Certain websites redirect to www.google.com

[kaito1412]

I've been noticing weird behaviour on my computer with respect to internet usage. Here are the ones I identified:

- I cannot connect to hxxp://www.safer-networking.org/ (Address not found) or do an automatic update from Spybot-SD (Version 1.6.0.30); I can, however, do a manual update for Spybot by downloading the updates via mirrors, such as hxxp://majorgeeks.com/download3957.html
- I cannot download updates to ZoneAlarm Internet Security Suite (version 8.0.059.000) from their website at hxxp://download.zonealarm.com/; the program is, however, able to tell that there are new updates available
- When I try to connect to hxxp://windowsupdate.microsoft.com/, it redirects me to what appears to be Google
- I cannot download programs from hxxp://download.microsoft.com/ (such as Microsoft SyncToy 2.0), but I am able to get as far as the download page (the program itself cannot be downloaded).

I mainly use Mozilla Firefox (version 3.0.7), but the above errors still happen when I use Internet Explorer (version 7.0.5730.13) as well. I am running Windows XP Version 2002 SP3, with Symantec AntiVirus (version 10.1.5.5000). SAV's updates seem to function normally. SAV and Spybot scans, both performed in Windows XP safe mode, did not find/fix the situation.

Thank you for your time.

The following is my DDS log:

DDS (Ver_09-03-16.01) - NTFSx86
Run by kaito at 17:07:18.23 on 26/03/2009
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_07
Microsoft Windows XP Professional 5.1.2600.3.1252.2.1033.18.3326.2641 [GMT -4:00]

AV: ZoneAlarm Security Suite Antivirus *On-access scanning disabled* (Updated)
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated)
FW: ZoneAlarm Security Suite Firewall *disabled*
FW: NVIDIA Firewall *disabled*

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\Program Files\TRENDnet\TEW-424UB\SiSWLSvc.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Notebook Hardware Control\nhc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\VM301Snap.exe
C:\WINDOWS\Domino.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Eraser\Eraser.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Documents and Settings\kaito\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\TRENDnet\TEW-424UB\TRENDnet.exe
C:\Program Files\Ida\Ida.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\wscntfy.exe
I:\Downloads\Software\DDS\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.ca/
uInternet Settings,ProxyOverride = *.local
mWinlogon: Userinit=c:\windows\system32\userinit.exe
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: FGCatchUrl: {2f364306-aa45-47b5-9f9d-39a8b94e7ef7} - c:\program files\flashget\jccatch.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_07\bin\ssv.dll
BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
BHO: FlashGet GetFlash Class: {f156768e-81ef-470c-9057-481ba8380dba} - c:\program files\flashget\getflash.dll
uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe
uRun: [Orb] "c:\program files\winamp remote\bin\OrbTray.exe" /background
uRun: [Eraser] c:\program files\eraser\Eraser.exe -hide
uRun: [NVIDIA nTune] "c:\program files\nvidia corporation\ntune\nTuneCmd.exe" clear
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [Bandwidth Monitor Pro] "c:\program files\bandwidth monitor pro\Bandwidth Monitor Pro.exe" /minimized
uRun: [Ida] "c:\program files\ida\IdaLaunch.exe" -tray
uRun: [Google Update] "c:\documents and settings\kaito\local settings\application data\google\update\GoogleUpdate.exe" /c
mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC
mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName
mRun: [DAEMON Tools-1033] "c:\program files\d-tools\daemon.exe" -lang 1033
mRun: [awxDTools] rundll32 c:\progra~1\arniworx\awxdto~1\awxDTools.dll,awxRegisterDll /r /s
mRun: [nTrayFw] c:\program files\nvidia corporation\networkaccessmanager\bin\nTrayFw.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe
mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe"
mRun: [vptray] c:\progra~1\symant~1\VPTray.exe
mRun: [NotebookHardwareControl] "c:\program files\notebook hardware control\nhc.exe" -quiet
mRun: [ZoneAlarm Client] "c:\program files\zone labs\zonealarm\zlclient.exe"
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [AMD_Display]
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [BigDogPath] c:\windows\VM301Snap.exe Vimicro USB PC Camera (ZC0301PL)
mRun: [Domino] c:\windows\Domino.exe
mRun: [googletalk] c:\program files\google\google talk\googletalk.exe /autostart
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre1.6.0_07\bin\jusched.exe"
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\google~1.lnk - c:\program files\google\google calendar sync\GoogleCalendarSync.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\ultramon.lnk - c:\windows\installer\{cc15a5fc-b6d3-4a2d-8a26-d8f2702a3c00}\IcoUltraMon.ico
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\wirele~1.lnk - c:\windows\installer\{bdc88e5a-f47b-4314-ab38-994592e32c95}\NewShortcut1_BDC88E5AF47B4314AB38994592E32C95.exe
IE: &Download All with FlashGet - c:\program files\flashget\jc_all.htm
IE: &Download with FlashGet - c:\program files\flashget\jc_link.htm
IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office11\EXCEL.EXE/3000
IE: {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - c:\program files\flashget\FlashGet.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_07\bin\ssv.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office11\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab
DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} - hxxp://upload.facebook.com/controls/FacebookPhotoUploader.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1193279688234
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
TCP: {52B938B4-E442-4A6A-898B-1FAF589B092E} = 85.255.112.121;85.255.112.76
TCP: {D1BB30E4-82E6-4242-91F0-F66DBE3270DE} = 85.255.112.121;85.255.112.76
Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\advisor\system\BAVoilaX.dll
Notify: NavLogon - c:\windows\system32\NavLogon.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\kaito\applic~1\mozilla\firefox\profiles\b0lvp3za.lite\
FF - prefs.js: browser.startup.homepage - hxxp://www.redflagdeals.com/deals/main.php/alldeals/comments/toronto_public_library_offers_free_admissions_to_ago_casa_loma_many_more_mu
FF - plugin: c:\documents and settings\kaito\application data\mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\documents and settings\kaito\local settings\application data\google\update\1.2.141.5\npGoogleOneClick7.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npmozax.dll

