Slow Browser - Trojan.Zlob, Trojan Horse

[rockroy]

Since detecting Trojan.Zlob that's infected file byxvspq.dll from C:\WINDOWS\system32\ . I'm unable to delete it or clean it through Symantec AntiVirus Corporate Edition. It keeps saying that the file byxvspq.dll is currently used.
I've managed to manually delete it. Since then, there's a significance drop in using any browser. There's always a constant lag and when this happens the CPU usage is 100%. I can't pick up where there is being used.

After a couple of "try outs", googling on how to fix this problem thru downloading various anti-malware methods. While using the Deckard's System Scanner performed on safe mode. I've picked up another Trojan Horse infecting files:

lompqlbb.dll - locared in C:\WINDOWS\system32\

A0000010.dll - located in C:\System Volume Information\_restore{0041F8C1-BEF7-47C9-B410-DBFC02855A8C}\RP2\

Both these files are successfully quarantine.

Please advice.

So here's the log files:

Deckard's System Scanner v20070729.57
Run by Administrator on 2007-08-06 at 17:32:50
Computer is in Normal Mode.
--------------------------------------------------------------------------------



-- HijackThis (run as Administrator.exe) ---------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:03:01 PM, on 3/08/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\SYSTEM32\astsrv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Firebird\bin\ibguard.exe
C:\Program Files\Firebird\bin\ibserver.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\dss.exe
C:\WINDOWS\system32\taskmgr.exe
C:\DOCUME~1\samuel\Desktop\Administrator.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MemoryManager] rundll32.exe "C:\WINDOWS\system32\sycjcyje.dll",sitypnow
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\npjpi150_11.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\npjpi150_11.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/ho...vex/hcImpl.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = procepts.com.au
O17 - HKLM\Software\..\Telephony: DomainName = procepts.com.au
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = procepts.com.au
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AST Service (astcc) - Nalpeiron Ltd. - C:\WINDOWS\SYSTEM32\astsrv.exe
O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: InterBase Guardian (InterBaseGuardian) - FirebirdSQL Project - C:\Program Files\Firebird\bin\ibguard.exe
O23 - Service: InterBase Server (InterBaseServer) - Unknown owner - C:\Program.exe (file missing)
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe

--
End of file - 5256 bytes

-- Files created between 2007-07-06 and 2007-08-06 -----------------------------

2007-08-06 17:12:24 0 d-------- C:\VundoFix Backups
2007-08-06 15:31:08 0 d-------- C:\Program Files\SpywareBlaster
2007-08-06 15:03:26 0 d-------- C:\WINDOWS\system32\ActiveScan
2007-08-06 12:09:04 0 d-------- C:\Documents and Settings\justin\Application Data\Avant Profiles
2007-08-06 11:00:01 0 d-------- C:\Shares
2007-08-03 16:55:08 598070 --a------ C:\dss.exe
2007-08-02 16:46:00 0 d-------- C:\Documents and Settings\samuel\Application Data\Avant Profiles
2007-08-02 16:45:53 0 d-------- C:\Program Files\Avant Browser
2007-07-31 18:05:38 0 d-------- C:\Program Files\Lavasoft
2007-07-31 18:05:38 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-07-31 17:46:05 0 d-------- C:\WINDOWS\ERUNT
2007-07-31 17:41:27 1376079 --a------ C:\Documents and Settings\samuel\ComboFix.exe
2007-07-31 17:41:02 50688 --a------ C:\Documents and Settings\samuel\ATF-Cleaner.exe <Not Verified; Atribune.org; ATF Cleaner>
2007-07-31 17:40:10 1045508 --a------ C:\Documents and Settings\samuel\SDFix.exe
2007-07-31 17:38:05 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-07-31 17:35:48 0 d-------- C:\Documents and Settings\Administrator.NORTHCOTE\Application Data\Macromedia
2007-07-31 08:38:36 0 d-------- C:\Documents and Settings\justin\Application Data\Prevx
2007-07-30 15:27:25 0 d-------- C:\Documents and Settings\Administrator.NORTHCOTE\Application Data\WinRAR
2007-07-30 15:26:15 0 d-------- C:\Documents and Settings\Administrator.NORTHCOTE\Application Data\Prevx
2007-07-30 15:23:58 77312 --a------ C:\WINDOWS\ua2.dll
2007-07-30 15:17:47 0 d-------- C:\Documents and Settings\Administrator.NORTHCOTE\Application Data\Help
2007-07-30 12:12:21 0 d-------- C:\Program Files\Enigma Software Group
2007-07-30 09:05:01 0 d-------- C:\Documents and Settings\justin\.housecall6.6
2007-07-30 08:49:20 69184 --a------ C:\WINDOWS\system32\uovihejx.dll
2007-07-30 08:44:04 126016 --a------ C:\WINDOWS\system32\sycjcyje.dll
2007-07-30 08:37:55 809890 --ahs---- C:\WINDOWS\system32\dfhkj.bak2
2007-07-26 15:57:48 804599 --ahs---- C:\WINDOWS\system32\dfhkj.bak1
2007-07-26 15:52:04 0 d-------- C:\Documents and Settings\samuel\Application Data\WinRAR
2007-07-26 15:44:51 0 d-------- C:\Program Files\BitComet
2007-07-25 15:42:29 0 d-------- C:\Temp
2007-07-16 11:52:59 0 d-------- C:\Stockdelete
2007-07-13 15:23:24 0 d-------- C:\Program Files\MTPEodv5
2007-07-12 11:14:27 0 d-------- C:\Documents and Settings\All Users\Application Data\{DB87D862-CE63-4D20-B558-4149110A0074}
2007-07-11 14:59:28 0 d-------- C:\Program Files\EzyCompany


