Searchportal.com on Computer and Wont Go Away! :(

femi · 03-24-2008, 05:22 PM

Hey there!

I just followed the five steps before i posted, and nothing i did got rid of this pop up page that i get whenever i turn on my computer. It is called "searchportal" and hopefully someone here with a brilliant mind would be able to help me get rid of the nasty bugger! This has been happening for the past couple of weeks, and despite everything, it wont go away!

Also, when i did a panda scan, i found that my computer also seems to be infected with someother malware along the lines of myway and tribalfusion.. if anyone also knew how to get rid of these then that would help greatly!

Thank you very much!! i hope i did not leave anything out, but if i did then just yell at me and tell me what else i gotta do!

Here is my log and everything that you have asked for:

Deckard's System Scanner v20071014.68
Run by Felicia Mittica on 2008-03-24 19:00:09
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.

-- Last 5 Restore Point(s) --
68: 2008-03-25 00:00:31 UTC - RP439 - Deckard's System Scanner Restore Point
67: 2008-03-23 17:57:14 UTC - RP438 - System Checkpoint
66: 2008-03-22 02:37:33 UTC - RP437 - Software Distribution Service 3.0
65: 2008-03-21 23:31:40 UTC - RP436 - Software Distribution Service 3.0
64: 2008-03-21 21:11:14 UTC - RP435 - Software Distribution Service 3.0

-- First Restore Point --
1: 2007-12-26 17:54:10 UTC - RP372 - System Checkpoint

Backed up registry hives.
Performed disk cleanup.

Total Physical Memory: 504 MiB (512 MiB recommended).

-- HijackThis (run as Felicia Mittica.exe) -------------------------------------

Unable to find log (file not found); running clone.
-- HijackThis Clone ------------------------------------------------------------

Emulating logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2008-03-24 19:02:55
Platform: Windows XP Service Pack 2 (5.01.2600)
MSIE: Internet Explorer (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKEEPER.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Intel\Wireless\Bin\ZCfgSvc.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Outlook Express\svchost.exe
C:\Program Files\Dell\NicConfigSvc\NicConfigSvc.exe
C:\Program Files\Intel\Wireless\Bin\1XConfig.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Intel\Wireless\Bin\iFrmewrk.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Apoint\ApntEx.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Symantec AntiVirus\VPTray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Documents and Settings\Felicia Mittica\Application Data\Opera\Opera\profile\cache4\temporary_download\dss.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.ca/myway
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://mysearch.myway.com/jsp/dellsidebar.jsp?p=DC
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/en-us/srchasst/srchasst.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://home.microsoft.com/access/autosearch.asp?p=%s
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\deSrcAs.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\deSrcAs.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "c:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ssdiag] C:\WINDOWS\ssdiag.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (file missing)
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.mail.live.com/mail/w1/re...s/MSNPUpld.cab
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/...oUploader3.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/...toUploader.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} () - http://fpdownload.macromedia.com/get.../ultrashim.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/sof...iveXPlugin.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab
O16 - DPF: {CD3E5421-3A0A-47CB-B789-7929E6F5DE33} (SecurityDetector Class) - http://radialpoint.securityadvisor.c...tyDetector.cab
O18 - Protocol: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll
O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_0.EXE
O23 - Service: Window Net Dns (MyDNS) - Unknown owner - C:\Program Files\Outlook Express\svchost.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NicConfigSvc\NicConfigSvc.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SavRoam - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKEEPER.exe

--
End of file - 12381 bytes

-- File Associations -----------------------------------------------------------

All associations okay.

-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R1 APPDRV - c:\windows\system32\drivers\appdrv.sys <Not Verified; Dell Inc; Application Driver>
R1 omci (OMCI WDM Device Driver) - c:\windows\system32\drivers\omci.sys <Not Verified; Dell Inc; OMCI Driver>
R2 AegisP (AEGIS Protocol (IEEE 802.1x) v3.1.0.1) - c:\windows\system32\drivers\aegisp.sys <Not Verified; Meetinghouse Data Communications; AEGIS Client 3.1.0.1>
R2 s24trans (WLAN Transport) - c:\windows\system32\drivers\s24trans.sys <Not Verified; Intel Corporation; Intel Wireless LAN Packet Driver>
R3 DSproct - c:\program files\dellsupport\gtaction\triggers\dsproct.sys <Not Verified; Gteko Ltd.; processt>

S3 35999854-e799-4bdc-b431-60b22733eeb6 - d:\player\cds300.dll (file missing)
S3 P2k (Motorola USB Device) - c:\windows\system32\drivers\p2k.sys <Not Verified; Motorola Inc; P2k Driver>
S3 SbcpHid - c:\windows\system32\drivers\sbcphid.sys
S3 usbsermpt (Motorola USB Modem Driver for MPT) - c:\windows\system32\drivers\usbsermpt.sys <Not Verified; Microsoft Corporation; Microsoft(R) Windows (R) 2000 Operating System>
S3 wanatw (WAN Miniport (ATW)) - c:\windows\system32\drivers\wanatw4.sys (file missing)

-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 Apple Mobile Device - "c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe" <Not Verified; Apple, Inc.; Apple Mobile Device Service>
R2 Bonjour Service - "c:\program files\bonjour\mdnsresponder.exe" <Not Verified; Apple Inc.; Bonjour>
R2 MyDNS (Window Net Dns) - c:\program files\outlook express\svchost.exe
R2 NICCONFIGSVC - c:\program files\dell\nicconfigsvc\nicconfigsvc.exe <Not Verified; Dell Inc.; NicConfigSvc>
R2 RegSrvc - c:\program files\intel\wireless\bin\regsrvc.exe <Not Verified; Intel Corporation; RegSrvc Module>
R2 WLANKEEPER - c:\program files\intel\wireless\bin\wlkeeper.exe <Not Verified; Intel® Corporation; SSOFSet Service>

-- Device Manager: Disabled ----------------------------------------------------

No disabled devices found.

-- Scheduled Tasks -------------------------------------------------------------

2008-02-13 15:32:06 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job

-- Files created between 2008-02-24 and 2008-03-24 -----------------------------

2008-03-23 00:03:19 0 d-------- C:\Documents and Settings\All Users\Application Data\Adobe
2008-03-21 16:31:19 0 d-------- C:\Program Files\Microsoft Silverlight
2008-03-21 16:29:33 0 d-------- C:\Program Files\MSBuild
2008-03-21 16:24:20 0 d-------- C:\WINDOWS\system32\XPSViewer
2008-03-21 16:22:33 0 d-------- C:\Program Files\Reference Assemblies
2008-03-21 16:20:36 0 d-------- C:\68985d2199c0f26c42
2008-03-21 16:20:32 0 d-------- C:\Program Files\MSXML 6.0
2008-03-21 12:55:23 0 d-------- C:\WINDOWS\system32\ActiveScan
2008-03-20 18:42:42 0 d-------- C:\Program Files\MSECache
2008-03-16 21:59:09 0 d-------- C:\Documents and Settings\Rosalie\Application Data\Opera
2008-03-16 16:32:59 0 d-------- C:\Documents and Settings\Rosalie\Application Data\Real
2008-03-15 22:18:03 0 d-------- C:\Program Files\ZonedOut
2008-03-15 22:09:16 0 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-03-15 22:08:46 0 d-------- C:\Program Files\SpywareBlaster
2008-03-15 21:44:59 0 d-------- C:\Documents and Settings\Felicia Mittica\Application Data\Opera
2008-03-15 21:44:34 0 d-------- C:\Program Files\Opera
2008-03-14 21:45:17 0 dr-h----- C:\Documents and Settings\Administrator\Application Data <APPLIC~1>
2008-03-14 21:45:17 0 d-------- C:\Documents and Settings\Administrator\Application Data\You've Got Pictures Screensaver
2008-03-14 21:45:17 0 d-------- C:\Documents and Settings\Administrator\Application Data\Sun
2008-03-14 21:45:17 0 d---s---- C:\Documents and Settings\Administrator\Application Data\Microsoft
2008-03-14 21:45:17 0 d-------- C:\Documents and Settings\Administrator\Application Data\Intel
2008-03-14 21:45:17 0 d-------- C:\Documents and Settings\Administrator\Application Data\Identities
2008-03-14 21:45:17 0 d-------- C:\Documents and Settings\Administrator\Application Data\Apple Computer
2008-03-14 21:45:16 0 d--h----- C:\Documents and Settings\Administrator\Local Settings <LOCALS~1>
2008-03-14 21:45:16 0 dr------- C:\Documents and Settings\Administrator\Favorites <FAVORI~1>
2008-03-14 21:45:16 0 d-------- C:\Documents and Settings\Administrator\Desktop
2008-03-14 21:45:16 0 d--hs---- C:\Documents and Settings\Administrator\Cookies
2008-03-14 21:45:15 0 d--h----- C:\Documents and Settings\Administrator\Templates <TEMPLA~1>
2008-03-14 21:45:15 0 dr------- C:\Documents and Settings\Administrator\Start Menu <STARTM~1>
2008-03-14 21:45:15 0 dr-h----- C:\Documents and Settings\Administrator\SendTo
2008-03-14 21:45:15 0 dr-h----- C:\Documents and Settings\Administrator\Recent
2008-03-14 21:45:15 0 d--h----- C:\Documents and Settings\Administrator\PrintHood <PRINTH~1>
2008-03-14 21:45:15 0 d--h----- C:\Documents and Settings\Administrator\NetHood
2008-03-14 21:45:15 0 dr------- C:\Documents and Settings\Administrator\My Documents <MYDOCU~1>
2008-03-14 21:45:13 1048576 --ah----- C:\Documents and Settings\Administrator\NTUSER.DAT
2008-03-14 12:36:32 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-03-14 12:26:57 0 d-------- C:\Documents and Settings\Felicia Mittica\Application Data\Lavasoft
2008-03-14 12:25:56 0 d-------- C:\Program Files\Lavasoft
2008-03-14 12:15:31 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-03-11 21:54:40 0 dr------- C:\Documents and Settings\LocalService\My Documents <MYDOCU~1>
2008-03-11 21:54:39 0 dr-h----- C:\Documents and Settings\LocalService\Recent
2008-03-10 23:34:11 0 d-------- C:\Program Files\Common Files\Nero
2008-03-07 20:19:25 0 d-------- C:\Documents and Settings\Default User\Application Data\Apple Computer
2008-03-03 01:05:20 0 d-------- C:\Program Files\Common Files\Motorola Shared
2008-03-03 01:03:46 5936 --a------ C:\Documents and Settings\Felicia Mittica\mqdmwhnt.sys <Not Verified; MCCI; Motorola DM Composite Driver>
2008-03-03 01:03:46 79328 --a------ C:\Documents and Settings\Felicia Mittica\mqdmserd.sys <Not Verified; MCCI; Motorola USB Diag>
2008-03-03 01:03:46 92064 --a------ C:\Documents and Settings\Felicia Mittica\mqdmmdm.sys <Not Verified; MCCI; Motorola USB Modem>
2008-03-03 01:03:46 9232 --a------ C:\Documents and Settings\Felicia Mittica\mqdmmdfl.sys <Not Verified; MCCI; Motorola USB Modem Filter>
2008-03-03 01:03:46 4048 --a------ C:\Documents and Settings\Felicia Mittica\mqdmcr.sys <Not Verified; MCCI; Motorola USB DIAG>
2008-03-03 01:03:46 6208 --a------ C:\Documents and Settings\Felicia Mittica\mqdmcmnt.sys <Not Verified; MCCI; Motorola USB DIAG>
2008-03-03 01:03:46 66656 --a------ C:\Documents and Settings\Felicia Mittica\mqdmbus.sys <Not Verified; MCCI; Motorola DM Composite Driver>
2008-03-03 01:03:43 6947 --a------ C:\Documents and Settings\Felicia Mittica\1204524223-(null) <120452~1>
2008-03-03 00:43:33 0 d-------- C:\Documents and Settings\Felicia Mittica\Application Data\InstallShield
2008-03-03 00:36:36 0 d-------- C:\Program Files\Avanquest update
2008-03-03 00:34:40 0 d-------- C:\Program Files\Motorola Phone Tools
2008-03-03 00:34:39 22768 --a------ C:\WINDOWS\system32\drivers\usbsermpt.sys <USBSER~1.SYS> <Not Verified; Microsoft Corporation; Microsoft(R) Windows (R) 2000 Operating System>
2008-03-03 00:34:39 22768 --a------ C:\Documents and Settings\Felicia Mittica\usbsermpt.sys <USBSER~1.SYS> <Not Verified; Microsoft Corporation; Microsoft(R) Windows (R) 2000 Operating System>
2008-03-03 00:34:39 0 d-------- C:\Documents and Settings\All Users\Application Data\BVRP Software
2008-03-02 23:56:32 36480 --a------ C:\WINDOWS\system32\drivers\P2k.sys <Not Verified; Motorola Inc; P2k Driver>
2008-02-25 18:37:38 0 d-------- C:\Temp
2008-02-25 18:36:29 0 d-------- C:\Program Files\Xilisoft
2008-02-25 12:50:31 0 d-------- C:\Program Files\iPod
2008-02-25 12:50:13 0 d-------- C:\Program Files\iTunes
2008-02-25 12:49:42 0 d-------- C:\Program Files\Bonjour
2008-02-25 12:48:18 0 d-------- C:\Program Files\QuickTime
2008-02-25 12:48:13 0 d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-02-25 12:45:06 0 d-------- C:\Program Files\Common Files\Apple

