM   #38 (permalink)
Registered User
 
Join Date: Jul 2007
Posts: 22
OS: windows xp


Re: Winfixer HELP!!!!
Finally here it is

KASPERSKY ONLINE SCANNER REPORT
Thursday, July 05, 2007 7:35:26 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.93.0
Kaspersky Anti-Virus database last update: 6/07/2007
Kaspersky Anti-Virus database records: 358777


Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true

Scan Target My Computer
C:\
D:\
E:\
F:\
G:\
H:\
I:\
J:\
K:\

Scan Statistics
Total number of scanned objects 93949
Number of viruses found 9
Number of infected objects 17
Number of suspicious objects 0
Duration of the scan process 01:15:19

Infected Object Name Virus Name Last Action
C:\Documents and Settings\All Users\Application Data\McAfee\MNA\NAData Object is locked skipped

C:\Documents and Settings\All Users\Application Data\McAfee\MPF\data\log.edb Object is locked skipped

C:\Documents and Settings\All Users\Application Data\McAfee\MSC\Logs\Events.dat Object is locked skipped

C:\Documents and Settings\All Users\Application Data\McAfee\MSC\Logs\{7B6B4714-560C-4518-9FD5-5203B710E6BF}.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\McAfee\MSC\Logs\{A8D64BF3-3C7D-46C1-ADD1-C77E0F73952C}.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\McAfee\MSC\McUsers.dat Object is locked skipped

C:\Documents and Settings\All Users\Application Data\McAfee\MSK\MSKWMDB.dat Object is locked skipped

C:\Documents and Settings\All Users\Application Data\McAfee\MSK\RBLDB.dat Object is locked skipped

C:\Documents and Settings\All Users\Application Data\McAfee\MSK\settingsdb.dat Object is locked skipped

C:\Documents and Settings\All Users\Application Data\McAfee\VirusScan\Data\TFR2.tmp Object is locked skipped

C:\Documents and Settings\All Users\Application Data\McAfee\VirusScan\Logs\OAS.Log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3ad391678a806ec4d691e83aaa393b6f_24adf822-76f7-4481-b30b-ff1b40f8687f Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\8788de7389644a9da0ab73661aa5862d_24adf822-76f7-4481-b30b-ff1b40f8687f Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a5b70be27637ee6e5cf5a677d47acb21_24adf822-76f7-4481-b30b-ff1b40f8687f Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\eHome\logs\ehRecvr.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped

C:\Documents and Settings\dad\Application Data\Gtek\GTUpdate\AUpdate\DellSupport\DSAgnt.log Object is locked skipped

C:\Documents and Settings\dad\Application Data\Gtek\GTUpdate\AUpdate\DellSupport\DSAgnt_GTActions.log Object is locked skipped

C:\Documents and Settings\dad\Application Data\Gtek\GTUpdate\AUpdate\DellSupport\gdql_d_DSAgnt.log Object is locked skipped

C:\Documents and Settings\dad\Application Data\Gtek\GTUpdate\AUpdate\DellSupport\glog.log Object is locked skipped

C:\Documents and Settings\dad\Application Data\SiteAdvisor\SiteAdv.csh Object is locked skipped

C:\Documents and Settings\dad\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\dad\Desktop\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped

C:\Documents and Settings\dad\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\dad\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\dad\Local Settings\History\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\dad\Local Settings\Temp\Perflib_Perfdata_c38.dat Object is locked skipped

C:\Documents and Settings\dad\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\dad\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\dad\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\steve\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\omfge.class-8438415-292ab2e8.class Infected: Trojan-Downloader.Java.OpenStream.y skipped

C:\Documents and Settings\steve\Local Settings\Temp\ac8zt2\edi.exe Infected: not-a-virus:AdWare.Win32.Agent.bn skipped

C:\Documents and Settings\steve\Local Settings\Temp\BIT184.tmp Infected: Trojan-Downloader.Win32.Agent.bwq skipped

C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll Object is locked skipped

C:\Program Files\DIGStream\digstream.exe Infected: not-a-virus:Downloader.Win32.DigStream skipped

C:\QooBox\Quarantine\C\Program Files\NewMediaCodec\NewMediaCodec.ocx.vir Infected: Trojan.Win32.Agent.ahq skipped

C:\QooBox\Quarantine\C\Program Files\Video ActiveX Object\uninst.exe.vir Infected: Trojan-Downloader.Win32.Zlob.bon skipped

C:\QooBox\Quarantine\C\WINDOWS\avp.exe.vir Infected: Trojan-Downloader.Win32.Agent.bwq skipped

C:\QooBox\Quarantine\C\WINDOWS\ddesupport.dll.vir Infected: not-a-virus:AdWare.Win32.Agent.bn skipped