-- Find3M Report ---------------------------------------------------------------

2007-08-06 14:30:31 0 d-------- C:\Program Files\MSN Messenger
2007-08-02 11:35:03 0 d-------- C:\Program Files\Paritech
2007-07-31 17:38:05 0 d-------- C:\Program Files\Common Files
2007-07-31 1327 0 d-------- C:\Program Files\Equis
2007-06-30 17:48:08 0 d-------- C:\Documents and Settings\Administrator.NORTHCOTE\Application Data\AdobeUM
2007-06-30 17:47:21 0 d-------- C:\Documents and Settings\Administrator.NORTHCOTE\Application Data\Adobe
2007-06-30 17:43:50 0 d-------- C:\Documents and Settings\Administrator.NORTHCOTE\Application Data\Paritech
2007-06-30 17:40:50 0 d-------- C:\Documents and Settings\Administrator.NORTHCOTE\Application Data\Talkback
2007-06-30 17:40:25 0 d-------- C:\Documents and Settings\Administrator.NORTHCOTE\Application Data\Mozilla
2007-06-27 10:36:12 0 d-------- C:\Program Files\Common Files\Equis
2007-06-20 1526 0 d-------- C:\Program Files\Firebird
2007-06-18 14:41:04 0 d-------- C:\Program Files\Traders' Choice Software
2007-06-15 09:14:42 0 d-------- C:\Program Files\Safari
2007-06-14 13:46:41 50956 --ah----- C:\WINDOWS\system32\mlfcache.dat
2007-06-14 13:22:02 0 d-------- C:\Program Files\Bonjour
2007-06-14 13:21:08 0 d-------- C:\Program Files\QuickTime
2007-06-14 13:18:21 0 d-------- C:\Program Files\Apple Software Update
2007-06-13 13:19:02 0 d-------- C:\Program Files\Common Files\ACD Systems
2007-06-08 10:20:53 0 d-------- C:\Program Files\Microsoft Works
2007-06-08 09:45:03 0 d-------- C:\Program Files\MSECache


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [15/08/2003 05:34 PM C:\WINDOWS\SOUNDMAN.EXE]
"vptray"="C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe" [30/07/2002 10:35 AM]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [27/04/2007 09:41 AM]
"MemoryManager"="C:\WINDOWS\system32\sycjcyje.dll" [30/07/2007 08:44 AM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [03/08/2004 11:56 PM]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [23/09/2005 10:05:26 PM]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [21/01/2000 6:15:54 PM]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"




-- End of Deckard's System Scanner: finished at 2007-08-06 at 17:43:19 ---------

[sUBs]

1. Download & Save this file to Desktop -> http://download.bleepingcomputer.com...a/ComboFix.exe

2. Double click on combofix.exe & follow the prompts.

3. When finished, it shall produce a log for you. Post that log & a fresh HJT log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

[rockroy]

Hi,

Here's the log for combo Fix:


ComboFix 07-07-30.2 - "samuel" 2007-08-07 13:12:12.1 [GMT 10:00] - NTFS
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.True
* Created a new restore point


(((((((((((((((((((((((((((((((((((((((((((( V Log )))))))))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\system32\uovihejx.dll
C:\WINDOWS\system32\dfhkj.bak1
C:\WINDOWS\system32\dfhkj.bak2
C:\WINDOWS\system32\dfhkj.ini


* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *


((((((((((((((((((((((((( Files Created from 2007-07-07 to 2007-08-07 )))))))))))))))))))))))))))))))


2007-08-06 17:12 <DIR> d-------- C:\VundoFix Backups
2007-08-06 15:31 <DIR> d-------- C:\Program Files\SpywareBlaster
2007-08-06 15:03 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2007-08-06 12:09 <DIR> d-------- C:\DOCUME~1\justin\APPLIC~1\Avant Profiles
2007-08-06 11:00 <DIR> d-------- C:\Shares
2007-08-03 16:55 598,070 --a------ C:\dss.exe
2007-08-03 16:53 <DIR> d-------- C:\Deckard
2007-08-02 16:46 <DIR> d-------- C:\DOCUME~1\samuel\APPLIC~1\Avant Profiles
2007-08-02 16:45 <DIR> d-------- C:\Program Files\Avant Browser
2007-07-31 18:17 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-07-31 18:05 <DIR> d-------- C:\Program Files\Lavasoft
2007-07-31 18:05 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-07-31 17:46 <DIR> d-------- C:\WINDOWS\ERUNT
2007-07-31 17:41 50,688 --a------ C:\DOCUME~1\samuel\ATF-Cleaner.exe
2007-07-31 17:41 1,376,079 --a------ C:\DOCUME~1\samuel\ComboFix.exe
2007-07-31 17:40 1,045,508 --a------ C:\DOCUME~1\samuel\SDFix.exe
2007-07-31 17:38 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-07-31 17:35 18,164,640 --a------ C:\DOCUME~1\samuel\aaw2007.exe
2007-07-31 16:12 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll
2007-07-31 08:38 <DIR> d-------- C:\DOCUME~1\justin\APPLIC~1\Prevx
2007-07-30 15:27 <DIR> d-------- C:\DOCUME~1\ADMINI~1.NOR\APPLIC~1\WinRAR
2007-07-30 15:26 <DIR> d-------- C:\DOCUME~1\ADMINI~1.NOR\APPLIC~1\Prevx
2007-07-30 15:23 77,312 --a------ C:\WINDOWS\ua2.dll
2007-07-30 15:17 <DIR> d-------- C:\DOCUME~1\ADMINI~1.NOR\APPLIC~1\Help
2007-07-30 12:12 <DIR> d-------- C:\Program Files\Enigma Software Group
2007-07-30 09:05 <DIR> d-------- C:\DOCUME~1\justin\.housecall6.6
2007-07-30 08:44 126,016 --a------ C:\WINDOWS\system32\sycjcyje.dll
2007-07-26 15:52 <DIR> d-------- C:\DOCUME~1\samuel\APPLIC~1\WinRAR
2007-07-26 15:44 <DIR> d-------- C:\Program Files\BitComet
2007-07-25 15:42 <DIR> d-------- C:\Temp
2007-07-16 11:52 <DIR> d-------- C:\Stockdelete
2007-07-13 15:23 <DIR> d-------- C:\Program Files\MTPEodv5
2007-07-12 11:14 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\{DB87D862-CE63-4D20-B558-4149110A0074}
2007-07-11 14:59 <DIR> d-------- C:\Program Files\EzyCompany


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-06 14:30 --------- d-------- C:\Program Files\MSN Messenger
2007-08-02 11:35 --------- d-------- C:\Program Files\Paritech
2007-07-31 13:06 --------- d-------- C:\Program Files\Equis
2007-07-26 15:47 359808 --a------ C:\WINDOWS\system32\drivers\tcpip.sys
2007-06-27 10:36 --------- d-------- C:\Program Files\Common Files\Equis
2007-06-20 15:06 --------- d-------- C:\Program Files\Firebird
2007-06-18 14:41 --------- d-------- C:\Program Files\Traders' Choice Software
2007-06-15 09:14 --------- d-------- C:\Program Files\Safari
2007-06-14 13:46 50956 --ah----- C:\WINDOWS\system32\mlfcache.dat
2007-06-14 13:24 --------- d-------- C:\DOCUME~1\samuel\APPLIC~1\Apple Computer
2007-06-14 13:22 --------- d-------- C:\Program Files\Bonjour
2007-06-14 13:21 --------- d-------- C:\Program Files\QuickTime
2007-06-14 13:18 --------- d-------- C:\Program Files\Apple Software Update
2007-06-13 13:19 --------- d-------- C:\Program Files\Common Files\ACD Systems
2007-06-08 10:20 --------- d-------- C:\Program Files\Microsoft Works
2007-06-08 09:45 --------- d-------- C:\Program Files\MSECache
2007-06-06 14:25 214600 --a------ C:\DOCUME~1\samuel\APPLIC~1\ngUninstaller.exe
2007-05-17 01:12 683520 --a------ C:\WINDOWS\system32\inetcomm.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2003-08-15 17:34 C:\WINDOWS\SOUNDMAN.EXE]
"vptray"="C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe" [2002-07-30 10:35]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:56]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-14 02:24]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2000-01-21 18:15:54]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"