-- Find3M Report ---------------------------------------------------------------

2008-03-24 18:40:33 0 d-------- C:\Program Files\Symantec AntiVirus
2008-03-23 00:05:14 0 d-------- C:\Documents and Settings\Felicia Mittica\Application Data\AdobeUM
2008-03-21 13:49:11 0 d-------- C:\Program Files\MSN Messenger
2008-03-21 13:47:11 0 d-------- C:\Program Files\Messenger
2008-03-21 13:44:11 0 d-------- C:\Program Files\Digital Line Detect
2008-03-21 13:44:11 0 d-------- C:\Program Files\DellSupport
2008-03-21 13:43:00 0 d-------- C:\Program Files\Common Files\Symantec Shared
2008-03-21 13:41:10 0 d-------- C:\Program Files\Apoint
2008-03-21 00:33:52 0 d-------- C:\Documents and Settings\Felicia Mittica\Application Data\uTorrent
2008-03-21 00:19:15 0 d-------- C:\Program Files\LimeWire
2008-03-20 22:40:17 0 d-------- C:\Documents and Settings\Felicia Mittica\Application Data\Real
2008-03-16 09:27:05 0 d-------- C:\Documents and Settings\Felicia Mittica\Application Data\Adobe
2008-03-14 12:36:32 0 d-------- C:\Program Files\Common Files
2008-03-06 02:57:44 0 d-------- C:\Program Files\uTorrent
2008-03-03 00:40:27 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-02-25 12:51:09 0 d-------- C:\Documents and Settings\Felicia Mittica\Application Data\Apple Computer
2008-02-13 18:40:23 3454 --a------ C:\WINDOWS\unins000.dat
2008-02-13 18:32:45 691545 --a------ C:\WINDOWS\unins000.exe
2008-02-12 19:42:15 0 d-------- C:\Program Files\DivX
2008-01-28 21:34:53 0 d-------- C:\Program Files\Common Files\xing shared
2008-01-28 21:34:49 0 d-------- C:\Program Files\Real
2008-01-28 21:34:21 0 d-------- C:\Program Files\Common Files\Real
2008-01-28 21:29:26 0 d-------- C:\Program Files\Windows Media Connect 2

-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [09/13/2004 05:33 PM]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [10/14/2005 09:49 PM]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [10/14/2005 09:46 PM]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [10/14/2005 09:50 PM]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [09/25/2007 02:11 AM]
"@"="" []
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [10/30/2004 03:59 PM]
"PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [04/11/2004 09:15 PM]
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [09/01/2005 06:24 PM]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [02/23/2005 05:19 PM]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [12/06/2004 02:05 AM]
"ISUSPM Startup"="c:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [06/10/2005 11:44 AM]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [06/10/2005 11:44 AM]
"ssdiag"="C:\WINDOWS\ssdiag.exe" [07/14/2004 12:28 PM]
"MSKDetectorExe"="C:\Program Files\McAfee\SpamKiller\MSKDetct.exe" [08/12/2005 05:16 PM]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [03/24/2006 08:14 PM]
"vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [05/27/2006 04:40 AM]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [01/28/2008 09:33 PM]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [02/01/2008 12:13 AM]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [02/19/2008 02:10 PM]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" []
"NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" []

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [10/13/2004 11:24 AM]
"DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [03/15/2007 11:09 AM]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [01/28/2008 12:43 PM]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 06:00 AM]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [12/14/2004 4:44:06 AM]
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2/6/2006 4:50:51 PM]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2/13/2001 2:01:04 AM]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
C:\Program Files\Intel\Wireless\Bin\LgNotify.dll 09/07/2004 05:08 PM 110592 C:\Program Files\Intel\Wireless\Bin\LgNotify.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

-- End of Deckard's System Scanner: finished at 2008-03-24 19:03:50 ------------

femi · 03-27-2008, 08:51 PM

... would someone please help?
thanks!

femi · 03-30-2008, 09:07 AM

Bump :(

femi · 04-01-2008, 09:04 AM

Bump! bumpity bump bump..

tetonbob · 04-01-2008, 01:50 PM

Hi, sorry for any delay in replying, but this section of the forum is extremely busy.

If you still need assistance for this issue, plesae do this first:

Please go to: VirusTotal

On the page you'll find a "Browse" button.
Next to the browse button you'll see a box to enter text.
Please copy/paste the following in BOLD:

c:\program files\outlook express\svchost.exe
Then click the "Send File " button just below.
This will scan the file. Please be patient.
Once scanned, copy and paste the results in your next reply.

Edit:

Please also let the folks at Daniweb know you'll no longer be needing assistance. Any other forums at which you might have posted, please inform them as well if you'll be using my assistance.

This will stop another helper elsewhere from reviewing the same log, and spend time helping someone else.

Thanks.

femi · 04-01-2008, 08:45 PM

Thanks soo much for answering! :D

Here are the results.. I tried getting them into a neat table, all to no avail sadly :(

And yes, i'll let everyone know that you are helping me!

ile svchost.exe received on 03.28.2008 13:48:34 (CET)

Antivirus Version Last Update Result

AhnLab-V3 2008.3.26.0 2008.03.28 -
AntiVir 7.6.0.78 2008.03.28 TR/Delf.bhp
Authentium 4.93.8 2008.03.28 -
Avast 4.7.1098.0 2008.03.28 -
AVG 7.5.0.516 2008.03.27 Generic10.BJZ
BitDefender 7.2 2008.03.28 -
CAT-QuickHeal 9.50 2008.03.28 Trojan.Delf.bhp
ClamAV 0.92.1 2008.03.28 -
DrWeb 4.44.0.09170 2008.03.28 Trojan.LowZones.815
eSafe 7.0.15.0 2008.03.18 -
eTrust-Vet 31.3.5651 2008.03.28 -
Ewido 4.0 2008.03.28 -
FileAdvisor 1 2008.03.28 High threat detected
Fortinet 3.14.0.0 2008.03.28 W32/Delf.BHP!tr
F-Prot 4.4.2.54 2008.03.27 W32/Trojan2.AHAR
F-Secure 6.70.13260.0 2008.03.28 Trojan.Win32.Delf.bhp
Ikarus T3.1.1.20 2008.03.28 -
Kaspersky 7.0.0.125 2008.03.28 Trojan.Win32.Delf.bhp
McAfee 5261 2008.03.27 -
Microsoft 1.3301 2008.03.28 Trojan:Win32/Delf.RAX
NOD32v2 2981 2008.03.28 -
Norman 5.80.02 2008.03.26 W32/Delf.BQIJ
Panda 9.0.0.4 2008.03.28 -
Prevx1 V2 2008.03.28 Generic10.BJZ
Rising 20.37.41.00 2008.03.28 -
Sophos 4.27.0 2008.03.28 Mal/Behav-053
Sunbelt 3.0.978.0 2008.03.18 -
Symantec 10 2008.03.28 -
TheHacker 6.2.92.257 2008.03.27 -
VBA32 3.12.6.3 2008.03.25 Trojan.Win32.Delf.bhp
VirusBuster 4.3.26:9 2008.03.27 -
Webwasher-Gateway 6.6.2 2008.03.28 Trojan.Delf.bhp

Additional information
File size: 493056 bytes
MD5: 6b13319c54ca4cc64682209a60226cc2
SHA1: b4bd9c54be19da997335f5b5ccd9e2427465c17f
PEiD: -
Bit9 info: http://fileadvisor.bit9.com/services...82209a60226cc2
Prevx info: http://info.prevx.com/aboutprogramte...903700EC9A2CCB

tetonbob · 04-01-2008, 08:52 PM

Ok, thanks....I knew that was a nasty, I wanted to see how well detected it was. As you can see Symantec does not have it in their definitions...no worries, I can read that mess.

It's how all VirusTotal logs get posted

We'll begin with ComboFix.

Please visit this webpage for instructions for downloading and running ComboFix:

http://www.bleepingcomputer.com/comb...o-use-combofix

Please ensure you read this guide carefully and install the Recovery Console first.

