Spam emails being automatically sent

[dcards]

Hi,

I’m having some issues with my desktop that I think is caused by a virus or spyware.

Spam emails are constantly being sent from my machine. I know this because Norton scans my outgoing mail and brings up messages about not being able to deliver the message. It’s so bad that I can’t effectively use the internet from the infected machine or any other machine on my network because the outgoing mail is taking all the bandwidth.

I have performed the 5 steps before posting a log and I still seem to be having the same problem.

Below is my HiJack log and attached is the extra.txt and the report from the Panda scan. Thanks for any assistance you can provide …

Deckard's System Scanner v20071014.68
Run by Louis Curti on 2007-12-02 10:49:37
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.


-- Last 5 Restore Point(s) --
11: 2007-12-02 18:49:43 UTC - RP14 - Deckard's System Scanner Restore Point
10: 2007-12-01 23:04:41 UTC - RP13 - Software Distribution Service 3.0
9: 2007-12-01 21:31:18 UTC - RP12 - Software Distribution Service 3.0
8: 2007-12-01 21:22:10 UTC - RP11 - Removed The Sims Superstar
7: 2007-12-01 04:38:51 UTC - RP10 - Installed SUPERAntiSpyware Free Edition


-- First Restore Point --
1: 2007-11-27 05:30:45 UTC - RP4 - Installed Symantec Technical Support Web Controls


Backed up registry hives.
Performed disk cleanup.



-- HijackThis Clone ------------------------------------------------------------


Emulating logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2007-12-02 10:51:18
Platform: Windows XP Service Pack 2 (5.01.2600)
MSIE: Internet Explorer (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\SYSTEM32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\SYSTEM32\services.exe
C:\WINDOWS\SYSTEM32\lsass.exe
C:\WINDOWS\SYSTEM32\svchost.exe
C:\WINDOWS\SYSTEM32\svchost.exe
C:\WINDOWS\SYSTEM32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\SYSTEM32\LEXBCES.EXE
C:\WINDOWS\SYSTEM32\spoolsv.exe
C:\WINDOWS\SYSTEM32\LEXPPS.EXE
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\GeekSquad\upssrv.exe
C:\WINDOWS\SYSTEM32\svchost.exe
C:\GeekSquad\upsio.exe
C:\WINDOWS\explorer.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\WINDOWS\SYSTEM32\hkcmd.exe
C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Dell AIO Printer A920\dlbkbmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\WINDOWS\SYSTEM32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Data\Software\dds\dss.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com.../fix_homepage/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = iexplore
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Common Files\Symantec Shared\IDS\IPSBHO.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Dell AIO Printer A920] "C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [autoload] C:\WINDOWS\system32\drivers\smss.exe
O4 - HKCU\..\Run: [autorun] C:\Documents and Settings\Louis Curti\smss.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Iisigpp] C:\WINDOWS\??stem32\r?gsvr32.exe
O4 - HKCU\..\Run: [Huz] "C:\Program Files\??stem32\?hkdsk.exe"
O4 - HKCU\..\Run: [Aida] "C:\DOCUME~1\LOUISC~1\APPLIC~1\PPPATC~1\dllhost.exe" -vt ndrv
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/s...irector/sw.cab
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeup...ntent/opuc.cab
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} () - http://atv.disney.go.com/global/down.../OTOYAX29b.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramewor...o.cab56649.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pu...sh/swflash.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/popcaploader_v10.cab
O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL
O18 - Protocol: mso-offdap11 - {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL
O18 - Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: UPS Service (CyberPowerUPS) - Unknown owner - C:\GeekSquad\upssrv.exe
O23 - Service: ICF - Unknown owner - C:\WINDOWS\system32\svchost.exe:exe.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\SYSTEM32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\SYSTEM32\HPZipm12.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe


--
End of file - 7325 bytes

-- File Associations -----------------------------------------------------------

All associations okay.


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R1 omci (OMCI WDM Device Driver) - c:\windows\system32\drivers\omci.sys <Not Verified; Dell Computer Corporation; OMCI Driver>
R1 SASDIFSV - c:\program files\superantispyware\sasdifsv.sys
R1 SASKUTIL - c:\program files\superantispyware\saskutil.sys
R3 SASENUM - c:\program files\superantispyware\sasenum.sys <Not Verified; SuperAdBlocker, Inc.; SuperAntiSpyware>
R3 WmaCDriverV32 - c:\windows\system32\drivers\wmacdriverv32.sys <Not Verified; Windows (R) 2000/XP; Windows (R) 2000/XP Driver>

S3 fwdrv.sys - c:\fwdrv.sys (file missing)
S3 iAimTV2 - c:\windows\system32\drivers\watv03nt.sys (file missing)
S3 wanatw (WAN Miniport (ATW)) - c:\windows\system32\drivers\wanatw4.sys (file missing)


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 CyberPowerUPS (UPS Service) - c:\geeksquad\upssrv.exe

S2 ICF - c:\windows\system32\svchost.exe:exe.exe
S3 WmcCds (Windows Media Connect (WMC)) - c:\program files\windows media connect\mswmccds.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
S3 WmcCdsLs (Windows Media Connect (WMC) Helper) - c:\program files\windows media connect\mswmcls.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>


-- Device Manager: Disabled ----------------------------------------------------

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: Broadcom 440x 10/100 Integrated Controller
Device ID: PCI\VEN_14E4&DEV_4401&SUBSYS_81271028&REV_01\4&3B1CAF2B&0&48F0
Manufacturer: Broadcom
Name: Broadcom 440x 10/100 Integrated Controller
PNP Device ID: PCI\VEN_14E4&DEV_4401&SUBSYS_81271028&REV_01\4&3B1CAF2B&0&48F0
Service: bcm4sbxp


-- Scheduled Tasks -------------------------------------------------------------

2007-09-02 14:16:01 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
2003-11-26 19:59:58 568 --a------ C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Louis Curti.job


-- Files created between 2007-11-02 and 2007-12-02 -----------------------------

2007-12-01 15:04:43 0 d-------- C:\WINDOWS\LastGood
2007-12-01 13:15:00 0 d-------- C:\Documents and Settings\Louis Curti\Application Data\Wireshark
2007-12-01 12:55:59 0 d-------- C:\Program Files\Wireshark
2007-12-01 10:39:37 0 d-------- C:\WINDOWS\system32\ActiveScan
2007-11-30 20:38:52 0 d-------- C:\Documents and Settings\Louis Curti\Application Data\SUPERAntiSpyware.com
2007-11-30 20:38:34 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-11-30 19:15:26 0 d-------- C:\Documents and Settings\Administrator\Application Data\Grisoft
2007-11-30 19:09:51 0 d-------- C:\Documents and Settings\Louis Curti\Application Data\Grisoft
2007-11-26 22:01:53 0 d-------- C:\Documents and Settings\Default User\Application Data\Apple Computer
2007-11-26 20:48:29 6473 --ahs---- C:\WINDOWS\system32\yccdd.bak2