R2 InterBaseGuardian;InterBase Guardian;C:\Program Files\Firebird\bin\ibguard.exe -s
R2 InterBaseServer;InterBase Server;C:\Program Files\Firebird\bin\ibserver -s
R2 NAVAPEL;NAVAPEL;\??\C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\NAVAPEL.SYS
R3 ALCXSENS;Service for WDM 3D Audio Driver;C:\WINDOWS\system32\drivers\ALCXSENS.SYS
R3 ms_mpu401;Microsoft MPU-401 MIDI UART Driver;C:\WINDOWS\system32\drivers\msmpu401.sys
R3 NAVAP;NAVAP;\??\C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\NAVAP.sys
S3 LMImirr;LMImirr;C:\WINDOWS\system32\DRIVERS\LMImirr.sys


Contents of the 'Scheduled Tasks' folder
2007-07-26 08:21:57 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
2007-08-06 06:09:13 C:\WINDOWS\Tasks\At1.job - C:\DOCUME~1\samuel\Desktop\Look2Me-Destroyer.exe

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-07 13:59:27
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-07 14:16:00 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-08-07 14:15

--- E O F ---



Log for HijackThis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:29, on 2007-08-07
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\SYSTEM32\astsrv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Firebird\bin\ibguard.exe
C:\Program Files\Firebird\bin\ibserver.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Paritech\TactMan\TactMan.exe
C:\Program Files\Equis\MetaStock\MsWin.exe
C:\PROGRA~1\MICROS~2\Office\OUTLOOK.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\samuel\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.paritech.com.au/support/default.asp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/ho...vex/hcImpl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = procepts.com.au
O17 - HKLM\Software\..\Telephony: DomainName = procepts.com.au
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = procepts.com.au
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AST Service (astcc) - Nalpeiron Ltd. - C:\WINDOWS\SYSTEM32\astsrv.exe
O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: InterBase Guardian (InterBaseGuardian) - FirebirdSQL Project - C:\Program Files\Firebird\bin\ibguard.exe
O23 - Service: InterBase Server (InterBaseServer) - Unknown owner - C:\Program.exe (file missing)
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe

--
End of file - 5698 bytes

[sUBs]

C:\DOCUME~1\samuel\ATF-Cleaner.exe
C:\DOCUME~1\samuel\ComboFix.exe
C:\DOCUME~1\samuel\SDFix.exe
C:\DOCUME~1\samuel\aaw2007.exe

Don't place files at the root of your userprofile. Create a temporary folder somewhere else & move the above files there.

The combofix you ran is not the copy I asked to download. Please delete that & grab the correct copy from here: http://download.bleepingcomputer.com...a/ComboFix.exe

[rockroy]

Moved the requested files to C:\FIX

The log files for Combofix:

ComboFix 07-08-07.5 - "Administrator" 2007-08-07 17:36:43.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.574 [GMT 10:00]
* Created a new restore point


((((((((((((((((((((((((( Files Created from 2007-07-07 to 2007-08-07 )))))))))))))))))))))))))))))))


