need help with a spyware!!

[cmiddl01]

I was just surfing the web the other day. and bam a windows system message came up saying that my system is infected with a spyware and its making copys of stuff. so i ran trend micros antivirus but hasnt quite fixed it. every now and then i dte a microsoft vizual c++ runtime error pop up.

it also trys to install anti spyware. well here is my log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:17:13 AM, on 2/9/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Ideazon\ZEngine\Zboard.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSI\Core Center\CoreCenter.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\DllHost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\Internet Security\UfUpdUi.exe
C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe
C:\Program Files\Trend Micro\BM\TMBMSRV.exe
C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
C:\Program Files\Trend Micro\Internet Security\UfNavi.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [Ptipbmf] "rundll32.exe" ptipbmf.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Zboard] "C:\Program Files\Ideazon\ZEngine\Zboard.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [MSDrive] rundll32.exe C:\WINDOWS\system32\drvjew.dll,startup
O4 - HKLM\..\Run: [MSDisp32] rundll32.exe C:\WINDOWS\system32\drvtuk.dll,startup
O4 - HKLM\..\Run: [34e86dc6] rundll32.exe "C:\WINDOWS\system32\enmmkuus.dll",b
O4 - HKLM\..\Run: [UfSeAgnt.exe] "C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AdwareAlert] C:\Program Files\AdwareAlert\AdwareAlert.exe -boot
O4 - Startup: .protected
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: .protected
O4 - Global Startup: CoreCenter.lnk = C:\Program Files\MSI\Core Center\CoreCenter.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/...x/qtplugin.cab
O16 - DPF: {106E49CF-797A-11D2-81A2-00E02C015623} (AlternaTIFF ActiveX) - http://www.alternatiff.com/install/00/alttiff.cab
O16 - DPF: {64D01C7F-810D-446E-A07E-16C764235644} (AtlAtomadersCtlAttrib Class) - http://zone.msn.com/bingame/amad/default/atomaders.cab
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://zone.msn.com/bingame/amun/def...jolauncher.cab
O16 - DPF: {B7D07999-2ADB-4AEB-997E-F61CB7B2E2CD} (TSEasyInstallX Control) - http://www.trendsecure.com/easy_inst...syInstallX.CAB
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramewor...o.cab56649.cab
O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} (TikGames Online Control) - http://zone.msn.com/bingame/cnma/default/ct.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/popcaploader_v10.cab
O21 - SSODL: DrvKbd - {38f3dfd0-35c4-4fee-b530-b9ed989526e7} - C:\WINDOWS\Installer\{38f3dfd0-35c4-4fee-b530-b9ed989526e7}\DrvKbd.dll
O21 - SSODL: zip - {2f4c9115-57ce-47d4-92e4-fc64f9a17f09} - C:\WINDOWS\Installer\{2f4c9115-57ce-47d4-92e4-fc64f9a17f09}\zip.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Trend Micro Central Control Component (SfCtlCom) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
O23 - Service: Trend Micro Unauthorized Change Prevention Service (TMBMServer) - Trend Micro Inc. - C:\Program Files\Trend Micro\BM\TMBMSRV.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\TmProxy.exe

--
End of file - 7622 bytes


any help would be the best

[TheBruce1]

Hello and welcome to TSF


Apologises for the delay getting to your log. The helpers here are all volunteers and we have been very busy lately. If you are still having malware problems, follow instructions below.

============


Download Deckard's System Scanner (DSS) to your Desktop. Note: You must be logged onto an account with administrator privileges.

1. Close all applications and windows.
2. Double-click on dss.exe to run it, and follow the prompts.
3. When the scan is complete, two text files will open - main.txt <- this one will be maximized and extra.txt <-this one will be minimized
4. Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of main.txt here.
5. Please attach extra.txt to your post.

To attach a file to a new post, simply

1. Click the[Manage Attachments] button under Additional Options > Attach Files on the post composition page, and
2. copy and paste the following into the "Upload File from your Computer" box:

   C:\Deckard\System Scanner\extra.txt
   

3. Click Upload.

What DSS will do:

• create a new System Restore point in Windows XP and Vista.
• clean your Temporary Files, Downloaded Program Files, and Internet Cache Files, and also empty the Recycle Bin on all drives.
• check some important areas of your system and produce a report for your analyst to review. DSS automatically runs HijackThis for you, but it will also install and place a shortcut to HijackThis on your desktop if you do not already have HijackThis installed.

============
Logs Required
C:\Deckard\System Scanner\main.txt
C:\Deckard\System Scanner\extra.txt<---Attached

[cmiddl01]

sorry for taking so long here you go

I have tried to complete as much of the 5 step program that i could.

step1) nothing was in my add/remove programs listed in the post!

Step 2) panda scan it got to one spyware detection then froze did this 3 times and same thing. so i have no report from it.

Step3) spyware blaster kept getting a loop for the download so couldn't download the actual program.
IE-Spyad. got the program but couldnt find the txt file to upload.

Step4)I have all the updates


Step5) here is the main.txt the extra will be attached.
Deckard's System Scanner v20071014.68
Run by Chris on 2008-02-10 09:35:07
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.


-- Last 5 Restore Point(s) --
70: 2008-02-10 14:35:12 UTC - RP75 - Deckard's System Scanner Restore Point
69: 2008-02-10 04:52:36 UTC - RP74 - Restore Operation
68: 2008-02-09 19:45:42 UTC - RP73 - Installed Ventrilo Client
67: 2008-02-09 19:10:20 UTC - RP72 - Removed Trend Micro Internet Security
66: 2008-02-09 19:07:26 UTC - RP71 - Removed AdwareAlert


-- First Restore Point --
1: 2008-02-09 04:13:16 UTC - RP6 - System Checkpoint


Backed up registry hives.
Performed disk cleanup.



