Welcome to Tech Support Forum home to more then 136,000 problems solved. Issues have included: Spyware, Malware, Virus Issues, Windows, Microsoft, Linux, Networking, Security, Hardware, and Gaming Getting your problem solved is as easy as:
1. Registering for a free account
2. Asking your question
3. Receiving an answer

Registered members:
* Get free support
* Communicate privately with other members (PM).
* Removal of this message
* See fewer ads.
* And much more..

 


Want to know how to post a question? click here Having problems with spyware and pop-ups? First Steps
Go Back   Tech Support Forum > Security Center > Virus/Trojan/Spyware Help > Resolved HJT Threads
Reload this Page Generic Dropper.AU - Major Pop-Ups, etc
User Name
Password
Site Map Register Donate Rules Blogs Mark Forums Read


Resolved HJT Threads Resolved spyware and popup issues.

 
Page 1 of 2 1 2
 
LinkBack Thread Tools
Old 03-26-2008, 11:29 AM   #1 (permalink)
Registered User
 
Join Date: Mar 2008
Posts: 11
OS: WINXP


Evil Generic Dropper.AU - Major Pop-Ups, etc
Hi, thanks for helping. Here's what happened...
I tried to download a viewer to see a video clip - it never downloaded but then all hell broke loose.

1) McAfee started with the Generic Dropper.au
2) My background was some anti-virus software (privacy protector)
3) Pop ups for virus protection up the ying yang
4) Explorer Windows minimize and maximize without prompting
5) Task manager is disabled
6) Home page Ultimate Cleaner 2007 - even when I change it back, it goes back to Ultimate Cleaner

With DSS, I tried to have it access the internet after downloading but it was blocked. There is only the Main.TXT document. I also have the scan results document from the online tool.

I have attached the ActiveScan.TXT file results.

THANK YOU! Michael

DSS RESULTS:

uDeckard's System Scanner v20071014.68
Run by MichaelN on 2008-03-26 13:10:08
Computer is in Normal Mode.
--------------------------------------------------------------------------------



-- HijackThis Clone ------------------------------------------------------------


Emulating logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2008-03-26 13:11:01
Platform: Windows XP Service Pack 2 (5.01.2600)
MSIE: Internet Explorer (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKEEPER.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\ChatController\ccservice.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\Program Files\McAfee\MSC\mcmscsvc.exe
C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe
C:\Program Files\McAfee\VirusScan\mcods.exe
C:\Program Files\McAfee\MSC\mcpromgr.exe
C:\Program Files\Common Files\McAfee\McProxy\McProxy.exe
C:\Program Files\Common Files\McAfee\RedirSvc\RedirSvc.exe
C:\Program Files\McAfee\VirusScan\Mcshield.exe
C:\Program Files\McAfee\VirusScan\mcsysmon.exe
C:\Program Files\McAfee\MPF\MpfSrv.exe
C:\Program Files\McAfee\MPS\mps.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\explorer.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\McAfee\MPS\mpsevh.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\All Users.WINDOWS\Application Data\xstqncbg\hgpavyvg.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\PixArt\PAC207\Monitor.exe
C:\Program Files\antiviirus.exe
C:\Documents and Settings\MichaelN.THE-EA27A253A91\Application Data\Smilebox\SmileboxTray.exe
C:\WINDOWS\system32\lmnkdwpc.exe
C:\Program Files\Lexmark 1200 Series\lxczbmon.exe
C:\Program Files\Snapfish PictureMover\PictureMover.exe
C:\Program Files\Yahoo!\Messenger\Ymsgr_tray.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Documents and Settings\MichaelN.THE-EA27A253A91\Desktop\dss.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.comcast.net/toolbar2.0/search/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php...MjI6Ojg5&lid=2
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.comcast.net/toolbar2.0/search/
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: GNX Bingo - {2F97A8CB-0E8F-4AF0-B737-12C03F355794} - C:\WINDOWS\kdftlboeopx.dll
O2 - BHO: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\Program Files\ComcastToolbar\comcasttoolbar.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptcl.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\Program Files\ComcastToolbar\comcasttoolbar.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: qvdntlmw - {22B7098D-7F68-419F-A929-E844F8C36DA9} - C:\WINDOWS\qvdntlmw.dll
O4 - HKLM\..\Run: [Lexmark 1200 Series] "C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Monitor] C:\WINDOWS\PixArt\PAC207\Monitor.exe
O4 - HKLM\..\Run: [antiviirus] C:\Program Files\antiviirus.exe
O4 - HKLM\..\RunOnce: [pouetChessuninstall2] cmd.exe
/c
rd
/s
/q
c:\Games\PouetChess
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [SmileboxTray] "C:\Documents and Settings\MichaelN.THE-EA27A253A91\Application Data\Smilebox\SmileboxTray.exe"
O4 - HKCU\..\Run: [qpsxgjbi] C:\WINDOWS\system32\lmnkdwpc.exe
O4 - HKLM\..\Policies\Explorer\Run: [4P12KCLZWW] C:\Documents and Settings\All Users.WINDOWS\Application Data\xstqncbg\hgpavyvg.exe
O4 - Startup: Snapfish PictureMover.lnk = C:\Program Files\Snapfish PictureMover\PictureMover.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableTaskMgr=1
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: about://internet (HKCU)
O15 - Trusted Zone: http://mcafee.com (HKCU)
O15 - Trusted Zone: https://mcafee.com (HKCU)
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/s...irector/sw.cab
O16 - DPF: {2DAD3559-2923-4935-AD49-B673D2539944} (IASRunner Class) - https://www-307.ibm.com/pc/support/a...tent/AcpIR.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {74C861A1-D548-4916-BC8A-FDE92EDFF62C} () - http://mediaplayer.walmart.com/installer/install.cab
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} () - http://fpdownload.macromedia.com/get.../ultrashim.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://playgames.comcast.net/Gameshe...onGameHost.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/.../installer.exe
O18 - Protocol: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL
O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL
O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL
O21 - SSODL: VolumeAvp - {d3b77f49-0f44-4e48-871b-cd2e8890c725} - C:\WINDOWS\Installer\{d3b77f49-0f44-4e48-871b-cd2e8890c725}\VolumeAvp.dll
O21 - SSODL: RamRam - {7e5c3344-0009-4b57-9fae-b642d54866bd} - C:\WINDOWS\Installer\{7e5c3344-0009-4b57-9fae-b642d54866bd}\RamRam.dll
O21 - SSODL: dwnrpofk - {770A3D5C-3B3B-43F0-ABB2-273E737F2DD6} - (no file)
O21 - SSODL: vbgtorfd - {7C807B42-A8D3-4B32-9EAD-4C1B09014E18} - C:\WINDOWS\vbgtorfd.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Chat Controller - Zemerick Software, Inc. - C:\Program Files\ChatController\ccservice.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\EmProxy\emproxy.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\Program Files\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\Program Files\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\Program Files\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McProxy\McProxy.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\RedirSvc\RedirSvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\Mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MpfSrv.exe
O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\Program Files\McAfee\MPS\mps.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKEEPER.exe
O24 - Desktop Component 0: Privacy Protection - file:///C:\WINDOWS\privacy_danger\index.htm

--
End of file - 12320 bytes

-- Files created between 2008-02-26 and 2008-03-26 -----------------------------

2008-03-26 12:53:38 0 d-------- C:\WINDOWS\LastGood
2008-03-25 20:48:09 0 d-------- C:\Program Files\SpywareBlaster
2008-03-25 13:31:20 0 d-------- C:\WINDOWS\system32\ActiveScan
2008-03-25 12:43:21 98304 --a------ C:\WINDOWS\system32\ynwhslcb.exe
2008-03-25 12:42:45 0 d-------- C:\WINDOWS\privacy_danger
2008-03-24 19:03:10 0 d--h----- C:\Documents and Settings\Administrator.THE-EA27A253A91\Templates
2008-03-24 19:03:10 0 dr------- C:\Documents and Settings\Administrator.THE-EA27A253A91\Start Menu
2008-03-24 19:03:10 0 dr-h----- C:\Documents and Settings\Administrator.THE-EA27A253A91\SendTo
2008-03-24 19:03:10 0 d--h----- C:\Documents and Settings\Administrator.THE-EA27A253A91\Recent
2008-03-24 19:03:10 0 d--h----- C:\Documents and Settings\Administrator.THE-EA27A253A91\PrintHood
2008-03-24 19:03:10 0 d--h----- C:\Documents and Settings\Administrator.THE-EA27A253A91\NetHood
2008-03-24 19:03:10 0 d-------- C:\Documents and Settings\Administrator.THE-EA27A253A91\My Documents
2008-03-24 19:03:10 0 d--h----- C:\Documents and Settings\Administrator.THE-EA27A253A91\Local Settings
2008-03-24 19:03:10 0 d-------- C:\Documents and Settings\Administrator.THE-EA27A253A91\Favorites
2008-03-24 19:03:10 0 d-------- C:\Documents and Settings\Administrator.THE-EA27A253A91\Desktop
2008-03-24 19:03:10 0 d--hs---- C:\Documents and Settings\Administrator.THE-EA27A253A91\Cookies
2008-03-24 19:03:10 0 dr-h----- C:\Documents and Settings\Administrator.THE-EA27A253A91\Application Data
2008-03-24 19:03:10 0 d---s---- C:\Documents and Settings\Administrator.THE-EA27A253A91\Application Data\Microsoft
2008-03-24 19:03:10 0 d-------- C:\Documents and Settings\Administrator.THE-EA27A253A91\Application Data\Intel
2008-03-24 19:03:09 786432 --ah----- C:\Documents and Settings\Administrator.THE-EA27A253A91\NTUSER.DAT
2008-03-24 16:29:26 4096 --a------ C:\WINDOWS\userconfig9x.dll
2008-03-24 16:29:26 4096 --a------ C:\WINDOWS\system32winlogonpc.exe
2008-03-24 16:29:26 4096 --a------ C:\WINDOWS\system32taack.exe
2008-03-24 16:29:26 4096 --a------ C:\WINDOWS\system32taack.dat
2008-03-24 16:29:26 4096 --a------ C:\WINDOWS\system32ssurf022.dll
2008-03-24 16:29:26 4096 --a------ C:\WINDOWS\system32sncntr.exe
2008-03-24 16:29:26 0 d-------- C:\WINDOWS\system32smp
2008-03-24 16:29:26 4096 --a------ C:\WINDOWS\system32psoft1.exe
2008-03-24 16:29:26 4096 --a------ C:\WINDOWS\system32psof1.exe
2008-03-24 16:29:26 4096 --a------ C:\WINDOWS\system32ps1.exe
2008-03-24 16:29:26 4096 --a------ C:\WINDOWS\system32mwin32.exe
2008-03-24 16:29:26 4096 --a------ C:\WINDOWS\system32msnbho.dll
2008-03-24 16:29:26 4096 --a------ C:\WINDOWS\system32medup020.dll
2008-03-24 16:29:26 4096 --a------ C:\WINDOWS\system32medup012.dll
2008-03-24 16:29:26 4096 --a------ C:\WINDOWS\system32hxiwlgpm.exe
2008-03-24 16:29:26 4096 --a------ C:\WINDOWS\system32hxiwlgpm.dat
2008-03-24 16:29:26 4096 --a------ C:\WINDOWS\system32hoproxy.dll
2008-03-24 16:29:26 4096 --a------ C:\WINDOWS\system32bsva-egihsg52.exe
2008-03-24 16:29:26 4096 --a------ C:\WINDOWS\iTunesMusic.exe
2008-03-24 16:29:26 4096 --a------ C:\WINDOWS\FVProtect.exe
2008-03-24 16:29:26 4096 --a------ C:\WINDOWS\a.bat
2008-03-24 16:29:25 4096 --a------ C:\WINDOWS\system32thun32.dll
2008-03-24 16:29:25 4096 --a------ C:\WINDOWS\system32thun.dll
2008-03-24 16:29:25 4096 --a------ C:\WINDOWS\system32temp#01.exe
2008-03-24 16:29:25 4096 --a------ C:\WINDOWS\system32ssvchost.exe
2008-03-24 16:29:25 4096 --a------ C:\WINDOWS\system32ssvchost.com
2008-03-24 16:29:25 4096 --a------ C:\WINDOWS\system32Rundl1.exe
2008-03-24 16:29:25 4096 --a------ C:\WINDOWS\system32regm64.dll
2008-03-24 16:29:25 4096 --a------ C:\WINDOWS\system32regc64.dll
2008-03-24 16:29:25 4096 --a------ C:\WINDOWS\system32netode.exe
2008-03-24 16:29:25 4096 --a------ C:\WINDOWS\system32mtr2.exe
2008-03-24 16:29:25 4096 --a------ C:\WINDOWS\system32msvchost.exe
2008-03-24 16:29:25 4096 --a------ C:\WINDOWS\system32msgp.exe
2008-03-24 16:29:25 4096 --a------ C:\WINDOWS\system32h@tkeysh@@k.dll
2008-03-24 16:29:25 4096 --a------ C:\WINDOWS\system32dpcproxy.exe
2008-03-24 16:29:25 0 d-------- C:\Program Files\Inet Delivery
2008-03-24 16:29:24 4096 --a------ C:\WINDOWS\winsystem.exe
2008-03-24 16:29:24 4096 --a------ C:\WINDOWS\system32WINWGPX.EXE
2008-03-24 16:29:24 4096 --a------ C:\WINDOWS\system32winsystem.exe
2008-03-24 16:29:24 4096 --a------ C:\WINDOWS\system32vcatchpi.dll
2008-03-24 16:29:24 4096 --a------ C:\WINDOWS\system32vbsys2.dll
2008-03-24 16:29:24 4096 --a------ C:\WINDOWS\system32sysreq.exe
2008-03-24 16:29:24 4096 --a------ C:\WINDOWS\system32newsd32.exe
2008-03-24 16:29:24 4096 --a------ C:\WINDOWS\system32mssecu.exe
2008-03-24 16:29:24 4096 --a------ C:\WINDOWS\system32emesx.dll
2008-03-24 16:29:24 4096 --a------ C:\WINDOWS\system32bdn.com
2008-03-24 16:29:24 4096 --a------ C:\WINDOWS\system32awtoolb.dll
2008-03-24 16:29:24 4096 --a------ C:\WINDOWS\system32anticipator.dll
2008-03-24 16:29:24 4096 --a------ C:\WINDOWS\system32akttzn.exe
2008-03-24 16:29:24 4096 --a------ C:\WINDOWS\mssecu.exe
2008-03-24 16:29:24 0 d-------- C:\WINDOWS\mslagent
2008-03-24 16:29:24 4096 --a------ C:\WINDOWS\bdn.com
2008-03-24 16:29:24 0 d-------- C:\Program Files\akl
2008-03-24 16:29:08 0 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\xstqncbg
2008-03-24 16:29:07 94208 --a------ C:\WINDOWS\system32\lmnkdwpc.exe
2008-03-24 16:28:20 221184 --a------ C:\WINDOWS\vbgtorfd.dll
2008-03-24 16:28:20 151552 --a------ C:\WINDOWS\qvdntlmw.dll
2008-03-24 16:28:20 81920 --a------ C:\WINDOWS\norlatmx.exe
2008-03-24 16:28:20 212992 --a------ C:\WINDOWS\kdftlboeopx.dll
2008-03-24 16:27:47 21736 --a------ C:\Program Files\antiviirus.exe
2008-03-22 20:39:04 0 d-------- C:\Program Files\Safari
2008-03-21 08:30:52 0 d-------- C:\WINDOWS\system32\AGEIA
2008-03-21 08:30:50 0 d-------- C:\Program Files\AGEIA Technologies
2008-03-21 08:30:12 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-03-19 16:43:22 48128 --a------ C:\WINDOWS\system32\Remove.exe <Not Verified; PixArt Imaging Incorporation; Driver Remover>
2008-03-19 16:43:13 0 d-------- C:\WINDOWS\PixArt
2008-03-19 16:43:11 0 d-------- C:\Program Files\Common Files\PAC207
2008-03-19 16:43:11 0 d-------- C:\Program Files\Basic Webcam
2008-03-19 16:41:44 0 d-------- C:\Program Files\BestOn
2008-03-17 14:52:37 0 d-------- C:\Documents and Settings\LucasN.THE-EA27A253A91\Application Data\HP
2008-03-14 19:23:09 0 d-------- C:\Program Files\uTorrent
2008-03-11 17:43:02 0 d-------- C:\Documents and Settings\Susan\Application Data\acccore
2008-03-07 21:31:06 0 d-------- C:\Program Files\Unity
2008-03-02 11:10:21 0 d-------- C:\Program Files\Ubisoft
2008-02-27 19:40:55 0 d-------- C:\temp
2008-02-27 19:33:23 0 d-------- C:\Program Files\Lexmark 1200 Series
2008-02-27 19:32:51 299520 --a------ C:\WINDOWS\uninst.exe <Not Verified; InstallShield Corporation, Inc.; InstallShield unInstaller>
2008-02-27 19:32:30 0 d-------- C:\Documents and Settings\MichaelN.THE-EA27A253A91\WINDOWS
2008-02-27 19:32:15 0 d-------- C:\Lexmark