2007-08-07 16:12 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-08-07 15:00 <DIR> d-------- C:\FIX
2007-08-06 17:12 <DIR> d-------- C:\VundoFix Backups
2007-08-06 15:31 <DIR> d-------- C:\Program Files\SpywareBlaster
2007-08-06 15:03 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2007-08-06 12:09 <DIR> d-------- C:\DOCUME~1\justin\APPLIC~1\Avant Profiles
2007-08-06 11:00 <DIR> d-------- C:\Shares
2007-08-03 16:53 <DIR> d-------- C:\Deckard
2007-08-02 16:46 <DIR> d-------- C:\DOCUME~1\samuel\APPLIC~1\Avant Profiles
2007-08-02 16:45 <DIR> d-------- C:\Program Files\Avant Browser
2007-07-31 18:17 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-07-31 18:05 <DIR> d-------- C:\Program Files\Lavasoft
2007-07-31 18:05 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-07-31 17:46 <DIR> d-------- C:\WINDOWS\ERUNT
2007-07-31 17:38 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-07-31 16:12 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll
2007-07-31 08:38 <DIR> d-------- C:\DOCUME~1\justin\APPLIC~1\Prevx
2007-07-30 15:27 <DIR> d-------- C:\DOCUME~1\ADMINI~1.NOR\APPLIC~1\WinRAR
2007-07-30 15:26 <DIR> d-------- C:\DOCUME~1\ADMINI~1.NOR\APPLIC~1\Prevx
2007-07-30 15:23 77,312 --a------ C:\WINDOWS\ua2.dll
2007-07-30 15:17 <DIR> d-------- C:\DOCUME~1\ADMINI~1.NOR\APPLIC~1\Help
2007-07-30 12:12 <DIR> d-------- C:\Program Files\Enigma Software Group
2007-07-30 09:05 <DIR> d-------- C:\DOCUME~1\justin\.housecall6.6
2007-07-30 08:44 126,016 --a------ C:\WINDOWS\system32\sycjcyje.dll
2007-07-26 15:52 <DIR> d-------- C:\DOCUME~1\samuel\APPLIC~1\WinRAR
2007-07-26 15:44 <DIR> d-------- C:\Program Files\BitComet
2007-07-25 15:42 <DIR> d-------- C:\Temp
2007-07-16 11:52 <DIR> d-------- C:\Stockdelete
2007-07-13 15:23 <DIR> d-------- C:\Program Files\MTPEodv5
2007-07-12 11:14 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\{DB87D862-CE63-4D20-B558-4149110A0074}
2007-07-11 14:59 <DIR> d-------- C:\Program Files\EzyCompany


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-06 14:30 --------- d-------- C:\Program Files\MSN Messenger
2007-08-02 11:35 --------- d-------- C:\Program Files\Paritech
2007-07-31 13:06 --------- d-------- C:\Program Files\Equis
2007-07-26 15:47 359808 --a--c--- C:\WINDOWS\system32\dllcache\tcpip.sys
2007-07-26 15:47 359808 --a------ C:\WINDOWS\system32\drivers\tcpip.sys
2007-06-30 17:48 --------- d-------- C:\DOCUME~1\ADMINI~1.NOR\APPLIC~1\AdobeUM
2007-06-30 17:43 --------- d-------- C:\DOCUME~1\ADMINI~1.NOR\APPLIC~1\Paritech
2007-06-30 17:40 --------- d-------- C:\DOCUME~1\ADMINI~1.NOR\APPLIC~1\Talkback
2007-06-27 10:36 --------- d-------- C:\Program Files\Common Files\Equis
2007-06-20 15:06 --------- d-------- C:\Program Files\Firebird
2007-06-18 14:41 --------- d-------- C:\Program Files\Traders' Choice Software
2007-06-15 09:14 --------- d-------- C:\Program Files\Safari
2007-06-14 13:46 50956 --ah----- C:\WINDOWS\system32\mlfcache.dat
2007-06-14 13:22 --------- d-------- C:\Program Files\Bonjour
2007-06-14 13:21 --------- d-------- C:\Program Files\QuickTime
2007-06-14 13:18 --------- d-------- C:\Program Files\Apple Software Update
2007-06-13 13:19 --------- d-------- C:\Program Files\Common Files\ACD Systems
2007-06-08 10:20 --------- d-------- C:\Program Files\Microsoft Works
2007-06-08 09:45 --------- d-------- C:\Program Files\MSECache
2007-05-17 01:12 86528 -----c--- C:\WINDOWS\system32\dllcache\directdb.dll
2007-05-17 01:12 85504 -----c--- C:\WINDOWS\system32\dllcache\wabimp.dll
2007-05-17 01:12 683520 --a------ C:\WINDOWS\system32\inetcomm.dll
2007-05-17 01:12 683520 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll
2007-05-17 01:12 510976 --a--c--- C:\WINDOWS\system32\dllcache\wab32.dll
2007-05-17 01:12 1314816 -----c--- C:\WINDOWS\system32\dllcache\msoe.dll
2007-05-08 19:24 3583488 --a--c--- C:\WINDOWS\system32\dllcache\mshtml.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2003-08-15 17:34 C:\WINDOWS\SOUNDMAN.EXE]
"vptray"="C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe" [2002-07-30 10:35]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:56]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2000-01-21 18:15:54]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"