============= SERVICES / DRIVERS ===============

R1 KLIF;KLIF;c:\windows\system32\drivers\klif.sys [2008-10-23 148496]
R1 SAVRT;SAVRT;c:\program files\symantec antivirus\savrt.sys [2006-9-6 337592]
R1 SAVRTPEL;SAVRTPEL;c:\program files\symantec antivirus\Savrtpel.sys [2006-9-6 54968]
R1 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2008-10-23 353680]
R2 878TVCard;Bt878 TV Card - Video Capture;c:\windows\system32\drivers\Bt878.sys [2007-1-3 196608]
R2 878TVTuner;Bt878 TV Card - TV Tuner;c:\windows\system32\drivers\BtTuner.sys [2007-1-3 9088]
R2 878Xbar;Bt878 TV Card - Crossbar;c:\windows\system32\drivers\BtXbar.sys [2007-1-3 8448]
R2 ccEvtMgr;Symantec Event Manager;c:\program files\common files\symantec shared\ccEvtMgr.exe [2006-7-19 192160]
R2 ccSetMgr;Symantec Settings Manager;c:\program files\common files\symantec shared\ccSetMgr.exe [2006-7-19 169632]
R2 SavRoam;SAVRoam;c:\program files\symantec antivirus\SavRoam.exe [2006-9-27 116464]
R2 Symantec AntiVirus;Symantec AntiVirus;c:\program files\symantec antivirus\Rtvscan.exe [2006-9-27 1813232]
R2 UltraMonUtility;UltraMon Utility Driver;c:\program files\common files\realtime soft\ultramonmirrordrv\x32\UltraMonUtility.sys [2008-9-14 10496]
R3 AmdTools;AMD Special Tools Driver;c:\windows\system32\drivers\AmdTools.sys [2008-10-27 34304]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2009-2-27 101936]
R3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20090325.002\naveng.sys [2009-3-26 89104]
R3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20090325.002\navex15.sys [2009-3-26 876144]
S2 freenet-darknet-8888;Freenet 0.7 darknet-8888;c:\program files\freenet\bin\wrapper-windows-x86-32.exe [2008-11-9 204800]
S2 vsmon;TrueVector Internet Monitor;c:\windows\system32\zonelabs\vsmon.exe -service --> c:\windows\system32\zonelabs\vsmon.exe -service [?]
S3 FXDRV;FXDRV;\??\g:\fxdrv.sys --> g:\Fxdrv.sys [?]
S3 npf;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2007-1-25 42000]
S3 SIS163u;SiS163 USB Wireless LAN Adapter Driver;c:\windows\system32\drivers\sis163u.sys [2006-2-15 215552]

============== File Associations ===============

inifile=%SystemRoot%\System32\NOTEPAD.EXE %1"
piffile="%1" %*"

=============== Created Last 30 ================

2009-03-22 13:46 <DIR> --d----- c:\program files\Trend Micro
2009-03-21 20:27 3,840 a------- c:\windows\system32\drivers\BANTExt.sys
2009-03-21 20:27 <DIR> --d----- c:\program files\Belarc
2009-03-19 17:30 <DIR> --d----- c:\program files\Moai
2009-03-17 22:04 73,728 a------- c:\windows\system32\javacpl.cpl
2009-03-07 15:31 278,728 a------- c:\windows\system32\drivers\atksgt.sys
2009-03-07 15:31 25,416 a------- c:\windows\system32\drivers\lirsgt.sys
2009-03-07 15:28 73,728 a------- c:\windows\system32\ISUSPM.cpl

==================== Find3M ====================

2009-03-26 10:40 4,212 a---h--- c:\windows\system32\zllictbl.dat
2009-03-25 21:46 22,528 a------- c:\windows\system32\drivers\nhcDriver.sys
2009-03-25 19:50 8,904,260 a--sh--- c:\windows\system32\drivers\fidbox.idx
2009-03-25 19:50 664,961,056 a--sh--- c:\windows\system32\drivers\fidbox.dat
2009-03-07 15:32 107,888 a------- c:\windows\system32\CmdLineExt.dll
2008-09-26 03:13 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008092620080927\index.dat

============= FINISH: 17:08:21.78 ===============

[chemist]

Hello and Welcome to TSF.

Please Subscribe to this Thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant notification by email, then click Add Subscription.

Please note that the forum is very busy and if I don't hear from you within three days this thread will be closed.

Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions.

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding.
Ensure that there aren't any opened browsers when you are carrying out the procedures below.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

------------------------------------------------------

Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate.

Please stay with me until given the 'all clear' even if symptoms seemingly abate.

Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by a helper.

------------------------------------------------------

It appears that you have two antivirus programs installed and running, Symantec and ZoneAlarm, and two firewall programs installed and running, Symantec and NVIDIA. While this may seem like better protection, they can actually conflict with one another and cause system instability or even system hangs. Please choose one antivirus and one firewall to keep, and uninstall the others via Add or Remove Programs in your Control Panel.

If you uninstall Symantec, please do the following:

Please download the Norton Removal Tool and Save it to your Desktop.

• Close all programs and double-click the Norton_Removal_Tool.exe then click Run
• Follow the on-screen instructions.
• Restart the computer if asked.
• Then delete Norton_Removal_Tool.exe from your desktop.

------------------------------------------------------

While Spybot's TeaTimer is an excellent tool for the prevention of spyware, it can sometimes prevent tools from fixing certain things.
Please disable TeaTimer for now until you are clean. TeaTimer can be re-activated once your logs are clean.

• Open Spybot Search & Destroy.
• In the Mode menu click "Advanced mode" if not already selected.
• Choose "Yes" at the Warning prompt.
• Expand the "Tools" menu.
• Click "Resident".
• Uncheck the "Resident "TeaTimer" (Protection of overall system settings) active." box.
• If TeaTimer gives you a warning that changes were made, click the "Allow Change" box when prompted.
• In the File menu click "Exit" to exit Spybot Search & Destroy.

------------------------------------------------------

Download ResetTeaTimer

• and Save it to your Desktop.
• Double-click ResetTeaTimer.zip
• Double-click ResetTeaTimer.bat and click Run to remove all entries set by TeaTimer.
• A DOS window will open and close again, this is normal.

------------------------------------------------------

If for some reason during these fixes you receive prompts from Spybot about whether to Allow or Deny any changes, please Allow them all.

