Puper Trojan w/HJT - I 'Think' I got it

Speargun · 07-01-2008, 12:21 PM

During a random act of stoopidity, I double clicked on a file & infected my system with the puper trojan. My brain said don't click on that, but my finger wasn't paying attention & did it anyway.

Here is where I'm at:

Mcafee didn't do anything but tell me I was infected so I ran the mcafee SDAT.EXE from the command line in safe mode. 6 days later it looks like the scan might have helped a little.

I booted back into windows and kept getting buffer under/over??? run warnings from mcafee from SERVICES.EXE.

All of the file associations had been lost & I would get an error that rundll32.exe was missing even though it was there.

I first expanded rundll32.exe from the windows install disk and overwrote the one in my system32 directory. I then ran this (http://www.dougknox.com/xp/fileassoc/xp_fileassoc.zip) program to get the associations back then I ran (http://www.dougknox.com/xp/fileassoc/xp_exe_fix.zip) to fix the registry.

I deleted mcafee and installed AVG antivirus which found a number of trojans and quarantined them.

I then ran HJT and now I'm here. Could someone take a look at my HJT & let me know if everything looks right?

Did I forget anything? Any suggestions?

Thanks a Bunch!
-Jeff

Speargun · 07-01-2008, 03:14 PM

I also just found out that there is no longer a screen saver tab under my display properties.

-EDIT-
Never mind. I just found the correct registry entry to change it.

forhockey · 07-01-2008, 04:41 PM

Hi Speargun,

Have you taken the time to familiarize yourself with the following sticky before posting?

(Updated!) IMPORTANT - Read This Before Posting A Log

Please go through the 5 steps outlined in the link below and post back the requested logs in this thread.

Please take into consideration that we are very busy, and try our best to answer every thread. If you haven't heard a reply from anyone after 48 hrs, then simply type "bump" to move your thread up.

Thanks

Speargun · 07-02-2008, 09:30 AM

I have read the 5 steps before posting & I think I have everything done.

Here is my HJT log.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:23:59 AM, on 7/2/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgfws8.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PSIService.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\Wacom_Tablet.exe
C:\WINDOWS\system32\WTablet\Wacom_TabletUser.exe
C:\WINDOWS\system32\Wacom_Tablet.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\notepad.exe
C:\WINDOWS\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cust...search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/cust.../www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cust...ch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/cust.../www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - C:\Program Files\AVG\AVG8\avgssie.dll
O3 - Toolbar: (no name) - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - (no file)
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [[system]] C:\WINDOWS\system32\drivers\services.exe
O4 - HKCU\..\Run: [winlogon] C:\Documents and Settings\Jeff\svchost.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\.DEFAULT\..\Run: [[system]] C:\WINDOWS\system32\drivers\services.exe (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Download with Go!Zilla - file://C:\Program Files\Go!Zilla\download-with-gozilla.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {2d8ed06d-3c30-438b-96ae-4d110fdc1fb8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/actives.../as2stubie.cab
O16 - DPF: {76D90D08-EAB7-46D8-BF99-87445BF59E72} (SystemInfo Class) - http://getdway.com/dwayready/dpcsysinfo.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1D731043-EF11-4D60-AED7-9CBA20BDC6BD}: NameServer = 85.255.116.171,85.255.112.179
O17 - HKLM\System\CCS\Services\Tcpip\..\{6889E773-DE91-40B0-849E-1DEF939D8B8E}: NameServer = 85.255.116.171,85.255.112.179
O17 - HKLM\System\CCS\Services\Tcpip\..\{AD80959F-BBCD-4D8F-9BA4-7AA377BBBB39}: NameServer = 85.255.116.171,85.255.112.179
O17 - HKLM\System\CCS\Services\Tcpip\..\{D7CABB8C-7323-4E69-B824-C5671CB1A0FD}: NameServer = 85.255.116.171,85.255.112.179
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.171 85.255.112.179
O17 - HKLM\System\CS1\Services\Tcpip\..\{1D731043-EF11-4D60-AED7-9CBA20BDC6BD}: NameServer = 85.255.116.171,85.255.112.179
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.116.171 85.255.112.179
O17 - HKLM\System\CS2\Services\Tcpip\..\{1D731043-EF11-4D60-AED7-9CBA20BDC6BD}: NameServer = 85.255.116.171,85.255.112.179
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 85.255.116.171 85.255.112.179
O17 - HKLM\System\CS3\Services\Tcpip\..\{1D731043-EF11-4D60-AED7-9CBA20BDC6BD}: NameServer = 85.255.116.171,85.255.112.179
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.171 85.255.112.179
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL,avgrsstx.dll
O23 - Service: Adobe Active File Monitor V5 (AdobeActiveFileMonitor5.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe (file missing)
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: AVG8 Firewall (avgfws8) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgfws8.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe (file missing)
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: Task Scheduler (Schedule) - Unknown owner - C:\WINDOWS\system32\drivers\services.exe (file missing)
O23 - Service: TabletServiceWacom - Wacom Technology, Corp. - C:\WINDOWS\system32\Wacom_Tablet.exe
O24 - Desktop Component 1: Aqua Real 3D - 7db39a0d-580f-4be9-9195-8bfcd226f6c2
O24 - Desktop Component 2: Aqua Garden - 6423CD5F-D089-4BF1-88B6-6A359339DAFF

--
End of file - 9425 bytes

Here is the Deckard's System Scanner MAIN.TXT, and attached is the EXTRA.TXT

Deckard's System Scanner v20071014.68
Run by Jeff on 2008-07-02 11:00:20
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

System Restore is disabled; attempting to re-enable...success.

-- Last 1 Restore Point(s) --
1: 2008-07-02 15:00:23 UTC - RP1 - System Checkpoint

Backed up registry hives.
Performed disk cleanup.

-- HijackThis (run as Jeff.exe) ------------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:02:42 AM, on 7/2/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgfws8.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PSIService.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\Wacom_Tablet.exe
C:\WINDOWS\system32\WTablet\Wacom_TabletUser.exe
C:\WINDOWS\system32\Wacom_Tablet.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Documents and Settings\Jeff\My Documents\My Downloads\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Jeff.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cust...search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/cust.../www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cust...ch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/cust.../www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - C:\Program Files\AVG\AVG8\avgssie.dll
O3 - Toolbar: (no name) - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - (no file)
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [[system]] C:\WINDOWS\system32\drivers\services.exe
O4 - HKCU\..\Run: [winlogon] C:\Documents and Settings\Jeff\svchost.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\.DEFAULT\..\Run: [[system]] C:\WINDOWS\system32\drivers\services.exe (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Download with Go!Zilla - file://C:\Program Files\Go!Zilla\download-with-gozilla.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {2d8ed06d-3c30-438b-96ae-4d110fdc1fb8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/actives.../as2stubie.cab
O16 - DPF: {76D90D08-EAB7-46D8-BF99-87445BF59E72} (SystemInfo Class) - http://getdway.com/dwayready/dpcsysinfo.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1D731043-EF11-4D60-AED7-9CBA20BDC6BD}: NameServer = 85.255.116.171,85.255.112.179
O17 - HKLM\System\CCS\Services\Tcpip\..\{6889E773-DE91-40B0-849E-1DEF939D8B8E}: NameServer = 85.255.116.171,85.255.112.179
O17 - HKLM\System\CCS\Services\Tcpip\..\{AD80959F-BBCD-4D8F-9BA4-7AA377BBBB39}: NameServer = 85.255.116.171,85.255.112.179
O17 - HKLM\System\CCS\Services\Tcpip\..\{D7CABB8C-7323-4E69-B824-C5671CB1A0FD}: NameServer = 85.255.116.171,85.255.112.179
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.171 85.255.112.179
O17 - HKLM\System\CS1\Services\Tcpip\..\{1D731043-EF11-4D60-AED7-9CBA20BDC6BD}: NameServer = 85.255.116.171,85.255.112.179
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.116.171 85.255.112.179
O17 - HKLM\System\CS2\Services\Tcpip\..\{1D731043-EF11-4D60-AED7-9CBA20BDC6BD}: NameServer = 85.255.116.171,85.255.112.179
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 85.255.116.171 85.255.112.179
O17 - HKLM\System\CS3\Services\Tcpip\..\{1D731043-EF11-4D60-AED7-9CBA20BDC6BD}: NameServer = 85.255.116.171,85.255.112.179
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.171 85.255.112.179
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL,avgrsstx.dll
O23 - Service: Adobe Active File Monitor V5 (AdobeActiveFileMonitor5.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe (file missing)
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: AVG8 Firewall (avgfws8) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgfws8.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe (file missing)
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: Task Scheduler (Schedule) - Unknown owner - C:\WINDOWS\system32\drivers\services.exe (file missing)
O23 - Service: TabletServiceWacom - Wacom Technology, Corp. - C:\WINDOWS\system32\Wacom_Tablet.exe
O24 - Desktop Component 1: Aqua Real 3D - 7db39a0d-580f-4be9-9195-8bfcd226f6c2
O24 - Desktop Component 2: Aqua Garden - 6423CD5F-D089-4BF1-88B6-6A359339DAFF

--
End of file - 9427 bytes

-- File Associations -----------------------------------------------------------

.js - JSFile - DefaultIcon - "C:\Program Files\Adobe\Adobe Dreamweaver CS3\Dreamweaver.exe",7
.js - JSFile - shell\open\command - "C:\Program Files\Adobe\Adobe Dreamweaver CS3\Dreamweaver.exe","%1"

-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R3 NTIDrvr (Upper Class Filter Driver) - c:\windows\system32\drivers\ntidrvr.sys <Not Verified; NewTech Infosystems, Inc.; >
R3 pfc (Padus ASPI Shell) - c:\windows\system32\drivers\pfc.sys <Not Verified; Padus, Inc.; Padus(R) ASPI Shell>