C:\QooBox\Quarantine\C\WINDOWS\mgrs.exe.vir Infected: Trojan-Downloader.Win32.Alphabet.gen skipped

C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP10\A0000090.ocx Infected: Trojan.Win32.Agent.ahq skipped

C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP10\A0000094.exe Infected: Trojan-Downloader.Win32.Zlob.bon skipped

C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP10\A0000097.exe Infected: Trojan-Downloader.Win32.Agent.bwq skipped

C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP10\A0000098.exe Infected: Trojan-Downloader.Win32.Alphabet.gen skipped

C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP10\A0000102.dll Infected: not-a-virus:AdWare.Win32.Agent.bn skipped

C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP11\A0000215.dll Infected: not-a-virus:AdWare.Win32.Agent.c skipped

C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP11\A0000216.exe Infected: not-a-virus:AdWare.Win32.Agent.c skipped

C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP11\change.log Object is locked skipped

C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

C:\WINDOWS\ModemLog_Conexant D850 56K V.9x DFVc Modem.txt Object is locked skipped

C:\WINDOWS\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{61E25E60-C4E7-49B5-90BE-0C8729CBB82B}.crmlog Object is locked skipped

C:\WINDOWS\SchedLgU.Txt Object is locked skipped

C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped

C:\WINDOWS\Sti_Trace.log Object is locked skipped

C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped

C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped

C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\DEFAULT Object is locked skipped

C:\WINDOWS\system32\config\default.LOG Object is locked skipped

C:\WINDOWS\system32\config\Media Ce.evt Object is locked skipped

C:\WINDOWS\system32\config\SAM Object is locked skipped

C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\SECURITY Object is locked skipped

C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped

C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped

C:\WINDOWS\system32\config\software.LOG Object is locked skipped

C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\SYSTEM Object is locked skipped

C:\WINDOWS\system32\config\system.LOG Object is locked skipped

C:\WINDOWS\system32\h323log.txt Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped

C:\WINDOWS\Temp\mcafee_2kidoqVK352HNLp Object is locked skipped

C:\WINDOWS\Temp\mcmsc_akBHGr5iD0PpyBq Object is locked skipped

C:\WINDOWS\Temp\mcmsc_CbPgroRzy7Q62aq Object is locked skipped

C:\WINDOWS\Temp\mcmsc_D3VMZrcIalvYnYU Object is locked skipped

C:\WINDOWS\Temp\mcmsc_h3P855YiDKYd6Vc Object is locked skipped

C:\WINDOWS\Temp\mcmsc_jGYWtBExxE4VvAL Object is locked skipped

C:\WINDOWS\Temp\mcmsc_kwuT8k9I7aNtcRD Object is locked skipped

C:\WINDOWS\Temp\Perflib_Perfdata_59c.dat Object is locked skipped

C:\WINDOWS\Temp\sqlite_4HKNOsIZVgRlXZU Object is locked skipped

C:\WINDOWS\Temp\sqlite_5aAQZgqcH75PcqA Object is locked skipped

C:\WINDOWS\Temp\sqlite_8hheB2abwZmXCav Object is locked skipped

C:\WINDOWS\Temp\sqlite_BGoWaR2D67urNz0 Object is locked skipped

C:\WINDOWS\Temp\sqlite_wt6R5lb8xlIWufk Object is locked skipped

C:\WINDOWS\Temp\sqlite_yhBvCA2pdo49m9P Object is locked skipped

C:\WINDOWS\wiadebug.log Object is locked skipped

C:\WINDOWS\wiaservc.log Object is locked skipped

C:\WINDOWS\WindowsUpdate.log Object is locked skipped

D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

D:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP11\change.log Object is locked skipped

Scan process completed.


THIS IS THE DSS


Deckard's System Scanner v20070611.50
Run by dad on 2007-07-05 at 19:37:41
Computer is in Normal Mode.
--------------------------------------------------------------------------------



-- HijackThis (run as dad.exe) -------------------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 7:37:48 PM, on 7/5/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\System32\GEARSec.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\PROGRA~1\McAfee\MPS\mps.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\Program Files\Norton Ghost\Agent\VProSvc.exe
C:\Program Files\McAfee\MPS\mpsevh.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\CTHELPER.EXE
C:\WINDOWS\system32\CTXFIHLP.EXE
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Norton Ghost\Agent\GhostTray.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Dell Photo AIO Printer 944\dlcdmon.exe
C:\Program Files\Dell Photo AIO Printer 944\memcard.exe
C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE
C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\McAfee\MSK\MskAgent.exe
C:\Program Files\SiteAdvisor\6066\SiteAdv.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\SiteAdvisor\6066\SAService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\dlcdcoms.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
C:\WINDOWS\explorer.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Documents and Settings\dad\Local Settings\Temporary Internet Files\Content.IE5\6RY7Q9AR\dss[1].exe
C:\PROGRA~1\HIJACK~1\dad.exe