-- Find3M Report ---------------------------------------------------------------

2008-03-26 09:09:22 0 d-------- C:\Program Files\iTunes
2008-03-26 05:31:52 0 d-------- C:\Program Files\AIM6
2008-03-25 19:12:39 0 d-------- C:\Documents and Settings\MichaelN.THE-EA27A253A91\Application Data\Smilebox
2008-03-25 14:04:20 0 d-------- C:\Program Files\ComcastToolbar
2008-03-25 14:04:07 0 d-------- C:\Program Files\Messenger
2008-03-23 02:05:44 0 d-------- C:\Documents and Settings\MichaelN.THE-EA27A253A91\Application Data\source code
2008-03-22 20:41:29 0 d-------- C:\Documents and Settings\MichaelN.THE-EA27A253A91\Application Data\Apple Computer
2008-03-21 23:01:02 0 d-------- C:\Documents and Settings\MichaelN.THE-EA27A253A91\Application Data\uTorrent
2008-03-21 08:59:59 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-03-21 08:30:12 0 d-------- C:\Program Files\Common Files
2008-03-15 22:27:31 0 d-------- C:\Program Files\Google
2008-03-15 13:01:17 0 d-------- C:\Documents and Settings\MichaelN.THE-EA27A253A91\Application Data\Vso
2008-03-15 13:01:17 47360 --a------ C:\Documents and Settings\MichaelN.THE-EA27A253A91\Application Data\pcouffin.sys <Not Verified; VSO Software; Patin couffin engine>
2008-03-15 13:01:17 33 --a------ C:\Documents and Settings\MichaelN.THE-EA27A253A91\Application Data\pcouffin.log
2008-03-15 13:01:17 1144 --a------ C:\Documents and Settings\MichaelN.THE-EA27A253A91\Application Data\pcouffin.inf
2008-03-15 13:01:17 7887 --a------ C:\Documents and Settings\MichaelN.THE-EA27A253A91\Application Data\pcouffin.cat
2008-03-15 13:00:40 0 d-------- C:\Program Files\Call of Duty Game of the Year Edition
2008-03-14 18:38:27 0 d-------- C:\Program Files\Online Services
2008-03-14 18:34:57 0 d-------- C:\Program Files\EA SPORTS
2008-03-14 18:34:32 0 d-------- C:\Program Files\CLSetup07
2008-03-13 23:07:14 68248 --a----c- C:\Documents and Settings\MichaelN.THE-EA27A253A91\Application Data\GDIPFONTCACHEV1.DAT
2008-03-05 20:36:23 0 d-------- C:\Program Files\Mah Jong Medley
2008-03-01 20:52:06 0 d-------- C:\Program Files\iPod
2008-03-01 20:50:03 0 d-------- C:\Program Files\QuickTime
2008-02-26 08:31:54 0 d-------- C:\Program Files\McAfee
2008-02-24 11:22:11 0 d-------- C:\Program Files\ReflexiveArcade
2008-02-15 22:19:27 0 d-------- C:\Program Files\Free History Eraser
2008-02-15 20:03:27 0 d--h----- C:\Documents and Settings\MichaelN.THE-EA27A253A91\Application Data\Gtek
2008-02-15 1934 0 d-------- C:\Documents and Settings\MichaelN.THE-EA27A253A91\Application Data\Snapfish
2008-02-15 19:05:50 0 d-------- C:\Program Files\Snapfish PictureMover
2008-02-09 12:52:08 0 d-------- C:\Program Files\Nick Arcade
2008-01-25 14:25:56 63 --a----c- C:\Documents and Settings\MichaelN.THE-EA27A253A91\Application Data\Printer.ini
2008-01-25 05:30:09 1890 --ahs--c- C:\WINDOWS\system32\KGyGaAvL.sys
2008-01-25 05:30:09 8 -r-hs---- C:\WINDOWS\system32\8B8D426A3F.sys
2007-12-27 11:57:21 0 --a----c- C:\WINDOWS\PowerReg.dat


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2F97A8CB-0E8F-4AF0-B737-12C03F355794}]
03/24/2008 12:41 PM 212992 --a------ C:\WINDOWS\kdftlboeopx.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Lexmark 1200 Series"="C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe" [07/13/2006 02:22 PM]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [02/01/2008 12:13 AM]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [02/19/2008 02:10 PM]
"Monitor"="C:\WINDOWS\PixArt\PAC207\Monitor.exe" [11/03/2006 11:01 AM]
"antiviirus"="C:\Program Files\antiviirus.exe" [03/24/2008 04:27 PM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 06:00 AM]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [03/27/2007 03:22 PM]
"SmileboxTray"="C:\Documents and Settings\MichaelN.THE-EA27A253A91\Application Data\Smilebox\SmileboxTray.exe" [01/28/2008 07:27 PM]
"qpsxgjbi"="C:\WINDOWS\system32\lmnkdwpc.exe" [03/24/2008 04:29 PM]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce]
"pouetChessuninstall2"=cmd.exe\0/c\0rd\0/s\0/q\0c:\Games\PouetChess\0\0

C:\Documents and Settings\MichaelN.THE-EA27A253A91\Start Menu\Programs\Startup\
Snapfish PictureMover.lnk - C:\Program Files\Snapfish PictureMover\PictureMover.exe [11/6/2007 6:35:44 PM]

C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2/13/2001 1:01:04 AM]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"=1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\Run]
"4P12KCLZWW"=C:\Documents and Settings\All Users.WINDOWS\Application Data\xstqncbg\hgpavyvg.exe

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
Source= file:///C:\WINDOWS\privacy_danger\index.htm
FriendlyName= Privacy Protection

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"VolumeAvp"= {d3b77f49-0f44-4e48-871b-cd2e8890c725} - C:\WINDOWS\Installer\{d3b77f49-0f44-4e48-871b-cd2e8890c725}\VolumeAvp.dll [03/24/2008 04:27 PM 14378]
"RamRam"= {7e5c3344-0009-4b57-9fae-b642d54866bd} - C:\WINDOWS\Installer\{7e5c3344-0009-4b57-9fae-b642d54866bd}\RamRam.dll [03/24/2008 04:27 PM 14378]
"vbgtorfd"= {7C807B42-A8D3-4B32-9EAD-4C1B09014E18} - C:\WINDOWS\vbgtorfd.dll [03/24/2008 12:41 PM 221184]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Microsoft Works Calendar Reminders.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Microsoft Works Calendar Reminders.lnk
backup=C:\WINDOWS\pss\Microsoft Works Calendar Reminders.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cww]
"C:\Program Files\cw5\cww.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
"C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus C88 Series]
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIABA.EXE /P23 "EPSON Stylus C88 Series" /O6 "USB001" /M "Stylus C88"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
C:\WINDOWS\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]
C:\WINDOWS\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]
C:\WINDOWS\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelWireless]
"C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelZeroConfig]
"C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MP10_EnsureFileVer]
C:\WINDOWS\inf\unregmp2.exe /EnsureFileVersions

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService]
"C:\Program Files\Dell\Media Experience\PCMService.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]
stsystra.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet




-- End of Deckard's System Scanner: finished at 2008-03-26 13:14:06 ------------
Attached Files
File Type: txt Activescan.txt (81.9 KB, 1 views)
Last edited by mnotarangelo; 03-26-2008 at 11:37 AM. Reason: added information
mnotarangelo is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Important Information
Join the #1 Tech Support Forum Today - It's Totally Free!

TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free.

