annoying virus help

ddrum1031 · 03-13-2009, 06:27 PM

hi,

i had this awful virus on my computer and finally got it removed and everything cleaned up but there is one more i cannot get rid of..
anytime a program starts a warning pops up that says:

(program name).exe-bad image
the app or dll globalroot/systemroot/system32/tdssnvuo.dll is not a valid windows image.please check this against your installation diskette.

at the same time a popup message appears that says:

antivirus
virus detected-restart required
then a paragraph about how i need to restart to remove the virus and to run the antivirus again to see if it is still on my system.. underneath it gives the virus and infected file
rootkit.win32.tdss.dbg
c:\windows\system32\tdssnuvo.dll

(this is not from my antivirus program)

ive tried to run both gmer and dds and the virus wont let me run either of them..help!!
many thanks
dave

**chemist** · 03-13-2009, 07:34 PM

Hello and Welcome to TSF.

Please Subscribe to this Thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant notification by email, then click Add Subscription.

------------------------------------------------------

See if RSIT will run:

Download RSIT by random/random and Save it to your Desktop.
Double-click RSIT.exe to run the tool.
Click Continue at the disclaimer screen.
When the scan completes it will open a log named log.txt maximized, and a log named info.txt minimized.
Please copy/paste the contents of log.txt in your next reply.
Please attach info.txt to your reply.

To attach a file to a reply, simply

Click the Manage Attachments button under Additional Options > Attach Files on the post composition page, and
Copy and Paste the following into the Upload File from your Computer box:
C:\rsit\info.txt
Click Upload

------------------------------------------------------

Let's try to get a GMER log. This will only work if you extracted gmer.exe to your desktop.

Open Notepad and copy/paste the text in the quotebox below into Notepad:

Quote:

@echo off
copy /y gmer.exe omer.exe
start omer

Save this as run.bat Choose to "Save type as - All Files" next to gmer.exe
It should look like this:

Double-click run.bat & allow it to run.

Then, use these settings to produce a log.

If asked to allow gmer.sys driver to load, please consent.
If it gives you a warning about rootkit activity and asks if you want to run scan...click NO.

Click the image to enlarge it
In the right panel, you will see several boxes that have been checked. Uncheck the following ...
- Sections
- IAT/EAT
- Drives/Partition other than Systemdrive (typically C:\)
- Show All (don't miss this one)
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop, and attach it to your next reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries

------------------------------------------------------

ddrum1031 · 03-14-2009, 12:22 AM

thank you .. both worked here you go

info.txt logfile of random's system information tool 1.05 2009-03-13 21:44:02

======Uninstall list======

-->C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
-->C:\WINDOWS\IsUninst.exe -fC:\WINDOWS\orun32.isu
-->C:\WINDOWS\IsUninst.exe -fC:\WINDOWS\system32\UninstIPP.isu
-->c:\WINDOWS\system32\\MSIEXEC.EXE /x {075473F5-846A-448B-BCB3-104AA1760205}
-->c:\WINDOWS\system32\\MSIEXEC.EXE /x {AB708C9B-97C8-4AC9-899B-DBF226AC9382}
-->c:\WINDOWS\system32\\MSIEXEC.EXE /x {B12665F4-4E93-4AB4-B7FC-37053B524629}
-->MsiExec.exe /X{7B4AB13C-1A5C-4BC5-ABA6-762F8198444C}
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe Download Manager 2.2 (Remove Only)-->"C:\Program Files\Common Files\Adobe\ESD\uninst.exe"
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Photoshop 7.0-->C:\WINDOWS\ISUNINST.EXE -f"C:\Program Files\Adobe\Photoshop 7.0\Uninst.isu" -c"C:\Program Files\Adobe\Photoshop 7.0\Uninst.dll"
Adobe Reader 7.0.9-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A70900000002}
Adobe® Photoshop® Album Starter Edition 3.0-->MsiExec.exe /I{4BDFD2CE-6329-42E4-9801-9B3D1F10D79B}
AGEIA PhysX v2.6.0-->MsiExec.exe /X{582876EC-A178-44D4-9823-C10D6C62EAFF}
Agere Systems PCI-SV92PP Soft Modem-->agrsmdel
AIM 6-->C:\Program Files\AIM6\uninst.exe
AOL Uninstaller (Choose which Products to Remove)-->C:\Program Files\Common Files\AOL\uninstaller.exe
Apple Mobile Device Support-->MsiExec.exe /I{EC4455AB-F155-4CC1-A4C5-88F3777F9886}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
Ask Toolbar-->rundll32 C:\PROGRA~1\AskSBar\bar\1.bin\AskSBar.dll,O
Bonjour-->MsiExec.exe /I{07287123-B8AC-41CE-8346-3D777245C35B}
Compact Wireless-G USB Adapter-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F855C3AE-992D-4B84-A09D-07103CDCDAC2}\setup.exe" -l0x9
Customer Experience Enhancement-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\1050\INTEL3~1\IDriver.exe /M{23012310-3E05-46A5-88A9-C6CBCABCAC79} /l1033
Debrief v2.3-->"C:\Program Files\Idealign\Debrief\unins000.exe"
Download Updater (AOL LLC)-->C:\Program Files\Common Files\Software Update Utility\uninstall.exe
Easy Internet Sign-up-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\1050\INTEL3~1\IDriver.exe /M{8105684D-8CA6-440D-8F58-7E5FD67A499D} /l1033
Enhanced Multimedia Keyboard Solution-->C:\HP\KBD\Install.exe /u
Express Rip-->C:\Program Files\NCH Swift Sound\ExpressRip\uninst.exe
GameTap-->C:\Program Files\InstallShield Installation Information\{67E158AF-8856-4337-B483-EA21930786AF}\setup.exe -runfromtemp -l0x0009 -removeonly
GdiplusUpgrade-->MsiExec.exe /I{5421155F-B033-49DB-9B33-8F80F233D4D5}
High Definition Audio Driver Package - KB888111-->"C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe"
HijackThis 2.0.2-->"C:\Program Files\trend micro\HijackThis.exe" /uninstall
Hotfix for Windows Internet Explorer 7 (KB947864)-->"C:\WINDOWS\ie7updates\KB947864-IE7\spuninst\spuninst.exe"
Hotfix for Windows Media Format SDK (KB902344)-->"C:\WINDOWS\$NtUninstallKB902344$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
HP Boot Optimizer-->C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe /uninstall
HP Deskjet Printer Preload-->MsiExec.exe /I{2C5D07FB-31A2-4F2D-9FDA-0B24ACD42BD0}
HP Document Viewer 5.3-->C:\Program Files\HP\Digital Imaging\DocumentViewer\hpzscr01.exe -datfile hpqbud04.dat
HP DVD Play 1.0-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{45D707E9-F3C4-11D9-A373-0050BAE317E1}\Setup.exe" -uninstall
HP Extended Capabilities 5.0-->C:\Program Files\HP\Digital Imaging\ExtCapUninstall\hpzscr01.exe -datfile hpqhsc01.dat
HP Imaging Device Functions 6.0-->C:\Program Files\HP\Digital Imaging\DigitalImagingMonitor\hpzscr01.exe -datfile hpqbud01.dat
HP Organize-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D0122362-6333-4DE4-93F6-A5A2F3CC101A}\Setup.exe" UNINSTALL
HP Photosmart 330,380,420,470,7800,8000,8200 Series-->C:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\setup\hpzscr01.exe -d MsiRollbackUninstaller -datfile hphscr08.dat
HP Photosmart Cameras 5.0-->C:\Program Files\HP\Digital Imaging\{C83A12B9-B31B-461A-BBD4-CE9B988094F1}\setup\hpzscr01.exe -datfile hpiscr01.dat
HP Photosmart Cameras 6.0-->C:\Program Files\HP\Digital Imaging\{61CF89F5-5175-4b3b-ABB8-C89821252D50}\setup\hpzscr01.exe -datfile hpiscr01.dat
HP Photosmart Essential-->MsiExec.exe /X{6994491D-D491-48F1-AE1F-E179C1FFFC2F}
HP Photosmart Premier Software 6.0-->C:\Program Files\HP\Digital Imaging\uninstall\hpzscr01.exe -datfile hpqscr01.dat
HP PSC & OfficeJet 5.3.A-->"C:\Program Files\HP\Digital Imaging\{3E386744-10FA-44b2-98C9-DF7A270DECB3}\setup\hpzscr01.exe" -datfile hposcr06.dat
HP PSC & OfficeJet 5.3.B-->"C:\Program Files\HP\Digital Imaging\{5B79CFD1-6845-4158-9D7D-6BE89DF2C135}\setup\hpzscr01.exe" -datfile hposcr07.dat
HP Rhapsody-->C:\PROGRA~1\HPRHAP~1\Unwise32.exe /A C:\PROGRA~1\HPRHAP~1\install.log
HP Solution Center and Imaging Support Tools 6.0-->C:\Program Files\HP\Digital Imaging\eSupport\hpzscr01.exe -datfile hpqbud05.dat
HP Support Overview-->"C:\WINDOWS\unins000.exe"
HP Update-->MsiExec.exe /X{8C6027FD-53DC-446D-BB75-CACD7028A134}
HP Web Helper-->regsvr32 /u /s "C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\webhelper.dll"
InstallMgr-->MsiExec.exe /I{98177940-C048-4831-A279-F3888B1E2C7F}
Intel(R) Graphics Media Accelerator Driver-->RUNDLL32.EXE C:\WINDOWS\system32\ialmrem.dll,UninstallW2KIGfx2ID PCI\VEN_8086&DEV_2782 PCI\VEN_8086&DEV_2582
Intel(R) PRO Network Connections Drivers-->Prounstl.exe
InterVideo WinDVD Player-->"C:\Program Files\InstallShield Installation Information\{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}\setup.exe" REMOVEALL
iTunes-->MsiExec.exe /I{F5C63795-2708-4D15-BF18-5ABBFF7DFFC8}
J2SE Runtime Environment 5.0 Update 5-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150050}
J2SE Runtime Environment 5.0 Update 6-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150060}
Java(TM) 6 Update 12-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216012FF}
LimeWire 4.18.8-->"C:\Program Files\LimeWire\uninstall.exe"
LiveReg (Symantec Corporation)-->C:\Program Files\Common Files\Symantec Shared\LiveReg\VcSetup.exe /REMOVE
LiveUpdate 1.80 (Symantec Corporation)-->C:\Program Files\Symantec\LiveUpdate\LSETUP.EXE /U
Microsoft .NET Framework 1.1 Hotfix (KB928366)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0 Service Pack 1-->MsiExec.exe /I{B508B3F1-A24A-32C0-B310-85786919EF28}
Microsoft Base Smart Card Cryptographic Service Provider Package-->"C:\WINDOWS\$NtUninstallbasecsp$\spuninst\spuninst.exe"
Microsoft Default Manager-->MsiExec.exe /I{B7148D71-0A8F-4501-96B4-4E1CC67F874E}
Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft Money 2006-->"C:\Program Files\Microsoft Money 2006\MNYCoreFiles\Setup\uninst.exe" /s:120
Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Office 2003 Edition 60 Days Trial Welcome Tour-->MsiExec.exe /I{A01FC76F-CC09-4658-9E37-5C2F635EE708}
Microsoft Office Standard Edition 2003-->MsiExec.exe /I{91120409-6000-11D3-8CFE-0150048383C9}
Microsoft Search Enhancement Pack-->MsiExec.exe /I{9C9CEB9D-53FD-49A7-85D2-FE674F72F24E}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Works-->MsiExec.exe /I{416D80BA-6F6D-4672-B7CF-F54DA2F80B44}
MSN Toolbar-->"C:\Program Files\Microsoft\Search Enhancement Pack\InstallMgr\InstallMgr.exe"
MSN Toolbar-->MsiExec.exe /X{B6EF6DCE-078E-4952-A7FA-352A9C349EB0}
MSXML 4.0 SP2 (KB927978)-->MsiExec.exe /I{37477865-A3F1-4772-AD43-AAFC6BCFF99F}
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 6 Service Pack 2 (KB954459)-->MsiExec.exe /I{1A528690-6A2D-4BC5-B143-8C4AE8D19D96}
muvee autoProducer 4.5-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E073D315-3C54-44BF-A1B2-B5583AEA618C}\setup.exe" -l0x9
Open Adder-->"C:\Program Files\Open Adder\unins000.exe"
PerfectDisk-->MsiExec.exe /I{212F5777-1190-4DEF-8E4D-6B2F313B45E7}
Presto! Forms 3.50.02-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B79920F8-AB6E-45B2-B257-900BBA969FF7}\setup.exe" -l0x9 -anything
Presto! PageManager 7.12.10-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{72CD4C5F-AB0B-4814-8780-9A4F26A2086B}\setup.exe" -l0x9 -anything
PS2-->C:\WINDOWS\system32\ps2.exe uninstall
QuickTime-->MsiExec.exe /I{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}
RealPlayer-->C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
Realtek High Definition Audio Driver-->RtlUpd.exe -r
Remove IntelliMover Demo-->c:\hp\bin\cloaker.exe c:\hp\bin\commands.exe /c "C:\Program Files\IntelliMoverDemo\clean.bat"
RPS Ad Blocker-->MsiExec.exe /I{D7C43475-D2E5-44BB-A9F6-812EFFA1904F}
RPS AntiFraud-->MsiExec.exe /I{201CF88D-7683-4C66-BCE8-A99F90D11ED1}
RPS AntiSpyware-->MsiExec.exe /I{BF2CB640-523C-4139-B8D5-A9D4076113BB}
RPS AntiVirus-->MsiExec.exe /I{F4A0CA14-4184-4EFE-9172-88073846EF65}
RPS App Detector-->MsiExec.exe /I{B6922B02-D537-4F20-A8FB-80B81A916112}
RPS Backup-->MsiExec.exe /I{76C8D41A-F8C7-4E9F-A289-07B17D5A38DC}
RPS Burn-->MsiExec.exe /I{829B2A63-5390-46BE-9AB3-64EBCB6AD1D5}
RPS CRT-->MsiExec.exe /I{011A2240-08DF-45BB-AA4E-1A78637CCF80}
RPS Diagnostic Utility-->MsiExec.exe /I{06163887-E6C1-4EC0-A125-EBC20F752910}
RPS Firewall-->MsiExec.exe /I{CD01263B-E427-476C-A9FB-DCC68B2D5BF1}
RPS Ksdk-->MsiExec.exe /I{6106A807-33EE-4FD9-83BC-9C384B5B92C7}
RPS ParentalControl-->MsiExec.exe /I{08587E99-5B56-40FB-9CFB-439DAB398B75}
RPS Performance Tool-->MsiExec.exe /I{8B183051-F65D-4F6A-8B36-F0E3D90D1AA2}
RPS PopupBlocker-->MsiExec.exe /I{D7D795A4-E115-45AC-A4A0-998031DCCA7C}
RPS Privacy Manager-->MsiExec.exe /I{E88FB872-191F-4195-AE0D-0EE7B64EBC40}
RPS RpsCore-->MsiExec.exe /I{731AD74C-93CE-4F1B-8DA7-23BB70B28766}
RPS Security Cleanup-->MsiExec.exe /I{B5DCEB60-E958-470D-BE28-86FA6EAB25CA}
RPS Zip-->MsiExec.exe /I{EFC05AD4-26C2-4E58-A0AD-3A2F2A891FE9}
Security Update for Step By Step Interactive Training (KB923723)-->"C:\WINDOWS\$NtUninstallKB923723$\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB938127)-->"C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB942615)-->"C:\WINDOWS\ie7updates\KB942615-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB944533)-->"C:\WINDOWS\ie7updates\KB944533-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB956390)-->"C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB958215)-->"C:\WINDOWS\ie7updates\KB958215-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB960714)-->"C:\WINDOWS\ie7updates\KB960714-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB961260)-->"C:\WINDOWS\ie7updates\KB961260-IE7\spuninst\spuninst.exe"
Security Update for Windows Media Player (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Security Update for Windows Media Player 10 (KB911565)-->"C:\WINDOWS\$NtUninstallKB911565$\spuninst\spuninst.exe"
Security Update for Windows Media Player 10 (KB917734)-->"C:\WINDOWS\$NtUninstallKB917734_WMP10$\spuninst\spuninst.exe"
Security Update for Windows Media Player 10 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP10$\spuninst\spuninst.exe"
Security Update for Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Security Update for Windows XP (KB938464-v2)-->"C:\WINDOWS\$NtUninstallKB938464-v2$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Security Update for Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Security Update for Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Security Update for Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
Security Update for Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
Security Update for Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
Security Update for Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
Security Update for Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"
Security Update for Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958690)-->"C:\WINDOWS\$NtUninstallKB958690$\spuninst\spuninst.exe"
Security Update for Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"
Security Update for Windows XP (KB960715)-->"C:\WINDOWS\$NtUninstallKB960715$\spuninst\spuninst.exe"
Sonic Express Labeler-->MsiExec.exe /X{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}
Sonic MyDVD Plus-->MsiExec.exe /X{21657574-BD54-48A2-9450-EB03B2C7FC29}
Sonic RecordNow Audio-->MsiExec.exe /X{AB708C9B-97C8-4AC9-899B-DBF226AC9382}
Sonic RecordNow Copy-->MsiExec.exe /X{B12665F4-4E93-4AB4-B7FC-37053B524629}
Sonic RecordNow Data-->MsiExec.exe /X{075473F5-846A-448B-BCB3-104AA1760205}
Sonic Update Manager-->MsiExec.exe /X{30465B6C-B53F-49A1-9EBA-A3F187AD502E}
Spy Sweeper Core-->MsiExec.exe /I{3F5B6210-0903-4DC6-8034-8F488AA3A782}
Switch-->C:\Program Files\NCH Swift Sound\Switch\uninst.exe
Update for Windows XP (KB951072-v2)-->"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
Update for Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Update for Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
Update for Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"
Updates from HP (remove only)-->C:\WINDOWS\HPCPCUninstall-9972322\HPBWSetup.exe -appid 9972322 -uninstall
Verizon Internet Security Suite-->"C:\Program Files\InstallShield Installation Information\{6D01DFC8-AEA9-4F8F-B7C7-205E75F758D5}\setup.exe" -runfromtemp -l0x0009 -removeonly
Verizon Servicepoint 1.5.23-->"C:\Program Files\Verizon\VSP\unins000.exe"
Windows Installer Clean Up-->MsiExec.exe /X{121634B0-2F4B-11D3-ADA3-00C04F52DD52}
Windows Media Connect-->"C:\WINDOWS\$NtUninstallWMCSetup$\spuninst\spuninst.exe"
Windows Media Format Runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Player 10-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"

