Links keep redirecting, I.E acting wacko, etc.

Alyssapie · 07-09-2009, 08:56 AM

Hey all. Well, to start off- I'm not exactly sure what happened.
Some time last week my computer started acting a bit crazy. Popups kept popping up, and Firefox and I.E would randomly shut down on me when I tried to search something. I noticed it started doing this right after my mom used the computer for god knows what. She claimed she only checked her email and looked up her horoscope, but who knows. But she did tell me that all of her messages in her email account had been deleted somehow. And she had over 100 messages... I dont know how that happened. Maybe it's some stupid email virus?

I ran Ad-Aware, and it detected and deleted a few things.
I downloaded a couple programs. I tried Trojan Hunter at first, but every time I opened it, one of those annoying "...has encountered a problem. We're sorry if you were in the middle of something, blah blah blah" errors. So I gave up and uninstalled it... and tried BitDefender instead. I ran several scans, and it detected several things and got rid of them all! I also tried Spyware Doctor, which as also gotten rid of several things! I ran it once more, earlier today, to check if anything else was left, and it claims no more malicious crap is found on here.

No more popups, and FireFox seems to be working fine... except for two things: Any link I go to is still being redirected to another random site, particularly two sites: Either a false anti-virus scanner website, or a random search site (cant remember the name). Other times, it'll be redirected, but FireFox will block it, saying it is a reported attack site.

Not to mention Internet Explorer is still acting a bit crazy, shutting down on me randomly. But I havent noticed much, because I've been using FireFox mostly. :/ ..... OH! And some applications that I attempt to install... wont load to install them. And HijackThis wont load up, either. So I cant use that... There were a couple of other spyware/trojan programs I attempted to use but gave up because they wouldnt load at all, either. But I forget their names...

Anyway, I've given up on the scanners.
I've ran them so many times, and even though a bunch of crap has been detected and deleted, it still continues to act wacky. So here I am, to my last resort, asking for help! Please.

EDIT: Oh wow, I've noticed there are a whole bunch of "Google Redirecting" threads lately. Wow. .....

DDS (Ver_09-06-26.01) - NTFSx86
Run by Alyssa at 21:50:33.40 on Wed 07/08/2009
Internet Explorer: 6.0.2900.2180
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.446.60 [GMT -4:00]

FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\system32\svchost -k rpcss
C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\svchost.exe -k drv
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\BitDefender\BitDefender 2009\seccenter.exe
C:\WINDOWS\System32\alg.exe
c:\windows\system\hpsysdrv.exe
C:\Program Files\Mozilla FireFox\firefox.exe
C:\Documents and Settings\Alyssa\Desktop\dds.scr
C:\WINDOWS\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://alyssaerin.webs.com/home.htm
uSearch Page = hxxp://www.google.com
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PRESARIO&pf=desktop
uSearch Bar = hxxp://www.google.com/ie
mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=64&bd=PRESARIO&pf=desktop
mDefault_Search_URL = hxxp://www.google.com/ie
mSearch Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PRESARIO&pf=desktop
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=64&bd=PRESARIO&pf=desktop
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PRESARIO&pf=desktop
uInternet Connection Wizard,ShellNext = iexplore
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn0\yt.dll
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\progra~1\yahoo!\companion\installs\cpn0\yt.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: {D76AB2A1-00F3-42BD-F434-00BBC39C8953} - No File
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll
uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
uRun: [Aim6]
uRun: [uTorrent] "c:\program files\utorrent\uTorrent.exe"
uRun: [AROReminder] c:\program files\advanced registry optimizer\ARO.exe -rem
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [GridinSoft Trojan Killer] "c:\program files\trojan killer\trojankiller.exe" 0
uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
mRun: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [Recguard] c:\windows\sminst\RECGUARD.EXE
mRun: [PCDrProfiler]
mRun: [HPBootOp] "c:\program files\hewlett-packard\hp boot optimizer\HPBootOp.exe" /run
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [AdobeCS4ServiceManager] "c:\program files\common files\adobe\cs4servicemanager\CS4ServiceManager.exe" -launchedbylogin
mRun: [BDAgent] "c:\program files\bitdefender\bitdefender 2009\bdagent.exe"
mRun: [ISTray] "c:\program files\spyware doctor\pctsTray.exe"
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
uPolicies-system: EnableProfileQuota = 1 (0x1)
IE: {E2D4D26B-0180-43a4-B05F-462D6D54C789} - c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\iebutton\support.htm
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {08B0E5C0-4FCB-11CF-AAA5-00401C608501}
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} - hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.4.8.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://javadl-esd.sun.com/update/1.4.1/jinstall-1_4_1-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0014-0001-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/1.4/jinstall-14-windows-i586.cab
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll
Notify: dcebcfbeafeabaded - c:\windows\system32\dcebcfbeafeabaded.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
STS: {D76AB2A1-00F3-42BD-F434-00BBC39C8953} - No File
STS: ThreadingModel - No File