S3 FTDIBUS (USB Download Interface Driver) - c:\windows\system32\drivers\ftdibus.sys <Not Verified; FTDI Ltd.; FT8U232AX>
S3 FTSER2K (2002 Design, Inc. USB Download Interface Driver) - c:\windows\system32\drivers\ftser2k.sys <Not Verified; FTDI Ltd.; FT8U232AX>
S3 MR97310_VGA_DUAL_CAMERA (Dual-Mode Digital Camera) - c:\windows\system32\drivers\mr97310v.sys <Not Verified; Mars Semiconductor Corp.; USB Dual-Mode Camera>
S3 PTDMBus (PANTECH USB Modem Composite Device Driver ) - c:\windows\system32\drivers\ptdmbus.sys (file missing)
S3 PTDMMdm (PANTECH USB Modem Drivers ) - c:\windows\system32\drivers\ptdmmdm.sys (file missing)
S3 PTDMVsp (PANTECH USB Modem Serial Port ) - c:\windows\system32\drivers\ptdmvsp.sys (file missing)
S3 PTDMWWAN (PANTECH USB Modem WWAN Driver) - c:\windows\system32\drivers\ptdmwwan.sys (file missing)
S3 samhid - c:\windows\system32\drivers\samhid.sys

-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 Apple Mobile Device - "c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe" <Not Verified; Apple, Inc.; Apple Mobile Device Service>
R2 ProtexisLicensing - c:\windows\system32\psiservice.exe <Not Verified; ; PSIService>

S2 AdobeActiveFileMonitor5.0 (Adobe Active File Monitor V5) - c:\program files\adobe\photoshop elements 5.0\photoshopelementsfileagent.exe (file missing)
S2 PnkBstrA - c:\windows\system32\pnkbstra.exe (file missing)
S2 Schedule (Task Scheduler) - c:\windows\system32\drivers\services.exe (file missing)
S3 FLEXnet Licensing Service - "c:\program files\common files\macrovision shared\flexnet publisher\fnplicensingservice.exe" <Not Verified; Macrovision Europe Ltd.; FLEXnet Publisher (32 bit)>
S4 Bonjour Service (##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##) - "c:\program files\bonjour\mdnsresponder.exe" <Not Verified; Apple Computer, Inc.; Bonjour>
S4 nmraapache (Pure Networks Net2Go Service) - "c:\program files\pure networks\network magic\webserver\bin\nmraapache.exe" -k runservice <Not Verified; Pure Networks, Inc.; Pure Networks Net2Go Service>

-- Device Manager: Disabled ----------------------------------------------------

No disabled devices found.

-- Scheduled Tasks -------------------------------------------------------------

2008-06-24 15:37:37 430 --a------ C:\WINDOWS\Tasks\SyncBack Photo Vault.job
2008-06-24 14:39:10 310 --a------ C:\WINDOWS\Tasks\Ad-aware 6.job
2008-06-24 10:00:19 286 --a------ C:\WINDOWS\Tasks\Spybot - Search & Destroy - Scheduled Task.job
2008-06-23 15

01 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
2008-06-22 11:49:54 258 --a------ C:\WINDOWS\Tasks\Disk Cleanup.job

-- Files created between 2008-06-02 and 2008-07-02 -----------------------------

2008-07-02 10:54:06 0 d-------- C:\Documents and Settings\All Users\Application Data\TEMP
2008-07-02 10:54:00 0 d-------- C:\Program Files\SpywareBlaster
2008-07-01 21:21:32 0 d-------- C:\Program Files\Panda Security
2008-07-01 17:07:34 0 d-------- C:\WINDOWS\LastGood
2008-07-01 13:31:50 0 d-------- C:\Program Files\Trend Micro
2008-07-01 12:48:37 0 d------c- C:\xp_fileassoc
2008-06-30 21:50:23 0 d--h---c- C:\$AVG8.VAULT$
2008-06-30 21:38:36 0 d-------- C:\WINDOWS\system32\drivers\Avg
2008-06-30 21:36:48 0 d-------- C:\Program Files\AVG
2008-06-30 21:36:48 0 d-------- C:\Documents and Settings\All Users\Application Data\avg8
2008-06-24 20:08:57 0 d------c- C:\sdat
2008-06-24 20:07:19 51434127 --a----c- C:\sdat5324.exe <Not Verified; McAfee, Inc.; McAfee Core Components>
2008-06-24 18:49:52 0 d-------- C:\Documents and Settings\LocalService\Application Data\McAfee
2008-06-24 16:33:41 0 d-------- C:\Documents and Settings\Jeff\Application Data\Alien Skin
2008-06-24 16:22:51 63920 --a------ C:\WINDOWS\system32\drivers\2eba2bdd.sys
2008-06-24 15:56:59 0 d-------- C:\Program Files\Alien Skin
2008-06-24 13:24:50 0 d-------- C:\Program Files\2BrightSparks
2008-06-22 17:53:26 0 d-------- C:\Program Files\uTorrent
2008-06-22 17:53:13 0 d-------- C:\Documents and Settings\Jeff\Application Data\uTorrent
2008-06-22 13:17:55 0 d--h----- C:\WINDOWS\PIF
2008-06-22 11:48:09 0 d-------- C:\Documents and Settings\All Users\Application Data\Macrovision
2008-06-22 03:01:11 0 d-------- C:\Program Files\MSXML 6.0
2008-06-21 13:12:49 155648 --a------ C:\WINDOWS\system32\Phanfare Screensaver.scr
2008-06-21 13:12:48 0 d-------- C:\Program Files\Phanfare 2.0
2008-06-21 13:11:54 0 d-------- C:\Program Files\MSBuild
2008-06-21 13:08:56 0 d-------- C:\WINDOWS\system32\XPSViewer
2008-06-21 13:08:24 0 d-------- C:\Program Files\Reference Assemblies
2008-06-21 11:17:09 0 d-------- C:\WINDOWS\MSSecurityNS
2008-06-21 11:17:09 0 d-------- C:\WINDOWS\MSSecurityNi
2008-06-20 14:29:03 0 d-------- C:\Documents and Settings\Jeff\Application Data\Corel
2008-06-20 11:58:39 0 d-------- C:\Documents and Settings\Jeff\Application Data\Opera
2008-06-20 11:47:16 0 d-------- C:\Documents and Settings\All Users\Application Data\espionServerData
2008-06-20 11:35:20 0 d-------- C:\Program Files\Corel
2008-06-20 11:35:20 0 d-------- C:\Documents and Settings\All Users\Application Data\Corel
2008-06-20 11:30:03 0 d-------- C:\Documents and Settings\LocalService\Application Data\WTablet
2008-06-20 11:05:03 0 d-------- C:\Documents and Settings\Jeff\Application Data\WTablet
2008-06-20 11:04:23 0 d-------- C:\WINDOWS\system32\WTablet
2008-06-20 11:04:17 0 d-------- C:\Program Files\Tablet
2008-06-20 11:02:28 0 d-------- C:\Documents and Settings\Jeff\Application Data\McAfee

-- Find3M Report ---------------------------------------------------------------

2008-07-01 13:16:49 0 d-------- C:\Program Files\Common Files
2008-07-01 13:16:17 0 d-------- C:\Program Files\McAfee
2008-06-24 13:07:39 0 d-------- C:\Program Files\WISE-FTP
2008-06-24 12:57:43 0 d-------- C:\Program Files\Duplicate File Finder
2008-06-22 18:54:23 0 d-------- C:\Documents and Settings\Jeff\Application Data\Adobe
2008-06-22 13:44:13 0 d-------- C:\Program Files\Common Files\InstallShield
2008-06-22 11:42:03 0 d-------- C:\Program Files\WinMatrix XP
2008-05-21 07:22:26 0 d-------- C:\Program Files\Java
2008-05-18 13:50:02 0 d-------- C:\Program Files\Game Elements
2008-05-08 21:59:26 0 d-------- C:\Program Files\SystemRequirementsLab
2008-05-08 21:59:26 0 d-------- C:\Documents and Settings\Jeff\Application Data\SystemRequirementsLab
2008-05-07 19:13:53 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-05-07 18:58:37 0 d-------- C:\Program Files\Games

-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [06/30/2008 09:38 PM]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [02/02/2005 12:34 AM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"[system]"="C:\WINDOWS\system32\drivers\services.exe" []
"winlogon"="C:\Documents and Settings\Jeff\svchost.exe" []
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 03:56 AM]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"[system]"=C:\WINDOWS\system32\drivers\services.exe

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2/19/2006 4:21:22 AM]
HP Photosmart Premier Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2/10/2006 7:56:20 AM]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoDispBackgroundPage"=0 (0x0)
"NoDispScrSavPage"=0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"System"="kdkak.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL,avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\c:^documents and settings^jeff^start menu^programs^startup^userinit.exe]
path=C:\Documents and Settings\Jeff\Start Menu\Programs\Startup\userinit.exe
backup=C:\WINDOWS\pss\userinit.exeStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ad-aware]
"C:\Program Files\Lavasoft\Ad-aware 6\Ad-aware.exe" +c

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AIM]
C:\Program Files\AIM\aim.exe -cnetwait.odl

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Go!Zilla]
"C:\Program Files\Go!Zilla\gozilla.exe" /tray

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
"C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
"C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
%systemroot%\system32\dumprep 0 -k

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark X1100 Series]
"C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
"C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Picasa Media Detector]
C:\Program Files\Picasa2\PicasaMediaDetector.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\QTTask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WildTangent CDA]
RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winlogon]
C:\Documents and Settings\Jeff\svchost.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winmatrix.exe]
C:\Program Files\WinMatrix XP\WinMatrixXP.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Wise-FTP Scheduler]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe -quiet

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\[system]]
C:\WINDOWS\system32\drivers\services.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"nmservice"=2 (0x2)
"nmraapache"=3 (0x3)
"mnmsrvc"=3 (0x3)
"LexBceS"=2 (0x2)
"GoogleDesktopManager"=3 (0x3)
"Irmon"=2 (0x2)
"iPod Service"=3 (0x3)
"Bonjour Service"=2 (0x2)

-- End of Deckard's System Scanner: finished at 2008-07-02 11

20 ------------

Also attached is the Panda ActiveScan log.