-- Find3M Report ---------------------------------------------------------------

2007-12-01 14:19:59 0 d-------- C:\Program Files\SUPERAntiSpyware
2007-12-01 14:19:55 0 d-------- C:\Program Files\QuickTime
2007-12-01 14:19:24 0 d-------- C:\Program Files\Norton AntiVirus
2007-12-01 1423 0 d-------- C:\Program Files\iTunes
2007-12-01 14:04:18 0 d-------- C:\Program Files\Dell AIO Printer A920
2007-12-01 14:03:09 0 d-------- C:\Program Files\Common Files\Symantec Shared
2007-12-01 13:26:05 0 d-------- C:\Program Files\MSN Games
2007-12-01 13:23:59 0 d-------- C:\Program Files\Viewpoint
2007-12-01 13:22:56 0 d-------- C:\Program Files\Maxis
2007-12-01 13:21:48 0 d-------- C:\Program Files\Common Files\InstallShield
2007-12-01 13:21:44 0 d--h----- C:\Program Files\InstallShield Installation Information
2007-12-01 13:21:16 0 d-------- C:\Program Files\Common Files
2007-12-01 12:53:16 0 d-------- C:\Documents and Settings\Louis Curti\Application Data\U3
2007-12-01 10:50:54 0 d-------- C:\Program Files\Common Files\Real
2007-12-01 10:50:31 0 d-------- C:\Documents and Settings\Louis Curti\Application Data\Real
2007-11-30 17:33:06 0 d-------- C:\Program Files\Common Files\Scanner
2007-11-30 17:30:10 0 d-------- C:\Documents and Settings\Louis Curti\Application Data\Lavasoft
2007-11-30 17:26:37 0 d-------- C:\Program Files\AIM
2007-11-30 17:26:29 0 d-------- C:\Documents and Settings\Louis Curti\Application Data\Aim
2007-11-27 02:04:17 0 d-------- C:\Program Files\ISM
2007-11-26 20:23:19 0 d-------- C:\Program Files\Symantec
2007-09-05 22:38:41 10 --a------ C:\WINDOWS\system32\kr_done1


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}]
11/26/2003 07:50 PM 116088 --a------ C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [10/25/2006 06:58 PM]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [10/30/2006 09:36 AM]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [10/19/2005 07:59 AM]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [05/11/2005 11:12 PM]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [10/19/2005 07:59 AM]
"Dell AIO Printer A920"="C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe" [04/10/2003 03:52 AM]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [08/24/2007 09:07 PM]
"osCheck"="C:\Program Files\Norton AntiVirus\osCheck.exe" [08/24/2007 08:53 PM]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [06/11/2007 01:25 AM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"autoload"="C:\WINDOWS\system32\drivers\smss.exe" []
"autorun"="C:\Documents and Settings\Louis Curti\smss.exe" []
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [10/13/2004 08:24 AM]
"Iisigpp"="C:\WINDOWS\??stem32\r?gsvr32.exe" [08/03/2004 11:56 PM]
"Huz"="C:\Program Files\??stem32\?hkdsk.exe" []
"Aida"="C:\DOCUME~1\LOUISC~1\APPLIC~1\PPPATC~1\dllhost.exe" []
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [02/27/2007 11:39 AM]

C:\Documents and Settings\Louis Curti\Start Menu\Programs\Startup\
DESKTOP.INI [9/3/2002 7:00:00 AM]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
DESKTOP.INI [9/3/2002 7:00:00 AM]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [5/11/2005 11:23:26 PM]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSaveSettings"=0 (0x0)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [12/20/2006 12:55 PM 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 02/27/2007 11:39 AM 282624 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{33622d6b-9dba-11da-8171-00038a000015}]
AutoRun\command- F:\LaunchU3.exe




-- End of Deckard's System Scanner: finished at 2007-12-02 10:52:27 ------------

[dcards]

Bump.

[tetonbob]

Hello and Welcome. Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe.

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

---------------------------------------------------------------------------------------------

1. Download combofix.exe to your desktop. We'll use this later.
   
2. Download SDFix and save it to your Desktop.
   
3. Disconnect from the internet....pull the plug!
   
   
   Double click SDFix.exe and it will extract the files to %systemdrive%
   (Drive that contains the Windows Directory, typically C:\SDFix)
   
   
   Please then reboot your computer in Safe Mode by doing the following :
   • Restart your computer
   • After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
   • Instead of Windows loading as normal, the Advanced Options Menu should appear;
   • Select the first option, to run Windows in Safe Mode, then press Enter.
   • Choose your usual account.
   
   
   • Open the extracted SDFix folder and double click RunThis.bat to start the script.
   • Type Y to begin the cleanup process.
   • It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
   • Press any Key and it will restart the PC.
   • When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
   • Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
     (Report.txt will also be copied to Clipboard ready for posting back on the forum).
   • Post that log, C:\SDFix\report.txt , in your next reply at the end of this fix.
   
   
   Once SDFix has finished it's routine, run ComboFix:
   
   
4. Disable your real time protection of your Anti-Virus. Exit the program via the SystemTray icon.
5. Run ComboFix, using these instructions:
   
   Click the Windows 'Start' button > Select 'Run' - then copy/paste this into the run box & click OK
   

   "%userprofile%\desktop\combofix.exe" /killall

6. Type "1" and press Enter to begin the scan.
7. When finished, it shall produce a log for you. Post that log in your next reply.
   
   Note:
   Do not mouseclick combofix's window whilst it's running. That may cause it to stall
   
   ---------------------------------------------------------------------------------------------
   
8. Re-enable your Anti-Virus if it is not active...a reboot should have re-activated it.
   
9. Re-establish an internet connection.
   
10. Please download HijackThis to your desktop
    
    Alternate link
    
    Double-click on the file you just downloaded.
    Click on the "Unzip" button to install. It will by default install to the directory - C:\Program Files\Trend Micro\HijackThis
    
    Upon install, HijackThis should open for you.
    
    Should it not open, navigate to C:\Program Files\Trend Micro\HijackThis and double click on HijackThis.exe
    
    1. If it gives you an intro screen, just choose 'Do a system scan and save a logfile'.
    2. If you don't get the intro screen, just hit Scan and then click on Save log.
    3. Post the hijackthis.log file here. Do not fix anything in HijackThis since they may be harmless.
    