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\alyssa\applic~1\mozilla\firefox\profiles\m5peofr8.default\
FF - prefs.js: browser.startup.homepage - hxxp://alyssaerin.webs.com/home.htm
FF - plugin: c:\program files\google\google updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\java\j2re1.4.1\bin\NPJava11.dll
FF - plugin: c:\program files\java\j2re1.4.1\bin\NPJava12.dll
FF - plugin: c:\program files\java\j2re1.4.1\bin\NPJava13.dll
FF - plugin: c:\program files\java\j2re1.4.1\bin\NPJava32.dll
FF - plugin: c:\program files\java\j2re1.4.1\bin\NPJPI141.dll
FF - plugin: c:\program files\java\j2re1.4.1\bin\NPOJI610.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll

============= SERVICES / DRIVERS ===============

R?2 drv;drv;c:\windows\system32\svchost.exe -k drv [2004-8-4 14336]
R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-7-6 130936]
R1 drvdrv;drvdrv;c:\program files\drv\drv.sys [2009-7-1 9344]
R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\spyware doctor\pctsAuxs.exe [2008-6-11 348752]
R2 sdCoreService;PC Tools Security Service;c:\program files\spyware doctor\pctsSvc.exe [2008-6-11 1095560]
R2 Symantec Core LC;Symantec Core LC;c:\program files\common files\symantec shared\ccpd-lc\symlcsvc.exe [2006-8-1 1251720]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2008-6-12 24652]
R3 bdfm;BDFM;c:\windows\system32\drivers\bdfm.sys [2009-4-15 145544]
S0 d9aa3e4c115132d2aa59c76bd90d4659;d9aa3e4c115132d2aa59c76bd90d4659;c:\windows\system32\d9aa3e4c115132d2aa59c76bd90d4659.sys --> c:\windows\system32\d9aa3e4c115132d2aa59c76bd90d4659.sys [?]
S3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;c:\windows\system32\drivers\wg111v2.sys [2007-12-26 272128]