If you need anything else, just let me know.

Thanks!

-Jeff

forhockey · 07-02-2008, 08:51 PM

Hello Jeff,

Please copy this page to Notepad and save to your desktop for reference as you will not have any browsers open while you are carrying out portions of these instructions.

Also be sure to carry out the instructions in the sequence listed below.

--------------------------------------------------------------

Click > Start > Control Panel > Add / Remove Programs and uninstall the following programs (if they exist):

Viewpoint Manager
Viewpoint Media Player <<<this is considered foistware instead of malware since it is installed without users approval, but doesn't spy or do anything "bad". Read this article: http://www.clickz.com/news/article.php/3561546

Additional info: http://vil.nai.com/vil/content/v_137262.htm

--------------------------------------------------------------

P2P Software

I see you have P2P software ( µTorrent, ) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information.

--------------------------------------------------------------

Please download FixWareout from one of these sites:
http://downloads.subratam.org/Fixwareout.exe
http://download.bleepingcomputer.com...Fixwareout.exe

Save it to your desktop and run it.
Click "Next", then Install, make sure "Run fixit" is checked and click Finish.
The fix will begin: Please follow the prompts.
You will be asked to reboot your computer: Please do so.
Your system may take longer than usual to load and this is normal.

Once the desktop loads post the text that will open (report.txt)

--------------------------------------------------------------

Please visit this webpage for instructions for downloading and running ComboFix:

http://www.bleepingcomputer.com/comb...o-use-combofix

IMPORTANT: Make sure you install the Recovery Console before running ComboFix.

--------------------------------------------------------------

Reply back with the following:

C:\fixwareout\report.txt
C:\ComboFix.txt
New HJT log

Speargun · 07-03-2008, 12:20 AM

Quote:

Originally Posted by forhockey

.......
--------------------------------------------------------------

P2P Software

I see you have P2P software ( µTorrent, ) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information.
--------------------------------------------------------------

I'm pretty sure that was the culprit.
A buddy was staying with me while his house was being finished & I'm pretty sure he was downloading stuff with utorrent & burning it to disks. When I called him & told him what happened, he suddenly had to go.

I was cleaning up the download folder when I clicked on the file that started all of this. I think it was keygen or something like that.

Anyway, I deleted Viewpoint Manager & Viewpoint Media Player from add/remove programs. I then ran Fixit, combofix, & HJT.
here are the results:

FIXIT

Username "Jeff" - 07/03/2008 0:34:21 [Fixwareout edited 9/01/2007]

~~~~~ Prerun check
HKLM\SOFTWARE\~\Winlogon\ "System"="kdkak.exe"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
"nameserver"="85.255.116.171 85.255.112.179" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{1D731043-EF11-4D60-AED7-9CBA20BDC6BD}
"nameserver"="85.255.116.171,85.255.112.179" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{6889E773-DE91-40B0-849E-1DEF939D8B8E}
"nameserver"="85.255.116.171,85.255.112.179" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{AD80959F-BBCD-4D8F-9BA4-7AA377BBBB39}
"nameserver"="85.255.116.171,85.255.112.179" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{D7CABB8C-7323-4E69-B824-C5671CB1A0FD}
"nameserver"="85.255.116.171,85.255.112.179" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{1D731043-EF11-4D60-AED7-9CBA20BDC6BD}
"DhcpNameServer"="85.255.116.171,85.255.112.179" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{6889E773-DE91-40B0-849E-1DEF939D8B8E}
"DhcpNameServer"="85.255.116.171,85.255.112.179" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{AD80959F-BBCD-4D8F-9BA4-7AA377BBBB39}
"DhcpNameServer"="85.255.116.171,85.255.112.179" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{EDC08F2A-6379-4CAB-8340-03811F5125CF}
"DhcpNameServer"="85.255.116.171,85.255.112.179" <Value cleared.

Successfully flushed the DNS Resolver Cache.

System was rebooted successfully.

~~~~~ Postrun check
HKLM\SOFTWARE\~\Winlogon\ "system"=""
....
....
~~~~~ Misc files.
....
~~~~~ Checking for older varients.
....

~~~~~ Current runs (hklm hkcu "run" Keys Only)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
"AVG8_TRAY"="C:\\PROGRA~1\\AVG\\AVG8\\avgtray.exe"
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
"[system]"="C:\\WINDOWS\\system32\\drivers\\services.exe"
"winlogon"="C:\\Documents and Settings\\Jeff\\svchost.exe"
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
....
Hosts file was reset, If you use a custom hosts file please replace it...
~~~~~ End report ~~~~~

---------------------------------------------------------------

COMBOFIX

ComboFix 08-07-02.3 - Jeff 2008-07-03 1:43:33.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1608 [GMT -4:00]
Running from: C:\Documents and Settings\Jeff\My Documents\My Downloads\ComboFix.exe
Command switches used :: C:\Documents and Settings\Jeff\My Documents\My Downloads\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\mdm.exe

.
((((((((((((((((((((((((( Files Created from 2008-06-03 to 2008-07-03 )))))))))))))))))))))))))))))))
.

2067-02-24 16:21 . 2003-02-05 05:02 79,947 --a--c--- C:\WINDOWS\fw20.vxd
2008-07-03 00:34 . 2008-07-03 01:36 <DIR> d----c--- C:\fixwareout
2008-07-02 10:59 . 2008-07-02 10:59 <DIR> d----c--- C:\Deckard
2008-07-02 10:54 . 2008-07-02 10:57 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-07-02 10:54 . 2008-07-02 10:54 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\TEMP
2008-07-01 21:21 . 2008-07-01 21:26 <DIR> d-------- C:\Program Files\Panda Security
2008-07-01 13:31 . 2008-07-01 13:31 <DIR> d-------- C:\Program Files\Trend Micro
2008-07-01 12:48 . 2008-07-01 12:48 <DIR> d----c--- C:\xp_fileassoc
2008-06-30 21:50 . 2008-07-01 02:10 <DIR> d--h-c--- C:\$AVG8.VAULT$
2008-06-30 21:38 . 2008-07-02 17:19 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg
2008-06-30 21:38 . 2008-06-30 21:38 96,520 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys
2008-06-30 21:38 . 2008-06-30 21:38 76,040 --a------ C:\WINDOWS\system32\drivers\avgtdix.sys
2008-06-30 21:38 . 2008-06-30 21:38 12,936 --a------ C:\WINDOWS\system32\drivers\avgrkx86.sys
2008-06-30 21:38 . 2008-06-30 21:38 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll
2008-06-30 21:36 . 2008-06-30 21:36 <DIR> d-------- C:\Program Files\AVG
2008-06-30 21:36 . 2008-06-30 21:36 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg8
2008-06-30 21:36 . 2008-06-30 21:36 45,568 --a------ C:\WINDOWS\system32\avgfwdx.dll
2008-06-30 21:36 . 2008-06-30 21:36 23,296 --a------ C:\WINDOWS\system32\drivers\avgfwdx.sys
2008-06-24 20:08 . 2008-06-30 23:09 <DIR> d----c--- C:\sdat
2008-06-24 20:07 . 2008-06-24 19:53 51,434,127 --a--c--- C:\sdat5324.exe
2008-06-24 18:49 . 2008-06-24 18:49 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\McAfee
2008-06-24 16:33 . 2008-06-24 16:33 <DIR> d-------- C:\Documents and Settings\Jeff\Application Data\Alien Skin
2008-06-24 16:22 . 2008-07-03 01:48 63,920 --a------ C:\WINDOWS\system32\drivers\2eba2bdd.sys
2008-06-24 15:56 . 2008-06-24 15:56 <DIR> d-------- C:\Program Files\Alien Skin
2008-06-24 13:24 . 2008-06-24 13:24 <DIR> d-------- C:\Program Files\2BrightSparks
2008-06-23 19:36 . 2008-03-06 14:58 129,784 --------- C:\WINDOWS\system32\pxafs.dll
2008-06-22 17:53 . 2008-06-24 16:47 <DIR> d-------- C:\Program Files\uTorrent
2008-06-22 17:53 . 2008-06-24 17:32 <DIR> d-------- C:\Documents and Settings\Jeff\Application Data\uTorrent
2008-06-22 13:17 . 2008-06-22 13:17 <DIR> d--h----- C:\WINDOWS\PIF
2008-06-22 11:48 . 2008-06-22 11:48 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Macrovision
2008-06-22 03:01 . 2008-06-22 03:01 <DIR> d-------- C:\Program Files\MSXML 6.0
2008-06-21 13:12 . 2008-06-21 13:12 <DIR> d-------- C:\Program Files\Phanfare 2.0
2008-06-21 13:12 . 2008-06-13 10:22 323,624 --a------ C:\WINDOWS\system32\wiaaut.dll
2008-06-21 13:12 . 2008-06-13 15:23 155,648 --a------ C:\WINDOWS\system32\Phanfare Screensaver.scr
2008-06-21 13:11 . 2008-06-21 13:11 <DIR> d-------- C:\Program Files\MSBuild
2008-06-21 13:08 . 2008-06-21 13:08 <DIR> d-------- C:\WINDOWS\system32\XPSViewer
2008-06-21 13:08 . 2008-06-21 13:08 <DIR> d-------- C:\Program Files\Reference Assemblies
2008-06-21 13:08 . 2006-06-29 13:07 14,048 --------- C:\WINDOWS\system32\spmsg2.dll
2008-06-21 11:17 . 2008-06-21 11:17 <DIR> d-------- C:\WINDOWS\MSSecurityNS
2008-06-21 11:17 . 2008-06-21 11:17 <DIR> d-------- C:\WINDOWS\MSSecurityNi
2008-06-20 14:29 . 2008-06-20 14:29 <DIR> d-------- C:\Documents and Settings\Jeff\Application Data\Corel
2008-06-20 11:47 . 2008-06-20 11:47 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\espionServerData
2008-06-20 11:35 . 2008-06-20 11:35 <DIR> d-------- C:\Program Files\Corel
2008-06-20 11:35 . 2008-06-20 11:35 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Corel
2008-06-20 11:30 . 2008-06-22 16:10 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\WTablet
2008-06-20 11:19 . 2008-03-06 14:57 118,520 --------- C:\WINDOWS\system32\pxinsi64.exe
2008-06-20 11:19 . 2008-03-06 14:57 118,056 --------- C:\WINDOWS\system32\pxcpyi64.exe
2008-06-20 11:05 . 2008-07-03 00:37 <DIR> d-------- C:\Documents and Settings\Jeff\Application Data\WTablet
2008-06-20 11:04 . 2008-06-20 11:04 <DIR> d-------- C:\Program Files\Tablet
2008-06-20 11:02 . 2008-07-01 13:01 <DIR> d-------- C:\Documents and Settings\Jeff\Application Data\McAfee