-- HijackThis (run as Chris.exe) -----------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:36:23 AM, on 2/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Ideazon\ZEngine\Zboard.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSI\Core Center\CoreCenter.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\DllHost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Chris\Desktop\programs\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Chris.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {3664B307-3EF1-4370-A334-B865D6C4F132} - C:\WINDOWS\system32\jkhfd.dll
O2 - BHO: (no name) - {42A44A09-3A1E-4BA2-B14C-D8398E0C3317} - C:\WINDOWS\system32\efccbyv.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {A95B2816-1D7E-4561-A202-68C0DE02353A} - C:\WINDOWS\system32\vrypizyy.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.1121.2472\swg.dll
O2 - BHO: {10c03ae3-a041-2cb9-f174-f41fed4ec82e} - {e28ce4de-f14f-471f-9bc2-140a3ea30c01} - C:\WINDOWS\system32\phrbxkie.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [Ptipbmf] "rundll32.exe" ptipbmf.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Zboard] "C:\Program Files\Ideazon\ZEngine\Zboard.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [MSDrive] rundll32.exe C:\WINDOWS\system32\drvjew.dll,startup
O4 - HKLM\..\Run: [MSDisp32] rundll32.exe C:\WINDOWS\system32\drvtuk.dll,startup
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [34e86dc6] rundll32.exe "C:\WINDOWS\system32\qeigkbyd.dll",b
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: CoreCenter.lnk = C:\Program Files\MSI\Core Center\CoreCenter.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/...x/qtplugin.cab
O16 - DPF: {106E49CF-797A-11D2-81A2-00E02C015623} (AlternaTIFF ActiveX) - http://www.alternatiff.com/install/00/alttiff.cab
O16 - DPF: {64D01C7F-810D-446E-A07E-16C764235644} (AtlAtomadersCtlAttrib Class) - http://zone.msn.com/bingame/amad/default/atomaders.cab
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://zone.msn.com/bingame/amun/def...jolauncher.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {B7D07999-2ADB-4AEB-997E-F61CB7B2E2CD} (TSEasyInstallX Control) - http://www.trendsecure.com/easy_inst...syInstallX.CAB
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramewor...o.cab56649.cab
O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} (TikGames Online Control) - http://zone.msn.com/bingame/cnma/default/ct.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/popcaploader_v10.cab
O20 - Winlogon Notify: efccbyv - C:\WINDOWS\SYSTEM32\efccbyv.dll
O20 - Winlogon Notify: vrypizyy - C:\WINDOWS\SYSTEM32\vrypizyy.dll
O20 - Winlogon Notify: winjyg32 - C:\WINDOWS\SYSTEM32\winjyg32.dll
O21 - SSODL: DrvKbd - {38f3dfd0-35c4-4fee-b530-b9ed989526e7} - C:\WINDOWS\Installer\{38f3dfd0-35c4-4fee-b530-b9ed989526e7}\DrvKbd.dll
O21 - SSODL: zip - {2f4c9115-57ce-47d4-92e4-fc64f9a17f09} - C:\WINDOWS\Installer\{2f4c9115-57ce-47d4-92e4-fc64f9a17f09}\zip.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 7621 bytes

-- File Associations -----------------------------------------------------------

All associations okay.


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R1 NPPTNT2 - c:\windows\system32\npptnt2.sys <Not Verified; INCA Internet Co., Ltd.; nProtect NPSC Kernel Mode Driver for NT>
R3 PCAlertDriver - c:\program files\msi\core center\ntglm7x.sys <Not Verified; MICRO-STAR INT'L CO., LTD.; NTGLM7X driver>
R3 RushTopDevice - c:\program files\msi\core center\rushtop.sys <Not Verified; Vireo Software; Driver::Works>

S3 GMSIPCI - d:\install\gmsipci.sys (file missing)
S3 moufiltr (Mouse Filter Driver) - c:\windows\system32\drivers\moufiltr.sys <Not Verified; Chic Tech.; Chic Tech.>
S3 SDTHOOK - c:\windows\system32\drivers\sdthook.sys <Not Verified; Panda Software; Panda® Antivirus>


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

S2 CLTNetCnService (Symantec Lic NetConnect service) - "c:\program files\common files\symantec shared\ccsvchst.exe" /h cccommon (file missing)


-- Device Manager: Disabled ----------------------------------------------------

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: 1394 Net Adapter
Device ID: V1394\NIC1394\3D469510DC00
Manufacturer: Microsoft
Name: 1394 Net Adapter
PNP Device ID: V1394\NIC1394\3D469510DC00
Service: NIC1394

Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description: RAID Controller
Device ID: PCI\VEN_1106&DEV_3149&SUBSYS_70201462&REV_80\3&61AAA01&0&78
Manufacturer:
Name: RAID Controller
PNP Device ID: PCI\VEN_1106&DEV_3149&SUBSYS_70201462&REV_80\3&61AAA01&0&78
Service:


-- Scheduled Tasks -------------------------------------------------------------

2008-02-09 12:55:16 496 --a------ C:\WINDOWS\Tasks\AdwareAlert Scheduled Scan.job