======Security center information======

AV: Verizon Internet Security Suite Anti-Virus
FW: Verizon Internet Security Suite Firewall

System event log

Computer Name: YOUR-D0F670B45A
Event Code: 7035
Message: The SAVRT service was successfully sent a start control.

Record Number: 455936
Source Name: Service Control Manager
Time Written: 20090203174843.000000-300
Event Type: information
User: NT AUTHORITY\SYSTEM

Computer Name: YOUR-D0F670B45A
Event Code: 7035
Message: The Remote Access Connection Manager service was successfully sent a start control.

Record Number: 455935
Source Name: Service Control Manager
Time Written: 20090203174843.000000-300
Event Type: information
User: NT AUTHORITY\SYSTEM

Computer Name: YOUR-D0F670B45A
Event Code: 7036
Message: The Telephony service entered the running state.

Record Number: 455934
Source Name: Service Control Manager
Time Written: 20090203174843.000000-300
Event Type: information
User:

Computer Name: YOUR-D0F670B45A
Event Code: 7036
Message: The Wireless Zero Configuration service entered the stopped state.

Record Number: 455933
Source Name: Service Control Manager
Time Written: 20090203174843.000000-300
Event Type: information
User:

Computer Name: YOUR-D0F670B45A
Event Code: 7026
Message: The following boot-start or system-start driver(s) failed to load:
ftsata2

Record Number: 455932
Source Name: Service Control Manager
Time Written: 20090203174843.000000-300
Event Type: error
User:

Application event log

Computer Name: YOUR-D0F670B45A
Event Code: 11729
Message: Product: PhotoGallery -- Configuration failed.

Record Number: 5446
Source Name: MsiInstaller
Time Written: 20080128172452.000000-300
Event Type: information
User: YOUR-D0F670B45A\HP_Owner

Computer Name: YOUR-D0F670B45A
Event Code: 1001
Message: Detection of product '{869C3062-4745-4949-B6C9-98AF24D89030}', feature 'CalendarPlugin' failed during request for component '{851E048E-FA2C-4017-9CDE-CC427D39E095}'

Record Number: 5445
Source Name: MsiInstaller
Time Written: 20080128172449.000000-300
Event Type: warning
User: YOUR-D0F670B45A\HP_Owner

Computer Name: YOUR-D0F670B45A
Event Code: 1004
Message: Detection of product '{869C3062-4745-4949-B6C9-98AF24D89030}', feature 'CalendarPlugin', component '{F7FB9315-0E31-4915-9BBD-59C29D295F12}' failed. The resource 'c:\Program Files\Common Files\HP\Memories Disc\2.0\mpv\etc\hpodmpv_md\' does not exist.

Record Number: 5444
Source Name: MsiInstaller
Time Written: 20080128172449.000000-300
Event Type: warning
User: YOUR-D0F670B45A\HP_Owner

Computer Name: YOUR-D0F670B45A
Event Code: 11729
Message: Product: PhotoGallery -- Configuration failed.

Record Number: 5443
Source Name: MsiInstaller
Time Written: 20080128172254.000000-300
Event Type: information
User: YOUR-D0F670B45A\HP_Owner

Computer Name: YOUR-D0F670B45A
Event Code: 1001
Message: Detection of product '{869C3062-4745-4949-B6C9-98AF24D89030}', feature 'CalendarPlugin' failed during request for component '{851E048E-FA2C-4017-9CDE-CC427D39E095}'

Record Number: 5442
Source Name: MsiInstaller
Time Written: 20080128172253.000000-300
Event Type: warning
User: YOUR-D0F670B45A\HP_Owner

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=C:\Program Files\Corel\Corel SVG Viewer\;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;c:\Python22;C:\Program Files\QuickTime\QTSystem\
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 13 Stepping 8, GenuineIntel
"PROCESSOR_REVISION"=0d08
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"SonicCentral"=c:\Program Files\Common Files\Sonic Shared\Sonic Central\
"CLASSPATH"=.;C:\Program Files\Java\jre6\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files\Java\jre6\lib\ext\QTJava.zip

-----------------EOF-----------------

**chemist** · 03-14-2009, 01:07 AM

Hello ddrum1031.

Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate.

Please stay with me until given the 'all clear' even if symptoms seemingly abate.

Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by a helper.

------------------------------------------------------

One or more of the identified infections is a backdoor trojan.

This type of infection allows hackers to remotely control your computer, log keystrokes, steal critical system information, and download and execute files without your knowledge.

If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

Please read this: How Do I Handle Possible Identify Theft, Internet Fraud, and CC Fraud?

------------------------------------------------------

Please visit this webpage for download links, and instructions for running ComboFix:

http://www.bleepingcomputer.com/comb...o-use-combofix

* Ensure you have disabled all antivirus and antimalware programs so they do not interfere with the running of ComboFix.

Get help here

Please post the C:\ComboFix.txt in your next reply for further review.

------------------------------------------------------

ddrum1031 · 03-14-2009, 09:30 AM

ok i disabled my antivirus/firewall and downloaded combofix to my desktop but when i click on it nothing happens. ive tried it a few times

**chemist** · 03-14-2009, 01:08 PM

Hello ddrum1031. Delete ComboFix.exe from your desktop.

Download ComboFix from any of the links below. You must rename it before saving it. Save it to your Desktop.

If you are using Firefox, go to Tools > Options > Main and select 'Always ask me where to save files' and click OK.

Link 1
Link 2
Link 3

* IMPORTANT !!! Save Combo-Fix.exe to your Desktop

------------------------------------------------------

Now follow the rest of the instructions as before for running Combo-Fix.exe and post the log, ComboFix.txt in your next reply.

------------------------------------------------------

ddrum1031 · 03-14-2009, 07:20 PM

thank you again here is the log

ComboFix 09-03-13.02 - HP_Owner 2009-03-14 21:10:03.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.503.140 [GMT -4:00]
Running from: c:\documents and settings\HP_Owner\Desktop\combo-fix.exe
AV: Verizon Internet Security Suite Anti-Virus *On-access scanning enabled* (Updated)
FW: Verizon Internet Security Suite Firewall *enabled*
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\Internet Explorer\DLLs\c.cgm
c:\windows\IE4 Error Log.txt
c:\windows\system32\drivers\TDSSmxst.sys
c:\windows\system32\TDSSarxx.dll
c:\windows\system32\TDSSdxcp.dll
c:\windows\system32\TDSSkkai.log
c:\windows\system32\TDSSmtve.dat
c:\windows\system32\TDSSnmxh.log
c:\windows\system32\TDSSnvuo.dll
c:\windows\system32\TDSSoitt.dll
c:\windows\system32\TDSSsahc.dll
c:\windows\system32\TDSSvoqm.dll
c:\windows\system32\TDSSxhyf.log
D:\Autorun.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_TDSSserv.sys
-------\Legacy_TDSSserv.sys

((((((((((((((((((((((((( Files Created from 2009-02-15 to 2009-03-15 )))))))))))))))))))))))))))))))
.

2009-03-13 21:42 . 2009-03-13 21:44 <DIR> d-------- C:\rsit
2009-03-13 18:48 . 2009-03-13 18:48 <DIR> d-------- c:\program files\Microsoft
2009-03-13 18:40 . 2009-03-13 18:39 73,728 --a------ c:\windows\system32\javacpl.cpl
2009-03-08 02:02 . 2009-03-08 02:17 540 --a------ c:\windows\system32\PDBootState
2009-03-07 20:35 . 2008-06-26 15:23 112,144 --a------ c:\windows\system32\drivers\kl1.sys
2009-03-07 20:35 . 2008-04-24 15:02 53,192 --a------ c:\windows\system32\drivers\rp_skt32.sys
2009-03-07 20:34 . 2009-03-07 20:34 <DIR> d-------- c:\program files\Raxco
2009-03-07 20:34 . 2009-03-07 20:34 <DIR> d-------- c:\documents and settings\All Users\Application Data\Raxco
2009-03-07 20:34 . 2007-04-19 12:36 48,384 --a------ c:\windows\system32\drivers\rp_pkt32.sys
2009-03-07 20:06 . 2009-03-14 21:08 1,741,856 --ahs---- c:\windows\system32\drivers\fidbox.dat
2009-03-07 20:06 . 2009-03-14 21:14 23,840 --ahs---- c:\windows\system32\drivers\fidbox2.dat
2009-03-07 20:06 . 2009-03-14 21:08 5,996 --ahs---- c:\windows\system32\drivers\fidbox.idx
2009-03-07 20:06 . 2009-03-14 21:08 3,092 --ahs---- c:\windows\system32\drivers\fidbox2.idx
2009-03-07 19:17 . 2009-03-07 20:33 <DIR> d-------- c:\program files\Verizon
2009-03-07 19:17 . 2009-03-07 19:17 <DIR> d-------- c:\documents and settings\HP_Owner\Application Data\Verizon
2009-03-07 19:17 . 2009-03-07 20:33 <DIR> d-------- c:\documents and settings\All Users\Application Data\Verizon
2009-03-07 18:22 . 2009-03-07 18:38 164 --a------ c:\windows\install.dat
2009-03-07 17:19 . 2009-03-07 17:19 <DIR> d-------- c:\program files\iPod
2009-03-07 17:18 . 2009-03-07 17:19 <DIR> d-------- c:\program files\iTunes
2009-03-07 17:18 . 2009-03-07 17:19 <DIR> d-------- c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2009-03-07 17:15 . 2009-03-07 17:16 <DIR> d-------- c:\program files\QuickTime
2009-03-07 17:03 . 2009-03-07 17:03 <DIR> d-------- c:\program files\Bonjour
2009-03-04 14:15 . 2009-03-07 19:06 <DIR> d-------- c:\program files\MakeNewDirectory
2009-03-04 12:28 . 2009-03-04 12:28 <DIR> d-------- c:\windows\system32\scripting
2009-03-04 12:28 . 2009-03-04 12:28 <DIR> d-------- c:\windows\system32\en
2009-03-04 12:28 . 2009-03-04 12:28 <DIR> d-------- c:\windows\system32\bits
2009-03-04 12:28 . 2009-03-04 12:28 <DIR> d-------- c:\windows\l2schemas
2009-03-04 12:26 . 2009-03-04 12:29 <DIR> d-------- c:\windows\ServicePackFiles
2009-03-04 12:18 . 2009-03-04 12:18 <DIR> d-------- c:\windows\EHome
2009-03-04 01:04 . 2009-03-07 17:57 <DIR> d-------- c:\program files\Symantec
2009-03-04 00:27 . 2009-03-04 00:27 <DIR> d-------- c:\documents and settings\HP_Owner\Application Data\Malwarebytes
2009-03-04 00:20 . 2009-03-04 00:20 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-14 01:43 --------- d-----w c:\program files\Trend Micro
2009-03-13 22:39 410,984 ----a-w c:\windows\system32\deploytk.dll
2009-03-08 04:45 79,872 ----a-w c:\windows\system32\drivers\1izxa6k3nhm.sys
2009-03-08 00:32 --------- d--h--w c:\program files\InstallShield Installation Information
2009-03-07 22:00 --------- d-----w c:\program files\Common Files\Symantec Shared
2009-03-07 21:58 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec
2009-03-07 21:14 --------- d-----w c:\program files\Common Files\Apple
2009-03-07 21:14 --------- d-----w c:\documents and settings\HP_Owner\Application Data\LimeWire
2009-03-04 16:33 45,056 ----a-w c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\uninstallUI\eHelpSetup.exe
2009-03-04 16:32 61,440 ----a-w c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\modemutil.dll
2009-03-04 16:32 44,032 ----a-w c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\Scripts\devcon.exe
2009-03-04 16:32 40,960 ----a-w c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\ScDmi.dll
2009-03-04 16:32 341,048 ----a-w c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\HPBasicDetection3.dll
2009-03-04 16:32 32,768 ----a-w c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\uploadHSC.dll
2009-03-04 16:32 32,768 ----a-w c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\Scom.dll
2009-03-04 16:32 217,088 ----a-w c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\WebHelper.dll
2009-03-04 16:32 163,840 ----a-w c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\modemcheck.dll
2009-03-04 05:45 --------- d-----w c:\documents and settings\HP_Owner\Application Data\Viewpoint
2009-02-14 17:08 1,553,784 ----a-w c:\windows\WRSetup.dll
2009-02-13 22:09 29,808 ----a-w c:\windows\system32\drivers\ssfs0bbc.sys
2009-02-13 22:09 23,152 ----a-w c:\windows\system32\drivers\sshrmd.sys
2009-02-13 22:09 176,752 ----a-w c:\windows\system32\drivers\ssidrv.sys
2009-02-09 11:13 1,846,784 ----a-w c:\windows\system32\win32k.sys
2009-02-09 11:13 1,846,784 ------w c:\windows\system32\dllcache\win32k.sys
2009-01-17 02:35 3,594,752 ------w c:\windows\system32\dllcache\mshtml.dll
2009-01-02 23:28 164 ----a-w C:\install.dat
2008-12-22 23:48 40,432 ----a-w c:\documents and settings\HP_Owner\5c4de.zip
2008-12-19 09:10 70,656 ------w c:\windows\system32\dllcache\ie4uinit.exe
2008-12-19 09:10 13,824 ------w c:\windows\system32\dllcache\ieudinit.exe
2008-12-19 05:25 634,024 ------w c:\windows\system32\dllcache\iexplore.exe
2008-12-19 05:23 161,792 ------w c:\windows\system32\dllcache\ieakui.dll
2008-02-08 02:19 88 --sh--r c:\documents and settings\All Users\Application Data\B8711D67DE.sys
2008-02-08 02:19 2,828 --sha-w c:\documents and settings\All Users\Application Data\KGyGaAvL.sys
2008-01-16 02:14 1,542 ----a-w c:\documents and settings\HP_Owner\Application Data\wklnhst.dat
2006-06-16 21:18 22 --sha-w c:\windows\SMINST\HPCD.sys
.