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-03 04:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-07-01 17:16 --------- d-----w C:\Program Files\McAfee
2008-07-01 17:16 --------- d-----w C:\Documents and Settings\All Users\Application Data\McAfee
2008-07-01 17:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\SiteAdvisor
2008-06-24 17:07 --------- d-----w C:\Program Files\WISE-FTP
2008-06-24 16:57 --------- d-----w C:\Program Files\Duplicate File Finder
2008-06-22 17:44 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-06-22 15:42 --------- d-----w C:\Program Files\WinMatrix XP
2008-06-13 13:10 272,128 ----a-w C:\WINDOWS\system32\dllcache\bthport.sys
2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-05-24 21:59 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-05-24 21:58 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-05-21 11:22 --------- d-----w C:\Program Files\Java
2008-05-18 17:50 --------- d-----w C:\Program Files\Game Elements
2008-05-09 01:59 --------- d-----w C:\Program Files\SystemRequirementsLab
2008-05-09 01:59 --------- d-----w C:\Documents and Settings\Jeff\Application Data\SystemRequirementsLab
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\dllcache\rmcast.sys
2008-05-07 23:58 90,112 ----a-w C:\WINDOWS\DUMP6226.tmp
2008-05-07 23:14 22,328 ----a-w C:\Documents and Settings\Jeff\Application Data\PnkBstrK.sys
2008-05-07 23:13 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-07 22:58 --------- d-----w C:\Program Files\Games
2008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
2008-05-07 05:18 1,287,680 ------w C:\WINDOWS\system32\dllcache\quartz.dll
2008-04-24 02:16 3,591,680 ------w C:\WINDOWS\system32\dllcache\mshtml.dll
2008-04-22 07:40 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe
2008-04-22 07:39 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2008-04-22 07:39 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-04-20 05:07 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll
.

Code:

<pre>
-c--a-w           322,080 2000-07-11 06:05:32  C:\AV8R\G- 15 GB DRIVE\Program Files\Microsoft Office\Download\Zips\resume - Resume Wizard for Microsoft Publisher 2000 .exe
-c--a-w           472,328 2000-07-11 05:56:12  C:\AV8R\G- 15 GB DRIVE\Program Files\Microsoft Office\Download\Zips\sounds - Microsoft Office Sounds for Office 2000 .exe
</pre>

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"[system]"="C:\WINDOWS\system32\drivers\services.exe" [N/A]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:56 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-06-30 21:38 1231128]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-02-02 00:34 5513216]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"[system]"="C:\WINDOWS\system32\drivers\services.exe" [N/A]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 04:21:22 288472]
HP Photosmart Premier Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2006-02-10 07:56:20 73728]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL,avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.dvacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\Vio\Dvacm.acm
"MSACM.CEGSM"= mobilev.acm

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\c:^documents and settings^jeff^start menu^programs^startup^userinit.exe]
path=C:\Documents and Settings\Jeff\Start Menu\Programs\Startup\userinit.exe
backup=C:\WINDOWS\pss\userinit.exeStartup
=

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
C:\WINDOWS\system32\dumprep 0 -k [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Wise-FTP Scheduler]
[X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ad-aware]
--a------ 2003-07-12 23:00 684544 C:\Program Files\Lavasoft\Ad-aware 6\Ad-aware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AIM]
C:\Program Files\AIM\aim.exe [N/A]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Go!Zilla]
C:\Program Files\Go!Zilla\gozilla.exe [N/A]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
--a------ 2007-09-15 21:44 1838592 C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE [N/A]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark X1100 Series]
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe [N/A]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
C:\Program Files\MSN Messenger\MsnMsgr.Exe [N/A]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Picasa Media Detector]
--a------ 2005-10-28 14:08 335872 C:\Program Files\Picasa2\PicasaMediaDetector.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2007-10-19 21:16 286720 C:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WildTangent CDA]
C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll [N/A]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winlogon]
C:\Documents and Settings\Jeff\svchost.exe [N/A]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winmatrix.exe]
C:\Program Files\WinMatrix XP\WinMatrixXP.exe [N/A]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe [N/A]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\[system]]
C:\WINDOWS\system32\drivers\services.exe [N/A]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"nmservice"=2 (0x2)
"nmraapache"=3 (0x3)
"mnmsrvc"=3 (0x3)
"LexBceS"=2 (0x2)
"GoogleDesktopManager"=3 (0x3)
"Irmon"=2 (0x2)
"iPod Service"=3 (0x3)
"Bonjour Service"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\WINDOWS\\system32\\LEXPPS.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"C:\\Program Files\\Games\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"C:\\Program Files\\Phanfare 2.0\\Phanfare.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"67:UDP"= 67:UDP:DHCP Discovery Service

R0 avgrkx86;avgrkx86.sys;C:\WINDOWS\system32\Drivers\avgrkx86.sys [2008-06-30 21:38]
R0 viasraid;viasraid;C:\WINDOWS\system32\DRIVERS\viasraid.sys [2003-06-12 19:31]
R1 avgldx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-06-30 21:38]
R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-06-30 21:38]
R2 avgfws8;AVG8 Firewall;C:\PROGRA~1\AVG\AVG8\avgfws8.exe [2008-06-30 21:38]
R2 avgtdix;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-06-30 21:38]
R2 TabletServiceWacom;TabletServiceWacom;C:\WINDOWS\system32\Wacom_Tablet.exe [2007-09-07 11:40]
R3 avgfwdx;avgfwdx;C:\WINDOWS\system32\DRIVERS\avgfwdx.sys [2008-06-30 21:36]
R3 wacommousefilter;Wacom Mouse Filter Driver;C:\WINDOWS\system32\DRIVERS\wacommousefilter.sys [2007-02-16 11:12]
R3 wacomvhid;Wacom Virtual Hid Driver;C:\WINDOWS\system32\DRIVERS\wacomvhid.sys [2007-02-16 10:30]
R3 WacomVKHid;Virtual Keyboard Driver;C:\WINDOWS\system32\DRIVERS\WacomVKHid.sys [2007-02-15 16:11]
S3 AN983;ADMtek AN983/AN985/ADM951X 10/100Mbps Fast Ethernet Adapter;C:\WINDOWS\system32\DRIVERS\AN983.sys [2002-08-28 22:59]
S3 avgfwfd;AVG network filter service;C:\WINDOWS\system32\DRIVERS\avgfwdx.sys [2008-06-30 21:36]
S3 MR97310_VGA_DUAL_CAMERA;Dual-Mode Digital Camera;C:\WINDOWS\system32\DRIVERS\mr97310v.sys [2002-11-07 16:20]
S3 PTDMBus;PANTECH USB Modem Composite Device Driver ;C:\WINDOWS\system32\DRIVERS\PTDMBus.sys []
S3 PTDMMdm;PANTECH USB Modem Drivers ;C:\WINDOWS\system32\DRIVERS\PTDMMdm.sys []
S3 PTDMVsp;PANTECH USB Modem Serial Port ;C:\WINDOWS\system32\DRIVERS\PTDMVsp.sys []
S3 PTDMWWAN;PANTECH USB Modem WWAN Driver;C:\WINDOWS\system32\DRIVERS\PTDMWWAN.sys []
S3 samhid;samhid;C:\WINDOWS\system32\drivers\samhid.sys [2006-01-07 12:09]
S3 wdm_au8830;Aureal Vortex 8830 Audio Driver (WDM);C:\WINDOWS\system32\drivers\adm8830.sys [2001-08-17 13:19]

*Newly Created Service* - catchme
.
Contents of the 'Scheduled Tasks' folder
"2008-06-24 18:39:10 C:\WINDOWS\Tasks\Ad-aware 6.job"
- C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-aware.exe
"2008-06-23 19

01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-06-22 15:49:54 C:\WINDOWS\Tasks\Disk Cleanup.job"
- C:\WINDOWS\system32\cleanmgr.exe
"2008-06-24 14:00:19 C:\WINDOWS\Tasks\Spybot - Search & Destroy - Scheduled Task.job"
- C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
"2008-06-24 19:37:37 C:\WINDOWS\Tasks\SyncBack Photo Vault.job"
- C:\Program Files\2BrightSparks\SyncBack\SyncBack.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-03 01:46:52
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\Ati2evxx.dll
.
Completion time: 2008-07-03 2:02:59
ComboFix-quarantined-files.txt 2008-07-03 06:02:22