-- Files created between 2008-01-10 and 2008-02-10 -----------------------------

2099-03-03 11:58:07 0 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Windows Genuine Advantage
2099-03-01 16:16:25 36864 --a------ C:\WINDOWS\system32\CNMCP45.EXE
2099-03-01 16:16:24 0 d--h----- C:\BJPrinter
2008-02-10 08:42:56 44928 --a------ C:\WINDOWS\system32\drivers\SDTHOOK.SYS <Not Verified; Panda Software; Panda® Antivirus>
2008-02-10 08:17:35 8576 --a------ C:\WINDOWS\system32\drivers\dbgjjsigxjjp.sys <Not Verified; Panda Software International; RKPavProc Driver>
2008-02-10 08:15:17 8576 --a------ C:\WINDOWS\system32\drivers\RkPavProc.sys <Not Verified; Panda Software International; RKPavProc Driver>
2008-02-10 07:46:24 0 d-------- C:\WINDOWS\system32\ActiveScan
2008-02-09 23:58:39 98709 --a------ C:\Program Files\udefender_setup.exe
2008-02-09 23:58:39 0 d-------- C:\Program Files\SystemDefender
2008-02-09 23:53:34 12288 --a------ C:\Program Files\tmp202453.exe <Not Verified; Search2find LLC; Search2find>
2008-02-09 23:53:34 10240 --a------ C:\Program Files\tmp202218.exe <Not Verified; NoName Corp.; NNC module>
2008-02-09 23:48:51 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-02-09 23:19:03 89664 --a------ C:\WINDOWS\system32\qeigkbyd.dll
2008-02-09 23:16:04 93760 --a------ C:\WINDOWS\system32\phrbxkie.dll
2008-02-09 22:01:36 7168 --a------ C:\WINDOWS\system32\windows
2008-02-09 14:45:42 0 d-------- C:\Program Files\Ventrilo
2008-02-09 12:44:49 2988 --a------ C:\WINDOWS\system32\tmp.reg
2008-02-09 12:18:20 0 d-------- C:\Documents and Settings\Chris\Application Data\Grisoft
2008-02-09 12:18:02 0 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Grisoft
2008-02-09 02:55:39 116 --a------ C:\tempdel.bat
2008-02-09 02:55:31 26624 --a------ C:\WINDOWS\system32\urqrrrr.dll
2008-02-08 23:36:22 0 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Trend Micro
2008-02-08 23:22:04 88640 -----n--- C:\WINDOWS\system32\enmmkuus.dll
2008-02-08 23:20:53 0 d-------- C:\Program Files\Trend Micro
2008-02-08 23:19:05 163904 --a------ C:\WINDOWS\system32\vrypizyy.dll
2008-02-08 23:19:05 163904 --a------ C:\WINDOWS\system32\mglixljw.dll
2008-02-08 23:16:05 94784 --a------ C:\WINDOWS\system32\irontkln.dll
2008-02-08 22:53:18 298811 --ahs---- C:\WINDOWS\system32\dfhkj.ini2
2008-02-08 22:53:14 338432 --a------ C:\WINDOWS\system32\jkhfd.dll
2008-02-08 22:48:43 12288 --a------ C:\Program Files\tmp19914406.exe <Not Verified; Search2find LLC; Search2find>
2008-02-08 22:48:40 10240 --a------ C:\Program Files\tmp19911781.exe <Not Verified; NoName Corp.; NNC module>
2008-02-08 22:48:38 16896 --a------ C:\WINDOWS\system32\drvtuk.dll
2008-02-08 22:48:36 15360 --a------ C:\WINDOWS\system32\drvjewr.dll
2008-02-08 22:48:27 26624 --a------ C:\WINDOWS\system32\fccbyaw.dll
2008-02-08 22:48:25 23552 --a------ C:\WINDOWS\system32\winjyg32.dll
2008-02-08 22:48:10 45056 --a------ C:\WINDOWS\system32\efccbyv.dll
2008-02-08 22:46:46 0 d-------- C:\Documents and Settings\Chris\Application Data\WinRAR


-- Find3M Report ---------------------------------------------------------------

2008-02-10 08:29:07 0 d-------- C:\Program Files\QuickTime
2008-02-10 08:23:50 0 d-------- C:\Program Files\Common Files\LightScribe
2008-02-10 08:21:24 0 d-------- C:\Program Files\Google
2008-02-09 23:48:21 0 d-------- C:\Program Files\MobMapUpdater
2008-02-09 14:45:26 0 d-------- C:\Program Files\Common Files
2008-02-08 17:25:27 0 d-------- C:\Program Files\Real
2008-02-08 17:25:03 0 d-------- C:\Program Files\Outspark
2008-01-26 13:26:09 0 d-------- C:\Program Files\World of Warcraft
2007-12-21 13:39:25 0 d-------- C:\Program Files\AddOn Studio for World of Warcraft
2007-12-21 06:49:27 0 d-------- C:\Program Files\Microsoft Visual Studio 9.0
2007-12-21 06:47:47 0 d-------- C:\Program Files\Microsoft SDKs
2007-12-21 06:47:43 0 d-------- C:\Program Files\Common Files\Merge Modules
2007-12-21 06:47:05 0 d-------- C:\Program Files\MSBuild
2007-12-21 06:46:59 0 d-------- C:\Program Files\Reference Assemblies
2007-12-21 06:45:09 0 d-------- C:\Program Files\MSXML 6.0
2007-12-20 21:15:06 0 d-------- C:\Program Files\Winamp
2007-12-14 19:51:10 0 d--hs--c- C:\Program Files\Common Files\WindowsLiveInstaller
2007-12-14 19:48:03 0 d-------- C:\Program Files\Windows Live
2007-12-12 16:47:08 0 d-------- C:\Program Files\TSO