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\program files\mcafee\virusscan\scriptcl.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [AudioDrvEmulator] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Norton Ghost 10.0] "C:\Program Files\Norton Ghost\Agent\GhostTray.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [dlcdmon.exe] "C:\Program Files\Dell Photo AIO Printer 944\dlcdmon.exe"
O4 - HKLM\..\Run: [MemoryCardManager] "C:\Program Files\Dell Photo AIO Printer 944\memcard.exe"
O4 - HKLM\..\Run: [CTDVDDET] "C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE"
O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe" /r
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MskAgentexe] C:\Program Files\McAfee\MSK\MskAgent.exe
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6066\SiteAdv.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/sh...1/mcinsctl.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Black Box Installer (BlackBoxInstallerService) - Unknown owner - C:\Program Files\M-Audio Black Box\Install\BlackBoxInst.exe (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: dlcd_device - - C:\WINDOWS\system32\dlcdcoms.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe
O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Norton Ghost\Agent\VProSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SiteAdvisor Service - McAfee, Inc. - C:\Program Files\SiteAdvisor\6066\SAService.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe


-- Files created between 2007-06-05 and 2007-07-05 -----------------------------

2007-07-05 17:33:26 0 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-07-05 17:33:25 0 d-------- C:\WINDOWS\system32\Kaspersky Lab
2007-07-05 17:33:24 0 d-------- C:\WINDOWS\LastGood
2007-07-05 14:58:43 53248 --a------ C:\WINDOWS\system32\Process.exe <Not Verified; http://www.beyondlogic.org; Command Line Process Utility>
2007-07-05 13:51:27 0 d-------- C:\WINDOWS\system32\appmgmt
2007-07-05 13:15:39 3726 --a------ C:\WINDOWS\system32\tmp.reg
2007-07-05 13:14:50 288417 --a------ C:\WINDOWS\system32\SrchSTS.exe <Not Verified; S!Ri; SrchSTS>
2007-07-05 13:14:50 51200 --a------ C:\WINDOWS\system32\dumphive.exe
2007-07-05 11:37:26 0 d-------- C:\WINDOWS\privacy_danger(2)
2007-07-01 21:21:33 0 d-------- C:\Documents and Settings\steve\Application Data\McAfee


-- Find3M Report ---------------------------------------------------------------

2007-07-05 15:21:18 4184 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys
2007-07-05 15:21:18 56 -r-hs---- C:\WINDOWS\system32\7C27710655.sys
2007-07-05 14:04:58 0 d-------- C:\Program Files\thriXXX
2007-07-05 12:34:59 14498 --a------ C:\Program Files\ComboFix2.txt
2007-07-05 11:19:20 0 d-------- C:\Program Files\McAfee
2007-07-04 14:57:15 0 d-------- C:\Program Files\AWS
2007-06-30 15:22:18 0 d-------- C:\Program Files\Maxis
2007-06-21 20:03:37 0 d-------- C:\Program Files\Dl_cats
2007-06-14 1655 0 d-------- C:\Program Files\ArtMoney
2007-06-03 13:50:10 0 d-------- C:\Program Files\Microsoft Games
2007-05-09 22:58:37 0 d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-04-16 12:14:59 30 --a------ C:\WINDOWS\popcinfo.dat