Pre-Run: 24,801,624,064 bytes free
Post-Run: 24,869,498,880 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

261 --- E O F --- 2008-06-22 07:01:14

----------------------------------------------------------

HJT

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:19:27 AM, on 7/3/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgfws8.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Wacom_Tablet.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\system32\WTablet\Wacom_TabletUser.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\system32\Wacom_Tablet.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cust...ch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/cust.../www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - C:\Program Files\AVG\AVG8\avgssie.dll
O3 - Toolbar: (no name) - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - (no file)
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [[system]] C:\WINDOWS\system32\drivers\services.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\.DEFAULT\..\Run: [[system]] C:\WINDOWS\system32\drivers\services.exe (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Download with Go!Zilla - file://C:\Program Files\Go!Zilla\download-with-gozilla.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {2d8ed06d-3c30-438b-96ae-4d110fdc1fb8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/actives.../as2stubie.cab
O16 - DPF: {76D90D08-EAB7-46D8-BF99-87445BF59E72} (SystemInfo Class) - http://getdway.com/dwayready/dpcsysinfo.cab
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.171 85.255.112.179
O17 - HKLM\System\CS1\Services\Tcpip\..\{1D731043-EF11-4D60-AED7-9CBA20BDC6BD}: NameServer = 85.255.116.171,85.255.112.179
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL,avgrsstx.dll
O23 - Service: Adobe Active File Monitor V5 (AdobeActiveFileMonitor5.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe (file missing)
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: AVG8 Firewall (avgfws8) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgfws8.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe (file missing)
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: TabletServiceWacom - Wacom Technology, Corp. - C:\WINDOWS\system32\Wacom_Tablet.exe
O24 - Desktop Component 1: Aqua Real 3D - 7db39a0d-580f-4be9-9195-8bfcd226f6c2
O24 - Desktop Component 2: Aqua Garden - 6423CD5F-D089-4BF1-88B6-6A359339DAFF

--
End of file - 7852 bytes

Speargun · 07-03-2008, 01:15 PM

I just found another problem....

I tried to add my printer back and I get the error:
"OPERATION COULD NOT BE COMPLETED. THE PRINT SPOOLER SERVICE IS NOT RUNNING."
I tried to start it from the admin tools but was given the error
"COULD NOT START THE PRINT SPOOLER SERVICE ON LOCAL COMPUTER.
ERROR 1068: THE DEPENDENCY SERVICE OR GROUP FAILED TO START."

TX,
-Jeff

forhockey · 07-04-2008, 05:36 PM

Hello, lets first make sure your computer is clean before we jump onto the next issue.

Open HijackThis and click on 'Do a System Scan Only'. Check the following entries (If they still exist, make sure you do not miss any)

O4 - HKCU\..\Run: [[system]] C:\WINDOWS\system32\drivers\services.exe
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.171 85.255.112.179
O17 - HKLM\System\CS1\Services\Tcpip\..\{1D731043-EF11-4D60-AED7-9CBA20BDC6BD}: NameServer = 85.255.116.171,85.255.112.179

Please remember to close all other windows, including browsers then click Fix checked.

--------------------------------------------------------------

Perform an online scan with Panda ActiveScan

Click on Scan Your PC Now
A "pop up" window will appear, or a new tab will open.
Click on Register
Choose the option you like most, but we recommend the Free Registration.
Click on Register
Enter your e-mail address, and create a password.
Select "I do not want to receive any type of information". (unless you want to receive such information)
Click on Send
Confirm registration, and continue by entering your user name and password, then click on Enter
Select Full Scan, then Click on Scan Now
Wait for the components to be loaded and installed. Don't close this window or go to another page while it is downloading. You can continue using the Internet by opening another window in your browser.
If it finds any malware it can disinfect, the Disinfect button will be enabled. Click on Disinfect
Please ignore the offer to buy the program. Click on Export To
Export the log and save it to your desktop.
Please attach the contents of that log in your next reply.

* Turn off the real time scanner of any existing antivirus program while performing the online scan

--------------------------------------------------------------

Please reply back with the following:

Panda online scan results
Fresh HijackThis log

Speargun · 07-05-2008, 07:55 AM

Here's the new HJT & the Panda ActiveScan report is attached.

-Jeff

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:51:33 AM, on 7/5/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgfws8.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\PSIService.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\Wacom_Tablet.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\WTablet\Wacom_TabletUser.exe
C:\WINDOWS\system32\Wacom_Tablet.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\PROGRA~1\AVG\AVG8\avgscanx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cust...ch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/cust.../www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - C:\Program Files\AVG\AVG8\avgssie.dll
O3 - Toolbar: (no name) - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - (no file)
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\.DEFAULT\..\Run: [[system]] C:\WINDOWS\system32\drivers\services.exe (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Download with Go!Zilla - file://C:\Program Files\Go!Zilla\download-with-gozilla.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {2d8ed06d-3c30-438b-96ae-4d110fdc1fb8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/actives.../as2stubie.cab
O16 - DPF: {76D90D08-EAB7-46D8-BF99-87445BF59E72} (SystemInfo Class) - http://getdway.com/dwayready/dpcsysinfo.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL,avgrsstx.dll
O23 - Service: Adobe Active File Monitor V5 (AdobeActiveFileMonitor5.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe (file missing)
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: AVG8 Firewall (avgfws8) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgfws8.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe (file missing)
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: TabletServiceWacom - Wacom Technology, Corp. - C:\WINDOWS\system32\Wacom_Tablet.exe
O24 - Desktop Component 1: Aqua Real 3D - 7db39a0d-580f-4be9-9195-8bfcd226f6c2
O24 - Desktop Component 2: Aqua Garden - 6423CD5F-D089-4BF1-88B6-6A359339DAFF

--
End of file - 7553 bytes

forhockey · 07-05-2008, 03:29 PM

Open My Computer. Select the Tools menu and click Folder Options. Select the View Tab then select Show all files in the Hidden files section. Also make sure there is no checkmark beside Hide file extensions for known file types. Click OK.

--------------------------------------------------------------

Delete the following Files indicated in RED and Folders indicated in BLUE if they still exist.

c:\program files\vvsn
C:\WINDOWS\system32\drivers\2eba2bdd.sys

--------------------------------------------------------------

Go here to run an online scannner from ESET.

Note: You will need to use Internet explorer for this scan
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activex control to install
Click Start
Make sure that the option Remove found threats is unticked, and the option Scan unwanted applications is checked
Click Scan
Wait for the scan to finish
Use notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
Copy and paste that log as a reply to this topic, along with a new HijackThis log and a description of any remaining problems