------- Sigcheck -------

2004-08-04 00:00 14336 8f078ae4ed187aaabc0a305146de6716 c:\windows\$NtServicePackUninstall$\svchost.exe
2008-04-13 20:12 14336 27c6d03bcdb8cfeb96b716f3d8be3e18 c:\windows\ServicePackFiles\i386\svchost.exe
2008-04-13 20:12 14336 27c6d03bcdb8cfeb96b716f3d8be3e18 c:\windows\system32\svchost.exe

2005-03-02 14:19 577024 1800f293bccc8ede8a70e12b88d80036 c:\windows\$hf_mig$\KB890859\SP2QFE\user32.dll
2007-03-08 11:48 578048 7aa4f6c00405dfc4b70ed4214e7d687b c:\windows\$hf_mig$\KB925902\SP2QFE\user32.dll
2009-03-08 17:13 577536 b409909f6e2e8a7067076ed748abf1e7 c:\windows\$NtServicePackUninstall$\user32.dll
2005-03-02 14:09 577024 de2db164bbb35db061af0997e4499054 c:\windows\$NtUninstallKB925902$\user32.dll
2008-04-13 20:12 578560 b26b135ff1b9f60c9388b4a7d16f600b c:\windows\ServicePackFiles\i386\user32.dll
2008-04-13 20:12 578560 b26b135ff1b9f60c9388b4a7d16f600b c:\windows\system32\user32.dll

2004-08-04 00:00 82944 2ed0b7f12a60f90092081c50fa0ec2b2 c:\windows\$NtServicePackUninstall$\ws2_32.dll
2008-04-13 20:12 82432 2ccc474eb85ceaa3e1fa1726580a3e5a c:\windows\ServicePackFiles\i386\ws2_32.dll
2008-04-13 20:12 82432 2ccc474eb85ceaa3e1fa1726580a3e5a c:\windows\system32\ws2_32.dll

2004-08-04 00:00 502272 01c3346c241652f43aed8e2149881bfe c:\windows\$NtServicePackUninstall$\winlogon.exe
2008-04-13 20:12 507904 ed0ef0a136dec83df69f04118870003e c:\windows\ServicePackFiles\i386\winlogon.exe
2008-04-13 20:12 507904 ed0ef0a136dec83df69f04118870003e c:\windows\system32\winlogon.exe

2004-08-04 00:00 182912 558635d3af1c7546d26067d5d9b6959e c:\windows\$NtServicePackUninstall$\ndis.sys
2008-04-13 15:20 182656 1df7f42665c94b825322fae71721130d c:\windows\ServicePackFiles\i386\ndis.sys
2008-04-13 15:20 182656 1df7f42665c94b825322fae71721130d c:\windows\system32\drivers\ndis.sys

2004-08-04 00:00 29056 4448006b6bc60e6c027932cfc38d6855 c:\windows\$NtServicePackUninstall$\ip6fw.sys
2008-04-13 14:53 36608 3bb22519a194418d5fec05d800a19ad0 c:\windows\ServicePackFiles\i386\ip6fw.sys
2008-04-13 14:53 36608 3bb22519a194418d5fec05d800a19ad0 c:\windows\system32\drivers\ip6fw.sys

2008-04-13 20:12 1033728 12896823fb95bfb3dc9b46bcaedc9923 c:\windows\explorer.exe
2007-06-13 07:26 1033216 7712df0cdde3a5ac89843e61cd5b3658 c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
2007-06-13 06:23 1033216 97bd6515465659ff8f3b7be375b2ea87 c:\windows\$NtServicePackUninstall$\explorer.exe
2004-08-04 00:00 1032192 a0732187050030ae399b241436565e64 c:\windows\$NtUninstallKB938828$\explorer.exe
2008-04-13 20:12 1033728 12896823fb95bfb3dc9b46bcaedc9923 c:\windows\ServicePackFiles\i386\explorer.exe

2004-08-04 00:00 108032 c6ce6eec82f187615d1002bb3bb50ed4 c:\windows\$NtServicePackUninstall$\services.exe
2008-04-13 20:12 108544 0e776ed5f7cc9f94299e70461b7b8185 c:\windows\ServicePackFiles\i386\services.exe
2008-04-13 20:12 108544 0e776ed5f7cc9f94299e70461b7b8185 c:\windows\system32\services.exe

2004-08-04 00:00 13312 84885f9b82f4d55c6146ebf6065d75d2 c:\windows\$NtServicePackUninstall$\lsass.exe
2008-04-13 20:12 13312 bf2466b3e18e970d8a976fb95fc1ca85 c:\windows\ServicePackFiles\i386\lsass.exe
2008-04-13 20:12 13312 bf2466b3e18e970d8a976fb95fc1ca85 c:\windows\system32\lsass.exe

2004-08-04 00:00 15360 24232996a38c0b0cf151c2140ae29fc8 c:\windows\$NtServicePackUninstall$\ctfmon.exe
2008-04-13 20:12 15360 5f1d5f88303d4a4dbc8e5f97ba967cc3 c:\windows\ServicePackFiles\i386\ctfmon.exe
2008-04-13 20:12 15360 5f1d5f88303d4a4dbc8e5f97ba967cc3 c:\windows\system32\ctfmon.exe

2005-06-10 20:17 57856 ad3d9d191aea7b5445fe1d82ffbb4788 c:\windows\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
2005-06-10 19:53 57856 da81ec57acd4cdc3d4c51cf3d409af9f c:\windows\$NtServicePackUninstall$\spoolsv.exe
2008-04-13 20:12 57856 d8e14a61acc1d4a6cd0d38aebac7fa3b c:\windows\ServicePackFiles\i386\spoolsv.exe
2008-04-13 20:12 57856 d8e14a61acc1d4a6cd0d38aebac7fa3b c:\windows\system32\spoolsv.exe

2004-08-04 00:00 24576 39b1ffb03c2296323832acbae50d2aff c:\windows\$NtServicePackUninstall$\userinit.exe
2008-04-13 20:12 26112 a93aee1928a9d7ce3e16d24ec7380f89 c:\windows\ServicePackFiles\i386\userinit.exe
2008-04-13 20:12 26112 a93aee1928a9d7ce3e16d24ec7380f89 c:\windows\system32\userinit.exe

2004-08-04 00:00 295424 b60c877d16d9c880b952fda04adf16e6 c:\windows\$NtServicePackUninstall$\termsrv.dll
2008-04-13 20:12 295424 ff3477c03be7201c294c35f684b3479f c:\windows\ServicePackFiles\i386\termsrv.dll
2008-04-13 20:12 295424 ff3477c03be7201c294c35f684b3479f c:\windows\system32\termsrv.dll

2006-07-05 06:57 985088 0fdd84928a5dde2510761b7ec76ccec9 c:\windows\$hf_mig$\KB917422\SP2QFE\kernel32.dll
2007-04-16 12:07 986112 09f7cb3687f86edaa4ca081f7ab66c03 c:\windows\$hf_mig$\KB935839\SP2QFE\kernel32.dll
2007-04-16 11:52 984576 a01f9ca902a88f7ced06884174d6419d c:\windows\$NtServicePackUninstall$\kernel32.dll
2004-08-04 00:00 983552 888190e31455fad793312f8d087146eb c:\windows\$NtUninstallKB917422$\kernel32.dll
2006-07-05 06:55 984064 d8db5397de07577c1cb50ba6d23b3ad4 c:\windows\$NtUninstallKB935839$\kernel32.dll
2008-04-13 20:11 989696 c24b983d211c34da8fcc1ac38477971d c:\windows\ServicePackFiles\i386\kernel32.dll
2008-04-13 20:11 989696 c24b983d211c34da8fcc1ac38477971d c:\windows\system32\kernel32.dll

2004-08-04 00:00 17408 1b5f6923abb450692e9fe0672c897aed c:\windows\$NtServicePackUninstall$\powrprof.dll
2008-04-13 20:12 17408 50a166237a0fa771261275a405646cc0 c:\windows\ServicePackFiles\i386\powrprof.dll
2008-04-13 20:12 17408 50a166237a0fa771261275a405646cc0 c:\windows\system32\powrprof.dll

2004-08-04 00:00 110080 87ca7ce6469577f059297b9d6556d66d c:\windows\$NtServicePackUninstall$\imm32.dll
2008-04-13 20:11 110080 0da85218e92526972a821587e6a8bf8f c:\windows\ServicePackFiles\i386\imm32.dll
2008-04-13 20:11 110080 0da85218e92526972a821587e6a8bf8f c:\windows\system32\imm32.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2}]
2008-12-14 17:23 66912 --a------ c:\program files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232]
"Aim6"="c:\program files\AIM6\aim6.exe" [2008-10-31 50480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WrtMon.exe"="c:\windows\system32\spool\drivers\w32x86\3\WrtMon.exe" [2006-09-20 20480]
"HPHUPD08"="c:\program files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe" [2005-06-01 49152]
"HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2005-11-09 249856]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2005-09-24 49152]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2006-03-06 180269]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-01-06 290088]
"VerizonServicepoint.exe"="c:\program files\Verizon\VSP\VerizonServicepoint.exe" [2008-10-20 2303216]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-13 148888]
"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-02-03 233304]
"SoundMan"="SOUNDMAN.EXE" [2005-09-21 c:\windows\SOUNDMAN.EXE]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-09-24 282624]
Updates From HP.lnk - c:\program files\Updates from HP\9972322\Program\Updates from HP.exe [2006-03-06 36903]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ PDBoot.exe\0autocheck autochk *

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\1izxa6k3nhm.sys]
@="\??\c:\windows\system32\drivers\1izxa6k3nhm.sys"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\idnyml1kmta.sys]
@="\??\c:\windows\system32\drivers\idnyml1kmta.sys"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
--a------ 2005-06-07 00:46 57344 c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
--a------ 2005-11-03 11:22 77824 c:\windows\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]
--a------ 2005-11-03 11:26 118784 c:\windows\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2009-01-05 17:18 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Recguard]
--a------ 2005-07-22 19:14 237568 c:\windows\SMINST\Recguard.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2006-03-06 21:02 180269 c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\High Definition Audio Property Page Shortcut]
--a------ 2005-01-07 21:07 61952 c:\windows\system32\HdAShCut.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\Updates from HP\\9972322\\Program\\Updates from HP.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Common Files\\AOL\\1158579814\\ee\\aolsoftware.exe"=
"c:\\Program Files\\Common Files\\AOL\\1158579814\\ee\\aim6.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"135:TCP"= 135:TCP:TCP Port 135
"5000:TCP"= 5000:TCP:TCP Port 5000
"5001:TCP"= 5001:TCP:TCP Port 5001
"5002:TCP"= 5002:TCP:TCP Port 5002
"5003:TCP"= 5003:TCP:TCP Port 5003
"5004:TCP"= 5004:TCP:TCP Port 5004
"5005:TCP"= 5005:TCP:TCP Port 5005
"5006:TCP"= 5006:TCP:TCP Port 5006
"5007:TCP"= 5007:TCP:TCP Port 5007
"5008:TCP"= 5008:TCP:TCP Port 5008
"5009:TCP"= 5009:TCP:TCP Port 5009
"5010:TCP"= 5010:TCP:TCP Port 5010
"5011:TCP"= 5011:TCP:TCP Port 5011
"5012:TCP"= 5012:TCP:TCP Port 5012
"5013:TCP"= 5013:TCP:TCP Port 5013
"5014:TCP"= 5014:TCP:TCP Port 5014
"5015:TCP"= 5015:TCP:TCP Port 5015
"5016:TCP"= 5016:TCP:TCP Port 5016
"5017:TCP"= 5017:TCP:TCP Port 5017
"5018:TCP"= 5018:TCP:TCP Port 5018
"5019:TCP"= 5019:TCP:TCP Port 5019
"5020:TCP"= 5020:TCP:TCP Port 5020

R0 ssfs0bbc;ssfs0bbc;c:\windows\system32\drivers\ssfs0bbc.sys [2009-02-13 29808]
R2 SeaPort;SeaPort;c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2009-01-14 226656]
S2 1izxa6k3nhm.sys;1izxa6k3nhm.sys;c:\windows\system32\drivers\1izxa6k3nhm.sys [2004-08-04 79872]
S2 idnyml1kmta.sys;idnyml1kmta.sys;\??\c:\windows\system32\drivers\idnyml1kmta.sys --> c:\windows\system32\drivers\idnyml1kmta.sys [?]
S2 Viewpoint Manager Service;Viewpoint Manager Service;"c:\program files\Viewpoint\Common\ViewpointService.exe" --> c:\program files\Viewpoint\Common\ViewpointService.exe [?]
S3 A5AGU;D-Link USB Wireless Network Adapter Service;c:\windows\system32\drivers\A5AGU.sys [2006-05-08 347648]
S3 jfdcd;jfdcd;\??\c:\docume~1\HP_Owner\LOCALS~1\Temp\jfdcd.sys --> c:\docume~1\HP_Owner\LOCALS~1\Temp\jfdcd.sys [?]
S3 Radialpoint Security Services;Verizon Internet Security Suite;c:\program files\Verizon\Verizon Internet Security Suite\RpsSecurityAwareR.exe [2008-10-24 96496]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - GTNDIS5

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480
.
Contents of the 'Scheduled Tasks' folder

2008-12-10 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 13:34]

2009-03-15 c:\windows\Tasks\Symantec NetDetect.job
- c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2002-08-07 10:04]
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)
MSConfigStartUp-SeekmoOE - c:\program files\Seekmo\bin\10.0.406.0\OEAddOn.exe
MSConfigStartUp-SeekmoSA - c:\program files\Seekmo\bin\10.0.406.0\SeekmoSA.exe

.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = *.local
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\HP_Owner\Start Menu\Programs\IMVU\Run IMVU.lnk
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-14 21:13:58
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1340)
c:\windows\system32\GTGina.dll
.
Completion time: 2009-03-14 21:15:58
ComboFix-quarantined-files.txt 2009-03-15 01:15:20

Pre-Run: 124,438,679,552 bytes free
Post-Run: 124,984,557,568 bytes free

308 --- E O F --- 2009-03-12 04:07:23

**chemist** · 03-14-2009, 08:10 PM

Hello ddrum1031. Good job!

Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions.

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding.
Ensure that there aren't any opened browsers when you are carrying out the procedures below.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

------------------------------------------------------

Please uninstall the following via the Add or Remove Programs section of your Control Panel if they still exist:

LiveReg (Symantec Corporation)
LiveUpdate 1.80 (Symantec Corporation)

------------------------------------------------------

Please uninstall the following via Start->(or My Computer)->Control Panel->Add or Remove Programs if it still exists:

Ask Toolbar<<Please read here

Also delete the following Folder if it still exists:

C:\Program Files\AskSBar

------------------------------------------------------

I see you have P2P software ( LimeWire ) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares.

References for the risk of these programs are here, here, and here.

I would strongly recommend that you uninstall it, however that choice is up to you. If you choose to remove this program, you can do so via Control Panel >> Add or Remove Programs.

------------------------------------------------------

Close any open browsers.

Disable your antivirus and antispyware applications, usually via a right-click on the System Tray icon. They may otherwise interfere with ComboFix.

Open Notepad and copy/paste all the text in the codebox below into Notepad:

Code:

http://www.techsupportforum.com/security-center/virus-trojan-spyware-help/355831-annoying-virus-help.html#post2022661

Collect::
c:\windows\system32\drivers\1izxa6k3nhm.sys

Registry::
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\1izxa6k3nhm.sys]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\idnyml1kmta.sys]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000000

Driver::
1izxa6k3nhm.sys
idnyml1kmta.sys
Viewpoint Manager Service
jfdcd

Save this Notepad file as CFScript.txt to your Desktop and then close the file.

Referring to the picture above, drag CFScript onto ComboFix

If you are prompted to update ComboFix and have an internet connection, please choose Yes

Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.

When finished, it shall produce a log for you. Please post that log, ComboFix.txt in your next reply.

Note:
Do not mouseclick ComboFix's window whilst it's running. That may cause it to stall.

**Note**

When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.

Ensure you are connected to the internet and click OK on the message box.

If you do not get a message box, please do the following:

Go Start > Run and copy/paste the following single-line command into the Run box and click OK:

C:\CF-Submit.htm

Please follow the instructions for submitting the file for analysis and let me know it was submitted.

------------------------------------------------------

ddrum1031 · 03-15-2009, 01:13 AM

ComboFix 09-03-13.02 - HP_Owner 2009-03-15 2:57:21.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.503.72 [GMT -4:00]
Running from: c:\documents and settings\HP_Owner\Desktop\combo-fix.exe
Command switches used :: c:\documents and settings\HP_Owner\Desktop\CFScript.txt
AV: Verizon Internet Security Suite Anti-Virus *On-access scanning disabled* (Updated)
FW: Verizon Internet Security Suite Firewall *disabled*
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\drivers\1izxa6k3nhm.sys

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_1IZXA6K3NHM.SYS
-------\Legacy_IDNYML1KMTA.SYS
-------\Legacy_JFDCD
-------\Legacy_VIEWPOINT_MANAGER_SERVICE
-------\Service_1izxa6k3nhm.sys
-------\Service_idnyml1kmta.sys
-------\Service_jfdcd
-------\Service_Viewpoint Manager Service

((((((((((((((((((((((((( Files Created from 2009-02-15 to 2009-03-15 )))))))))))))))))))))))))))))))
.

2009-03-13 21:42 . 2009-03-13 21:44 <DIR> d-------- C:\rsit
2009-03-13 18:48 . 2009-03-13 18:48 <DIR> d-------- c:\program files\Microsoft
2009-03-13 18:40 . 2009-03-13 18:39 73,728 --a------ c:\windows\system32\javacpl.cpl
2009-03-08 02:02 . 2009-03-15 01:10 540 --a------ c:\windows\system32\PDBootState
2009-03-07 20:35 . 2008-06-26 15:23 112,144 --a------ c:\windows\system32\drivers\kl1.sys
2009-03-07 20:35 . 2008-04-24 15:02 53,192 --a------ c:\windows\system32\drivers\rp_skt32.sys
2009-03-07 20:34 . 2009-03-07 20:34 <DIR> d-------- c:\program files\Raxco
2009-03-07 20:34 . 2009-03-07 20:34 <DIR> d-------- c:\documents and settings\All Users\Application Data\Raxco
2009-03-07 20:34 . 2007-04-19 12:36 48,384 --a------ c:\windows\system32\drivers\rp_pkt32.sys
2009-03-07 20:06 . 2009-03-15 03:03 2,184,480 --ahs---- c:\windows\system32\drivers\fidbox.dat
2009-03-07 20:06 . 2009-03-15 03:03 33,568 --ahs---- c:\windows\system32\drivers\fidbox2.dat
2009-03-07 20:06 . 2009-03-15 03:00 30,212 --ahs---- c:\windows\system32\drivers\fidbox.idx
2009-03-07 20:06 . 2009-03-15 03:00 4,124 --ahs---- c:\windows\system32\drivers\fidbox2.idx
2009-03-07 19:17 . 2009-03-07 20:33 <DIR> d-------- c:\program files\Verizon
2009-03-07 19:17 . 2009-03-07 19:17 <DIR> d-------- c:\documents and settings\HP_Owner\Application Data\Verizon
2009-03-07 19:17 . 2009-03-07 20:33 <DIR> d-------- c:\documents and settings\All Users\Application Data\Verizon
2009-03-07 18:22 . 2009-03-07 18:38 164 --a------ c:\windows\install.dat
2009-03-07 17:19 . 2009-03-07 17:19 <DIR> d-------- c:\program files\iPod
2009-03-07 17:18 . 2009-03-07 17:19 <DIR> d-------- c:\program files\iTunes
2009-03-07 17:18 . 2009-03-07 17:19 <DIR> d-------- c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2009-03-07 17:15 . 2009-03-07 17:16 <DIR> d-------- c:\program files\QuickTime
2009-03-07 17:03 . 2009-03-07 17:03 <DIR> d-------- c:\program files\Bonjour
2009-03-04 14:15 . 2009-03-07 19:06 <DIR> d-------- c:\program files\MakeNewDirectory
2009-03-04 12:28 . 2009-03-04 12:28 <DIR> d-------- c:\windows\system32\scripting
2009-03-04 12:28 . 2009-03-04 12:28 <DIR> d-------- c:\windows\system32\en
2009-03-04 12:28 . 2009-03-04 12:28 <DIR> d-------- c:\windows\system32\bits
2009-03-04 12:28 . 2009-03-04 12:28 <DIR> d-------- c:\windows\l2schemas
2009-03-04 12:26 . 2009-03-04 12:29 <DIR> d-------- c:\windows\ServicePackFiles
2009-03-04 12:18 . 2009-03-04 12:18 <DIR> d-------- c:\windows\EHome
2009-03-04 00:27 . 2009-03-04 00:27 <DIR> d-------- c:\documents and settings\HP_Owner\Application Data\Malwarebytes
2009-03-04 00:20 . 2009-03-04 00:20 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-15 06:54 --------- d-----w c:\program files\Common Files\Symantec Shared
2009-03-14 01:43 --------- d-----w c:\program files\Trend Micro
2009-03-08 00:32 --------- d--h--w c:\program files\InstallShield Installation Information
2009-03-07 21:58 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec
2009-03-07 21:14 --------- d-----w c:\program files\Common Files\Apple
2009-03-07 21:14 --------- d-----w c:\documents and settings\HP_Owner\Application Data\LimeWire
2009-03-04 05:45 --------- d-----w c:\documents and settings\HP_Owner\Application Data\Viewpoint
2009-02-14 17:08 1,553,784 ----a-w c:\windows\WRSetup.dll
2009-02-13 22:09 29,808 ----a-w c:\windows\system32\drivers\ssfs0bbc.sys
2009-02-13 22:09 23,152 ----a-w c:\windows\system32\drivers\sshrmd.sys
2009-02-13 22:09 176,752 ----a-w c:\windows\system32\drivers\ssidrv.sys
2009-01-02 23:28 164 ----a-w C:\install.dat
2008-12-22 23:48 40,432 ----a-w c:\documents and settings\HP_Owner\5c4de.zip
2008-02-08 02:19 88 --sh--r c:\documents and settings\All Users\Application Data\B8711D67DE.sys
2008-02-08 02:19 2,828 --sha-w c:\documents and settings\All Users\Application Data\KGyGaAvL.sys
2008-01-16 02:14 1,542 ----a-w c:\documents and settings\HP_Owner\Application Data\wklnhst.dat
2006-06-16 21:18 22 --sha-w c:\windows\SMINST\HPCD.sys
.

------- Sigcheck -------

2004-08-04 00:00 14336 8f078ae4ed187aaabc0a305146de6716 c:\windows\$NtServicePackUninstall$\svchost.exe
2008-04-13 20:12 14336 27c6d03bcdb8cfeb96b716f3d8be3e18 c:\windows\ServicePackFiles\i386\svchost.exe
2008-04-13 20:12 14336 27c6d03bcdb8cfeb96b716f3d8be3e18 c:\windows\system32\svchost.exe

2005-03-02 14:19 577024 1800f293bccc8ede8a70e12b88d80036 c:\windows\$hf_mig$\KB890859\SP2QFE\user32.dll
2007-03-08 11:48 578048 7aa4f6c00405dfc4b70ed4214e7d687b c:\windows\$hf_mig$\KB925902\SP2QFE\user32.dll
2009-03-08 17:13 577536 b409909f6e2e8a7067076ed748abf1e7 c:\windows\$NtServicePackUninstall$\user32.dll
2005-03-02 14:09 577024 de2db164bbb35db061af0997e4499054 c:\windows\$NtUninstallKB925902$\user32.dll
2008-04-13 20:12 578560 b26b135ff1b9f60c9388b4a7d16f600b c:\windows\ServicePackFiles\i386\user32.dll
2008-04-13 20:12 578560 b26b135ff1b9f60c9388b4a7d16f600b c:\windows\system32\user32.dll

2004-08-04 00:00 82944 2ed0b7f12a60f90092081c50fa0ec2b2 c:\windows\$NtServicePackUninstall$\ws2_32.dll
2008-04-13 20:12 82432 2ccc474eb85ceaa3e1fa1726580a3e5a c:\windows\ServicePackFiles\i386\ws2_32.dll
2008-04-13 20:12 82432 2ccc474eb85ceaa3e1fa1726580a3e5a c:\windows\system32\ws2_32.dll

2004-08-04 00:00 502272 01c3346c241652f43aed8e2149881bfe c:\windows\$NtServicePackUninstall$\winlogon.exe
2008-04-13 20:12 507904 ed0ef0a136dec83df69f04118870003e c:\windows\ServicePackFiles\i386\winlogon.exe
2008-04-13 20:12 507904 ed0ef0a136dec83df69f04118870003e c:\windows\system32\winlogon.exe

2004-08-04 00:00 182912 558635d3af1c7546d26067d5d9b6959e c:\windows\$NtServicePackUninstall$\ndis.sys
2008-04-13 15:20 182656 1df7f42665c94b825322fae71721130d c:\windows\ServicePackFiles\i386\ndis.sys
2008-04-13 15:20 182656 1df7f42665c94b825322fae71721130d c:\windows\system32\drivers\ndis.sys

2004-08-04 00:00 29056 4448006b6bc60e6c027932cfc38d6855 c:\windows\$NtServicePackUninstall$\ip6fw.sys
2008-04-13 14:53 36608 3bb22519a194418d5fec05d800a19ad0 c:\windows\ServicePackFiles\i386\ip6fw.sys
2008-04-13 14:53 36608 3bb22519a194418d5fec05d800a19ad0 c:\windows\system32\drivers\ip6fw.sys

2008-04-13 20:12 1033728 12896823fb95bfb3dc9b46bcaedc9923 c:\windows\explorer.exe
2007-06-13 07:26 1033216 7712df0cdde3a5ac89843e61cd5b3658 c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
2007-06-13 06:23 1033216 97bd6515465659ff8f3b7be375b2ea87 c:\windows\$NtServicePackUninstall$\explorer.exe
2004-08-04 00:00 1032192 a0732187050030ae399b241436565e64 c:\windows\$NtUninstallKB938828$\explorer.exe
2008-04-13 20:12 1033728 12896823fb95bfb3dc9b46bcaedc9923 c:\windows\ServicePackFiles\i386\explorer.exe

2004-08-04 00:00 108032 c6ce6eec82f187615d1002bb3bb50ed4 c:\windows\$NtServicePackUninstall$\services.exe
2008-04-13 20:12 108544 0e776ed5f7cc9f94299e70461b7b8185 c:\windows\ServicePackFiles\i386\services.exe
2008-04-13 20:12 108544 0e776ed5f7cc9f94299e70461b7b8185 c:\windows\system32\services.exe