    
    ---------------------------------------------------------------------------------------------

Please return with logs from:

SDFix
ComboFix
HijackThis

[dcards]

Hi! Thanks for your reply. Below is the HijackThis log file and attched are the SDFix and Combofix reports.

Thanks for any help you can give.


SDFix: Version 1.117

Run by Administrator on Thu 12/06/2007 at 12:31 PM

Microsoft Windows XP [Version 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:

Name:
fwdrv.sys
ICF

Path:
\??\C:\fwdrv.sys
C:\WINDOWS\system32\svchost.exe:exe.exe

fwdrv.sys - Deleted
ICF - Deleted



Restoring Windows Registry Values
Restoring Windows Default Hosts File
Restoring Missing Security Center Service
Restoring Missing SharedAccess Service

Rebooting...


Normal Mode:
Checking Files:

Trojan Files Found:

C:\wintemp.log - Deleted
C:\WINDOWS\Casino.ico - Deleted
C:\WINDOWS\Free Online Dating.ico - Deleted
C:\WINDOWS\Spyware Remover.ico - Deleted
C:\WINDOWS\system32\kr_done1 - Deleted
C:\WINDOWS\system32\lt.res - Deleted
C:\WINDOWS\system32\sft.res - Deleted
C:\WINDOWS\wr.txt - Deleted



Folder C:\Documents and Settings\All Users\Documents\Settings - Removed

Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
: ADS Found!

svchost.exe: deleted 51200 bytes in 1 streams.

Checking for remaining Streams

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.



Final Check:

catchme 0.3.1262.1 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-06 14:38:36
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services:
------------------



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

Remaining Files:
---------------

File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes:

Wed 5 Nov 2003 6,473 A.SH. --- "C:\WINDOWS\SYSTEM32\kjkmp.bak1"
Wed 26 Nov 2003 6,513 A.SH. --- "C:\WINDOWS\SYSTEM32\kjkmp.bak2"
Wed 26 Nov 2003 6,472 A.SH. --- "C:\WINDOWS\SYSTEM32\yccdd.bak1"
Mon 26 Nov 2007 6,473 A.SH. --- "C:\WINDOWS\SYSTEM32\yccdd.bak2"
Wed 14 May 2003 43,008 ...H. --- "C:\Program Files\Common Files\Adobe\ESD\DLMCleanup.exe"
Wed 8 Aug 2007 400 A..H. --- "C:\Program Files\Common Files\Symantec Shared\COH\COH32LU.reg"
Wed 8 Aug 2007 403 A..H. --- "C:\Program Files\Common Files\Symantec Shared\COH\COHDLU.reg"

Finished!

ComboFix 07-12-05.2 - Louis Curti 2007-12-06 14:51:29.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.466 [GMT -8:00]
Running from: C:\Documents and Settings\Louis Curti\desktop\combofix.exe
Command switches used :: /killall
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\check_LSA7.txt
C:\Documents and Settings\All Users\Application Data\SystemDoctor
C:\Documents and Settings\Louis Curti\Application Data\PPPATC~1
C:\Documents and Settings\Louis Curti\Application Data\PPPATC~1\?ppPatch\
C:\Documents and Settings\Louis Curti\Application Data\SystemDoctor
C:\Documents and Settings\Louis Curti\Application Data\SystemDoctor\Logs\Activate.log
C:\Documents and Settings\Louis Curti\Application Data\SystemDoctor\Logs\update.log
C:\Documents and Settings\Louis Curti\Application Data\WinTouch
C:\Documents and Settings\Louis Curti\Application Data\WinTouch\wintouch.cfg
C:\Documents and Settings\Louis Curti\ResErrors.log
C:\Program Files\ISM
C:\Program Files\ISM\dictionary.gz
C:\Program Files\ISM\targets.gz
C:\Program Files\ISM\Uninstall.exe
C:\Program Files\racle~1
C:\Program Files\stem32~1
C:\WINDOWS\curity~1
C:\WINDOWS\curity~1\s?stem\
C:\WINDOWS\ecurit~1
C:\WINDOWS\smante~1
C:\WINDOWS\stem32~1
C:\WINDOWS\system32\drivers\fad.sys
C:\WINDOWS\system32\ssembl~1

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_ASC355
-------\LEGACY_ASC355O
-------\LEGACY_FWDRV.SYS
-------\LEGACY_NPF


((((((((((((((((((((((((( Files Created from 2007-11-06 to 2007-12-06 )))))))))))))))))))))))))))))))
.