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3664B307-3EF1-4370-A334-B865D6C4F132}]
02/08/2008 10:53 PM 338432 --a------ C:\WINDOWS\system32\jkhfd.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{42A44A09-3A1E-4BA2-B14C-D8398E0C3317}]
02/08/2008 10:48 PM 45056 --a------ C:\WINDOWS\system32\efccbyv.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A95B2816-1D7E-4561-A202-68C0DE02353A}]
02/08/2008 11:19 PM 163904 --a------ C:\WINDOWS\system32\vrypizyy.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e28ce4de-f14f-471f-9bc2-140a3ea30c01}]
02/09/2008 11:16 PM 93760 --a------ C:\WINDOWS\system32\phrbxkie.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Ptipbmf"="rundll32.exe" [08/04/2004 07:00 AM C:\WINDOWS\system32\rundll32.exe]
"SoundMan"="SOUNDMAN.EXE" [08/15/2003 02:34 AM C:\WINDOWS\SOUNDMAN.EXE]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [10/04/2007 05:14 PM]
"nwiz"="nwiz.exe" [10/04/2007 05:14 PM C:\WINDOWS\system32\nwiz.exe]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [07/09/2001 11:50 AM]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [11/23/2006 06:28 PM]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [09/25/2007 12:11 AM]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [04/30/2007 06:40 PM]
"Zboard"="C:\Program Files\Ideazon\ZEngine\Zboard.exe" [09/24/2007 04:57 PM]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [10/04/2007 05:14 PM]
"MSDrive"="C:\WINDOWS\system32\drvjew.dll" []
"MSDisp32"="C:\WINDOWS\system32\drvtuk.dll" [02/08/2008 10:48 PM]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [06/11/2007 04:25 AM]
"34e86dc6"="C:\WINDOWS\system32\qeigkbyd.dll" [02/09/2008 11:19 PM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [06/18/2007 06:38 PM]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 07:00 AM]

C:\Documents and Settings\Chris\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [3/16/2005 6:16:50 PM]

C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\
CoreCenter.lnk - C:\Program Files\MSI\Core Center\CoreCenter.exe [2/18/2005 12:25:37 AM]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{42A44A09-3A1E-4BA2-B14C-D8398E0C3317}"= C:\WINDOWS\system32\efccbyv.dll [02/08/2008 10:48 PM 45056]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"DrvKbd"= {38f3dfd0-35c4-4fee-b530-b9ed989526e7} - C:\WINDOWS\Installer\{38f3dfd0-35c4-4fee-b530-b9ed989526e7}\DrvKbd.dll [02/08/2008 10:48 PM 14374]
"zip"= {2f4c9115-57ce-47d4-92e4-fc64f9a17f09} - C:\WINDOWS\Installer\{2f4c9115-57ce-47d4-92e4-fc64f9a17f09}\zip.dll [02/08/2008 10:48 PM 39462]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\efccbyv]
efccbyv.dll 02/08/2008 10:48 PM 45056 C:\WINDOWS\system32\efccbyv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\vrypizyy]
vrypizyy.dll 02/08/2008 11:19 PM 163904 C:\WINDOWS\system32\vrypizyy.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winjyg32]
winjyg32.dll 02/08/2008 10:48 PM 23552 C:\WINDOWS\system32\winjyg32.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\jkhfd.dll




-- Hosts -----------------------------------------------------------------------

10.18.250.4 ad.doubleclick.net
10.18.250.4 ad.fastclick.net
10.18.250.4 ads.fastclick.net
10.18.250.4 ar.atwola.com
10.18.250.4 atdmt.com
10.18.250.4 avp.ch
10.18.250.4 avp.com
10.18.250.4 avp.ru
10.18.250.4 awaps.net
10.18.250.4 banner.fastclick.net

79 more entries in hosts file.


-- End of Deckard's System Scanner: finished at 2008-02-10 09:37:36 ------------

[TheBruce1]

Hello again

In your next post could you attach the extra.txt from Deckard System Scanner.

========

Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe.

=========

Please follow all instructions and in which order they come, if you have any questions, please ask before proceeding. Its important that you follow this through until i give you the all clear, a lack of symptoms does not mean that it is no longer present.

==========

Please print out or copy this page to Notepad in order to assist you when carrying out the following instructions.

==========

Download SDFix and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:SDFix)

Please then reboot your computer in Safe Mode by doing the following :

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
• Instead of Windows loading as normal, the Advanced Options Menu should appear;
• Select the first option, to run Windows in Safe Mode, then press Enter.
• Choose your usual account.

• Open the extracted SDFix folder and double click RunThis.bat to start the script.
• Type Y to begin the cleanup process.
• It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
• Press any Key and it will restart the PC.
• When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
• Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
  (Report.txt will also be copied to Clipboard ready for posting back on the forum).
• Finally paste the contents of the Report.txt back on the forum with all the required logs

=========

Please visit this webpage for download links, and instructions for running the tool: http://www.bleepingcomputer.com/comb...o-use-combofix

• When the tool is finished, it will produce a report for you.
• Please post the C:\ComboFix.txt along with a new HijackThis log so we may continue cleaning the system.

=========

Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here.