R2 InterBaseGuardian;InterBase Guardian;C:\Program Files\Firebird\bin\ibguard.exe -s
R2 InterBaseServer;InterBase Server;C:\Program Files\Firebird\bin\ibserver -s
R2 NAVAPEL;NAVAPEL;\??\C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\NAVAPEL.SYS
R3 ALCXSENS;Service for WDM 3D Audio Driver;C:\WINDOWS\system32\drivers\ALCXSENS.SYS
R3 ms_mpu401;Microsoft MPU-401 MIDI UART Driver;C:\WINDOWS\system32\drivers\msmpu401.sys
R3 NAVAP;NAVAP;\??\C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\NAVAP.sys
S3 LMImirr;LMImirr;C:\WINDOWS\system32\DRIVERS\LMImirr.sys

*Newly Created Service* - CATCHME

Contents of the 'Scheduled Tasks' folder
2007-07-26 08:21:57 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
2007-08-07 06:09:07 C:\WINDOWS\Tasks\At1.job - C:\DOCUME~1\samuel\Desktop\Look2Me-Destroyer.exe

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-07 17:58:33
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-07 18:17:54
C:\ComboFix-quarantined-files.txt ... 2007-08-07 18:17
C:\ComboFix2.txt ... 2007-08-07 14:16

--- E O F ---

Log Files for Hijackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:36, on 2007-08-08
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SYSTEM32\astsrv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Firebird\bin\ibguard.exe
C:\Program Files\Firebird\bin\ibserver.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\samuel\Desktop\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/ho...vex/hcImpl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = procepts.com.au
O17 - HKLM\Software\..\Telephony: DomainName = procepts.com.au
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = procepts.com.au
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AST Service (astcc) - Nalpeiron Ltd. - C:\WINDOWS\SYSTEM32\astsrv.exe
O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: InterBase Guardian (InterBaseGuardian) - FirebirdSQL Project - C:\Program Files\Firebird\bin\ibguard.exe
O23 - Service: InterBase Server (InterBaseServer) - Unknown owner - C:\Program.exe (file missing)
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe

--
End of file - 5499 bytes

[sUBs]

Go to Start > Control Panel > Add or Remove Programs and uninstall the following programs:

• SpyHunter

Please note any other programs that you dont recognize in that list in your next response


---------------


Open notepad and copy/paste the text in the quotebox below into it:

http://www.techsupportforum.com/security-center/hijackthis-log-help/172362-slow-browser-trojan-zlob-trojan-horse.html
Collect::
C:\WINDOWS\system32\sycjcyje.dll
File::
C:\WINDOWS\Tasks\At1.job
Folder::
C:\VundoFix Backups
C:\Program Files\Enigma Software Group

Save this as "CFScript"




Refering to the picture above, drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply.

Additonally, ComboFix will generate a zipped file on your Desktop, called Submit [Date Time].zip
Please submit this file to:

http://www.bleepingcomputer.com/subm....php?channel=4

The file must be uploaded before proceeding to the next step.


---------------


Click here perform an online scan >> Online Scanner


---------------


In your next post, please include fresh logs from:

1. Fresh Hijackthis log taken just before replying
2. Online scan
3. ComboFix's log

Please provide details of any problems you encountered whilst performing the above steps & update us on how the computer behaves now

[rockroy]

Log files from KASPERSKY SCAN:

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Thursday, August 09, 2007 6:47:25 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.93.0
Kaspersky Anti-Virus database last update: 9/08/2007
Kaspersky Anti-Virus database records: 377389
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\

Scan Statistics:
Total number of scanned objects: 127853
Number of viruses found: 4
Number of infected objects: 13
Number of suspicious objects: 0
Duration of the scan process: 01:16:59