------------------------------------------------------

Please download ComboFix and Save it to your Desktop.

**Note: It is important that it is saved directly to your desktop**

First, we need to install the Windows Recovery Console.

The Windows Recovery Console will allow you to boot up into a special recovery(repair) mode, if needed. This allows us to help you in the case that your computer has a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Download the file from here:

http://files.filefront.com/WindowsXP.../fileinfo.html

Do not be concerned that this file is for SP2 and you have SP3. It will work just fine on your system.

Save it as it is originally named to your Desktop.

Now close all open windows and programs, including all antivirus and antispyware programs. Get help here



Then drag the setup package onto ComboFix.exe and drop it. Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Recovery Console.

As part of installing the Recovery Console, ComboFix will begin to run. Your desktop may disappear. This is normal. It will return.

ComboFix will now automatically install the Windows Recovery Console onto your computer, which will show up as a new option when booting up your computer. Do not select the Windows Recovery Console option when you start your computer unless requested to by a helper.

Once the Recovery Console is installed, this blue window will appear:



Please continue as follows:

• Close/disable all antivirus and antispyware programs so they do not interfere with the running of ComboFix. Get help here
• Please click Yes to continue scanning for malware.

When the tool is finished, it will produce a log for you.

Please post that log, ComboFix.txt, in your next reply.

------------------------------------------------------

[kaito1412]

Hi chemist,

First of all, thank you for helping me with my issue. Before I continue with your recommended steps, I would like two clarifications.

Originally Posted by chemist

It appears that you have two antivirus programs installed and running, Symantec and ZoneAlarm, and two firewall programs installed and running, Symantec and NVIDIA.

With regards to my firewall, I believe my firewall programs are ZoneAlarm and NVIDIA. While I have no issues with uninstalling NVIDIA, will keeping NVIDIA installed (but disabled) affect anything?

Similarly, with regards to my antivirus programs, I only run Symantec with ZoneAlarm's antivirust disabled. I have a stronger disincentive to uninstall ZoneAlarm since it's antivirus is bundled in the Internet Security Suite and I like ZoneAlarm's firewall. Again, is there a way to keep both without having them affect each other?

Thanks again for your time!

[chemist]

I meant ZoneAlarm, LOL.

Even if it is disabled, it can still conflict with the one that is running.

You should only have one AV and one FW installed.

[kaito1412]

Which combination would you recommend I keep? ZoneAlarm, or NVIDIA and Symantec?

[chemist]

If it were me, I would keep ZoneAlarm. If you uninstall Symantec, remember to run the Norton Removal Tool.

[kaito1412]

Originally Posted by chemist

Please post that log, ComboFix.txt, in your next reply.

Please find ComboFix.txt, attached.

ComboFix 09-03-27.02 - kaito 2009-03-29 19:55:09.1 - NTFSx86 MINIMAL
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3326.3035 [GMT -4:00]
Running from: c:\documents and settings\kaito\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\kaito\Desktop\WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
AV: ZoneAlarm Security Suite Antivirus *On-access scanning disabled* (Outdated)
FW: ZoneAlarm Security Suite Firewall *disabled*
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\IE4 Error Log.txt
c:\windows\system32\Cache
c:\windows\system32\WMVSDECD.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_PCIDump


((((((((((((((((((((((((( Files Created from 2009-02-28 to 2009-03-30 )))))))))))))))))))))))))))))))
.

2009-03-29 20:06 . 2009-03-29 20:08 <DIR> d-------- c:\windows\LastGood
2009-03-29 18:36 . 2009-03-29 18:36 <DIR> d-------- c:\documents and settings\All Users\Application Data\NortonInstaller
2009-03-26 21:19 . 2009-03-26 21:19 <DIR> d-------- c:\program files\iPod
2009-03-26 21:18 . 2009-03-26 21:20 <DIR> d-------- c:\program files\iTunes
2009-03-26 21:18 . 2009-03-26 21:20 <DIR> d-------- c:\documents and settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
2009-03-26 21:12 . 2009-03-26 21:14 <DIR> d-------- c:\program files\QuickTime
2009-03-26 20:54 . 2009-03-26 20:55 <DIR> d-------- c:\program files\Safari
2009-03-26 20:51 . 2009-03-26 20:51 <DIR> d-------- c:\program files\Bonjour
2009-03-26 20:25 . 2009-03-26 20:25 0 --ah---t- C:\pcwtest.tmp
2009-03-22 13:46 . 2009-03-22 13:46 <DIR> d-------- c:\program files\Trend Micro
2009-03-21 20:27 . 2009-03-21 20:27 <DIR> d-------- c:\program files\Belarc
2009-03-21 20:27 . 2008-02-27 13:49 3,840 --a------ c:\windows\system32\drivers\BANTExt.sys
2009-03-19 17:30 . 2009-03-19 17:30 <DIR> d-------- c:\program files\Moai
2009-03-17 22:04 . 2008-06-10 02:32 73,728 --a------ c:\windows\system32\javacpl.cpl
2009-03-12 09:22 . 2009-03-12 09:22 <DIR> d-------- c:\program files\Common Files\Adobe AIR
2009-03-09 09:12 . 2009-03-09 09:18 <DIR> d-------- c:\documents and settings\kaito\Application Data\U3
2009-03-07 15:39 . 2009-03-07 15:39 <DIR> d-------- c:\documents and settings\All Users\Application Data\InstallShield
2009-03-07 15:31 . 2009-03-07 15:31 278,728 --a------ c:\windows\system32\drivers\atksgt.sys
2009-03-07 15:31 . 2009-03-07 15:31 25,416 --a------ c:\windows\system32\drivers\lirsgt.sys
2009-03-07 15:28 . 2004-08-09 06:04 73,728 --a------ c:\windows\system32\ISUSPM.cpl
2009-02-12 01:17 . 2009-02-12 01:17 44 --a------ c:\windows\system32\1234415847.(null)