Join TechSupportforum.com Today - Click Here

Old 03-28-2008, 06:53 PM   #2 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,691
OS: 2000 Pro; XP Pro; XP Home


Re: Generic Dropper.AU - Major Pop-Ups, etc
Please visit this webpage for instructions for downloading and running ComboFix:

http://www.bleepingcomputer.com/comb...o-use-combofix

Please ensure you read this guide carefully and install the Recovery Console first.

The Windows Recovery Console will allow you to boot up into a special recovery mode that allows us to help you in the case that your computer has a problem after an attempted removal of malware.

If you have any questions along the way, STOP and ask them before proceeding.

Post the log from ComboFix when you've accomplished that, along with a new HijackThis log.

It does not appear as though DSS was allowed to download and install HijackThis. To produce a HijackThis log for your next reply, please do this:

Please download HijackThis to your desktop

Alternate link

Double-click on the file you just downloaded.
Click on the "Unzip" button to install. It will by default install to the directory - C:\Program Files\Trend Micro\HijackThis

Upon install, HijackThis should open for you.

Should it not open, navigate to C:\Program Files\Trend Micro\HijackThis and double click on HijackThis.exe

1. If it gives you an intro screen, just choose 'Do a system scan and save a logfile'.
2. If you don't get the intro screen, just hit Scan and then click on Save log.
3. Post the hijackthis.log file here. Do not fix anything in HijackThis since they may be harmless.

---------------------------------------------------------------------------------------------
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 03-31-2008, 07:44 PM   #3 (permalink)
Registered User
 
Join Date: Mar 2008
Posts: 11
OS: WINXP


Thumbs Up Re: Generic Dropper.AU - Major Pop-Ups, etc
Thank you TetonBob! Thank you for your help!

Here is the Combofix File:

ComboFix 08-03-30.4 - MichaelN 2008-03-31 21:14:10.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.564 [GMT -4:00]
Running from: C:\Documents and Settings\MichaelN.THE-EA27A253A91\Desktop\ComboFix.exe
* Resident AV is active

.
TimedOut: progfile.dat

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\LucasN.THE-EA27A253A91\Desktop\Error Cleaner.url
C:\Documents and Settings\LucasN.THE-EA27A253A91\Desktop\Privacy Protector.url
C:\Documents and Settings\LucasN.THE-EA27A253A91\Desktop\Spyware&Malware Protection.url
C:\Documents and Settings\LucasN.THE-EA27A253A91\Favorites\Error Cleaner.url
C:\Documents and Settings\LucasN.THE-EA27A253A91\Favorites\Privacy Protector.url
C:\Documents and Settings\LucasN.THE-EA27A253A91\Favorites\Spyware&Malware Protection.url
C:\Documents and Settings\MichaelN.THE-EA27A253A91\Application Data\inst.exe
C:\Documents and Settings\MichaelN.THE-EA27A253A91\Application Data\searchtoolbarcorp
C:\Documents and Settings\MichaelN.THE-EA27A253A91\Application Data\searchtoolbarcorp\Toolbar Vision\PageHistory.txt
C:\Documents and Settings\MichaelN.THE-EA27A253A91\Application Data\searchtoolbarcorp\Toolbar Vision\WebHistory.txt
C:\Documents and Settings\MichaelN.THE-EA27A253A91\Desktop\Error Cleaner.url
C:\Documents and Settings\MichaelN.THE-EA27A253A91\Desktop\Privacy Protector.url
C:\Documents and Settings\MichaelN.THE-EA27A253A91\Desktop\Spyware&Malware Protection.url
C:\Documents and Settings\MichaelN.THE-EA27A253A91\Favorites\Error Cleaner.url
C:\Documents and Settings\MichaelN.THE-EA27A253A91\Favorites\Privacy Protector.url
C:\Documents and Settings\MichaelN.THE-EA27A253A91\Favorites\Spyware&Malware Protection.url
C:\Documents and Settings\Susan\Desktop\Error Cleaner.url
C:\Documents and Settings\Susan\Desktop\Privacy Protector.url
C:\Documents and Settings\Susan\Desktop\Spyware&Malware Protection.url
C:\Documents and Settings\Susan\Favorites\Error Cleaner.url
C:\Documents and Settings\Susan\Favorites\Privacy Protector.url
C:\Documents and Settings\Susan\Favorites\Spyware&Malware Protection.url
C:\Program Files\akl
C:\Program Files\akl\akl.dll
C:\Program Files\akl\akl.exe
C:\Program Files\akl\uninstall.exe
C:\Program Files\akl\unsetup.exe
C:\Program Files\Inet Delivery
C:\Program Files\Inet Delivery\inetdl.exe
C:\Program Files\Inet Delivery\intdel.exe
C:\Program Files\vsadd-in
C:\WINDOWS\a.bat
C:\WINDOWS\base64.tmp
C:\WINDOWS\bdn.com
C:\WINDOWS\FVProtect.exe
C:\WINDOWS\iTunesMusic.exe
C:\WINDOWS\mslagent
C:\WINDOWS\mslagent\2_mslagent.dll
C:\WINDOWS\mslagent\mslagent.exe
C:\WINDOWS\mslagent\uninstall.exe
C:\WINDOWS\mssecu.exe
C:\WINDOWS\norlatmx.exe
C:\WINDOWS\privacy_danger
C:\WINDOWS\privacy_danger\images\capt.gif
C:\WINDOWS\privacy_danger\images\danger.jpg
C:\WINDOWS\privacy_danger\images\down.gif
C:\WINDOWS\privacy_danger\images\spacer.gif
C:\WINDOWS\privacy_danger\index.htm
C:\WINDOWS\qvdntlmw.dll
C:\WINDOWS\rs.txt
C:\WINDOWS\system32akttzn.exe
C:\WINDOWS\system32anticipator.dll
C:\WINDOWS\system32awtoolb.dll
C:\WINDOWS\system32bdn.com
C:\WINDOWS\system32bsva-egihsg52.exe
C:\WINDOWS\system32dpcproxy.exe
C:\WINDOWS\system32emesx.dll
C:\WINDOWS\system32h@tkeysh@@k.dll
C:\WINDOWS\system32hoproxy.dll
C:\WINDOWS\system32hxiwlgpm.dat
C:\WINDOWS\system32hxiwlgpm.exe
C:\WINDOWS\system32medup012.dll
C:\WINDOWS\system32medup020.dll
C:\WINDOWS\system32msgp.exe
C:\WINDOWS\system32msnbho.dll
C:\WINDOWS\system32mssecu.exe
C:\WINDOWS\system32msvchost.exe
C:\WINDOWS\system32mtr2.exe
C:\WINDOWS\system32mwin32.exe
C:\WINDOWS\system32netode.exe
C:\WINDOWS\system32newsd32.exe
C:\WINDOWS\system32ps1.exe
C:\WINDOWS\system32psof1.exe
C:\WINDOWS\system32psoft1.exe
C:\WINDOWS\system32regc64.dll
C:\WINDOWS\system32regm64.dll
C:\WINDOWS\system32Rundl1.exe
C:\WINDOWS\system32smp
C:\WINDOWS\system32smp\msrc.exe
C:\WINDOWS\system32sncntr.exe
C:\WINDOWS\system32ssurf022.dll
C:\WINDOWS\system32ssvchost.com
C:\WINDOWS\system32ssvchost.exe
C:\WINDOWS\system32sysreq.exe
C:\WINDOWS\system32taack.dat
C:\WINDOWS\system32taack.exe
C:\WINDOWS\system32temp#01.exe
C:\WINDOWS\system32thun.dll
C:\WINDOWS\system32thun32.dll
C:\WINDOWS\system32VBIEWER.OCX
C:\WINDOWS\system32vbsys2.dll
C:\WINDOWS\system32vcatchpi.dll
C:\WINDOWS\system32winlogonpc.exe
C:\WINDOWS\system32winsystem.exe
C:\WINDOWS\system32WINWGPX.EXE
C:\WINDOWS\userconfig9x.dll
C:\WINDOWS\vbgtorfd.dll
C:\WINDOWS\Web\def.htm
C:\WINDOWS\winsystem.exe
C:\WINDOWS\zip1.tmp
C:\WINDOWS\zip2.tmp
C:\WINDOWS\zip3.tmp
C:\WINDOWS\zipped.tmp
D:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2008-03-01 to 2008-04-01 )))))))))))))))))))))))))))))))
.

2008-03-25 20:48 . 2008-03-25 20:48 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-03-25 20:48 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\system32\MSINET.OCX
2008-03-25 13:31 . 2008-03-25 14:03 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2008-03-25 13:31 . 2008-03-25 13:31 30,590 --a------ C:\WINDOWS\system32\pavas.ico
2008-03-25 13:31 . 2008-03-25 13:31 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico
2008-03-25 13:31 . 2008-03-25 13:31 1,406 --a------ C:\WINDOWS\system32\Help.ico
2008-03-25 12:43 . 2008-03-25 12:43 98,304 --a------ C:\WINDOWS\system32\ynwhslcb.exe
2008-03-24 19:50 . 2008-03-24 19:50 61,224 --a------ C:\Documents and Settings\MichaelN.THE-EA27A253A91\GoToAssistDownloadHelper.exe
2008-03-24 19:28 . 2008-03-24 19:28 <DIR> d----c--- C:\Deckard
2008-03-24 19:03 . 2007-05-21 15:28 <DIR> d-------- C:\Documents and Settings\Administrator.THE-EA27A253A91\Application Data\Intel
2008-03-24 16:29 . 2008-03-25 15:39 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\xstqncbg
2008-03-24 16:29 . 2008-03-24 16:29 94,208 --a------ C:\WINDOWS\system32\lmnkdwpc.exe
2008-03-24 16:28 . 2008-03-24 12:41 212,992 --a------ C:\WINDOWS\kdftlboeopx.dll
2008-03-24 16:27 . 2008-03-24 16:27 21,736 --a------ C:\Program Files\antiviirus.exe
2008-03-22 20:39 . 2008-03-22 20:39 <DIR> d-------- C:\Program Files\Safari
2008-03-21 08:30 . 2008-03-21 08:30 <DIR> d-------- C:\WINDOWS\system32\AGEIA
2008-03-21 08:30 . 2008-03-21 08:30 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-03-21 08:30 . 2008-03-21 08:31 <DIR> d-------- C:\Program Files\AGEIA Technologies
2008-03-19 16:43 . 2008-03-19 16:43 <DIR> d-------- C:\WINDOWS\PixArt
2008-03-19 16:43 . 2008-03-19 16:43 <DIR> d-------- C:\Program Files\Common Files\PAC207
2008-03-19 16:43 . 2008-03-19 16:43 <DIR> d-------- C:\Program Files\Basic Webcam
2008-03-19 16:43 . 2006-11-03 10:59 48,128 --a------ C:\WINDOWS\system32\Remove.exe
2008-03-19 16:43 . 2007-03-16 00:10 316 --a------ C:\WINDOWS\system32\Remover.ini
2008-03-19 16:41 . 2008-03-19 16:41 <DIR> d-------- C:\Program Files\BestOn
2008-03-17 14:52 . 2008-03-17 14:52 <DIR> d-------- C:\Documents and Settings\LucasN.THE-EA27A253A91\Application Data\HP
2008-03-14 19:23 . 2008-03-14 19:23 <DIR> d-------- C:\Program Files\uTorrent
2008-03-11 17:43 . 2008-03-11 17:43 <DIR> d-------- C:\Documents and Settings\Susan\Application Data\acccore
2008-03-07 21:31 . 2008-03-07 21:31 <DIR> d-------- C:\Program Files\Unity
2008-03-05 07:31 . 2004-08-04 01:56 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll
2008-03-05 07:31 . 2001-08-17 23:36 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll
2008-03-02 11:10 . 2008-03-21 08:59 <DIR> d-------- C:\Program Files\Ubisoft
2008-03-02 10:54 . 2004-05-14 17:53 462,848 --a------ C:\WINDOWS\system32\ltkrn13n.dll
2008-03-02 10:54 . 2004-05-14 17:53 450,560 --a------ C:\WINDOWS\system32\ltimg13n.dll
2008-03-02 10:54 . 2004-05-14 17:53 401,408 --a------ C:\WINDOWS\system32\lfcmp13n.dll
2008-03-02 10:54 . 2004-05-14 17:53 299,008 --a------ C:\WINDOWS\system32\ltdis13n.dll
2008-03-02 10:54 . 2004-01-12 03:09 206,336 --a------ C:\WINDOWS\system32\ltefx13n.dll
2008-03-02 10:54 . 2004-05-14 17:53 163,840 --a------ C:\WINDOWS\system32\ltfil13n.dll
2008-03-02 10:54 . 2003-11-04 16:10 69,632 --a------ C:\WINDOWS\system32\lfgif13n.dll
2008-03-02 10:54 . 2004-05-14 17:53 57,344 --a------ C:\WINDOWS\system32\lfbmp13n.dll
2008-03-01 20:52 . 2008-03-31 21:10 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-03-01 20:52 . 2008-03-01 20:52 1,409 --a------ C:\WINDOWS\QTFont.for