2004-08-04 00:00 13312 84885f9b82f4d55c6146ebf6065d75d2 c:\windows\$NtServicePackUninstall$\lsass.exe
2008-04-13 20:12 13312 bf2466b3e18e970d8a976fb95fc1ca85 c:\windows\ServicePackFiles\i386\lsass.exe
2008-04-13 20:12 13312 bf2466b3e18e970d8a976fb95fc1ca85 c:\windows\system32\lsass.exe

2004-08-04 00:00 15360 24232996a38c0b0cf151c2140ae29fc8 c:\windows\$NtServicePackUninstall$\ctfmon.exe
2008-04-13 20:12 15360 5f1d5f88303d4a4dbc8e5f97ba967cc3 c:\windows\ServicePackFiles\i386\ctfmon.exe
2008-04-13 20:12 15360 5f1d5f88303d4a4dbc8e5f97ba967cc3 c:\windows\system32\ctfmon.exe

2005-06-10 20:17 57856 ad3d9d191aea7b5445fe1d82ffbb4788 c:\windows\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
2005-06-10 19:53 57856 da81ec57acd4cdc3d4c51cf3d409af9f c:\windows\$NtServicePackUninstall$\spoolsv.exe
2008-04-13 20:12 57856 d8e14a61acc1d4a6cd0d38aebac7fa3b c:\windows\ServicePackFiles\i386\spoolsv.exe
2008-04-13 20:12 57856 d8e14a61acc1d4a6cd0d38aebac7fa3b c:\windows\system32\spoolsv.exe

2004-08-04 00:00 24576 39b1ffb03c2296323832acbae50d2aff c:\windows\$NtServicePackUninstall$\userinit.exe
2008-04-13 20:12 26112 a93aee1928a9d7ce3e16d24ec7380f89 c:\windows\ServicePackFiles\i386\userinit.exe
2008-04-13 20:12 26112 a93aee1928a9d7ce3e16d24ec7380f89 c:\windows\system32\userinit.exe

2004-08-04 00:00 295424 b60c877d16d9c880b952fda04adf16e6 c:\windows\$NtServicePackUninstall$\termsrv.dll
2008-04-13 20:12 295424 ff3477c03be7201c294c35f684b3479f c:\windows\ServicePackFiles\i386\termsrv.dll
2008-04-13 20:12 295424 ff3477c03be7201c294c35f684b3479f c:\windows\system32\termsrv.dll

2006-07-05 06:57 985088 0fdd84928a5dde2510761b7ec76ccec9 c:\windows\$hf_mig$\KB917422\SP2QFE\kernel32.dll
2007-04-16 12:07 986112 09f7cb3687f86edaa4ca081f7ab66c03 c:\windows\$hf_mig$\KB935839\SP2QFE\kernel32.dll
2007-04-16 11:52 984576 a01f9ca902a88f7ced06884174d6419d c:\windows\$NtServicePackUninstall$\kernel32.dll
2004-08-04 00:00 983552 888190e31455fad793312f8d087146eb c:\windows\$NtUninstallKB917422$\kernel32.dll
2006-07-05 06:55 984064 d8db5397de07577c1cb50ba6d23b3ad4 c:\windows\$NtUninstallKB935839$\kernel32.dll
2008-04-13 20:11 989696 c24b983d211c34da8fcc1ac38477971d c:\windows\ServicePackFiles\i386\kernel32.dll
2008-04-13 20:11 989696 c24b983d211c34da8fcc1ac38477971d c:\windows\system32\kernel32.dll

2004-08-04 00:00 17408 1b5f6923abb450692e9fe0672c897aed c:\windows\$NtServicePackUninstall$\powrprof.dll
2008-04-13 20:12 17408 50a166237a0fa771261275a405646cc0 c:\windows\ServicePackFiles\i386\powrprof.dll
2008-04-13 20:12 17408 50a166237a0fa771261275a405646cc0 c:\windows\system32\powrprof.dll

2004-08-04 00:00 110080 87ca7ce6469577f059297b9d6556d66d c:\windows\$NtServicePackUninstall$\imm32.dll
2008-04-13 20:11 110080 0da85218e92526972a821587e6a8bf8f c:\windows\ServicePackFiles\i386\imm32.dll
2008-04-13 20:11 110080 0da85218e92526972a821587e6a8bf8f c:\windows\system32\imm32.dll
.
((((((((((((((((((((((((((((( SnapShot@2009-03-14_21.14.27.93 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-10-21 00:02:28 163,328 ----a-w c:\windows\ERDNT\subs\ERDNT.EXE
+ 2009-03-15 07:03:01 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_454.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232]
"Aim6"="c:\program files\AIM6\aim6.exe" [2008-10-31 50480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WrtMon.exe"="c:\windows\system32\spool\drivers\w32x86\3\WrtMon.exe" [2006-09-20 20480]
"HPHUPD08"="c:\program files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe" [2005-06-01 49152]
"HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2005-11-09 249856]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2005-09-24 49152]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2006-03-06 180269]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-01-06 290088]
"VerizonServicepoint.exe"="c:\program files\Verizon\VSP\VerizonServicepoint.exe" [2008-10-20 2303216]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-13 148888]
"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-02-03 233304]
"SoundMan"="SOUNDMAN.EXE" [2005-09-21 c:\windows\SOUNDMAN.EXE]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-09-24 282624]
Updates From HP.lnk - c:\program files\Updates from HP\9972322\Program\Updates from HP.exe [2006-03-06 36903]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ PDBoot.exe\0autocheck autochk *

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
--a------ 2005-06-07 00:46 57344 c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
--a------ 2005-11-03 11:22 77824 c:\windows\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]
--a------ 2005-11-03 11:26 118784 c:\windows\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2009-01-05 17:18 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Recguard]
--a------ 2005-07-22 19:14 237568 c:\windows\SMINST\Recguard.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2006-03-06 21:02 180269 c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\High Definition Audio Property Page Shortcut]
--a------ 2005-01-07 21:07 61952 c:\windows\system32\HdAShCut.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\Updates from HP\\9972322\\Program\\Updates from HP.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Common Files\\AOL\\1158579814\\ee\\aolsoftware.exe"=
"c:\\Program Files\\Common Files\\AOL\\1158579814\\ee\\aim6.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"135:TCP"= 135:TCP:TCP Port 135
"5000:TCP"= 5000:TCP:TCP Port 5000
"5001:TCP"= 5001:TCP:TCP Port 5001
"5002:TCP"= 5002:TCP:TCP Port 5002
"5003:TCP"= 5003:TCP:TCP Port 5003
"5004:TCP"= 5004:TCP:TCP Port 5004
"5005:TCP"= 5005:TCP:TCP Port 5005
"5006:TCP"= 5006:TCP:TCP Port 5006
"5007:TCP"= 5007:TCP:TCP Port 5007
"5008:TCP"= 5008:TCP:TCP Port 5008
"5009:TCP"= 5009:TCP:TCP Port 5009
"5010:TCP"= 5010:TCP:TCP Port 5010
"5011:TCP"= 5011:TCP:TCP Port 5011
"5012:TCP"= 5012:TCP:TCP Port 5012
"5013:TCP"= 5013:TCP:TCP Port 5013
"5014:TCP"= 5014:TCP:TCP Port 5014
"5015:TCP"= 5015:TCP:TCP Port 5015
"5016:TCP"= 5016:TCP:TCP Port 5016
"5017:TCP"= 5017:TCP:TCP Port 5017
"5018:TCP"= 5018:TCP:TCP Port 5018
"5019:TCP"= 5019:TCP:TCP Port 5019
"5020:TCP"= 5020:TCP:TCP Port 5020

R0 ssfs0bbc;ssfs0bbc;c:\windows\system32\drivers\ssfs0bbc.sys [2009-02-13 29808]
R2 SeaPort;SeaPort;c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2009-01-14 226656]
S3 A5AGU;D-Link USB Wireless Network Adapter Service;c:\windows\system32\drivers\A5AGU.sys [2006-05-08 347648]
S3 Radialpoint Security Services;Verizon Internet Security Suite;c:\program files\Verizon\Verizon Internet Security Suite\RpsSecurityAwareR.exe [2008-10-24 96496]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480
.
Contents of the 'Scheduled Tasks' folder

2008-12-10 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 13:34]
.
- - - - ORPHANS REMOVED - - - -

BHO-{0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - c:\program files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL

.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = *.local
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\HP_Owner\Start Menu\Programs\IMVU\Run IMVU.lnk
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-15 03:04:30
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1268)
c:\windows\system32\GTGina.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Verizon\Verizon Internet Security Suite\Fws.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Raxco\PerfectDisk\PDAgent.exe
c:\windows\system32\HPZipm12.exe
c:\windows\system32\wdfmgr.exe
c:\program files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe
c:\program files\Compact Wireless-G USB Adapter Wireless Network Monitor\WUSB54GC.exe
c:\program files\Raxco\PerfectDisk\PDEngine.exe
c:\windows\system32\spool\drivers\w32x86\3\WrtProc.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-03-15 3:07:46 - machine was rebooted
ComboFix-quarantined-files.txt 2009-03-15 07:07:26

Pre-Run: 128,931,168,256 bytes free
Post-Run: 128,833,277,952 bytes free

291 --- E O F --- 2009-03-12 04:07:23

**chemist** · 03-15-2009, 05:55 AM

Hello again, ddrum1031. Please tell us how your system is behaving.

Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions.

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding.
Ensure that there aren't any opened browsers when you are carrying out the procedures below.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

------------------------------------------------------

It appears you didn't submit the file for analysis.

There should be a file named [4]-Submit_date@time.zip located here:

C:\QooBox\Quarantine\[4]-Submit_date@time.zip

Using the 'Browse' button, please submit it to this site ==> http://www.bleepingcomputer.com/subm....php?channel=4

and include this link in the message:

http://www.techsupportforum.com/security-center/virus-trojan-spyware-help/355831-annoying-virus-help.html#post2022661

Please let me know if you successfully submitted the file. Thanks.

------------------------------------------------------

Please download ATF-Cleaner by Atribune and Save it to your Desktop.

Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

If you use Firefox browser

Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

------------------------------------------------------

Please run this online scan to help look for remnants.

Establish an internet connection & perform an online scan at Kaspersky Online Scanner

Ensure your external and/or USB drives are inserted during the scan.

Click Accept, when prompted to download and install the program files and database of malware definitions.

Click Run at any Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.
Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
Once the scan is complete, it will display if your system has been infected.
It does not provide an option to clean/disinfect. We only require a report from it.
Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
Click View scan report at the bottom.
Click the Save Report As... button.
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply.

**Note**

To optimize scanning time and produce a more sensible report for review:

Close any open programs.
Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.

Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.

------------------------------------------------------

Please post the following in your next reply:

Kaspersky report
report on system behavior

ddrum1031 · 03-15-2009, 01:01 PM

sorry about that after the scan a box did not pop up so i tried finding the file with run it said that file doesnt exist. i just searched for the file [4]-Submit_date@time.zip and it doesnt exist.. my computer is running great, popup free and alot smoother now

here is the kaspersky report:
--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Sunday, March 15, 2009
Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Sunday, March 15, 2009 16:39:14
Records in database: 1908766
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\
F:\
G:\
H:\
I:\

Scan statistics:
Files scanned: 86328
Threat name: 2
Infected objects: 5
Suspicious objects: 0
Duration of the scan: 02:36:46

File name / Threat name / Threats count
C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\__.zip Infected: Backdoor.Win32.TDSS.bkw 1
D:\I386\APPS\APP22639\src\CompaqPresario_Spring06.exe Infected: not-a-virus:AdWare.Win32.WeatherBug.a 2
D:\I386\APPS\APP22639\src\HPPavillion_Spring06.exe Infected: not-a-virus:AdWare.Win32.WeatherBug.a 2

The selected area was scanned.

**chemist** · 03-15-2009, 01:26 PM

Hello again, ddrum1031. QooBox is ComboFix's quarantine folder. It will get deleted when we uninstall ComboFix.

The two Spring06.exe files come installed from the factory on your recovery partition, so we will leave those alone.

------------------------------------------------------

Go to Start > Run and copy/paste the following into the Run box and click OK:

C:\QooBox\ComboFix-quarantined-files.txt

A text file should open. Please post the contents of that file in your next reply.

------------------------------------------------------

ddrum1031 · 03-15-2009, 02:11 PM

oh good yea lets leave that alone .. heres the combofix quarantine

2004-08-04 00:00:00 A------- 79,872 C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\1izxa6k3nhm.sys.vir
2006-06-07 20:47:41 A------- 1,107 C:\Qoobox\Quarantine\C\WINDOWS\IE4 Error Log.txt.vir
2008-12-13 15:58:17 A------- 441 C:\Qoobox\Quarantine\C\WINDOWS\system32\TDSSmtve.dat.vir
2008-12-13 15:58:32 A------- 2,709 C:\Qoobox\Quarantine\C\WINDOWS\system32\TDSSdxcp.dll.vir
2008-12-13 15:58:37 A------- 27,213 C:\Qoobox\Quarantine\C\WINDOWS\system32\TDSSkkai.log.vir
2008-12-13 16:01:56 A------- 14 C:\Qoobox\Quarantine\C\Documents and Settings\All Users\Application Data\Microsoft\Internet Explorer\DLLs\c.cgm.vir
2009-01-03 18:05:45 A------- 1,221 C:\Qoobox\Quarantine\C\WINDOWS\system32\TDSSxhyf.log.vir
2009-03-14 21:01:44 A------- 480 C:\Qoobox\Quarantine\catchme.log
2009-03-14 21:03:13 A------- 1,123 C:\Qoobox\Quarantine\Registry_backups\Service_TDSSserv.sys.reg.dat
2009-03-14 21:03:17 A------- 58,696 C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\__.zip
2009-03-14 21:13:27 A------- 14,612 C:\Qoobox\Quarantine\Registry_backups\tcpip.reg
2009-03-14 21:14:01 A------- 53 C:\Qoobox\Quarantine\D\Autorun.inf.vir
2009-03-14 21:14:30 A------- 171 C:\Qoobox\Quarantine\Registry_backups\WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C}.reg.dat
2009-03-14 21:14:42 A------- 610 C:\Qoobox\Quarantine\Registry_backups\MSConfigStartUp-SeekmoOE.reg.dat
2009-03-14 21:14:42 A------- 622 C:\Qoobox\Quarantine\Registry_backups\MSConfigStartUp-SeekmoSA.reg.dat
2009-03-15 02:57:13 A------- 22,707 C:\Qoobox\Quarantine\[4]-Submit_2009-03-15@2.57.zip
2009-03-15 02:59:33 A------- 862 C:\Qoobox\Quarantine\Registry_backups\Legacy_1IZXA6K3NHM.SYS.reg.dat
2009-03-15 02:59:33 A------- 862 C:\Qoobox\Quarantine\Registry_backups\Legacy_IDNYML1KMTA.SYS.reg.dat
2009-03-15 02:59:33 A------- 942 C:\Qoobox\Quarantine\Registry_backups\Legacy_VIEWPOINT_MANAGER_SERVICE.reg.dat
2009-03-15 02:59:33 A------- 1,298 C:\Qoobox\Quarantine\Registry_backups\Legacy_JFDCD.reg.dat
2009-03-15 02:59:33 A------- 1,454 C:\Qoobox\Quarantine\Registry_backups\Service_1izxa6k3nhm.sys.reg.dat
2009-03-15 02:59:33 A------- 1,454 C:\Qoobox\Quarantine\Registry_backups\Service_idnyml1kmta.sys.reg.dat
2009-03-15 02:59:33 A------- 2,630 C:\Qoobox\Quarantine\Registry_backups\Service_jfdcd.reg.dat
2009-03-15 02:59:34 A------- 3,340 C:\Qoobox\Quarantine\Registry_backups\Service_Viewpoint Manager Service.reg.dat
2009-03-15 03

36 A------- 461 C:\Qoobox\Quarantine\Registry_backups\BHO-{0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2}.reg.dat

**chemist** · 03-15-2009, 02:20 PM

Hello again, ddrum1031.

