[SOLVED] Need vundo help please

aeisenbaum · 02-09-2008, 03:15 AM

c drive is red x mark. Tons of pos tmp files in mydocuments. I could not successfully run panda. Windows live onecare scan states it was unable to clean Vundo.gen!A

Deckard's System Scanner v20071014.68
Run by Emily Salazar on 2008-02-09 02:51:22
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.

-- Last 5 Restore Point(s) --
45: 2008-02-09 09:51:34 UTC - RP392 - Deckard's System Scanner Restore Point
44: 2008-02-09 06:55:14 UTC - RP391 - ComboFix created restore point
43: 2008-02-08 23:58:00 UTC - RP390 - Removed Trend Micro Internet Security
42: 2008-02-07 10:48:49 UTC - RP389 - Software Distribution Service 3.0
41: 2008-02-07 10:35:28 UTC - RP388 - Software Distribution Service 3.0

-- First Restore Point --
1: 2008-02-06 05:18:51 UTC - RP348 - System Checkpoint

Backed up registry hives.
Performed disk cleanup.

Total Physical Memory: 504 MiB (512 MiB recommended).

-- HijackThis (run as Emily Salazar.exe) ---------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:52:41 AM, on 2/9/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\Explorer.EXE
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\McAfee\MPS\mps.exe
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\Program Files\McAfee\MPS\mpsevh.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\dlcccoms.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Qwest\QuickCare\agentui\quickcare.exe
C:\Documents and Settings\Emily Salazar\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Emily Salazar.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptcl.dll
O2 - BHO: (no name) - {BD4742DB-08DA-456D-A68F-7ACD99AA4801} - C:\WINDOWS\system32\awvtu.dll (file missing)
O4 - HKLM\..\Run: [Apoint] "C:\Program Files\Apoint\Apoint.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe"
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [RealTray] "C:\Program Files\Real\RealPlayer\RealPlay.exe" SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [dlccmon.exe] "C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QUICKCARE] "C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe" /P QUICKCARE
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] "C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe"
O4 - HKLM\..\Run: [IndexSearch] "C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe"
O4 - HKLM\..\Run: [SetDefPrt] "C:\Program Files\Brother\Brmfl04g\BrStDvPt.exe"
O4 - HKLM\..\Run: [ControlCenter2.0] "C:\Program Files\Brother\ControlCenter2\brctrcen.exe" /autorun
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKUS\S-1-5-18\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Default user')
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/pr02...s/MSNPUpld.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/res...lscbase370.cab
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} (cpbrkpie Control) - http://a19.g.akamai.net/7/19/7125/14...2/cpbrkpie.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O23 - Service: dlcc_device - Unknown owner - C:\WINDOWS\system32\dlcccoms.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe
O23 - Service: Microsoft cache control (MSControlService) - Unknown owner - C:\WINDOWS\system32\windows (file missing)
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

--
End of file - 8934 bytes

-- File Associations -----------------------------------------------------------

All associations okay.

-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R1 APPDRV - c:\windows\system32\drivers\appdrv.sys <Not Verified; Dell Inc; Application Driver>
R1 omci (OMCI WDM Device Driver) - c:\windows\system32\drivers\omci.sys <Not Verified; Dell Inc; OMCI Driver>
R2 AegisP (AEGIS Protocol (IEEE 802.1x) v3.2.0.3) - c:\windows\system32\drivers\aegisp.sys <Not Verified; Meetinghouse Data Communications; AEGIS Client 3.2.0.3>
R2 ASCTRM - c:\windows\system32\drivers\asctrm.sys <Not Verified; Windows (R) 2000 DDK provider; Windows (R) 2000 DDK driver>

S3 catchme - c:\docume~1\emilys~1\locals~1\temp\catchme.sys (file missing)
S3 wanatw (WAN Miniport (ATW)) - c:\windows\system32\drivers\wanatw4.sys (file missing)

-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 NICCONFIGSVC - c:\program files\dell\nicconfigsvc\nicconfigsvc.exe <Not Verified; Dell Inc.; NicConfigSvc>

S3 MSControlService (Microsoft cache control) - c:\windows\system32\windows (file missing)

-- Device Manager: Disabled ----------------------------------------------------

No disabled devices found.

-- Scheduled Tasks -------------------------------------------------------------

2008-02-08 17:09:20 356 --a------ C:\WINDOWS\Tasks\McDefragTask.job
2008-02-08 17:09:18 348 --a------ C:\WINDOWS\Tasks\McQcTask.job
2007-03-05 21:28:39 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job

-- Files created between 2008-01-09 and 2008-02-09 -----------------------------

2008-02-09 02:04:51 0 d-------- C:\WINDOWS\system32\ActiveScan
2008-02-09 02:04:48 0 d-------- C:\WINDOWS\LastGood
2008-02-09 01:08:33 0 d-------- C:\Program Files\Trend Micro
2008-02-08 23:54:37 68096 --a------ C:\WINDOWS\system32\zip.exe
2008-02-08 23:54:37 98816 --a------ C:\WINDOWS\system32\sed.exe
2008-02-08 23:54:37 80412 --a------ C:\WINDOWS\system32\grep.exe
2008-02-08 23:54:37 73728 --a------ C:\WINDOWS\system32\fdsv.exe <Not Verified; Smallfrogs Studio; >
2008-02-08 17:12:33 143360 --a------ C:\WINDOWS\system32\dunzip32.dll <Not Verified; Inner Media, Inc.; DynaZIP-32 Multi-Threading UnZIP DLL>
2008-02-08 17:08:53 0 d-------- C:\Program Files\McAfee.com
2008-02-07 19:18:35 0 d-------- C:\VundoFix Backups
2008-02-06 22:26:45 0 d-------- C:\Program Files\Windows Live Safety Center
2008-02-06 02:52:16 0 d-------- C:\Documents and Settings\Emily Salazar\Application Data\SiteAdvisor
2008-02-06 02:52:16 0 d-------- C:\Documents and Settings\All Users\Application Data\SiteAdvisor
2008-02-05 23:31:29 0 d-------- C:\Documents and Settings\All Users\Application Data\Trend Micro
2008-02-05 21:09:45 164 --a------ C:\install.dat
2008-01-31 01:22:26 0 d-------- C:\Documents and Settings\LocalService\Application Data\Sun
2008-01-31 00:22:19 4980736 --a------ C:\Documents and Settings\Emily Salazar\ntuser.dat
2008-01-30 23:42:35 0 d-------- C:\Documents and Settings\Emily Salazar\Application Data\McAfee
2008-01-30 22:50:15 0 d-------- C:\Documents and Settings\Emily Salazar\Application Data\Talkback
2008-01-30 22:49:28 0 d-------- C:\Documents and Settings\Emily Salazar\Application Data\Mozilla
2008-01-30 11:27:43 0 d-------- C:\Program Files\Common Files\McAfee
2008-01-30 11:27:30 0 d-------- C:\Program Files\McAfee
2008-01-30 10:47:51 0 d-------- C:\Documents and Settings\All Users\Application Data\McAfee
2008-01-30 10:16:51 0 d--hs---- C:\WINDOWS\RW1pbHkgU2FsYXphcg
2008-01-30 10:16:25 0 d-------- C:\WINDOWS\system32\tps5
2008-01-30 10:16:25 0 d-------- C:\WINDOWS\system32\leb3
2008-01-30 10:16:25 0 d-------- C:\WINDOWS\system32\gis6
2008-01-30 10:16:25 0 d-------- C:\WINDOWS\system32\dom1
2008-01-30 10:16:24 0 d-------- C:\WINDOWS\system32\rip4
2008-01-30 10:11:40 0 d-------- C:\WINDOWS\system32\nGpxx01

-- Find3M Report ---------------------------------------------------------------

2008-02-09 01:54:56 797 --a------ C:\Documents and Settings\Emily Salazar\Application Data\Launch Internet Explorer Browser.lnk
2008-02-07 03:17:19 0 d-------- C:\Program Files\Java
2008-02-07 03:05:56 0 d-------- C:\Program Files\Dell
2008-02-07 02:55:21 0 d-------- C:\Program Files\Common Files\supportsoft
2008-02-06 17:20:17 0 d-------- C:\Program Files\Google
2008-01-31 05:33:47 0 d-------- C:\Program Files\Common Files\Symantec Shared
2008-01-31 05:33:45 0 d-------- C:\Program Files\Symantec
2008-01-31 05:31:55 0 d-------- C:\Program Files\Common Files
2008-01-31 02:31:57 0 d-------- C:\Program Files\Messenger
2008-01-31 02:25:21 0 d-------- C:\Program Files\Online Services
2008-01-30 23:33:49 0 d-------- C:\Documents and Settings\Emily Salazar\Application Data\Move Networks
2008-01-29 14:51:20 0 d-------- C:\Program Files\Dl_cats
2008-01-28 14:44:39 0 d-------- C:\Documents and Settings\Emily Salazar\Application Data\AdobeUM

-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BD4742DB-08DA-456D-A68F-7ACD99AA4801}]
C:\WINDOWS\system32\awvtu.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [09/13/2004 02:33 PM]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [11/19/2003 03:48 PM]
"PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [04/11/2004 06:15 PM]
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [03/04/2005 09:26 AM]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [02/23/2005 02:19 PM]
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [10/13/2005 08:12 AM]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [02/16/2007 10:54 AM]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [07/27/2004 02:50 PM]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [07/27/2004 02:50 PM]
"dlccmon.exe"="C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe" [07/22/2005 12:03 PM]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [03/02/2007 03:24 PM]
"QUICKCARE"="C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe" [11/07/2006 08:07 PM]
"SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [10/14/2003 09:22 AM]
"PaperPort PTD"="C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe" [04/14/2004 01:46 PM]
"IndexSearch"="C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe" [04/14/2004 02:04 PM]
"SetDefPrt"="C:\Program Files\Brother\Brmfl04g\BrStDvPt.exe" [11/11/2004 04:14 PM]
"ControlCenter2.0"="C:\Program Files\Brother\ControlCenter2\brctrcen.exe" [01/07/2005 04:30 PM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 03:00 AM]
"DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" []

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [10/13/2005 8:05:39 AM]
QuickBooks Update Agent.lnk - C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [11/15/2005 3:31:34 AM]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

-- End of Deckard's System Scanner: finished at 2008-02-09 02:54:11 ------------

**TheBruce1** · 02-12-2008, 05:14 AM

Hello and welcome to TSF

Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe.

==========

Please follow all instructions and in which order they come, if you have any questions, please ask before proceeding. Its important that you follow this through until i give you the all clear, a lack of symptoms does not mean that it is no longer present.

===========

Please print out or copy this page to Notepad in order to assist you when carrying out the following instructions.

============

Download SDFix and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:SDFix)

Please then reboot your computer in Safe Mode by doing the following :

Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, the Advanced Options Menu should appear;
Select the first option, to run Windows in Safe Mode, then press Enter.
Choose your usual account.

Open the extracted SDFix folder and double click RunThis.bat to start the script.
Type Y to begin the cleanup process.
It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
Press any Key and it will restart the PC.
When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
(Report.txt will also be copied to Clipboard ready for posting back on the forum).
Finally paste the contents of the Report.txt back on the forum with the required logs

================

Please visit this webpage for download links, and instructions for running the tool: http://www.bleepingcomputer.com/comb...o-use-combofix

When the tool is finished, it will produce a report for you.
Please post the C:\ComboFix.txt along with a new HijackThis log so we may continue cleaning the system.

===============
Logs Required
Report.txt(from SDFix)
C:\Combofix.txt
Hijackthis Log

aeisenbaum · 02-12-2008, 02:04 PM

Thank you for helping me so far. One thing I did notice, is that in the system tray, the date was off by a day (said it was the 13th when it is the 12th). This may have happened after combofix, I'm not sure. I changed the date to the correct date. I hope that was ok. The three logs you requested are as follows:

SDFix: Version 1.141

Run by Emily Salazar on Tue 02/12/2008 at 01:03 PM

Microsoft Windows XP [Version 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:

Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...

Normal Mode:
Checking Files:

Trojan Files Found:

C:\PROGRA~1\MESSEN~1\RTEPRE~1.HTM - Deleted
C:\PROGRA~1\MESSEN~1\QUGAVAJ - Deleted

Removing Temp Files...

ADS Check:

Final Check:

catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-12 13:10:42
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:00000053
"TracesSuccessful"=dword:00000007

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

Remaining Services:
------------------

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

Remaining Files:
---------------

File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes:

Wed 19 Oct 2005 56 A.SHR --- "C:\i386\9CD1F59E4F.sys"
Wed 19 Oct 2005 1,890 A.SH. --- "C:\i386\KGyGaAvL.sys"
Thu 7 Sep 2006 4 A..H. --- "C:\WINDOWS\uccspecb.sys"
Wed 13 Oct 2004 1,694,208 ..SH. --- "C:\Program Files\Messenger\msmsgs.exe"
Wed 19 Oct 2005 56 ..SHR --- "C:\WINDOWS\system32\9CD1F59E4F.sys"
Wed 19 Oct 2005 1,890 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys"
Thu 26 Apr 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Fri 12 Nov 2004 37,376 ...H. --- "C:\Program Files\Common Files\Adobe\ESD\DLMCleanup.exe"

Finished!

ComboFix 08-02-13.1 - Emily Salazar 2008-02-12 13:35:08.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.223 [GMT -7:00]
Running from: C:\Documents and Settings\Emily Salazar\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\WINDOWS\system32\nGpxx01

----- BITS: Possible infected sites -----

hxxp://au.download.windo
.
((((((((((((((((((((((((( Files Created from 2008-01-13 to 2008-02-13 )))))))))))))))))))))))))))))))
.

2008-02-12 13:01 . 2008-02-12 13:01 <DIR> d-------- C:\WINDOWS\ERUNT
2008-02-12 12:51 . 2008-02-12 13:13 <DIR> d-------- C:\SDFix
2008-02-09 02:50 . 2008-02-09 02:50 <DIR> d-------- C:\Deckard
2008-02-09 02:04 . 2008-02-09 02:13 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2008-02-09 02:04 . 2008-02-09 02:26 30,590 --a------ C:\WINDOWS\system32\pavas.ico
2008-02-09 02:04 . 2008-02-09 02:26 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico
2008-02-09 02:04 . 2008-02-09 02:26 1,406 --a------ C:\WINDOWS\system32\Help.ico
2008-02-09 01:08 . 2008-02-09 01:08 <DIR> d-------- C:\Program Files\Trend Micro
2008-02-08 23:51 . 2004-08-04 03:00 388,608 --a------ C:\kmd.exe
2008-02-08 17:15 . 2008-02-12 13:29 3,806 --a------ C:\WINDOWS\system32\Config.MPF
2008-02-08 17:12 . 2006-03-03 11:07 143,360 --a------ C:\WINDOWS\system32\dunzip32.dll
2008-02-08 17:10 . 2007-06-25 10:57 37,480 --a------ C:\WINDOWS\system32\drivers\mfesmfk.sys
2008-02-08 17:10 . 2007-06-25 10:57 32,008 --a------ C:\WINDOWS\system32\drivers\mferkdk.sys
2008-02-08 17:09 . 2007-06-25 10:57 171,240 --a------ C:\WINDOWS\system32\drivers\mfehidk.sys
2008-02-08 17:09 . 2007-03-02 14:16 109,608 --a------ C:\WINDOWS\system32\drivers\Mpfp.sys
2008-02-08 17:09 . 2007-06-25 14:54 71,496 --a------ C:\WINDOWS\system32\drivers\mfeavfk.sys
2008-02-08 17:09 . 2007-06-25 10:57 34,184 --a------ C:\WINDOWS\system32\drivers\mfebopk.sys
2008-02-08 17:08 . 2008-02-08 17:09 <DIR> d-------- C:\Program Files\McAfee.com
2008-02-07 19:18 . 2008-02-07 19:52 <DIR> d-------- C:\VundoFix Backups
2008-02-07 03:18 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-02-06 22:26 . 2008-02-06 22:35 <DIR> d-------- C:\Program Files\Windows Live Safety Center
2008-02-06 02:52 . 2008-02-12 13:18 <DIR> d-------- C:\Documents and Settings\Emily Salazar\Application Data\SiteAdvisor
2008-02-06 02:52 . 2008-02-06 02:52 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SiteAdvisor
2008-02-06 01:59 . 2006-11-07 21:01 66,048 --a------ C:\WINDOWS\ieResetIcons.exe
2008-02-05 23:31 . 2008-02-05 23:31 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Trend Micro
2008-02-05 21:09 . 2008-02-05 21:09 164 --a------ C:\install.dat
2008-01-30 23:42 . 2008-02-05 23:02 <DIR> d-------- C:\Documents and Settings\Emily Salazar\Application Data\McAfee
2008-01-30 22:50 . 2008-01-30 22:50 <DIR> d-------- C:\Documents and Settings\Emily Salazar\Application Data\Talkback
2008-01-30 11:27 . 2008-02-08 17:13 <DIR> d-------- C:\Program Files\McAfee
2008-01-30 11:27 . 2008-02-08 17:12 <DIR> d-------- C:\Program Files\Common Files\McAfee
2008-01-30 10:47 . 2008-02-08 17:11 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\McAfee
2008-01-30 10:16 . 2008-01-30 10:16 <DIR> d-------- C:\WINDOWS\system32\tps5
2008-01-30 10:16 . 2008-01-31 05:12 <DIR> d-------- C:\WINDOWS\system32\rip4
2008-01-30 10:16 . 2008-02-07 01:30 <DIR> d-------- C:\WINDOWS\system32\leb3
2008-01-30 10:16 . 2008-01-31 05:05 <DIR> d-------- C:\WINDOWS\system32\gis6
2008-01-30 10:16 . 2008-01-31 00:20 <DIR> d-------- C:\WINDOWS\system32\dom1
2008-01-30 10:16 . 2008-01-31 05:12 <DIR> d--hs---- C:\WINDOWS\RW1pbHkgU2FsYXphcg
2008-01-30 10:16 . 2008-01-30 10:16 <DIR> d-------- C:\Temp\gTiis19
2008-01-30 10:11 . 2008-01-30 10:11 <DIR> d-------- C:\Temp\cXzz9