-- Registry Dump ---------------------------------------------------------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{02478D38-C3F9-4EFB-9B51-7695ECA05670} C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
{089FD14D-132B-48FC-8861-0048AE113215} C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
{5CA3D70E-1895-11CF-8E15-001234567890} C:\WINDOWS\System32\DLA\DLASHX_W.DLL
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
{7DB2D5A0-7241-4E79-B68D-6309F01C5231} c:\program files\mcafee\virusscan\scriptcl.dll
{9030D464-4C02-4ABF-8ECC-5164760863C6} C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
{AA58ED58-01DD-4d91-8333-CF10577473F7} c:\program files\google\googletoolbar4.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"CTHelper"="CTHELPER.EXE"
"CTxfiHlp"="CTXFIHLP.EXE"
"IAAnotif"="C:\\Program Files\\Intel\\Intel Matrix Storage Manager\\iaanotif.exe"
"ATIPTA"="\"C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe\""
"DMXLauncher"="C:\\Program Files\\Dell\\Media Experience\\DMXLauncher.exe"
"AudioDrvEmulator"="\"C:\\Program Files\\Creative\\Shared Files\\Module Loader\\DLLML.exe\" -1 AudioDrvEmulator \"C:\\Program Files\\Creative\\Shared Files\\Module Loader\\Audio Emulator\\AudDrvEm.dll\""
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"Norton Ghost 10.0"="\"C:\\Program Files\\Norton Ghost\\Agent\\GhostTray.exe\""
"ISUSPM Startup"="\"C:\\Program Files\\Common Files\\InstallShield\\UpdateService\\isuspm.exe\" -startup"
"ISUSScheduler"="\"C:\\Program Files\\Common Files\\InstallShield\\UpdateService\\issch.exe\" -start"
"dlcdmon.exe"="\"C:\\Program Files\\Dell Photo AIO Printer 944\\dlcdmon.exe\""
"MemoryCardManager"="\"C:\\Program Files\\Dell Photo AIO Printer 944\\memcard.exe\""
"CTDVDDET"="\"C:\\Program Files\\Creative\\Sound Blaster X-Fi\\DVDAudio\\CTDVDDET.EXE\""
"VolPanel"="\"C:\\Program Files\\Creative\\Sound Blaster X-Fi\\Volume Panel\\VolPanel.exe\" /r"
"MMTray"="\"C:\\Program Files\\Musicmatch\\Musicmatch Jukebox\\mm_tray.exe\""
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"MskAgentexe"="C:\\Program Files\\McAfee\\MSK\\MskAgent.exe"
"SiteAdvisor"="C:\\Program Files\\SiteAdvisor\\6066\\SiteAdv.exe"
"SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_11\\bin\\jusched.exe"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\1.2.1128.5462\\GoogleToolbarNotifier.exe"
"DellSupport"="\"C:\\Program Files\\DellSupport\\DSAgnt.exe\" /startup"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"=hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,52,65,73,6f,75,72,\
63,65,73,5c,54,68,65,6d,65,73,5c,52,6f,79,61,6c,65,5c,52,6f,79,61,6c,65,2e,\
6d,73,73,74,79,6c,65,73,00
"InstallTheme"=hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,52,65,73,6f,75,72,63,65,\
73,5c,54,68,65,6d,65,73,5c,52,6f,79,61,6c,65,2e,74,68,65,6d,65,00

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, xlibgfl254.dll"

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
Authentication Packages REG_MULTI_SZ msv1_0\0\0
Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0
Notification Packages REG_MULTI_SZ scecli\0\0

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\MCODS

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
Usnsvc REG_MULTI_SZ usnsvc\0\0


[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}]
Shell\AutoRun\command E:\setup.exe


-- End of Deckard's System Scanner: finished at 2007-07-05 at 19:38:08 ---------
dangvirus is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 07-05-2007, 05:49 PM   #39 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,479
OS: 2000 Pro; XP Pro; XP Home


Re: Winfixer HELP!!!!
Well, it looks like one of those folders got missed....this is one reason I was trying to use the script and combofix....it makes this seek and destroy easier on your end.

Let's try this another way....

Please download the OTMoveIt by OldTimer.
  • Save it to your desktop.
  • Please double-click OTMoveIt.exe to run it.
  • Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

    C:\WINDOWS\privacy_danger(2)
    C:\Documents and Settings\steve\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\omfge.class-8438415-292ab2e8.class
    C:\Documents and Settings\steve\Local Settings\Temp\ac8zt2\edi.exe
    C:\Documents and Settings\steve\Local Settings\Temp\BIT184.tmp

  • Return to OTMoveIt, right click on the "Paste List of Files/Folders to be moved" window and choose Paste.
  • Click the red Moveit! button.
  • Close OTMoveIt
If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Please post the log from OTMoveIt, located here:

c:\_OTMoveIt\MovedFiles\mmddyyyy_hhmmss.log

Where mmddyyyy_hhmmss is the date of the tool run.
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 07-05-2007, 06:07 PM   #40 (permalink)
Registered User
 
Join Date: Jul 2007
Posts: 22
OS: windows xp


Re: Winfixer HELP!!!!
C:\WINDOWS\privacy_danger(2) moved successfully.
C:\Documents and Settings\steve\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\omfge.class-8438415-292ab2e8.class moved successfully.
C:\Documents and Settings\steve\Local Settings\Temp\ac8zt2\edi.exe moved successfully.
C:\Documents and Settings\steve\Local Settings\Temp\BIT184.tmp moved successfully.

Created on 07/05/2007 20:03:40

Did I do it right?
dangvirus is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
 
Page 2 of 3 1 2 3

« Previous Thread | Next Thread »

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off



All times are GMT -7. The time now is 08:41 PM.

Contact Us - Tech Support Forum - Archive - Privacy Statement - Top


Copyright 2001 - 2009, Tech Support Forum
Home Tips Plus | Outdoor Basecamp | Automotive Support Forum

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85