There should be a file named [4]-Submit_2009-03-15@2.57.zip located here:

C:\Qoobox\Quarantine\[4]-Submit_2009-03-15@2.57.zip

Please submit it to this site ==> http://www.bleepingcomputer.com/subm....php?channel=4

and include this link in the message:

http://www.techsupportforum.com/security-center/virus-trojan-spyware-help/355831-annoying-virus-help.html#post2022661

Please let me know if you successfully submitted the file. Thanks.

------------------------------------------------------

ddrum1031 · 03-15-2009, 03:22 PM

yea that was the file i couldnt find before.. i found it and successfully submitted it..

**chemist** · 03-15-2009, 03:32 PM

Hello again, ddrum1031. Thanks for submitting the file.

------------------------------------------------------

Congratulations. Well done! Your logs appear clean. You should be good to go.

As far as those infected objects listed in the Kaspersky report, those are safely tucked away in ComboFix's quarantine folder or in old System Restore Points, which we will be taking care of now.

Please disable Verizon Internet Security Suite Anti-Virus before uninstalling ComboFix and then re-enable it after doing so.

Go to Start >> Run and Copy/Paste the following single-line command into the Run box and click OK:

combofix /u

This will uninstall ComboFix and delete ComboFix's quarantine folder. It will also implement some cleanup procedures, remove old System Restore Points which contain previous infections, and create a fresh, clean System Restore Point.

Please re-enable your antivirus program and any other antispyware programs disabled earlier if you haven't already.

You can safely delete any tools downloaded or any logs, files, and any shortcuts on your desktop that were created during this fix.

------------------------------------------------------

MICROSOFT UPDATES
It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft and download all the critical updates to help prevent possible re-infection.

SPYWARE PREVENTION
This is a good time to set up protection against further attacks. In light of your recent problem, I'm sure you'd like to avoid any future infections. Please read these well written articles:

How Did I Get Infected In The First Place? by TonyKlein
PC Safety and Security--What Do I Need?

To help protect your computer in the future I recommend that you get the following free programs if you do not already have them:

SpywareBlaster prevents the installation of ActiveX-based malware, blocks cookies, and restricts the actions of "bad" sites in Internet Explorer. See tutorial here
IE-Spyad is another excellent program that places over 5000 dubious websites and domains in the IE Restricted list, which will help prevent attempts to infect your system. It basically prevents any downloads from the sites listed, although you will still be able to connect to the site. See tutorial here
MVPS HOSTS FILE replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. It basically prevents your computer from connecting to those sites by redirecting them to 127.0.0.1, which is the IP of your local computer. See guide here and for Windows Vista here

Keep your antivirus program and antispyware programs updated and scan with them on a regular basis.

Please respond to this thread one more time so we can mark this thread as resolved.

ddrum1031 · 03-15-2009, 07:01 PM

excellent.. yea everything is running great now .. thank you again for all your help.. take care

**chemist** · 03-15-2009, 07:13 PM

You're very welcome, ddrum1031! Glad to have helped.

03-13-2009, 06:27 PM	#1 (permalink)
ddrum1031 Registered User Join Date: Mar 2009 Posts: 9 OS: windows xp	annoying virus help hi, i had this awful virus on my computer and finally got it removed and everything cleaned up but there is one more i cannot get rid of.. anytime a program starts a warning pops up that says: (program name).exe-bad image the app or dll globalroot/systemroot/system32/tdssnvuo.dll is not a valid windows image.please check this against your installation diskette. at the same time a popup message appears that says: antivirus virus detected-restart required then a paragraph about how i need to restart to remove the virus and to run the antivirus again to see if it is still on my system.. underneath it gives the virus and infected file rootkit.win32.tdss.dbg c:\windows\system32\tdssnuvo.dll (this is not from my antivirus program) ive tried to run both gmer and dds and the virus wont let me run either of them..help!! many thanks dave

03-14-2009, 01:07 AM	#4 (permalink)
chemist Moderator, Analyst, Security Team; Rangemaster, TSF Academy Join Date: Oct 2007 Location: Georgia Posts: 10,641 OS: XP SP3	Re: annoying virus help Hello ddrum1031. Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate. Please stay with me until given the 'all clear' even if symptoms seemingly abate. Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by a helper. ------------------------------------------------------ One or more of the identified infections is a backdoor trojan. This type of infection allows hackers to remotely control your computer, log keystrokes, steal critical system information, and download and execute files without your knowledge. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation. Please read this: How Do I Handle Possible Identify Theft, Internet Fraud, and CC Fraud? ------------------------------------------------------ Please visit this webpage for download links, and instructions for running ComboFix: http://www.bleepingcomputer.com/comb...o-use-combofix * Ensure you have disabled all antivirus and antimalware programs so they do not interfere with the running of ComboFix. Get help here Please post the C:\ComboFix.txt in your next reply for further review. ------------------------------------------------------ __________________ Our help is free but please donate Proud member of ASAP Proud member of UNITE

03-14-2009, 09:30 AM	#5 (permalink)
ddrum1031 Registered User Join Date: Mar 2009 Posts: 9 OS: windows xp	Re: annoying virus help ok i disabled my antivirus/firewall and downloaded combofix to my desktop but when i click on it nothing happens. ive tried it a few times

03-14-2009, 01:08 PM	#6 (permalink)
chemist Moderator, Analyst, Security Team; Rangemaster, TSF Academy Join Date: Oct 2007 Location: Georgia Posts: 10,641 OS: XP SP3	Re: annoying virus help Hello ddrum1031. Delete ComboFix.exe from your desktop. Download ComboFix from any of the links below. You *must* rename it before saving it. Save it to your Desktop. If you are using Firefox, go to Tools > Options > Main and select 'Always ask me where to save files' and click OK. Link 1 Link 2 Link 3 * IMPORTANT !!! Save Combo-Fix.exe to your Desktop ------------------------------------------------------ Now follow the rest of the instructions as before for running Combo-Fix.exe and post the log, ComboFix.txt in your next reply. ------------------------------------------------------ __________________ Our help is free but please donate Proud member of ASAP Proud member of UNITE