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-08 23:53 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-02-07 10:17 --------- d-----w C:\Program Files\Java
2008-02-07 10:05 --------- d-----w C:\Program Files\Dell
2008-02-07 10:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\GTek
2008-02-07 09:57 --------- d-----w C:\Documents and Settings\All Users\Application Data\SupportSoft
2008-02-07 09:55 --------- d-----w C:\Program Files\Common Files\supportsoft
2008-02-07 00:20 --------- d-----w C:\Program Files\Google
2008-01-31 12:33 --------- d-----w C:\Program Files\Symantec
2008-01-31 12:33 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-01-31 10:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-01-31 06:33 --------- d-----w C:\Documents and Settings\Emily Salazar\Application Data\Move Networks
2008-01-29 21:51 --------- d-----w C:\Program Files\Dl_cats
2008-01-28 21:44 --------- d-----w C:\Documents and Settings\Emily Salazar\Application Data\AdobeUM
2008-01-11 05:53 44,544 ------w C:\WINDOWS\system32\dllcache\pngfilt.dll
2008-01-08 17:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Dell
2007-12-19 23:01 347,136 ------w C:\WINDOWS\system32\dllcache\dxtmsft.dll
2007-12-18 09:51 179,584 ----a-w C:\WINDOWS\system32\drivers\mrxdav.sys
2007-12-18 09:51 179,584 ------w C:\WINDOWS\system32\dllcache\mrxdav.sys
2007-12-08 05:21 3,592,192 ------w C:\WINDOWS\system32\dllcache\mshtml.dll
2007-12-07 02:21 824,832 ----a-w C:\WINDOWS\system32\wininet.dll
2007-12-07 02:21 824,832 ------w C:\WINDOWS\system32\dllcache\wininet.dll
2007-12-07 02:21 671,232 ------w C:\WINDOWS\system32\dllcache\mstime.dll
2007-12-07 02:21 63,488 ------w C:\WINDOWS\system32\dllcache\icardie.dll
2007-12-07 02:21 6,066,176 ------w C:\WINDOWS\system32\dllcache\ieframe.dll
2007-12-07 02:21 52,224 ------w C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2007-12-07 02:21 478,208 ------w C:\WINDOWS\system32\dllcache\mshtmled.dll
2007-12-07 02:21 459,264 ------w C:\WINDOWS\system32\dllcache\msfeeds.dll
2007-12-07 02:21 44,544 ------w C:\WINDOWS\system32\dllcache\iernonce.dll
2007-12-07 02:21 384,512 ------w C:\WINDOWS\system32\dllcache\iedkcs32.dll
2007-12-07 02:21 383,488 ------w C:\WINDOWS\system32\dllcache\ieapfltr.dll
2007-12-07 02:21 27,648 ------w C:\WINDOWS\system32\dllcache\jsproxy.dll
2007-12-07 02:21 267,776 ------w C:\WINDOWS\system32\dllcache\iertutil.dll
2007-12-07 02:21 233,472 ------w C:\WINDOWS\system32\dllcache\webcheck.dll
2007-12-07 02:21 230,400 ------w C:\WINDOWS\system32\dllcache\ieaksie.dll
2007-12-07 02:21 214,528 ------w C:\WINDOWS\system32\dllcache\dxtrans.dll
2007-12-07 02:21 193,024 ------w C:\WINDOWS\system32\dllcache\msrating.dll
2007-12-07 02:21 153,088 ------w C:\WINDOWS\system32\dllcache\ieakeng.dll
2007-12-07 02:21 133,120 ------w C:\WINDOWS\system32\dllcache\extmgr.dll
2007-12-07 02:21 124,928 ------w C:\WINDOWS\system32\dllcache\advpack.dll
2007-12-07 02:21 105,984 ------w C:\WINDOWS\system32\dllcache\url.dll
2007-12-07 02:21 102,912 ------w C:\WINDOWS\system32\dllcache\occache.dll
2007-12-07 02:21 1,159,680 ------w C:\WINDOWS\system32\dllcache\urlmon.dll
2007-12-06 11:01 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe
2007-12-06 11:00 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2007-12-06 11:00 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
2007-12-06 04:59 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll
2007-12-04 18:38 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
2007-12-04 18:38 550,912 ------w C:\WINDOWS\system32\dllcache\oleaut32.dll
2005-10-20 03:30 56 --sh--r C:\WINDOWS\system32\9CD1F59E4F.sys
2005-10-20 03:30 1,890 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BD4742DB-08DA-456D-A68F-7ACD99AA4801}]
C:\WINDOWS\system32\awvtu.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:00 15360]
"DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2004-09-13 14:33 155648]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-11-19 15:48 32881]
"PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2004-04-11 18:15 290816]
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2005-03-04 09:26 606208]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 14:19 53248]
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2005-10-13 08:12 26112]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 10:54 282624]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 14:50 221184]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 14:50 81920]
"dlccmon.exe"="C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe" [2005-07-22 12:03 425984]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-03-02 15:24 257088]
"QUICKCARE"="C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe" [2006-11-07 20:07 192512]
"SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 09:22 155648]
"PaperPort PTD"="C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe" [2004-04-14 13:46 57393]
"IndexSearch"="C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe" [2004-04-14 14:04 40960]
"SetDefPrt"="C:\Program Files\Brother\Brmfl04g\BrStDvPt.exe" [2004-11-11 16:14 49152]
"ControlCenter2.0"="C:\Program Files\Brother\ControlCenter2\brctrcen.exe" [2005-01-07 16:30 864256]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [ ]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2005-10-13 08:05:39 24576]
QuickBooks Update Agent.lnk - C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2005-11-15 03:31:34 806912]

S3 BrScnUsb;Brother USB Still Image driver;C:\WINDOWS\system32\Drivers\BrScnUsb.sys [2004-10-15 11:50]
S3 MSControlService;Microsoft cache control;C:\WINDOWS\system32\windows []

.
Contents of the 'Scheduled Tasks' folder
"2007-03-06 04:28:39 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-02-09 00:09:20 C:\WINDOWS\Tasks\McDefragTask.job"
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe'
"2008-02-09 00:09:18 C:\WINDOWS\Tasks\McQcTask.job"
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-13 13:37:23
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-13 13:38:51
ComboFix-quarantined-files.txt 2008-02-13 20:38:00
ComboFix2.txt 2008-02-09 07:05:56
.
2008-02-12 19:39:44 --- E O F ---

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:45:14 PM, on 2/13/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\PROGRA~1\McAfee\MPS\mps.exe
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\McAfee\MPS\mpsevh.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\dlcccoms.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\iPod\bin\iPodService.exe
c:\PROGRA~1\mcafee\msc\mcuimgr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptcl.dll
O2 - BHO: (no name) - {BD4742DB-08DA-456D-A68F-7ACD99AA4801} - C:\WINDOWS\system32\awvtu.dll (file missing)
O4 - HKLM\..\Run: [Apoint] "C:\Program Files\Apoint\Apoint.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe"
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [RealTray] "C:\Program Files\Real\RealPlayer\RealPlay.exe" SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [dlccmon.exe] "C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QUICKCARE] "C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe" /P QUICKCARE
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] "C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe"
O4 - HKLM\..\Run: [IndexSearch] "C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe"
O4 - HKLM\..\Run: [SetDefPrt] "C:\Program Files\Brother\Brmfl04g\BrStDvPt.exe"
O4 - HKLM\..\Run: [ControlCenter2.0] "C:\Program Files\Brother\ControlCenter2\brctrcen.exe" /autorun
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKUS\S-1-5-18\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Default user')
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/pr02...s/MSNPUpld.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/res...lscbase370.cab
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} (cpbrkpie Control) - http://a19.g.akamai.net/7/19/7125/14...2/cpbrkpie.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O23 - Service: dlcc_device - Unknown owner - C:\WINDOWS\system32\dlcccoms.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe
O23 - Service: Microsoft cache control (MSControlService) - Unknown owner - C:\WINDOWS\system32\windows (file missing)
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

--
End of file - 8931 bytes

**TheBruce1** · 02-13-2008, 06:45 AM

Good job Emily

=========

Download ATF-Cleaner by Atribune to your desktop.Do not run just yet, we will shortly

=========

Open notepad and copy/paste the text in the quotebox below into it:

Quote:

KillAll::

File::
C:\WINDOWS\uccspecb.sys

Folder::
C:\VundoFix Backups
C:\WINDOWS\system32\rip4
C:\WINDOWS\system32\leb3
C:\WINDOWS\system32\gis6
C:\WINDOWS\system32\dom1
C:\Temp

DirLook::
C:\WINDOWS\RW1pbHkgU2FsYXphcg

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BD4742DB-08DA-456D-A68F-7ACD99AA4801}]

Save this as CFscript

Refering to the picture above, drag CFscript into ComboFix.exe

Follow the prompts, and post the resulting log, C:\ComboFix.txt

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

Warning:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

=============

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

Updating Java:

Download the latest version of Java Runtime Environment (JRE) 6u4.
Scroll down to where it says "The Java SE Runtime Environment (JRE) allows end-users to run Java applications".
Click the "Download" button to the right.
In the pull down menu next to Platform select Windows
Check the box that says: "I agree to the Java SE Runtime Environment 6 License Agreement"
Click Continue
Click on the link to download Windows Offline Installation and save to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
Check any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u4-windowsi586-p.exe to install the newest version.

================

Double-click ATF Cleaner.exe to open it

Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.

If you have Firefox installed:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

If you have Opera installed:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Click Exit on the Main menu to close the program.

===========

Perform an online scan with Internet Explorer with Panda ActiveScan

Click on located at the bottom of the page.
A "pop up" window will appear. * Please ensure that your pop up blocker doesn't block it *
Enter your e-mail address, country, and state & click "Free Online Scan" *The download of the 8 MB Panda's ActiveX control will take place*

Begin the scan by selecting

If it finds any malware, it will offer you a report.
Please ignore any entry it finds and the offer to buy the program to remove the entry, as we will address this later.
Click on then click

* You needn't remain online while it's doing the scan but you have to re-connect after it has finished to see the report.
* Turn off the real time scanner of any existing antivirus program while performing the online scan

Paste the Panda Scan report into your next reply.

============

Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here.

============
Logs Required
C:\Combofix.txt
Panda Scan Report
Hijackthis Log

aeisenbaum · 02-13-2008, 08:42 PM

Still can not run panda active scan successfully. When i click scan my computer icon i get a error icon on bottom left of widow stating, object doesn't support this property or method. Scan just hangs and never does anything. I let it sit for 30min. Active x was installed, all steps followed correctly. In ie7 I can not access my internet options or clear browsing history etc. Maybe this is causing the hang up?
Anyway, all other steps were followed. Combo and hijack logs are as follows:

ComboFix 08-02-13.1 - Emily Salazar 2008-02-13 19

37.6 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.279 [GMT -7:00]
Running from: C:\Documents and Settings\Emily Salazar\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Emily Salazar\Desktop\CFscript.txt
* Created a new restore point

FILE
C:\WINDOWS\uccspecb.sys
.

((((((((((((((((((((((((( Files Created from 2008-01-14 to 2008-02-14 )))))))))))))))))))))))))))))))
.

2008-02-13 17:49 . 2008-02-13 17:49 <DIR> d-------- C:\Program Files\Common Files\Java
2008-02-13 17:49 . 2007-12-14 01:59 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-02-12 13:01 . 2008-02-12 13:01 <DIR> d-------- C:\WINDOWS\ERUNT
2008-02-12 12:51 . 2008-02-12 13:13 <DIR> d-------- C:\SDFix
2008-02-09 02:50 . 2008-02-09 02:50 <DIR> d-------- C:\Deckard
2008-02-09 02:04 . 2008-02-13 18:50 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico
2008-02-09 02:04 . 2008-02-13 18:50 1,406 --a------ C:\WINDOWS\system32\Help.ico
2008-02-09 01:08 . 2008-02-09 01:08 <DIR> d-------- C:\Program Files\Trend Micro
2008-02-08 23:51 . 2004-08-04 03:00 388,608 --a------ C:\kmd.exe
2008-02-08 17:15 . 2008-02-13 18:56 3,940 --a------ C:\WINDOWS\system32\Config.MPF
2008-02-08 17:12 . 2006-03-03 11:07 143,360 --a------ C:\WINDOWS\system32\dunzip32.dll
2008-02-08 17:10 . 2007-06-25 10:57 37,480 --a------ C:\WINDOWS\system32\drivers\mfesmfk.sys
2008-02-08 17:10 . 2007-06-25 10:57 32,008 --a------ C:\WINDOWS\system32\drivers\mferkdk.sys
2008-02-08 17:09 . 2007-06-25 10:57 171,240 --a------ C:\WINDOWS\system32\drivers\mfehidk.sys
2008-02-08 17:09 . 2007-03-02 14:16 109,608 --a------ C:\WINDOWS\system32\drivers\Mpfp.sys
2008-02-08 17:09 . 2007-06-25 14:54 71,496 --a------ C:\WINDOWS\system32\drivers\mfeavfk.sys
2008-02-08 17:09 . 2007-06-25 10:57 34,184 --a------ C:\WINDOWS\system32\drivers\mfebopk.sys
2008-02-08 17:08 . 2008-02-08 17:09 <DIR> d-------- C:\Program Files\McAfee.com
2008-02-06 22:26 . 2008-02-06 22:35 <DIR> d-------- C:\Program Files\Windows Live Safety Center
2008-02-06 02:52 . 2008-02-13 18:40 <DIR> d-------- C:\Documents and Settings\Emily Salazar\Application Data\SiteAdvisor
2008-02-06 02:52 . 2008-02-06 02:52 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SiteAdvisor
2008-02-06 01:59 . 2006-11-07 21:01 66,048 --a------ C:\WINDOWS\ieResetIcons.exe
2008-02-05 23:31 . 2008-02-05 23:31 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Trend Micro
2008-02-05 21:09 . 2008-02-05 21:09 164 --a------ C:\install.dat
2008-01-30 23:42 . 2008-02-05 23:02 <DIR> d-------- C:\Documents and Settings\Emily Salazar\Application Data\McAfee
2008-01-30 22:50 . 2008-01-30 22:50 <DIR> d-------- C:\Documents and Settings\Emily Salazar\Application Data\Talkback
2008-01-30 11:27 . 2008-02-08 17:13 <DIR> d-------- C:\Program Files\McAfee
2008-01-30 11:27 . 2008-02-08 17:12 <DIR> d-------- C:\Program Files\Common Files\McAfee
2008-01-30 10:47 . 2008-02-08 17:11 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\McAfee
2008-01-30 10:16 . 2008-01-30 10:16 <DIR> d-------- C:\WINDOWS\system32\tps5
2008-01-30 10:16 . 2008-01-31 05:12 <DIR> d--hs---- C:\WINDOWS\RW1pbHkgU2FsYXphcg

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-14 00:49 --------- d-----w C:\Program Files\Java
2008-02-08 23:53 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-02-07 10:05 --------- d-----w C:\Program Files\Dell
2008-02-07 10:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\GTek
2008-02-07 09:57 --------- d-----w C:\Documents and Settings\All Users\Application Data\SupportSoft
2008-02-07 09:55 --------- d-----w C:\Program Files\Common Files\supportsoft
2008-02-07 00:20 --------- d-----w C:\Program Files\Google
2008-01-31 12:33 --------- d-----w C:\Program Files\Symantec
2008-01-31 12:33 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-01-31 10:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-01-31 06:33 --------- d-----w C:\Documents and Settings\Emily Salazar\Application Data\Move Networks
2008-01-29 21:51 --------- d-----w C:\Program Files\Dl_cats
2008-01-28 21:44 --------- d-----w C:\Documents and Settings\Emily Salazar\Application Data\AdobeUM
2008-01-11 05:53 44,544 ------w C:\WINDOWS\system32\dllcache\pngfilt.dll
2008-01-08 17:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Dell
2007-12-19 23:01 347,136 ------w C:\WINDOWS\system32\dllcache\dxtmsft.dll
2007-12-18 09:51 179,584 ----a-w C:\WINDOWS\system32\drivers\mrxdav.sys
2007-12-18 09:51 179,584 ------w C:\WINDOWS\system32\dllcache\mrxdav.sys
2007-12-08 05:21 3,592,192 ------w C:\WINDOWS\system32\dllcache\mshtml.dll
2007-12-07 02:21 824,832 ----a-w C:\WINDOWS\system32\wininet.dll
2007-12-07 02:21 824,832 ------w C:\WINDOWS\system32\dllcache\wininet.dll
2007-12-07 02:21 671,232 ------w C:\WINDOWS\system32\dllcache\mstime.dll
2007-12-07 02:21 63,488 ------w C:\WINDOWS\system32\dllcache\icardie.dll
2007-12-07 02:21 6,066,176 ------w C:\WINDOWS\system32\dllcache\ieframe.dll
2007-12-07 02:21 52,224 ------w C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2007-12-07 02:21 478,208 ------w C:\WINDOWS\system32\dllcache\mshtmled.dll
2007-12-07 02:21 459,264 ------w C:\WINDOWS\system32\dllcache\msfeeds.dll
2007-12-07 02:21 44,544 ------w C:\WINDOWS\system32\dllcache\iernonce.dll
2007-12-07 02:21 384,512 ------w C:\WINDOWS\system32\dllcache\iedkcs32.dll
2007-12-07 02:21 383,488 ------w C:\WINDOWS\system32\dllcache\ieapfltr.dll
2007-12-07 02:21 27,648 ------w C:\WINDOWS\system32\dllcache\jsproxy.dll
2007-12-07 02:21 267,776 ------w C:\WINDOWS\system32\dllcache\iertutil.dll
2007-12-07 02:21 233,472 ------w C:\WINDOWS\system32\dllcache\webcheck.dll
2007-12-07 02:21 230,400 ------w C:\WINDOWS\system32\dllcache\ieaksie.dll
2007-12-07 02:21 214,528 ------w C:\WINDOWS\system32\dllcache\dxtrans.dll
2007-12-07 02:21 193,024 ------w C:\WINDOWS\system32\dllcache\msrating.dll
2007-12-07 02:21 153,088 ------w C:\WINDOWS\system32\dllcache\ieakeng.dll
2007-12-07 02:21 133,120 ------w C:\WINDOWS\system32\dllcache\extmgr.dll
2007-12-07 02:21 124,928 ------w C:\WINDOWS\system32\dllcache\advpack.dll
2007-12-07 02:21 105,984 ------w C:\WINDOWS\system32\dllcache\url.dll
2007-12-07 02:21 102,912 ------w C:\WINDOWS\system32\dllcache\occache.dll
2007-12-07 02:21 1,159,680 ------w C:\WINDOWS\system32\dllcache\urlmon.dll
2007-12-06 11:01 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe
2007-12-06 11:00 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2007-12-06 11:00 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
2007-12-06 04:59 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll
2007-12-04 18:38 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
2007-12-04 18:38 550,912 ------w C:\WINDOWS\system32\dllcache\oleaut32.dll
2005-10-20 03:30 56 --sh--r C:\WINDOWS\system32\9CD1F59E4F.sys
2005-10-20 03:30 1,890 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

---- Directory of C:\WINDOWS\RW1pbHkgU2FsYXphcg ----

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:00 15360]
"DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2004-09-13 14:33 155648]
"PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2004-04-11 18:15 290816]
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2005-03-04 09:26 606208]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 14:19 53248]
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2005-10-13 08:12 26112]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 10:54 282624]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 14:50 221184]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 14:50 81920]
"dlccmon.exe"="C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe" [2005-07-22 12:03 425984]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-03-02 15:24 257088]
"QUICKCARE"="C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe" [2006-11-07 20:07 192512]
"SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 09:22 155648]
"PaperPort PTD"="C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe" [2004-04-14 13:46 57393]
"IndexSearch"="C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe" [2004-04-14 14:04 40960]
"SetDefPrt"="C:\Program Files\Brother\Brmfl04g\BrStDvPt.exe" [2004-11-11 16:14 49152]
"ControlCenter2.0"="C:\Program Files\Brother\ControlCenter2\brctrcen.exe" [2005-01-07 16:30 864256]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe" [2007-12-14 03:42 144784]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [ ]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2005-10-13 08:05:39 24576]
QuickBooks Update Agent.lnk - C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2005-11-15 03:31:34 806912]

S3 BrScnUsb;Brother USB Still Image driver;C:\WINDOWS\system32\Drivers\BrScnUsb.sys [2004-10-15 11:50]
S3 MSControlService;Microsoft cache control;C:\WINDOWS\system32\windows []

.
Contents of the 'Scheduled Tasks' folder
"2007-03-06 04:28:39 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-02-09 00:09:20 C:\WINDOWS\Tasks\McDefragTask.job"
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe'
"2008-02-09 00:09:18 C:\WINDOWS\Tasks\McQcTask.job"
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-13 19:11:54
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

C:\WINDOWS\bcmwltrytmp.reg

scan completed successfully
hidden files: 1

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\PROGRA~1\McAfee\MPS\mps.exe
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\Program Files\McAfee\MPS\mpsevh.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\dlcccoms.exe
c:\PROGRA~1\mcafee\msc\mcuimgr.exe
.
**************************************************************************
.
Completion time: 2008-02-13 19:14:31 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-14 02:14:27
ComboFix2.txt 2008-02-14 00:24:15
ComboFix3.txt 2008-02-13 23:56:43
ComboFix4.txt 2008-02-13 23:33:35
ComboFix5.txt 2008-02-13 20:38:52
.
2008-02-12 19:39:44 --- E O F ---

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:26:45 PM, on 2/13/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\PROGRA~1\McAfee\MPS\mps.exe
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\Program Files\McAfee\MPS\mpsevh.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\WINDOWS\system32\dlcccoms.exe
C:\WINDOWS\explorer.exe
c:\PROGRA~1\mcafee\msc\mcuimgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptcl.dll
O4 - HKLM\..\Run: [Apoint] "C:\Program Files\Apoint\Apoint.exe"
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [RealTray] "C:\Program Files\Real\RealPlayer\RealPlay.exe" SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [dlccmon.exe] "C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QUICKCARE] "C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe" /P QUICKCARE
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] "C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe"
O4 - HKLM\..\Run: [IndexSearch] "C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe"
O4 - HKLM\..\Run: [SetDefPrt] "C:\Program Files\Brother\Brmfl04g\BrStDvPt.exe"
O4 - HKLM\..\Run: [ControlCenter2.0] "C:\Program Files\Brother\ControlCenter2\brctrcen.exe" /autorun
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKUS\S-1-5-18\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Default user')
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/pr02...s/MSNPUpld.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/res...lscbase370.cab
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} (cpbrkpie Control) - http://a19.g.akamai.net/7/19/7125/14...2/cpbrkpie.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O23 - Service: dlcc_device - Unknown owner - C:\WINDOWS\system32\dlcccoms.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe
O23 - Service: Microsoft cache control (MSControlService) - Unknown owner - C:\WINDOWS\system32\windows (file missing)
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

--
End of file - 7962 bytes

**TheBruce1** · 02-14-2008, 04:26 AM

Try this one instead.

Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner

Answer Yes, when prompted to install an ActiveX component.

The program will then begin downloading the latest definition files.
Once the files have been downloaded click on NEXT
Locate the Scan Settings button & configure to:
- Scan using the following Anti-Virus database:
  - Extended
- Scan Options:
  - Scan Archives
  - Scan Mail Bases
Click OK & have it scan My Computer
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

* Turn off the real time scanner of any existing antivirus program while performing the online scan

Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license has been accepted, reset to 100%.

aeisenbaum · 02-14-2008, 03:03 PM

Thanks for your continued help, it is much appreciated. There was only a Save Report As..button to click on (no Save as Text button). The default was as an html doc but i saved as .txt. I also have as html if necessary (file:///C:/Documents%20and%20Settings/Emily%20Salazar/Desktop/kaspersky.html). The icon is on my desktop. The .txt report is as follows:

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Thursday, February 14, 2008 2:53:23 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 14/02/2008
Kaspersky Anti-Virus database records: 567002
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\

Scan Statistics:
Total number of scanned objects: 52888
Number of viruses found: 8
Number of infected objects: 21
Number of suspicious objects: 0
Duration of the scan process: 01:03:23

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\McAfee\MNA\NAData Object is locked skipped
C:\Documents and Settings\All Users\Application Data\McAfee\MPF\data\log.edb Object is locked skipped
C:\Documents and Settings\All Users\Application Data\McAfee\MSC\Logs\Events.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\McAfee\MSC\McUsers.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\McAfee\VirusScan\Logs\OAS.Log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\QSLLPSVCShare Object is locked skipped
C:\Documents and Settings\Emily Salazar\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Emily Salazar\Local Settings\Application Data\Microsoft\Media Player\CurrentDatabase_360.wmdb Object is locked skipped
C:\Documents and Settings\Emily Salazar\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Emily Salazar\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Emily Salazar\Local Settings\Application Data\SupportSoft\QUICKCARE\Emily Salazar\state\logs\sprtcmd.log Object is locked skipped
C:\Documents and Settings\Emily Salazar\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Emily Salazar\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\Emily Salazar\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Emily Salazar\ntuser.dat Object is locked skipped
C:\Documents and Settings\Emily Salazar\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Data\master.mdf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Data\mastlog.ldf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Data\model.mdf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Data\modellog.ldf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Data\tempdb.mdf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Data\templog.ldf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\LOG\ERRORLOG Object is locked skipped
C:\QooBox\Quarantine\catchme2008-02-09_ 00258.71.zip/classpnpp.sys Infected: Rootkit.Win32.Agent.to skipped
C:\QooBox\Quarantine\catchme2008-02-09_ 00258.71.zip ZIP: infected - 1 skipped
C:\SDFix\backups\backups.zip/backups/rteprekyc.html Infected: Trojan-Clicker.HTML.IFrame.dn skipped
C:\SDFix\backups\backups.zip ZIP: infected - 1 skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP367\A0033151.exe Infected: not-a-virus:AdWare.Win32.Agent.co skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP368\A0033704.exe Infected: Trojan.Win32.Scapur.k skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP368\A0033720.dll Infected: not-a-virus:AdWare.Win32.Agent.acn skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP372\A0034755.exe Infected: not-a-virus:AdWare.Win32.Agent.co skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP374\A0034973.dll Infected: not-a-virus:AdWare.Win32.Agent.acn skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP374\A0034977.dll Infected: not-a-virus:AdWare.Win32.Agent.acn skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP375\A0036021.exe Infected: Trojan.Win32.Scapur.k skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP377\A0036550.dll Infected: not-a-virus:AdWare.Win32.Agent.acn skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP377\A0036559.exe Infected: Trojan.Win32.Scapur.k skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP379\A0036959.dll Infected: not-a-virus:AdWare.Win32.Agent.acn skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP383\A0040335.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP383\A0040336.exe Infected: Trojan-Downloader.Win32.Small.hwg skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP383\A0040337.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP383\A0040340.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP390\A0043365.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP390\A0043366.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP401\change.log Object is locked skipped
C:\WINDOWS\cpbrkpie.ocx Infected: not-a-virus:AdWare.Win32.Coupons.h skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{16ECFB36-97FF-4370-9194-A5C3C11CC417}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\DEFAULT Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SYSTEM Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\Temp\mcafee_YMjWFqw4zMM9tAQ Object is locked skipped
C:\WINDOWS\Temp\mcmsc_gSFiwDtYtfv6H6E Object is locked skipped
C:\WINDOWS\Temp\mcmsc_NXv8dV8VSgbMI50 Object is locked skipped
C:\WINDOWS\Temp\mcmsc_zNtUeuDV5exrNHG Object is locked skipped
C:\WINDOWS\Temp\Perflib_Perfdata_c0.dat Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.

**TheBruce1** · 02-15-2008, 10:14 AM

Open notepad and copy/paste the text in the quotebox below into it:

Quote:

KillAll::

File::
C:\kmd.exe
C:\WINDOWS\cpbrkpie.ocx
C:\WINDOWS\bcmwltrytmp.reg

Folder::
C:\WINDOWS\system32\tps5
C:\WINDOWS\RW1pbHkgU2FsYXphcg
C:\Documents and Settings\All Users\Application Data\Viewpoint
C:\Program Files\Symantec
C:\Program Files\Common Files\Symantec Shared
C:\Documents and Settings\All Users\Application Data\Symantec

Save this as CFscript

Refering to the picture above, drag CFscript into ComboFix.exe

Follow the prompts, and post the resulting log, C:\ComboFix.txt

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

Warning:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

================

Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here.

================
Logs Required
C:\Combofix.txt
Hijackthis Log

aeisenbaum · 02-15-2008, 02:11 PM

Thanks...The logs are as follows:

ComboFix 08-02-13.1 - Emily Salazar 2008-02-15 13:51:31.7 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.258 [GMT -7:00]
Running from: C:\Documents and Settings\Emily Salazar\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Emily Salazar\Desktop\CFscript.txt
* Created a new restore point

FILE
C:\kmd.exe
C:\WINDOWS\bcmwltrytmp.reg
C:\WINDOWS\cpbrkpie.ocx
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\Symantec
C:\Documents and Settings\All Users\Application Data\Symantec\LiveSubscribe\Catalog.LiveSubscribe
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Product.Inventory.LiveUpdate
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Settings.LiveUpdate
C:\Documents and Settings\All Users\Application Data\Viewpoint
C:\kmd.exe
C:\Program Files\Common Files\Symantec Shared
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsys.dll
C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys
C:\Program Files\Common Files\Symantec Shared\SPManifests\eraser.spm
C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080116.003\IDS9xx86.dll
C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080116.003\IDSVia64.cat
C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080116.003\IDSVia64.INF
C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080116.003\IDSviA64.sys
C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080116.003\IDSVix86.cat
C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080116.003\IDSVix86.INF
C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080116.003\IDSvix86.sys
C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080116.003\IDSxpx86.dll
C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080116.003\SymIDSCo.sys
C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080116.003\SymIDSCo.vxd
C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080116.003\SymIDSI.dll
C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080122.002\IDS9xx86.dll
C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080122.002\IDSVia64.cat
C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080122.002\IDSVia64.INF
C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080122.002\IDSviA64.sys
C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080122.002\IDSVix86.cat
C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080122.002\IDSVix86.INF
C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080122.002\IDSvix86.sys
C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080122.002\IDSxpx86.dll
C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080122.002\SymIDSCo.sys
C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080122.002\SymIDSCo.vxd
C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080122.002\SymIDSI.dll
C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\BinHub\IDS9xx86.dll
C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\BinHub\IDSVia64.cat
C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\BinHub\IDSVia64.INF
C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\BinHub\IDSviA64.sys
C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\BinHub\IDSVix86.cat
C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\BinHub\IDSVix86.INF
C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\BinHub\IDSvix86.sys
C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\BinHub\IDSxpx86.dll
C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\BinHub\symidsco.sys
C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\BinHub\symidsco.vxd
C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\BinHub\SymIDSI.dll
C:\Program Files\Symantec
C:\Program Files\Symantec\DownloadManager\NPM2004tb15.exe
C:\Program Files\Symantec\DownloadManager\setup.exe
C:\WINDOWS\cpbrkpie.ocx
C:\WINDOWS\RW1pbHkgU2FsYXphcg
C:\WINDOWS\system32\tps5
C:\WINDOWS\system32\tps5\covstadcom7.exe

.
((((((((((((((((((((((((( Files Created from 2008-01-15 to 2008-02-15 )))))))))))))))))))))))))))))))
.

2008-02-14 13:16 . 2008-02-14 13:16 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-02-14 13:16 . 2008-02-14 13:16 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-02-13 19:21 . 2008-02-13 19:30 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2008-02-13 19:21 . 2008-02-13 20:34 30,590 --a------ C:\WINDOWS\system32\pavas.ico
2008-02-13 17:49 . 2008-02-13 17:49 <DIR> d-------- C:\Program Files\Common Files\Java
2008-02-13 17:49 . 2007-12-14 01:59 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-02-12 13:01 . 2008-02-12 13:01 <DIR> d-------- C:\WINDOWS\ERUNT
2008-02-12 12:51 . 2008-02-12 13:13 <DIR> d-------- C:\SDFix
2008-02-09 02:50 . 2008-02-09 02:50 <DIR> d-------- C:\Deckard
2008-02-09 02:04 . 2008-02-13 20:34 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico
2008-02-09 02:04 . 2008-02-13 20:34 1,406 --a------ C:\WINDOWS\system32\Help.ico
2008-02-09 01:08 . 2008-02-09 01:08 <DIR> d-------- C:\Program Files\Trend Micro
2008-02-08 17:15 . 2008-02-15 13:56 4,350 --a------ C:\WINDOWS\system32\Config.MPF
2008-02-08 17:12 . 2006-03-03 11:07 143,360 --a------ C:\WINDOWS\system32\dunzip32.dll
2008-02-08 17:10 . 2007-06-25 10:57 37,480 --a------ C:\WINDOWS\system32\drivers\mfesmfk.sys
2008-02-08 17:10 . 2007-06-25 10:57 32,008 --a------ C:\WINDOWS\system32\drivers\mferkdk.sys
2008-02-08 17:09 . 2007-06-25 10:57 171,240 --a------ C:\WINDOWS\system32\drivers\mfehidk.sys
2008-02-08 17:09 . 2007-03-02 14:16 109,608 --a------ C:\WINDOWS\system32\drivers\Mpfp.sys
2008-02-08 17:09 . 2007-06-25 14:54 71,496 --a------ C:\WINDOWS\system32\drivers\mfeavfk.sys
2008-02-08 17:09 . 2007-06-25 10:57 34,184 --a------ C:\WINDOWS\system32\drivers\mfebopk.sys
2008-02-08 17:08 . 2008-02-08 17:09 <DIR> d-------- C:\Program Files\McAfee.com
2008-02-06 22:26 . 2008-02-06 22:35 <DIR> d-------- C:\Program Files\Windows Live Safety Center
2008-02-06 02:52 . 2008-02-14 13:05 <DIR> d-------- C:\Documents and Settings\Emily Salazar\Application Data\SiteAdvisor
2008-02-06 02:52 . 2008-02-06 02:52 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SiteAdvisor
2008-02-06 01:59 . 2006-11-07 21:01 66,048 --a------ C:\WINDOWS\ieResetIcons.exe
2008-02-05 23:31 . 2008-02-05 23:31 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Trend Micro
2008-02-05 21:09 . 2008-02-05 21:09 164 --a------ C:\install.dat
2008-01-30 23:42 . 2008-02-05 23:02 <DIR> d-------- C:\Documents and Settings\Emily Salazar\Application Data\McAfee
2008-01-30 22:50 . 2008-01-30 22:50 <DIR> d-------- C:\Documents and Settings\Emily Salazar\Application Data\Talkback
2008-01-30 11:27 . 2008-02-08 17:13 <DIR> d-------- C:\Program Files\McAfee
2008-01-30 11:27 . 2008-02-08 17:12 <DIR> d-------- C:\Program Files\Common Files\McAfee
2008-01-30 10:47 . 2008-02-08 17:11 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\McAfee

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-14 00:49 --------- d-----w C:\Program Files\Java
2008-02-07 10:05 --------- d-----w C:\Program Files\Dell
2008-02-07 10:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\GTek
2008-02-07 09:57 --------- d-----w C:\Documents and Settings\All Users\Application Data\SupportSoft
2008-02-07 09:55 --------- d-----w C:\Program Files\Common Files\supportsoft
2008-02-07 00:20 --------- d-----w C:\Program Files\Google
2008-01-31 06:33 --------- d-----w C:\Documents and Settings\Emily Salazar\Application Data\Move Networks
2008-01-29 21:51 --------- d-----w C:\Program Files\Dl_cats
2008-01-28 21:44 --------- d-----w C:\Documents and Settings\Emily Salazar\Application Data\AdobeUM
2008-01-08 17:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Dell
2007-12-18 09:51 179,584 ----a-w C:\WINDOWS\system32\drivers\mrxdav.sys
2005-10-20 03:30 56 --sh--r C:\WINDOWS\system32\9CD1F59E4F.sys
2005-10-20 03:30 1,890 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:00 15360]
"DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2004-09-13 14:33 155648]
"PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2004-04-11 18:15 290816]
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2005-03-04 09:26 606208]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 14:19 53248]
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2005-10-13 08:12 26112]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 10:54 282624]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 14:50 221184]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 14:50 81920]
"dlccmon.exe"="C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe" [2005-07-22 12:03 425984]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-03-02 15:24 257088]
"QUICKCARE"="C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe" [2006-11-07 20:07 192512]
"SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 09:22 155648]
"PaperPort PTD"="C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe" [2004-04-14 13:46 57393]
"IndexSearch"="C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe" [2004-04-14 14:04 40960]
"SetDefPrt"="C:\Program Files\Brother\Brmfl04g\BrStDvPt.exe" [2004-11-11 16:14 49152]
"ControlCenter2.0"="C:\Program Files\Brother\ControlCenter2\brctrcen.exe" [2005-01-07 16:30 864256]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe" [2007-12-14 03:42 144784]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [ ]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2005-10-13 08:05:39 24576]
QuickBooks Update Agent.lnk - C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2005-11-15 03:31:34 806912]

S3 BrScnUsb;Brother USB Still Image driver;C:\WINDOWS\system32\Drivers\BrScnUsb.sys [2004-10-15 11:50]
S3 MSControlService;Microsoft cache control;C:\WINDOWS\system32\windows []

.
Contents of the 'Scheduled Tasks' folder
"2007-03-06 04:28:39 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-02-09 00:09:20 C:\WINDOWS\Tasks\McDefragTask.job"
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe'
"2008-02-09 00:09:18 C:\WINDOWS\Tasks\McQcTask.job"
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-15 13:57:03
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\PROGRA~1\McAfee\MPS\mps.exe
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\McAfee\MPS\mpsevh.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
c:\PROGRA~1\mcafee\msc\mcuimgr.exe
.
**************************************************************************
.
Completion time: 2008-02-15 13:59:22 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-15 20:59:18
ComboFix2.txt 2008-02-14 02:14:32
ComboFix3.txt 2008-02-14 00:24:15
ComboFix4.txt 2008-02-13 23:56:43
ComboFix5.txt 2008-02-13 23:33:35
.
2008-02-12 19:39:44 --- E O F ---

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:04:07 PM, on 2/15/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\PROGRA~1\McAfee\MPS\mps.exe
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\McAfee\MPS\mpsevh.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\explorer.exe
c:\PROGRA~1\mcafee\msc\mcuimgr.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
c:\PROGRA~1\mcafee\msc\mcshell.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptcl.dll
O4 - HKLM\..\Run: [Apoint] "C:\Program Files\Apoint\Apoint.exe"
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [RealTray] "C:\Program Files\Real\RealPlayer\RealPlay.exe" SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [dlccmon.exe] "C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QUICKCARE] "C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe" /P QUICKCARE
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] "C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe"
O4 - HKLM\..\Run: [IndexSearch] "C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe"
O4 - HKLM\..\Run: [SetDefPrt] "C:\Program Files\Brother\Brmfl04g\BrStDvPt.exe"
O4 - HKLM\..\Run: [ControlCenter2.0] "C:\Program Files\Brother\ControlCenter2\brctrcen.exe" /autorun
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKUS\S-1-5-18\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Default user')
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/pr02...s/MSNPUpld.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/res...lscbase370.cab
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} (cpbrkpie Control) - http://a19.g.akamai.net/7/19/7125/14...2/cpbrkpie.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O23 - Service: dlcc_device - Unknown owner - C:\WINDOWS\system32\dlcccoms.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe
O23 - Service: Microsoft cache control (MSControlService) - Unknown owner - C:\WINDOWS\system32\windows (file missing)
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

--
End of file - 7529 bytes

**TheBruce1** · 02-15-2008, 02:27 PM

Open HijackThis and click on 'Do a System Scan Only'. Check the following entries (If they still exist, make sure you do not miss any)

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} (cpbrkpie Control) - http://a19.g.akamai.net/7/19/7125/14...2/cpbrkpie.cab

Please remember to close all other windows, including browsers then click Fix checked.

==========

Delete the following Files indicated in RED and Folders indicated in BLUE if they still exist.

C:\SDFix

You can keep ATF-Cleaner if you wish.