The Windows Recovery Console will allow you to boot up into a special recovery mode that allows us to help you in the case that your computer has a problem after an attempted removal of malware.

If you have any questions along the way, STOP and ask them before proceeding.

Post the log from ComboFix when you've accomplished that, along with a new HijackThis log.

It does not appear as though DSS was allowed to download and install HijackThis. To produce a HijackThis log for your next reply, please do this:

Please download HijackThis to your desktop

Alternate link

Double-click on the file you just downloaded.
Click on the "Unzip" button to install. It will by default install to the directory - C:\Program Files\Trend Micro\HijackThis

Upon install, HijackThis should open for you.

Should it not open, navigate to C:\Program Files\Trend Micro\HijackThis and double click on HijackThis.exe

1. If it gives you an intro screen, just choose 'Do a system scan and save a logfile'.
2. If you don't get the intro screen, just hit Scan and then click on Save log.
3. Post the hijackthis.log file here. Do not fix anything in HijackThis since they may be harmless.

---------------------------------------------------------------------------------------------

femi · 04-02-2008, 05:06 PM

Hello! A bit of a problem :(

I was going to install the Windows recovery console- however, it requires the use of the Windows Xp CD Rom, which I do not have!
My laptop is a Dell computer- which means that they shipped it to me with all of the programs all ready installed on it - but no cd's or a hard copy of the actuall programs that are on my computer.

So, I was wondering if i can still run Combofix without creating the windows Recovery Console... or would that be a very bad idea? (i'm thinking it is..)

If that is the case, and I do need the cd, then would I have to call Dell and ask them to send me the cd?

What do i do! ? :S
(thanks!)

tetonbob · 04-02-2008, 05:35 PM

Read on....

Quote:

If on the other hand, you use Windows XP and do not have the Windows CD, ComboFix includes a method of installing the Windows Recovery console by downloading a file from Microsoft. To install the Windows Recovery Console when you do not have the Windows XP CD, please follow these instructions:

You'll need the download from Microsoft for:

Microsoft Windows XP Home Edition Service Pack 2

Any questions, feel free to ask.

femi · 04-02-2008, 08:56 PM

I do believe that you are a genius!
why I had not thought of reading all instructions all the way i do not know..

anyways, did what you said and here is the log of Combofix (quite large!)

also, before doing this scan i had to disable all of my antivirus/anti-spyware programs - do i re-enable them all now, or would it be more practical for me to keep them off untill i totally finish fixing this problem??

thanks :)

ComboFix 08-04-02.1 - Felicia Mittica 2008-04-02 22:45:37.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.193 [GMT -5:00]
Running from: C:\Documents and Settings\Felicia Mittica\Desktop\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2008-03-03 to 2008-04-03 )))))))))))))))))))))))))))))))
.

2008-03-30 15:40 . 2008-03-30 15:40 <DIR> d-------- C:\Program Files\Trend Micro
2008-03-30 12:41 . 2008-03-30 12:41 <DIR> d-------- C:\Documents and Settings\Felicia Mittica\Application Data\Grisoft
2008-03-30 12:40 . 2008-03-30 12:40 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-03-30 12:40 . 2007-05-30 07:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-03-25 20:56 . 2008-03-25 20:56 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Dell
2008-03-24 18:59 . 2008-03-24 18:59 <DIR> d-------- C:\Deckard
2008-03-21 16:31 . 2008-03-21 16:31 <DIR> d-------- C:\Program Files\Microsoft Silverlight
2008-03-21 16:29 . 2008-03-21 16:29 <DIR> d-------- C:\Program Files\MSBuild
2008-03-21 16:24 . 2008-03-21 18:42 <DIR> d-------- C:\WINDOWS\system32\XPSViewer
2008-03-21 16:22 . 2008-03-21 16:22 <DIR> d-------- C:\Program Files\Reference Assemblies
2008-03-21 16:20 . 2008-03-21 16:20 <DIR> d-------- C:\Program Files\MSXML 6.0
2008-03-21 16:20 . 2006-06-29 13:07 14,048 --------- C:\WINDOWS\system32\spmsg2.dll
2008-03-21 16:08 . 2006-11-13 01:02 288,768 --------- C:\WINDOWS\system32\rhttpaa.dll
2008-03-21 16:08 . 2006-11-13 01:02 116,736 --------- C:\WINDOWS\system32\aaclient.dll
2008-03-21 16:08 . 2006-11-13 01:02 36,352 --------- C:\WINDOWS\system32\tsgqec.dll
2008-03-21 12:55 . 2008-03-21 14:05 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2008-03-21 12:55 . 2008-03-21 12:55 30,590 --a------ C:\WINDOWS\system32\pavas.ico
2008-03-21 12:55 . 2008-03-21 12:55 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico
2008-03-21 12:55 . 2008-03-21 12:55 1,406 --a------ C:\WINDOWS\system32\Help.ico
2008-03-20 18:42 . 2008-03-20 18:42 <DIR> d-------- C:\Program Files\MSECache
2008-03-15 22:18 . 2007-03-31 12:12 <DIR> d-------- C:\Program Files\ZonedOut
2008-03-15 22:09 . 2008-04-02 22:21 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-03-15 22:08 . 2008-03-21 00:19 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-03-15 22:08 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\system32\MSINET.OCX
2008-03-15 21:44 . 2008-03-21 13:07 <DIR> d-------- C:\Program Files\Opera
2008-03-14 23:11 . 2008-04-02 17:19 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-03-14 23:11 . 2008-03-14 23:11 1,409 --a------ C:\WINDOWS\QTFont.for
2008-03-14 21:45 . 2006-02-06 16:52 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\You've Got Pictures Screensaver
2008-03-14 21:45 . 2006-02-06 16:47 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Intel
2008-03-14 21:45 . 2008-03-07 20:19 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Apple Computer
2008-03-14 12:36 . 2008-03-14 12:36 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-03-14 12:26 . 2008-03-14 12:37 <DIR> d-------- C:\Documents and Settings\Felicia Mittica\Application Data\Lavasoft
2008-03-14 12:25 . 2008-03-14 12:37 <DIR> d-------- C:\Program Files\Lavasoft
2008-03-14 12:15 . 2008-03-14 12:16 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-03-10 23:34 . 2008-03-11 22:21 <DIR> d-------- C:\Program Files\Common Files\Nero
2008-03-07 21:15 . 2004-05-25 18:06 417,792 --a------ C:\WINDOWS\system32\ac3filter.ax
2008-03-07 21:15 . 2005-02-27 22:48 356,352 --a------ C:\WINDOWS\system32\RealMediaSplitter.ax
2008-03-07 21:15 . 2004-01-10 18:02 258,048 --a------ C:\WINDOWS\system32\GplMpgDec.ax
2008-03-03 01:09 . 2008-03-03 01:09 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-03-03 01:09 . 2008-03-03 01:09 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_motmodem_01005.Wdf
2008-03-03 01:05 . 2008-03-03 01:05 <DIR> d-------- C:\Program Files\Common Files\Motorola Shared
2008-03-03 01:05 . 2006-11-13 15:45 1,419,232 --a------ C:\WINDOWS\system32\wdfcoinstaller01005.dll
2008-03-03 01:05 . 2006-12-14 11:27 40,832 --a------ C:\WINDOWS\system32\drivers\motodrv.sys
2008-03-03 01:05 . 2007-02-27 15:31 21,504 --a------ C:\WINDOWS\system32\drivers\motmodem.sys
2008-03-03 01:03 . 2008-03-03 01:03 92,064 --a------ C:\Documents and Settings\Felicia Mittica\mqdmmdm.sys
2008-03-03 01:03 . 2008-03-03 01:03 79,328 --a------ C:\Documents and Settings\Felicia Mittica\mqdmserd.sys
2008-03-03 01:03 . 2008-03-03 01:03 66,656 --a------ C:\Documents and Settings\Felicia Mittica\mqdmbus.sys
2008-03-03 01:03 . 2008-03-03 01:03 9,232 --a------ C:\Documents and Settings\Felicia Mittica\mqdmmdfl.sys
2008-03-03 01:03 . 2008-03-03 01:03 6,208 --a------ C:\Documents and Settings\Felicia Mittica\mqdmcmnt.sys
2008-03-03 01:03 . 2008-03-03 01:03 5,936 --a------ C:\Documents and Settings\Felicia Mittica\mqdmwhnt.sys
2008-03-03 01:03 . 2008-03-03 01:03 4,048 --a------ C:\Documents and Settings\Felicia Mittica\mqdmcr.sys
2008-03-03 00:43 . 2008-03-03 00:43 <DIR> d-------- C:\Documents and Settings\Felicia Mittica\Application Data\InstallShield
2008-03-03 00:36 . 2008-03-03 00:43 <DIR> d-------- C:\Program Files\Avanquest update
2008-03-03 00:34 . 2008-03-03 01:07 <DIR> d-------- C:\Program Files\Motorola Phone Tools
2008-03-03 00:34 . 2008-03-03 00:54 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\BVRP Software
2008-03-03 00:34 . 2008-03-03 01:03 25,600 --a------ C:\Documents and Settings\Felicia Mittica\usbsermptxp.sys
2008-03-03 00:34 . 2008-03-03 00:39 22,768 --a------ C:\WINDOWS\system32\drivers\usbsermpt.sys
2008-03-03 00:34 . 2008-03-03 01:03 22,768 --a------ C:\Documents and Settings\Felicia Mittica\usbsermpt.sys
2008-03-03 00:03 . 2004-08-04 00:08 25,600 --a------ C:\WINDOWS\system32\drivers\usbser.sys
2008-03-03 00:03 . 2004-08-04 00:08 25,600 --a------ C:\WINDOWS\system32\dllcache\usbser.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-03 03:41 --------- d-----w C:\Program Files\Symantec AntiVirus
2008-04-02 22:22 --------- d-----w C:\Documents and Settings\Felicia Mittica\Application Data\AdobeUM
2008-04-02 05:19 --------- d-----w C:\Documents and Settings\Felicia Mittica\Application Data\uTorrent
2008-03-21 18:50 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-03-21 18:49 --------- d-----w C:\Program Files\MSN Messenger
2008-03-21 18:45 --------- d-----w C:\Program Files\iTunes
2008-03-21 18:44 --------- d-----w C:\Program Files\Digital Line Detect
2008-03-21 18:44 --------- d-----w C:\Program Files\DellSupport
2008-03-21 18:43 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-03-21 18:41 --------- d-----w C:\Program Files\Bonjour
2008-03-21 18:41 --------- d-----w C:\Program Files\Apoint
2008-03-21 05:19 --------- d-----w C:\Program Files\LimeWire
2008-03-06 07:57 --------- d-----w C:\Program Files\uTorrent
2008-03-03 05:40 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-26 03:43 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-25 23:36 --------- d-----w C:\Program Files\Xilisoft
2008-02-25 17:51 --------- d-----w C:\Documents and Settings\Felicia Mittica\Application Data\Apple Computer
2008-02-25 17:50 --------- d-----w C:\Program Files\iPod
2008-02-25 17:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-02-25 17:49 --------- d-----w C:\Program Files\QuickTime
2008-02-25 17:45 --------- d-----w C:\Program Files\Common Files\Apple
2008-02-13 23:32 691,545 ----a-w C:\WINDOWS\unins000.exe
2008-02-13 00:42 --------- d-----w C:\Program Files\DivX
2008-01-11 05:53 44,544 ----a-w C:\WINDOWS\system32\dllcache\pngfilt.dll
2007-11-02 03:09 33,200 ----a-w C:\Documents and Settings\Felicia Mittica\Application Data\GDIPFONTCACHEV1.DAT
2006-03-17 22:56 56 --sh--r C:\WINDOWS\system32\C5CB0AD7B0.sys
2006-03-17 22:56 3,766 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 11:24 1694208]
"DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 11:09 460784]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:00 15360]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45 313472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2004-09-13 17:33 155648]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-10-14 21:49 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-10-14 21:46 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-10-14 21:50 114688]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 02:11 132496]
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2004-10-30 15:59 385024]
"PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2004-04-11 21:15 290816]
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2005-09-01 18:24 684032]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 17:19 53248]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-12-06 02:05 127035]
"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 11:44 249856]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 11:44 81920]
"ssdiag"="C:\WINDOWS\ssdiag.exe" [2004-07-14 12:28 57401]
"MSKDetectorExe"="C:\Program Files\McAfee\SpamKiller\MSKDetct.exe" [2005-08-12 17:16 1121792]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-03-24 20:14 53408]
"vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2006-05-27 04:40 124656]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-01-28 21:33 185896]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-02-01 00:13 385024]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 14:10 267048]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [ ]
"NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [ ]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696]
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2006-02-06 16:50:51 24576]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 02:01:04 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
C:\Program Files\Intel\Wireless\Bin\LgNotify.dll 2004-09-07 17:08 110592 C:\Program Files\Intel\Wireless\Bin\LgNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Internet Explorer\\iexplore.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Opera\\Opera.exe"=