Speargun · 07-06-2008, 09:03 AM

ESET log

# version=4
# OnlineScanner.ocx=1.0.0.56
# OnlineScannerDLLA.dll=1, 0, 0, 51
# OnlineScannerDLLW.dll=1, 0, 0, 51
# OnlineScannerUninstaller.exe=1, 0, 0, 49
# vers_standard_module=3244 (20080705)
# vers_arch_module=1.064 (20080214)
# vers_adv_heur_module=1.064 (20070717)
# EOSSerial=4c1e64178dd4cb4ab2da4a9207d41786
# end=finished
# remove_checked=false
# unwanted_checked=true
# utc_time=2008-07-06 05:59:38
# local_time=2008-07-06 01:59:38 (-0500, Eastern Daylight Time)
# country="United States"
# osver=5.1.2600 NT Service Pack 2
# scanned=2696242
# found=28
# scan_time=24650
C:\AV8R\a-Speargun\My Documents\Documents\Office\Word\Documents\Music\chords.zip probably unknown NewHeur_PE virus 00000000000000000000000000000000
C:\AV8R\a-Speargun\My Documents\Documents\Office\Word\Documents\Music\chords.zip »ZIP »Chords.CAB probably unknown NewHeur_PE virus 00000000000000000000000000000000
C:\AV8R\a-Speargun\My Documents\Documents\Office\Word\Documents\Music\chords.zip »ZIP »Chords.CAB »CAB »Chords.exe probably unknown NewHeur_PE virus 00000000000000000000000000000000
C:\AV8R\C - Windows XP\a-Speargun\My Documents\Documents\Office\Word\Documents\Music\chords.zip probably unknown NewHeur_PE virus 00000000000000000000000000000000
C:\AV8R\C - Windows XP\a-Speargun\My Documents\Documents\Office\Word\Documents\Music\chords.zip »ZIP »Chords.CAB probably unknown NewHeur_PE virus 00000000000000000000000000000000
C:\AV8R\C - Windows XP\a-Speargun\My Documents\Documents\Office\Word\Documents\Music\chords.zip »ZIP »Chords.CAB »CAB »Chords.exe probably unknown NewHeur_PE virus 00000000000000000000000000000000
C:\AV8R\C - Windows XP\Program Files\Accessories\Music\Chords\Chords.exe probably unknown NewHeur_PE virus 00000000000000000000000000000000
C:\AV8R\D - Application on Av8r\Microsoft Office\Documents\Music\chords.zip probably unknown NewHeur_PE virus 00000000000000000000000000000000
C:\AV8R\D - Application on Av8r\Microsoft Office\Documents\Music\chords.zip »ZIP »Chords.CAB probably unknown NewHeur_PE virus 00000000000000000000000000000000
C:\AV8R\D - Application on Av8r\Microsoft Office\Documents\Music\chords.zip »ZIP »Chords.CAB »CAB »Chords.exe probably unknown NewHeur_PE virus 00000000000000000000000000000000
C:\Backup\PeoplePC\Branding\ppcstub.exe probably unknown NewHeur_PE virus 00000000000000000000000000000000
C:\Documents and Settings\Jeff\My Documents\My MDT\My Documents MDT\Install_AIM.exe Win32/Adware.WBug.A application 2FF2EC707305F71D8C923773A1A8A3E0
C:\Documents and Settings\Jeff\My Documents\My MDT\My Documents MDT\Install_AIM.exe »WISE »WxBug.EXE Win32/Adware.WBug.A application 00000000000000000000000000000000
C:\Documents and Settings\Jeff\My Documents\My MDT\My Documents MDT\Install_AIM.exe »WISE »WxBug.EXE »WISE »MiniBugTransporter.dll Win32/Adware.WBug.A application 00000000000000000000000000000000
C:\System Volume Information\_restore{93EA7FB1-3634-4E01-BFEE-735EDB571361}\RP1\A0000027.exe Win32/Adware.NdotNet application F4B9AFDB3B0EEF5443FFD62B67C41881
C:\System Volume Information\_restore{93EA7FB1-3634-4E01-BFEE-735EDB571361}\RP1\A0000027.exe »WISE »freeze_388.exe Win32/Adware.NdotNet application 00000000000000000000000000000000
C:\System Volume Information\_restore{93EA7FB1-3634-4E01-BFEE-735EDB571361}\RP1\A0000028.exe multiple infiltrations 9AC4B993112EBDE785ED5F0694DB01FC
C:\System Volume Information\_restore{93EA7FB1-3634-4E01-BFEE-735EDB571361}\RP1\A0000028.exe »WISE »VVSN_FRZE1604Inst.exe Win32/Adware.SaveNow application 00000000000000000000000000000000
C:\System Volume Information\_restore{93EA7FB1-3634-4E01-BFEE-735EDB571361}\RP1\A0000028.exe »WISE »freeze_388.exe Win32/Adware.NdotNet application 00000000000000000000000000000000
C:\System Volume Information\_restore{93EA7FB1-3634-4E01-BFEE-735EDB571361}\RP1\A0000051.exe Win32/Adware.WBug.A application 954B1F29D2963F04FEF9E652967EBC17
C:\System Volume Information\_restore{93EA7FB1-3634-4E01-BFEE-735EDB571361}\RP1\A0000051.exe »WISE »WxBug.EXE Win32/Adware.WBug.A application 00000000000000000000000000000000
C:\System Volume Information\_restore{93EA7FB1-3634-4E01-BFEE-735EDB571361}\RP1\A0000051.exe »WISE »WxBug.EXE »WISE »MiniBugTransporter.dll Win32/Adware.WBug.A application 00000000000000000000000000000000
F:\My Documents\Music\chords.zip probably unknown NewHeur_PE virus 00000000000000000000000000000000
F:\My Documents\Music\chords.zip »ZIP »Chords.CAB probably unknown NewHeur_PE virus 00000000000000000000000000000000
F:\My Documents\Music\chords.zip »ZIP »Chords.CAB »CAB »Chords.exe probably unknown NewHeur_PE virus 00000000000000000000000000000000
H:\Zipfiles\Install_AIM.exe Win32/Adware.WBug.A application 954B1F29D2963F04FEF9E652967EBC17
H:\Zipfiles\Install_AIM.exe »WISE »WxBug.EXE Win32/Adware.WBug.A application 00000000000000000000000000000000
H:\Zipfiles\Install_AIM.exe »WISE »WxBug.EXE »WISE »MiniBugTransporter.dll Win32/Adware.WBug.A application 00000000000000000000000000000000

HJT

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:02:41 AM, on 7/6/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgfws8.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\PSIService.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\system32\Wacom_Tablet.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\system32\WTablet\Wacom_TabletUser.exe
C:\WINDOWS\system32\Wacom_Tablet.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\AVG\AVG8\avgscanx.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cust...ch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/cust.../www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - C:\Program Files\AVG\AVG8\avgssie.dll
O3 - Toolbar: (no name) - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - (no file)
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [[system]] C:\WINDOWS\system32\drivers\services.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [[system]] C:\WINDOWS\system32\drivers\services.exe (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Download with Go!Zilla - file://C:\Program Files\Go!Zilla\download-with-gozilla.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {2d8ed06d-3c30-438b-96ae-4d110fdc1fb8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/actives.../as2stubie.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/OnlineScanner.cab
O16 - DPF: {76D90D08-EAB7-46D8-BF99-87445BF59E72} (SystemInfo Class) - http://getdway.com/dwayready/dpcsysinfo.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL,avgrsstx.dll
O23 - Service: Adobe Active File Monitor V5 (AdobeActiveFileMonitor5.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe (file missing)
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: AVG8 Firewall (avgfws8) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgfws8.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe (file missing)
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: TabletServiceWacom - Wacom Technology, Corp. - C:\WINDOWS\system32\Wacom_Tablet.exe
O24 - Desktop Component 1: Aqua Real 3D - 7db39a0d-580f-4be9-9195-8bfcd226f6c2
O24 - Desktop Component 2: Aqua Garden - 6423CD5F-D089-4BF1-88B6-6A359339DAFF

--
End of file - 8045 bytes

forhockey · 07-06-2008, 12:46 PM

Please delete the following files:

C:\AV8R\a-Speargun\My Documents\Documents\Office\Word\Documents\Music\chords.zip
C:\AV8R\C - Windows XP\a-Speargun\My Documents\Documents\Office\Word\Documents\Music\chords.zip
C:\AV8R\D - Application on Av8r\Microsoft Office\Documents\Music\chords.zip
C:\Backup\PeoplePC\Branding\ppcstub.exe
C:\Documents and Settings\Jeff\My Documents\My MDT\My Documents MDT\Install_AIM.exe
F:\My Documents\Music\chords.zip
H:\Zipfiles\Install_AIM.exe

--------------------------------------------------------------

Well done, your logs are clean! There are just a few more things I would like you to do.

The following procedure will clear out ComboFix.exe, as well as the backups and quarantines created by the fix. It will also reset your System Restore by flushing out previous restore points (which contain the infections) and create a new restore point.

Click Start > Run and copy/paste, or type the following bolded text into the Run box and click OK:

ComboFix /u

----------------------------------------------------------------

Microsoft Updates

It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft and download all the critical updates to help prevent possible re-infection.

Malware Prevention Tools

These programs configure your computer to prevent known malware-related changes. You can have more than one of these at a time and they take up minimal resources.

SpywareBlaster - Install & update SpywareBlaster with the latest definitions. After you have updated, click the button - enable protection for all unprotected items. Check regularly for updates.
IE-Spyad - Here is an installation guide -> http://www.techsupportforum.com/cont...ticles/63.html
MVPS Hosts File - extract and double-click the mvps.bat file. This will replace your current HOSTS file with one that will restrict known ad sites form serving you unsolicited advertisements, preventing your computer from connecting to those sites.
McAfee SiteAdvisor - helps to warn you before you interact with a dangerous Web site. Works with both IE and Firefox.
SpywareGuard - real-time protection that detects and blocks spyware before it can execute.

Alternative Web Browsers

Using an alternative browser can help prevent malware from being installed without your knowledge, but may not work on all websites.

Firefox

Opera

Firewalls

If you do not have a firewall, here are a few free ones available for personal use:

Understanding and Using Firewalls

Informational Reading

In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles:

PC SAFETY AND SECURITY
How Did I Get Infected In The First Place?.
THE ANTI-SPYWARE TUTORIAL
STRONG PASSWORDS

Please respond to this thread one more time so we can mark this thread as resolved.

Speargun · 07-06-2008, 02:28 PM

Thanks for all of the help!!!

I think I'll make my computer off limits for anyone else from now on.

Which anti virus software would you recommend?
Free is nice, but I don't have a problem paying if it is going to work. (I've been paying for McAfee for the past several years now.)

Thanks again!
Jeff

forhockey · 07-09-2008, 04:50 PM

Hi Speargun,

You're welcome. Here are my recommendations

Free: Avira Personal Edition Classic

Pay: Kaspersky Internet Security 7.0

Note: You must only have one AntiVirus program installed at a time, or else it will cause system performance issues.

Its usually a user preference when it comes to deciding what Anti-Virus program they want.

Speargun · 07-09-2008, 08:28 PM

Thanks again for all of the help!

You can mark the thread as resolved.

07-01-2008, 12:21 PM	#1 (permalink)
Speargun Registered User Join Date: Jun 2008 Posts: 9 OS: XP sp2	Puper Trojan w/HJT - I 'Think' I got it During a random act of stoopidity, I double clicked on a file & infected my system with the puper trojan. My brain said don't click on that, but my finger wasn't paying attention & did it anyway. Here is where I'm at: Mcafee didn't do anything but tell me I was infected so I ran the mcafee SDAT.EXE from the command line in safe mode. 6 days later it looks like the scan might have helped a little. I booted back into windows and kept getting buffer under/over??? run warnings from mcafee from SERVICES.EXE. All of the file associations had been lost & I would get an error that rundll32.exe was missing even though it was there. I first expanded rundll32.exe from the windows install disk and overwrote the one in my system32 directory. I then ran this (http://www.dougknox.com/xp/fileassoc/xp_fileassoc.zip) program to get the associations back then I ran (http://www.dougknox.com/xp/fileassoc/xp_exe_fix.zip) to fix the registry. I deleted mcafee and installed AVG antivirus which found a number of trojans and quarantined them. I then ran HJT and now I'm here. Could someone take a look at my HJT & let me know if everything looks right? Did I forget anything? Any suggestions? Thanks a Bunch! -Jeff

07-01-2008, 03:14 PM	#2 (permalink)
Speargun Registered User Join Date: Jun 2008 Posts: 9 OS: XP sp2	Re: Puper Trojan w/HJT - I 'Think' I got it I also just found out that there is no longer a screen saver tab under my display properties. -EDIT- Never mind. I just found the correct registry entry to change it. Last edited by Speargun; 07-01-2008 at 03:22 PM.