Infected Object Name / Virus Name / Last Action
C:\AstLog.txt Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\079b7aa1fe86091a894c3d2a66af8269_4586d927-2777-46c0-a5cc-7afd7de07dc9 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\1b546a1ea1ce527e5ba78ba3a99d774a_4586d927-2777-46c0-a5cc-7afd7de07dc9 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\511a0f3f9e960fa97de3d0b74adfc574_4586d927-2777-46c0-a5cc-7afd7de07dc9 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a26334bf9a71353214a5ba04a31a7741_4586d927-2777-46c0-a5cc-7afd7de07dc9 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\c3ebeb3bfac35265d663c16153578b2a_4586d927-2777-46c0-a5cc-7afd7de07dc9 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\APTemp\AP0.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\APTemp\AP1.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\APTemp\AP2.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\APTemp\AP3.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\APTemp\AP4.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\APTemp\AP5.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\06980000.VBN Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
C:\Documents and Settings\justin\Local Settings\Temp\xjqtikgl.exe Infected: Trojan-Dropper.Win32.Agent.bmk skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\samuel\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\samuel\Desktop\SamT\dss.exe Infected: IM-Worm.Win32.Sohanad.aw skipped
C:\Documents and Settings\samuel\Desktop\[4]-Submit_2007-08-08_151132.34.zip/sycjcyje.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.kp skipped
C:\Documents and Settings\samuel\Desktop\[4]-Submit_2007-08-08_151132.34.zip ZIP: infected - 1 skipped
C:\Documents and Settings\samuel\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped
C:\Documents and Settings\samuel\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\samuel\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\samuel\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\samuel\Local Settings\History\History.IE5\MSHist012007080920070810\index.dat Object is locked skipped
C:\Documents and Settings\samuel\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\samuel\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\samuel\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\samuel\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\samuel\UserData\index.dat Object is locked skipped
C:\FIX\dss.exe Infected: IM-Worm.Win32.Sohanad.aw skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{0041F8C1-BEF7-47C9-B410-DBFC02855A8C}\RP7\A0001600.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.kp skipped
C:\System Volume Information\_restore{0041F8C1-BEF7-47C9-B410-DBFC02855A8C}\RP7\change.log Object is locked skipped
C:\WINDOWS\CSC\00000001 Object is locked skipped
C:\WINDOWS\Debug\Netlogon.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\Prefetch\layout.ini Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
D:\Shares\EzyCharts\NASDAQ\UVEW_Ezy Charts.TXT Object is locked skipped
D:\Shares\EzyCharts\NYSE\FRE-F_Ezy Charts.TXT Object is locked skipped
D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
D:\System Volume Information\_restore{0041F8C1-BEF7-47C9-B410-DBFC02855A8C}\RP7\change.log Object is locked skipped

Scan process completed.



LOG FILES FOR HIJACKTHIS:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:47, on 2007-08-09
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\SYSTEM32\astsrv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Firebird\bin\ibguard.exe
C:\Program Files\Firebird\bin\ibserver.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\WINDOWS\system32\SVCH0ST.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\samuel\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.paritech.com.au/support/default.asp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [autorun] C:\WINDOWS\system32\SVCH0ST.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/ho...vex/hcImpl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = procepts.com.au
O17 - HKLM\Software\..\Telephony: DomainName = procepts.com.au
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = procepts.com.au
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AST Service (astcc) - Nalpeiron Ltd. - C:\WINDOWS\SYSTEM32\astsrv.exe
O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: InterBase Guardian (InterBaseGuardian) - FirebirdSQL Project - C:\Program Files\Firebird\bin\ibguard.exe
O23 - Service: InterBase Server (InterBaseServer) - Unknown owner - C:\Program.exe (file missing)

--
End of file - 5679 bytes




While trying to perform the online scan, i've encounter a hang when it comes to scan file C:\Windows\ServicePackfiles\i386\msobshel.htm.
Tried restarting computer and scan again, it stop at that file.
Did a bit of search, and someone suggested to disable the Symantec Antivirus. So i did so thru disabling the SERVICES in Control Panel > Administration Tools.
And PRESTO !! The scan went thru. And my browser or actually the entire performance of my PC is faster and seems to be where it suppose to be.

[sUBs]

Open NOTEPAD.exe and copy/paste the text in the quotebox below into it:

@echo off
if exist "%temp%\log.txt" del "%temp%\log.txt"

for %%g in (
"C:\Documents and Settings\justin\Local Settings\Temp\xjqtikgl.exe"
"C:\Documents and Settings\samuel\Desktop\[4]-Submit_2007-08-08_151132.34.zip"
) do (
del /a/f %%g >nul 2>&1
if exist %%g echo.%%~g>>"%temp%\log.txt"
)

for %%g in (
%systemdrive%\Deckard
%systemdrive%\Qoobox
) do (
rd /s/q %%g >nul 2>&1
if exist %%g echo.%%~g>>"%temp%\log.txt"
)
if exist "%temp%\log.txt" ( start notepad "%temp%\log.txt"
) else echo.Deleted Successfully !!

echo.GetObject("winmgmts:" ^& "{impersonationLevel=impersonate}!\\" ^& "." ^& "\root\default").Get("SystemRestore").Disable("")>SR.vbs
echo.GetObject("winmgmts:" ^& "{impersonationLevel=impersonate}!\\" ^& "." ^& "\root\default").Get("SystemRestore").Enable("")>>SR.vbs
wscript SR.vbs