R1 npapimon;npapimon;C:\WINDOWS\system32\drivers\npapimon.sys [2004-07-14 12:29]
R1 sdcplh;sdcplh;C:\WINDOWS\system32\drivers\sdcplh.sys [2005-12-15 15:10]
R1 ssdiagn;ssdiagn;C:\WINDOWS\system32\drivers\ssdiagn.sys [2004-07-14 12:28]
R2 MyDNS;Window Net Dns;C:\Program Files\Outlook Express\svchost.exe [2008-03-10 02:50]
S3 35999854-e799-4bdc-b431-60b22733eeb6;35999854-e799-4bdc-b431-60b22733eeb6;D:\Player\cds300.dll []
S3 MotDev;Motorola Inc. USB Device;C:\WINDOWS\system32\DRIVERS\motodrv.sys [2006-12-14 11:27]

.
Contents of the 'Scheduled Tasks' folder
"2008-02-13 20:32:06 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-02 22:48:02
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-04-02 22:48:51
ComboFix-quarantined-files.txt 2008-04-03 03:48:35
Pre-Run: 49,674,072,064 bytes free
Post-Run: 49,660,444,672 bytes free
.
2008-03-12 01:22:23 --- E O F ---

tetonbob · 04-02-2008, 09:03 PM

Here we go...next steps...

Leave protections disabled for now. After this next run of ComboFix, re-enable.

Did you download and install HijackThis? I'll need a new log at the end of this run.

Open notepad and copy/paste the text in the quotebox below into it:

Quote:

http://www.techsupportforum.com/security-center/hijackthis-log-help/233437-searchportal-com-computer-wont-go-away.html

Driver::
MyDNS

Collect::
C:\Program Files\Outlook Express\svchost.exe

Save this as CFScript.txt

Refering to the picture above, drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply.

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture a file to submit for analysis.

Ensure you are connected to the internet and click OK. A browser will open. Simply follow the instructions to copy/paste/send the requested file.

---------------------------------------------------------------------------------------------

Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here.

---------------------------------------------------------------------------------------------

femi · 04-02-2008, 09:23 PM

Ok this message is going to be even more involved then before...I tried to make it easier for you again

Here is my HijackThis log >>>

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:20:20 PM, on 4/2/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Apoint\Apntex.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Opera\Opera.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\deSrcAs.dll (file missing)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ssdiag] C:\WINDOWS\ssdiag.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.mail.live.com/mail/w1/re...s/MSNPUpld.cab
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/...oUploader3.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/...toUploader.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/sof...iveXPlugin.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab
O16 - DPF: {CD3E5421-3A0A-47CB-B789-7929E6F5DE33} (SecurityDetector Class) - http://radialpoint.securityadvisor.c...tyDetector.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

--
End of file - 10157 bytes

Here is the new Combofix scan >>>

ComboFix 08-04-02.1 - Felicia Mittica 2008-04-02 23:08:24.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.185 [GMT -5:00]
Running from: C:\Documents and Settings\Felicia Mittica\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Felicia Mittica\Desktop\CFScript.txt
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\Outlook Express\svchost.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_MYDNS
-------\Service_MyDNS

((((((((((((((((((((((((( Files Created from 2008-03-03 to 2008-04-03 )))))))))))))))))))))))))))))))
.

2008-03-30 15:40 . 2008-03-30 15:40 <DIR> d-------- C:\Program Files\Trend Micro
2008-03-30 12:41 . 2008-03-30 12:41 <DIR> d-------- C:\Documents and Settings\Felicia Mittica\Application Data\Grisoft
2008-03-30 12:40 . 2008-03-30 12:40 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-03-30 12:40 . 2007-05-30 07:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-03-25 20:56 . 2008-03-25 20:56 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Dell
2008-03-24 18:59 . 2008-03-24 18:59 <DIR> d-------- C:\Deckard
2008-03-21 16:31 . 2008-03-21 16:31 <DIR> d-------- C:\Program Files\Microsoft Silverlight
2008-03-21 16:29 . 2008-03-21 16:29 <DIR> d-------- C:\Program Files\MSBuild
2008-03-21 16:24 . 2008-03-21 18:42 <DIR> d-------- C:\WINDOWS\system32\XPSViewer
2008-03-21 16:22 . 2008-03-21 16:22 <DIR> d-------- C:\Program Files\Reference Assemblies
2008-03-21 16:20 . 2008-03-21 16:20 <DIR> d-------- C:\Program Files\MSXML 6.0
2008-03-21 16:20 . 2006-06-29 13:07 14,048 --------- C:\WINDOWS\system32\spmsg2.dll
2008-03-21 16:08 . 2006-11-13 01:02 288,768 --------- C:\WINDOWS\system32\rhttpaa.dll
2008-03-21 16:08 . 2006-11-13 01:02 116,736 --------- C:\WINDOWS\system32\aaclient.dll
2008-03-21 16:08 . 2006-11-13 01:02 36,352 --------- C:\WINDOWS\system32\tsgqec.dll
2008-03-21 12:55 . 2008-03-21 14:05 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2008-03-21 12:55 . 2008-03-21 12:55 30,590 --a------ C:\WINDOWS\system32\pavas.ico
2008-03-21 12:55 . 2008-03-21 12:55 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico
2008-03-21 12:55 . 2008-03-21 12:55 1,406 --a------ C:\WINDOWS\system32\Help.ico
2008-03-20 18:42 . 2008-03-20 18:42 <DIR> d-------- C:\Program Files\MSECache
2008-03-15 22:18 . 2007-03-31 12:12 <DIR> d-------- C:\Program Files\ZonedOut
2008-03-15 22:09 . 2008-04-02 22:21 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-03-15 22:08 . 2008-03-21 00:19 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-03-15 22:08 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\system32\MSINET.OCX
2008-03-15 21:44 . 2008-03-21 13:07 <DIR> d-------- C:\Program Files\Opera
2008-03-14 23:11 . 2008-04-02 17:19 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-03-14 23:11 . 2008-03-14 23:11 1,409 --a------ C:\WINDOWS\QTFont.for
2008-03-14 21:45 . 2006-02-06 16:52 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\You've Got Pictures Screensaver
2008-03-14 21:45 . 2006-02-06 16:47 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Intel
2008-03-14 21:45 . 2008-03-07 20:19 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Apple Computer
2008-03-14 12:36 . 2008-03-14 12:36 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-03-14 12:26 . 2008-03-14 12:37 <DIR> d-------- C:\Documents and Settings\Felicia Mittica\Application Data\Lavasoft
2008-03-14 12:25 . 2008-03-14 12:37 <DIR> d-------- C:\Program Files\Lavasoft
2008-03-14 12:15 . 2008-03-14 12:16 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-03-10 23:34 . 2008-03-11 22:21 <DIR> d-------- C:\Program Files\Common Files\Nero
2008-03-07 21:15 . 2004-05-25 18:06 417,792 --a------ C:\WINDOWS\system32\ac3filter.ax
2008-03-07 21:15 . 2005-02-27 22:48 356,352 --a------ C:\WINDOWS\system32\RealMediaSplitter.ax
2008-03-07 21:15 . 2004-01-10 18:02 258,048 --a------ C:\WINDOWS\system32\GplMpgDec.ax
2008-03-03 01:09 . 2008-03-03 01:09 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-03-03 01:09 . 2008-03-03 01:09 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_motmodem_01005.Wdf
2008-03-03 01:05 . 2008-03-03 01:05 <DIR> d-------- C:\Program Files\Common Files\Motorola Shared
2008-03-03 01:05 . 2006-11-13 15:45 1,419,232 --a------ C:\WINDOWS\system32\wdfcoinstaller01005.dll
2008-03-03 01:05 . 2006-12-14 11:27 40,832 --a------ C:\WINDOWS\system32\drivers\motodrv.sys
2008-03-03 01:05 . 2007-02-27 15:31 21,504 --a------ C:\WINDOWS\system32\drivers\motmodem.sys
2008-03-03 01:03 . 2008-03-03 01:03 92,064 --a------ C:\Documents and Settings\Felicia Mittica\mqdmmdm.sys
2008-03-03 01:03 . 2008-03-03 01:03 79,328 --a------ C:\Documents and Settings\Felicia Mittica\mqdmserd.sys
2008-03-03 01:03 . 2008-03-03 01:03 66,656 --a------ C:\Documents and Settings\Felicia Mittica\mqdmbus.sys
2008-03-03 01:03 . 2008-03-03 01:03 9,232 --a------ C:\Documents and Settings\Felicia Mittica\mqdmmdfl.sys
2008-03-03 01:03 . 2008-03-03 01:03 6,208 --a------ C:\Documents and Settings\Felicia Mittica\mqdmcmnt.sys
2008-03-03 01:03 . 2008-03-03 01:03 5,936 --a------ C:\Documents and Settings\Felicia Mittica\mqdmwhnt.sys
2008-03-03 01:03 . 2008-03-03 01:03 4,048 --a------ C:\Documents and Settings\Felicia Mittica\mqdmcr.sys
2008-03-03 00:43 . 2008-03-03 00:43 <DIR> d-------- C:\Documents and Settings\Felicia Mittica\Application Data\InstallShield
2008-03-03 00:36 . 2008-03-03 00:43 <DIR> d-------- C:\Program Files\Avanquest update
2008-03-03 00:34 . 2008-03-03 01:07 <DIR> d-------- C:\Program Files\Motorola Phone Tools
2008-03-03 00:34 . 2008-03-03 00:54 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\BVRP Software
2008-03-03 00:34 . 2008-03-03 01:03 25,600 --a------ C:\Documents and Settings\Felicia Mittica\usbsermptxp.sys
2008-03-03 00:34 . 2008-03-03 00:39 22,768 --a------ C:\WINDOWS\system32\drivers\usbsermpt.sys
2008-03-03 00:34 . 2008-03-03 01:03 22,768 --a------ C:\Documents and Settings\Felicia Mittica\usbsermpt.sys
2008-03-03 00:03 . 2004-08-04 00:08 25,600 --a------ C:\WINDOWS\system32\drivers\usbser.sys
2008-03-03 00:03 . 2004-08-04 00:08 25,600 --a------ C:\WINDOWS\system32\dllcache\usbser.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-03 04:11 --------- d-----w C:\Program Files\Symantec AntiVirus
2008-04-02 22:22 --------- d-----w C:\Documents and Settings\Felicia Mittica\Application Data\AdobeUM
2008-04-02 05:19 --------- d-----w C:\Documents and Settings\Felicia Mittica\Application Data\uTorrent
2008-03-21 18:50 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-03-21 18:49 --------- d-----w C:\Program Files\MSN Messenger
2008-03-21 18:45 --------- d-----w C:\Program Files\iTunes
2008-03-21 18:44 --------- d-----w C:\Program Files\Digital Line Detect
2008-03-21 18:44 --------- d-----w C:\Program Files\DellSupport
2008-03-21 18:43 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-03-21 18:41 --------- d-----w C:\Program Files\Bonjour
2008-03-21 18:41 --------- d-----w C:\Program Files\Apoint
2008-03-21 05:19 --------- d-----w C:\Program Files\LimeWire
2008-03-06 07:57 --------- d-----w C:\Program Files\uTorrent
2008-03-03 05:40 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-26 03:43 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-25 23:36 --------- d-----w C:\Program Files\Xilisoft
2008-02-25 17:51 --------- d-----w C:\Documents and Settings\Felicia Mittica\Application Data\Apple Computer
2008-02-25 17:50 --------- d-----w C:\Program Files\iPod
2008-02-25 17:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-02-25 17:49 --------- d-----w C:\Program Files\QuickTime
2008-02-25 17:45 --------- d-----w C:\Program Files\Common Files\Apple
2008-02-13 23:32 691,545 ----a-w C:\WINDOWS\unins000.exe
2008-02-13 00:42 --------- d-----w C:\Program Files\DivX
2007-11-02 03:09 33,200 ----a-w C:\Documents and Settings\Felicia Mittica\Application Data\GDIPFONTCACHEV1.DAT
2006-03-17 22:56 56 --sh--r C:\WINDOWS\system32\C5CB0AD7B0.sys
2006-03-17 22:56 3,766 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((( snapshot@2008-04-02_22.48.28.04 )))))))))))))))))))))))))))))))))))))))))
.
+ 2000-08-31 13:00:00 163,328 ----a-w C:\WINDOWS\ERDNT\subs\ERDNT.EXE
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 11:24 1694208]
"DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 11:09 460784]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:00 15360]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45 313472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2004-09-13 17:33 155648]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-10-14 21:49 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-10-14 21:46 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-10-14 21:50 114688]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 02:11 132496]
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2004-10-30 15:59 385024]
"PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2004-04-11 21:15 290816]
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2005-09-01 18:24 684032]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 17:19 53248]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-12-06 02:05 127035]
"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 11:44 249856]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 11:44 81920]
"ssdiag"="C:\WINDOWS\ssdiag.exe" [2004-07-14 12:28 57401]
"MSKDetectorExe"="C:\Program Files\McAfee\SpamKiller\MSKDetct.exe" [2005-08-12 17:16 1121792]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-03-24 20:14 53408]
"vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2006-05-27 04:40 124656]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-01-28 21:33 185896]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-02-01 00:13 385024]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 14:10 267048]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [ ]
"NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [ ]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696]
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2006-02-06 16:50:51 24576]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 02:01:04 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
C:\Program Files\Intel\Wireless\Bin\LgNotify.dll 2004-09-07 17:08 110592 C:\Program Files\Intel\Wireless\Bin\LgNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Internet Explorer\\iexplore.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Opera\\Opera.exe"=