=============== Created Last 30 ================

2009-07-08 08:57 230 a------- c:\windows\system32\spupdsvc.inf
2009-07-08 08:55 66,048 a------- c:\windows\ieResetIcons.exe
2009-07-06 17:01 159,600 a------- c:\windows\system32\drivers\pctgntdi.sys
2009-07-06 17:00 130,936 a------- c:\windows\system32\drivers\PCTCore.sys
2009-07-06 17:00 73,840 a------- c:\windows\system32\drivers\PCTAppEvent.sys
2009-07-06 17:00 64,392 a------- c:\windows\system32\drivers\pctplsg.sys
2009-07-06 17:00 <DIR> --d----- c:\docume~1\alyssa\applic~1\PC Tools
2009-07-06 16:51 <DIR> --d----- c:\docume~1\alyssa\applic~1\WinPatrol
2009-07-06 16:51 <DIR> --d----- c:\program files\BillP Studios
2009-07-06 16:01 <DIR> --d----- c:\program files\Trojan Killer
2009-07-06 15:41 <DIR> --d----- c:\program files\WormGuard 3.1
2009-07-06 13:01 <DIR> --d----- c:\program files\CleanUp!
2009-07-06 10:31 <DIR> --d----- c:\documents and settings\alyssa\Tracing
2009-07-06 10:30 <DIR> -cd----- c:\docume~1\alluse~1\applic~1\Messenger Plus!
2009-07-06 10:26 <DIR> --d----- c:\program files\Microsoft
2009-07-06 10:26 <DIR> --d----- c:\program files\Windows Live SkyDrive
2009-07-06 10:24 <DIR> --d----- c:\program files\common files\Windows Live
2009-07-04 15:42 <DIR> --dsh--- c:\documents and settings\alyssa\PrivacIE
2009-07-03 12:01 268 ac--h--- C:\sqmdata11.sqm
2009-07-03 12:01 244 ac--h--- C:\sqmnoopt11.sqm
2009-07-03 11:24 81,984 a------- c:\windows\system32\bdod.bin
2009-07-03 11:24 292 a------- c:\windows\system32\BDUpdateV1.xml
2009-07-03 08:27 268 ac--h--- C:\sqmdata10.sqm
2009-07-03 08:27 244 ac--h--- C:\sqmnoopt10.sqm
2009-07-03 08:25 <DIR> --dsh--- c:\documents and settings\alyssa\IETldCache
2009-07-03 07:26 102,912 -------- c:\windows\system32\dllcache\iecompat.dll
2009-07-03 07:25 <DIR> --d----- c:\windows\ie8updates
2009-07-03 07:24 246,272 -------- c:\windows\system32\dllcache\ieproxy.dll
2009-07-03 07:24 12,800 -------- c:\windows\system32\dllcache\xpshims.dll
2009-07-03 07:23 191,488 a------- c:\windows\system32\SET28B.tmp
2009-07-03 07:23 81,920 a------- c:\windows\system32\ieencode.dll
2009-07-03 07:23 81,920 a------- c:\windows\system32\dllcache\ieencode.dll
2009-07-03 01:04 850 a------- c:\windows\system32\ProductTweaks.xml
2009-07-03 01:04 385 a------- c:\windows\system32\user_gensett.xml
2009-07-02 21:48 0 a------- c:\docume~1\alyssa\applic~1\wklnhst.dat
2009-07-02 21:00 <DIR> --d----- c:\program files\ATS2
2009-07-02 20:36 268 ac--h--- C:\sqmdata09.sqm
2009-07-02 20:36 244 ac--h--- C:\sqmnoopt09.sqm
2009-07-02 19:32 <DIR> --d----- c:\docume~1\alyssa\applic~1\BitDefender
2009-07-02 19:31 <DIR> -cd----- c:\docume~1\alluse~1\applic~1\BitDefender
2009-07-02 19:31 <DIR> --d----- c:\program files\BitDefender
2009-07-02 19:29 <DIR> --d----- c:\program files\common files\BitDefender
2009-07-02 19:28 162,304 a------- c:\windows\system32\ztvunrar36.dll
2009-07-02 19:28 153,088 a------- c:\windows\system32\unrar3.dll
2009-07-02 19:28 77,312 a------- c:\windows\system32\ztvunace26.dll
2009-07-02 19:28 75,264 a------- c:\windows\system32\unacev2.dll
2009-07-02 19:28 69,632 a------- c:\windows\system32\ztvcabinet.dll
2009-07-02 19:28 <DIR> -cd----- c:\docume~1\alluse~1\applic~1\Simply Super Software
2009-07-02 19:28 <DIR> --d----- c:\docume~1\alyssa\applic~1\Simply Super Software
2009-07-02 18:21 268 ac--h--- C:\sqmdata08.sqm
2009-07-02 18:21 244 ac--h--- C:\sqmnoopt08.sqm
2009-07-02 14:19 268 ac--h--- C:\sqmdata07.sqm
2009-07-02 14:19 244 ac--h--- C:\sqmnoopt07.sqm
2009-07-02 13:48 <DIR> --d----- c:\program files\TrojanHunter 5.1
2009-07-02 12:42 41,831,992 a------- c:\program files\Norman Malware Cleaner.exe
2009-07-02 06:46 268 ac--h--- C:\sqmdata06.sqm
2009-07-02 06:46 244 ac--h--- C:\sqmnoopt06.sqm
2009-07-01 20:29 <DIR> --d----- c:\program files\drv
2009-07-01 20:29 2 a------- c:\windows\010112010146118114.dat
2009-07-01 10:35 244 ac--h--- C:\sqmnoopt05.sqm
2009-07-01 10:35 232 ac--h--- C:\sqmdata05.sqm
2009-06-30 19:23 <DIR> --d----- c:\program files\Advanced Windows Cleaner
2009-06-30 19:17 <DIR> --d----- c:\docume~1\alyssa\applic~1\Sammsoft
2009-06-30 19:09 <DIR> --d----- c:\program files\FreeRAM XP Pro
2009-06-30 18:44 <DIR> --d----- c:\program files\common files\Macrovision Shared
2009-06-30 08:54 <DIR> -cd----- c:\docume~1\alluse~1\applic~1\acccore
2009-06-30 08:53 <DIR> --d----- c:\program files\common files\AOL
2009-06-29 23:09 <DIR> --d----- c:\program files\uTorrent
2009-06-29 23:09 <DIR> --d----- c:\docume~1\alyssa\applic~1\uTorrent
2009-06-29 21:49 <DIR> --d----- c:\program files\Sony
2009-06-29 21:40 <DIR> --d----- c:\windows\system32\XPSViewer
2009-06-29 21:39 14,048 -------- c:\windows\system32\spmsg2.dll
2009-06-29 16:51 268 ac--h--- C:\sqmdata04.sqm
2009-06-29 16:51 244 ac--h--- C:\sqmnoopt04.sqm
2009-06-28 22:07 <DIR> --d----- c:\program files\common files\DivX Shared
2009-06-28 15:59 268 ac--h--- C:\sqmdata03.sqm
2009-06-28 15:59 244 ac--h--- C:\sqmnoopt03.sqm
2009-06-26 00:08 <DIR> --d----- c:\docume~1\alyssa\applic~1\HPQ
2009-06-25 23:33 <DIR> --d----- c:\documents and settings\alyssa\Contacts
2009-06-25 23:18 12,800 a--sh--- c:\windows\system32\Thumbs.db
2009-06-25 18:59 <DIR> --d----- c:\program files\Virtual TI-83 Plus
2009-06-25 09:36 48,640 a--sh--- c:\windows\Thumbs.db
2009-06-25 09:20 244 ac--h--- C:\sqmnoopt02.sqm
2009-06-25 09:20 232 ac--h--- C:\sqmdata02.sqm
2009-06-25 08:50 <DIR> --d----- c:\documents and settings\alyssa\WINDOWS
2009-06-25 08:50 <DIR> --d----- c:\docume~1\alyssa\applic~1\Intuit
2009-06-25 08:50 <DIR> --d----- c:\documents and settings\Alyssa
2009-06-12 23:35 <DIR> --d----- c:\windows\system32\scripting
2009-06-12 23:35 <DIR> --d----- c:\windows\l2schemas
2009-06-12 23:35 <DIR> --d----- c:\windows\system32\en
2009-06-12 23:35 <DIR> --d----- c:\windows\system32\bits
2009-06-12 23:30 <DIR> --d----- c:\windows\ServicePackFiles
2009-06-12 23:05 <DIR> --d----- c:\windows\EHome