2007-12-06 12:30 . 2007-12-06 12:30 <DIR> d-------- C:\WINDOWS\ERUNT
2007-12-06 12:16 . 2007-12-06 12:16 <DIR> d-------- C:\Documents and Settings\NetworkService\Application Data\Webroot
2007-12-02 14:35 . 2007-12-02 14:35 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\Webroot
2007-12-02 14:35 . 2007-12-02 14:35 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Webroot
2007-12-02 14:35 . 2007-10-01 16:40 1,526,072 --a------ C:\WINDOWS\WRSetup.dll
2007-12-02 14:35 . 2007-10-01 16:24 163,640 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\ssidrv.sys
2007-12-02 14:35 . 2007-10-01 16:24 23,864 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\sskbfd.sys
2007-12-02 14:35 . 2007-10-01 16:24 21,816 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\sshrmd.sys
2007-12-02 14:35 . 2007-10-01 16:24 20,280 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\SSFS0BB9.sys
2007-12-02 14:34 . 2007-12-02 14:34 164 --a------ C:\install.dat
2007-12-02 14:32 . 2007-12-02 14:32 <DIR> d-------- C:\Documents and Settings\Louis Curti\Application Data\Webroot
2007-12-02 10:49 . 2007-12-02 10:49 <DIR> d-------- C:\Deckard
2007-12-01 13:15 . 2007-12-01 13:15 <DIR> d-------- C:\Documents and Settings\Louis Curti\Application Data\Wireshark
2007-12-01 12:55 . 2007-12-01 12:56 <DIR> d-------- C:\Program Files\Wireshark
2007-12-01 10:39 . 2007-12-01 14:36 <DIR> d-------- C:\WINDOWS\SYSTEM32\ActiveScan
2007-12-01 10:39 . 2007-12-01 13:35 30,590 --a------ C:\WINDOWS\SYSTEM32\pavas.ico
2007-11-30 20:38 . 2007-11-30 20:38 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-11-30 20:38 . 2007-11-30 20:38 <DIR> d-------- C:\Documents and Settings\Louis Curti\Application Data\SUPERAntiSpyware.com
2007-11-30 19:15 . 2007-11-30 19:15 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Grisoft
2007-11-30 19:09 . 2007-11-30 19:09 <DIR> d-------- C:\Documents and Settings\Louis Curti\Application Data\Grisoft
2007-11-30 19:09 . 2007-05-30 04:10 10,872 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\AvgAsCln.sys
2007-11-30 17:29 . 2007-11-30 17:29 2 --a------ C:\WINDOWS\msoffice.ini
2007-11-26 20:48 . 2007-11-26 20:48 6,473 --ahs---- C:\WINDOWS\SYSTEM32\yccdd.bak2
2007-11-26 20:21 . 2007-07-09 05:09 584,192 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\rpcrt4.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-06 23:02 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2007-12-03 02:13 --------- d-----w C:\Documents and Settings\Louis Curti\Application Data\U3
2007-12-01 22:19 --------- d-----w C:\Program Files\SUPERAntiSpyware
2007-12-01 22:19 --------- d-----w C:\Program Files\QuickTime
2007-12-01 22:19 --------- d-----w C:\Program Files\Norton AntiVirus
2007-12-01 22:06 --------- d-----w C:\Program Files\iTunes
2007-12-01 22:04 --------- d-----w C:\Program Files\Dell AIO Printer A920
2007-12-01 21:26 --------- d-----w C:\Program Files\MSN Games
2007-12-01 21:23 --------- d-----w C:\Program Files\Viewpoint
2007-12-01 21:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint
2007-12-01 21:22 --------- d-----w C:\Program Files\Maxis
2007-12-01 21:21 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-01 21:21 --------- d-----w C:\Program Files\Common Files\InstallShield
2007-12-01 18:50 --------- d-----w C:\Program Files\Common Files\Real
2007-12-01 01:39 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-12-01 01:33 --------- d-----w C:\Program Files\Common Files\Scanner
2007-12-01 01:30 --------- d-----w C:\Documents and Settings\Louis Curti\Application Data\Lavasoft
2007-12-01 01:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL
2007-12-01 01:26 --------- d-----w C:\Program Files\AIM
2007-12-01 01:26 --------- d-----w C:\Documents and Settings\Louis Curti\Application Data\Aim
2007-11-27 04:23 805 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2007-11-27 04:23 123,952 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2007-11-27 04:23 10,740 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2007-11-27 04:23 --------- d-----w C:\Program Files\Symantec
2003-11-06 00:44 6,473 --sha-w C:\WINDOWS\SYSTEM32\kjkmp.bak1
2003-11-27 00:00 6,513 --sha-w C:\WINDOWS\SYSTEM32\kjkmp.bak2
2003-11-27 03:44 6,472 --sha-w C:\WINDOWS\SYSTEM32\yccdd.bak1
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}]
2003-11-26 19:50 116088 --a------ C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 08:24]
"Iisigpp"="C:\WINDOWS\??stem32\r?gsvr32.exe" [2004-08-03 23:56]
"Huz"="C:\Program Files\??stem32\?hkdsk.exe" []
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-02-27 11:39]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-10-25 18:58]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-10-30 09:36]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-10-19 07:59]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 23:12]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-10-19 07:59]
"Dell AIO Printer A920"="C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe" [2003-04-10 03:52]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-08-24 21:07]
"osCheck"="C:\Program Files\Norton AntiVirus\osCheck.exe" [2007-08-24 20:53]
"SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" [2007-10-01 16:40]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-11 23:23:26]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 12:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-02-27 11:39 282624 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

R0 SSFS0BB9;Spy Sweeper File System Filer Driver: 0BB9;C:\WINDOWS\system32\Drivers\SSFS0BB9.SYS
R2 LiveUpdate Notice;LiveUpdate Notice;"C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon
R3 SymIMMP;SymIMMP;C:\WINDOWS\system32\DRIVERS\SymIM.sys
R3 WmaCDriverV32;WmaCDriverV32;C:\WINDOWS\system32\drivers\WmaCDriverV32.sys
S3 A3AB;D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB);C:\WINDOWS\system32\DRIVERS\A3AB.sys
S3 COH_Mon;COH_Mon;\??\C:\WINDOWS\system32\Drivers\COH_Mon.sys
S3 SymIM;Symantec Network Security Intermediate Filter Service;C:\WINDOWS\system32\DRIVERS\SymIM.sys

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{33622d6b-9dba-11da-8171-00038a000015}]
\Shell\AutoRun\command - F:\LaunchU3.exe

.
Contents of the 'Scheduled Tasks' folder
"2007-12-02 22:16:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-12-06 15:18:09 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Louis Curti.job"
- C:\Program Files\Norton AntiVirus\Navw32.exe
.
**************************************************************************

catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-06 15:03:47
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-06 15:05:30 - machine was rebooted
.
--- E O F ---


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:17:10 PM, on 12/6/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\GeekSquad\upssrv.exe
C:\GeekSquad\upsio.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Dell AIO Printer A920\dlbkbmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com.../fix_homepage/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Dell AIO Printer A920] "C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Iisigpp] C:\WINDOWS\??stem32\r?gsvr32.exe
O4 - HKCU\..\Run: [Huz] "C:\Program Files\??stem32\?hkdsk.exe"
O4 - HKCU\..\Run: [SUPERAntiSpyware] "C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe"
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - http://atv.disney.go.com/global/down.../OTOYAX29b.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramewor...o.cab56649.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pu...sh/swflash.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/popcaploader_v10.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: UPS Service (CyberPowerUPS) - Unknown owner - C:\GeekSquad\upssrv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

--
End of file - 5940 bytes

[tetonbob]

Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\WINDOWS\SYSTEM32\yccdd.bak2
C:\WINDOWS\SYSTEM32\kjkmp.bak1
C:\WINDOWS\SYSTEM32\kjkmp.bak2
C:\WINDOWS\SYSTEM32\yccdd.bak1

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Iisigpp"=-
"Huz"=-

Save this as CFScript.txt




Refering to the picture above, drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply.

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

---------------------------------------------------------------------------------------------


I see you have SUPERAntiSpyware....

• Load SUPERAntiSpyware and click the Check for Updates button.
• Once the update has finished, exit SUPERAntiSpyware. Please do NOT run a scan yet!

Restart your computer and boot into Safe Mode by tapping the F8 key repeatedly until a menu shows up (and choose Safe Mode from the list). In some systems, this may be the F5 key, so try that if F8 doesn't work. Login on your usual account. Make sure to close any open browsers.