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-01 00:57 --------- d-----w C:\Program Files\McAfee
2008-03-30 04:01 --------- d-----w C:\Documents and Settings\MichaelN.THE-EA27A253A91\Application Data\source code
2008-03-26 20:51 --------- d-----w C:\Documents and Settings\LucasN.THE-EA27A253A91\Application Data\COMCASTTOOLBAR
2008-03-26 13:09 --------- d-----w C:\Program Files\iTunes
2008-03-26 09:31 --------- d-----w C:\Program Files\AIM6
2008-03-26 02:38 --------- d---a-w C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP
2008-03-25 23:12 --------- d-----w C:\Documents and Settings\MichaelN.THE-EA27A253A91\Application Data\Smilebox
2008-03-25 18:04 --------- d-----w C:\Program Files\Lexmark 1200 Series
2008-03-25 18:04 --------- d-----w C:\Program Files\ComcastToolbar
2008-03-24 23:43 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\McAfee
2008-03-24 19:48 --------- d-----w C:\Documents and Settings\Susan\Application Data\COMCASTTOOLBAR
2008-03-23 00:41 --------- d-----w C:\Documents and Settings\MichaelN.THE-EA27A253A91\Application Data\Apple Computer
2008-03-22 03:01 --------- d-----w C:\Documents and Settings\MichaelN.THE-EA27A253A91\Application Data\uTorrent
2008-03-21 12:59 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-21 12:53 --------- d-----w C:\Documents and Settings\ZacharyN.THE-EA27A253A91\Application Data\COMCASTTOOLBAR
2008-03-16 02:27 --------- d-----w C:\Program Files\Google
2008-03-15 17:01 47,360 ----a-w C:\Documents and Settings\MichaelN.THE-EA27A253A91\Application Data\pcouffin.sys
2008-03-15 17:01 --------- d-----w C:\Documents and Settings\MichaelN.THE-EA27A253A91\Application Data\Vso
2008-03-15 17:00 --------- d-----w C:\Program Files\Call of Duty Game of the Year Edition
2008-03-14 22:34 --------- d-----w C:\Program Files\EA SPORTS
2008-03-14 22:34 --------- d-----w C:\Program Files\CLSetup07
2008-03-14 03:07 68,248 -c--a-w C:\Documents and Settings\MichaelN.THE-EA27A253A91\Application Data\GDIPFONTCACHEV1.DAT
2008-03-06 00:36 --------- d-----w C:\Program Files\Mah Jong Medley
2008-03-02 00:52 --------- d-----w C:\Program Files\iPod
2008-03-02 00:50 --------- d-----w C:\Program Files\QuickTime
2008-02-24 15:22 --------- d-----w C:\Program Files\ReflexiveArcade
2008-02-21 13:02 --------- d-----w C:\Documents and Settings\Susan\Application Data\Move Networks
2008-02-19 20:10 --------- d-----w C:\Documents and Settings\LucasN.THE-EA27A253A91\Application Data\Viewpoint
2008-02-16 02:19 --------- d-----w C:\Program Files\Free History Eraser
2008-02-16 00:03 --------- d--h--w C:\Documents and Settings\MichaelN.THE-EA27A253A91\Application Data\Gtek
2008-02-16 00:03 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Gtek
2008-02-15 23:06 --------- d-----w C:\Documents and Settings\MichaelN.THE-EA27A253A91\Application Data\Snapfish
2008-02-15 23:05 --------- d-----w C:\Program Files\Snapfish PictureMover
2008-02-09 16:52 --------- d-----w C:\Program Files\Nick Arcade
2008-02-06 14:51 171,400 ----a-w C:\WINDOWS\system32\drivers\mfehidk.sys
2008-01-21 19:07 67,864 ----a-w C:\Documents and Settings\ZacharyN.THE-EA27A253A91\Application Data\GDIPFONTCACHEV1.DAT
2008-01-11 05:53 44,544 ----a-w C:\WINDOWS\system32\SET1CB.tmp
2007-12-16 20:19 67,864 -c--a-w C:\Documents and Settings\LucasN.THE-EA27A253A91\Application Data\GDIPFONTCACHEV1.DAT
2007-07-29 16:23 67,480 -c--a-w C:\Documents and Settings\Susan\Application Data\GDIPFONTCACHEV1.DAT
2006-07-18 00:46 130 -c--a-w C:\Documents and Settings\MichaelN.THE-EA27A253A91\Application Data\fusioncache.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2F97A8CB-0E8F-4AF0-B737-12C03F355794}]
2008-03-24 12:41 212992 --a------ C:\WINDOWS\kdftlboeopx.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:00 15360]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-03-27 15:22 4670968]
"SmileboxTray"="C:\Documents and Settings\MichaelN.THE-EA27A253A91\Application Data\Smilebox\SmileboxTray.exe" [2008-01-28 19:27 201352]
"qpsxgjbi"="C:\WINDOWS\system32\lmnkdwpc.exe" [2008-03-24 16:29 94208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Lexmark 1200 Series"="C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe" [2006-07-13 14:22 57344]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-02-01 00:13 385024]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 14:10 267048]
"Monitor"="C:\WINDOWS\PixArt\PAC207\Monitor.exe" [2006-11-03 11:01 319488]
"antiviirus"="C:\Program Files\antiviirus.exe" [2008-03-24 16:27 21736]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"pouetChessuninstall2"="cmd.exe\0/c\0rd\0/s\0/q\0c:\Games\PouetChess\0\0" [ ]

C:\Documents and Settings\MichaelN.THE-EA27A253A91\Start Menu\Programs\Startup\
Snapfish PictureMover.lnk - C:\Program Files\Snapfish PictureMover\PictureMover.exe [2007-11-06 18:35:44 475136]

C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]
"4P12KCLZWW"= C:\Documents and Settings\All Users.WINDOWS\Application Data\xstqncbg\hgpavyvg.exe

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
Source= file:///C:\WINDOWS\privacy_danger\index.htm
FriendlyName= Privacy Protection

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Microsoft Works Calendar Reminders.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Microsoft Works Calendar Reminders.lnk
backup=C:\WINDOWS\pss\Microsoft Works Calendar Reminders.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2004-08-04 06:00 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cww]
--a--c--- 2007-08-06 17:40 307384 C:\Program Files\cw5\cww.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
-----c--- 2005-12-09 20:29 49152 C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus C88 Series]
--a--c--- 2005-01-27 04:00 98304 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIABA.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
--a--c--- 2006-06-06 17:06 77824 C:\WINDOWS\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]
--a--c--- 2006-06-06 17:10 118784 C:\WINDOWS\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]
--a--c--- 2006-06-06 17:09 94208 C:\WINDOWS\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelWireless]
--a--c--- 2007-02-21 11:17 970752 C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelZeroConfig]
--a--c--- 2007-02-21 11:19 819200 C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-02-19 14:10 267048 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
--a--c--- 2001-08-16 23:41 28738 C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MP10_EnsureFileVer]
--a------ 2007-06-26 23:10 317440 C:\WINDOWS\inf\unregmp2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2004-10-13 12:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService]
-----c--- 2004-04-11 20:15 290816 C:\Program Files\Dell\Media Experience\PCMService.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-02-01 00:13 385024 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]
--a--c--- 2006-03-24 17:30 282624 C:\WINDOWS\stsystra.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a--c--- 2007-03-14 03:43 83608 C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
--a--c--- 2006-05-19 14:51 774233 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
-ra------ 2006-03-30 17:45 313472 C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
--a------ 2007-03-27 15:22 4670968 C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\uTorrent\\utorrent.exe"=
"C:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=

R2 Chat Controller;Chat Controller;C:\Program Files\ChatController\ccservice.exe [2007-01-08 13:57]
R2 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" [2007-01-04 17:38]
S3 PAC207;Basic Webcam;C:\WINDOWS\system32\DRIVERS\PFC027.SYS [2006-11-20 08:48]

*Newly Created Service* - CATCHME
.
Contents of the 'Scheduled Tasks' folder
"2008-03-22 23:35:04 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-03-15 05:00:01 C:\WINDOWS\Tasks\McDefragTask.job"
- c:\program files\mcafee\mqc\QcConsol.exe'
"2008-03-01 06:00:25 C:\WINDOWS\Tasks\McQcTask.job"
- c:\program files\mcafee\mqc\QcConsol.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-31 21:18:55
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
pouetChessuninstall2 = 63 00 6D 00 64 00 2E 00 65 00

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-03-31 21:23:40
ComboFix-quarantined-files.txt 2008-04-01 01:23:36
Pre-Run: 7,879,364,608 bytes free
Post-Run: 7,873,626,112 bytes free
.
2008-03-12 07:02:22 --- E O F ---


And here is the Hijackthis file:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:38:56 PM, on 3/31/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\ChatController\ccservice.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\PROGRA~1\McAfee\MPS\mps.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\McAfee\MPS\mpsevh.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Documents and Settings\All Users.WINDOWS\Application Data\xstqncbg\hgpavyvg.exe
C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\PixArt\PAC207\Monitor.exe
C:\Program Files\Lexmark 1200 Series\lxczbmon.exe
C:\Program Files\antiviirus.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\MichaelN.THE-EA27A253A91\Application Data\Smilebox\SmileboxTray.exe
C:\Program Files\Snapfish PictureMover\PictureMover.exe
C:\WINDOWS\system32\spcjebat.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php...MjI6Ojg5&lid=2
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: GNX Bingo - {2F97A8CB-0E8F-4AF0-B737-12C03F355794} - C:\WINDOWS\kdftlboeopx.dll
O2 - BHO: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~1\COMCAS~1.DLL
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptcl.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~1\COMCAS~1.DLL
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [Lexmark 1200 Series] "C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Monitor] C:\WINDOWS\PixArt\PAC207\Monitor.exe
O4 - HKLM\..\Run: [antiviirus] C:\Program Files\antiviirus.exe
O4 - HKLM\..\RunOnce: [pouetChessuninstall2] cmd.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [SmileboxTray] "C:\Documents and Settings\MichaelN.THE-EA27A253A91\Application Data\Smilebox\SmileboxTray.exe"
O4 - HKCU\..\Run: [qpsxgjbi] C:\WINDOWS\system32\lmnkdwpc.exe
O4 - HKCU\..\Run: [docbpbkg] C:\WINDOWS\system32\spcjebat.exe
O4 - HKLM\..\Policies\Explorer\Run: [4P12KCLZWW] C:\Documents and Settings\All Users.WINDOWS\Application Data\xstqncbg\hgpavyvg.exe
O4 - Startup: Snapfish PictureMover.lnk = C:\Program Files\Snapfish PictureMover\PictureMover.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://*.mcafee.com
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {2DAD3559-2923-4935-AD49-B673D2539944} (IASRunner Class) - https://www-307.ibm.com/pc/support/a...tent/AcpIR.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {74C861A1-D548-4916-BC8A-FDE92EDFF62C} - http://mediaplayer.walmart.com/installer/install.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://playgames.comcast.net/Gameshe...onGameHost.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/.../installer.exe
O21 - SSODL: VolumeAvp - {d3b77f49-0f44-4e48-871b-cd2e8890c725} - (no file)
O21 - SSODL: RamRam - {7e5c3344-0009-4b57-9fae-b642d54866bd} - (no file)
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Chat Controller - Zemerick Software, Inc. - C:\Program Files\ChatController\ccservice.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
O24 - Desktop Component 0: Privacy Protection - file:///C:\WINDOWS\privacy_danger\index.htm

--
End of file - 10587 bytes
mnotarangelo is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 03-31-2008, 08:03 PM   #4 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,691
OS: 2000 Pro; XP Pro; XP Home


Re: Generic Dropper.AU - Major Pop-Ups, etc
Disconnect from the internet, and disable your protection applications once again. They may otherwise interfere with ComboFix.