03-14-2009, 07:20 PM	#7 (permalink)
ddrum1031 Registered User Join Date: Mar 2009 Posts: 9 OS: windows xp	Re: annoying virus help thank you again here is the log ComboFix 09-03-13.02 - HP_Owner 2009-03-14 21:10:03.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.503.140 [GMT -4:00] Running from: c:\documents and settings\HP_Owner\Desktop\combo-fix.exe AV: Verizon Internet Security Suite Anti-Virus On-access scanning enabled (Updated) FW: Verizon Internet Security Suite Firewall enabled . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\All Users\Application Data\Microsoft\Internet Explorer\DLLs\c.cgm c:\windows\IE4 Error Log.txt c:\windows\system32\drivers\TDSSmxst.sys c:\windows\system32\TDSSarxx.dll c:\windows\system32\TDSSdxcp.dll c:\windows\system32\TDSSkkai.log c:\windows\system32\TDSSmtve.dat c:\windows\system32\TDSSnmxh.log c:\windows\system32\TDSSnvuo.dll c:\windows\system32\TDSSoitt.dll c:\windows\system32\TDSSsahc.dll c:\windows\system32\TDSSvoqm.dll c:\windows\system32\TDSSxhyf.log D:\Autorun.inf . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_TDSSserv.sys -------\Legacy_TDSSserv.sys ((((((((((((((((((((((((( Files Created from 2009-02-15 to 2009-03-15 ))))))))))))))))))))))))))))))) . 2009-03-13 21:42 . 2009-03-13 21:44 <DIR> d-------- C:\rsit 2009-03-13 18:48 . 2009-03-13 18:48 <DIR> d-------- c:\program files\Microsoft 2009-03-13 18:40 . 2009-03-13 18:39 73,728 --a------ c:\windows\system32\javacpl.cpl 2009-03-08 02:02 . 2009-03-08 02:17 540 --a------ c:\windows\system32\PDBootState 2009-03-07 20:35 . 2008-06-26 15:23 112,144 --a------ c:\windows\system32\drivers\kl1.sys 2009-03-07 20:35 . 2008-04-24 15:02 53,192 --a------ c:\windows\system32\drivers\rp_skt32.sys 2009-03-07 20:34 . 2009-03-07 20:34 <DIR> d-------- c:\program files\Raxco 2009-03-07 20:34 . 2009-03-07 20:34 <DIR> d-------- c:\documents and settings\All Users\Application Data\Raxco 2009-03-07 20:34 . 2007-04-19 12:36 48,384 --a------ c:\windows\system32\drivers\rp_pkt32.sys 2009-03-07 20:06 . 2009-03-14 21:08 1,741,856 --ahs---- c:\windows\system32\drivers\fidbox.dat 2009-03-07 20:06 . 2009-03-14 21:14 23,840 --ahs---- c:\windows\system32\drivers\fidbox2.dat 2009-03-07 20:06 . 2009-03-14 21:08 5,996 --ahs---- c:\windows\system32\drivers\fidbox.idx 2009-03-07 20:06 . 2009-03-14 21:08 3,092 --ahs---- c:\windows\system32\drivers\fidbox2.idx 2009-03-07 19:17 . 2009-03-07 20:33 <DIR> d-------- c:\program files\Verizon 2009-03-07 19:17 . 2009-03-07 19:17 <DIR> d-------- c:\documents and settings\HP_Owner\Application Data\Verizon 2009-03-07 19:17 . 2009-03-07 20:33 <DIR> d-------- c:\documents and settings\All Users\Application Data\Verizon 2009-03-07 18:22 . 2009-03-07 18:38 164 --a------ c:\windows\install.dat 2009-03-07 17:19 . 2009-03-07 17:19 <DIR> d-------- c:\program files\iPod 2009-03-07 17:18 . 2009-03-07 17:19 <DIR> d-------- c:\program files\iTunes 2009-03-07 17:18 . 2009-03-07 17:19 <DIR> d-------- c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2009-03-07 17:15 . 2009-03-07 17:16 <DIR> d-------- c:\program files\QuickTime 2009-03-07 17:03 . 2009-03-07 17:03 <DIR> d-------- c:\program files\Bonjour 2009-03-04 14:15 . 2009-03-07 19:06 <DIR> d-------- c:\program files\MakeNewDirectory 2009-03-04 12:28 . 2009-03-04 12:28 <DIR> d-------- c:\windows\system32\scripting 2009-03-04 12:28 . 2009-03-04 12:28 <DIR> d-------- c:\windows\system32\en 2009-03-04 12:28 . 2009-03-04 12:28 <DIR> d-------- c:\windows\system32\bits 2009-03-04 12:28 . 2009-03-04 12:28 <DIR> d-------- c:\windows\l2schemas 2009-03-04 12:26 . 2009-03-04 12:29 <DIR> d-------- c:\windows\ServicePackFiles 2009-03-04 12:18 . 2009-03-04 12:18 <DIR> d-------- c:\windows\EHome 2009-03-04 01:04 . 2009-03-07 17:57 <DIR> d-------- c:\program files\Symantec 2009-03-04 00:27 . 2009-03-04 00:27 <DIR> d-------- c:\documents and settings\HP_Owner\Application Data\Malwarebytes 2009-03-04 00:20 . 2009-03-04 00:20 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-03-14 01:43 --------- d-----w c:\program files\Trend Micro 2009-03-13 22:39 410,984 ----a-w c:\windows\system32\deploytk.dll 2009-03-08 04:45 79,872 ----a-w c:\windows\system32\drivers\1izxa6k3nhm.sys 2009-03-08 00:32 --------- d--h--w c:\program files\InstallShield Installation Information 2009-03-07 22:00 --------- d-----w c:\program files\Common Files\Symantec Shared 2009-03-07 21:58 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec 2009-03-07 21:14 --------- d-----w c:\program files\Common Files\Apple 2009-03-07 21:14 --------- d-----w c:\documents and settings\HP_Owner\Application Data\LimeWire 2009-03-04 16:33 45,056 ----a-w c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\uninstallUI\eHelpSetup.exe 2009-03-04 16:32 61,440 ----a-w c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\modemutil.dll 2009-03-04 16:32 44,032 ----a-w c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\Scripts\devcon.exe 2009-03-04 16:32 40,960 ----a-w c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\ScDmi.dll 2009-03-04 16:32 341,048 ----a-w c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\HPBasicDetection3.dll 2009-03-04 16:32 32,768 ----a-w c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\uploadHSC.dll 2009-03-04 16:32 32,768 ----a-w c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\Scom.dll 2009-03-04 16:32 217,088 ----a-w c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\WebHelper.dll 2009-03-04 16:32 163,840 ----a-w c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\modemcheck.dll 2009-03-04 05:45 --------- d-----w c:\documents and settings\HP_Owner\Application Data\Viewpoint 2009-02-14 17:08 1,553,784 ----a-w c:\windows\WRSetup.dll 2009-02-13 22:09 29,808 ----a-w c:\windows\system32\drivers\ssfs0bbc.sys 2009-02-13 22:09 23,152 ----a-w c:\windows\system32\drivers\sshrmd.sys 2009-02-13 22:09 176,752 ----a-w c:\windows\system32\drivers\ssidrv.sys 2009-02-09 11:13 1,846,784 ----a-w c:\windows\system32\win32k.sys 2009-02-09 11:13 1,846,784 ------w c:\windows\system32\dllcache\win32k.sys 2009-01-17 02:35 3,594,752 ------w c:\windows\system32\dllcache\mshtml.dll 2009-01-02 23:28 164 ----a-w C:\install.dat 2008-12-22 23:48 40,432 ----a-w c:\documents and settings\HP_Owner\5c4de.zip 2008-12-19 09:10 70,656 ------w c:\windows\system32\dllcache\ie4uinit.exe 2008-12-19 09:10 13,824 ------w c:\windows\system32\dllcache\ieudinit.exe 2008-12-19 05:25 634,024 ------w c:\windows\system32\dllcache\iexplore.exe 2008-12-19 05:23 161,792 ------w c:\windows\system32\dllcache\ieakui.dll 2008-02-08 02:19 88 --sh--r c:\documents and settings\All Users\Application Data\B8711D67DE.sys 2008-02-08 02:19 2,828 --sha-w c:\documents and settings\All Users\Application Data\KGyGaAvL.sys 2008-01-16 02:14 1,542 ----a-w c:\documents and settings\HP_Owner\Application Data\wklnhst.dat 2006-06-16 21:18 22 --sha-w c:\windows\SMINST\HPCD.sys . ------- Sigcheck ------- 2004-08-04 00:00 14336 8f078ae4ed187aaabc0a305146de6716 c:\windows\$NtServicePackUninstall$\svchost.exe 2008-04-13 20:12 14336 27c6d03bcdb8cfeb96b716f3d8be3e18 c:\windows\ServicePackFiles\i386\svchost.exe 2008-04-13 20:12 14336 27c6d03bcdb8cfeb96b716f3d8be3e18 c:\windows\system32\svchost.exe 2005-03-02 14:19 577024 1800f293bccc8ede8a70e12b88d80036 c:\windows\$hf_mig$\KB890859\SP2QFE\user32.dll 2007-03-08 11:48 578048 7aa4f6c00405dfc4b70ed4214e7d687b c:\windows\$hf_mig$\KB925902\SP2QFE\user32.dll 2009-03-08 17:13 577536 b409909f6e2e8a7067076ed748abf1e7 c:\windows\$NtServicePackUninstall$\user32.dll 2005-03-02 14:09 577024 de2db164bbb35db061af0997e4499054 c:\windows\$NtUninstallKB925902$\user32.dll 2008-04-13 20:12 578560 b26b135ff1b9f60c9388b4a7d16f600b c:\windows\ServicePackFiles\i386\user32.dll 2008-04-13 20:12 578560 b26b135ff1b9f60c9388b4a7d16f600b c:\windows\system32\user32.dll 2004-08-04 00:00 82944 2ed0b7f12a60f90092081c50fa0ec2b2 c:\windows\$NtServicePackUninstall$\ws2_32.dll 2008-04-13 20:12 82432 2ccc474eb85ceaa3e1fa1726580a3e5a c:\windows\ServicePackFiles\i386\ws2_32.dll 2008-04-13 20:12 82432 2ccc474eb85ceaa3e1fa1726580a3e5a c:\windows\system32\ws2_32.dll 2004-08-04 00:00 502272 01c3346c241652f43aed8e2149881bfe c:\windows\$NtServicePackUninstall$\winlogon.exe 2008-04-13 20:12 507904 ed0ef0a136dec83df69f04118870003e c:\windows\ServicePackFiles\i386\winlogon.exe 2008-04-13 20:12 507904 ed0ef0a136dec83df69f04118870003e c:\windows\system32\winlogon.exe 2004-08-04 00:00 182912 558635d3af1c7546d26067d5d9b6959e c:\windows\$NtServicePackUninstall$\ndis.sys 2008-04-13 15:20 182656 1df7f42665c94b825322fae71721130d c:\windows\ServicePackFiles\i386\ndis.sys 2008-04-13 15:20 182656 1df7f42665c94b825322fae71721130d c:\windows\system32\drivers\ndis.sys 2004-08-04 00:00 29056 4448006b6bc60e6c027932cfc38d6855 c:\windows\$NtServicePackUninstall$\ip6fw.sys 2008-04-13 14:53 36608 3bb22519a194418d5fec05d800a19ad0 c:\windows\ServicePackFiles\i386\ip6fw.sys 2008-04-13 14:53 36608 3bb22519a194418d5fec05d800a19ad0 c:\windows\system32\drivers\ip6fw.sys 2008-04-13 20:12 1033728 12896823fb95bfb3dc9b46bcaedc9923 c:\windows\explorer.exe 2007-06-13 07:26 1033216 7712df0cdde3a5ac89843e61cd5b3658 c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe 2007-06-13 06:23 1033216 97bd6515465659ff8f3b7be375b2ea87 c:\windows\$NtServicePackUninstall$\explorer.exe 2004-08-04 00:00 1032192 a0732187050030ae399b241436565e64 c:\windows\$NtUninstallKB938828$\explorer.exe 2008-04-13 20:12 1033728 12896823fb95bfb3dc9b46bcaedc9923 c:\windows\ServicePackFiles\i386\explorer.exe 2004-08-04 00:00 108032 c6ce6eec82f187615d1002bb3bb50ed4 c:\windows\$NtServicePackUninstall$\services.exe 2008-04-13 20:12 108544 0e776ed5f7cc9f94299e70461b7b8185 c:\windows\ServicePackFiles\i386\services.exe 2008-04-13 20:12 108544 0e776ed5f7cc9f94299e70461b7b8185 c:\windows\system32\services.exe 2004-08-04 00:00 13312 84885f9b82f4d55c6146ebf6065d75d2 c:\windows\$NtServicePackUninstall$\lsass.exe 2008-04-13 20:12 13312 bf2466b3e18e970d8a976fb95fc1ca85 c:\windows\ServicePackFiles\i386\lsass.exe 2008-04-13 20:12 13312 bf2466b3e18e970d8a976fb95fc1ca85 c:\windows\system32\lsass.exe 2004-08-04 00:00 15360 24232996a38c0b0cf151c2140ae29fc8 c:\windows\$NtServicePackUninstall$\ctfmon.exe 2008-04-13 20:12 15360 5f1d5f88303d4a4dbc8e5f97ba967cc3 c:\windows\ServicePackFiles\i386\ctfmon.exe 2008-04-13 20:12 15360 5f1d5f88303d4a4dbc8e5f97ba967cc3 c:\windows\system32\ctfmon.exe 2005-06-10 20:17 57856 ad3d9d191aea7b5445fe1d82ffbb4788 c:\windows\$hf_mig$\KB896423\SP2QFE\spoolsv.exe 2005-06-10 19:53 57856 da81ec57acd4cdc3d4c51cf3d409af9f c:\windows\$NtServicePackUninstall$\spoolsv.exe 2008-04-13 20:12 57856 d8e14a61acc1d4a6cd0d38aebac7fa3b c:\windows\ServicePackFiles\i386\spoolsv.exe 2008-04-13 20:12 57856 d8e14a61acc1d4a6cd0d38aebac7fa3b c:\windows\system32\spoolsv.exe 2004-08-04 00:00 24576 39b1ffb03c2296323832acbae50d2aff c:\windows\$NtServicePackUninstall$\userinit.exe 2008-04-13 20:12 26112 a93aee1928a9d7ce3e16d24ec7380f89 c:\windows\ServicePackFiles\i386\userinit.exe 2008-04-13 20:12 26112 a93aee1928a9d7ce3e16d24ec7380f89 c:\windows\system32\userinit.exe 2004-08-04 00:00 295424 b60c877d16d9c880b952fda04adf16e6 c:\windows\$NtServicePackUninstall$\termsrv.dll 2008-04-13 20:12 295424 ff3477c03be7201c294c35f684b3479f c:\windows\ServicePackFiles\i386\termsrv.dll 2008-04-13 20:12 295424 ff3477c03be7201c294c35f684b3479f c:\windows\system32\termsrv.dll 2006-07-05 06:57 985088 0fdd84928a5dde2510761b7ec76ccec9 c:\windows\$hf_mig$\KB917422\SP2QFE\kernel32.dll 2007-04-16 12:07 986112 09f7cb3687f86edaa4ca081f7ab66c03 c:\windows\$hf_mig$\KB935839\SP2QFE\kernel32.dll 2007-04-16 11:52 984576 a01f9ca902a88f7ced06884174d6419d c:\windows\$NtServicePackUninstall$\kernel32.dll 2004-08-04 00:00 983552 888190e31455fad793312f8d087146eb c:\windows\$NtUninstallKB917422$\kernel32.dll 2006-07-05 06:55 984064 d8db5397de07577c1cb50ba6d23b3ad4 c:\windows\$NtUninstallKB935839$\kernel32.dll 2008-04-13 20:11 989696 c24b983d211c34da8fcc1ac38477971d c:\windows\ServicePackFiles\i386\kernel32.dll 2008-04-13 20:11 989696 c24b983d211c34da8fcc1ac38477971d c:\windows\system32\kernel32.dll 2004-08-04 00:00 17408 1b5f6923abb450692e9fe0672c897aed c:\windows\$NtServicePackUninstall$\powrprof.dll 2008-04-13 20:12 17408 50a166237a0fa771261275a405646cc0 c:\windows\ServicePackFiles\i386\powrprof.dll 2008-04-13 20:12 17408 50a166237a0fa771261275a405646cc0 c:\windows\system32\powrprof.dll 2004-08-04 00:00 110080 87ca7ce6469577f059297b9d6556d66d c:\windows\$NtServicePackUninstall$\imm32.dll 2008-04-13 20:11 110080 0da85218e92526972a821587e6a8bf8f c:\windows\ServicePackFiles\i386\imm32.dll 2008-04-13 20:11 110080 0da85218e92526972a821587e6a8bf8f c:\windows\system32\imm32.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2}] 2008-12-14 17:23 66912 --a------ c:\program files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232] "Aim6"="c:\program files\AIM6\aim6.exe" [2008-10-31 50480] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "WrtMon.exe"="c:\windows\system32\spool\drivers\w32x86\3\WrtMon.exe" [2006-09-20 20480] "HPHUPD08"="c:\program files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe" [2005-06-01 49152] "HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2005-11-09 249856] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2005-09-24 49152] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2006-03-06 180269] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-01-06 290088] "VerizonServicepoint.exe"="c:\program files\Verizon\VSP\VerizonServicepoint.exe" [2008-10-20 2303216] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-13 148888] "Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-02-03 233304] "SoundMan"="SOUNDMAN.EXE" [2005-09-21 c:\windows\SOUNDMAN.EXE] c:\documents and settings\All Users\Start Menu\Programs\Startup\ HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-09-24 282624] Updates From HP.lnk - c:\program files\Updates from HP\9972322\Program\Updates from HP.exe [2006-03-06 36903] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ PDBoot.exe\0autocheck autochk * [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\1izxa6k3nhm.sys] @="\??\c:\windows\system32\drivers\1izxa6k3nhm.sys" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\idnyml1kmta.sys] @="\??\c:\windows\system32\drivers\idnyml1kmta.sys" [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader] --a------ 2005-06-07 00:46 57344 c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd] --a------ 2005-11-03 11:22 77824 c:\windows\system32\hkcmd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers] --a------ 2005-11-03 11:26 118784 c:\windows\system32\igfxpers.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2009-01-05 17:18 413696 c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Recguard] --a------ 2005-07-22 19:14 237568 c:\windows\SMINST\Recguard.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] --a------ 2006-03-06 21:02 180269 c:\program files\Common Files\Real\Update_OB\realsched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\High Definition Audio Property Page Shortcut] --a------ 2005-01-07 21:07 61952 c:\windows\system32\HdAShCut.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "c:\\Program Files\\Updates from HP\\9972322\\Program\\Updates from HP.exe"= "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "c:\\Program Files\\Common Files\\AOL\\1158579814\\ee\\aolsoftware.exe"= "c:\\Program Files\\Common Files\\AOL\\1158579814\\ee\\aim6.exe"= "c:\\Program Files\\LimeWire\\LimeWire.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\AIM6\\aim6.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "135:TCP"= 135:TCP:TCP Port 135 "5000:TCP"= 5000:TCP:TCP Port 5000 "5001:TCP"= 5001:TCP:TCP Port 5001 "5002:TCP"= 5002:TCP:TCP Port 5002 "5003:TCP"= 5003:TCP:TCP Port 5003 "5004:TCP"= 5004:TCP:TCP Port 5004 "5005:TCP"= 5005:TCP:TCP Port 5005 "5006:TCP"= 5006:TCP:TCP Port 5006 "5007:TCP"= 5007:TCP:TCP Port 5007 "5008:TCP"= 5008:TCP:TCP Port 5008 "5009:TCP"= 5009:TCP:TCP Port 5009 "5010:TCP"= 5010:TCP:TCP Port 5010 "5011:TCP"= 5011:TCP:TCP Port 5011 "5012:TCP"= 5012:TCP:TCP Port 5012 "5013:TCP"= 5013:TCP:TCP Port 5013 "5014:TCP"= 5014:TCP:TCP Port 5014 "5015:TCP"= 5015:TCP:TCP Port 5015 "5016:TCP"= 5016:TCP:TCP Port 5016 "5017:TCP"= 5017:TCP:TCP Port 5017 "5018:TCP"= 5018:TCP:TCP Port 5018 "5019:TCP"= 5019:TCP:TCP Port 5019 "5020:TCP"= 5020:TCP:TCP Port 5020 R0 ssfs0bbc;ssfs0bbc;c:\windows\system32\drivers\ssfs0bbc.sys [2009-02-13 29808] R2 SeaPort;SeaPort;c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2009-01-14 226656] S2 1izxa6k3nhm.sys;1izxa6k3nhm.sys;c:\windows\system32\drivers\1izxa6k3nhm.sys [2004-08-04 79872] S2 idnyml1kmta.sys;idnyml1kmta.sys;\??\c:\windows\system32\drivers\idnyml1kmta.sys --> c:\windows\system32\drivers\idnyml1kmta.sys [?] S2 Viewpoint Manager Service;Viewpoint Manager Service;"c:\program files\Viewpoint\Common\ViewpointService.exe" --> c:\program files\Viewpoint\Common\ViewpointService.exe [?] S3 A5AGU;D-Link USB Wireless Network Adapter Service;c:\windows\system32\drivers\A5AGU.sys [2006-05-08 347648] S3 jfdcd;jfdcd;\??\c:\docume~1\HP_Owner\LOCALS~1\Temp\jfdcd.sys --> c:\docume~1\HP_Owner\LOCALS~1\Temp\jfdcd.sys [?] S3 Radialpoint Security Services;Verizon Internet Security Suite;c:\program files\Verizon\Verizon Internet Security Suite\RpsSecurityAwareR.exe [2008-10-24 96496] --- Other Services/Drivers In Memory --- NewlyCreated - GTNDIS5 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D] \Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480 . Contents of the 'Scheduled Tasks' folder 2008-12-10 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 13:34] 2009-03-15 c:\windows\Tasks\Symantec NetDetect.job - c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2002-08-07 10:04] . - - - - ORPHANS REMOVED - - - - WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file) MSConfigStartUp-SeekmoOE - c:\program files\Seekmo\bin\10.0.406.0\OEAddOn.exe MSConfigStartUp-SeekmoSA - c:\program files\Seekmo\bin\10.0.406.0\SeekmoSA.exe . ------- Supplementary Scan ------- . uInternet Settings,ProxyOverride = .local IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\HP_Owner\Start Menu\Programs\IMVU\Run IMVU.lnk . *********************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-03-14 21:13:58 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************ . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(1340) c:\windows\system32\GTGina.dll . Completion time: 2009-03-14 21:15:58 ComboFix-quarantined-files.txt 2009-03-15 01:15:20 Pre-Run: 124,438,679,552 bytes free Post-Run: 124,984,557,568 bytes free 308 --- E O F --- 2009-03-12 04:07:23