07-01-2008, 04:41 PM	#3 (permalink)
forhockey Analyst, Security Team Join Date: Sep 2006 Location: Ontario, Canada Posts: 2,947 OS: Windows 7 Ultimate	Re: Puper Trojan w/HJT - I 'Think' I got it Hi Speargun, Have you taken the time to familiarize yourself with the following sticky before posting? (Updated!) IMPORTANT - Read This Before Posting A Log Please go through the 5 steps outlined in the link below and post back the requested logs in this thread. Please take into consideration that we are very busy, and try our best to answer every thread. If you haven't heard a reply from anyone after 48 hrs, then simply type "bump" to move your thread up. Thanks __________________ Proud Member of ASAP Proud Member of UNITE Keep this forum alive - if you've been helped at this forum, please do consider a donation. Thank you for your support. Donation link for Tech Support Forum

07-02-2008, 08:51 PM	#5 (permalink)
forhockey Analyst, Security Team Join Date: Sep 2006 Location: Ontario, Canada Posts: 2,947 OS: Windows 7 Ultimate	Re: Puper Trojan w/HJT - I 'Think' I got it Hello Jeff, Please copy this page to Notepad and save to your desktop for reference as you will not have any browsers open while you are carrying out portions of these instructions. Also be sure to carry out the instructions in the sequence listed below. -------------------------------------------------------------- Click > Start > Control Panel > Add / Remove Programs and uninstall the following programs (if they exist): Viewpoint Manager Viewpoint Media Player <<<this is considered foistware instead of malware since it is installed without users approval, but doesn't spy or do anything "bad". Read this article: http://www.clickz.com/news/article.php/3561546 Additional info: http://vil.nai.com/vil/content/v_137262.htm -------------------------------------------------------------- P2P Software I see you have P2P software ( µTorrent, ) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information. -------------------------------------------------------------- Please download FixWareout from one of these sites: http://downloads.subratam.org/Fixwareout.exe http://download.bleepingcomputer.com...Fixwareout.exe Save it to your desktop and run it. Click *"Next",* then Install, make sure *"Run fixit"* is checked and click Finish. The fix will begin: Please follow the prompts. You will be asked to reboot your computer: Please do so. Your system may take longer than usual to load and this is normal. Once the desktop loads post the text that will open (report.txt) -------------------------------------------------------------- Please visit this webpage for instructions for downloading and running ComboFix: http://www.bleepingcomputer.com/comb...o-use-combofix IMPORTANT: Make sure you install the Recovery Console before running ComboFix. -------------------------------------------------------------- Reply back with the following: C:\fixwareout\report.txt C:\ComboFix.txt New HJT log __________________ Proud Member of ASAP Proud Member of UNITE Keep this forum alive - if you've been helped at this forum, please do consider a donation. Thank you for your support. Donation link for Tech Support Forum

07-03-2008, 01:15 PM	#7 (permalink)
Speargun Registered User Join Date: Jun 2008 Posts: 9 OS: XP sp2	Re: Puper Trojan w/HJT - I 'Think' I got it I just found another problem.... I tried to add my printer back and I get the error: "OPERATION COULD NOT BE COMPLETED. THE PRINT SPOOLER SERVICE IS NOT RUNNING." I tried to start it from the admin tools but was given the error "COULD NOT START THE PRINT SPOOLER SERVICE ON LOCAL COMPUTER. ERROR 1068: THE DEPENDENCY SERVICE OR GROUP FAILED TO START." TX, -Jeff

07-04-2008, 05:36 PM	#8 (permalink)
forhockey Analyst, Security Team Join Date: Sep 2006 Location: Ontario, Canada Posts: 2,947 OS: Windows 7 Ultimate	Re: Puper Trojan w/HJT - I 'Think' I got it Hello, lets first make sure your computer is clean before we jump onto the next issue. Open HijackThis and click on 'Do a System Scan Only'. Check the following entries (If they still exist, make sure you do not miss any) O4 - HKCU\..\Run: [[system]] C:\WINDOWS\system32\drivers\services.exe O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.171 85.255.112.179 O17 - HKLM\System\CS1\Services\Tcpip\..\{1D731043-EF11-4D60-AED7-9CBA20BDC6BD}: NameServer = 85.255.116.171,85.255.112.179 *Please remember to close all other windows, including browsers then click Fix checked.* -------------------------------------------------------------- Perform an online scan with Panda ActiveScan Click on Scan Your PC Now A "pop up" window will appear, or a new tab will open. Click on Register Choose the option you like most, but we recommend the Free Registration. Click on Register Enter your e-mail address, and create a password. Select "I do not want to receive any type of information". (unless you want to receive such information) Click on Send Confirm registration, and continue by entering your user name and password, then click on Enter Select Full Scan, then Click on Scan Now Wait for the components to be loaded and installed. Don't close this window or go to another page while it is downloading. You can continue using the Internet by opening another window in your browser. If it finds any malware it can disinfect, the Disinfect button will be enabled. Click on Disinfect Please ignore the offer to buy the program. Click on Export To Export the log and save it to your desktop. Please attach the contents of that log in your next reply. * Turn off the real time scanner of any existing antivirus program while performing the online scan -------------------------------------------------------------- Please reply back with the following: Panda online scan results Fresh HijackThis log __________________ Proud Member of ASAP Proud Member of UNITE Keep this forum alive - if you've been helped at this forum, please do consider a donation. Thank you for your support. Donation link for Tech Support Forum

07-05-2008, 03:29 PM	#10 (permalink)
forhockey Analyst, Security Team Join Date: Sep 2006 Location: Ontario, Canada Posts: 2,947 OS: Windows 7 Ultimate	Re: Puper Trojan w/HJT - I 'Think' I got it Open My Computer. Select the Tools menu and click Folder Options. Select the View Tab then select Show all files in the Hidden files section. Also make sure there is no checkmark beside Hide file extensions for known file types. Click OK. -------------------------------------------------------------- Delete the following Files indicated in RED and Folders indicated in BLUE if they still exist. c:\program files\vvsn C:\WINDOWS\system32\drivers\2eba2bdd.sys -------------------------------------------------------------- Go here to run an online scannner from ESET. Note: You will need to use Internet explorer for this scan Tick the box next to YES, I accept the Terms of Use. Click Start When asked, allow the activex control to install Click Start Make sure that the option Remove found threats is unticked, and the option Scan unwanted applications is checked Click Scan Wait for the scan to finish Use notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt Copy and paste that log as a reply to this topic, along with a new HijackThis log and a description of any remaining problems __________________ Proud Member of ASAP Proud Member of UNITE Keep this forum alive - if you've been helped at this forum, please do consider a donation. Thank you for your support. Donation link for Tech Support Forum