Quote:
* Resident AV is active

Open HijackThis and click on 'Do a System Scan Only'. Check the following entries if they exist (make sure you do not miss any) and click Fix Checked

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php...MjI6Ojg5&lid=2
O2 - BHO: GNX Bingo - {2F97A8CB-0E8F-4AF0-B737-12C03F355794} - C:\WINDOWS\kdftlboeopx.dll
O4 - HKLM\..\Run: [antiviirus] C:\Program Files\antiviirus.exe
O4 - HKLM\..\RunOnce: [pouetChessuninstall2] cmd.exe
O4 - HKCU\..\Run: [qpsxgjbi] C:\WINDOWS\system32\lmnkdwpc.exe
O4 - HKCU\..\Run: [docbpbkg] C:\WINDOWS\system32\spcjebat.exe
O4 - HKLM\..\Policies\Explorer\Run: [4P12KCLZWW] C:\Documents and Settings\All Users.WINDOWS\Application Data\xstqncbg\hgpavyvg.exe
O21 - SSODL: VolumeAvp - {d3b77f49-0f44-4e48-871b-cd2e8890c725} - (no file)
O21 - SSODL: RamRam - {7e5c3344-0009-4b57-9fae-b642d54866bd} - (no file)
O24 - Desktop Component 0: Privacy Protection - file:///C:\WINDOWS\privacy_danger\index.htm


Close HijackThis now.

---------------------------------------------------------------------------------------------

Open notepad and copy/paste the text in the quotebox below into it:

Quote:
http://www.techsupportforum.com/security-center/hijackthis-log-help/234016-generic-dropper-au-major-pop-ups-etc.html

Folder::
C:\Documents and Settings\All Users.WINDOWS\Application Data\xstqncbg
c:\program files\Inet Delivery
c:\windows\mslagent

Registry::
[-hkey_classes_root\clsid\{54645654-2225-4455-44A1-9F4543D34545}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2F97A8CB-0E8F-4AF0-B737-12C03F355794}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"qpsxgjbi"=-
"docbpbkg"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"antiviirus"=-
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]
"4P12KCLZWW"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"VolumeAvp"=-
"RamRam"=-

Collect::
C:\Documents and Settings\All Users.WINDOWS\Application Data\xstqncbg\hgpavyvg.exe
C:\WINDOWS\system32\ynwhslcb.exe
C:\WINDOWS\system32\lmnkdwpc.exe
C:\WINDOWS\kdftlboeopx.dll
C:\Program Files\antiviirus.exe
C:\WINDOWS\system32\spcjebat.exe
Save this as CFScript.txt




Refering to the picture above, drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply.

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture a file to submit for analysis.

Re-enable your protections...a reboot should have done this.

Ensure you are connected to the internet and click OK. A browser will open. Simply follow the instructions to copy/paste/send the requested file.

---------------------------------------------------------------------------------------------

Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here.

---------------------------------------------------------------------------------------------
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 03-31-2008, 09:07 PM   #5 (permalink)
Registered User
 
Join Date: Mar 2008
Posts: 11
OS: WINXP


Thumbs Up Re: Generic Dropper.AU - Major Pop-Ups, etc
HI TETONBOB...

I could not connect to the internet and send the file. When COMBOFIX finished running, the screen was blank - no start button, no bar, no clock, no nothing - so I couldn't reconnect and send the file.

I did the combofix and hijackthis.

Thank you! Mike


combofix:
ComboFix 08-03-30.4 - MichaelN 2008-03-31 22:48:35.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.533 [GMT -4:00]
Running from: C:\Documents and Settings\MichaelN.THE-EA27A253A91\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\MichaelN.THE-EA27A253A91\Desktop\CFScript.txt
* Created a new restore point
* Resident AV is active

.
TimedOut: progfile.dat

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users.WINDOWS\Application Data\xstqncbg
C:\Documents and Settings\All Users.WINDOWS\Application Data\xstqncbg\hgpavyvg.exe
C:\Program Files\antiviirus.exe
C:\WINDOWS\kdftlboeopx.dll
C:\WINDOWS\rs.txt
C:\WINDOWS\system32\lmnkdwpc.exe
C:\WINDOWS\system32\spcjebat.exe
C:\WINDOWS\system32\ynwhslcb.exe

.
((((((((((((((((((((((((( Files Created from 2008-03-01 to 2008-04-01 )))))))))))))))))))))))))))))))
.

2008-03-31 21:38 . 2008-03-31 21:38 <DIR> d-------- C:\Program Files\Trend Micro
2008-03-25 20:48 . 2008-03-25 20:48 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-03-25 20:48 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\system32\MSINET.OCX
2008-03-25 13:31 . 2008-03-25 14:03 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2008-03-25 13:31 . 2008-03-25 13:31 30,590 --a------ C:\WINDOWS\system32\pavas.ico
2008-03-25 13:31 . 2008-03-25 13:31 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico
2008-03-25 13:31 . 2008-03-25 13:31 1,406 --a------ C:\WINDOWS\system32\Help.ico
2008-03-24 19:50 . 2008-03-24 19:50 61,224 --a------ C:\Documents and Settings\MichaelN.THE-EA27A253A91\GoToAssistDownloadHelper.exe
2008-03-24 19:28 . 2008-03-24 19:28 <DIR> d----c--- C:\Deckard
2008-03-24 19:03 . 2007-05-21 15:28 <DIR> d-------- C:\Documents and Settings\Administrator.THE-EA27A253A91\Application Data\Intel
2008-03-22 20:39 . 2008-03-22 20:39 <DIR> d-------- C:\Program Files\Safari
2008-03-21 08:30 . 2008-03-21 08:30 <DIR> d-------- C:\WINDOWS\system32\AGEIA
2008-03-21 08:30 . 2008-03-21 08:30 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-03-21 08:30 . 2008-03-21 08:31 <DIR> d-------- C:\Program Files\AGEIA Technologies
2008-03-19 16:43 . 2008-03-19 16:43 <DIR> d-------- C:\WINDOWS\PixArt
2008-03-19 16:43 . 2008-03-19 16:43 <DIR> d-------- C:\Program Files\Common Files\PAC207
2008-03-19 16:43 . 2008-03-19 16:43 <DIR> d-------- C:\Program Files\Basic Webcam
2008-03-19 16:43 . 2006-11-03 10:59 48,128 --a------ C:\WINDOWS\system32\Remove.exe
2008-03-19 16:43 . 2007-03-16 00:10 316 --a------ C:\WINDOWS\system32\Remover.ini
2008-03-19 16:41 . 2008-03-19 16:41 <DIR> d-------- C:\Program Files\BestOn
2008-03-17 14:52 . 2008-03-17 14:52 <DIR> d-------- C:\Documents and Settings\LucasN.THE-EA27A253A91\Application Data\HP
2008-03-14 19:23 . 2008-03-14 19:23 <DIR> d-------- C:\Program Files\uTorrent
2008-03-11 17:43 . 2008-03-11 17:43 <DIR> d-------- C:\Documents and Settings\Susan\Application Data\acccore
2008-03-07 21:31 . 2008-03-07 21:31 <DIR> d-------- C:\Program Files\Unity
2008-03-05 07:31 . 2004-08-04 01:56 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll
2008-03-05 07:31 . 2001-08-17 23:36 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll
2008-03-02 11:10 . 2008-03-21 08:59 <DIR> d-------- C:\Program Files\Ubisoft
2008-03-02 10:54 . 2004-05-14 17:53 462,848 --a------ C:\WINDOWS\system32\ltkrn13n.dll
2008-03-02 10:54 . 2004-05-14 17:53 450,560 --a------ C:\WINDOWS\system32\ltimg13n.dll
2008-03-02 10:54 . 2004-05-14 17:53 401,408 --a------ C:\WINDOWS\system32\lfcmp13n.dll
2008-03-02 10:54 . 2004-05-14 17:53 299,008 --a------ C:\WINDOWS\system32\ltdis13n.dll
2008-03-02 10:54 . 2004-01-12 03:09 206,336 --a------ C:\WINDOWS\system32\ltefx13n.dll
2008-03-02 10:54 . 2004-05-14 17:53 163,840 --a------ C:\WINDOWS\system32\ltfil13n.dll
2008-03-02 10:54 . 2003-11-04 16:10 69,632 --a------ C:\WINDOWS\system32\lfgif13n.dll
2008-03-02 10:54 . 2004-05-14 17:53 57,344 --a------ C:\WINDOWS\system32\lfbmp13n.dll
2008-03-01 20:52 . 2008-03-31 21:34 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-03-01 20:52 . 2008-03-01 20:52 1,409 --a------ C:\WINDOWS\QTFont.for

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-01 00:57 --------- d-----w C:\Program Files\McAfee
2008-03-30 04:01 --------- d-----w C:\Documents and Settings\MichaelN.THE-EA27A253A91\Application Data\source code
2008-03-26 20:51 --------- d-----w C:\Documents and Settings\LucasN.THE-EA27A253A91\Application Data\COMCASTTOOLBAR
2008-03-26 13:09 --------- d-----w C:\Program Files\iTunes
2008-03-26 09:31 --------- d-----w C:\Program Files\AIM6
2008-03-26 02:38 --------- d---a-w C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP
2008-03-25 23:12 --------- d-----w C:\Documents and Settings\MichaelN.THE-EA27A253A91\Application Data\Smilebox
2008-03-25 18:04 --------- d-----w C:\Program Files\Lexmark 1200 Series
2008-03-25 18:04 --------- d-----w C:\Program Files\ComcastToolbar
2008-03-24 23:43 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\McAfee
2008-03-24 19:48 --------- d-----w C:\Documents and Settings\Susan\Application Data\COMCASTTOOLBAR
2008-03-23 00:41 --------- d-----w C:\Documents and Settings\MichaelN.THE-EA27A253A91\Application Data\Apple Computer
2008-03-22 03:01 --------- d-----w C:\Documents and Settings\MichaelN.THE-EA27A253A91\Application Data\uTorrent
2008-03-21 12:59 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-21 12:53 --------- d-----w C:\Documents and Settings\ZacharyN.THE-EA27A253A91\Application Data\COMCASTTOOLBAR
2008-03-16 02:27 --------- d-----w C:\Program Files\Google
2008-03-15 17:01 47,360 ----a-w C:\Documents and Settings\MichaelN.THE-EA27A253A91\Application Data\pcouffin.sys
2008-03-15 17:01 --------- d-----w C:\Documents and Settings\MichaelN.THE-EA27A253A91\Application Data\Vso
2008-03-15 17:00 --------- d-----w C:\Program Files\Call of Duty Game of the Year Edition
2008-03-14 22:34 --------- d-----w C:\Program Files\EA SPORTS
2008-03-14 22:34 --------- d-----w C:\Program Files\CLSetup07
2008-03-14 03:07 68,248 -c--a-w C:\Documents and Settings\MichaelN.THE-EA27A253A91\Application Data\GDIPFONTCACHEV1.DAT
2008-03-06 00:36 --------- d-----w C:\Program Files\Mah Jong Medley
2008-03-02 00:52 --------- d-----w C:\Program Files\iPod
2008-03-02 00:50 --------- d-----w C:\Program Files\QuickTime
2008-02-24 15:22 --------- d-----w C:\Program Files\ReflexiveArcade
2008-02-21 13:02 --------- d-----w C:\Documents and Settings\Susan\Application Data\Move Networks
2008-02-19 20:10 --------- d-----w C:\Documents and Settings\LucasN.THE-EA27A253A91\Application Data\Viewpoint
2008-02-16 02:19 --------- d-----w C:\Program Files\Free History Eraser
2008-02-16 00:03 --------- d--h--w C:\Documents and Settings\MichaelN.THE-EA27A253A91\Application Data\Gtek
2008-02-16 00:03 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Gtek
2008-02-15 23:06 --------- d-----w C:\Documents and Settings\MichaelN.THE-EA27A253A91\Application Data\Snapfish
2008-02-15 23:05 --------- d-----w C:\Program Files\Snapfish PictureMover
2008-02-09 16:52 --------- d-----w C:\Program Files\Nick Arcade
2008-02-06 14:51 171,400 ----a-w C:\WINDOWS\system32\drivers\mfehidk.sys
2008-01-21 19:07 67,864 ----a-w C:\Documents and Settings\ZacharyN.THE-EA27A253A91\Application Data\GDIPFONTCACHEV1.DAT
2008-01-11 05:53 44,544 ----a-w C:\WINDOWS\system32\SET1CB.tmp
2007-12-16 20:19 67,864 -c--a-w C:\Documents and Settings\LucasN.THE-EA27A253A91\Application Data\GDIPFONTCACHEV1.DAT
2007-07-29 16:23 67,480 -c--a-w C:\Documents and Settings\Susan\Application Data\GDIPFONTCACHEV1.DAT
2006-07-18 00:46 130 -c--a-w C:\Documents and Settings\MichaelN.THE-EA27A253A91\Application Data\fusioncache.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:00 15360]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-03-27 15:22 4670968]
"SmileboxTray"="C:\Documents and Settings\MichaelN.THE-EA27A253A91\Application Data\Smilebox\SmileboxTray.exe" [2008-01-28 19:27 201352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Lexmark 1200 Series"="C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe" [2006-07-13 14:22 57344]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-02-01 00:13 385024]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 14:10 267048]
"Monitor"="C:\WINDOWS\PixArt\PAC207\Monitor.exe" [2006-11-03 11:01 319488]