==========
Logs Required
Report.txt(from SDFix)
C:\Combofix.txt
Hijackthis Log
C:\Deckard\System Scanner\extra.txt<---Attached

[cmiddl01]

I did this:
# Restart your computer
# After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
# Instead of Windows loading as normal, the Advanced Options Menu should appear;

and the menu wouldn't come up i did it 10 times to see if i was just being retarted. had a friend come over that is a little more techy then I. He got the menu up but it wouldnt let him chose a option the timer would just count down then go into normal mode for windows.

I attached the extra file on my last post but i will attach it agian on this one. I used the paperclip icon browsed for the file slected the file then clicked upload. it told me that i have attached it already.

so here is the link to that post. The reason why I posted twice is that after i posted here I saw the 5 step program and did the steps and posted the results in a new post on accident. It wouldnt let me delete the post so I just let it run.

http://www.techsupportforum.com/security-center/hijackthis-log-help/220263-b-spyware-comercials-running-through-speakers-b.html

Thanks agian for your patiance in helping me with this ordeal

[TheBruce1]

Ok, i have deleted your other thread, if you are having trouble booting into safe mode just carry on with the rest of the instructions and we`ll take it from there.

[cmiddl01]

with the sdfix i click on the runthis file a dos window opens and this is what it says verbatom.


To run the sdfix tool please reboot to safe mode
(Reboot, tap the F8 key and choose safe mode from the advanced menu)
(sdfix requires administrator account privileges)

1. download/run a-squared (emsi software - 15.5 mb)
2. download/run norman malware cleaner (norman - 3.5 mb)
3. download/run savcli (sophos - 11.5 mb)
4. download kaspersky anti-virus S.O.S. (kaspersky lab)

A. create system report
B. create service/ driver list
c. create catchme log
D. export safeboot key
U. download latest version of sdfix

E. exit

(active internet connection required to download files

type A,B,C,D,U,1,2,3 or E to exit

I typed Y and it just closed the dos program. Do you want me to run all of those iteams?

[TheBruce1]

No, forget about SDFix for now, just follow instructions for running Combofix and post the combofix.txt along with a new Hijackthis log.

[cmiddl01]

ok here is combofix log

ComboFix 08-02-16.2 - Chris 2008-02-16 19:01:43.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1064 [GMT -5:00]
Running from: C:\Documents and Settings\Chris\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
C:\WINDOWS\system32\efccbyv.dll
C:\WINDOWS\system32\jkhfd.dll
C:\WINDOWS\system32\vrypizyy.dll
C:\.protected
C:\install.exe
C:\Program Files\SystemDefender
C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\bpeorebm.ini
C:\WINDOWS\system32\dfhkj.ini
C:\WINDOWS\system32\dfhkj.ini2
C:\WINDOWS\system32\drivers\etc\.protected
C:\WINDOWS\system32\drvjadr.dll
C:\WINDOWS\system32\drvjewr.dll
C:\WINDOWS\system32\dybkgieq.ini
C:\WINDOWS\system32\efccbyv.dll
C:\WINDOWS\system32\enmmkuus.dll
C:\WINDOWS\system32\fccbyaw.dll
C:\WINDOWS\system32\hfjvmgfm.ini
C:\WINDOWS\system32\irontkln.dll
C:\WINDOWS\system32\janhbjrb.dll
C:\WINDOWS\system32\jaudfwos.ini
C:\WINDOWS\system32\jkhfd.dll
C:\WINDOWS\system32\jrfikqyj.dll
C:\WINDOWS\system32\mberoepb.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mglixljw.dll
C:\WINDOWS\system32\phrbxkie.dll
C:\WINDOWS\system32\qpobgerj.dll
C:\WINDOWS\system32\suukmmne.ini
C:\WINDOWS\system32\tuvwwtt.dll
C:\WINDOWS\system32\urqrrrr.dll
C:\WINDOWS\system32\uvwffviy.dllbox
C:\WINDOWS\system32\vrypizyy.dll
C:\WINDOWS\system32\vrypizyy.dllbox
C:\WINDOWS\system32\windows
C:\WINDOWS\system32\winjyg32.dll

.
((((((((((((((((((((((((( Files Created from 2008-01-17 to 2008-02-17 )))))))))))))))))))))))))))))))
.