07-06-2008, 09:03 AM	#11 (permalink)
Speargun Registered User Join Date: Jun 2008 Posts: 9 OS: XP sp2	Re: Puper Trojan w/HJT - I 'Think' I got it ESET log # version=4 # OnlineScanner.ocx=1.0.0.56 # OnlineScannerDLLA.dll=1, 0, 0, 51 # OnlineScannerDLLW.dll=1, 0, 0, 51 # OnlineScannerUninstaller.exe=1, 0, 0, 49 # vers_standard_module=3244 (20080705) # vers_arch_module=1.064 (20080214) # vers_adv_heur_module=1.064 (20070717) # EOSSerial=4c1e64178dd4cb4ab2da4a9207d41786 # end=finished # remove_checked=false # unwanted_checked=true # utc_time=2008-07-06 05:59:38 # local_time=2008-07-06 01:59:38 (-0500, Eastern Daylight Time) # country="United States" # osver=5.1.2600 NT Service Pack 2 # scanned=2696242 # found=28 # scan_time=24650 C:\AV8R\a-Speargun\My Documents\Documents\Office\Word\Documents\Music\chords.zip probably unknown NewHeur_PE virus 00000000000000000000000000000000 C:\AV8R\a-Speargun\My Documents\Documents\Office\Word\Documents\Music\chords.zip »ZIP »Chords.CAB probably unknown NewHeur_PE virus 00000000000000000000000000000000 C:\AV8R\a-Speargun\My Documents\Documents\Office\Word\Documents\Music\chords.zip »ZIP »Chords.CAB »CAB »Chords.exe probably unknown NewHeur_PE virus 00000000000000000000000000000000 C:\AV8R\C - Windows XP\a-Speargun\My Documents\Documents\Office\Word\Documents\Music\chords.zip probably unknown NewHeur_PE virus 00000000000000000000000000000000 C:\AV8R\C - Windows XP\a-Speargun\My Documents\Documents\Office\Word\Documents\Music\chords.zip »ZIP »Chords.CAB probably unknown NewHeur_PE virus 00000000000000000000000000000000 C:\AV8R\C - Windows XP\a-Speargun\My Documents\Documents\Office\Word\Documents\Music\chords.zip »ZIP »Chords.CAB »CAB »Chords.exe probably unknown NewHeur_PE virus 00000000000000000000000000000000 C:\AV8R\C - Windows XP\Program Files\Accessories\Music\Chords\Chords.exe probably unknown NewHeur_PE virus 00000000000000000000000000000000 C:\AV8R\D - Application on Av8r\Microsoft Office\Documents\Music\chords.zip probably unknown NewHeur_PE virus 00000000000000000000000000000000 C:\AV8R\D - Application on Av8r\Microsoft Office\Documents\Music\chords.zip »ZIP »Chords.CAB probably unknown NewHeur_PE virus 00000000000000000000000000000000 C:\AV8R\D - Application on Av8r\Microsoft Office\Documents\Music\chords.zip »ZIP »Chords.CAB »CAB »Chords.exe probably unknown NewHeur_PE virus 00000000000000000000000000000000 C:\Backup\PeoplePC\Branding\ppcstub.exe probably unknown NewHeur_PE virus 00000000000000000000000000000000 C:\Documents and Settings\Jeff\My Documents\My MDT\My Documents MDT\Install_AIM.exe Win32/Adware.WBug.A application 2FF2EC707305F71D8C923773A1A8A3E0 C:\Documents and Settings\Jeff\My Documents\My MDT\My Documents MDT\Install_AIM.exe »WISE »WxBug.EXE Win32/Adware.WBug.A application 00000000000000000000000000000000 C:\Documents and Settings\Jeff\My Documents\My MDT\My Documents MDT\Install_AIM.exe »WISE »WxBug.EXE »WISE »MiniBugTransporter.dll Win32/Adware.WBug.A application 00000000000000000000000000000000 C:\System Volume Information\_restore{93EA7FB1-3634-4E01-BFEE-735EDB571361}\RP1\A0000027.exe Win32/Adware.NdotNet application F4B9AFDB3B0EEF5443FFD62B67C41881 C:\System Volume Information\_restore{93EA7FB1-3634-4E01-BFEE-735EDB571361}\RP1\A0000027.exe »WISE »freeze_388.exe Win32/Adware.NdotNet application 00000000000000000000000000000000 C:\System Volume Information\_restore{93EA7FB1-3634-4E01-BFEE-735EDB571361}\RP1\A0000028.exe multiple infiltrations 9AC4B993112EBDE785ED5F0694DB01FC C:\System Volume Information\_restore{93EA7FB1-3634-4E01-BFEE-735EDB571361}\RP1\A0000028.exe »WISE »VVSN_FRZE1604Inst.exe Win32/Adware.SaveNow application 00000000000000000000000000000000 C:\System Volume Information\_restore{93EA7FB1-3634-4E01-BFEE-735EDB571361}\RP1\A0000028.exe »WISE »freeze_388.exe Win32/Adware.NdotNet application 00000000000000000000000000000000 C:\System Volume Information\_restore{93EA7FB1-3634-4E01-BFEE-735EDB571361}\RP1\A0000051.exe Win32/Adware.WBug.A application 954B1F29D2963F04FEF9E652967EBC17 C:\System Volume Information\_restore{93EA7FB1-3634-4E01-BFEE-735EDB571361}\RP1\A0000051.exe »WISE »WxBug.EXE Win32/Adware.WBug.A application 00000000000000000000000000000000 C:\System Volume Information\_restore{93EA7FB1-3634-4E01-BFEE-735EDB571361}\RP1\A0000051.exe »WISE »WxBug.EXE »WISE »MiniBugTransporter.dll Win32/Adware.WBug.A application 00000000000000000000000000000000 F:\My Documents\Music\chords.zip probably unknown NewHeur_PE virus 00000000000000000000000000000000 F:\My Documents\Music\chords.zip »ZIP »Chords.CAB probably unknown NewHeur_PE virus 00000000000000000000000000000000 F:\My Documents\Music\chords.zip »ZIP »Chords.CAB »CAB »Chords.exe probably unknown NewHeur_PE virus 00000000000000000000000000000000 H:\Zipfiles\Install_AIM.exe Win32/Adware.WBug.A application 954B1F29D2963F04FEF9E652967EBC17 H:\Zipfiles\Install_AIM.exe »WISE »WxBug.EXE Win32/Adware.WBug.A application 00000000000000000000000000000000 H:\Zipfiles\Install_AIM.exe »WISE »WxBug.EXE »WISE »MiniBugTransporter.dll Win32/Adware.WBug.A application 00000000000000000000000000000000 HJT Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:02:41 AM, on 7/6/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\PROGRA~1\AVG\AVG8\avgfws8.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\system32\PSIService.exe C:\PROGRA~1\AVG\AVG8\avgam.exe C:\WINDOWS\System32\svchost.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\WINDOWS\system32\Wacom_Tablet.exe C:\PROGRA~1\AVG\AVG8\avgnsx.exe C:\WINDOWS\system32\WTablet\Wacom_TabletUser.exe C:\WINDOWS\system32\Wacom_Tablet.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\ctfmon.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe C:\WINDOWS\system32\wuauclt.exe C:\PROGRA~1\AVG\AVG8\avgscanx.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cust...ch/search.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/cust.../www.yahoo.com R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - C:\Program Files\AVG\AVG8\avgssie.dll O3 - Toolbar: (no name) - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - (no file) O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file) O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-18\..\Run: [[system]] C:\WINDOWS\system32\drivers\services.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [[system]] C:\WINDOWS\system32\drivers\services.exe (User 'Default user') O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Download with Go!Zilla - file://C:\Program Files\Go!Zilla\download-with-gozilla.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {2d8ed06d-3c30-438b-96ae-4d110fdc1fb8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/actives.../as2stubie.cab O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/OnlineScanner.cab O16 - DPF: {76D90D08-EAB7-46D8-BF99-87445BF59E72} (SystemInfo Class) - http://getdway.com/dwayready/dpcsysinfo.cab O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL,avgrsstx.dll O23 - Service: Adobe Active File Monitor V5 (AdobeActiveFileMonitor5.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe (file missing) O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: AVG8 Firewall (avgfws8) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgfws8.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe (file missing) O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe O23 - Service: TabletServiceWacom - Wacom Technology, Corp. - C:\WINDOWS\system32\Wacom_Tablet.exe O24 - Desktop Component 1: Aqua Real 3D - 7db39a0d-580f-4be9-9195-8bfcd226f6c2 O24 - Desktop Component 2: Aqua Garden - 6423CD5F-D089-4BF1-88B6-6A359339DAFF -- End of file - 8045 bytes

07-06-2008, 12:46 PM	#12 (permalink)
forhockey Analyst, Security Team Join Date: Sep 2006 Location: Ontario, Canada Posts: 2,947 OS: Windows 7 Ultimate	Re: Puper Trojan w/HJT - I 'Think' I got it Please delete the following files: C:\AV8R\a-Speargun\My Documents\Documents\Office\Word\Documents\Music\chords.zip C:\AV8R\C - Windows XP\a-Speargun\My Documents\Documents\Office\Word\Documents\Music\chords.zip C:\AV8R\D - Application on Av8r\Microsoft Office\Documents\Music\chords.zip C:\Backup\PeoplePC\Branding\ppcstub.exe C:\Documents and Settings\Jeff\My Documents\My MDT\My Documents MDT\Install_AIM.exe F:\My Documents\Music\chords.zip H:\Zipfiles\Install_AIM.exe -------------------------------------------------------------- Well done, your logs are clean! There are just a few more things I would like you to do. The following procedure will clear out ComboFix.exe, as well as the backups and quarantines created by the fix. It will also reset your System Restore by flushing out previous restore points (which contain the infections) and create a new restore point. Click Start > Run and copy/paste, or type the following bolded text into the Run box and click OK: ComboFix /u ---------------------------------------------------------------- Microsoft Updates It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft and download all the critical updates to help prevent possible re-infection. Malware Prevention Tools These programs configure your computer to prevent known malware-related changes. You can have more than one of these at a time and they take up minimal resources. SpywareBlaster - Install & update SpywareBlaster with the latest definitions. After you have updated, click the button - enable protection for all unprotected items. Check regularly for updates. IE-Spyad - Here is an installation guide -> http://www.techsupportforum.com/cont...ticles/63.html MVPS Hosts File - extract and double-click the mvps.bat file. This will replace your current HOSTS file with one that will restrict known ad sites form serving you unsolicited advertisements, preventing your computer from connecting to those sites. McAfee SiteAdvisor - helps to warn you before you interact with a dangerous Web site. Works with both IE and Firefox. SpywareGuard - real-time protection that detects and blocks spyware before it can execute. Alternative Web Browsers Using an alternative browser can help prevent malware from being installed without your knowledge, but may not work on all websites. Firefox Opera Firewalls If you do not have a firewall, here are a few free ones available for personal use: Understanding and Using Firewalls Comodo Firewall Pro ZoneAlarm OutPost Firewall Informational Reading In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles: PC SAFETY AND SECURITY How Did I Get Infected In The First Place?. THE ANTI-SPYWARE TUTORIAL STRONG PASSWORDS Please respond to this thread one more time so we can mark this thread as resolved. __________________ Proud Member of ASAP Proud Member of UNITE Keep this forum alive - if you've been helped at this forum, please do consider a donation. Thank you for your support. Donation link for Tech Support Forum

07-06-2008, 02:28 PM	#13 (permalink)
Speargun Registered User Join Date: Jun 2008 Posts: 9 OS: XP sp2	Re: Puper Trojan w/HJT - I 'Think' I got it Thanks for all of the help!!! I think I'll make my computer off limits for anyone else from now on. Which anti virus software would you recommend? Free is nice, but I don't have a problem paying if it is going to work. (I've been paying for McAfee for the past several years now.) Thanks again! Jeff

07-09-2008, 04:50 PM	#14 (permalink)
forhockey Analyst, Security Team Join Date: Sep 2006 Location: Ontario, Canada Posts: 2,947 OS: Windows 7 Ultimate	Re: Puper Trojan w/HJT - I 'Think' I got it Hi Speargun, You're welcome. Here are my recommendations Free: Avira Personal Edition Classic Pay: Kaspersky Internet Security 7.0 Note: You must only have one AntiVirus program installed at a time, or else it will cause system performance issues. Its usually a user preference when it comes to deciding what Anti-Virus program they want. __________________ Proud Member of ASAP Proud Member of UNITE Keep this forum alive - if you've been helped at this forum, please do consider a donation. Thank you for your support. Donation link for Tech Support Forum

07-09-2008, 08:28 PM	#15 (permalink)
Speargun Registered User Join Date: Jun 2008 Posts: 9 OS: XP sp2	Re: Puper Trojan w/HJT - I 'Think' I got it Thanks again for all of the help! You can mark the thread as resolved.