(
echo.REGEDIT4&echo.
echo.[hkey_current_user\software\microsoft\windows\currentversion\explorer\advanced]
echo."hidden"=dword:00000002
echo."hidefileext"=dword:00000001
echo."showsuperhidden"=dword:00000000
)>rehide.reg

regedit /s rehide.reg
del rehide.reg SR.vbs
nircmd wait 7000
del %0

Save this as fix.bat Choose to "Save type as - All Files"
It should look like this:
Double click on fix.bat & allow it to run

Post back to tell me what it says

[rockroy]

After running Fix.bat

message returned in command prompt:

Deleted Successfully !!
C:\fix\*, Are you sure <Y/N>? y
C:\>

[sUBs]

After running Fix.bat

message returned in command prompt:

Deleted Successfully !!
C:\fix\*, Are you sure <Y/N>? y
C:\>

Are you certain that you copied the batchfile correctly?
I have no references to c:\fix\* in there.

[rockroy]

This is what i did:
1. i copied the instructions,
2. paste into a notepad
3. Saved it as Fix.bat and select file type as All Files
4. Saved it in C:\
5. Run CMD
6. Type Fix

and that's the returned message i got.

[sUBs]

LOL ...you were supposed to double click it. Running it from the command prompt will cause it to look for the folder "fix". :)

No harm done. As long as it says "Deleted Successfully !!" , that means the job got done.

How's the machine now?

[rockroy]

, yeah sorry about that.

Machine seems to be running smoother now, almost same performance since i've disable Symantec Antivirus.


So, the deletion process executed from the batch file is deleting the infected files ?

[sUBs]

Yes, that's basically the gist of it. Saves you the trouble of searching for each & every individual file. Also provides me feedback whether the file got deleted properly.


----------------------


Now that your system is clean, kindly follow these simple steps in order to keep your computer clean and secure:

1. ANTIVIRUS SOFTWARE
   It is imperative that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
   
   
   
2. FIREWALL
   Without a firewall your computer is succeptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. A tutorial on Firewalls and a listing of some available ones can be found here → http://www.bleepingcomputer.com/forums/tutorial60.html
   
   
   
3. Microsoft Windows Update → http://www.windowsupdate.com
   Visit regularly. This will ensure your computer always has the latest security updates. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
   
   
4. SPYWAREBLASTER
   SpywareBlaster prevents the installation of malicious ActiveX, adware, browser hijackers, dialers, and other potentially unwanted software. Blocks spyware/tracking cookies & restricts the actions of potentially unwanted sites.
   
   Unlike other programs, SpywareBlaster does not have to remain running in the background. A tutorial on installing & using this product can be found here → http://www.bleepingcomputer.com/forums/tutorial49.html
   
   
   
5. IE-SPYAD
   IE/Spyad places more than 4000 dubious websites and domains in the IE Restricted list. This severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites. A tutorial on installing this product can be found here http://www.spywarewarrior.com/uiuc/resource.htm

Update all these programs regularly. Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.

Follow this list and your potential for being infected again will reduce dramatically. Here are some additional utilities that will further enhance your safety.

• http://www.trillian.cc → Trillian or http://www.miranda-im.com → Miranda-IM - These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN)
  
  
• http://www.mozilla.org/products/firefox/ - Firefox - Use this alternate browser. Whilst Internet Explorer is not a bad browser, almost every exploit crafted is targeted to take advantage of an IE weakness.
  
  
• http://java.com/en/index.jsp - Sun's Java - It's much more secure than Microsoft's Java Virtual Machine.
  
  
• http://www.aumha.org/downloads/erunt-setup.exe - ERUNT - A useful freeware utility for users of Windows 2000/XP. It's made up of two parts - ERUNT & NTREGOPT.
  
  ERUNT will create daily complete backups of your computer's Registry. Whilst System Restore does the same thing, a corrupt registry file may prevent Windows from booting & this effectively renders disables System Restore. With ERUNT, you're able to restore the damaged Registry.
  
  NTREGOPT works by recreating each registry hive "from scratch", thus removing any slack space that may be left from previously modified or deleted keys. In other words, it compacts the Registry to a small size which allows Windows to load & perform faster.

To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Tony Klein - http://computercops.biz/postlite7736-.html

After doing all these, your system will be optimised against future threats.

It's okay to delete the Hijack This folder in a couple weeks if everything is working okay.
Have a safe & happy computing day.

Kindly respond to this thread once more so we can mark this thread as resolved.

[rockroy]

THANKs !!!

You have been very helpful ! Your analytical and detail problem solving skill is greatly appreciated ! Keep up the good work.