2008-02-15 18:00 . 2008-02-15 18:00 1,308,807 --a------ C:\SDFix.exe
2008-02-15 17:59 . 2008-02-15 18:35 <DIR> d-------- C:\SDFix
2008-02-14 18:54 . 2008-02-14 18:54 12,288 --a------ C:\Program Files\tmp141171.exe
2008-02-10 09:32 . 2008-02-10 09:32 <DIR> d-------- C:\Deckard
2008-02-10 08:42 . 2007-06-05 10:56 44,928 --a------ C:\WINDOWS\system32\drivers\SDTHOOK.SYS
2008-02-10 08:17 . 2007-06-08 09:44 8,576 --a------ C:\WINDOWS\system32\drivers\dbgjjsigxjjp.sys
2008-02-10 08:15 . 2007-06-08 09:44 8,576 --a------ C:\WINDOWS\system32\drivers\RkPavProc.sys
2008-02-10 07:46 . 2008-02-10 08:18 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2008-02-10 07:46 . 2008-02-10 07:54 30,590 --a------ C:\WINDOWS\system32\pavas.ico
2008-02-10 07:46 . 2008-02-10 07:54 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico
2008-02-10 07:46 . 2008-02-10 07:54 1,406 --a------ C:\WINDOWS\system32\Help.ico
2008-02-09 23:58 . 2008-02-09 23:58 98,709 --a------ C:\Program Files\udefender_setup.exe
2008-02-09 23:53 . 2008-02-09 23:53 12,288 --a------ C:\Program Files\tmp202453.exe
2008-02-09 23:53 . 2008-02-09 23:53 10,240 --a------ C:\Program Files\tmp202218.exe
2008-02-09 23:48 . 2008-02-09 23:48 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-02-09 14:45 . 2008-02-09 23:48 <DIR> d-------- C:\Program Files\Ventrilo
2008-02-09 12:44 . 2008-02-09 23:37 2,988 --a------ C:\WINDOWS\system32\tmp.reg
2008-02-09 12:18 . 2008-02-09 12:18 <DIR> d-------- C:\Documents and Settings\Chris\Application Data\Grisoft
2008-02-09 12:18 . 2008-02-09 12:18 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Grisoft
2008-02-09 12:18 . 2007-05-30 07:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-02-08 23:36 . 2008-02-08 23:36 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Trend Micro
2008-02-08 23:20 . 2008-02-09 18:47 <DIR> d-------- C:\Program Files\Trend Micro
2008-02-08 22:48 . 2008-02-08 22:48 16,896 --a------ C:\WINDOWS\system32\drvtuk.dll
2008-02-08 22:48 . 2008-02-08 22:48 12,288 --a------ C:\Program Files\tmp19914406.exe
2008-02-08 22:48 . 2008-02-08 22:48 10,240 --a------ C:\Program Files\tmp19911781.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-17 00:02 6,971 ----a-w C:\Program Files\tmp389281.exe
2008-02-17 00:02 6,971 ----a-w C:\Program Files\tmp389187.exe
2008-02-17 00:02 10,240 ----a-w C:\Program Files\tmp389171.exe
2008-02-17 00:02 10,240 ----a-w C:\Program Files\tmp388140.exe
2008-02-17 00:02 10,240 ----a-w C:\Program Files\tmp388093.exe
2008-02-17 00:02 10,240 ----a-w C:\Program Files\tmp388078.exe
2008-02-17 00:02 10,240 ----a-w C:\Program Files\tmp387875.exe
2008-02-17 00:02 10,240 ----a-w C:\Program Files\tmp387843.exe
2008-02-10 13:29 --------- d-----w C:\Program Files\QuickTime
2008-02-10 13:23 --------- d-----w C:\Program Files\Common Files\LightScribe
2008-02-10 13:21 --------- d-----w C:\Program Files\Google
2008-02-10 04:48 --------- d-----w C:\Program Files\MobMapUpdater
2008-02-08 22:27 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\flag ace stupid data
2008-02-08 22:25 --------- d-----w C:\Program Files\Real
2008-02-08 22:25 --------- d-----w C:\Program Files\Outspark
2008-01-26 18:26 --------- d-----w C:\Program Files\World of Warcraft
2007-12-21 18:39 --------- d-----w C:\Program Files\AddOn Studio for World of Warcraft
2007-12-21 11:50 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft Help
2007-12-21 11:49 --------- d-----w C:\Program Files\Microsoft Visual Studio 9.0
2007-12-21 11:47 --------- d-----w C:\Program Files\MSBuild
2007-12-21 11:47 --------- d-----w C:\Program Files\Microsoft SDKs
2007-12-21 11:47 --------- d-----w C:\Program Files\Common Files\Merge Modules
2007-12-21 11:46 --------- d-----w C:\Program Files\Reference Assemblies
2007-12-21 11:45 --------- d-----w C:\Program Files\MSXML 6.0
2007-12-21 02:15 --------- d-----w C:\Program Files\Winamp
2007-12-18 09:51 179,584 ----a-w C:\WINDOWS\system32\drivers\mrxdav.sys
2007-12-07 02:21 824,832 ----a-w C:\WINDOWS\system32\wininet.dll
2007-12-04 18:38 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-18 18:38 68856]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 07:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Ptipbmf"="rundll32.exe" [2004-08-04 07:00 33280 C:\WINDOWS\system32\rundll32.exe]
"SoundMan"="SOUNDMAN.EXE" [2003-08-15 02:34 57344 C:\WINDOWS\SOUNDMAN.EXE]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-10-04 17:14 8491008]
"nwiz"="nwiz.exe" [2007-10-04 17:14 1626112 C:\WINDOWS\system32\nwiz.exe]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-11-23 18:28 185896]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11 132496]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-30 18:40 282624]
"Zboard"="C:\Program Files\Ideazon\ZEngine\Zboard.exe" [2007-09-24 16:57 57344]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-10-04 17:14 81920]
"MSDrive"="C:\WINDOWS\system32\drvjad.dll" [ ]
"MSDisp32"="C:\WINDOWS\system32\drvtuk.dll" [2008-02-08 22:48 16896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"DrvKbd"= {38f3dfd0-35c4-4fee-b530-b9ed989526e7} - C:\WINDOWS\Installer\{38f3dfd0-35c4-4fee-b530-b9ed989526e7}\DrvKbd.dll [2008-02-08 22:48 14374]
"zip"= {64dc05a6-46c0-4b13-87f9-fc34b370701d} - C:\WINDOWS\Installer\{64dc05a6-46c0-4b13-87f9-fc34b370701d}\zip.dll [2008-02-14 18:54 38438]
"RamUnknown"= {8ca2bd97-30fe-4423-9b59-aa5408209638} - C:\WINDOWS\Installer\{8ca2bd97-30fe-4423-9b59-aa5408209638}\RamUnknown.dll [2008-02-15 18:45 14374]