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-30 00:08 670,037,792 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-03-30 00:07 22,528 ----a-w c:\windows\system32\drivers\nhcDriver.sys
2009-03-29 23:47 8,977,460 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-03-27 14:21 --------- d-----w c:\documents and settings\kaito\Application Data\uTorrent
2009-03-27 01:19 --------- d-----w c:\program files\Common Files\Apple
2009-03-27 00:54 --------- d-----w c:\program files\FlashGet
2009-03-25 03:32 --------- d-----w c:\program files\Real Alternative
2009-03-22 16:04 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-03-22 15:55 --------- d-----w c:\program files\Spybot - Search & Destroy
2009-03-18 02:40 --------- d-----w c:\program files\Freenet
2009-03-12 13:20 --------- d-----w c:\program files\Common Files\Adobe
2009-03-07 23:42 --------- d--h--w c:\program files\InstallShield Installation Information
2009-03-07 19:33 --------- d-----w c:\program files\AGEIA Technologies
2009-03-07 19:31 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-03-07 19:28 --------- d-----w c:\program files\Common Files\InstallShield
2009-02-23 01:11 1,599,769 ----a-w c:\windows\Internet Logs\tvDebug.Zip
2009-02-08 21:19 4,072,448 ----a-w c:\windows\Internet Logs\xDB14.tmp
2009-02-06 04:58 --------- d-----w c:\program files\MSN Messenger
2009-02-06 04:58 --------- d-----w c:\program files\Messenger Plus! Live
2009-02-03 10:46 158,822 ----a-w c:\windows\Internet Logs\vsmon_2nd_2009_02_03_05_46_07_small.dmp.zip
2009-01-31 15:46 --------- d-----w c:\documents and settings\kaito\Application Data\Screenshot Sender
2009-01-31 15:37 --------- d-----w c:\program files\Windows Live
2009-01-21 06:29 3,354,112 ----a-w c:\windows\Internet Logs\xDB13.tmp
2009-01-16 18:14 155,663 ----a-w c:\windows\Internet Logs\vsmon_2nd_2009_01_16_13_13_58_small.dmp.zip
2009-01-13 21:45 2,758,144 ----a-w c:\windows\Internet Logs\xDB12.tmp
2009-01-12 02:27 148,944 ----a-w c:\windows\Internet Logs\vsmon_2nd_2009_01_11_21_26_35_small.dmp.zip
2009-01-10 10:10 153,431 ----a-w c:\windows\Internet Logs\vsmon_2nd_2009_01_10_05_10_14_small.dmp.zip
2009-01-06 17:11 3,339,264 ----a-w c:\windows\Internet Logs\xDB11.tmp
2008-12-07 18:30 3,760,640 ----a-w c:\windows\Internet Logs\xDBF.tmp
2008-12-07 18:30 3,281,408 ----a-w c:\windows\Internet Logs\xDB10.tmp
2008-09-26 07:13 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008092620080927\index.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"Orb"="c:\program files\Winamp Remote\bin\OrbTray.exe" [2007-10-22 360448]
"Eraser"="c:\program files\Eraser\Eraser.exe" [2007-07-28 277328]
"NVIDIA nTune"="c:\program files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-09-04 81920]
"Bandwidth Monitor Pro"="c:\program files\Bandwidth Monitor Pro\Bandwidth Monitor Pro.exe" [2008-11-24 224768]
"Ida"="c:\program files\Ida\IdaLaunch.exe" [2008-12-03 36512]
"Google Update"="c:\documents and settings\kaito\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-01-03 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"DAEMON Tools-1033"="c:\program files\D-Tools\daemon.exe" [2004-08-22 81920]
"awxDTools"="c:\progra~1\arniWORX\AWXDTO~1\awxDTools.dll" [2005-03-17 126976]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"NotebookHardwareControl"="c:\program files\Notebook Hardware Control\nhc.exe" [2007-05-03 2629632]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-10-09 981904]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-07 86016]
"BigDogPath"="c:\windows\VM301Snap.exe" [2007-03-27 49152]
"Domino"="c:\windows\Domino.exe" [2006-07-04 49152]
"googletalk"="c:\program files\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-03-12 342312]
"nwiz"="nwiz.exe" [2008-10-07 c:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.ffds"= c:\progra~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll
"msacm.ac3filter"= ac3filter.acm

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ScheduleTV.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\ScheduleTV.lnk
backup=c:\windows\pss\ScheduleTV.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2009-03-12 20:56 342312 c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2009-01-05 16:18 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TV Card Remote Control Applet]
-ra------ 2004-11-30 00:00 286720 c:\windows\878RMT.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2007-10-10 01:28 36352 c:\program files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
-r------- 2005-09-22 04:42 90112 c:\windows\soundman.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"googletalk"=c:\program files\Google\Google Talk\googletalk.exe /autostart
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime
"Start WingMan Profiler"=c:\program files\Logitech\Gaming Software\LWEMon.exe /noui

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
"c:\\Program Files\\FlashGet\\flashget.exe"=
"c:\\Program Files\\Shareaza\\Shareaza.exe"=
"c:\\Documents and Settings\\kaito\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.dll"=
"c:\\Documents and Settings\\kaito\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"i:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6346:TCP"= 6346:TCP:ShareazaTCP
"6346:UDP"= 6346:UDP:ShareazaUDP

R2 878TVCard;Bt878 TV Card - Video Capture;c:\windows\system32\drivers\Bt878.sys [2007-01-03 196608]
R2 878TVTuner;Bt878 TV Card - TV Tuner;c:\windows\system32\drivers\BtTuner.sys [2007-01-03 9088]
R2 878Xbar;Bt878 TV Card - Crossbar;c:\windows\system32\drivers\BtXbar.sys [2007-01-03 8448]
R2 UltraMonUtility;UltraMon Utility Driver;c:\program files\Common Files\Realtime Soft\UltraMonMirrorDrv\x32\UltraMonUtility.sys [2008-09-14 10496]
R3 AmdTools;AMD Special Tools Driver;c:\windows\system32\drivers\AmdTools.sys [2008-10-27 34304]
R3 SIS163u;SiS163 USB Wireless LAN Adapter Driver;c:\windows\system32\drivers\sis163u.sys [2006-02-15 215552]
R3 SISNPF;SIS Netgroup Packet Filter;c:\windows\system32\drivers\SISNPF.SYS [2005-12-23 31872]
S2 freenet-darknet-8888;Freenet 0.7 darknet-8888;c:\program files\Freenet\bin\wrapper-windows-x86-32.exe [2008-11-09 204800]
S3 cpuz129;cpuz129;i:\downloads\Software\CPUID\pcwiz32.sys [2009-03-26 9600]
S3 FXDRV;FXDRV;\??\g:\fxdrv.sys --> g:\Fxdrv.sys [?]
S3 npf;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2007-01-25 42000]
.
Contents of the 'Scheduled Tasks' folder