C:\Documents and Settings\MichaelN.THE-EA27A253A91\Start Menu\Programs\Startup\
Snapfish PictureMover.lnk - C:\Program Files\Snapfish PictureMover\PictureMover.exe [2007-11-06 18:35:44 475136]

C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Microsoft Works Calendar Reminders.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Microsoft Works Calendar Reminders.lnk
backup=C:\WINDOWS\pss\Microsoft Works Calendar Reminders.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2004-08-04 06:00 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cww]
--a--c--- 2007-08-06 17:40 307384 C:\Program Files\cw5\cww.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
-----c--- 2005-12-09 20:29 49152 C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus C88 Series]
--a--c--- 2005-01-27 04:00 98304 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIABA.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
--a--c--- 2006-06-06 17:06 77824 C:\WINDOWS\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]
--a--c--- 2006-06-06 17:10 118784 C:\WINDOWS\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]
--a--c--- 2006-06-06 17:09 94208 C:\WINDOWS\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelWireless]
--a--c--- 2007-02-21 11:17 970752 C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelZeroConfig]
--a--c--- 2007-02-21 11:19 819200 C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-02-19 14:10 267048 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
--a--c--- 2001-08-16 23:41 28738 C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MP10_EnsureFileVer]
--a------ 2007-06-26 23:10 317440 C:\WINDOWS\inf\unregmp2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2004-10-13 12:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService]
-----c--- 2004-04-11 20:15 290816 C:\Program Files\Dell\Media Experience\PCMService.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-02-01 00:13 385024 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]
--a--c--- 2006-03-24 17:30 282624 C:\WINDOWS\stsystra.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a--c--- 2007-03-14 03:43 83608 C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
--a--c--- 2006-05-19 14:51 774233 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
-ra------ 2006-03-30 17:45 313472 C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
--a------ 2007-03-27 15:22 4670968 C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\uTorrent\\utorrent.exe"=
"C:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=

R2 Chat Controller;Chat Controller;C:\Program Files\ChatController\ccservice.exe [2007-01-08 13:57]
R2 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" [2007-01-04 17:38]
S3 PAC207;Basic Webcam;C:\WINDOWS\system32\DRIVERS\PFC027.SYS [2006-11-20 08:48]

.
Contents of the 'Scheduled Tasks' folder
"2008-03-22 23:35:04 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-03-15 05:00:01 C:\WINDOWS\Tasks\McDefragTask.job"
- c:\program files\mcafee\mqc\QcConsol.exe'
"2008-03-01 06:00:25 C:\WINDOWS\Tasks\McQcTask.job"
- c:\program files\mcafee\mqc\QcConsol.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-31 22:53:07
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-03-31 22:56:14
ComboFix-quarantined-files.txt 2008-04-01 02:56:10
ComboFix2.txt 2008-04-01 01:23:41
Pre-Run: 8,987,369,472 bytes free
Post-Run: 8,980,840,448 bytes free
.
2008-03-12 07:02:22 --- E O F ---


HIJACKTHIS:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:05:30 PM, on 3/31/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\ChatController\ccservice.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\PROGRA~1\McAfee\MPS\mps.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\McAfee\MPS\mpsevh.exe
C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\PixArt\PAC207\Monitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\MichaelN.THE-EA27A253A91\Application Data\Smilebox\SmileboxTray.exe
C:\Program Files\Snapfish PictureMover\PictureMover.exe
C:\Program Files\Lexmark 1200 Series\lxczbmon.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~1\COMCAS~1.DLL
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptcl.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~1\COMCAS~1.DLL
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [Lexmark 1200 Series] "C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Monitor] C:\WINDOWS\PixArt\PAC207\Monitor.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [SmileboxTray] "C:\Documents and Settings\MichaelN.THE-EA27A253A91\Application Data\Smilebox\SmileboxTray.exe"
O4 - Startup: Snapfish PictureMover.lnk = C:\Program Files\Snapfish PictureMover\PictureMover.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://*.mcafee.com
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {2DAD3559-2923-4935-AD49-B673D2539944} (IASRunner Class) - https://www-307.ibm.com/pc/support/a...tent/AcpIR.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {74C861A1-D548-4916-BC8A-FDE92EDFF62C} - http://mediaplayer.walmart.com/installer/install.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://playgames.comcast.net/Gameshe...onGameHost.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/.../installer.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Chat Controller - Zemerick Software, Inc. - C:\Program Files\ChatController\ccservice.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

--
End of file - 9626 bytes
mnotarangelo is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 03-31-2008, 09:11 PM   #6 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,691
OS: 2000 Pro; XP Pro; XP Home


Re: Generic Dropper.AU - Major Pop-Ups, etc
Ok, but now you have connection, or you're using another machine? Is the desktop back to normal?

Quote:
* Resident AV is active
This is twice now the directives have not been followed. Are you having difficulty disabling McAfee? Having the AV active while ComboFix is working can cause system issues, it's why we want it disabled.

What is the current status of the machine?
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 03-31-2008, 09:21 PM   #7 (permalink)
Registered User
 
Join Date: Mar 2008
Posts: 11
OS: WINXP


Re: Generic Dropper.AU - Major Pop-Ups, etc
I'm really trying - I can't seem to shut down McAfee!

Can you help me figure it out? Do I just go to processes and shut down all McAfee?

I'm sorry - I appreciate your help I'm just not sure how to do it.

Mike
mnotarangelo is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 03-31-2008, 09:23 PM   #8 (permalink)
Registered User
 
Join Date: Mar 2008
Posts: 11
OS: WINXP


Re: Generic Dropper.AU - Major Pop-Ups, etc
I think I shut everything down until a system restart. Mike
mnotarangelo is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 03-31-2008, 09:26 PM   #9 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,691
OS: 2000 Pro; XP Pro; XP Home


Re: Generic Dropper.AU - Major Pop-Ups, etc
Ok, Mike...McAfee is a bit of a pill to gain control of. Thanks for letting me know you're trying. What's more important for me to know right now is the current state of your machine.

Desktop normal? Internet OK?
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 03-31-2008, 09:54 PM   #10 (permalink)
Registered User
 
Join Date: Mar 2008
Posts: 11
OS: WINXP


Re: Generic Dropper.AU - Major Pop-Ups, etc
Thanks Bob....I thought I had McAfee licked...went in and disabled all services (I Thought....but no)

The desktop seems correct. I am no longer getting the virus software page as my background. I still cannot get the Comcast Tool bar to reappear. When I go back to VIEW/Toolbars it has Comcast grayed out.

The continuous pop ups are gone.

I don't see any more Trojan errors although I think I checked off something like 'do not show this error again'...

I'm a mess Bob - Sorry! I wish I were more help!

Mike

Hijack Log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:32, on 2008-03-31
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\savedump.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\ChatController\ccservice.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\PROGRA~1\McAfee\MPS\mps.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\McAfee\MPS\mpsevh.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\PixArt\PAC207\Monitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\MichaelN.THE-EA27A253A91\Application Data\Smilebox\SmileboxTray.exe
C:\Program Files\Lexmark 1200 Series\lxczbmon.exe
C:\Program Files\Snapfish PictureMover\PictureMover.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
c:\PROGRA~1\mcafee\msc\mcuimgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~1\COMCAS~1.DLL
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptcl.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~1\COMCAS~1.DLL
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [Lexmark 1200 Series] "C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Monitor] C:\WINDOWS\PixArt\PAC207\Monitor.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [SmileboxTray] "C:\Documents and Settings\MichaelN.THE-EA27A253A91\Application Data\Smilebox\SmileboxTray.exe"
O4 - Startup: Snapfish PictureMover.lnk = C:\Program Files\Snapfish PictureMover\PictureMover.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://*.mcafee.com
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {2DAD3559-2923-4935-AD49-B673D2539944} (IASRunner Class) - https://www-307.ibm.com/pc/support/a...tent/AcpIR.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {74C861A1-D548-4916-BC8A-FDE92EDFF62C} - http://mediaplayer.walmart.com/installer/install.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://playgames.comcast.net/Gameshe...onGameHost.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/.../installer.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Chat Controller - Zemerick Software, Inc. - C:\Program Files\ChatController\ccservice.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

--
End of file - 9516 bytes


Combofix.txt log:
ComboFix 08-03-30.4 - MichaelN 2008-03-31 23:34:14.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.593 [GMT -4:00]
Running from: C:\Documents and Settings\MichaelN.THE-EA27A253A91\Desktop\ComboFix.exe
* Resident AV is active

.
TimedOut: progfile.dat

((((((((((((((((((((((((( Files Created from 2008-03-01 to 2008-04-01 )))))))))))))))))))))))))))))))
.

2008-03-31 21:38 . 2008-03-31 21:38 <DIR> d-------- C:\Program Files\Trend Micro
2008-03-25 20:48 . 2008-03-25 20:48 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-03-25 20:48 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\system32\MSINET.OCX
2008-03-25 13:31 . 2008-03-25 14:03 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2008-03-25 13:31 . 2008-03-25 13:31 30,590 --a------ C:\WINDOWS\system32\pavas.ico
2008-03-25 13:31 . 2008-03-25 13:31 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico
2008-03-25 13:31 . 2008-03-25 13:31 1,406 --a------ C:\WINDOWS\system32\Help.ico
2008-03-24 19:50 . 2008-03-24 19:50 61,224 --a------ C:\Documents and Settings\MichaelN.THE-EA27A253A91\GoToAssistDownloadHelper.exe
2008-03-24 19:28 . 2008-03-24 19:28 <DIR> d----c--- C:\Deckard
2008-03-24 19:03 . 2007-05-21 15:28 <DIR> d-------- C:\Documents and Settings\Administrator.THE-EA27A253A91\Application Data\Intel
2008-03-22 20:39 . 2008-03-22 20:39 <DIR> d-------- C:\Program Files\Safari
2008-03-21 08:30 . 2008-03-21 08:30 <DIR> d-------- C:\WINDOWS\system32\AGEIA
2008-03-21 08:30 . 2008-03-21 08:30 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-03-21 08:30 . 2008-03-21 08:31 <DIR> d-------- C:\Program Files\AGEIA Technologies
2008-03-19 16:43 . 2008-03-19 16:43 <DIR> d-------- C:\WINDOWS\PixArt
2008-03-19 16:43 . 2008-03-19 16:43 <DIR> d-------- C:\Program Files\Common Files\PAC207
2008-03-19 16:43 . 2008-03-19 16:43 <DIR> d-------- C:\Program Files\Basic Webcam
2008-03-19 16:43 . 2006-11-03 10:59 48,128 --a------ C:\WINDOWS\system32\Remove.exe
2008-03-19 16:43 . 2007-03-16 00:10 316 --a------ C:\WINDOWS\system32\Remover.ini
2008-03-19 16:41 . 2008-03-19 16:41 <DIR> d-------- C:\Program Files\BestOn
2008-03-17 14:52 . 2008-03-17 14:52 <DIR> d-------- C:\Documents and Settings\LucasN.THE-EA27A253A91\Application Data\HP
2008-03-14 19:23 . 2008-03-14 19:23 <DIR> d-------- C:\Program Files\uTorrent
2008-03-11 17:43 . 2008-03-11 17:43 <DIR> d-------- C:\Documents and Settings\Susan\Application Data\acccore
2008-03-07 21:31 . 2008-03-07 21:31 <DIR> d-------- C:\Program Files\Unity
2008-03-05 07:31 . 2004-08-04 01:56 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll
2008-03-05 07:31 . 2001-08-17 23:36 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll
2008-03-02 11:10 . 2008-03-21 08:59 <DIR> d-------- C:\Program Files\Ubisoft
2008-03-02 10:54 . 2004-05-14 17:53 462,848 --a------ C:\WINDOWS\system32\ltkrn13n.dll
2008-03-02 10:54 . 2004-05-14 17:53 450,560 --a------ C:\WINDOWS\system32\ltimg13n.dll
2008-03-02 10:54 . 2004-05-14 17:53 401,408 --a------ C:\WINDOWS\system32\lfcmp13n.dll
2008-03-02 10:54 . 2004-05-14 17:53 299,008 --a------ C:\WINDOWS\system32\ltdis13n.dll
2008-03-02 10:54 . 2004-01-12 03:09 206,336 --a------ C:\WINDOWS\system32\ltefx13n.dll
2008-03-02 10:54 . 2004-05-14 17:53 163,840 --a------ C:\WINDOWS\system32\ltfil13n.dll
2008-03-02 10:54 . 2003-11-04 16:10 69,632 --a------ C:\WINDOWS\system32\lfgif13n.dll
2008-03-02 10:54 . 2004-05-14 17:53 57,344 --a------ C:\WINDOWS\system32\lfbmp13n.dll
2008-03-01 20:52 . 2008-03-31 23:31 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-03-01 20:52 . 2008-03-01 20:52 1,409 --a------ C:\WINDOWS\QTFont.for