==================== Find3M ====================

2009-07-03 10:52 145,544 a------- c:\windows\system32\drivers\bdfm.sys
2009-06-12 23:39 82,623 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat
2009-06-12 23:39 208,896 a------- c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\plugin\WebHelper.dll
2009-06-12 23:38 45,056 a------- c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\uninstallui\eHelpSetup.exe
2009-06-12 23:38 163,840 a------- c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\plugin\modemcheck.dll
2009-06-12 23:38 61,440 a------- c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\plugin\modemutil.dll
2009-06-12 23:38 44,032 a------- c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\scripts\devcon.exe
2009-06-12 23:38 40,960 a------- c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\plugin\ScDmi.dll
2009-06-12 23:38 32,768 a------- c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\plugin\uploadHSC.dll
2009-06-12 23:38 32,768 a------- c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\plugin\Scom.dll
2009-06-12 23:38 341,048 a------- c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\plugin\HPBasicDetection3.dll
2009-05-07 11:32 345,600 a------- c:\windows\system32\localspl.dll
2009-05-07 11:32 345,600 -------- c:\windows\system32\dllcache\localspl.dll
2009-05-01 17:02 90,112 a------- c:\windows\system32\dpl100.dll
2009-05-01 17:02 823,296 a------- c:\windows\system32\divx_xx0c.dll
2009-05-01 17:02 823,296 a------- c:\windows\system32\divx_xx07.dll
2009-05-01 17:02 815,104 a------- c:\windows\system32\divx_xx0a.dll
2009-05-01 17:02 811,008 a------- c:\windows\system32\divx_xx16.dll
2009-05-01 17:02 802,816 a------- c:\windows\system32\divx_xx11.dll
2009-05-01 17:02 685,056 a------- c:\windows\system32\DivX.dll
2009-04-29 00:55 459,264 a------- c:\windows\system32\dllcache\msfeeds.dll
2009-04-29 00:55 52,224 a------- c:\windows\system32\dllcache\msfeedsbs.dll
2009-04-29 00:55 6,066,176 a------- c:\windows\system32\dllcache\ieframe.dll
2009-04-29 00:55 268,288 a------- c:\windows\system32\dllcache\iertutil.dll
2009-04-29 00:55 383,488 a------- c:\windows\system32\dllcache\ieapfltr.dll
2009-04-29 00:55 63,488 a------- c:\windows\system32\dllcache\icardie.dll
2009-04-28 05:05 13,824 -------- c:\windows\system32\dllcache\ieudinit.exe
2009-04-17 08:26 1,847,168 a------- c:\windows\system32\win32k.sys
2009-04-17 08:26 1,847,168 -------- c:\windows\system32\dllcache\win32k.sys
2009-04-15 10:51 585,216 a------- c:\windows\system32\rpcrt4.dll
2009-04-15 10:51 585,216 -------- c:\windows\system32\dllcache\rpcrt4.dll