R1 npapimon;npapimon;C:\WINDOWS\system32\drivers\npapimon.sys [2004-07-14 12:29]
R1 sdcplh;sdcplh;C:\WINDOWS\system32\drivers\sdcplh.sys [2005-12-15 15:10]
R1 ssdiagn;ssdiagn;C:\WINDOWS\system32\drivers\ssdiagn.sys [2004-07-14 12:28]
S3 35999854-e799-4bdc-b431-60b22733eeb6;35999854-e799-4bdc-b431-60b22733eeb6;D:\Player\cds300.dll []
S3 MotDev;Motorola Inc. USB Device;C:\WINDOWS\system32\DRIVERS\motodrv.sys [2006-12-14 11:27]

.
Contents of the 'Scheduled Tasks' folder
"2008-02-13 20:32:06 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-02 23:13:20
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Apoint\Apntex.exe
.
**************************************************************************
.
Completion time: 2008-04-02 23:16:19 - machine was rebooted
ComboFix-quarantined-files.txt 2008-04-03 04:16:12
ComboFix2.txt 2008-04-03 03:48:51
Pre-Run: 49,877,250,048 bytes free
Post-Run: 49,824,055,296 bytes free
.
2008-03-12 01:22:23 --- E O F ---

tetonbob · 04-02-2008, 09:32 PM

Great, thanks for uploading the file. Please locate the zip file, and delete it from your desktop.

Next....

Open HijackThis and click on 'Do a System Scan Only'. Check the following entries if they exist (make sure you do not miss any) and click Fix Checked

R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\deSrcAs.dll (file missing)

Close HijackThis now.

---------------------------------------------------------------------------------------------

Locate and delete this folder if present:

C:\Program Files\MyWaySA

---------------------------------------------------------------------------------------------

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

Download the latest version of Java Runtime Environment (JRE) 6 Update 5 and save it to your desktop.
Scroll down to where it says "The Java SE Runtime Environment (JRE) allows end-users to run Java applications."
Click the "Download" button to the right.
Read the License Agreement and then check the box that says: "Accept License Agreement". The page will refresh.
Click on the link to download Windows Offline Installation and save the file to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u5-windows-i586-p.exe to install the newest version.

After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
- On the General tab, under Temporary Internet Files, click the Settings button.
- Next, click on the Delete Files button
- There are two options in the window to clear the cache - Leave BOTH Checked
  - Applications and Applets
    Trace and Log Files
- Click OK on Delete Temporary Files Window
  Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
- Click OK to leave the Temporary Files Window
- Click OK to leave the Java Control Panel.

---------------------------------------------------------------------------------------------

Please run this online scan to help look for remnants.

First, Go to Start>Control Panel>Add/Remove Programs and remove Kaspersky online scanner if present prior to downloading the most up-to-date one.

Next, establish an internet connection & perform an online scan using Internet Explorer at Kaspersky Online Scanner

Answer Yes, when prompted to install an ActiveX component.

The program will then begin downloading the latest definition files.
Once the files have been downloaded click on NEXT
Locate the Scan Settings button & configure to:
- Scan using the following Anti-Virus database:
  - Extended
- Scan Options:
  - Scan Archives
  - Scan Mail Bases
Click OK & have it scan My Computer
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

* Turn off the real time scanner of any existing antivirus program while performing the online scan

Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%.

---------------------------------------------------------------------------------------------

Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here.

---------------------------------------------------------------------------------------------

Let me know how the machine is behaving.

femi · 04-02-2008, 09:55 PM

One tiny problem - My computer wont let me uninstall any of the old versions of Java - There are no Add/Remove programs" buttons on it.. i dont know why...

tetonbob · 04-02-2008, 10:01 PM

just install the new version for now, and we'll address that later. Java insists they patch the older versions; we also suggest removing them as they take a lot of space.

femi · 04-03-2008, 06:09 AM

Hey there - so i just re-started my computer and nothing had popped up as of yet - eveything seems to be ok!

Here are the logs:

Hijack this >>

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:45:06 AM, on 4/3/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Opera\Opera.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ssdiag] C:\WINDOWS\ssdiag.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.mail.live.com/mail/w1/re...s/MSNPUpld.cab
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/...oUploader3.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/...toUploader.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/sof...iveXPlugin.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab
O16 - DPF: {CD3E5421-3A0A-47CB-B789-7929E6F5DE33} (SecurityDetector Class) - http://radialpoint.securityadvisor.c...tyDetector.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

--
End of file - 10199 bytes

Kaspersky Scan >>

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Thursday, April 03, 2008 7:38:17 AM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 3/04/2008
Kaspersky Anti-Virus database records: 679225
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\

Scan Statistics:
Total number of scanned objects: 75955
Number of viruses found: 4
Number of infected objects: 10
Number of suspicious objects: 0
Duration of the scan process: 01:22:37