2009-03-01 c:\windows\Tasks\defrag c.job
- c:\windows\system32\defrag.exe [2008-04-13 20:12]

2009-03-08 c:\windows\Tasks\defrag d.job
- c:\windows\system32\defrag.exe [2008-04-13 20:12]

2009-03-15 c:\windows\Tasks\defrag e.job
- c:\windows\system32\defrag.exe [2008-04-13 20:12]

2009-03-22 c:\windows\Tasks\defrag f.job
- c:\windows\system32\defrag.exe [2008-04-13 20:12]

2009-03-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1409082233-1532298954-839522115-1003.job
- c:\documents and settings\kaito\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-01-03 15:28]
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-AMD_Display - (no file)
Notify-NavLogon - (no file)
MSConfigStartUp-Adobe Reader Speed Launcher - c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe


.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.ca/
uInternet Settings,ProxyOverride = *.local
IE: &Download All with FlashGet - c:\program files\FlashGet\jc_all.htm
IE: &Download with FlashGet - c:\program files\FlashGet\jc_link.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\kaito\Application Data\Mozilla\Firefox\Profiles\b0lvp3za.Lite\
FF - prefs.js: browser.startup.homepage - hxxp://www.redflagdeals.com/deals/main.php/alldeals/comments/toronto_public_library_offers_free_admissions_to_ago_casa_loma_many_more_mu
FF - plugin: c:\documents and settings\kaito\Application Data\Mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\documents and settings\kaito\Local Settings\Application Data\Google\Update\1.2.141.5\npGoogleOneClick7.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
.
.
------- File Associations -------
.
inifile=%SystemRoot%\System32\NOTEPAD.EXE %1"
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-29 20:04:23
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


c:\windows\LastGood
c:\windows\system32\cdm.dll.wusetup.453781.bak 94920 bytes executable

scan completed successfully
hidden files: 2

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ZoneLabs\vsmon.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
c:\program files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe
c:\program files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
c:\program files\NVIDIA Corporation\nTune\nTuneService.exe
c:\windows\system32\nvsvc32.exe
c:\program files\TRENDnet\TEW-424UB\SiSWLSvc.exe
c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\rundll32.exe
c:\program files\UltraMon\UltraMon.exe
c:\program files\TRENDnet\TEW-424UB\TRENDnet.exe
c:\program files\UltraMon\UltraMonTaskbar.exe
c:\program files\Ida\Ida.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2009-03-29 20:17:19 - machine was rebooted
ComboFix-quarantined-files.txt 2009-03-30 00:16:33

Pre-Run: 10,749,902,848 bytes free
Post-Run: 7,353,700,352 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

249 --- E O F --- 2008-10-24 08:11:28

[chemist]

Hello kaito. Please tell us how your system is behaving.

Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions.

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding.
Ensure that there aren't any opened browsers when you are carrying out the procedures below.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

------------------------------------------------------

I see you have FlashGet installed on your system. We recommend uninstalling it via Add or Remove Programs in your Control Panel.

Please read here and here

------------------------------------------------------

I see you have P2P software ( uTorrent and Shareaza ) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares.

References for the risk of these programs are here, here, and here.

I would strongly recommend that you uninstall them, however that choice is up to you. If you choose to remove these programs, you can do so via Control Panel >> Add or Remove Programs.

------------------------------------------------------

Go Start > Run and copy/paste the following single-line command into the Run box and click OK:

sc delete FXDRV

A DOS window will open and close again, this is normal.

------------------------------------------------------

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version Java components and update.

• Download the latest version of Java Runtime Environment (JRE) 6 and Save it to your Desktop.
• Scroll down to where it says Java Runtime Environment (JRE) 6 Update 13 The Java SE Runtime Environment (JRE) allows end-users to run Java applications.
• Click the Download button to the right.
• Select the Windows platform from the dropdown menu.
• Read the License Agreement and then check the box that says: I agree to the Java SE Runtime Environment 6 with JavaFX License Agreement
• Click Continue The page will refresh.
• Click on the link to download Windows Offline Installation and Save the file to your Desktop.
• Close any programs you may have running - especially your web browser.
• Go to Start(or My Computer) > Control Panel and double-click on Add or Remove Programs and remove all older versions of Java.
• Click (highlight) any item with Java Runtime Environment (JRE, J2SE, Java(TM) SE or Java(TM) 6) in the name.
• Click the Remove or Change/Remove button.
• Repeat as many times as necessary to remove each Java version.
• Reboot your computer once all Java components are removed.
• Then from your desktop double-click on jre-6u13-windows-i586-p.exe to install the newest version.

• After the install is complete, go back to your Control Panel(using Classic View) and click the Java icon. (looks like a coffee cup)
  • On the General tab, under Temporary Internet Files, click the Settings button.
  • Next, click on the Delete Files button.
  • There are two options in the window to clear the cache - Leave BOTH Checked
    • Applications and Applets
    • Trace and Log Files
  • Click OK on Delete Temporary Files Window.
    Note: This deletes ALL the Downloaded Applications and Applets from the CACHE
  • Click OK to leave the Temporary Files Window.
  • Click OK to leave the Java Control Panel.
  • Delete jre-6u13-windows-i586-p.exe from your desktop.

------------------------------------------------------

Please download ATF-Cleaner by Atribune and Save it to your Desktop.

• Double-click ATF-Cleaner.exe to run the program.
• Under Main choose: Select All
• Click the Empty Selected button.

If you use Firefox browser

• Click Firefox at the top and choose: Select All
• Click the Empty Selected button.
• NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

• Click Opera at the top and choose: Select All
• Click the Empty Selected button.
• NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

------------------------------------------------------

Please run this online scan to help look for remnants.