=========

Well done,your logs are clean.

Click start>run>type(or copy/paste command into run box):

ComboFix /u

Click ok.

=========

Clear IE7 cookies

*On the Internet Explorer 7 Tools menu, click Internet Options. The Internet Options box should open to the General tab.
*On the General tab, in the Browsing History, click the Delete button. This will delete all the files that are currently stored in your cache [that includes cookies too].
*Click OK, and then click OK again.

Clear Firefox cookies/cache

• Select "Tools"
• Select "Options".
• Select "Privacy".
• In "Settings" window put the check mark for Cookies,Cache,Browsing history and any others you want.
• Click OK.
• In Private area click "Clear Now".

-------------------------------------------------------------------------------------------

MICROSOFT UPDATES

1.Click Start,Run, type sysdm.cpl, and then press OK.
2.Click the Automatic Updates tab, and then click to select one of the following options. We recommend that you select the Automatic (recommended).

Microsoft updates are released every second Tuesday of each month,what is called "Patch Tuesday".

------------------------------------------------------------------------------------------

Useful Information and Programs to keep you safe.

TrendProtect is a FREE browser plug-in that helps you avoid Web pages with unwanted content and hidden threats. TrendProtect rates the current page and pages listed in Google, MSN, and Yahoo search results. You can use the rating to decide if you want to visit or avoid a given Web page. To rate Web pages, TrendProtect refers to an extensive database that covers the following information for billions of Web pages:

* Content category
* Phishing scam detection
* Site reputation
* Page reputation

WOT Free helps you avoid disingenuous Internet content by allowing you to learn from others' experiences. WOT shows you website reputations on your browser, telling you how much other users trust a website. This helps you make better decisions while browsing and avoid phishing, malware, and other types of fraud. Reputations can also be added to web search results, Gmail, Wikipedia, and other selected sites.

WOT reputations are computed mainly from user testimonies. Sharing your knowledge with others is just a click away, without ever having to leave the site. We also collect data from hundreds of other sources (including PhishTank) to quickly warn you of emerging threats. Currently, WOT knows over 12 million websites.
Note:Only compatible with Firefox 1.5 and higher.

Only install one of the above

--------------------------------------------------------------------------------------

Alternate Browsers
Try the following free alternate browsers rather than Internet Explorer
Avant
Firefox
Opera
K-Meleon

------------------------------------------------------------------------------------------

Free Antispyware Products
SuperAntiSpyware
AVG Antispyware Free
Ad-Aware
Spybot S&D
Download SpywareBlaster 3.5.1 to help prevent spyware from installing in the first place. Install & update SpywareBlaster with the latest definitions. After you have updated, click the button - enable protection for all unprotected items.
Download Spyware Guard to catch and block spyware before it can execute.

------------------------------------------------------------------

IE-Spyad™ is a freeware utility that places more than 4000 dubious websites and domains in the Internet Explorer Restricted List.

Download and installation instructions for IE-Spyad™ Here

-----------------------------------------

The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer. Note that if you use a company provided HOSTS file you should not use the MVPS HOSTS file.

If your having trouble downloading & extracting,see link below for guidance:
http://www.mvps.org/winhelp2002/hosts2.htm

Once you have extracted the host file,double click on it and a new window will open.

Double-click on mvps.batand follow the prompts

---------------------------------------------------------------

Winpatrol - Download and install the free version of Winpatrol. A tutorial for this product is located here:
Using Winpatrol to protect your computer.

----------------------------------------

SnoopFree is a programme that informs you when another programme is wanting to log your keystrokes or read your screen.Only for XP users.

Update all these programs regularly. Without regular updates you will not be protected when new malicious programs are released.

==============================================

Also, please take a look at these well written articles:

PC Safety and Security--What Do I Need?

HOW DID I GET INFECTED IN THE FIRST PLACE? by Tony Klein
THE ANTI-SPYWARE TUTORIAL
MAKING INTERNET EXPLORER SAFER
Understanding and Using Firewalls

**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.

Please reply to this thread once more,as we may mark this as resolved,thanks.

aeisenbaum · 02-15-2008, 03:41 PM

I still have three issues:

1. In My Computer the C drive icon is still a Red X.

2. In My Documents folder it is filled with tons of POS TMP files (some are copy of copies many times over). Previously when I would try and delete them they would not go away, and make copies of themselves. I didn't want to try and delete them this time for fear of reinfecting (w/out checking with you first).

3. In IE7 I can not access Internet Options. When I click on Internet Options in Tools menu a very brief small box appears and disappears almost instantaneously. So in turn I can not delete my Browsing History. In the address bar drop down I still have my history from before you helped me.

Hopefully we can address these issues. Your help is certainly appreciated. Thank you!

aeisenbaum · 02-15-2008, 03:44 PM

Regarding my previous message. On my desktop, when I right click the IE7 icon and select Properties...Nothing happens.
Thanks again for your continued assistance.

**TheBruce1** · 02-15-2008, 04:26 PM

Combofix should have taken care of those pos temp file, delete your current version of Combofix if you have not done so already and download the updated version below.

===========

Download Combofix from any of the links below, and save it to your desktop.
Link 1
Link 2
Link 3

**Note: It is important that it is saved directly to your desktop**

Double click on ComboFix.exe & follow the prompts.

When finished, it will produce a report for you.
Please post the C:\ComboFix.txt along with a new HijackThis log so we can continue cleaning the system.

Note:
Do not mouseclick combofix's window while it's running. That may cause it to stall

=============
Logs Required
C:\Combofix.txt
Hijackthis Log

aeisenbaum · 02-16-2008, 07:53 PM

Sorry for the delay in my response. The logs are as follows:

ComboFix 08-02-17.2 - Emily Salazar 2008-02-16 19:37:37.8 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.204 [GMT -7:00]
Running from: C:\Documents and Settings\Emily Salazar\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2008-01-17 to 2008-02-17 )))))))))))))))))))))))))))))))
.

2008-02-14 13:16 . 2008-02-14 13:16 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-02-14 13:16 . 2008-02-14 13:16 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-02-13 19:21 . 2008-02-13 19:30 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2008-02-13 19:21 . 2008-02-13 20:34 30,590 --a------ C:\WINDOWS\system32\pavas.ico
2008-02-13 17:49 . 2008-02-13 17:49 <DIR> d-------- C:\Program Files\Common Files\Java
2008-02-13 17:49 . 2007-12-14 01:59 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-02-12 13:01 . 2008-02-12 13:01 <DIR> d-------- C:\WINDOWS\ERUNT
2008-02-09 02:04 . 2008-02-13 20:34 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico
2008-02-09 02:04 . 2008-02-13 20:34 1,406 --a------ C:\WINDOWS\system32\Help.ico
2008-02-09 01:08 . 2008-02-09 01:08 <DIR> d-------- C:\Program Files\Trend Micro
2008-02-08 17:15 . 2008-02-16 19:36 4,350 --a------ C:\WINDOWS\system32\Config.MPF
2008-02-08 17:12 . 2006-03-03 11:07 143,360 --a------ C:\WINDOWS\system32\dunzip32.dll
2008-02-08 17:10 . 2007-06-25 10:57 37,480 --a------ C:\WINDOWS\system32\drivers\mfesmfk.sys
2008-02-08 17:10 . 2007-06-25 10:57 32,008 --a------ C:\WINDOWS\system32\drivers\mferkdk.sys
2008-02-08 17:09 . 2007-06-25 10:57 171,240 --a------ C:\WINDOWS\system32\drivers\mfehidk.sys
2008-02-08 17:09 . 2007-03-02 14:16 109,608 --a------ C:\WINDOWS\system32\drivers\Mpfp.sys
2008-02-08 17:09 . 2007-06-25 14:54 71,496 --a------ C:\WINDOWS\system32\drivers\mfeavfk.sys
2008-02-08 17:09 . 2007-06-25 10:57 34,184 --a------ C:\WINDOWS\system32\drivers\mfebopk.sys
2008-02-08 17:08 . 2008-02-08 17:09 <DIR> d-------- C:\Program Files\McAfee.com
2008-02-06 22:26 . 2008-02-06 22:35 <DIR> d-------- C:\Program Files\Windows Live Safety Center
2008-02-06 02:52 . 2008-02-16 19:29 <DIR> d-------- C:\Documents and Settings\Emily Salazar\Application Data\SiteAdvisor
2008-02-06 02:52 . 2008-02-06 02:52 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SiteAdvisor
2008-02-06 01:59 . 2006-11-07 21:01 66,048 --a------ C:\WINDOWS\ieResetIcons.exe
2008-02-05 23:31 . 2008-02-05 23:31 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Trend Micro
2008-02-05 21:09 . 2008-02-05 21:09 164 --a------ C:\install.dat
2008-01-30 23:42 . 2008-02-05 23:02 <DIR> d-------- C:\Documents and Settings\Emily Salazar\Application Data\McAfee
2008-01-30 22:50 . 2008-01-30 22:50 <DIR> d-------- C:\Documents and Settings\Emily Salazar\Application Data\Talkback
2008-01-30 11:27 . 2008-02-08 17:13 <DIR> d-------- C:\Program Files\McAfee
2008-01-30 11:27 . 2008-02-08 17:12 <DIR> d-------- C:\Program Files\Common Files\McAfee
2008-01-30 10:47 . 2008-02-08 17:11 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\McAfee

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-14 00:49 --------- d-----w C:\Program Files\Java
2008-02-07 10:05 --------- d-----w C:\Program Files\Dell
2008-02-07 10:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\GTek
2008-02-07 09:57 --------- d-----w C:\Documents and Settings\All Users\Application Data\SupportSoft
2008-02-07 09:55 --------- d-----w C:\Program Files\Common Files\supportsoft
2008-02-07 00:20 --------- d-----w C:\Program Files\Google
2008-01-31 06:33 --------- d-----w C:\Documents and Settings\Emily Salazar\Application Data\Move Networks
2008-01-29 21:51 --------- d-----w C:\Program Files\Dl_cats
2008-01-28 21:44 --------- d-----w C:\Documents and Settings\Emily Salazar\Application Data\AdobeUM
2008-01-11 05:53 44,544 ------w C:\WINDOWS\system32\dllcache\pngfilt.dll
2008-01-08 17:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Dell
2007-12-19 23:01 347,136 ------w C:\WINDOWS\system32\dllcache\dxtmsft.dll
2007-12-18 09:51 179,584 ----a-w C:\WINDOWS\system32\drivers\mrxdav.sys
2007-12-18 09:51 179,584 ------w C:\WINDOWS\system32\dllcache\mrxdav.sys
2007-12-08 05:21 3,592,192 ------w C:\WINDOWS\system32\dllcache\mshtml.dll
2007-12-06 11:01 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe
2007-12-06 11:00 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2007-12-06 11:00 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
2007-12-06 04:59 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll
2007-12-04 18:38 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
2007-12-04 18:38 550,912 ------w C:\WINDOWS\system32\dllcache\oleaut32.dll
2005-10-20 03:30 56 --sh--r C:\WINDOWS\system32\9CD1F59E4F.sys
2005-10-20 03:30 1,890 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:00 15360]
"DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2004-09-13 14:33 155648]
"PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2004-04-11 18:15 290816]
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2005-03-04 09:26 606208]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 14:19 53248]
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2005-10-13 08:12 26112]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 10:54 282624]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 14:50 221184]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 14:50 81920]
"dlccmon.exe"="C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe" [2005-07-22 12:03 425984]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-03-02 15:24 257088]
"QUICKCARE"="C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe" [2006-11-07 20:07 192512]
"SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 09:22 155648]
"PaperPort PTD"="C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe" [2004-04-14 13:46 57393]
"IndexSearch"="C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe" [2004-04-14 14:04 40960]
"SetDefPrt"="C:\Program Files\Brother\Brmfl04g\BrStDvPt.exe" [2004-11-11 16:14 49152]
"ControlCenter2.0"="C:\Program Files\Brother\ControlCenter2\brctrcen.exe" [2005-01-07 16:30 864256]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe" [2007-12-14 03:42 144784]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [ ]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2005-10-13 08:05:39 24576]
QuickBooks Update Agent.lnk - C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2005-11-15 03:31:34 806912]

S3 BrScnUsb;Brother USB Still Image driver;C:\WINDOWS\system32\Drivers\BrScnUsb.sys [2004-10-15 11:50]
S3 MSControlService;Microsoft cache control;C:\WINDOWS\system32\windows []

.
Contents of the 'Scheduled Tasks' folder
"2007-03-06 04:28:39 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-02-09 00:09:20 C:\WINDOWS\Tasks\McDefragTask.job"
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe'
"2008-02-09 00:09:18 C:\WINDOWS\Tasks\McQcTask.job"
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-16 19:40:07
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-16 19:40:59
ComboFix2.txt 2008-02-15 20:59:23
.
2008-02-12 19:39:44 --- E O F ---

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:43:01 PM, on 2/16/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\PROGRA~1\McAfee\MPS\mps.exe
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\McAfee\MPS\mpsevh.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
C:\Program Files\Apoint\Apntex.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\dlcccoms.exe
c:\PROGRA~1\mcafee\msc\mcuimgr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptcl.dll
O4 - HKLM\..\Run: [Apoint] "C:\Program Files\Apoint\Apoint.exe"
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [RealTray] "C:\Program Files\Real\RealPlayer\RealPlay.exe" SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [dlccmon.exe] "C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QUICKCARE] "C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe" /P QUICKCARE
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] "C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe"
O4 - HKLM\..\Run: [IndexSearch] "C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe"
O4 - HKLM\..\Run: [SetDefPrt] "C:\Program Files\Brother\Brmfl04g\BrStDvPt.exe"
O4 - HKLM\..\Run: [ControlCenter2.0] "C:\Program Files\Brother\ControlCenter2\brctrcen.exe" /autorun
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKUS\S-1-5-18\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Default user')
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/pr02...s/MSNPUpld.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/res...lscbase370.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O23 - Service: dlcc_device - Unknown owner - C:\WINDOWS\system32\dlcccoms.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe
O23 - Service: Microsoft cache control (MSControlService) - Unknown owner - C:\WINDOWS\system32\windows (file missing)
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

--
End of file - 7897 bytes

**TheBruce1** · 02-17-2008, 04:40 AM

Nothing showing in the Combofix log, what is the exact location of these tmp files.

=======

Go to Start->Run and type in regedit and hit OK.Go to HKEY_LOCAL_MACHINE and click on it>then right-click on HKEY_LOCAL_MACHINE and select export.
Save the registry somewhere as a backup. Close the Registry Editor now.

Open notepad and copy/paste the text in the quotebox below:
(don't forget to copy and paste REGEDIT4)

Quote:

REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Drive Icons]

Save the file as "Fix.reg". Make sure to save it with the quotes. Choose to "Save type as - All Files"
It should look like this:

Double click on the Fix.reg file and choose Yes to merge/add it to the registry. You may delete the file afterwards.

=========

ESET Online Scanner

Please go to the following link ESET Online Scanner Link
Tick the box YES, I accept the Terms Of Use
Click the Start button
Now click the Install button
Click Start

The scanner engine will initialise and update
Do Not tick the box Remove found threats
Click the Scan button

The scan will now run, please be patient
When the scan finishes click the Details tab
Copy and paste the contents of the %ProgramFiles%\EsetOnlineScanner\log.txt back here.

==========

Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here.

===========
Logs Required
Scan results
Hijackthis Log

aeisenbaum · 02-17-2008, 11:08 PM

The exact location of the pos TMP files are: C:\Documents and Settings\Emily Salazar\My Documents.

ESET Online Scanner would not let me right click to copy the scan details but they are as follows:

Files Scanned: 245353 (seems like way too many files probably all those pos TMP files)
Threats Found: 1
Total Scan Time: 01:08:09
Scan Status: Finished

Details Tab of ESET Online Scanner:
"Probably a variant of JS/TrojanDownloader.Agent.NBQ trojan"
C:\Documents and Settings\Emily Salazar\Local Settings\Application Data\Mozilla\Firefox\Profiles\1udcqudp.default\Cache\E43CDD90d01

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:50:51 PM, on 2/17/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\PROGRA~1\McAfee\MPS\mps.exe
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\McAfee\MPS\mpsevh.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\dlcccoms.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptcl.dll
O4 - HKLM\..\Run: [Apoint] "C:\Program Files\Apoint\Apoint.exe"
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [RealTray] "C:\Program Files\Real\RealPlayer\RealPlay.exe" SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [dlccmon.exe] "C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QUICKCARE] "C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe" /P QUICKCARE
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] "C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe"
O4 - HKLM\..\Run: [IndexSearch] "C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe"
O4 - HKLM\..\Run: [SetDefPrt] "C:\Program Files\Brother\Brmfl04g\BrStDvPt.exe"
O4 - HKLM\..\Run: [ControlCenter2.0] "C:\Program Files\Brother\ControlCenter2\brctrcen.exe" /autorun
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKUS\S-1-5-18\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Default user')
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/pr02...s/MSNPUpld.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/res...lscbase370.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O23 - Service: dlcc_device - Unknown owner - C:\WINDOWS\system32\dlcccoms.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe
O23 - Service: Microsoft cache control (MSControlService) - Unknown owner - C:\WINDOWS\system32\windows (file missing)
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

--
End of file - 7996 bytes

**TheBruce1** · 02-18-2008, 05:04 AM

Open notepad and copy/paste the text in the quotebox below into it:

Quote:

DirLook::
C:\Documents and Settings\Emily Salazar\My Documents

Save this as CFscript

Refering to the picture above, drag CFscript into ComboFix.exe

Follow the prompts, and post the resulting log, C:\ComboFix.txt

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

Warning:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

=========
Logs Required
C:\Combofix.txt
Hijackthis Log

aeisenbaum · 02-18-2008, 11:42 AM

Thanks for your continued assistance. The combofix log is too long to copy and paste per an error msg via tech support forum. I have attached the file. Please see attachment. The Hijackthis log is as follows:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:23:46 AM, on 2/18/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\PROGRA~1\McAfee\MPS\mps.exe
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\McAfee\MPS\mpsevh.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\dlcccoms.exe
c:\PROGRA~1\mcafee\msc\mcuimgr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptcl.dll
O4 - HKLM\..\Run: [Apoint] "C:\Program Files\Apoint\Apoint.exe"
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [RealTray] "C:\Program Files\Real\RealPlayer\RealPlay.exe" SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [dlccmon.exe] "C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QUICKCARE] "C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe" /P QUICKCARE
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] "C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe"
O4 - HKLM\..\Run: [IndexSearch] "C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe"
O4 - HKLM\..\Run: [SetDefPrt] "C:\Program Files\Brother\Brmfl04g\BrStDvPt.exe"
O4 - HKLM\..\Run: [ControlCenter2.0] "C:\Program Files\Brother\ControlCenter2\brctrcen.exe" /autorun
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKUS\S-1-5-18\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Default user')
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/pr02...s/MSNPUpld.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/res...lscbase370.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O23 - Service: dlcc_device - Unknown owner - C:\WINDOWS\system32\dlcccoms.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe
O23 - Service: Microsoft cache control (MSControlService) - Unknown owner - C:\WINDOWS\system32\windows (file missing)
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

--
End of file - 8023 bytes

**TheBruce1** · 02-18-2008, 01:47 PM

Open notepad and copy/paste the text in the quotebox below into it:

Quote:

KillAll::