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-01 00:57 --------- d-----w C:\Program Files\McAfee
2008-03-30 04:01 --------- d-----w C:\Documents and Settings\MichaelN.THE-EA27A253A91\Application Data\source code
2008-03-26 20:51 --------- d-----w C:\Documents and Settings\LucasN.THE-EA27A253A91\Application Data\COMCASTTOOLBAR
2008-03-26 13:09 --------- d-----w C:\Program Files\iTunes
2008-03-26 09:31 --------- d-----w C:\Program Files\AIM6
2008-03-26 02:38 --------- d---a-w C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP
2008-03-25 23:12 --------- d-----w C:\Documents and Settings\MichaelN.THE-EA27A253A91\Application Data\Smilebox
2008-03-25 18:04 --------- d-----w C:\Program Files\Lexmark 1200 Series
2008-03-25 18:04 --------- d-----w C:\Program Files\ComcastToolbar
2008-03-24 23:43 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\McAfee
2008-03-24 19:48 --------- d-----w C:\Documents and Settings\Susan\Application Data\COMCASTTOOLBAR
2008-03-23 00:41 --------- d-----w C:\Documents and Settings\MichaelN.THE-EA27A253A91\Application Data\Apple Computer
2008-03-22 03:01 --------- d-----w C:\Documents and Settings\MichaelN.THE-EA27A253A91\Application Data\uTorrent
2008-03-21 12:59 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-21 12:53 --------- d-----w C:\Documents and Settings\ZacharyN.THE-EA27A253A91\Application Data\COMCASTTOOLBAR
2008-03-16 02:27 --------- d-----w C:\Program Files\Google
2008-03-15 17:01 47,360 ----a-w C:\Documents and Settings\MichaelN.THE-EA27A253A91\Application Data\pcouffin.sys
2008-03-15 17:01 --------- d-----w C:\Documents and Settings\MichaelN.THE-EA27A253A91\Application Data\Vso
2008-03-15 17:00 --------- d-----w C:\Program Files\Call of Duty Game of the Year Edition
2008-03-14 22:34 --------- d-----w C:\Program Files\EA SPORTS
2008-03-14 22:34 --------- d-----w C:\Program Files\CLSetup07
2008-03-14 03:07 68,248 -c--a-w C:\Documents and Settings\MichaelN.THE-EA27A253A91\Application Data\GDIPFONTCACHEV1.DAT
2008-03-06 00:36 --------- d-----w C:\Program Files\Mah Jong Medley
2008-03-02 00:52 --------- d-----w C:\Program Files\iPod
2008-03-02 00:50 --------- d-----w C:\Program Files\QuickTime
2008-02-24 15:22 --------- d-----w C:\Program Files\ReflexiveArcade
2008-02-21 13:02 --------- d-----w C:\Documents and Settings\Susan\Application Data\Move Networks
2008-02-19 20:10 --------- d-----w C:\Documents and Settings\LucasN.THE-EA27A253A91\Application Data\Viewpoint
2008-02-16 02:19 --------- d-----w C:\Program Files\Free History Eraser
2008-02-16 00:03 --------- d--h--w C:\Documents and Settings\MichaelN.THE-EA27A253A91\Application Data\Gtek
2008-02-16 00:03 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Gtek
2008-02-15 23:06 --------- d-----w C:\Documents and Settings\MichaelN.THE-EA27A253A91\Application Data\Snapfish
2008-02-15 23:05 --------- d-----w C:\Program Files\Snapfish PictureMover
2008-02-09 16:52 --------- d-----w C:\Program Files\Nick Arcade
2008-02-06 14:51 171,400 ----a-w C:\WINDOWS\system32\drivers\mfehidk.sys
2008-01-21 19:07 67,864 ----a-w C:\Documents and Settings\ZacharyN.THE-EA27A253A91\Application Data\GDIPFONTCACHEV1.DAT
2008-01-11 05:53 44,544 ----a-w C:\WINDOWS\system32\SET1CB.tmp
2007-12-16 20:19 67,864 -c--a-w C:\Documents and Settings\LucasN.THE-EA27A253A91\Application Data\GDIPFONTCACHEV1.DAT
2007-07-29 16:23 67,480 -c--a-w C:\Documents and Settings\Susan\Application Data\GDIPFONTCACHEV1.DAT
2006-07-18 00:46 130 -c--a-w C:\Documents and Settings\MichaelN.THE-EA27A253A91\Application Data\fusioncache.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:00 15360]
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [2007-03-27 15:22 4670968]
"SmileboxTray"="C:\Documents and Settings\MichaelN.THE-EA27A253A91\Application Data\Smilebox\SmileboxTray.exe" [2008-01-28 19:27 201352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Lexmark 1200 Series"="C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe" [2006-07-13 14:22 57344]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-02-01 00:13 385024]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 14:10 267048]
"Monitor"="C:\WINDOWS\PixArt\PAC207\Monitor.exe" [2006-11-03 11:01 319488]

C:\Documents and Settings\MichaelN.THE-EA27A253A91\Start Menu\Programs\Startup\
Snapfish PictureMover.lnk - C:\Program Files\Snapfish PictureMover\PictureMover.exe [2007-11-06 18:35:44 475136]

C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Microsoft Works Calendar Reminders.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Microsoft Works Calendar Reminders.lnk
backup=C:\WINDOWS\pss\Microsoft Works Calendar Reminders.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2004-08-04 06:00 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cww]
--a--c--- 2007-08-06 17:40 307384 C:\Program Files\cw5\cww.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
-----c--- 2005-12-09 20:29 49152 C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus C88 Series]
--a--c--- 2005-01-27 04:00 98304 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIABA.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
--a--c--- 2006-06-06 17:06 77824 C:\WINDOWS\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]
--a--c--- 2006-06-06 17:10 118784 C:\WINDOWS\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]
--a--c--- 2006-06-06 17:09 94208 C:\WINDOWS\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelWireless]
--a--c--- 2007-02-21 11:17 970752 C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelZeroConfig]
--a--c--- 2007-02-21 11:19 819200 C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-02-19 14:10 267048 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
--a--c--- 2001-08-16 23:41 28738 C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MP10_EnsureFileVer]
--a------ 2007-06-26 23:10 317440 C:\WINDOWS\inf\unregmp2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2004-10-13 12:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService]
-----c--- 2004-04-11 20:15 290816 C:\Program Files\Dell\Media Experience\PCMService.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-02-01 00:13 385024 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]
--a--c--- 2006-03-24 17:30 282624 C:\WINDOWS\stsystra.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a--c--- 2007-03-14 03:43 83608 C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
--a--c--- 2006-05-19 14:51 774233 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
-ra------ 2006-03-30 17:45 313472 C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
--a------ 2007-03-27 15:22 4670968 C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\uTorrent\\utorrent.exe"=
"C:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=

R2 Chat Controller;Chat Controller;C:\Program Files\ChatController\ccservice.exe [2007-01-08 13:57]
R2 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" [2007-01-04 17:38]
S3 PAC207;Basic Webcam;C:\WINDOWS\system32\DRIVERS\PFC027.SYS [2006-11-20 08:48]

.
Contents of the 'Scheduled Tasks' folder
"2008-03-22 23:35:04 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-03-15 05:00:01 C:\WINDOWS\Tasks\McDefragTask.job"
- c:\program files\mcafee\mqc\QcConsol.exe'
"2008-03-01 06:00:25 C:\WINDOWS\Tasks\McQcTask.job"
- c:\program files\mcafee\mqc\QcConsol.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-31 23:38:10
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-03-31 23:41:44
ComboFix-quarantined-files.txt 2008-04-01 03:41:41
ComboFix2.txt 2008-04-01 02:56:15
ComboFix3.txt 2008-04-01 01:23:41
Pre-Run: 8,980,353,024 bytes free
Post-Run: 8,973,262,848 bytes free
.
2008-03-12 07:02:22 --- E O F ---
mnotarangelo is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 03-31-2008, 09:58 PM   #11 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,691
OS: 2000 Pro; XP Pro; XP Home


Re: Generic Dropper.AU - Major Pop-Ups, etc
You're doing fine, Mike.

Somewhere on your desktop should be a file named similarly to this:

[4]-Submit_2008-03-31@22:48.zip

Please upload it here:

http://www.bleepingcomputer.com/subm....php?channel=4

Let me know when you've done that, and we'll move on.
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 03-31-2008, 10:12 PM   #12 (permalink)
Registered User
 
Join Date: Mar 2008
Posts: 11
OS: WINXP


Re: Generic Dropper.AU - Major Pop-Ups, etc
Thank you Bob...
It's been sent.
mnotarangelo is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 03-31-2008, 10:15 PM   #13 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,691
OS: 2000 Pro; XP Pro; XP Home


Re: Generic Dropper.AU - Major Pop-Ups, etc
Great. Thanks, Mike.

Please now delete the zip file from your desktop.

I'm not sure about the Comcast Toolbar issue, it may need to be reinstalled if it's something you use a lot. Let's make sure the system is clean first.

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
  • Download the latest version of Java Runtime Environment (JRE) 6 Update 5 and save it to your desktop.
  • Scroll down to where it says "The Java SE Runtime Environment (JRE) allows end-users to run Java applications."
  • Click the "Download" button to the right.
  • Read the License Agreement and then check the box that says: "Accept License Agreement". The page will refresh.
  • Click on the link to download Windows Offline Installation and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u5-windows-i586-p.exe to install the newest version.
  • After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
    • On the General tab, under Temporary Internet Files, click the Settings button.
    • Next, click on the Delete Files button
    • There are two options in the window to clear the cache - Leave BOTH Checked
      • Applications and Applets
        Trace and Log Files
    • Click OK on Delete Temporary Files Window
      Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
    • Click OK to leave the Temporary Files Window
    • Click OK to leave the Java Control Panel.

---------------------------------------------------------------------------------------------

Please download ATF Cleaner by Atribune.
This program is for XP and Windows 2000 only
  • Double-click ATF-Cleaner.exe to run the program.
    Under Main choose: Select All
    Click the Empty Selected button.
If you use Firefox browser
  • Click Firefox at the top and choose: Select All
    Click the Empty Selected button.
    NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browser
  • Click Opera at the top and choose: Select All
    Click the Empty Selected button.
    NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

---------------------------------------------------------------------------------------------

Please run this online scan to help look for remnants.

First, Go to Start>Control Panel>Add/Remove Programs and remove Kaspersky online scanner if present prior to downloading the most up-to-date one.