R3 Alpham1;Ideazon Merc USB Human Interface Device;C:\WINDOWS\system32\DRIVERS\Alpham1.sys [2007-07-23 10:56]
R3 Alpham2;Ideazon Merc MM USB Human Interface Device;C:\WINDOWS\system32\DRIVERS\Alpham2.sys [2007-03-20 12:49]
R3 PCAlertDriver;PCAlertDriver;C:\Program Files\MSI\Core Center\NTGLM7X.sys [2003-08-05 11:04]
R3 RushTopDevice;RushTopDevice;C:\Program Files\MSI\Core Center\RushTop.sys [2003-08-20 14:44]
S3 moufiltr;Mouse Filter Driver;C:\WINDOWS\system32\DRIVERS\moufiltr.sys [2007-01-30 19:17]
S4 msvsmon90;Visual Studio 2008 Remote Debugger;"C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\Remote Debugger\x86\msvsmon.exe" [2007-11-07 08:58]

.
Contents of the 'Scheduled Tasks' folder
"2008-02-15 08:00:00 C:\WINDOWS\Tasks\AdwareAlert Scheduled Scan.job"
- C:\Program Files\AdwareAlert\AdwareAlert.ex
- C:\Program Files\AdwareAlert
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-16 19:02:51
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\explorer.exe [6.00.2900.3156]
-> C:\WINDOWS\Installer\{38f3dfd0-35c4-4fee-b530-b9ed989526e7}\DrvKbd.dll
-> C:\WINDOWS\Installer\{64dc05a6-46c0-4b13-87f9-fc34b370701d}\zip.dll
-> C:\WINDOWS\Installer\{8ca2bd97-30fe-4423-9b59-aa5408209638}\RamUnknown.dll
.
Completion time: 2008-02-16 19:03:25
ComboFix-quarantined-files.txt 2008-02-17 00:03:23
.
2008-02-15 08:02:37 --- E O F ---
here is the hijackthislog

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 713 PM, on 2/16/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Ideazon\ZEngine\Zboard.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSI\Core Center\CoreCenter.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\DllHost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\DOCUME~1\Chris\LOCALS~1\Temp\agentmon.exe
C:\DOCUME~1\Chris\LOCALS~1\Temp\32mon.exe
C:\DOCUME~1\Chris\LOCALS~1\Temp\sysagent.exe
C:\DOCUME~1\Chris\LOCALS~1\Temp\sysagent.exe
C:\DOCUME~1\Chris\LOCALS~1\Temp\winagent.exe
C:\DOCUME~1\Chris\LOCALS~1\Temp\32sys.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.1121.2472\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [Ptipbmf] "rundll32.exe" ptipbmf.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Zboard] "C:\Program Files\Ideazon\ZEngine\Zboard.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [MSDrive] rundll32.exe C:\WINDOWS\system32\drvjad.dll,startup
O4 - HKLM\..\Run: [MSDisp32] rundll32.exe C:\WINDOWS\system32\drvtuk.dll,startup
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: CoreCenter.lnk = C:\Program Files\MSI\Core Center\CoreCenter.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/...x/qtplugin.cab
O16 - DPF: {106E49CF-797A-11D2-81A2-00E02C015623} (AlternaTIFF ActiveX) - http://www.alternatiff.com/install/00/alttiff.cab
O16 - DPF: {64D01C7F-810D-446E-A07E-16C764235644} (AtlAtomadersCtlAttrib Class) - http://zone.msn.com/bingame/amad/default/atomaders.cab
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://zone.msn.com/bingame/amun/def...jolauncher.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {B7D07999-2ADB-4AEB-997E-F61CB7B2E2CD} (TSEasyInstallX Control) - http://www.trendsecure.com/easy_inst...syInstallX.CAB
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramewor...o.cab56649.cab
O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} (TikGames Online Control) - http://zone.msn.com/bingame/cnma/default/ct.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/popcaploader_v10.cab
O21 - SSODL: DrvKbd - {38f3dfd0-35c4-4fee-b530-b9ed989526e7} - C:\WINDOWS\Installer\{38f3dfd0-35c4-4fee-b530-b9ed989526e7}\DrvKbd.dll
O21 - SSODL: zip - {64dc05a6-46c0-4b13-87f9-fc34b370701d} - C:\WINDOWS\Installer\{64dc05a6-46c0-4b13-87f9-fc34b370701d}\zip.dll
O21 - SSODL: RamUnknown - {8ca2bd97-30fe-4423-9b59-aa5408209638} - C:\WINDOWS\Installer\{8ca2bd97-30fe-4423-9b59-aa5408209638}\RamUnknown.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 7237 bytes



Thanks I hope i did this right and it helps you help me!