File::
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos24E0.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos24E0.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos24E0.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos24DF.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos24DF.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of Copy of pos24DF.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of pos24DF.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos24DF.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos20C9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos20C6.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20C9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20C6.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of pos20C6.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos20C9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos20C6.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos20CD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos20C2.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20CD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20C2.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of Copy of pos20CD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of Copy of pos20C2.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (6) of Copy of pos20C2.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (5) of Copy of pos20C2.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (4) of Copy of pos20C2.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of pos20CD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of pos20C2.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos20CD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos20C2.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos20CE.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20CE.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos20CE.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos20C1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20C1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos20C1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos20CA.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos20C5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20CA.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20C5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of Copy of pos20CA.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of Copy of pos20C5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (4) of Copy of pos20CA.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of pos20CA.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of pos20C5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos20CA.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos20C5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of Copy of pos20CA.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of Copy of pos20C5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos20AA.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20AA.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of Copy of pos20AA.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of pos20AA.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos20AA.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos20BD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20BD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of Copy of pos20BD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of pos20BD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos20BD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos20BE.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20BE.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of Copy of pos20BE.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of pos20BE.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos20BE.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos20A9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20A9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20A6.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20A5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of Copy of pos20A9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of Copy of pos20A6.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of Copy of pos20A5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of Copy of Copy of pos20A6.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (4) of Copy of pos20A9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of pos20A9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of Copy of pos20A6.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos20A9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of Copy of pos20A6.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of Copy of pos20A5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of Copy of Copy of pos20A6.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos20AD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20AD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of Copy of pos20AD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of pos20AD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos20AD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos20B5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos20A1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20B5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20A1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of Copy of pos20B5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of pos20B5.tmp C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos20B5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos20A1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of Copy of pos20B5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos20B9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos20B2.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20B9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20B2.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (5) of Copy of pos20B2.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (4) of Copy of pos20B2.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of pos20B2.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos20B9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos20B2.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos20B1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20B1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos20B1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos20BA.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos20B6.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20BA.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20B6.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (5) of Copy of pos20BA.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (4) of Copy of pos20BA.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of pos20BA.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of pos20B6.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos20BA.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos20B6.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos19D5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos19D5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (6) of pos19D5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (5) of pos19D5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (5) of Copy of pos19D5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (4) of pos19D5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (4) of Copy of pos19D5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of pos19D5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of pos19D5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of pos19D5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos19D5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos19D9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos19D9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (8) of pos19D9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (7) of pos19D9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (6) of pos19D9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (6) of Copy of pos19D9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (5) of pos19D9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (5) of Copy of pos19D9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (4) of pos19D9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (4) of Copy of pos19D9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of pos19D9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of pos19D9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of pos19D9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos19D9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos19E1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of Copy of pos19E1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of Copy of Copy of pos19E1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (6) of pos19E1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (5) of pos19E1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (4) of pos19E1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of pos19E1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of Copy of pos19E1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of pos19E1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of Copy of pos19E1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos19D1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of Copy of pos19D1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (4) of pos19D1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of pos19D1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of pos19D1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of Copy of pos19D1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos19ED.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos19E5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos19ED.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos19E5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (4) of pos19E5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of pos19E5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of pos19E5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of pos19E5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos19ED.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos19E5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos19E9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos19DD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of Copy of pos19E9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of Copy of pos19DD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of Copy of Copy of pos19DD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (7) of pos19E9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (6) of pos19E9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (6) of pos19DD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (5) of pos19E9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (5) of pos19DD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (5) of Copy of Copy of pos19DD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (4) of pos19E9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (4) of pos19DD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (4) of Copy of Copy of pos19DD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of pos19E9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of pos19DD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of Copy of pos19DD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of pos19E9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of pos19DD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of Copy of pos19E9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of Copy of pos19DD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of Copy of Copy of pos19DD.tmp

Save this as CFscript

Refering to the picture above, drag CFscript into ComboFix.exe

Follow the prompts, and post the resulting log, C:\ComboFix.txt

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

Warning:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

=========
Logs Required
C:\Combofix.txt
Hijackthis Log

aeisenbaum · 02-18-2008, 05:27 PM

All of the pos TMP files are gone from My documents folder EXCEPT for two of them. The icon for them looks like when a program is no longer associated with opening them icon (if you know what I mean). The names of the two remaining pos TMP files are: "Copy (2) of Copy of pos20B5" and "Copy (3) of Copy of pos20B5".

Thanks, the logs are as follows:

ComboFix 08-02-17.2 - Emily Salazar 2008-02-18 16:56:57.10 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.287 [GMT -7:00]
Running from: C:\Documents and Settings\Emily Salazar\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Emily Salazar\Desktop\CFscript.txt
* Created a new restore point

FILE ::
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of Copy of Copy of pos19DD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of Copy of Copy of pos20A6.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of Copy of pos19D1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of Copy of pos19DD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of Copy of pos19E1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of Copy of pos19E9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of Copy of pos20A5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of Copy of pos20A6.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of Copy of pos20B5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of Copy of pos20C5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of Copy of pos20CA.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos19D5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos19D9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos19E5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos19ED.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos20A1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos20A9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos20AA.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos20AD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos20B1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos20B2.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos20B6.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos20B9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos20BA.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos20BD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos20BE.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos20C1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos20C2.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos20C5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos20C6.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos20C9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos20CA.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos20CD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos20CE.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos24DF.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos24E0.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of pos19D1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of pos19D5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of pos19D9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of pos19DD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of pos19E1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of pos19E5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of pos19E9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of Copy of pos19DD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of Copy of pos19E1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of Copy of pos20A6.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of pos19D5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of pos19D9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of pos19E5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of pos20A9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of pos20AA.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of pos20AD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of pos20B2.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of pos20B5.tmp C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos20B5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of pos20B6.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of pos20BA.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of pos20BD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of pos20BE.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of pos20C2.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of pos20C5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of pos20C6.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of pos20CA.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of pos20CD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of pos24DF.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of pos19D1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of pos19D5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of pos19D9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of pos19DD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of pos19E1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of pos19E5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of pos19E9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (4) of Copy of Copy of pos19DD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (4) of Copy of pos19D5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (4) of Copy of pos19D9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (4) of Copy of pos20A9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (4) of Copy of pos20B2.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (4) of Copy of pos20BA.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (4) of Copy of pos20C2.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (4) of Copy of pos20CA.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (4) of pos19D1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (4) of pos19D5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (4) of pos19D9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (4) of pos19DD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (4) of pos19E1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (4) of pos19E5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (4) of pos19E9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (5) of Copy of Copy of pos19DD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (5) of Copy of pos19D5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (5) of Copy of pos19D9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (5) of Copy of pos20B2.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (5) of Copy of pos20BA.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (5) of Copy of pos20C2.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (5) of pos19D5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (5) of pos19D9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (5) of pos19DD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (5) of pos19E1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (5) of pos19E9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (6) of Copy of pos19D9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (6) of Copy of pos20C2.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (6) of pos19D5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (6) of pos19D9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (6) of pos19DD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (6) of pos19E1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (6) of pos19E9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (7) of pos19D9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (7) of pos19E9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (8) of pos19D9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of Copy of Copy of pos19DD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of Copy of Copy of pos19E1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of Copy of Copy of pos20A6.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of Copy of pos19D1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of Copy of pos19DD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of Copy of pos19E1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of Copy of pos19E9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of Copy of pos20A5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of Copy of pos20A6.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of Copy of pos20A9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of Copy of pos20AA.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of Copy of pos20AD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of Copy of pos20B5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of Copy of pos20BD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of Copy of pos20BE.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of Copy of pos20C2.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of Copy of pos20C5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of Copy of pos20CA.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of Copy of pos20CD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of Copy of pos24DF.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos19D1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos19D5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos19D9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos19DD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos19E1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos19E5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos19E9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos19ED.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20A1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20A5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20A6.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20A9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20AA.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20AD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20B1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20B2.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20B5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20B6.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20B9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20BA.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20BD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20BE.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20C1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20C2.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20C5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20C6.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20C9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20CA.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20CD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20CE.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos24DF.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos24E0.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos19D5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos19D9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos19E5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos19ED.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos20A1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos20A9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos20AA.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos20AD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos20B1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos20B2.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos20B5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos20B6.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos20B9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos20BA.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos20BD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos20BE.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos20C1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos20C2.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos20C5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos20C6.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos20C9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos20CA.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos20CD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos20CE.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos24DF.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos24E0.tmp
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of Copy of Copy of pos19DD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of Copy of Copy of pos20A6.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of Copy of pos19D1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of Copy of pos19DD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of Copy of pos19E1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of Copy of pos19E9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of Copy of pos20A5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of Copy of pos20A6.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of Copy of pos20B5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of Copy of pos20C5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of Copy of pos20CA.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos19D5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos19D9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos19E5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos19ED.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos20A1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos20A9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos20AA.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos20AD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos20B1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos20B2.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos20B6.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos20B9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos20BA.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos20BD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos20BE.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos20C1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos20C2.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos20C5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos20C6.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos20C9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos20CA.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos20CD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos20CE.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos24DF.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of Copy of pos24E0.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of pos19D1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of pos19D5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of pos19D9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of pos19DD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of pos19E1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of pos19E5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (2) of pos19E9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of Copy of pos19DD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of Copy of pos19E1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of Copy of pos20A6.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of pos19D5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of pos19D9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of pos19E5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of pos20A9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of pos20AA.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of pos20AD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of pos20B2.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of pos20B6.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of pos20BA.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of pos20BD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of pos20BE.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of pos20C2.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of pos20C5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of pos20C6.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of pos20CA.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of pos20CD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of Copy of pos24DF.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of pos19D1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of pos19D5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of pos19D9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of pos19DD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of pos19E1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of pos19E5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (3) of pos19E9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (4) of Copy of Copy of pos19DD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (4) of Copy of pos19D5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (4) of Copy of pos19D9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (4) of Copy of pos20A9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (4) of Copy of pos20B2.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (4) of Copy of pos20BA.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (4) of Copy of pos20C2.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (4) of Copy of pos20CA.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (4) of pos19D1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (4) of pos19D5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (4) of pos19D9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (4) of pos19DD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (4) of pos19E1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (4) of pos19E5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (4) of pos19E9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (5) of Copy of Copy of pos19DD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (5) of Copy of pos19D5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (5) of Copy of pos19D9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (5) of Copy of pos20B2.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (5) of Copy of pos20BA.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (5) of Copy of pos20C2.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (5) of pos19D5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (5) of pos19D9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (5) of pos19DD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (5) of pos19E1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (5) of pos19E9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (6) of Copy of pos19D9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (6) of Copy of pos20C2.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (6) of pos19D5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (6) of pos19D9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (6) of pos19DD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (6) of pos19E1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (6) of pos19E9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (7) of pos19D9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (7) of pos19E9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy (8) of pos19D9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of Copy of Copy of pos19DD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of Copy of Copy of pos19E1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of Copy of Copy of pos20A6.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of Copy of pos19D1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of Copy of pos19DD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of Copy of pos19E1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of Copy of pos19E9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of Copy of pos20A5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of Copy of pos20A6.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of Copy of pos20A9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of Copy of pos20AA.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of Copy of pos20AD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of Copy of pos20B5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of Copy of pos20BD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of Copy of pos20BE.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of Copy of pos20C2.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of Copy of pos20C5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of Copy of pos20CA.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of Copy of pos20CD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of Copy of pos24DF.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos19D1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos19D5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos19D9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos19DD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos19E1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos19E5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos19E9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos19ED.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20A1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20A5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20A6.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20A9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20AA.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20AD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20B1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20B2.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20B5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20B6.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20B9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20BA.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20BD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20BE.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20C1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20C2.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20C5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20C6.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20C9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20CA.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20CD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos20CE.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos24DF.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of Copy of pos24E0.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos19D5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos19D9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos19E5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos19ED.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos20A1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos20A9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos20AA.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos20AD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos20B1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos20B2.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos20B5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos20B6.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos20B9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos20BA.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos20BD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos20BE.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos20C1.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos20C2.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos20C5.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos20C6.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos20C9.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos20CA.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos20CD.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos20CE.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos24DF.tmp
C:\Documents and Settings\Emily Salazar\My Documents\Copy of pos24E0.tmp

.
((((((((((((((((((((((((( Files Created from 2008-01-19 to 2008-02-19 )))))))))))))))))))))))))))))))
.

2008-02-17 21:27 . 2008-02-17 21:30 <DIR> d-------- C:\Program Files\EsetOnlineScanner
2008-02-14 13:16 . 2008-02-14 13:16 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-02-14 13:16 . 2008-02-14 13:16 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-02-13 19:21 . 2008-02-13 19:30 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2008-02-13 19:21 . 2008-02-13 20:34 30,590 --a------ C:\WINDOWS\system32\pavas.ico
2008-02-13 17:49 . 2008-02-13 17:49 <DIR> d-------- C:\Program Files\Common Files\Java
2008-02-13 17:49 . 2007-12-14 01:59 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-02-12 13:01 . 2008-02-12 13:01 <DIR> d-------- C:\WINDOWS\ERUNT
2008-02-11 09:40 . 2008-02-11 09:40 2,715,648 --a------ C:\WINDOWS\system32\OnlineScanner.ocx
2008-02-11 09:39 . 2008-02-11 09:39 253,952 --a------ C:\WINDOWS\system32\OnlineScannerDLLA.dll
2008-02-11 09:39 . 2008-02-11 09:39 237,568 --a------ C:\WINDOWS\system32\OnlineScannerDLLW.dll
2008-02-09 02:04 . 2008-02-13 20:34 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico
2008-02-09 02:04 . 2008-02-13 20:34 1,406 --a------ C:\WINDOWS\system32\Help.ico
2008-02-09 01:08 . 2008-02-09 01:08 <DIR> d-------- C:\Program Files\Trend Micro
2008-02-08 17:15 . 2008-02-18 17:02 4,350 --a------ C:\WINDOWS\system32\Config.MPF
2008-02-08 17:12 . 2006-03-03 11:07 143,360 --a------ C:\WINDOWS\system32\dunzip32.dll
2008-02-08 17:10 . 2007-06-25 10:57 37,480 --a------ C:\WINDOWS\system32\drivers\mfesmfk.sys
2008-02-08 17:10 . 2007-06-25 10:57 32,008 --a------ C:\WINDOWS\system32\drivers\mferkdk.sys
2008-02-08 17:09 . 2007-06-25 10:57 171,240 --a------ C:\WINDOWS\system32\drivers\mfehidk.sys
2008-02-08 17:09 . 2007-03-02 14:16 109,608 --a------ C:\WINDOWS\system32\drivers\Mpfp.sys
2008-02-08 17:09 . 2007-06-25 14:54 71,496 --a------ C:\WINDOWS\system32\drivers\mfeavfk.sys
2008-02-08 17:09 . 2007-06-25 10:57 34,184 --a------ C:\WINDOWS\system32\drivers\mfebopk.sys
2008-02-08 17:08 . 2008-02-08 17:09 <DIR> d-------- C:\Program Files\McAfee.com
2008-02-08 13:53 . 2008-02-08 13:53 110,592 --a------ C:\WINDOWS\system32\OnlineScannerLang.dll
2008-02-06 22:26 . 2008-02-06 22:35 <DIR> d-------- C:\Program Files\Windows Live Safety Center
2008-02-06 02:52 . 2008-02-18 11:40 <DIR> d-------- C:\Documents and Settings\Emily Salazar\Application Data\SiteAdvisor
2008-02-06 02:52 . 2008-02-06 02:52 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SiteAdvisor
2008-02-06 01:59 . 2006-11-07 21:01 66,048 --a------ C:\WINDOWS\ieResetIcons.exe
2008-02-05 23:31 . 2008-02-05 23:31 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Trend Micro
2008-02-05 21:09 . 2008-02-05 21:09 164 --a------ C:\install.dat
2008-02-05 08:48 . 2008-02-05 08:48 77,824 --a------ C:\WINDOWS\system32\OnlineScannerUninstaller.exe
2008-01-30 23:42 . 2008-02-05 23:02 <DIR> d-------- C:\Documents and Settings\Emily Salazar\Application Data\McAfee
2008-01-30 22:50 . 2008-01-30 22:50 <DIR> d-------- C:\Documents and Settings\Emily Salazar\Application Data\Talkback
2008-01-30 11:27 . 2008-02-08 17:13 <DIR> d-------- C:\Program Files\McAfee
2008-01-30 11:27 . 2008-02-08 17:12 <DIR> d-------- C:\Program Files\Common Files\McAfee
2008-01-30 10:47 . 2008-02-08 17:11 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\McAfee

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-14 00:49 --------- d-----w C:\Program Files\Java
2008-02-07 10:05 --------- d-----w C:\Program Files\Dell
2008-02-07 10:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\GTek
2008-02-07 09:57 --------- d-----w C:\Documents and Settings\All Users\Application Data\SupportSoft
2008-02-07 09:55 --------- d-----w C:\Program Files\Common Files\supportsoft
2008-02-07 00:20 --------- d-----w C:\Program Files\Google
2008-01-31 06:33 --------- d-----w C:\Documents and Settings\Emily Salazar\Application Data\Move Networks
2008-01-29 21:51 --------- d-----w C:\Program Files\Dl_cats
2008-01-28 21:44 --------- d-----w C:\Documents and Settings\Emily Salazar\Application Data\AdobeUM
2008-01-08 17:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Dell
2005-10-20 03:30 56 --sh--r C:\WINDOWS\system32\9CD1F59E4F.sys
2005-10-20 03:30 1,890 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:00 15360]
"DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2004-09-13 14:33 155648]
"PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2004-04-11 18:15 290816]
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2005-03-04 09:26 606208]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 14:19 53248]
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2005-10-13 08:12 26112]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 10:54 282624]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 14:50 221184]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 14:50 81920]
"dlccmon.exe"="C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe" [2005-07-22 12:03 425984]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-03-02 15:24 257088]
"QUICKCARE"="C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe" [2006-11-07 20:07 192512]
"SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 09:22 155648]
"PaperPort PTD"="C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe" [2004-04-14 13:46 57393]
"IndexSearch"="C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe" [2004-04-14 14:04 40960]
"SetDefPrt"="C:\Program Files\Brother\Brmfl04g\BrStDvPt.exe" [2004-11-11 16:14 49152]
"ControlCenter2.0"="C:\Program Files\Brother\ControlCenter2\brctrcen.exe" [2005-01-07 16:30 864256]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe" [2007-12-14 03:42 144784]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [ ]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2005-10-13 08:05:39 24576]
QuickBooks Update Agent.lnk - C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2005-11-15 03:31:34 806912]

S3 BrScnUsb;Brother USB Still Image driver;C:\WINDOWS\system32\Drivers\BrScnUsb.sys [2004-10-15 11:50]
S3 MSControlService;Microsoft cache control;C:\WINDOWS\system32\windows []

.
Contents of the 'Scheduled Tasks' folder
"2007-03-06 04:28:39 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-02-09 00:09:20 C:\WINDOWS\Tasks\McDefragTask.job"
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe'
"2008-02-09 00:09:18 C:\WINDOWS\Tasks\McQcTask.job"
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-18 17:02:46
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\PROGRA~1\McAfee\MPS\mps.exe
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\WINDOWS\system32\wscntfy.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\McAfee\MPS\mpsevh.exe
C:\Program Files\Apoint\Apntex.exe
C:\WINDOWS\system32\dlcccoms.exe
C:\Program Files\iPod\bin\iPodService.exe
c:\PROGRA~1\mcafee\msc\mcuimgr.exe
.
**************************************************************************
.
Completion time: 2008-02-18 17:05:04 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-19 00:04:54
ComboFix2.txt 2008-02-18 18:21:29
ComboFix3.txt 2008-02-17 02:40:59
ComboFix4.txt 2008-02-15 20:59:23
.
2008-02-12 19:39:44 --- E O F ---