---------------------------------------------------------------------------------------------

IMPORTANT: Do NOT open any other windows or programs while SUPERAntiSpyware is scanning, it may interfere with the scanning process.

• Open SUPERAntiSpyware and click the Scan your Computer button.
• Check Perform Complete Scan and then click Next.
• SUPERAntiSpyware will now scan your computer and when it’s finished it will list all the infections it has found.
• Make sure that they all have a check next to them, and then click Next.
• Click Finish and you will be taken back to the main interface.
• It could be possible that it will ask you to reboot your computer in order to delete some files after reboot.
• I'll need a log afterwards of what has been found.
• To get the log, click Preferences and then click the Statistics/Logs tab. Click the dated log and press View Log and a text file will appear.
• Please post the results of the SUPERAntiSpyware login your next reply.

---------------------------------------------------------------------------------------------

Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here.

---------------------------------------------------------------------------------------------

[dcards]

Hi,

Here's the log from SUPERAntiSpyware and the ComboFix report is attached

SUPERAntiSpyware Scan Log
Generated 11/30/2007 at 10:18 PM

Application Version : 3.6.1000

Core Rules Database Version : 3190
Trace Rules Database Version: 1200

Scan type : Complete Scan
Total Scan Time : 01:36:00

Memory items scanned : 466
Memory threats detected : 0
Registry items scanned : 5655
Registry threats detected : 30
File items scanned : 91855
File threats detected : 261

Trojan.WinFixer
HKLM\Software\Classes\CLSID\{21CF5CE6-5893-4736-A676-03F471E513DC}
HKCR\CLSID\{21CF5CE6-5893-4736-A676-03F471E513DC}
HKCR\CLSID\{21CF5CE6-5893-4736-A676-03F471E513DC}\InprocServer32
HKCR\CLSID\{21CF5CE6-5893-4736-A676-03F471E513DC}\InprocServer32#ThreadingModel
C:\WINDOWS\SYSTEM32\DDCCY.DLL
HKLM\Software\Classes\CLSID\{87B3BE7D-0390-4C1F-A97F-03298AA74A8B}
HKCR\CLSID\{87B3BE7D-0390-4C1F-A97F-03298AA74A8B}
HKCR\CLSID\{87B3BE7D-0390-4C1F-A97F-03298AA74A8B}\InprocServer32
HKCR\CLSID\{87B3BE7D-0390-4C1F-A97F-03298AA74A8B}\InprocServer32#ThreadingModel
HKLM\Software\Classes\CLSID\{A302B865-326D-4BD2-A55A-1BC46CFEDA3B}
HKCR\CLSID\{A302B865-326D-4BD2-A55A-1BC46CFEDA3B}
HKCR\CLSID\{A302B865-326D-4BD2-A55A-1BC46CFEDA3B}\InprocServer32
HKCR\CLSID\{A302B865-326D-4BD2-A55A-1BC46CFEDA3B}\InprocServer32#ThreadingModel
C:\WINDOWS\SYSTEM32\SSQRQ.DLL

Adware.Vundo Variant
HKLM\Software\Classes\CLSID\{42452F52-EB5F-47CB-B6C7-07056A3C2A42}
HKCR\CLSID\{42452F52-EB5F-47CB-B6C7-07056A3C2A42}
HKCR\CLSID\{42452F52-EB5F-47CB-B6C7-07056A3C2A42}\InprocServer32
HKCR\CLSID\{42452F52-EB5F-47CB-B6C7-07056A3C2A42}\InprocServer32#ThreadingModel
C:\WINDOWS\SYSTEM32\PMNLM.DLL
HKLM\Software\Classes\CLSID\{9F96950C-C305-4B36-8F37-D15C339F4415}
HKCR\CLSID\{9F96950C-C305-4B36-8F37-D15C339F4415}
HKCR\CLSID\{9F96950C-C305-4B36-8F37-D15C339F4415}\InprocServer32
HKCR\CLSID\{9F96950C-C305-4B36-8F37-D15C339F4415}\InprocServer32#ThreadingModel
C:\WINDOWS\SYSTEM32\JKKJH.DLL
HKLM\Software\Classes\CLSID\{AEFC8277-09EE-43A9-BEC9-F737BAE20BFF}
HKCR\CLSID\{AEFC8277-09EE-43A9-BEC9-F737BAE20BFF}
HKCR\CLSID\{AEFC8277-09EE-43A9-BEC9-F737BAE20BFF}\InprocServer32
HKCR\CLSID\{AEFC8277-09EE-43A9-BEC9-F737BAE20BFF}\InprocServer32#ThreadingModel
C:\WINDOWS\SYSTEM32\GEEBB.DLL

Registry Cleaner Trial
HKCR\Install.Install
HKCR\Install.Install\CLSID
HKCR\Install.Install\CurVer
HKCR\Install.Install.1
HKCR\Install.Install.1\CLSID