[TheBruce1]

Hello again

===========

Download ATF-Cleaner by Atribune to your desktop.Do not run just yet, we will shortly

=============


Open notepad and copy/paste the text in the quotebox below into it:

KillAll::

File::
C:\Program Files\tmp141171.exe
C:\Program Files\udefender_setup.exe
C:\Program Files\tmp202453.exe
C:\Program Files\tmp202218.exe
C:\WINDOWS\system32\drvtuk.dll
C:\Program Files\tmp19914406.exe
C:\Program Files\tmp19911781.ex
C:\Program Files\tmp389281.exe
C:\Program Files\tmp389187.exe
C:\Program Files\tmp389171.exe
C:\Program Files\tmp388140.exe
C:\Program Files\tmp388093.exe
C:\Program Files\tmp388078.exe
C:\Program Files\tmp387875.exe
C:\Program Files\tmp387843.exe
C:\DOCUME~1\Chris\LOCALS~1\Temp\agentmon.exe
C:\DOCUME~1\Chris\LOCALS~1\Temp\32mon.exe
C:\DOCUME~1\Chris\LOCALS~1\Temp\sysagent.exe
C:\DOCUME~1\Chris\LOCALS~1\Temp\sysagent.exe
C:\DOCUME~1\Chris\LOCALS~1\Temp\winagent.exe
C:\DOCUME~1\Chris\LOCALS~1\Temp\32sys.exe
C:\WINDOWS\Installer\{38f3dfd0-35c4-4fee-b530-b9ed989526e7}\DrvKbd.dll
C:\WINDOWS\Installer\{64dc05a6-46c0-4b13-87f9-fc34b370701d}\zip.dll
C:\WINDOWS\Installer\{8ca2bd97-30fe-4423-9b59-aa5408209638}\RamUnknown.dll

Folder::
C:\Documents and Settings\All Users.WINDOWS\Application Data\flag ace stupid data

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"DrvKbd"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"zip"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"RamUnknown"=-

Save this as CFscript







Refering to the picture above, drag CFscript into ComboFix.exe

Follow the prompts, and post the resulting log, C:\ComboFix.txt

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.


Warning:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

============

Double-click ATF Cleaner.exe to open it

Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.

If you have Firefox installed:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

If you have Opera installed:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Click Exit on the Main menu to close the program.


============

Perform an online scan with Internet Explorer with Panda ActiveScan

1. Click on located at the bottom of the page.
2. A "pop up" window will appear. * Please ensure that your pop up blocker doesn't block it *
3. Enter your e-mail address, country, and state & click "Free Online Scan" *The download of the 8 MB Panda's ActiveX control will take place*

Begin the scan by selecting

• If it finds any malware, it will offer you a report.
• Please ignore any entry it finds and the offer to buy the program to remove the entry, as we will address this later.
• Click on then click

* You needn't remain online while it's doing the scan but you have to re-connect after it has finished to see the report.
* Turn off the real time scanner of any existing antivirus program while performing the online scan

Paste the Panda Scan report here into your next reply.

==========

Download fl.zip
Extract the contents to a new folder on Desktop.
Within the folder, locate & double-click fl.bat.
It should produce a report at c:\findlop.txt. Post the contents of the report in your next reply.

===========

Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here.

===========
Logs Required
C:\Combofix.txt
Panda Scan Report
C:\findlop.txt
Hijackthis Log

[cmiddl01]

Thanks for your time. I am currently working on it,but pandasoftware.com must be down at the time being I will keep trying to get the website up.

[TheBruce1]

No problem here getting to the Panda site, make sure you are using Internet Explorer rather than Firefox. If you are unable to use the Panda online scan let me know and we`ll try another one.

[cmiddl01]

ya i have been trying both explorer and firefox all morning and still cant reach thier site. are you able to?

[cmiddl01]

ok i have finally gotten to the website using this link

http://www.pandasecurity.com/homeuse...ns/activescan/

when i click on scan pc now the popup comes up and then IE says that it cant display website.

So lets try another tool.

[TheBruce1]

Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner

Answer Yes, when prompted to install an ActiveX component.

• The program will then begin downloading the latest definition files.
• Once the files have been downloaded click on NEXT
• Locate the Scan Settings button & configure to:
  • Scan using the following Anti-Virus database:
    • Extended
  • Scan Options:
    • Scan Archives
    • Scan Mail Bases
• Click OK & have it scan My Computer
• Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
• Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

* Turn off the real time scanner of any existing antivirus program while performing the online scan

Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license has been accepted, reset to 100%.

[cmiddl01]

do you have another tool i got to the kaspersky online scanner installed the activex control when it goes to update i get this.

Downloading from url: http://downloads4.kaspersky-labs.com
Downloading remote file: master.xml
Downloading from url: ftp://downloads1.kaspersky-labs.com
Downloading remote file: master.xml
Update process FAILED. No further antivirus actions can be performed!

it fails everytime it trys to update. went back to the panda site and thats still a no go.

[TheBruce1]

Don`t know how you got to there, try this link and follow the instructions for running Kaspersky online scan.
http://www.kaspersky.com/kos/eng/par...avwebscan.html

[cmiddl01]

agian with this link IE says website not found.
really i do not know whats going on I am fustrated
I am using IE for this cleaning

Version 7.0.5730.13

every link that i have tried after downloading the atf cleaner (not ran yet) wont work for me. all my other websites work and links from my other pages. not sure what to do for ya. I have never ran into such a link problem before. Maybe its because I am from the states. I do have AVG on my comp from the 5 step program not sure if that will do a log for ya or not.

[TheBruce1]

Originally Posted by cmiddl01

every link that i have tried after downloading the atf cleaner (not ran yet) wont work for me

Why are you trying to run an online scan before running ATF-Cleaner, have you run Combofix yet?

Please do this:

Download ATF-Cleaner(done)
Run Combofix according to my instructions
Run ATF-Clearner
Then and only then run the online scanner
If you have trouble with Panda, then try the Kaspersky links again
If your still having the same problems then let me know, once you completed the other steps outlined above.

[cmiddl01]

I am sorry i did run that. i havent ran the fl.zip stuff yet. for some reason all the links that are up here for the online scan wont work i have disabled all virus protection and have disabled the windows fire wall and still are having this problem.