03-14-2009, 08:10 PM	#8 (permalink)
chemist Moderator, Analyst, Security Team; Rangemaster, TSF Academy Join Date: Oct 2007 Location: Georgia Posts: 10,641 OS: XP SP3	Re: annoying virus help Hello ddrum1031. Good job! Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ Please uninstall the following via the Add or Remove Programs section of your Control Panel if they still exist: LiveReg (Symantec Corporation) LiveUpdate 1.80 (Symantec Corporation) ------------------------------------------------------ Please uninstall the following via Start->(or My Computer)->Control Panel->Add or Remove Programs if it still exists: Ask Toolbar<<Please read here Also delete the following Folder if it still exists: C:\Program Files\AskSBar ------------------------------------------------------ I see you have P2P software ( LimeWire ) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information. Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares. References for the risk of these programs are here, here, and here. I would strongly recommend that you uninstall it, however that choice is up to you. If you choose to remove this program, you can do so via Control Panel >> Add or Remove Programs. ------------------------------------------------------ Close any open browsers. Disable your antivirus and antispyware applications, usually via a right-click on the System Tray icon. They may otherwise interfere with ComboFix. Open Notepad and copy/paste all the text in the codebox below into Notepad: Code: http://www.techsupportforum.com/security-center/virus-trojan-spyware-help/355831-annoying-virus-help.html#post2022661 Collect:: c:\windows\system32\drivers\1izxa6k3nhm.sys Registry:: [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\1izxa6k3nhm.sys] [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\idnyml1kmta.sys] [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000000 Driver:: 1izxa6k3nhm.sys idnyml1kmta.sys Viewpoint Manager Service jfdcd Save this Notepad file as CFScript.txt to your Desktop and then close the file. Referring to the picture above, drag CFScript onto ComboFix If you are prompted to update ComboFix and have an internet connection, please choose Yes Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal. When finished, it shall produce a log for you. Please post that log, ComboFix.txt in your next reply. Note: Do not mouseclick ComboFix's window whilst it's running. That may cause it to stall. Note When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture files to submit for analysis. Ensure you are connected to the internet and click OK on the message box. If you do not get a message box, please do the following: Go Start > Run and copy/paste the following single-line command into the Run box and click OK: C:\CF-Submit.htm Please follow the instructions for submitting the file for analysis and let me know it was submitted. ------------------------------------------------------ __________________ Our help is free but please donate Proud member of ASAP Proud member of UNITE

03-15-2009, 05:55 AM	#10 (permalink)
chemist Moderator, Analyst, Security Team; Rangemaster, TSF Academy Join Date: Oct 2007 Location: Georgia Posts: 10,641 OS: XP SP3	Re: annoying virus help Hello again, ddrum1031. Please tell us how your system is behaving. Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ It appears you didn't submit the file for analysis. There should be a file named [4]-Submit_date@time.zip located here: C:\QooBox\Quarantine\[4]-Submit_date@time.zip Using the 'Browse' button, please submit it to this site ==> http://www.bleepingcomputer.com/subm....php?channel=4 and include this link in the message: http://www.techsupportforum.com/security-center/virus-trojan-spyware-help/355831-annoying-virus-help.html#post2022661 Please let me know if you successfully submitted the file. Thanks. ------------------------------------------------------ Please download ATF-Cleaner by Atribune and Save it to your Desktop. Double-click ATF-Cleaner.exe to run the program. Under Main choose: Select All Click the Empty Selected button. If you use Firefox browser Click Firefox at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click No at the prompt. If you use Opera browser Click Opera at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click No at the prompt. Click Exit on the Main menu to close the program. For Technical Support, double-click the e-mail address located at the bottom of each menu. ------------------------------------------------------ Please run this online scan to help look for remnants. Establish an internet connection & perform an online scan at Kaspersky Online Scanner Ensure your external and/or USB drives are inserted during the scan. Click Accept, when prompted to download and install the program files and database of malware definitions. Click Run at any Security prompt. The program will then begin downloading and installing and will also update the database. Please be patient as this can take several minutes. Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan. Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it. Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined. Click View scan report at the bottom. Click the Save Report As... button. Click the Save as Text button to save the file to your desktop so that you may post it in your next reply. Note To optimize scanning time and produce a more sensible report for review: Close any open programs. Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan. Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%. ------------------------------------------------------ Please post the following in your next reply: Kaspersky report report on system behavior __________________ Our help is free but please donate Proud member of ASAP Proud member of UNITE

03-15-2009, 01:01 PM	#11 (permalink)
ddrum1031 Registered User Join Date: Mar 2009 Posts: 9 OS: windows xp	Re: annoying virus help sorry about that after the scan a box did not pop up so i tried finding the file with run it said that file doesnt exist. i just searched for the file [4]-Submit_date@time.zip and it doesnt exist.. my computer is running great, popup free and alot smoother now here is the kaspersky report: -------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER 7 REPORT Sunday, March 15, 2009 Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Sunday, March 15, 2009 16:39:14 Records in database: 1908766 -------------------------------------------------------------------------------- Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: C:\ D:\ E:\ F:\ G:\ H:\ I:\ Scan statistics: Files scanned: 86328 Threat name: 2 Infected objects: 5 Suspicious objects: 0 Duration of the scan: 02:36:46 File name / Threat name / Threats count C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\__.zip Infected: Backdoor.Win32.TDSS.bkw 1 D:\I386\APPS\APP22639\src\CompaqPresario_Spring06.exe Infected: not-a-virus:AdWare.Win32.WeatherBug.a 2 D:\I386\APPS\APP22639\src\HPPavillion_Spring06.exe Infected: not-a-virus:AdWare.Win32.WeatherBug.a 2 The selected area was scanned.

03-15-2009, 01:26 PM	#12 (permalink)
chemist Moderator, Analyst, Security Team; Rangemaster, TSF Academy Join Date: Oct 2007 Location: Georgia Posts: 10,641 OS: XP SP3	Re: annoying virus help Hello again, ddrum1031. QooBox is ComboFix's quarantine folder. It will get deleted when we uninstall ComboFix. The two Spring06.exe files come installed from the factory on your recovery partition, so we will leave those alone. ------------------------------------------------------ Go to Start > Run and copy/paste the following into the Run box and click OK: C:\QooBox\ComboFix-quarantined-files.txt A text file should open. Please post the contents of that file in your next reply. ------------------------------------------------------ __________________ Our help is free but please donate Proud member of ASAP Proud member of UNITE

03-15-2009, 02:11 PM	#13 (permalink)
ddrum1031 Registered User Join Date: Mar 2009 Posts: 9 OS: windows xp	Re: annoying virus help oh good yea lets leave that alone .. heres the combofix quarantine 2004-08-04 00:00:00 A------- 79,872 C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\1izxa6k3nhm.sys.vir 2006-06-07 20:47:41 A------- 1,107 C:\Qoobox\Quarantine\C\WINDOWS\IE4 Error Log.txt.vir 2008-12-13 15:58:17 A------- 441 C:\Qoobox\Quarantine\C\WINDOWS\system32\TDSSmtve.dat.vir 2008-12-13 15:58:32 A------- 2,709 C:\Qoobox\Quarantine\C\WINDOWS\system32\TDSSdxcp.dll.vir 2008-12-13 15:58:37 A------- 27,213 C:\Qoobox\Quarantine\C\WINDOWS\system32\TDSSkkai.log.vir 2008-12-13 16:01:56 A------- 14 C:\Qoobox\Quarantine\C\Documents and Settings\All Users\Application Data\Microsoft\Internet Explorer\DLLs\c.cgm.vir 2009-01-03 18:05:45 A------- 1,221 C:\Qoobox\Quarantine\C\WINDOWS\system32\TDSSxhyf.log.vir 2009-03-14 21:01:44 A------- 480 C:\Qoobox\Quarantine\catchme.log 2009-03-14 21:03:13 A------- 1,123 C:\Qoobox\Quarantine\Registry_backups\Service_TDSSserv.sys.reg.dat 2009-03-14 21:03:17 A------- 58,696 C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\__.zip 2009-03-14 21:13:27 A------- 14,612 C:\Qoobox\Quarantine\Registry_backups\tcpip.reg 2009-03-14 21:14:01 A------- 53 C:\Qoobox\Quarantine\D\Autorun.inf.vir 2009-03-14 21:14:30 A------- 171 C:\Qoobox\Quarantine\Registry_backups\WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C}.reg.dat 2009-03-14 21:14:42 A------- 610 C:\Qoobox\Quarantine\Registry_backups\MSConfigStartUp-SeekmoOE.reg.dat 2009-03-14 21:14:42 A------- 622 C:\Qoobox\Quarantine\Registry_backups\MSConfigStartUp-SeekmoSA.reg.dat 2009-03-15 02:57:13 A------- 22,707 C:\Qoobox\Quarantine\[4]-Submit_2009-03-15@2.57.zip 2009-03-15 02:59:33 A------- 862 C:\Qoobox\Quarantine\Registry_backups\Legacy_1IZXA6K3NHM.SYS.reg.dat 2009-03-15 02:59:33 A------- 862 C:\Qoobox\Quarantine\Registry_backups\Legacy_IDNYML1KMTA.SYS.reg.dat 2009-03-15 02:59:33 A------- 942 C:\Qoobox\Quarantine\Registry_backups\Legacy_VIEWPOINT_MANAGER_SERVICE.reg.dat 2009-03-15 02:59:33 A------- 1,298 C:\Qoobox\Quarantine\Registry_backups\Legacy_JFDCD.reg.dat 2009-03-15 02:59:33 A------- 1,454 C:\Qoobox\Quarantine\Registry_backups\Service_1izxa6k3nhm.sys.reg.dat 2009-03-15 02:59:33 A------- 1,454 C:\Qoobox\Quarantine\Registry_backups\Service_idnyml1kmta.sys.reg.dat 2009-03-15 02:59:33 A------- 2,630 C:\Qoobox\Quarantine\Registry_backups\Service_jfdcd.reg.dat 2009-03-15 02:59:34 A------- 3,340 C:\Qoobox\Quarantine\Registry_backups\Service_Viewpoint Manager Service.reg.dat 2009-03-15 0336 A------- 461 C:\Qoobox\Quarantine\Registry_backups\BHO-{0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2}.reg.dat

03-15-2009, 02:20 PM	#14 (permalink)
chemist Moderator, Analyst, Security Team; Rangemaster, TSF Academy Join Date: Oct 2007 Location: Georgia Posts: 10,641 OS: XP SP3	Re: annoying virus help Hello again, ddrum1031. There should be a file named [4]-Submit_2009-03-15@2.57.zip located here: C:\Qoobox\Quarantine\[4]-Submit_2009-03-15@2.57.zip Please submit it to this site ==> http://www.bleepingcomputer.com/subm....php?channel=4 and include this link in the message: http://www.techsupportforum.com/security-center/virus-trojan-spyware-help/355831-annoying-virus-help.html#post2022661 Please let me know if you successfully submitted the file. Thanks. ------------------------------------------------------ __________________ Our help is free but please donate Proud member of ASAP Proud member of UNITE

03-15-2009, 03:22 PM	#15 (permalink)
ddrum1031 Registered User Join Date: Mar 2009 Posts: 9 OS: windows xp	Re: annoying virus help yea that was the file i couldnt find before.. i found it and successfully submitted it..

03-15-2009, 03:32 PM	#16 (permalink)
chemist Moderator, Analyst, Security Team; Rangemaster, TSF Academy Join Date: Oct 2007 Location: Georgia Posts: 10,641 OS: XP SP3	Re: annoying virus help Hello again, ddrum1031. Thanks for submitting the file. ------------------------------------------------------ Congratulations. Well done! Your logs appear clean. You should be good to go. As far as those infected objects listed in the Kaspersky report, those are safely tucked away in ComboFix's quarantine folder or in old System Restore Points, which we will be taking care of now. Please disable Verizon Internet Security Suite Anti-Virus before uninstalling ComboFix and then re-enable it after doing so. Go to Start >> Run and Copy/Paste the following single-line command into the Run box and click OK: combofix /u This will uninstall ComboFix and delete ComboFix's quarantine folder. It will also implement some cleanup procedures, remove old System Restore Points which contain previous infections, and create a fresh, clean System Restore Point. Please re-enable your antivirus program and any other antispyware programs disabled earlier if you haven't already. You can safely delete any tools downloaded or any logs, files, and any shortcuts on your desktop that were created during this fix. ------------------------------------------------------ MICROSOFT UPDATES It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft and download all the critical updates to help prevent possible re-infection. SPYWARE PREVENTION This is a good time to set up protection against further attacks. In light of your recent problem, I'm sure you'd like to avoid any future infections. Please read these well written articles: How Did I Get Infected In The First Place? by TonyKlein PC Safety and Security--What Do I Need? To help protect your computer in the future I recommend that you get the following free programs if you do not already have them: SpywareBlaster prevents the installation of ActiveX-based malware, blocks cookies, and restricts the actions of "bad" sites in Internet Explorer. See tutorial here IE-Spyad is another excellent program that places over 5000 dubious websites and domains in the IE Restricted list, which will help prevent attempts to infect your system. It basically prevents any downloads from the sites listed, although you will still be able to connect to the site. See tutorial here MVPS HOSTS FILE replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. It basically prevents your computer from connecting to those sites by redirecting them to 127.0.0.1, which is the IP of your local computer. See guide here and for Windows Vista here Keep your antivirus program and antispyware programs updated and scan with them on a regular basis. Please respond to this thread one more time so we can mark this thread as resolved. __________________ Our help is free but please donate Proud member of ASAP Proud member of UNITE

03-15-2009, 07:01 PM	#17 (permalink)
ddrum1031 Registered User Join Date: Mar 2009 Posts: 9 OS: windows xp	Re: annoying virus help excellent.. yea everything is running great now .. thank you again for all your help.. take care

03-15-2009, 07:13 PM	#18 (permalink)
chemist Moderator, Analyst, Security Team; Rangemaster, TSF Academy Join Date: Oct 2007 Location: Georgia Posts: 10,641 OS: XP SP3	Re: annoying virus help You're very welcome, ddrum1031! Glad to have helped. __________________ Our help is free but please donate Proud member of ASAP Proud member of UNITE