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5

23 PM, on 2/18/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\PROGRA~1\McAfee\MPS\mps.exe
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\McAfee\MPS\mpsevh.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\WINDOWS\system32\dlcccoms.exe
C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\WINDOWS\explorer.exe
c:\PROGRA~1\mcafee\msc\mcuimgr.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptcl.dll
O4 - HKLM\..\Run: [Apoint] "C:\Program Files\Apoint\Apoint.exe"
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [RealTray] "C:\Program Files\Real\RealPlayer\RealPlay.exe" SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [dlccmon.exe] "C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QUICKCARE] "C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe" /P QUICKCARE
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] "C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe"
O4 - HKLM\..\Run: [IndexSearch] "C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe"
O4 - HKLM\..\Run: [SetDefPrt] "C:\Program Files\Brother\Brmfl04g\BrStDvPt.exe"
O4 - HKLM\..\Run: [ControlCenter2.0] "C:\Program Files\Brother\ControlCenter2\brctrcen.exe" /autorun
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKUS\S-1-5-18\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Default user')
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/pr02...s/MSNPUpld.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/res...lscbase370.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O23 - Service: dlcc_device - Unknown owner - C:\WINDOWS\system32\dlcccoms.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe
O23 - Service: Microsoft cache control (MSControlService) - Unknown owner - C:\WINDOWS\system32\windows (file missing)
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

--
End of file - 8088 bytes

02-12-2008, 05:14 AM	#2 (permalink)
TheBruce1 Moderator, Analyst, Security Team Join Date: Oct 2006 Location: Dùn Èideann,Scotland. Posts: 5,093 OS: XP	Re: Need vundo help please Hello and welcome to TSF Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe. ========== Please follow all instructions and in which order they come, if you have any questions, please ask before proceeding. Its important that you follow this through until i give you the all clear, a lack of symptoms does not mean that it is no longer present. =========== Please print out or copy this page to Notepad in order to assist you when carrying out the following instructions. ============ Download SDFix and save it to your Desktop. Double click SDFix.exe and it will extract the files to %systemdrive% (Drive that contains the Windows Directory, typically C:SDFix) Please then reboot your computer in Safe Mode by doing the following : Restart your computer After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually; Instead of Windows loading as normal, the Advanced Options Menu should appear; Select the first option, to run Windows in Safe Mode, then press Enter. Choose your usual account. Open the extracted SDFix folder and double click RunThis.bat to start the script. Type Y to begin the cleanup process. It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot. Press any Key and it will restart the PC. When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons. Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt (Report.txt will also be copied to Clipboard ready for posting back on the forum). Finally paste the contents of the Report.txt back on the forum with the required logs ================ Please visit this webpage for download links, and instructions for running the tool: http://www.bleepingcomputer.com/comb...o-use-combofix When the tool is finished, it will produce a report for you. Please post the C:\ComboFix.txt along with a new HijackThis log so we may continue cleaning the system. =============== Logs Required Report.txt(from SDFix) C:\Combofix.txt Hijackthis Log __________________ Member of ASAP since 2007 Member of UNITE since 2008 Notice to BT customers BT to dump Phorm, see Here for more information. No DPI If we have helped you in anyway, please consider Donating

02-12-2008, 02:04 PM	#3 (permalink)
aeisenbaum Registered User Join Date: Feb 2008 Posts: 17 OS: xp sp2	Re: Need vundo help please Thank you for helping me so far. One thing I did notice, is that in the system tray, the date was off by a day (said it was the 13th when it is the 12th). This may have happened after combofix, I'm not sure. I changed the date to the correct date. I hope that was ok. The three logs you requested are as follows: SDFix: Version 1.141 Run by Emily Salazar on Tue 02/12/2008 at 01:03 PM Microsoft Windows XP [Version 5.1.2600] Running From: C:\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting... Normal Mode: Checking Files: Trojan Files Found: C:\PROGRA~1\MESSEN~1\RTEPRE~1.HTM - Deleted C:\PROGRA~1\MESSEN~1\QUGAVAJ - Deleted Removing Temp Files... ADS Check: Final Check: catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-02-12 13:10:42 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... scanning hidden registry entries ... [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher] "TracesProcessed"=dword:00000053 "TracesSuccessful"=dword:00000007 scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Remaining Services: ------------------ Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] Remaining Files: --------------- File Backups: - C:\SDFix\backups\backups.zip Files with Hidden Attributes: Wed 19 Oct 2005 56 A.SHR --- "C:\i386\9CD1F59E4F.sys" Wed 19 Oct 2005 1,890 A.SH. --- "C:\i386\KGyGaAvL.sys" Thu 7 Sep 2006 4 A..H. --- "C:\WINDOWS\uccspecb.sys" Wed 13 Oct 2004 1,694,208 ..SH. --- "C:\Program Files\Messenger\msmsgs.exe" Wed 19 Oct 2005 56 ..SHR --- "C:\WINDOWS\system32\9CD1F59E4F.sys" Wed 19 Oct 2005 1,890 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys" Thu 26 Apr 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp" Fri 12 Nov 2004 37,376 ...H. --- "C:\Program Files\Common Files\Adobe\ESD\DLMCleanup.exe" Finished! ComboFix 08-02-13.1 - Emily Salazar 2008-02-12 13:35:08.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.223 [GMT -7:00] Running from: C:\Documents and Settings\Emily Salazar\Desktop\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat C:\WINDOWS\system32\nGpxx01 ----- BITS: Possible infected sites ----- hxxp://au.download.windo . ((((((((((((((((((((((((( Files Created from 2008-01-13 to 2008-02-13 ))))))))))))))))))))))))))))))) . 2008-02-12 13:01 . 2008-02-12 13:01 <DIR> d-------- C:\WINDOWS\ERUNT 2008-02-12 12:51 . 2008-02-12 13:13 <DIR> d-------- C:\SDFix 2008-02-09 02:50 . 2008-02-09 02:50 <DIR> d-------- C:\Deckard 2008-02-09 02:04 . 2008-02-09 02:13 <DIR> d-------- C:\WINDOWS\system32\ActiveScan 2008-02-09 02:04 . 2008-02-09 02:26 30,590 --a------ C:\WINDOWS\system32\pavas.ico 2008-02-09 02:04 . 2008-02-09 02:26 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico 2008-02-09 02:04 . 2008-02-09 02:26 1,406 --a------ C:\WINDOWS\system32\Help.ico 2008-02-09 01:08 . 2008-02-09 01:08 <DIR> d-------- C:\Program Files\Trend Micro 2008-02-08 23:51 . 2004-08-04 03:00 388,608 --a------ C:\kmd.exe 2008-02-08 17:15 . 2008-02-12 13:29 3,806 --a------ C:\WINDOWS\system32\Config.MPF 2008-02-08 17:12 . 2006-03-03 11:07 143,360 --a------ C:\WINDOWS\system32\dunzip32.dll 2008-02-08 17:10 . 2007-06-25 10:57 37,480 --a------ C:\WINDOWS\system32\drivers\mfesmfk.sys 2008-02-08 17:10 . 2007-06-25 10:57 32,008 --a------ C:\WINDOWS\system32\drivers\mferkdk.sys 2008-02-08 17:09 . 2007-06-25 10:57 171,240 --a------ C:\WINDOWS\system32\drivers\mfehidk.sys 2008-02-08 17:09 . 2007-03-02 14:16 109,608 --a------ C:\WINDOWS\system32\drivers\Mpfp.sys 2008-02-08 17:09 . 2007-06-25 14:54 71,496 --a------ C:\WINDOWS\system32\drivers\mfeavfk.sys 2008-02-08 17:09 . 2007-06-25 10:57 34,184 --a------ C:\WINDOWS\system32\drivers\mfebopk.sys 2008-02-08 17:08 . 2008-02-08 17:09 <DIR> d-------- C:\Program Files\McAfee.com 2008-02-07 19:18 . 2008-02-07 19:52 <DIR> d-------- C:\VundoFix Backups 2008-02-07 03:18 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-02-06 22:26 . 2008-02-06 22:35 <DIR> d-------- C:\Program Files\Windows Live Safety Center 2008-02-06 02:52 . 2008-02-12 13:18 <DIR> d-------- C:\Documents and Settings\Emily Salazar\Application Data\SiteAdvisor 2008-02-06 02:52 . 2008-02-06 02:52 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SiteAdvisor 2008-02-06 01:59 . 2006-11-07 21:01 66,048 --a------ C:\WINDOWS\ieResetIcons.exe 2008-02-05 23:31 . 2008-02-05 23:31 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Trend Micro 2008-02-05 21:09 . 2008-02-05 21:09 164 --a------ C:\install.dat 2008-01-30 23:42 . 2008-02-05 23:02 <DIR> d-------- C:\Documents and Settings\Emily Salazar\Application Data\McAfee 2008-01-30 22:50 . 2008-01-30 22:50 <DIR> d-------- C:\Documents and Settings\Emily Salazar\Application Data\Talkback 2008-01-30 11:27 . 2008-02-08 17:13 <DIR> d-------- C:\Program Files\McAfee 2008-01-30 11:27 . 2008-02-08 17:12 <DIR> d-------- C:\Program Files\Common Files\McAfee 2008-01-30 10:47 . 2008-02-08 17:11 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\McAfee 2008-01-30 10:16 . 2008-01-30 10:16 <DIR> d-------- C:\WINDOWS\system32\tps5 2008-01-30 10:16 . 2008-01-31 05:12 <DIR> d-------- C:\WINDOWS\system32\rip4 2008-01-30 10:16 . 2008-02-07 01:30 <DIR> d-------- C:\WINDOWS\system32\leb3 2008-01-30 10:16 . 2008-01-31 05:05 <DIR> d-------- C:\WINDOWS\system32\gis6 2008-01-30 10:16 . 2008-01-31 00:20 <DIR> d-------- C:\WINDOWS\system32\dom1 2008-01-30 10:16 . 2008-01-31 05:12 <DIR> d--hs---- C:\WINDOWS\RW1pbHkgU2FsYXphcg 2008-01-30 10:16 . 2008-01-30 10:16 <DIR> d-------- C:\Temp\gTiis19 2008-01-30 10:11 . 2008-01-30 10:11 <DIR> d-------- C:\Temp\cXzz9 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-02-08 23:53 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint 2008-02-07 10:17 --------- d-----w C:\Program Files\Java 2008-02-07 10:05 --------- d-----w C:\Program Files\Dell 2008-02-07 10:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\GTek 2008-02-07 09:57 --------- d-----w C:\Documents and Settings\All Users\Application Data\SupportSoft 2008-02-07 09:55 --------- d-----w C:\Program Files\Common Files\supportsoft 2008-02-07 00:20 --------- d-----w C:\Program Files\Google 2008-01-31 12:33 --------- d-----w C:\Program Files\Symantec 2008-01-31 12:33 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-01-31 10:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec 2008-01-31 06:33 --------- d-----w C:\Documents and Settings\Emily Salazar\Application Data\Move Networks 2008-01-29 21:51 --------- d-----w C:\Program Files\Dl_cats 2008-01-28 21:44 --------- d-----w C:\Documents and Settings\Emily Salazar\Application Data\AdobeUM 2008-01-11 05:53 44,544 ------w C:\WINDOWS\system32\dllcache\pngfilt.dll 2008-01-08 17:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Dell 2007-12-19 23:01 347,136 ------w C:\WINDOWS\system32\dllcache\dxtmsft.dll 2007-12-18 09:51 179,584 ----a-w C:\WINDOWS\system32\drivers\mrxdav.sys 2007-12-18 09:51 179,584 ------w C:\WINDOWS\system32\dllcache\mrxdav.sys 2007-12-08 05:21 3,592,192 ------w C:\WINDOWS\system32\dllcache\mshtml.dll 2007-12-07 02:21 824,832 ----a-w C:\WINDOWS\system32\wininet.dll 2007-12-07 02:21 824,832 ------w C:\WINDOWS\system32\dllcache\wininet.dll 2007-12-07 02:21 671,232 ------w C:\WINDOWS\system32\dllcache\mstime.dll 2007-12-07 02:21 63,488 ------w C:\WINDOWS\system32\dllcache\icardie.dll 2007-12-07 02:21 6,066,176 ------w C:\WINDOWS\system32\dllcache\ieframe.dll 2007-12-07 02:21 52,224 ------w C:\WINDOWS\system32\dllcache\msfeedsbs.dll 2007-12-07 02:21 478,208 ------w C:\WINDOWS\system32\dllcache\mshtmled.dll 2007-12-07 02:21 459,264 ------w C:\WINDOWS\system32\dllcache\msfeeds.dll 2007-12-07 02:21 44,544 ------w C:\WINDOWS\system32\dllcache\iernonce.dll 2007-12-07 02:21 384,512 ------w C:\WINDOWS\system32\dllcache\iedkcs32.dll 2007-12-07 02:21 383,488 ------w C:\WINDOWS\system32\dllcache\ieapfltr.dll 2007-12-07 02:21 27,648 ------w C:\WINDOWS\system32\dllcache\jsproxy.dll 2007-12-07 02:21 267,776 ------w C:\WINDOWS\system32\dllcache\iertutil.dll 2007-12-07 02:21 233,472 ------w C:\WINDOWS\system32\dllcache\webcheck.dll 2007-12-07 02:21 230,400 ------w C:\WINDOWS\system32\dllcache\ieaksie.dll 2007-12-07 02:21 214,528 ------w C:\WINDOWS\system32\dllcache\dxtrans.dll 2007-12-07 02:21 193,024 ------w C:\WINDOWS\system32\dllcache\msrating.dll 2007-12-07 02:21 153,088 ------w C:\WINDOWS\system32\dllcache\ieakeng.dll 2007-12-07 02:21 133,120 ------w C:\WINDOWS\system32\dllcache\extmgr.dll 2007-12-07 02:21 124,928 ------w C:\WINDOWS\system32\dllcache\advpack.dll 2007-12-07 02:21 105,984 ------w C:\WINDOWS\system32\dllcache\url.dll 2007-12-07 02:21 102,912 ------w C:\WINDOWS\system32\dllcache\occache.dll 2007-12-07 02:21 1,159,680 ------w C:\WINDOWS\system32\dllcache\urlmon.dll 2007-12-06 11:01 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe 2007-12-06 11:00 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe 2007-12-06 11:00 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe 2007-12-06 04:59 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll 2007-12-04 18:38 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll 2007-12-04 18:38 550,912 ------w C:\WINDOWS\system32\dllcache\oleaut32.dll 2005-10-20 03:30 56 --sh--r C:\WINDOWS\system32\9CD1F59E4F.sys 2005-10-20 03:30 1,890 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BD4742DB-08DA-456D-A68F-7ACD99AA4801}] C:\WINDOWS\system32\awvtu.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:00 15360] "DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [ ] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Apoint"="C:\Program Files\Apoint\Apoint.exe" [2004-09-13 14:33 155648] "SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-11-19 15:48 32881] "PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2004-04-11 18:15 290816] "Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2005-03-04 09:26 606208] "DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 14:19 53248] "RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2005-10-13 08:12 26112] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 10:54 282624] "ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 14:50 221184] "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 14:50 81920] "dlccmon.exe"="C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe" [2005-07-22 12:03 425984] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-03-02 15:24 257088] "QUICKCARE"="C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe" [2006-11-07 20:07 192512] "SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 09:22 155648] "PaperPort PTD"="C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe" [2004-04-14 13:46 57393] "IndexSearch"="C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe" [2004-04-14 14:04 40960] "SetDefPrt"="C:\Program Files\Brother\Brmfl04g\BrStDvPt.exe" [2004-11-11 16:14 49152] "ControlCenter2.0"="C:\Program Files\Brother\ControlCenter2\brctrcen.exe" [2005-01-07 16:30 864256] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [ ] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2005-10-13 08:05:39 24576] QuickBooks Update Agent.lnk - C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2005-11-15 03:31:34 806912] S3 BrScnUsb;Brother USB Still Image driver;C:\WINDOWS\system32\Drivers\BrScnUsb.sys [2004-10-15 11:50] S3 MSControlService;Microsoft cache control;C:\WINDOWS\system32\windows [] . Contents of the 'Scheduled Tasks' folder "2007-03-06 04:28:39 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2008-02-09 00:09:20 C:\WINDOWS\Tasks\McDefragTask.job" - c:\PROGRA~1\mcafee\mqc\QcConsol.exe' "2008-02-09 00:09:18 C:\WINDOWS\Tasks\McQcTask.job" - c:\PROGRA~1\mcafee\mqc\QcConsol.exe . ************************************************************************ catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-02-13 13:37:23 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************ . Completion time: 2008-02-13 13:38:51 ComboFix-quarantined-files.txt 2008-02-13 20:38:00 ComboFix2.txt 2008-02-09 07:05:56 . 2008-02-12 19:39:44 --- E O F --- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 1:45:14 PM, on 2/13/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16608) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\wltrysvc.exe C:\WINDOWS\System32\bcmwltry.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe C:\PROGRA~1\McAfee\MSC\mcpromgr.exe c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\McAfee\MPF\MPFSrv.exe C:\PROGRA~1\McAfee\MPS\mps.exe C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\McAfee\MPS\mpsevh.exe C:\Program Files\Apoint\Apoint.exe C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe C:\Program Files\Dell\Media Experience\PCMService.exe C:\Program Files\Dell\QuickSet\quickset.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\Program Files\Real\RealPlayer\RealPlay.exe C:\Program Files\Apoint\Apntex.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe c:\PROGRA~1\mcafee.com\agent\mcagent.exe C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\dlcccoms.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\iPod\bin\iPodService.exe c:\PROGRA~1\mcafee\msc\mcuimgr.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptcl.dll O2 - BHO: (no name) - {BD4742DB-08DA-456D-A68F-7ACD99AA4801} - C:\WINDOWS\system32\awvtu.dll (file missing) O4 - HKLM\..\Run: [Apoint] "C:\Program Files\Apoint\Apoint.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe" O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" O4 - HKLM\..\Run: [RealTray] "C:\Program Files\Real\RealPlayer\RealPlay.exe" SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [ISUSPM Startup] "C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [dlccmon.exe] "C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe" O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QUICKCARE] "C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe" /P QUICKCARE O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot O4 - HKLM\..\Run: [PaperPort PTD] "C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe" O4 - HKLM\..\Run: [IndexSearch] "C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe" O4 - HKLM\..\Run: [SetDefPrt] "C:\Program Files\Brother\Brmfl04g\BrStDvPt.exe" O4 - HKLM\..\Run: [ControlCenter2.0] "C:\Program Files\Brother\ControlCenter2\brctrcen.exe" /autorun O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter O4 - HKUS\S-1-5-18\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Default user') O4 - Global Startup: Digital Line Detect.lnk = ? O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/pr02...s/MSNPUpld.cab O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/res...lscbase370.cab O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} (cpbrkpie Control) - http://a19.g.akamai.net/7/19/7125/14...2/cpbrkpie.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O23 - Service: dlcc_device - Unknown owner - C:\WINDOWS\system32\dlcccoms.exe O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe O23 - Service: Microsoft cache control (MSControlService) - Unknown owner - C:\WINDOWS\system32\windows (file missing) O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe -- End of file - 8931 bytes