Establish an internet connection & perform an online scan at Kaspersky Online Scanner

Ensure your external and/or USB drives are inserted during the scan.

Click Accept, when prompted to download and install the program files and database of malware definitions.

• Click Run at any Security prompt.
• The program will then begin downloading and installing and will also update the database.
• Please be patient as this can take several minutes.
• Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
• Once the scan is complete, it will display if your system has been infected.
• It does not provide an option to clean/disinfect. We only require a report from it.
• Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
• Click View scan report at the bottom.
• Click the Save Report As... button.
• Click the Save as Text button to save the file to your desktop so that you may post it in your next reply.

**Note**

To optimize scanning time and produce a more sensible report for review:

• Close any open programs.
• Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.

Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.

------------------------------------------------------

Please post the following in your next reply:

Kaspersky report
report on system behavior

[kaito1412]

Is it normal that Kaspersky Online Scanner is running at 100% CPU Usage during the entirety of the scan?

[chemist]

Did you disable ZoneAlarm AV and FW?

[kaito1412]

AV, yes. FW, no. I didn't disable the firewall because I don't feel protected online without it. If I should disable the firewall, will the online scanner still work offline?

[chemist]

Kaspersky is an online scanner. You will have to disable your FW during the scan.

[kaito1412]

Wouldn't that expose my computer to the internet while it's scanning?

[chemist]

You will only be at the Kaspersky site.

[kaito1412]

Is there another scanner you can recommend? I've been scanning my disks nearly non-stop for the last three days, even with my AV and FW disabled and my computer doing absolutely nothing but scanning, but I've only managed to scan about half my disks.

Granted, I do have nearly 1.5 TB of total disk space (only of which 1.1 TB is used), but I don't think it's normal for Kaspersky to go to 100% CPU usage for minutes on end, essentially freezing my computer, when I have 3.25 GB of RAM and an AMD Athlon 64 3500+. It's not a fast computer, but my understanding is that it would be more than enough to handle a virus scan in under three days.

On an unrelated note, but for the Kaspersky scan, it seems like the initial problem has been rectified. I can download files from Microsoft now, as well as updates from Zone Alarm's and Spybot's respective sites.

[chemist]

Try one of these:

Go here to run an online scannner from ESET.

• Note: You will need to use Internet Explorer for this scan.
• Turn off the real-time scanner of any existing antivirus program while performing the online scan.
• Tick the box next to YES, I accept the Terms of Use.
• Click Start
• When asked, allow the activex control to install.
• Click Start
• Make sure that the option Remove found threats is unticked, and the option Scan unwanted applications is checked.
• Click Scan
• Wait for the scan to finish.
• Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
• Copy and paste that log as a reply to this topic and also let me know how things are now.

------------------------------------------------------

If you have trouble with your computer blocking the ActiveX, go here and temporarily turn the feature off:

http://www.windowsreference.com/inte...the-publisher/

Remember to turn it back on after the scan!

------------------------------------------------------

Perform an online scan with Panda ActiveScan

• Click on Scan Your PC Now
• A "pop up" window will appear, or a new tab will open.
• Click on Register
• Choose the option you like most, but we recommend the Free Registration.
• Click on Register
• Enter your e-mail address, and create a password.
• Select "I do not want to receive any type of information" (unless you want to receive such information)
• Click on Send
• Confirm registration, and continue by entering your user name and password, then click on Enter
• Select Full Scan, then Click on Scan Now
• Wait for the components to be loaded and installed. Don't close this window or go to another page while it is downloading. You can continue using the Internet by opening another window in your browser.
• If it finds any malware it can disinfect, the Disinfect button will be enabled. Click on Disinfect
• Please ignore the offer to buy the program. Click on Export to
  
• Export the log and Save it to your Desktop.
• Please post the contents of that log in your next reply.

**Note**
To optimize scanning time and produce a more sensible report for review:

• Close any open programs.
• Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.

------------------------------------------------------

[chemist]

Try one of these:

Go here to run an online scannner from ESET.

• Note: You will need to use Internet Explorer for this scan.
• Turn off the real-time scanner of any existing antivirus program while performing the online scan.
• Tick the box next to YES, I accept the Terms of Use.
• Click Start
• When asked, allow the activex control to install.
• Click Start
• Make sure that the option Remove found threats is unticked, and the option Scan unwanted applications is checked.
• Click Scan
• Wait for the scan to finish.
• Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
• Copy and paste that log as a reply to this topic and also let me know how things are now.

------------------------------------------------------

If you have trouble with your computer blocking the ActiveX, go here and temporarily turn the feature off:

http://www.windowsreference.com/inte...the-publisher/

Remember to turn it back on after the scan!

------------------------------------------------------

Perform an online scan with Panda ActiveScan

• Click on Scan Your PC Now
• A "pop up" window will appear, or a new tab will open.
• Click on Register
• Choose the option you like most, but we recommend the Free Registration.
• Click on Register
• Enter your e-mail address, and create a password.
• Select "I do not want to receive any type of information" (unless you want to receive such information)
• Click on Send
• Confirm registration, and continue by entering your user name and password, then click on Enter
• Select Full Scan, then Click on Scan Now
• Wait for the components to be loaded and installed. Don't close this window or go to another page while it is downloading. You can continue using the Internet by opening another window in your browser.
• If it finds any malware it can disinfect, the Disinfect button will be enabled. Click on Disinfect
• Please ignore the offer to buy the program. Click on Export to
  
• Export the log and Save it to your Desktop.
• Please post the contents of that log in your next reply.

**Note**
To optimize scanning time and produce a more sensible report for review:

• Close any open programs.
• Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.