Trojan.Unknown Origin
HKLM\SOFTWARE\Microsoft\MSSMGR

Trojan.Spam-RUCrzy
C:\CD1007.NLS
C:\CD1009.NLS
C:\CD1021.NLS
C:\CD1031.NLS
C:\CD1037.NLS
C:\CD1038.NLS
C:\CD1052.NLS
C:\CD1053.NLS
C:\CD1055.NLS
C:\CD1082.NLS
C:\CD1084.NLS
C:\CD1106.NLS
C:\CD1118.NLS
C:\CD1127.NLS
C:\CD1142.NLS
C:\CD1145.NLS
C:\CD1153.NLS
C:\CD1179.NLS
C:\CD1190.NLS
C:\CD1191.NLS
C:\CD1202.NLS
C:\CD1209.NLS
C:\CD1221.NLS
C:\CD1224.NLS
C:\CD1253.NLS
C:\CD1270.NLS
C:\CD1272.NLS
C:\CD1281.NLS
C:\CD1287.NLS
C:\CD1288.NLS
C:\CD1291.NLS
C:\CD1292.NLS
C:\CD1299.NLS
C:\CD1303.NLS
C:\CD1306.NLS
C:\CD1308.NLS
C:\CD1309.NLS
C:\CD1310.NLS
C:\CD1316.NLS
C:\CD1322.NLS
C:\CD1328.NLS
C:\CD1333.NLS
C:\CD1343.NLS
C:\CD1350.NLS
C:\CD1355.NLS
C:\CD1359.NLS
C:\CD1362.NLS
C:\CD1370.NLS
C:\CD1382.NLS
C:\CD1383.NLS
C:\CD1386.NLS
C:\CD1389.NLS
C:\CD1391.NLS
C:\CD1393.NLS
C:\CD1413.NLS
C:\CD1418.NLS
C:\CD1421.NLS
C:\CD1422.NLS
C:\CD1433.NLS
C:\CD1439.NLS
C:\CD1464.NLS
C:\CD1472.NLS
C:\CD1476.NLS
C:\CD1483.NLS
C:\CD1484.NLS
C:\CD1485.NLS
C:\CD1491.NLS
C:\CD1510.NLS
C:\CD1512.NLS
C:\CD1519.NLS
C:\CD1523.NLS
C:\CD1537.NLS
C:\CD1538.NLS
C:\CD1541.NLS
C:\CD1580.NLS
C:\CD1588.NLS
C:\CD1591.NLS
C:\CD1596.NLS
C:\CD1600.NLS
C:\CD1604.NLS
C:\CD1609.NLS
C:\CD1617.NLS
C:\CD1618.NLS
C:\CD1623.NLS
C:\CD1626.NLS
C:\CD1634.NLS
C:\CD1636.NLS
C:\CD1639.NLS
C:\CD1646.NLS
C:\CD1648.NLS
C:\CD1651.NLS
C:\CD1662.NLS
C:\CD1664.NLS
C:\CD1688.NLS
C:\CD1702.NLS
C:\CD1703.NLS
C:\CD1704.NLS
C:\CD1712.NLS
C:\CD1716.NLS
C:\CD1723.NLS
C:\CD1729.NLS
C:\CD1734.NLS
C:\CD1745.NLS
C:\CD1756.NLS
C:\CD1757.NLS
C:\CD1762.NLS
C:\CD1767.NLS
C:\CD1771.NLS
C:\CD1777.NLS
C:\CD1778.NLS
C:\CD1798.NLS
C:\CD1813.NLS
C:\CD1827.NLS
C:\CD1833.NLS
C:\CD1836.NLS
C:\CD1859.NLS
C:\CD1868.NLS
C:\CD1869.NLS
C:\CD1875.NLS
C:\CD1886.NLS
C:\CD1888.NLS
C:\CD1893.NLS
C:\CD1900.NLS
C:\CD1909.NLS
C:\CD1924.NLS
C:\CD1929.NLS
C:\CD1935.NLS
C:\CD1941.NLS
C:\CD1942.NLS
C:\CD1944.NLS
C:\CD1945.NLS
C:\CD1946.NLS
C:\CD1962.NLS
C:\CD1966.NLS
C:\CD1989.NLS
C:\CD1995.NLS
C:\CD2003.NLS
C:\CD2006.NLS
C:\CD2008.NLS
C:\CD2020.NLS
C:\CD2021.NLS
C:\CD2030.NLS
C:\CD2035.NLS
C:\CD2040.NLS
C:\CD2072.NLS
C:\CD2075.NLS
C:\CD2093.NLS
C:\CD2097.NLS
C:\CD2101.NLS
C:\CD2107.NLS
C:\CD2115.NLS
C:\CD2141.NLS
C:\CD2150.NLS
C:\CD2156.NLS
C:\CD2157.NLS
C:\CD2161.NLS
C:\CD2168.NLS
C:\CD2195.NLS
C:\CD2199.NLS
C:\CD2200.NLS
C:\CD2249.NLS
C:\CD2264.NLS
C:\CD2281.NLS
C:\CD2290.NLS
C:\CD2314.NLS
C:\CD2322.NLS
C:\CD2323.NLS
C:\CD2337.NLS
C:\CD2348.NLS
C:\CD2350.NLS
C:\CD2358.NLS
C:\CD2374.NLS
C:\CD2376.NLS
C:\CD2401.NLS
C:\CD2410.NLS
C:\CD2416.NLS
C:\CD2421.NLS
C:\CD2430.NLS
C:\CD2436.NLS
C:\CD2446.NLS
C:\CD2447.NLS
C:\CD2448.NLS
C:\CD2451.NLS
C:\CD2457.NLS
C:\CD2458.NLS
C:\CD2478.NLS
C:\CD2503.NLS
C:\CD2506.NLS
C:\CD2511.NLS
C:\CD2514.NLS
C:\CD2529.NLS
C:\CD2537.NLS
C:\CD2538.NLS
C:\CD2547.NLS
C:\CD2548.NLS
C:\CD2556.NLS
C:\CD2557.NLS
C:\CD2573.NLS
C:\CD2574.NLS
C:\CD2587.NLS
C:\CD2589.NLS
C:\CD2595.NLS
C:\CD2602.NLS
C:\CD2616.NLS
C:\CD2622.NLS
C:\CD2624.NLS
C:\CD2629.NLS
C:\CD2644.NLS
C:\CD2655.NLS
C:\CD2657.NLS
C:\CD2658.NLS
C:\CD2667.NLS
C:\CD2668.NLS
C:\CD2673.NLS
C:\CD2699.NLS
C:\CD2705.NLS
C:\CD2711.NLS
C:\CD2718.NLS
C:\CD2726.NLS
C:\CD2728.NLS
C:\CD2741.NLS
C:\CD2753.NLS
C:\CD2758.NLS
C:\CD2788.NLS
C:\CD2796.NLS
C:\CD2805.NLS
C:\CD2807.NLS
C:\CD2811.NLS
C:\CD2815.NLS
C:\CD2829.NLS
C:\CD2840.NLS
C:\CD2842.NLS
C:\CD2844.NLS
C:\CD2861.NLS
C:\CD2869.NLS
C:\CD2881.NLS
C:\CD2890.NLS
C:\CD2892.NLS
C:\CD2894.NLS
C:\CD2895.NLS
C:\CD2902.NLS
C:\CD2912.NLS
C:\CD2930.NLS
C:\CD2931.NLS
C:\CD2938.NLS
C:\CD2942.NLS
C:\CD2954.NLS
C:\CD2958.NLS
C:\CD2961.NLS
C:\CD2966.NLS
C:\CD2977.NLS
C:\CD2986.NLS
C:\CD2998.NLS
C:\CD2999.NLS

Trojan.Downloader-CounterMeasures
C:\DOCUMENTS AND SETTINGS\NETWORKSERVICE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\G1LONXSQ\MUN1_26_11_070[1].EXE

Unclassified.Unknown Origin/System
C:\WINDOWS\SYSTEM32\PMKJK.DLL

[tetonbob]

Hi -

Open notepad and copy/paste the text in the quotebox below into it:

@ echo off
if exist look.txt del /q look.txt
dir /o/n "C:\WINDOWS\stem32~1" > look.txt
dir /o/n "C:\WINDOWS\stem32~2" >> look.txt
start notepad look.txt

Save this as peek.bat Choose to "Save type as - All Files"
It should look like this:
Double click on peek.bat & allow it to run

A text file will open. Please copy/paste the contents of that file in your next reply.