02-13-2008, 08:42 PM	#5 (permalink)
aeisenbaum Registered User Join Date: Feb 2008 Posts: 17 OS: xp sp2	Re: Need vundo help please Still can not run panda active scan successfully. When i click scan my computer icon i get a error icon on bottom left of widow stating, object doesn't support this property or method. Scan just hangs and never does anything. I let it sit for 30min. Active x was installed, all steps followed correctly. In ie7 I can not access my internet options or clear browsing history etc. Maybe this is causing the hang up? Anyway, all other steps were followed. Combo and hijack logs are as follows: ComboFix 08-02-13.1 - Emily Salazar 2008-02-13 1937.6 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.279 [GMT -7:00] Running from: C:\Documents and Settings\Emily Salazar\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Emily Salazar\Desktop\CFscript.txt * Created a new restore point FILE C:\WINDOWS\uccspecb.sys . ((((((((((((((((((((((((( Files Created from 2008-01-14 to 2008-02-14 ))))))))))))))))))))))))))))))) . 2008-02-13 17:49 . 2008-02-13 17:49 <DIR> d-------- C:\Program Files\Common Files\Java 2008-02-13 17:49 . 2007-12-14 01:59 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-02-12 13:01 . 2008-02-12 13:01 <DIR> d-------- C:\WINDOWS\ERUNT 2008-02-12 12:51 . 2008-02-12 13:13 <DIR> d-------- C:\SDFix 2008-02-09 02:50 . 2008-02-09 02:50 <DIR> d-------- C:\Deckard 2008-02-09 02:04 . 2008-02-13 18:50 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico 2008-02-09 02:04 . 2008-02-13 18:50 1,406 --a------ C:\WINDOWS\system32\Help.ico 2008-02-09 01:08 . 2008-02-09 01:08 <DIR> d-------- C:\Program Files\Trend Micro 2008-02-08 23:51 . 2004-08-04 03:00 388,608 --a------ C:\kmd.exe 2008-02-08 17:15 . 2008-02-13 18:56 3,940 --a------ C:\WINDOWS\system32\Config.MPF 2008-02-08 17:12 . 2006-03-03 11:07 143,360 --a------ C:\WINDOWS\system32\dunzip32.dll 2008-02-08 17:10 . 2007-06-25 10:57 37,480 --a------ C:\WINDOWS\system32\drivers\mfesmfk.sys 2008-02-08 17:10 . 2007-06-25 10:57 32,008 --a------ C:\WINDOWS\system32\drivers\mferkdk.sys 2008-02-08 17:09 . 2007-06-25 10:57 171,240 --a------ C:\WINDOWS\system32\drivers\mfehidk.sys 2008-02-08 17:09 . 2007-03-02 14:16 109,608 --a------ C:\WINDOWS\system32\drivers\Mpfp.sys 2008-02-08 17:09 . 2007-06-25 14:54 71,496 --a------ C:\WINDOWS\system32\drivers\mfeavfk.sys 2008-02-08 17:09 . 2007-06-25 10:57 34,184 --a------ C:\WINDOWS\system32\drivers\mfebopk.sys 2008-02-08 17:08 . 2008-02-08 17:09 <DIR> d-------- C:\Program Files\McAfee.com 2008-02-06 22:26 . 2008-02-06 22:35 <DIR> d-------- C:\Program Files\Windows Live Safety Center 2008-02-06 02:52 . 2008-02-13 18:40 <DIR> d-------- C:\Documents and Settings\Emily Salazar\Application Data\SiteAdvisor 2008-02-06 02:52 . 2008-02-06 02:52 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SiteAdvisor 2008-02-06 01:59 . 2006-11-07 21:01 66,048 --a------ C:\WINDOWS\ieResetIcons.exe 2008-02-05 23:31 . 2008-02-05 23:31 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Trend Micro 2008-02-05 21:09 . 2008-02-05 21:09 164 --a------ C:\install.dat 2008-01-30 23:42 . 2008-02-05 23:02 <DIR> d-------- C:\Documents and Settings\Emily Salazar\Application Data\McAfee 2008-01-30 22:50 . 2008-01-30 22:50 <DIR> d-------- C:\Documents and Settings\Emily Salazar\Application Data\Talkback 2008-01-30 11:27 . 2008-02-08 17:13 <DIR> d-------- C:\Program Files\McAfee 2008-01-30 11:27 . 2008-02-08 17:12 <DIR> d-------- C:\Program Files\Common Files\McAfee 2008-01-30 10:47 . 2008-02-08 17:11 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\McAfee 2008-01-30 10:16 . 2008-01-30 10:16 <DIR> d-------- C:\WINDOWS\system32\tps5 2008-01-30 10:16 . 2008-01-31 05:12 <DIR> d--hs---- C:\WINDOWS\RW1pbHkgU2FsYXphcg . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-02-14 00:49 --------- d-----w C:\Program Files\Java 2008-02-08 23:53 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint 2008-02-07 10:05 --------- d-----w C:\Program Files\Dell 2008-02-07 10:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\GTek 2008-02-07 09:57 --------- d-----w C:\Documents and Settings\All Users\Application Data\SupportSoft 2008-02-07 09:55 --------- d-----w C:\Program Files\Common Files\supportsoft 2008-02-07 00:20 --------- d-----w C:\Program Files\Google 2008-01-31 12:33 --------- d-----w C:\Program Files\Symantec 2008-01-31 12:33 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-01-31 10:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec 2008-01-31 06:33 --------- d-----w C:\Documents and Settings\Emily Salazar\Application Data\Move Networks 2008-01-29 21:51 --------- d-----w C:\Program Files\Dl_cats 2008-01-28 21:44 --------- d-----w C:\Documents and Settings\Emily Salazar\Application Data\AdobeUM 2008-01-11 05:53 44,544 ------w C:\WINDOWS\system32\dllcache\pngfilt.dll 2008-01-08 17:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Dell 2007-12-19 23:01 347,136 ------w C:\WINDOWS\system32\dllcache\dxtmsft.dll 2007-12-18 09:51 179,584 ----a-w C:\WINDOWS\system32\drivers\mrxdav.sys 2007-12-18 09:51 179,584 ------w C:\WINDOWS\system32\dllcache\mrxdav.sys 2007-12-08 05:21 3,592,192 ------w C:\WINDOWS\system32\dllcache\mshtml.dll 2007-12-07 02:21 824,832 ----a-w C:\WINDOWS\system32\wininet.dll 2007-12-07 02:21 824,832 ------w C:\WINDOWS\system32\dllcache\wininet.dll 2007-12-07 02:21 671,232 ------w C:\WINDOWS\system32\dllcache\mstime.dll 2007-12-07 02:21 63,488 ------w C:\WINDOWS\system32\dllcache\icardie.dll 2007-12-07 02:21 6,066,176 ------w C:\WINDOWS\system32\dllcache\ieframe.dll 2007-12-07 02:21 52,224 ------w C:\WINDOWS\system32\dllcache\msfeedsbs.dll 2007-12-07 02:21 478,208 ------w C:\WINDOWS\system32\dllcache\mshtmled.dll 2007-12-07 02:21 459,264 ------w C:\WINDOWS\system32\dllcache\msfeeds.dll 2007-12-07 02:21 44,544 ------w C:\WINDOWS\system32\dllcache\iernonce.dll 2007-12-07 02:21 384,512 ------w C:\WINDOWS\system32\dllcache\iedkcs32.dll 2007-12-07 02:21 383,488 ------w C:\WINDOWS\system32\dllcache\ieapfltr.dll 2007-12-07 02:21 27,648 ------w C:\WINDOWS\system32\dllcache\jsproxy.dll 2007-12-07 02:21 267,776 ------w C:\WINDOWS\system32\dllcache\iertutil.dll 2007-12-07 02:21 233,472 ------w C:\WINDOWS\system32\dllcache\webcheck.dll 2007-12-07 02:21 230,400 ------w C:\WINDOWS\system32\dllcache\ieaksie.dll 2007-12-07 02:21 214,528 ------w C:\WINDOWS\system32\dllcache\dxtrans.dll 2007-12-07 02:21 193,024 ------w C:\WINDOWS\system32\dllcache\msrating.dll 2007-12-07 02:21 153,088 ------w C:\WINDOWS\system32\dllcache\ieakeng.dll 2007-12-07 02:21 133,120 ------w C:\WINDOWS\system32\dllcache\extmgr.dll 2007-12-07 02:21 124,928 ------w C:\WINDOWS\system32\dllcache\advpack.dll 2007-12-07 02:21 105,984 ------w C:\WINDOWS\system32\dllcache\url.dll 2007-12-07 02:21 102,912 ------w C:\WINDOWS\system32\dllcache\occache.dll 2007-12-07 02:21 1,159,680 ------w C:\WINDOWS\system32\dllcache\urlmon.dll 2007-12-06 11:01 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe 2007-12-06 11:00 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe 2007-12-06 11:00 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe 2007-12-06 04:59 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll 2007-12-04 18:38 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll 2007-12-04 18:38 550,912 ------w C:\WINDOWS\system32\dllcache\oleaut32.dll 2005-10-20 03:30 56 --sh--r C:\WINDOWS\system32\9CD1F59E4F.sys 2005-10-20 03:30 1,890 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys . (((((((((((((((((((((((((((((((((((((((((((( Look ))))))))))))))))))))))))))))))))))))))))))))))))))))))))) . ---- Directory of C:\WINDOWS\RW1pbHkgU2FsYXphcg ---- ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:00 15360] "DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [ ] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Apoint"="C:\Program Files\Apoint\Apoint.exe" [2004-09-13 14:33 155648] "PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2004-04-11 18:15 290816] "Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2005-03-04 09:26 606208] "DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 14:19 53248] "RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2005-10-13 08:12 26112] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 10:54 282624] "ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 14:50 221184] "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 14:50 81920] "dlccmon.exe"="C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe" [2005-07-22 12:03 425984] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-03-02 15:24 257088] "QUICKCARE"="C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe" [2006-11-07 20:07 192512] "SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 09:22 155648] "PaperPort PTD"="C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe" [2004-04-14 13:46 57393] "IndexSearch"="C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe" [2004-04-14 14:04 40960] "SetDefPrt"="C:\Program Files\Brother\Brmfl04g\BrStDvPt.exe" [2004-11-11 16:14 49152] "ControlCenter2.0"="C:\Program Files\Brother\ControlCenter2\brctrcen.exe" [2005-01-07 16:30 864256] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe" [2007-12-14 03:42 144784] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [ ] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2005-10-13 08:05:39 24576] QuickBooks Update Agent.lnk - C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2005-11-15 03:31:34 806912] S3 BrScnUsb;Brother USB Still Image driver;C:\WINDOWS\system32\Drivers\BrScnUsb.sys [2004-10-15 11:50] S3 MSControlService;Microsoft cache control;C:\WINDOWS\system32\windows [] . Contents of the 'Scheduled Tasks' folder "2007-03-06 04:28:39 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2008-02-09 00:09:20 C:\WINDOWS\Tasks\McDefragTask.job" - c:\PROGRA~1\mcafee\mqc\QcConsol.exe' "2008-02-09 00:09:18 C:\WINDOWS\Tasks\McQcTask.job" - c:\PROGRA~1\mcafee\mqc\QcConsol.exe . ************************************************************************ catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-02-13 19:11:54 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... C:\WINDOWS\bcmwltrytmp.reg scan completed successfully hidden files: 1 ********************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\System32\wltrysvc.exe C:\WINDOWS\System32\bcmwltry.exe C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe C:\PROGRA~1\McAfee\MSC\mcpromgr.exe c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\McAfee\MPF\MPFSrv.exe C:\PROGRA~1\McAfee\MPS\mps.exe C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe C:\Program Files\McAfee\MPS\mpsevh.exe c:\PROGRA~1\mcafee.com\agent\mcagent.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Apoint\Apntex.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\dlcccoms.exe c:\PROGRA~1\mcafee\msc\mcuimgr.exe . ************************************************************************ . Completion time: 2008-02-13 19:14:31 - machine was rebooted ComboFix-quarantined-files.txt 2008-02-14 02:14:27 ComboFix2.txt 2008-02-14 00:24:15 ComboFix3.txt 2008-02-13 23:56:43 ComboFix4.txt 2008-02-13 23:33:35 ComboFix5.txt 2008-02-13 20:38:52 . 2008-02-12 19:39:44 --- E O F --- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 8:26:45 PM, on 2/13/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16608) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\wltrysvc.exe C:\WINDOWS\System32\bcmwltry.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe C:\PROGRA~1\McAfee\MSC\mcpromgr.exe c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\McAfee\MPF\MPFSrv.exe C:\PROGRA~1\McAfee\MPS\mps.exe C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe C:\Program Files\McAfee\MPS\mpsevh.exe c:\PROGRA~1\mcafee.com\agent\mcagent.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Apoint\Apoint.exe C:\Program Files\Dell\Media Experience\PCMService.exe C:\Program Files\Dell\QuickSet\quickset.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\Program Files\Real\RealPlayer\RealPlay.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe C:\Program Files\Apoint\Apntex.exe C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Digital Line Detect\DLG.exe C:\WINDOWS\system32\dlcccoms.exe C:\WINDOWS\explorer.exe c:\PROGRA~1\mcafee\msc\mcuimgr.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptcl.dll O4 - HKLM\..\Run: [Apoint] "C:\Program Files\Apoint\Apoint.exe" O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe" O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" O4 - HKLM\..\Run: [RealTray] "C:\Program Files\Real\RealPlayer\RealPlay.exe" SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [ISUSPM Startup] "C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [dlccmon.exe] "C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe" O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QUICKCARE] "C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe" /P QUICKCARE O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot O4 - HKLM\..\Run: [PaperPort PTD] "C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe" O4 - HKLM\..\Run: [IndexSearch] "C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe" O4 - HKLM\..\Run: [SetDefPrt] "C:\Program Files\Brother\Brmfl04g\BrStDvPt.exe" O4 - HKLM\..\Run: [ControlCenter2.0] "C:\Program Files\Brother\ControlCenter2\brctrcen.exe" /autorun O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter O4 - HKUS\S-1-5-18\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Default user') O4 - Global Startup: Digital Line Detect.lnk = ? O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/pr02...s/MSNPUpld.cab O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/res...lscbase370.cab O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} (cpbrkpie Control) - http://a19.g.akamai.net/7/19/7125/14...2/cpbrkpie.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O23 - Service: dlcc_device - Unknown owner - C:\WINDOWS\system32\dlcccoms.exe O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe O23 - Service: Microsoft cache control (MSControlService) - Unknown owner - C:\WINDOWS\system32\windows (file missing) O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe -- End of file - 7962 bytes

02-14-2008, 04:26 AM	#6 (permalink)
TheBruce1 Moderator, Analyst, Security Team Join Date: Oct 2006 Location: Dùn Èideann,Scotland. Posts: 5,093 OS: XP	Re: Need vundo help please Try this one instead. Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner Answer Yes, when prompted to install an ActiveX component. The program will then begin downloading the latest definition files. Once the files have been downloaded click on NEXT Locate the Scan Settings button & configure to: Scan using the following Anti-Virus database: Extended Scan Options: Scan Archives Scan Mail Bases Click OK & have it scan My Computer Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it. Click the Save as Text button to save the file to your desktop so that you may post it in your next reply * Turn off the real time scanner of any existing antivirus program while performing the online scan Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license has been accepted, reset to 100%. __________________ Member of ASAP since 2007 Member of UNITE since 2008 Notice to BT customers BT to dump Phorm, see Here for more information. No DPI If we have helped you in anyway, please consider Donating

02-14-2008, 03:03 PM	#7 (permalink)
aeisenbaum Registered User Join Date: Feb 2008 Posts: 17 OS: xp sp2	Re: Need vundo help please Thanks for your continued help, it is much appreciated. There was only a Save Report As..button to click on (no Save as Text button). The default was as an html doc but i saved as .txt. I also have as html if necessary (file:///C:/Documents%20and%20Settings/Emily%20Salazar/Desktop/kaspersky.html). The icon is on my desktop. The .txt report is as follows: ------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT Thursday, February 14, 2008 2:53:23 PM Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 14/02/2008 Kaspersky Anti-Virus database records: 567002 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: C:\ D:\ Scan Statistics: Total number of scanned objects: 52888 Number of viruses found: 8 Number of infected objects: 21 Number of suspicious objects: 0 Duration of the scan process: 01:03:23 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\All Users\Application Data\McAfee\MNA\NAData Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\MPF\data\log.edb Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\MSC\Logs\Events.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\MSC\McUsers.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\VirusScan\Logs\OAS.Log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\QSLLPSVCShare Object is locked skipped C:\Documents and Settings\Emily Salazar\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Emily Salazar\Local Settings\Application Data\Microsoft\Media Player\CurrentDatabase_360.wmdb Object is locked skipped C:\Documents and Settings\Emily Salazar\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Emily Salazar\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Emily Salazar\Local Settings\Application Data\SupportSoft\QUICKCARE\Emily Salazar\state\logs\sprtcmd.log Object is locked skipped C:\Documents and Settings\Emily Salazar\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Emily Salazar\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped C:\Documents and Settings\Emily Salazar\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Emily Salazar\ntuser.dat Object is locked skipped C:\Documents and Settings\Emily Salazar\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Data\master.mdf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Data\mastlog.ldf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Data\model.mdf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Data\modellog.ldf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Data\tempdb.mdf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Data\templog.ldf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\LOG\ERRORLOG Object is locked skipped C:\QooBox\Quarantine\catchme2008-02-09_ 00258.71.zip/classpnpp.sys Infected: Rootkit.Win32.Agent.to skipped C:\QooBox\Quarantine\catchme2008-02-09_ 00258.71.zip ZIP: infected - 1 skipped C:\SDFix\backups\backups.zip/backups/rteprekyc.html Infected: Trojan-Clicker.HTML.IFrame.dn skipped C:\SDFix\backups\backups.zip ZIP: infected - 1 skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP367\A0033151.exe Infected: not-a-virus:AdWare.Win32.Agent.co skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP368\A0033704.exe Infected: Trojan.Win32.Scapur.k skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP368\A0033720.dll Infected: not-a-virus:AdWare.Win32.Agent.acn skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP372\A0034755.exe Infected: not-a-virus:AdWare.Win32.Agent.co skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP374\A0034973.dll Infected: not-a-virus:AdWare.Win32.Agent.acn skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP374\A0034977.dll Infected: not-a-virus:AdWare.Win32.Agent.acn skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP375\A0036021.exe Infected: Trojan.Win32.Scapur.k skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP377\A0036550.dll Infected: not-a-virus:AdWare.Win32.Agent.acn skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP377\A0036559.exe Infected: Trojan.Win32.Scapur.k skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP379\A0036959.dll Infected: not-a-virus:AdWare.Win32.Agent.acn skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP383\A0040335.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP383\A0040336.exe Infected: Trojan-Downloader.Win32.Small.hwg skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP383\A0040337.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP383\A0040340.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP390\A0043365.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP390\A0043366.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP401\change.log Object is locked skipped C:\WINDOWS\cpbrkpie.ocx Infected: not-a-virus:AdWare.Win32.Coupons.h skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\EventCache\{16ECFB36-97FF-4370-9194-A5C3C11CC417}.bin Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\DEFAULT Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SYSTEM Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\Temp\mcafee_YMjWFqw4zMM9tAQ Object is locked skipped C:\WINDOWS\Temp\mcmsc_gSFiwDtYtfv6H6E Object is locked skipped C:\WINDOWS\Temp\mcmsc_NXv8dV8VSgbMI50 Object is locked skipped C:\WINDOWS\Temp\mcmsc_zNtUeuDV5exrNHG Object is locked skipped C:\WINDOWS\Temp\Perflib_Perfdata_c0.dat Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed.