------------------------------------------------------

[kaito1412]

Results from Panda ActiveScan:

;***********************************************************************************************************************************************************************************
ANALYSIS: 2009-04-02 22:51:55
PROTECTIONS: 1
MALWARE: 30
SUSPECTS: 7
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description Version Active Updated
;===================================================================================================================================================================================
ZoneAlarm Security Suite Antivirus 8.0.059.000 No No
;===================================================================================================================================================================================
MALWARE
Id Description Type Active Severity Disinfectable Disinfected Location
;===================================================================================================================================================================================
00024402 Exploit/iFrame HackTools No 0 Yes No E:\Program Files\Netscape\Users\rocket\Mail\Sarina.sbd\Sent[~0000008.~]
00024402 Exploit/iFrame HackTools No 0 Yes No E:\Program Files\Netscape\Users\rocket\Mail\Sarina.sbd\Sent[~0000005.~]
00049146 Joke/Bean Jokes No 0 Yes No E:\_ A Desktop\Gary's Folder\Mo Lui Things\Sth From Stanley or Sheena\bean.exe
00052042 Trj/Nuker.A Virus/Trojan No 0 Yes Yes E:\_ A Desktop\Old C\Done\Users.zip[rocket/Mail/Patrick][winnuke.exe][WINNUKE.EXE]
00052042 Trj/Nuker.A Virus/Trojan No 0 Yes Yes E:\_ A Desktop\My Documents\Non Frequently Accessed Files\To be backed up\Ready\mail2.zip[Patrick][winnuke.exe][WINNUKE.EXE]
00057805 Spammer/AnomMail HackTools No 0 Yes No E:\_ A Desktop\My Documents\Non Frequently Accessed Files\To be backed up\Ready\Very Good.zip[anonmail.zip][anonmail.exe]
00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No E:\Old Laptop\Documents and Settings\GM\Local Settings\Temp\Cookies\gm@casalemedia[1].txt
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No E:\Mobile Disk\Old C\FOUND.001\FILE0001.CHK[.doubleclick.net/]
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No E:\Mobile Disk\Old C\Documents and Settings\1412\Application Data\Mozilla\Profiles\gaajtz0m.default\cookies.txt[.doubleclick.net/]
00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No E:\Mobile Disk\Old C\Documents and Settings\1412\Cookies\1412@atdmt[2].txt
00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No E:\Old Laptop\Documents and Settings\GM\Application Data\Mozilla\Profiles\default\kd4thd6q.slt\cookies.txt[.atdmt.com/]
00145393 Cookie/Tradedoubler TrackingCookie No 0 Yes No E:\Mobile Disk\Old C\Documents and Settings\1412\Cookies\1412@tradedoubler[1].txt
00145457 Cookie/FastClick TrackingCookie No 0 Yes No E:\Mobile Disk\Old C\FOUND.001\FILE0001.CHK[.fastclick.net/]
00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No E:\Old Laptop\Documents and Settings\GM\Local Settings\Temp\Cookies\gm@tribalfusion[2].txt
00152401 Cookie/Belnk TrackingCookie No 0 Yes No E:\Mobile Disk\Old C\Documents and Settings\1412\Cookies\1412@belnk[1].txt
00162730 Cookie/Belnk TrackingCookie No 0 Yes No E:\Mobile Disk\Old C\Documents and Settings\1412\Cookies\1412@dist.belnk[3].txt
00162730 Cookie/Belnk TrackingCookie No 0 Yes No E:\Mobile Disk\Old C\Documents and Settings\1412\Cookies\1412@dist.belnk[2].txt
00167690 Cookie/Rightmedia TrackingCookie No 0 Yes No E:\Old Laptop\Documents and Settings\GM\Local Settings\Temp\Cookies\gm@rightmedia[2].txt
00167704 Cookie/Xiti TrackingCookie No 0 Yes No E:\Old Laptop\Documents and Settings\GM\Local Settings\Temp\Cookies\gm@xiti[1].txt
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No E:\Mobile Disk\Old C\FOUND.001\FILE0001.CHK[.ad.yieldmanager.com/]
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No E:\Mobile Disk\Old C\FOUND.001\FILE0001.CHK[.ad.yieldmanager.com/]
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No E:\Mobile Disk\Old C\Documents and Settings\1412\Cookies\1412@ad.yieldmanager[3].txt
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No E:\Mobile Disk\Old C\Documents and Settings\1412\Cookies\1412@ad.yieldmanager[2].txt
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No E:\Mobile Disk\Old C\FOUND.001\FILE0001.CHK[.ad.yieldmanager.com/]
00168114 Cookie/onestat.com TrackingCookie No 0 Yes No E:\Old Laptop\Documents and Settings\GM\Local Settings\Temp\Cookies\gm@stat.onestat[2].txt
00170087 Cookie/Hbmediapro TrackingCookie No 0 Yes No E:\Mobile Disk\Old C\Documents and Settings\1412\Cookies\1412@adopt.hbmediapro[2].txt
00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No E:\Mobile Disk\Old C\Documents and Settings\1412\Application Data\Mozilla\Profiles\7x97xbe6.1412\cookies.txt[.questionmarket.com/]
00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No E:\Mobile Disk\Old C\Documents and Settings\1412\Application Data\Mozilla\Profiles\7x97xbe6.1412\cookies.txt[.questionmarket.com/]
00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No E:\Mobile Disk\Old C\Documents and Settings\1412\Application Data\Mozilla\Profiles\7x97xbe6.1412\cookies.txt[.questionmarket.com/]
00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No E:\Mobile Disk\Old C\Documents and Settings\1412\Application Data\Mozilla\Firefox\Profiles\7x97xbe6.1412\cookies.txt[.questionmarket.com/]
00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No E:\Mobile Disk\Old C\Documents and Settings\1412\Application Data\Mozilla\Firefox\Profiles\7x97xbe6.1412\cookies.txt[.questionmarket.com/]
00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No E:\Mobile Disk\Old C\Documents and Settings\1412\Application Data\Mozilla\Firefox\Profiles\7x97xbe6.1412\cookies.txt[.questionmarket.com/]
00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No E:\Mobile Disk\Old C\Documents and Settings\1412\Application Data\Mozilla\Firefox\Profiles\7x97xbe6.1412\cookies.txt[.questionmarket.com/]
00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No E:\Mobile Disk\Old C\Documents and Settings\1412\Application Data\Mozilla\Profiles\7x97xbe6.1412\cookies.txt[.questionmarket.com/]
00173520 Cookie/Bluestreak TrackingCookie No 0 Yes No E:\Old Laptop\Documents and Settings\GM\Local Settings\Temp\Cookies\gm@bluestreak[1].txt
00194327 Cookie/Go TrackingCookie No 0 Yes No E:\Old Laptop\Documents and Settings\GM\Local Settings\Temp\Cookies\gm@go[1].txt
00199231 HackTool/EvID HackTools No 0 Yes No C:\Documents and Settings\kaito\My Documents\EvID4226Patch223d-en\EvID4226Patch.exe
00199231 HackTool/EvID HackTools No 0 Yes No C:\Documents and Settings\kaito\My Documents\EvID4226Patch223d-en.zip[EvID4226Patch.exe]
00243514 Trj/BO.K Virus/Trojan No 0 Yes Yes E:\_ A Desktop\My Documents\Computer Research\BO\back orfice 120.zip[MELT.EXE]
00262020 Cookie/Atwola TrackingCookie No 0 Yes No E:\Old Laptop\Documents and Settings\GM\Local Settings\Temp\Cookies\gm@atwola[2].txt
00262020 Cookie/Atwola TrackingCookie No 0 Yes No E:\Mobile Disk\Old C\Documents and Settings\1412\Application Data\Mozilla\Firefox\Profiles\7x97xbe6.1412\cookies.txt[.atwola.com/]
00262020 Cookie/Atwola TrackingCookie No 0 Yes No E:\Mobile Disk\Old C\Documents and Settings\1412\Application Data\Mozilla\Profiles\7x97xbe6.1412\cookies.txt[.atwola.com/]
00379444 Trj/BO.L Virus/Trojan No 0 Yes Yes E:\_ A Desktop\My Documents\Computer Research\BO\back orfice 120.zip[FREEZE.EXE]
00834118 Generic Backdoor Virus/Trojan No 0 Yes Yes E:\_ A Desktop\My Documents\Non Frequently Accessed Files\To be backed up\Ready\part1.zip[fip.zip][DC_IS.EXE]
01079664 Generic Trojan Virus/Trojan No 0 Yes Yes C:\Documents and Settings\kaito\My Documents\Downloads\Game Cam\Game_Cam_v1.4.zip[game.cam.v1.4-patch.exe]
01079664 Generic Trojan Virus/Trojan No 0 Yes Yes C:\Documents and Settings\kaito\My Documents\Downloads\Game Cam\game.cam.v1.4-patch.exe
01303862 Adware/ShowBehind Adware No 0 Yes No E:\Old Laptop\Documents and Settings\GM\My Documents\Programs\cspmario.zip[spmario.exe]
02222060 Generic Malware Virus/Trojan No 0 Yes Yes E:\Old Laptop\Program Files\Messenger Plus! 3\MsgPlus.exe
02885963 Rootkit/Booto.C Virus/Worm No 0 Yes Yes C:\System Volume Information\_restore{82A8330D-58ED-417B-ADD9-ACCF72464E43}\RP354\A0161298.sys
03881124 W32/Spamta.QO.worm Virus/Worm No 0 Yes Yes E:\_ A Desktop\My Documents\Non Frequently Accessed Files\To be backed up\Ready\part1.zip[dumb_cm4.zip][CMASTER4.EXE]
03986771 Generic Malware Virus/Trojan No 0 Yes Yes E:\M\My Shared Folder\kmd202gu_en (2).exe
;===================================================================================================================================================================================
SUSPECTS
Sent Location ^
;===================================================================================================================================================================================
No C:\Documents and Settings\kaito\Local Settings\Temporary Internet Files\Content.IE5\L6SXOQ7J\videoByTag[2].aspx
No E:\Mobile Disk\Old D\Downloads\MinUWet\minuwet.exe ^
No E:\Old Laptop\Documents and Settings\GM\My Documents\Programs\Music\Kazaa Lite\kazaalite_v200.zip[second stage/Kazaa.exe]
No E:\Old Laptop\Program Files\NokiaFREE Unlock Codes Calculator\NokiaFREE_CALC.exe ^
No E:\Program Files\Digimon\Uninstall.exe ^
No E:\Program Files\ICQ\NDETECT.EXE ^
No I:\My Documents\Computers\Virus Removal\ComboFix.exe ^
;===================================================================================================================================================================================
VULNERABILITIES
Id Severity Description ^
;===================================================================================================================================================================================
;===================================================================================================================================================================================