Also please do this:

Open notepad and copy/paste the text in the quotebox below into it:

vfind -ltf "%Systemdrive%\r?gsvr32.exe" >log2.txt
notepad log2.txt

Save this as peek2.bat Choose to "Save type as - All Files"
It should look like this:
Double click on peek.bat & allow it to run. A notepad file will open. Copy that information into your next reply, please.

[dcards]

Hi,

peek.bat


Volume in drive C is Curti3
Volume Serial Number is B038-A361

Directory of C:\WINDOWS

Volume in drive C is Curti3
Volume Serial Number is B038-A361

Directory of C:\WINDOWS


peek2.bat

----a-w 9,728 2002-08-29 11:00:00 C:\I386\REGSVR32.EXE
-c----w 9,728 2002-08-29 11:00:00 C:\WINDOWS\$NtServicePackUninstall$\regsvr32.exe
------w 11,776 2004-08-04 07:56:55 C:\WINDOWS\ServicePackFiles\i386\regsvr32.exe
----a-w 11,776 2004-08-04 07:56:55 C:\WINDOWS\SYSTEM32\regsvr32.exe

Entries: 4 (4)
Directories: 0 Files: 4
Bytes: 43,008 Blocks: 84

[tetonbob]

Hi -

Can you reboot your machine, please, and then post a new log from Deckard's System Scanner (dss.exe)?

[dcards]

wow, that was fast! :)

here ya go ...


Deckard's System Scanner v20071014.68
Run by Louis Curti on 2007-12-06 20:36:56
Computer is in Normal Mode.
--------------------------------------------------------------------------------



-- HijackThis (run as Louis Curti.exe) -----------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:37:05 PM, on 12/6/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\GeekSquad\upssrv.exe
C:\GeekSquad\upsio.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Dell AIO Printer A920\dlbkbmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Data\Software\dds\dss.exe
C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
C:\PROGRA~1\TRENDM~1\HIJACK~1\Louis Curti.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com.../fix_homepage/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Dell AIO Printer A920] "C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] "C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe"
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - http://atv.disney.go.com/global/down.../OTOYAX29b.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramewor...o.cab56649.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pu...sh/swflash.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/popcaploader_v10.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: UPS Service (CyberPowerUPS) - Unknown owner - C:\GeekSquad\upssrv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

--
End of file - 5720 bytes

-- Files created between 2007-11-06 and 2007-12-06 -----------------------------

2007-12-06 16:30:44 0 d-------- C:\Documents and Settings\Administrator\Application Data\SUPERAntiSpyware.com
2007-12-06 16:16:18 6736 --a------ C:\WINDOWS\system32\drivers\PROCEXP90.SYS <Not Verified; Sysinternals - www.sysinternals.com; Process Explorer>
2007-12-06 12:30:23 0 d-------- C:\WINDOWS\ERUNT
2007-12-06 12:16:58 0 d-------- C:\Documents and Settings\NetworkService\Application Data\Webroot
2007-12-02 14:35:39 0 d-------- C:\Documents and Settings\LocalService\Application Data\Webroot
2007-12-02 14:35:29 0 d-------- C:\Documents and Settings\All Users\Application Data\Webroot
2007-12-02 14:34:48 164 --a------ C:\install.dat
2007-12-02 14:32:57 0 d-------- C:\Documents and Settings\Louis Curti\Application Data\Webroot
2007-12-01 13:15:00 0 d-------- C:\Documents and Settings\Louis Curti\Application Data\Wireshark
2007-12-01 12:55:59 0 d-------- C:\Program Files\Wireshark
2007-12-01 10:39:37 0 d-------- C:\WINDOWS\system32\ActiveScan
2007-11-30 20:38:52 0 d-------- C:\Documents and Settings\Louis Curti\Application Data\SUPERAntiSpyware.com
2007-11-30 20:38:34 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-11-30 19:15:26 0 d-------- C:\Documents and Settings\Administrator\Application Data\Grisoft
2007-11-30 19:09:51 0 d-------- C:\Documents and Settings\Louis Curti\Application Data\Grisoft
2007-11-26 22:01:53 0 d-------- C:\Documents and Settings\Default User\Application Data\Apple Computer


-- Find3M Report ---------------------------------------------------------------

2007-12-06 17:38:01 0 d-------- C:\Program Files\SUPERAntiSpyware
2007-12-06 15:13:38 0 d-------- C:\Program Files\Trend Micro
2007-12-06 1545 0 d-------- C:\Program Files\Common Files\Symantec Shared
2007-12-02 18:13:53 0 d-------- C:\Documents and Settings\Louis Curti\Application Data\U3
2007-12-01 14:19:55 0 d-------- C:\Program Files\QuickTime
2007-12-01 14:19:24 0 d-------- C:\Program Files\Norton AntiVirus
2007-12-01 1423 0 d-------- C:\Program Files\iTunes
2007-12-01 14:04:18 0 d-------- C:\Program Files\Dell AIO Printer A920
2007-12-01 13:26:05 0 d-------- C:\Program Files\MSN Games
2007-12-01 13:23:59 0 d-------- C:\Program Files\Viewpoint
2007-12-01 13:22:56 0 d-------- C:\Program Files\Maxis
2007-12-01 13:21:48 0 d-------- C:\Program Files\Common Files\InstallShield
2007-12-01 13:21:44 0 d--h----- C:\Program Files\InstallShield Installation Information
2007-12-01 13:21:16 0 d-------- C:\Program Files\Common Files
2007-12-01 10:50:54 0 d-------- C:\Program Files\Common Files\Real
2007-12-01 10:50:31 0 d-------- C:\Documents and Settings\Louis Curti\Application Data\Real
2007-11-30 17:33:06 0 d-------- C:\Program Files\Common Files\Scanner
2007-11-30 17:30:10 0 d-------- C:\Documents and Settings\Louis Curti\Application Data\Lavasoft
2007-11-30 17:26:37 0 d-------- C:\Program Files\AIM
2007-11-30 17:26:29 0 d-------- C:\Documents and Settings\Louis Curti\Application Data\Aim
2007-11-26 20:23:19 0 d-------- C:\Program Files\Symantec