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\QSLLPSVCShare Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09A80000\4FABD6DD.VBN Infected: Exploit.JS.Agent.fd skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09A80001\4FABD6F4.VBN Infected: Exploit.JS.Agent.fd skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09A80002\4FABD6FE.VBN Infected: Exploit.JS.Agent.fd skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09A80003\4FABD708.VBN Infected: Exploit.JS.Agent.fd skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09A80004\4FABD712.VBN Infected: Exploit.JS.Agent.fd skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0B980000.VBN Infected: Exploit.HTML.IESlice.z skipped
C:\Documents and Settings\Felicia Mittica\Application Data\Opera\Opera\mail\indexer\indexer.dat Object is locked skipped
C:\Documents and Settings\Felicia Mittica\Application Data\Opera\Opera\mail\lexicon\lexicon.dat Object is locked skipped
C:\Documents and Settings\Felicia Mittica\Application Data\Opera\Opera\mail\mailbase.dat Object is locked skipped
C:\Documents and Settings\Felicia Mittica\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Felicia Mittica\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Felicia Mittica\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Felicia Mittica\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Felicia Mittica\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Felicia Mittica\ntuser.dat Object is locked skipped
C:\Documents and Settings\Felicia Mittica\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\EENGINE\EPERSIST.DAT Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBConfig.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBDebug.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBDetect.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBNotify.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBRefr.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetCfg.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetCfg2.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetDev.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetLoc.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetUsr.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMNot.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMReg.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMRSt.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBStHash.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBStMSI.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBValid.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPPolicy.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPStart.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPStop.log Object is locked skipped
C:\Program Files\Symantec AntiVirus\SAVRT\0285NAV~.TMP Object is locked skipped
C:\Program Files\Symantec AntiVirus\SAVRT\0502NAV~.TMP Object is locked skipped
C:\RECYCLER\S-1-5-21-3820244732-731631674-3984864858-1006\Dc1.zip/svchost.exe Infected: Trojan.Win32.Delf.bhp skipped
C:\RECYCLER\S-1-5-21-3820244732-731631674-3984864858-1006\Dc1.zip ZIP: infected - 1 skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP429\A0061405.exe/Toolbar.exe Infected: not-a-virus:AdTool.Win32.MyWebSearch.bm skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP429\A0061405.exe 7-Zip: infected - 1 skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP449\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\DEFAULT Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SYSTEM Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.

tetonbob · 04-03-2008, 08:29 AM

Open NOTEPAD.exe and copy/paste the text in the codebox below into it:

Code:

@echo off
if exist "%temp%\log.txt" del "%temp%\log.txt"

for %%g in (

"C:\RECYCLER\S-1-5-21-3820244732-731631674-3984864858-1006\Dc1.zip"

) do (
del /a/f %%g >nul 2>&1
if exist %%g echo.%%g>>"%temp%\log.txt"
)

for %%g in (

%systemdrive%\Deckard

) do (
rd /s/q %%g >nul 2>&1
if exist %%g echo.%%g>>"%temp%\log.txt"
)
if exist "%temp%\log.txt" ( start notepad "%temp%\log.txt"
) else echo.Deleted Successfully !!

pause
del %0

Save this as fix.bat Choose to "Save type as - All Files"
It should look like this:

Double click on fix.bat & allow it to run

Post back to tell me what it says

femi · 04-03-2008, 08:43 PM

it says "Deleted Sucessfully!"

.. now i think this is a good thing, yes? :D

tetonbob · 04-03-2008, 09:25 PM

It is, indeed.

Now let's see if we can get back to the Java issue.

Can you uninstall the old ones now, or are they greyed out still?

femi · 04-03-2008, 09:31 PM

The only one with a remove button is the most recent installation, and Java DB 10.3.1.4 >> (should i remove that now?). The rest are still greyed out...

03-27-2008, 08:51 PM	#2 (permalink)
femi Registered User Join Date: Mar 2008 Location: Canada! Posts: 28 OS: Windows xp	Re: Searchportal.com on Computer and Wont Go Away! :( ... would someone please help? thanks! __________________ ~ Be Happy ~

03-30-2008, 09:07 AM	#3 (permalink)
femi Registered User Join Date: Mar 2008 Location: Canada! Posts: 28 OS: Windows xp	Re: Searchportal.com on Computer and Wont Go Away! :( Bump :( __________________ ~ Be Happy ~

04-01-2008, 09:04 AM	#4 (permalink)
femi Registered User Join Date: Mar 2008 Location: Canada! Posts: 28 OS: Windows xp	Re: Searchportal.com on Computer and Wont Go Away! :( Bump! bumpity bump bump.. __________________ ~ Be Happy ~

04-01-2008, 01:50 PM	#5 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 35,524 OS: 2000 Pro; XP Pro; XP Home	Re: Searchportal.com on Computer and Wont Go Away! :( Hi, sorry for any delay in replying, but this section of the forum is extremely busy. If you still need assistance for this issue, plesae do this first: Please go to: VirusTotal On the page you'll find a "Browse" button. Next to the browse button you'll see a box to enter text. Please copy/paste the following in BOLD: c:\program files\outlook express\svchost.exe Then click the "Send File " button just below. This will scan the file. Please be patient. Once scanned, copy and paste the results in your next reply. Edit: Please also let the folks at Daniweb know you'll no longer be needing assistance. Any other forums at which you might have posted, please inform them as well if you'll be using my assistance. This will stop another helper elsewhere from reviewing the same log, and spend time helping someone else. Thanks. __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009 Last edited by tetonbob; 04-01-2008 at 01:56 PM.

04-01-2008, 08:45 PM	#6 (permalink)
femi Registered User Join Date: Mar 2008 Location: Canada! Posts: 28 OS: Windows xp	Re: Searchportal.com on Computer and Wont Go Away! :( Thanks soo much for answering! :D Here are the results.. I tried getting them into a neat table, all to no avail sadly :( And yes, i'll let everyone know that you are helping me! ile svchost.exe received on 03.28.2008 13:48:34 (CET) Antivirus Version Last Update Result AhnLab-V3 2008.3.26.0 2008.03.28 - AntiVir 7.6.0.78 2008.03.28 TR/Delf.bhp Authentium 4.93.8 2008.03.28 - Avast 4.7.1098.0 2008.03.28 - AVG 7.5.0.516 2008.03.27 Generic10.BJZ BitDefender 7.2 2008.03.28 - CAT-QuickHeal 9.50 2008.03.28 Trojan.Delf.bhp ClamAV 0.92.1 2008.03.28 - DrWeb 4.44.0.09170 2008.03.28 Trojan.LowZones.815 eSafe 7.0.15.0 2008.03.18 - eTrust-Vet 31.3.5651 2008.03.28 - Ewido 4.0 2008.03.28 - FileAdvisor 1 2008.03.28 High threat detected Fortinet 3.14.0.0 2008.03.28 W32/Delf.BHP!tr F-Prot 4.4.2.54 2008.03.27 W32/Trojan2.AHAR F-Secure 6.70.13260.0 2008.03.28 Trojan.Win32.Delf.bhp Ikarus T3.1.1.20 2008.03.28 - Kaspersky 7.0.0.125 2008.03.28 Trojan.Win32.Delf.bhp McAfee 5261 2008.03.27 - Microsoft 1.3301 2008.03.28 Trojan:Win32/Delf.RAX NOD32v2 2981 2008.03.28 - Norman 5.80.02 2008.03.26 W32/Delf.BQIJ Panda 9.0.0.4 2008.03.28 - Prevx1 V2 2008.03.28 Generic10.BJZ Rising 20.37.41.00 2008.03.28 - Sophos 4.27.0 2008.03.28 Mal/Behav-053 Sunbelt 3.0.978.0 2008.03.18 - Symantec 10 2008.03.28 - TheHacker 6.2.92.257 2008.03.27 - VBA32 3.12.6.3 2008.03.25 Trojan.Win32.Delf.bhp VirusBuster 4.3.26:9 2008.03.27 - Webwasher-Gateway 6.6.2 2008.03.28 Trojan.Delf.bhp Additional information File size: 493056 bytes MD5: 6b13319c54ca4cc64682209a60226cc2 SHA1: b4bd9c54be19da997335f5b5ccd9e2427465c17f PEiD: - Bit9 info: http://fileadvisor.bit9.com/services...82209a60226cc2 Prevx info: http://info.prevx.com/aboutprogramte...903700EC9A2CCB __________________ ~ Be Happy ~

04-01-2008, 08:52 PM	#7 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 35,524 OS: 2000 Pro; XP Pro; XP Home	Re: Searchportal.com on Computer and Wont Go Away! :( Ok, thanks....I knew that was a nasty, I wanted to see how well detected it was. As you can see Symantec does not have it in their definitions...no worries, I can read that mess. It's how all VirusTotal logs get posted We'll begin with ComboFix. Please visit this webpage for instructions for downloading and running ComboFix: http://www.bleepingcomputer.com/comb...o-use-combofix Please ensure you read this guide carefully and install the Recovery Console first. The Windows Recovery Console will allow you to boot up into a special recovery mode that allows us to help you in the case that your computer has a problem after an attempted removal of malware. If you have any questions along the way, STOP and ask them before proceeding. Post the log from ComboFix when you've accomplished that, along with a new HijackThis log. It does not appear as though DSS was allowed to download and install HijackThis. To produce a HijackThis log for your next reply, please do this: Please download HijackThis to your desktop Alternate link Double-click on the file you just downloaded. Click on the "Unzip" button to install. It will by default install to the directory - C:\Program Files\Trend Micro\HijackThis Upon install, HijackThis should open for you. Should it not open, navigate to C:\Program Files\Trend Micro\HijackThis and double click on HijackThis.exe 1. If it gives you an intro screen, just choose 'Do a system scan and save a logfile'. 2. If you don't get the intro screen, just hit Scan and then click on Save log. 3. Post the hijackthis.log file here. Do not fix anything in HijackThis since they may be harmless. --------------------------------------------------------------------------------------------- __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009

04-02-2008, 05:06 PM	#8 (permalink)
femi Registered User Join Date: Mar 2008 Location: Canada! Posts: 28 OS: Windows xp	Re: Searchportal.com on Computer and Wont Go Away! :( Hello! A bit of a problem :( I was going to install the Windows recovery console- however, it requires the use of the Windows Xp CD Rom, which I do not have! My laptop is a Dell computer- which means that they shipped it to me with all of the programs all ready installed on it - but no cd's or a hard copy of the actuall programs that are on my computer. So, I was wondering if i can still run Combofix without creating the windows Recovery Console... or would that be a very bad idea? (i'm thinking it is..) If that is the case, and I do need the cd, then would I have to call Dell and ask them to send me the cd? What do i do! ? :S (thanks!) __________________ ~ Be Happy ~