[chemist]

Hello again, kaito. Please ensure your E: and I: drives are inserted during this fix.

Open Notepad and copy/paste the entire contents of the codebox below into Notepad:

@echo off
if exist "%temp%\log.txt" del "%temp%\log.txt"

for %%g in (

"C:\Documents and Settings\kaito\Local Settings\Temporary Internet Files\Content.IE5\L6SXOQ7J\videoByTag[2].aspx"
"C:\Documents and Settings\kaito\My Documents\EvID4226Patch223d-en.zip"
"C:\Documents and Settings\kaito\My Documents\EvID4226Patch223d-en\EvID4226Patch.exe"
"E:\_ A Desktop\Gary's Folder\Mo Lui Things\Sth From Stanley or Sheena\bean.exe"
"E:\_ A Desktop\My Documents\Non Frequently Accessed Files\To be backed up\Ready\Very Good.zip"
"E:\Mobile Disk\Old D\Downloads\MinUWet\minuwet.exe"
"E:\Old Laptop\Documents and Settings\GM\My Documents\Programs\cspmario.zip"
"E:\Old Laptop\Documents and Settings\GM\My Documents\Programs\Music\Kazaa Lite\kazaalite_v200.zip"
"E:\Old Laptop\Program Files\NokiaFREE Unlock Codes Calculator\NokiaFREE_CALC.exe"
"E:\Program Files\Digimon\Uninstall.exe"
"E:\Program Files\ICQ\NDETECT.EXE"
"I:\My Documents\Computers\Virus Removal\ComboFix.exe"

) do (
del /a/f/q %%g >nul 2>&1
if exist %%g echo.%%~g>>"%temp%\log.txt"
)


if exist "%temp%\log.txt" ( start notepad "%temp%\log.txt"
) else echo.Deleted Successfully !!

pause
del %0

Save this Notepad file as fix.bat and choose to Save as type: - All Files then close the Notepad file.
It should look like this:

Double-click on fix.bat to run it.

Tell me what it says in your next reply. Press any key to continue.

------------------------------------------------------

[kaito1412]

"Deleted Successfully !!"