Next, establish an internet connection & perform an online scan using Internet Explorer at Kaspersky Online Scanner

Answer Yes, when prompted to install an ActiveX component.
  • The program will then begin downloading the latest definition files.
  • Once the files have been downloaded click on NEXT
  • Locate the Scan Settings button & configure to:
    • Scan using the following Anti-Virus database:
      • Extended
    • Scan Options:
      • Scan Archives
      • Scan Mail Bases
  • Click OK & have it scan My Computer
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Click the Save as Text button to save the file to your desktop so that you may post it in your next reply
* Turn off the real time scanner of any existing antivirus program while performing the online scan

Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%.

---------------------------------------------------------------------------------------------

Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here.

---------------------------------------------------------------------------------------------
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 04-01-2008, 02:56 PM   #14 (permalink)
Registered User
 
Join Date: Mar 2008
Posts: 11
OS: WINXP


Re: Generic Dropper.AU - Major Pop-Ups, etc
Hi Bob,
Welcome back to my nightmare! :)

I can't get Kaspersky to finish, it has gotten to 50 percent both times and hangs at about 80K records.

I will try again but it doesn't seem like it will work.

Thanks,
Mike
mnotarangelo is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 04-01-2008, 03:18 PM   #15 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,691
OS: 2000 Pro; XP Pro; XP Home


Re: Generic Dropper.AU - Major Pop-Ups, etc
Quote:
hangs at about 80K records.
Hi Mike -

Not exactly sure what that means....? Do the ActiveX control not install? Or does the scanner hang at some point?

Could once again be McAfee interfering if the latter....

MCAFEE ANTIVIRUS
Please navigate to the system tray on the bottom right hand corner and look for a sign.
  • right-click it -> chose "Exit."
  • a popup will warn that protection will now be disabled. Click on "Yes" to disable the Antivirus guard.
You succesfully disabled the McAfee Guard.

If still no joy, we have other options....

Go here to run an online scannner from ESET.
  • Note: You will need to use Internet explorer for this scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activex control to install
  • Click Start
  • Make sure that the option Remove found threats is unticked, and the option Scan unwanted applications is checked
  • Click Scan
  • Wait for the scan to finish
  • Use notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
  • Copy and paste that log as a reply to this topic and also let me know how things are now.

If that doesn't work.....

* Download Dr.Web CureIt to the desktop:
ftp://ftp.drweb.com/pub/drweb/cureit/cureit.exe
  • Doubleclick the drweb-cureit.exe file.
  • Click on Start, and Allow to run the express scan
  • This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan.
  • Once the short scan has finished, we need to change the default settings.
  • In the Menu Bar, Go to Options>Change Settings.
  • Click on the Actions tab
  • Using the drop down menus, change each item under Objects, Infected Packages and Malware to Report, then click OK
  • Next, tick the Complete Scan radio button.
  • Click the green arrow at the right, and the scan will start.
  • Click 'No to All' if it asks if you want to cure/move the file.
  • After the scan has completed, in the Dr.Web CureIt menu on top, click file and choose save report list
  • Save the report to your desktop. The report will be called DrWeb.csv
  • Close Dr.Web Cureit.
  • Ignore and close any windows which open, prompting you to buy DrWeb.
  • Post the contents of the log from Dr.Web you saved previously in your next reply.

Only one of the above need be performed.
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 04-01-2008, 09:55 PM   #16 (permalink)
Registered User
 
Join Date: Mar 2008
Posts: 11
OS: WINXP


Thumbs Up Re: Generic Dropper.AU - Major Pop-Ups, etc
Hi the Kaspersky file was too big so I'm attaching it.
Hope this is what you want! :)
Thanks Bob, Mike

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:48:27 PM, on 4/1/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/comcast.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~1\COMCAS~1.DLL
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptcl.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~1\COMCAS~1.DLL
O4 - HKLM\..\Run: [Lexmark 1200 Series] "C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Monitor] C:\WINDOWS\PixArt\PAC207\Monitor.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [SmileboxTray] "C:\Documents and Settings\MichaelN.THE-EA27A253A91\Application Data\Smilebox\SmileboxTray.exe"
O4 - HKUS\S-1-5-21-1844237615-1390067357-682003330-500\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Administrator')
O4 - Startup: Snapfish PictureMover.lnk = C:\Program Files\Snapfish PictureMover\PictureMover.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://*.mcafee.com
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
O16 - DPF: {2DAD3559-2923-4935-AD49-B673D2539944} (IASRunner Class) - https://www-307.ibm.com/pc/support/a...tent/AcpIR.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {74C861A1-D548-4916-BC8A-FDE92EDFF62C} - http://mediaplayer.walmart.com/installer/install.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://playgames.comcast.net/Gameshe...onGameHost.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/.../installer.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Chat Controller - Zemerick Software, Inc. - C:\Program Files\ChatController\ccservice.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

--
End of file - 8601 bytes
Attached Files
File Type: txt KASPERSKY ONLINE SCANNER REPORT.txt (1.11 MB, 1 views)
mnotarangelo is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 04-01-2008, 10:07 PM   #17 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,691
OS: 2000 Pro; XP Pro; XP Home


Re: Generic Dropper.AU - Major Pop-Ups, etc
That's just right, Mike...

Most of those items are locked away in quarantine, and we'll deal with them shortly.

Before we delete one item, I wonder if I could get you to upload it for me.

  • Please visit this site:

    http://www.bleepingcomputer.com/subm....php?channel=4

  • In the Link to topic where this file was requested: area, copy and paste this


    http://www.techsupportforum.com/security-center/hijackthis-log-help/234016-generic-dropper-au-major-pop-ups-etc-post1406951.html

  • In the Browse to the file you want to submit: area, copy and paste this


    C:\Documents and Settings\ZacharyN\My Documents\picture50.com
  • Then click Send File.
  • Once it shows:
    Quote:
    Your file was successfully submitted. Please let the user helping you know that you have submitted the file.
  • Close the site and continue with the steps below.

Open NOTEPAD.exe and copy/paste the text in the codebox below into it:
Code:
@echo off
if exist "%temp%\log.txt" del "%temp%\log.txt"

for %%g in (

"C:\Documents and Settings\MichaelN.THE-EA27A253A91\Desktop\[4]-Submit_2008-03-31@22.48.zip"
"C:\Documents and Settings\ZacharyN\My Documents\picture50.com"

) do (
del /a/f %%g >nul 2>&1
if exist %%g echo.%%g>>"%temp%\log.txt"
)

for %%g in (

%systemdrive%\Deckard

) do (
rd /s/q %%g >nul 2>&1
if exist %%g echo.%%g>>"%temp%\log.txt"
)
if exist "%temp%\log.txt" ( start notepad "%temp%\log.txt"
) else echo.Deleted Successfully !!

pause
del %0
Save this as fix.bat Choose to "Save type as - All Files"
It should look like this:
Double click on fix.bat & allow it to run

Post back to tell me what it says

Also, I noticed this:

Quote:
Boot mode: Safe mode with network support
Your HijackThis log was taken from Safe Mode with Networking? Any reason why?
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
Last edited by tetonbob; 04-01-2008 at 10:08 PM.
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 04-01-2008, 10:25 PM   #18 (permalink)
Registered User
 
Join Date: Mar 2008
Posts: 11
OS: WINXP


Thumbs Up Re: Generic Dropper.AU - Major Pop-Ups, etc
Hi bob, the fix.bat file said deletion successful.

Also...each of those lasts Scanners - Kaspersky, etc died on a file in an old Microsoft Game called Zoo Tycoon. It was the only file in the directory which had been uninstalled. When I tried to delete it, it was locked and wouldn't let me do anything with it.

When I went to safe mode, I blew it away no problem...and the Kaspersky scan worked immediately.

I could be full of crap but it seemed to work! LOL

Thanks! Mike
mnotarangelo is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 04-01-2008, 10:32 PM   #19 (permalink)
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,691
OS: 2000 Pro; XP Pro; XP Home


Re: Generic Dropper.AU - Major Pop-Ups, etc
Ahh, good work! Actually, that's a nice solution, as we want the onboard AV disabled while running the online scan anyway. I recall that ZooTycoon issue from another thread a while back.

There were also a couple of trymedia games files I left alone. They get flagged as adware, but most people who use these games don't seem to mind.

The files are:

C:\Downloads\RollerCoasterTycoon2-dm[1].exe
C:\Downloads\tpwSetup-dm[1].exe

Delete them or keep them, your choice.

You can also uninstall HijackThis from Add/Remove programs and delete the backups when you do so. Delete the shortcut from desktop, and check to see this folder is gone:

C:\Program Files\Trend Micro\HijackThis

Other than that...........

Your logs appear clean.You should be good to go. We still have a few items to address.

Go to -> Run -> copy/paste in the following single line command & click OK

combofix /u



This will uninstall ComboFix. It will also implement some cleanup procedures and reset System Restore points.

Now that your system is clean, to help protect your computer in the future I recommend that you follow these steps and use the following free programs:
  • Microsoft Windows Update - http://www.windowsupdate.com
    Visit regularly. This will ensure your computer always has the latest security updates. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

  • SpywareBlaster to help prevent spyware from installing in the first place.
    • Install & update SpywareBlaster with the latest definitions.
      After you have updated, click the button - enable protection for all unprotected items
  • MVPS HOST FILE
    The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites form serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer.
    • Download Host.zip to your desktop.
    • From your Desktop right-click (hosts.zip) and select:
      Extract All from the menu.
    • Click Next, click Next, select the option:
      "Show Extracted files", click Finish
    • This will open the newly created hosts folder on your Desktop.
    • Double-click on the included mvps.bat file, this will rename the existing HOSTS file to HOSTS.MVP, then it will copy the included updated HOSTS file to the correct location on your machine.
    • Once updated you should see another prompt that the task was completed.
  • ANTIVIRUS SOFTWARE
    It is very important that you have anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future. It is imperative that you update your antivirus software at least once a week (even more if you wish). If you do not update your antivirus software then it will not be able to catch new malware that may have come out.

    Do not install more than one AntiVirus program because they will conflict with each other.

  • FIREWALL
    Using a third-party firewall will allow you to give/deny access for applications that want to go online. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. A tutorial on Firewalls and a listing of some available ones can be found here

    Do not install more than one firewall program because they will conflict with each other.

Scan here http://secunia.com/software_inspector/ for out of date & vulnerable common applications on your computer

Here are some additional utilities that will further enhance your safety.
  • http://www.trillian.cc ? Trillian or http://www.miranda-im.com ? Miranda-IM - These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN)

  • http://www.mozilla.org/products/firefox/ - Firefox - Use this alternate browser. While Internet Explorer is not a bad browser, almost every exploit crafted is targeted to take advantage of an IE weakness.

  • http://java.com/en/index.jsp - Sun's Java - It's much more secure than Microsoft's Java Virtual Machine.

  • http://www.aumha.org/downloads/erunt-setup.exe - ERUNT - A useful freeware utility for users of Windows 2000/XP. It's made up of two parts - ERUNT & NTREGOPT.

    ERUNT will create daily complete backups of your computer's Registry. Whilst System Restore does the same thing, a corrupt registry file may prevent Windows from booting & this effectively renders disables System Restore. With ERUNT, you're able to restore the damaged Registry.

    NTREGOPT works by recreating each registry hive "from scratch", thus removing any slack space that may be left from previously modified or deleted keys. In other words, it compacts the Registry to a small size which allows Windows to load & perform faster.


In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles
If you want to fight back the Malware Writers that have made your life a misery, please take a look here and read what you can do against it.

Please respond to this thread one more time so we can mark this thread as resolved.
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 04-01-2008, 10:36 PM   #20 (permalink)
Registered User
 
Join Date: Mar 2008
Posts: 11
OS: WINXP


Re: Generic Dropper.AU - Major Pop-Ups, etc
Man Bob...you are amazing! Thank you so much for this! You have NOOOOO Idea what it means to me! Where can I send you a bottle of scotch! LOL Thank you again. You were a life saver! Much appreciated! Mike (and FAMILY!!!!)
mnotarangelo is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
 
Page 1 of 2 1 2

« Previous Thread | Next Thread »

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off



All times are GMT -7. The time now is 11:29 AM.

Contact Us - Tech Support Forum - Archive - Privacy Statement - Top


Copyright 2001 - 2009, Tech Support Forum
Home Tips Plus | Outdoor Basecamp | Automotive Support Forum

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85