04-02-2008, 08:56 PM	#10 (permalink)
femi Registered User Join Date: Mar 2008 Location: Canada! Posts: 28 OS: Windows xp	Re: Searchportal.com on Computer and Wont Go Away! :( I do believe that you are a genius! why I had not thought of reading all instructions all the way i do not know.. anyways, did what you said and here is the log of Combofix (quite large!) also, before doing this scan i had to disable all of my antivirus/anti-spyware programs - do i re-enable them all now, or would it be more practical for me to keep them off untill i totally finish fixing this problem?? thanks :) ComboFix 08-04-02.1 - Felicia Mittica 2008-04-02 22:45:37.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.193 [GMT -5:00] Running from: C:\Documents and Settings\Felicia Mittica\Desktop\ComboFix.exe . ((((((((((((((((((((((((( Files Created from 2008-03-03 to 2008-04-03 ))))))))))))))))))))))))))))))) . 2008-03-30 15:40 . 2008-03-30 15:40 <DIR> d-------- C:\Program Files\Trend Micro 2008-03-30 12:41 . 2008-03-30 12:41 <DIR> d-------- C:\Documents and Settings\Felicia Mittica\Application Data\Grisoft 2008-03-30 12:40 . 2008-03-30 12:40 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2008-03-30 12:40 . 2007-05-30 07:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2008-03-25 20:56 . 2008-03-25 20:56 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Dell 2008-03-24 18:59 . 2008-03-24 18:59 <DIR> d-------- C:\Deckard 2008-03-21 16:31 . 2008-03-21 16:31 <DIR> d-------- C:\Program Files\Microsoft Silverlight 2008-03-21 16:29 . 2008-03-21 16:29 <DIR> d-------- C:\Program Files\MSBuild 2008-03-21 16:24 . 2008-03-21 18:42 <DIR> d-------- C:\WINDOWS\system32\XPSViewer 2008-03-21 16:22 . 2008-03-21 16:22 <DIR> d-------- C:\Program Files\Reference Assemblies 2008-03-21 16:20 . 2008-03-21 16:20 <DIR> d-------- C:\Program Files\MSXML 6.0 2008-03-21 16:20 . 2006-06-29 13:07 14,048 --------- C:\WINDOWS\system32\spmsg2.dll 2008-03-21 16:08 . 2006-11-13 01:02 288,768 --------- C:\WINDOWS\system32\rhttpaa.dll 2008-03-21 16:08 . 2006-11-13 01:02 116,736 --------- C:\WINDOWS\system32\aaclient.dll 2008-03-21 16:08 . 2006-11-13 01:02 36,352 --------- C:\WINDOWS\system32\tsgqec.dll 2008-03-21 12:55 . 2008-03-21 14:05 <DIR> d-------- C:\WINDOWS\system32\ActiveScan 2008-03-21 12:55 . 2008-03-21 12:55 30,590 --a------ C:\WINDOWS\system32\pavas.ico 2008-03-21 12:55 . 2008-03-21 12:55 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico 2008-03-21 12:55 . 2008-03-21 12:55 1,406 --a------ C:\WINDOWS\system32\Help.ico 2008-03-20 18:42 . 2008-03-20 18:42 <DIR> d-------- C:\Program Files\MSECache 2008-03-15 22:18 . 2007-03-31 12:12 <DIR> d-------- C:\Program Files\ZonedOut 2008-03-15 22:09 . 2008-04-02 22:21 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-03-15 22:08 . 2008-03-21 00:19 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-03-15 22:08 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\system32\MSINET.OCX 2008-03-15 21:44 . 2008-03-21 13:07 <DIR> d-------- C:\Program Files\Opera 2008-03-14 23:11 . 2008-04-02 17:19 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-03-14 23:11 . 2008-03-14 23:11 1,409 --a------ C:\WINDOWS\QTFont.for 2008-03-14 21:45 . 2006-02-06 16:52 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\You've Got Pictures Screensaver 2008-03-14 21:45 . 2006-02-06 16:47 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Intel 2008-03-14 21:45 . 2008-03-07 20:19 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Apple Computer 2008-03-14 12:36 . 2008-03-14 12:36 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-03-14 12:26 . 2008-03-14 12:37 <DIR> d-------- C:\Documents and Settings\Felicia Mittica\Application Data\Lavasoft 2008-03-14 12:25 . 2008-03-14 12:37 <DIR> d-------- C:\Program Files\Lavasoft 2008-03-14 12:15 . 2008-03-14 12:16 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-03-10 23:34 . 2008-03-11 22:21 <DIR> d-------- C:\Program Files\Common Files\Nero 2008-03-07 21:15 . 2004-05-25 18:06 417,792 --a------ C:\WINDOWS\system32\ac3filter.ax 2008-03-07 21:15 . 2005-02-27 22:48 356,352 --a------ C:\WINDOWS\system32\RealMediaSplitter.ax 2008-03-07 21:15 . 2004-01-10 18:02 258,048 --a------ C:\WINDOWS\system32\GplMpgDec.ax 2008-03-03 01:09 . 2008-03-03 01:09 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf 2008-03-03 01:09 . 2008-03-03 01:09 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_motmodem_01005.Wdf 2008-03-03 01:05 . 2008-03-03 01:05 <DIR> d-------- C:\Program Files\Common Files\Motorola Shared 2008-03-03 01:05 . 2006-11-13 15:45 1,419,232 --a------ C:\WINDOWS\system32\wdfcoinstaller01005.dll 2008-03-03 01:05 . 2006-12-14 11:27 40,832 --a------ C:\WINDOWS\system32\drivers\motodrv.sys 2008-03-03 01:05 . 2007-02-27 15:31 21,504 --a------ C:\WINDOWS\system32\drivers\motmodem.sys 2008-03-03 01:03 . 2008-03-03 01:03 92,064 --a------ C:\Documents and Settings\Felicia Mittica\mqdmmdm.sys 2008-03-03 01:03 . 2008-03-03 01:03 79,328 --a------ C:\Documents and Settings\Felicia Mittica\mqdmserd.sys 2008-03-03 01:03 . 2008-03-03 01:03 66,656 --a------ C:\Documents and Settings\Felicia Mittica\mqdmbus.sys 2008-03-03 01:03 . 2008-03-03 01:03 9,232 --a------ C:\Documents and Settings\Felicia Mittica\mqdmmdfl.sys 2008-03-03 01:03 . 2008-03-03 01:03 6,208 --a------ C:\Documents and Settings\Felicia Mittica\mqdmcmnt.sys 2008-03-03 01:03 . 2008-03-03 01:03 5,936 --a------ C:\Documents and Settings\Felicia Mittica\mqdmwhnt.sys 2008-03-03 01:03 . 2008-03-03 01:03 4,048 --a------ C:\Documents and Settings\Felicia Mittica\mqdmcr.sys 2008-03-03 00:43 . 2008-03-03 00:43 <DIR> d-------- C:\Documents and Settings\Felicia Mittica\Application Data\InstallShield 2008-03-03 00:36 . 2008-03-03 00:43 <DIR> d-------- C:\Program Files\Avanquest update 2008-03-03 00:34 . 2008-03-03 01:07 <DIR> d-------- C:\Program Files\Motorola Phone Tools 2008-03-03 00:34 . 2008-03-03 00:54 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\BVRP Software 2008-03-03 00:34 . 2008-03-03 01:03 25,600 --a------ C:\Documents and Settings\Felicia Mittica\usbsermptxp.sys 2008-03-03 00:34 . 2008-03-03 00:39 22,768 --a------ C:\WINDOWS\system32\drivers\usbsermpt.sys 2008-03-03 00:34 . 2008-03-03 01:03 22,768 --a------ C:\Documents and Settings\Felicia Mittica\usbsermpt.sys 2008-03-03 00:03 . 2004-08-04 00:08 25,600 --a------ C:\WINDOWS\system32\drivers\usbser.sys 2008-03-03 00:03 . 2004-08-04 00:08 25,600 --a------ C:\WINDOWS\system32\dllcache\usbser.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-04-03 03:41 --------- d-----w C:\Program Files\Symantec AntiVirus 2008-04-02 22:22 --------- d-----w C:\Documents and Settings\Felicia Mittica\Application Data\AdobeUM 2008-04-02 05:19 --------- d-----w C:\Documents and Settings\Felicia Mittica\Application Data\uTorrent 2008-03-21 18:50 --------- d-----w C:\Program Files\Spybot - Search & Destroy 2008-03-21 18:49 --------- d-----w C:\Program Files\MSN Messenger 2008-03-21 18:45 --------- d-----w C:\Program Files\iTunes 2008-03-21 18:44 --------- d-----w C:\Program Files\Digital Line Detect 2008-03-21 18:44 --------- d-----w C:\Program Files\DellSupport 2008-03-21 18:43 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-03-21 18:41 --------- d-----w C:\Program Files\Bonjour 2008-03-21 18:41 --------- d-----w C:\Program Files\Apoint 2008-03-21 05:19 --------- d-----w C:\Program Files\LimeWire 2008-03-06 07:57 --------- d-----w C:\Program Files\uTorrent 2008-03-03 05:40 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-02-26 03:43 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-02-25 23:36 --------- d-----w C:\Program Files\Xilisoft 2008-02-25 17:51 --------- d-----w C:\Documents and Settings\Felicia Mittica\Application Data\Apple Computer 2008-02-25 17:50 --------- d-----w C:\Program Files\iPod 2008-02-25 17:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer 2008-02-25 17:49 --------- d-----w C:\Program Files\QuickTime 2008-02-25 17:45 --------- d-----w C:\Program Files\Common Files\Apple 2008-02-13 23:32 691,545 ----a-w C:\WINDOWS\unins000.exe 2008-02-13 00:42 --------- d-----w C:\Program Files\DivX 2008-01-11 05:53 44,544 ----a-w C:\WINDOWS\system32\dllcache\pngfilt.dll 2007-11-02 03:09 33,200 ----a-w C:\Documents and Settings\Felicia Mittica\Application Data\GDIPFONTCACHEV1.DAT 2006-03-17 22:56 56 --sh--r C:\WINDOWS\system32\C5CB0AD7B0.sys 2006-03-17 22:56 3,766 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 11:24 1694208] "DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 11:09 460784] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:00 15360] "updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45 313472] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Apoint"="C:\Program Files\Apoint\Apoint.exe" [2004-09-13 17:33 155648] "igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-10-14 21:49 94208] "igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-10-14 21:46 77824] "igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-10-14 21:50 114688] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 02:11 132496] "IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2004-10-30 15:59 385024] "PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2004-04-11 21:15 290816] "Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2005-09-01 18:24 684032] "DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 17:19 53248] "dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-12-06 02:05 127035] "ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 11:44 249856] "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 11:44 81920] "ssdiag"="C:\WINDOWS\ssdiag.exe" [2004-07-14 12:28 57401] "MSKDetectorExe"="C:\Program Files\McAfee\SpamKiller\MSKDetct.exe" [2005-08-12 17:16 1121792] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-03-24 20:14 53408] "vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2006-05-27 04:40 124656] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-01-28 21:33 185896] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-02-01 00:13 385024] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 14:10 267048] "NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [ ] "NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [ ] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696] Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2006-02-06 16:50:51 24576] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 02:01:04 83360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless] C:\Program Files\Intel\Wireless\Bin\LgNotify.dll 2004-09-07 17:08 110592 C:\Program Files\Intel\Wireless\Bin\LgNotify.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"= "C:\\Program Files\\MSN Messenger\\livecall.exe"= "C:\\Program Files\\Real\\RealPlayer\\realplay.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\Internet Explorer\\iexplore.exe"= "C:\\Program Files\\Bonjour\\mDNSResponder.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\Program Files\\Opera\\Opera.exe"= R1 npapimon;npapimon;C:\WINDOWS\system32\drivers\npapimon.sys [2004-07-14 12:29] R1 sdcplh;sdcplh;C:\WINDOWS\system32\drivers\sdcplh.sys [2005-12-15 15:10] R1 ssdiagn;ssdiagn;C:\WINDOWS\system32\drivers\ssdiagn.sys [2004-07-14 12:28] R2 MyDNS;Window Net Dns;C:\Program Files\Outlook Express\svchost.exe [2008-03-10 02:50] S3 35999854-e799-4bdc-b431-60b22733eeb6;35999854-e799-4bdc-b431-60b22733eeb6;D:\Player\cds300.dll [] S3 MotDev;Motorola Inc. USB Device;C:\WINDOWS\system32\DRIVERS\motodrv.sys [2006-12-14 11:27] . Contents of the 'Scheduled Tasks' folder "2008-02-13 20:32:06 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************ catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-04-02 22:48:02 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************ . Completion time: 2008-04-02 22:48:51 ComboFix-quarantined-files.txt 2008-04-03 03:48:35 Pre-Run: 49,674,072,064 bytes free Post-Run: 49,660,444,672 bytes free . 2008-03-12 01:22:23 --- E O F --- __________________ ~ Be Happy ~ Last edited by femi; 04-02-2008 at 08:58 PM.