02-15-2008, 02:27 PM	#10 (permalink)
TheBruce1 Moderator, Analyst, Security Team Join Date: Oct 2006 Location: Dùn Èideann,Scotland. Posts: 5,093 OS: XP	Re: Need vundo help please Open HijackThis and click on 'Do a System Scan Only'. Check the following entries (If they still exist, make sure you do not miss any) R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} (cpbrkpie Control) - http://a19.g.akamai.net/7/19/7125/14...2/cpbrkpie.cab *Please remember to close all other windows, including browsers then click Fix checked.* ========== Delete the following Files indicated in RED and Folders indicated in BLUE if they still exist. C:\SDFix You can keep ATF-Cleaner if you wish. ========= Well done,your logs are clean. Click start>run>type(or copy/paste command into run box): ComboFix /u Click ok. ========= Clear IE7 cookies On the Internet Explorer 7 Tools menu, click Internet Options. The Internet Options box should open to the General tab. On the General tab, in the Browsing History, click the Delete button. This will delete all the files that are currently stored in your cache [that includes cookies too]. Click OK, and then click OK again. Clear Firefox cookies/cache* • Select "Tools" • Select "Options". • Select "Privacy". • In "Settings" window put the check mark for Cookies,Cache,Browsing history and any others you want. • Click OK. • In Private area click "Clear Now". ------------------------------------------------------------------------------------------- MICROSOFT UPDATES 1.Click Start,Run, type sysdm.cpl, and then press OK. 2.Click the Automatic Updates tab, and then click to select one of the following options. We recommend that you select the Automatic (recommended). Microsoft updates are released every second Tuesday of each month,what is called "Patch Tuesday". ------------------------------------------------------------------------------------------ Useful Information and Programs to keep you safe. TrendProtect is a FREE browser plug-in that helps you avoid Web pages with unwanted content and hidden threats. TrendProtect rates the current page and pages listed in Google, MSN, and Yahoo search results. You can use the rating to decide if you want to visit or avoid a given Web page. To rate Web pages, TrendProtect refers to an extensive database that covers the following information for billions of Web pages: * Content category * Phishing scam detection * Site reputation * Page reputation WOT Free helps you avoid disingenuous Internet content by allowing you to learn from others' experiences. WOT shows you website reputations on your browser, telling you how much other users trust a website. This helps you make better decisions while browsing and avoid phishing, malware, and other types of fraud. Reputations can also be added to web search results, Gmail, Wikipedia, and other selected sites. WOT reputations are computed mainly from user testimonies. Sharing your knowledge with others is just a click away, without ever having to leave the site. We also collect data from hundreds of other sources (including PhishTank) to quickly warn you of emerging threats. Currently, WOT knows over 12 million websites. Note:Only compatible with Firefox 1.5 and higher. Only install one of the above -------------------------------------------------------------------------------------- Alternate Browsers Try the following free alternate browsers rather than Internet Explorer Avant Firefox Opera K-Meleon ------------------------------------------------------------------------------------------ Free Antispyware Products SuperAntiSpyware AVG Antispyware Free Ad-Aware Spybot S&D Download SpywareBlaster 3.5.1 to help prevent spyware from installing in the first place. Install & update SpywareBlaster with the latest definitions. After you have updated, click the button - enable protection for all unprotected items. Download Spyware Guard to catch and block spyware before it can execute. ------------------------------------------------------------------ IE-Spyad™ is a freeware utility that places more than 4000 dubious websites and domains in the Internet Explorer Restricted List. Download and installation instructions for IE-Spyad™ Here ----------------------------------------- The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer. Note that if you use a company provided HOSTS file you should not use the MVPS HOSTS file. If your having trouble downloading & extracting,see link below for guidance: http://www.mvps.org/winhelp2002/hosts2.htm Once you have extracted the host file,double click on it and a new window will open. Double-click on mvps.batand follow the prompts --------------------------------------------------------------- Winpatrol - Download and install the free version of Winpatrol. A tutorial for this product is located here: Using Winpatrol to protect your computer. ---------------------------------------- SnoopFree is a programme that informs you when another programme is wanting to log your keystrokes or read your screen.Only for XP users. Update all these programs regularly. Without regular updates you will not be protected when new malicious programs are released. ============================================== Also, please take a look at these well written articles: PC Safety and Security--What Do I Need? HOW DID I GET INFECTED IN THE FIRST PLACE? by Tony Klein THE ANTI-SPYWARE TUTORIAL MAKING INTERNET EXPLORER SAFER Understanding and Using Firewalls Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them. Please reply to this thread once more,as we may mark this as resolved,thanks. __________________ Member of ASAP since 2007 Member of UNITE since 2008 Notice to BT customers BT to dump Phorm, see Here for more information. No DPI If we have helped you in anyway, please consider Donating** Last edited by TheBruce1; 02-15-2008 at 02:28 PM.

02-15-2008, 03:41 PM	#11 (permalink)
aeisenbaum Registered User Join Date: Feb 2008 Posts: 17 OS: xp sp2	Re: Need vundo help please I still have three issues: 1. In My Computer the C drive icon is still a Red X. 2. In My Documents folder it is filled with tons of POS TMP files (some are copy of copies many times over). Previously when I would try and delete them they would not go away, and make copies of themselves. I didn't want to try and delete them this time for fear of reinfecting (w/out checking with you first). 3. In IE7 I can not access Internet Options. When I click on Internet Options in Tools menu a very brief small box appears and disappears almost instantaneously. So in turn I can not delete my Browsing History. In the address bar drop down I still have my history from before you helped me. Hopefully we can address these issues. Your help is certainly appreciated. Thank you!

02-15-2008, 03:44 PM	#12 (permalink)
aeisenbaum Registered User Join Date: Feb 2008 Posts: 17 OS: xp sp2	Re: Need vundo help please Regarding my previous message. On my desktop, when I right click the IE7 icon and select Properties...Nothing happens. Thanks again for your continued assistance.

02-15-2008, 04:26 PM	#13 (permalink)
TheBruce1 Moderator, Analyst, Security Team Join Date: Oct 2006 Location: Dùn Èideann,Scotland. Posts: 5,093 OS: XP	Re: Need vundo help please Combofix should have taken care of those pos temp file, delete your current version of Combofix if you have not done so already and download the updated version below. =========== Download Combofix from any of the links below, and save it to your desktop. Link 1 Link 2 Link 3 Note: It is important that it is saved directly to your desktop Double click on ComboFix.exe & follow the prompts. When finished, it will produce a report for you. Please post the C:\ComboFix.txt along with a new HijackThis log so we can continue cleaning the system. Note: Do not mouseclick combofix's window while it's running. That may cause it to stall ============= Logs Required C:\Combofix.txt Hijackthis Log __________________ Member of ASAP since 2007 Member of UNITE since 2008 Notice to BT customers BT to dump Phorm, see Here for more information. No DPI If we have helped you in anyway, please consider Donating

02-16-2008, 07:53 PM	#14 (permalink)
aeisenbaum Registered User Join Date: Feb 2008 Posts: 17 OS: xp sp2	Re: Need vundo help please Sorry for the delay in my response. The logs are as follows: ComboFix 08-02-17.2 - Emily Salazar 2008-02-16 19:37:37.8 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.204 [GMT -7:00] Running from: C:\Documents and Settings\Emily Salazar\Desktop\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((( Files Created from 2008-01-17 to 2008-02-17 ))))))))))))))))))))))))))))))) . 2008-02-14 13:16 . 2008-02-14 13:16 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab 2008-02-14 13:16 . 2008-02-14 13:16 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab 2008-02-13 19:21 . 2008-02-13 19:30 <DIR> d-------- C:\WINDOWS\system32\ActiveScan 2008-02-13 19:21 . 2008-02-13 20:34 30,590 --a------ C:\WINDOWS\system32\pavas.ico 2008-02-13 17:49 . 2008-02-13 17:49 <DIR> d-------- C:\Program Files\Common Files\Java 2008-02-13 17:49 . 2007-12-14 01:59 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-02-12 13:01 . 2008-02-12 13:01 <DIR> d-------- C:\WINDOWS\ERUNT 2008-02-09 02:04 . 2008-02-13 20:34 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico 2008-02-09 02:04 . 2008-02-13 20:34 1,406 --a------ C:\WINDOWS\system32\Help.ico 2008-02-09 01:08 . 2008-02-09 01:08 <DIR> d-------- C:\Program Files\Trend Micro 2008-02-08 17:15 . 2008-02-16 19:36 4,350 --a------ C:\WINDOWS\system32\Config.MPF 2008-02-08 17:12 . 2006-03-03 11:07 143,360 --a------ C:\WINDOWS\system32\dunzip32.dll 2008-02-08 17:10 . 2007-06-25 10:57 37,480 --a------ C:\WINDOWS\system32\drivers\mfesmfk.sys 2008-02-08 17:10 . 2007-06-25 10:57 32,008 --a------ C:\WINDOWS\system32\drivers\mferkdk.sys 2008-02-08 17:09 . 2007-06-25 10:57 171,240 --a------ C:\WINDOWS\system32\drivers\mfehidk.sys 2008-02-08 17:09 . 2007-03-02 14:16 109,608 --a------ C:\WINDOWS\system32\drivers\Mpfp.sys 2008-02-08 17:09 . 2007-06-25 14:54 71,496 --a------ C:\WINDOWS\system32\drivers\mfeavfk.sys 2008-02-08 17:09 . 2007-06-25 10:57 34,184 --a------ C:\WINDOWS\system32\drivers\mfebopk.sys 2008-02-08 17:08 . 2008-02-08 17:09 <DIR> d-------- C:\Program Files\McAfee.com 2008-02-06 22:26 . 2008-02-06 22:35 <DIR> d-------- C:\Program Files\Windows Live Safety Center 2008-02-06 02:52 . 2008-02-16 19:29 <DIR> d-------- C:\Documents and Settings\Emily Salazar\Application Data\SiteAdvisor 2008-02-06 02:52 . 2008-02-06 02:52 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SiteAdvisor 2008-02-06 01:59 . 2006-11-07 21:01 66,048 --a------ C:\WINDOWS\ieResetIcons.exe 2008-02-05 23:31 . 2008-02-05 23:31 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Trend Micro 2008-02-05 21:09 . 2008-02-05 21:09 164 --a------ C:\install.dat 2008-01-30 23:42 . 2008-02-05 23:02 <DIR> d-------- C:\Documents and Settings\Emily Salazar\Application Data\McAfee 2008-01-30 22:50 . 2008-01-30 22:50 <DIR> d-------- C:\Documents and Settings\Emily Salazar\Application Data\Talkback 2008-01-30 11:27 . 2008-02-08 17:13 <DIR> d-------- C:\Program Files\McAfee 2008-01-30 11:27 . 2008-02-08 17:12 <DIR> d-------- C:\Program Files\Common Files\McAfee 2008-01-30 10:47 . 2008-02-08 17:11 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\McAfee . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-02-14 00:49 --------- d-----w C:\Program Files\Java 2008-02-07 10:05 --------- d-----w C:\Program Files\Dell 2008-02-07 10:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\GTek 2008-02-07 09:57 --------- d-----w C:\Documents and Settings\All Users\Application Data\SupportSoft 2008-02-07 09:55 --------- d-----w C:\Program Files\Common Files\supportsoft 2008-02-07 00:20 --------- d-----w C:\Program Files\Google 2008-01-31 06:33 --------- d-----w C:\Documents and Settings\Emily Salazar\Application Data\Move Networks 2008-01-29 21:51 --------- d-----w C:\Program Files\Dl_cats 2008-01-28 21:44 --------- d-----w C:\Documents and Settings\Emily Salazar\Application Data\AdobeUM 2008-01-11 05:53 44,544 ------w C:\WINDOWS\system32\dllcache\pngfilt.dll 2008-01-08 17:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Dell 2007-12-19 23:01 347,136 ------w C:\WINDOWS\system32\dllcache\dxtmsft.dll 2007-12-18 09:51 179,584 ----a-w C:\WINDOWS\system32\drivers\mrxdav.sys 2007-12-18 09:51 179,584 ------w C:\WINDOWS\system32\dllcache\mrxdav.sys 2007-12-08 05:21 3,592,192 ------w C:\WINDOWS\system32\dllcache\mshtml.dll 2007-12-06 11:01 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe 2007-12-06 11:00 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe 2007-12-06 11:00 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe 2007-12-06 04:59 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll 2007-12-04 18:38 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll 2007-12-04 18:38 550,912 ------w C:\WINDOWS\system32\dllcache\oleaut32.dll 2005-10-20 03:30 56 --sh--r C:\WINDOWS\system32\9CD1F59E4F.sys 2005-10-20 03:30 1,890 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:00 15360] "DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [ ] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Apoint"="C:\Program Files\Apoint\Apoint.exe" [2004-09-13 14:33 155648] "PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2004-04-11 18:15 290816] "Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2005-03-04 09:26 606208] "DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 14:19 53248] "RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2005-10-13 08:12 26112] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 10:54 282624] "ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 14:50 221184] "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 14:50 81920] "dlccmon.exe"="C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe" [2005-07-22 12:03 425984] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-03-02 15:24 257088] "QUICKCARE"="C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe" [2006-11-07 20:07 192512] "SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 09:22 155648] "PaperPort PTD"="C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe" [2004-04-14 13:46 57393] "IndexSearch"="C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe" [2004-04-14 14:04 40960] "SetDefPrt"="C:\Program Files\Brother\Brmfl04g\BrStDvPt.exe" [2004-11-11 16:14 49152] "ControlCenter2.0"="C:\Program Files\Brother\ControlCenter2\brctrcen.exe" [2005-01-07 16:30 864256] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe" [2007-12-14 03:42 144784] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [ ] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2005-10-13 08:05:39 24576] QuickBooks Update Agent.lnk - C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2005-11-15 03:31:34 806912] S3 BrScnUsb;Brother USB Still Image driver;C:\WINDOWS\system32\Drivers\BrScnUsb.sys [2004-10-15 11:50] S3 MSControlService;Microsoft cache control;C:\WINDOWS\system32\windows [] . Contents of the 'Scheduled Tasks' folder "2007-03-06 04:28:39 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2008-02-09 00:09:20 C:\WINDOWS\Tasks\McDefragTask.job" - c:\PROGRA~1\mcafee\mqc\QcConsol.exe' "2008-02-09 00:09:18 C:\WINDOWS\Tasks\McQcTask.job" - c:\PROGRA~1\mcafee\mqc\QcConsol.exe . ************************************************************************ catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-02-16 19:40:07 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************ . Completion time: 2008-02-16 19:40:59 ComboFix2.txt 2008-02-15 20:59:23 . 2008-02-12 19:39:44 --- E O F --- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 7:43:01 PM, on 2/16/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16608) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\wltrysvc.exe C:\WINDOWS\System32\bcmwltry.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe C:\PROGRA~1\McAfee\MSC\mcpromgr.exe c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\McAfee\MPF\MPFSrv.exe C:\PROGRA~1\McAfee\MPS\mps.exe C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\McAfee\MPS\mpsevh.exe c:\PROGRA~1\mcafee.com\agent\mcagent.exe C:\Program Files\Apoint\Apoint.exe C:\Program Files\Dell\Media Experience\PCMService.exe C:\Program Files\Dell\QuickSet\quickset.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\Program Files\Real\RealPlayer\RealPlay.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe C:\Program Files\Apoint\Apntex.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\dlcccoms.exe c:\PROGRA~1\mcafee\msc\mcuimgr.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptcl.dll O4 - HKLM\..\Run: [Apoint] "C:\Program Files\Apoint\Apoint.exe" O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe" O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" O4 - HKLM\..\Run: [RealTray] "C:\Program Files\Real\RealPlayer\RealPlay.exe" SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [ISUSPM Startup] "C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [dlccmon.exe] "C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe" O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QUICKCARE] "C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe" /P QUICKCARE O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot O4 - HKLM\..\Run: [PaperPort PTD] "C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe" O4 - HKLM\..\Run: [IndexSearch] "C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe" O4 - HKLM\..\Run: [SetDefPrt] "C:\Program Files\Brother\Brmfl04g\BrStDvPt.exe" O4 - HKLM\..\Run: [ControlCenter2.0] "C:\Program Files\Brother\ControlCenter2\brctrcen.exe" /autorun O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter O4 - HKUS\S-1-5-18\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Default user') O4 - Global Startup: Digital Line Detect.lnk = ? O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/pr02...s/MSNPUpld.cab O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/res...lscbase370.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O23 - Service: dlcc_device - Unknown owner - C:\WINDOWS\system32\dlcccoms.exe O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe O23 - Service: Microsoft cache control (MSControlService) - Unknown owner - C:\WINDOWS\system32\windows (file missing) O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe -- End of file - 7897 bytes

02-17-2008, 11:08 PM	#16 (permalink)
aeisenbaum Registered User Join Date: Feb 2008 Posts: 17 OS: xp sp2	Re: Need vundo help please The exact location of the pos TMP files are: C:\Documents and Settings\Emily Salazar\My Documents. ESET Online Scanner would not let me right click to copy the scan details but they are as follows: Files Scanned: 245353 (seems like way too many files probably all those pos TMP files) Threats Found: 1 Total Scan Time: 01:08:09 Scan Status: Finished Details Tab of ESET Online Scanner: "Probably a variant of JS/TrojanDownloader.Agent.NBQ trojan" C:\Documents and Settings\Emily Salazar\Local Settings\Application Data\Mozilla\Firefox\Profiles\1udcqudp.default\Cache\E43CDD90d01 Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:50:51 PM, on 2/17/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16608) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\wltrysvc.exe C:\WINDOWS\System32\bcmwltry.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe C:\PROGRA~1\McAfee\MSC\mcpromgr.exe c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\McAfee\MPF\MPFSrv.exe C:\PROGRA~1\McAfee\MPS\mps.exe C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE c:\PROGRA~1\mcafee.com\agent\mcagent.exe C:\Program Files\McAfee\MPS\mpsevh.exe C:\Program Files\Apoint\Apoint.exe C:\Program Files\Dell\Media Experience\PCMService.exe C:\Program Files\Dell\QuickSet\quickset.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\Program Files\Real\RealPlayer\RealPlay.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Apoint\Apntex.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\dlcccoms.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptcl.dll O4 - HKLM\..\Run: [Apoint] "C:\Program Files\Apoint\Apoint.exe" O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe" O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" O4 - HKLM\..\Run: [RealTray] "C:\Program Files\Real\RealPlayer\RealPlay.exe" SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [ISUSPM Startup] "C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [dlccmon.exe] "C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe" O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QUICKCARE] "C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe" /P QUICKCARE O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot O4 - HKLM\..\Run: [PaperPort PTD] "C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe" O4 - HKLM\..\Run: [IndexSearch] "C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe" O4 - HKLM\..\Run: [SetDefPrt] "C:\Program Files\Brother\Brmfl04g\BrStDvPt.exe" O4 - HKLM\..\Run: [ControlCenter2.0] "C:\Program Files\Brother\ControlCenter2\brctrcen.exe" /autorun O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter O4 - HKUS\S-1-5-18\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Default user') O4 - Global Startup: Digital Line Detect.lnk = ? O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/pr02...s/MSNPUpld.cab O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/res...lscbase370.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O23 - Service: dlcc_device - Unknown owner - C:\WINDOWS\system32\dlcccoms.exe O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe O23 - Service: Microsoft cache control (MSControlService) - Unknown owner - C:\WINDOWS\system32\windows (file missing) O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe -- End of file - 7996 bytes