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}]
11/26/2003 07:50 PM 116088 --a------ C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [10/25/2006 06:58 PM]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [10/30/2006 09:36 AM]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [10/19/2005 07:59 AM]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [05/11/2005 11:12 PM]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [10/19/2005 07:59 AM]
"Dell AIO Printer A920"="C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe" [04/10/2003 03:52 AM]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [08/24/2007 09:07 PM]
"osCheck"="C:\Program Files\Norton AntiVirus\osCheck.exe" [08/24/2007 08:53 PM]
"SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" [10/01/2007 04:40 PM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [10/13/2004 08:24 AM]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [02/27/2007 11:39 AM]

C:\Documents and Settings\Louis Curti\Start Menu\Programs\Startup\
DESKTOP.INI [9/3/2002 7:00:00 AM]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
DESKTOP.INI [9/3/2002 7:00:00 AM]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [5/11/2005 11:23:26 PM]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [12/20/2006 12:55 PM 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 02/27/2007 11:39 AM 282624 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WebrootSpySweeperService]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{33622d6b-9dba-11da-8171-00038a000015}]
AutoRun\command- F:\LaunchU3.exe




-- End of Deckard's System Scanner: finished at 2007-12-06 20:37:36 ------------

[tetonbob]

Ok, that part looks much better.

Please run this online scan to help look for remnants.

First, Go to Start>Control Panel>Add/Remove Programs and remove Kaspersky online scanner if present prior to downloading the most up-to-date one.

Next, establish an internet connection & perform an online scan using Internet Explorer at Kaspersky Online Scanner

Answer Yes, when prompted to install an ActiveX component.

• The program will then begin downloading the latest definition files.
• Once the files have been downloaded click on NEXT
• Locate the Scan Settings button & configure to:
  • Scan using the following Anti-Virus database:
    • Extended
  • Scan Options:
    • Scan Archives
    • Scan Mail Bases
• Click OK & have it scan My Computer
• Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
• Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

* Turn off the real time scanner of any existing antivirus program while performing the online scan

Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%.

---------------------------------------------------------------------------------------------

[dcards]

Report from Kaspersky is attached. Thanks

[tetonbob]

How is the machine behaving now?

[dcards]

seems to be good ... no emails being automatically sent ... the bandwidth is clear ... amazing!! I'll keep it on line for the day and see what happens. If all is clear I'll close the issue ... thanks very much for your help and especially your prompt replies!!

one quick question ... is there a resource I can read to troubleshoot the next problem (just so I don't have to bother you next time)? Learn how to read the reports, know what BAT files to create, etc ... ?

[tetonbob]

Well, I've been doing this for several years, and still learn new things all the time. A lot can be found out by researching and reading, but unless you really know what you're doing, best to get advice. It's no bother, that's why we're here.

The items found by Kaspersky are in System Restore points, and will be addressed in the following steps.

Your logs appear clean. We still have a few items to address.

Go to -> Run -> copy/paste in the following single line command & click OK

combofix /u

This will uninstall ComboFix. It will also implement some cleanup procedures and reset System Restore points.

Now that your system is clean, to help protect your computer in the future I recommend that you follow these steps and use the following free programs:

• Microsoft Windows Update - http://www.windowsupdate.com
  Visit regularly. This will ensure your computer always has the latest security updates. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
  
  
• SpywareBlaster to help prevent spyware from installing in the first place.
  • Install & update SpywareBlaster with the latest definitions.
    After you have updated, click the button - enable protection for all unprotected items
• SpywareGuard to catch and block spyware before it can execute.
  
  
  IE-SpyAd - IE/Spyad places more than 4000 dubious websites and domains in the IE Restricted list. This severely impairs attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites. An installation tutorial is available here.
  
  
• MVPS HOST FILE
  The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites form serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer.
  • Download Host.zip to your desktop.
  • From your Desktop right-click (hosts.zip) and select:
    Extract All from the menu.
    
  • Click Next, click Next, select the option:
    "Show Extracted files", click Finish
    
  • This will open the newly created hosts folder on your Desktop.
    
  • Double-click on the included mvps.bat file, this will rename the existing HOSTS file to HOSTS.MVP, then it will copy the included updated HOSTS file to the correct location on your machine.
    
  • Once updated you should see another prompt that the task was completed.
• ANTIVIRUS SOFTWARE
  It is very important that you have anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future. It is imperative that you update your antivirus software at least once a week (even more if you wish). If you do not update your antivirus software then it will not be able to catch new malware that may have come out.
  
  Do not install more than one AntiVirus program because they will conflict with each other.
  
  
• FIREWALL
  If you do not have a firewall, here are a couple of great free ones available for personal use. Using a third-party firewall will allow you to give/deny access for applications that want to go online. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. A tutorial on Firewalls and a listing of some available ones can be found here
  
  Do not install more than one firewall program because they will conflict with each other.

Scan here http://secunia.com/software_inspector/ for out of date & vulnerable common applications on your computer

Here are some additional utilities that will further enhance your safety.

• http://www.trillian.cc ? Trillian or http://www.miranda-im.com ? Miranda-IM - These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN)
  
  
• http://www.mozilla.org/products/firefox/ - Firefox - Use this alternate browser. While Internet Explorer is not a bad browser, almost every exploit crafted is targeted to take advantage of an IE weakness.
  
  
• http://java.com/en/index.jsp - Sun's Java - It's much more secure than Microsoft's Java Virtual Machine.
  
  
• http://www.aumha.org/downloads/erunt-setup.exe - ERUNT - A useful freeware utility for users of Windows 2000/XP. It's made up of two parts - ERUNT & NTREGOPT.
  
  ERUNT will create daily complete backups of your computer's Registry. Whilst System Restore does the same thing, a corrupt registry file may prevent Windows from booting & this effectively renders disables System Restore. With ERUNT, you're able to restore the damaged Registry.
  
  NTREGOPT works by recreating each registry hive "from scratch", thus removing any slack space that may be left from previously modified or deleted keys. In other words, it compacts the Registry to a small size which allows Windows to load & perform faster.

In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles

• HOW DID I GET INFECTED IN THE FIRST PLACE?
• MAKING INTERNET EXPLORER SAFER

If you want to fight back the Malware Writers that have made your life a misery, please take a look here and read what you can do against it.

Please respond to this thread one more time so we can mark this thread as resolved.

[dcards]

Everything is working great! Thanks again. How do I mark this issue resolved?

[tetonbob]

The forum threads have a drop down under Thread Tools, but we archive ours in Resolved HJT, which is where I'll place this now.

Safe Surfing to you!