04-02-2008, 09:32 PM	#13 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 35,524 OS: 2000 Pro; XP Pro; XP Home	Re: Searchportal.com on Computer and Wont Go Away! :( Great, thanks for uploading the file. Please locate the zip file, and delete it from your desktop. Next.... Open HijackThis and click on 'Do a System Scan Only'. Check the following entries if they exist (make sure you do not miss any) and click Fix Checked R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\deSrcAs.dll (file missing) Close HijackThis now. --------------------------------------------------------------------------------------------- Locate and delete this folder if present: C:\Program Files\MyWaySA --------------------------------------------------------------------------------------------- Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update. Download the latest version of Java Runtime Environment (JRE) 6 Update 5 and save it to your desktop. Scroll down to where it says "The Java SE Runtime Environment (JRE) allows end-users to run Java applications." Click the "Download" button to the right. Read the License Agreement and then check the box that says: "Accept License Agreement". The page will refresh. Click on the link to download Windows Offline Installation and save the file to your desktop. Close any programs you may have running - especially your web browser. Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java. Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name. Click the Remove or Change/Remove button. Repeat as many times as necessary to remove each Java versions. Reboot your computer once all Java components are removed. Then from your desktop double-click on jre-6u5-windows-i586-p.exe to install the newest version. After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup) On the General tab, under Temporary Internet Files, click the Settings button. Next, click on the Delete Files button There are two options in the window to clear the cache - Leave BOTH Checked Applications and Applets Trace and Log Files Click OK on Delete Temporary Files Window Note: This deletes ALL the Downloaded Applications and Applets from the CACHE. Click OK to leave the Temporary Files Window Click OK to leave the Java Control Panel. --------------------------------------------------------------------------------------------- Please run this online scan to help look for remnants. First, Go to Start>Control Panel>Add/Remove Programs and remove Kaspersky online scanner if present prior to downloading the most up-to-date one. Next, establish an internet connection & perform an online scan using Internet Explorer at Kaspersky Online Scanner Answer Yes, when prompted to install an ActiveX component. The program will then begin downloading the latest definition files. Once the files have been downloaded click on NEXT Locate the Scan Settings button & configure to: Scan using the following Anti-Virus database: Extended Scan Options: Scan Archives Scan Mail Bases Click OK & have it scan My Computer Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it. Click the Save as Text button to save the file to your desktop so that you may post it in your next reply * Turn off the real time scanner of any existing antivirus program while performing the online scan Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%. --------------------------------------------------------------------------------------------- Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here. --------------------------------------------------------------------------------------------- Let me know how the machine is behaving. __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009

04-02-2008, 09:55 PM	#14 (permalink)
femi Registered User Join Date: Mar 2008 Location: Canada! Posts: 28 OS: Windows xp	Re: Searchportal.com on Computer and Wont Go Away! :( One tiny problem - My computer wont let me uninstall any of the old versions of Java - There are no Add/Remove programs" buttons on it.. i dont know why... __________________ ~ Be Happy ~

04-02-2008, 10:01 PM	#15 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 35,524 OS: 2000 Pro; XP Pro; XP Home	Re: Searchportal.com on Computer and Wont Go Away! :( just install the new version for now, and we'll address that later. Java insists they patch the older versions; we also suggest removing them as they take a lot of space. __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009

04-03-2008, 06:09 AM	#16 (permalink)
femi Registered User Join Date: Mar 2008 Location: Canada! Posts: 28 OS: Windows xp	Re: Searchportal.com on Computer and Wont Go Away! :( Hey there - so i just re-started my computer and nothing had popped up as of yet - eveything seems to be ok! Here are the logs: Hijack this >> Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 7:45:06 AM, on 4/3/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16608) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Symantec AntiVirus\DefWatch.exe C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\Program Files\Symantec AntiVirus\Rtvscan.exe C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Apoint\Apoint.exe C:\WINDOWS\explorer.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Apoint\Apntex.exe C:\Program Files\Opera\Opera.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = .local O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe" O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [ssdiag] C:\WINDOWS\ssdiag.exe O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9 O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Digital Line Detect.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing) O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.mail.live.com/mail/w1/re...s/MSNPUpld.cab O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/...oUploader3.cab O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/...toUploader.cab O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/sof...iveXPlugin.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab O16 - DPF: {CD3E5421-3A0A-47CB-B789-7929E6F5DE33} (SecurityDetector Class) - http://radialpoint.securityadvisor.c...tyDetector.cab O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe -- End of file - 10199 bytes Kaspersky Scan >> ------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT Thursday, April 03, 2008 7:38:17 AM Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 3/04/2008 Kaspersky Anti-Virus database records: 679225 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: C:\ D:\ Scan Statistics: Total number of scanned objects: 75955 Number of viruses found: 4 Number of infected objects: 10 Number of suspicious objects: 0 Duration of the scan process: 01:22:37 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\All Users\Application Data\QSLLPSVCShare Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09A80000\4FABD6DD.VBN Infected: Exploit.JS.Agent.fd skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09A80001\4FABD6F4.VBN Infected: Exploit.JS.Agent.fd skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09A80002\4FABD6FE.VBN Infected: Exploit.JS.Agent.fd skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09A80003\4FABD708.VBN Infected: Exploit.JS.Agent.fd skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09A80004\4FABD712.VBN Infected: Exploit.JS.Agent.fd skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0B980000.VBN Infected: Exploit.HTML.IESlice.z skipped C:\Documents and Settings\Felicia Mittica\Application Data\Opera\Opera\mail\indexer\indexer.dat Object is locked skipped C:\Documents and Settings\Felicia Mittica\Application Data\Opera\Opera\mail\lexicon\lexicon.dat Object is locked skipped C:\Documents and Settings\Felicia Mittica\Application Data\Opera\Opera\mail\mailbase.dat Object is locked skipped C:\Documents and Settings\Felicia Mittica\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Felicia Mittica\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Felicia Mittica\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Felicia Mittica\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Felicia Mittica\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Felicia Mittica\ntuser.dat Object is locked skipped C:\Documents and Settings\Felicia Mittica\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Program Files\Common Files\Symantec Shared\EENGINE\EPERSIST.DAT Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBConfig.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBDebug.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBDetect.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBNotify.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBRefr.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetCfg.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetCfg2.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetDev.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetLoc.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetUsr.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMNot.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMReg.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMRSt.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBStHash.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBStMSI.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBValid.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPPolicy.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPStart.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPStop.log Object is locked skipped C:\Program Files\Symantec AntiVirus\SAVRT\0285NAV~.TMP Object is locked skipped C:\Program Files\Symantec AntiVirus\SAVRT\0502NAV~.TMP Object is locked skipped C:\RECYCLER\S-1-5-21-3820244732-731631674-3984864858-1006\Dc1.zip/svchost.exe Infected: Trojan.Win32.Delf.bhp skipped C:\RECYCLER\S-1-5-21-3820244732-731631674-3984864858-1006\Dc1.zip ZIP: infected - 1 skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP429\A0061405.exe/Toolbar.exe Infected: not-a-virus:AdTool.Win32.MyWebSearch.bm skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP429\A0061405.exe 7-Zip: infected - 1 skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP449\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\DEFAULT Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SYSTEM Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed. __________________ ~ Be Happy ~ Last edited by femi; 04-03-2008 at 06:11 AM.*

04-03-2008, 08:29 AM	#17 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 35,524 OS: 2000 Pro; XP Pro; XP Home	Re: Searchportal.com on Computer and Wont Go Away! :( Open NOTEPAD.exe and copy/paste the text in the codebox below into it: Code: @echo off if exist "%temp%\log.txt" del "%temp%\log.txt" for %%g in ( "C:\RECYCLER\S-1-5-21-3820244732-731631674-3984864858-1006\Dc1.zip" ) do ( del /a/f %%g >nul 2>&1 if exist %%g echo.%%g>>"%temp%\log.txt" ) for %%g in ( %systemdrive%\Deckard ) do ( rd /s/q %%g >nul 2>&1 if exist %%g echo.%%g>>"%temp%\log.txt" ) if exist "%temp%\log.txt" ( start notepad "%temp%\log.txt" ) else echo.Deleted Successfully !! pause del %0 Save this as fix.bat Choose to "Save type as - All Files" It should look like this: Double click on fix.bat & allow it to run Post back to tell me what it says __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009

04-03-2008, 08:43 PM	#18 (permalink)
femi Registered User Join Date: Mar 2008 Location: Canada! Posts: 28 OS: Windows xp	Re: Searchportal.com on Computer and Wont Go Away! :( it says "Deleted Sucessfully!" .. now i think this is a good thing, yes? :D __________________ ~ Be Happy ~

04-03-2008, 09:25 PM	#19 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 35,524 OS: 2000 Pro; XP Pro; XP Home	Re: Searchportal.com on Computer and Wont Go Away! :( It is, indeed. Now let's see if we can get back to the Java issue. Can you uninstall the old ones now, or are they greyed out still? __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009

04-03-2008, 09:31 PM	#20 (permalink)
femi Registered User Join Date: Mar 2008 Location: Canada! Posts: 28 OS: Windows xp	Re: Searchportal.com on Computer and Wont Go Away! :( The only one with a remove button is the most recent installation, and Java DB 10.3.1.4 >> (should i remove that now?). The rest are still greyed out... __________________ ~ Be Happy ~