============= FINISH: 21:52:22.32 ===============

**chemist** · 07-11-2009, 07:30 PM

Hello and Welcome to TSF.

Please Subscribe to this Thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant notification by email, then click Add Subscription.

Please note that the forum is very busy and if I don't hear from you within three days this thread will be closed.

------------------------------------------------------

One or more of the identified infections is a backdoor trojan.

This type of infection allows hackers to remotely control your computer, log keystrokes, steal critical system information, and download and execute files without your knowledge.

If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

Please read this: How Do I Handle Possible Identify Theft, Internet Fraud, and CC Fraud?

------------------------------------------------------

It appears that you have two antivirus programs installed and running, BitDefender and SpywareDoctor. While this may seem like better protection, they can actually conflict with one another and cause system instability or even system hangs. Please choose one to keep and uninstall the other via Add or Remove Programs in your Control Panel. I suggest you uninstall SpywareDoctor.

------------------------------------------------------

You also have remnants of Norton(Symantec) on your system. They can conflict with your installed AntiVirus program and cause undesirable system behavior.

Please uninstall the following via the Add or Remove Programs section of your Control Panel if they still exist:

Symantec KB-DocID:2003093015493306

Decline any prompt to restart your computer.

------------------------------------------------------

Please download the Norton Removal Tool and Save it to your Desktop.

Close all programs and double-click the Norton_Removal_Tool.exe then click Run
Follow the on-screen instructions.
Restart the computer if asked.
Then delete Norton_Removal_Tool.exe from your desktop.

------------------------------------------------------

Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate.

Please stay with me until given the 'all clear' even if symptoms seemingly abate.

Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by a helper.

------------------------------------------------------

While Spybot's TeaTimer is an excellent tool for the prevention of spyware, it can sometimes prevent tools from fixing certain things.
Please disable TeaTimer for now until you are clean. TeaTimer can be re-activated once your logs are clean.

Open Spybot Search & Destroy.
In the Mode menu click Advanced mode if not already selected.
Choose Yes at the Warning prompt.
Expand the Tools menu.
Click Resident.
Uncheck the Resident "TeaTimer" (Protection of overall system settings) active. box.
If TeaTimer gives you a warning that changes were made, click the Allow Change box when prompted.
In the File menu click Exit to exit Spybot Search & Destroy.

------------------------------------------------------

Download ResetTeaTimer

and Save it to your Desktop.
Double-click ResetTeaTimer.zip
Double-click ResetTeaTimer.bat and click Run to remove all entries set by TeaTimer.
A DOS window will open and close again, this is normal.

------------------------------------------------------

If for some reason during these fixes you receive prompts from Spybot about whether to Allow or Deny any changes, please Allow them all.

------------------------------------------------------

Download ComboFix and Save it to your Desktop.

* IMPORTANT !!! Save Combo-Fix.exe to your Desktop

------------------------------------------------------

Disable your AntiVirus and AntiSpyware applications, usually via a right-click on the System Tray icon. They may otherwise interfere with our tools.
Get help here
Double-click on Combo-Fix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes to continue scanning for malware.

Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

------------------------------------------------------

Download mbr.exe and Save it to your Desktop.
Double-click mbr.exe to run it.
It shall produce a log on your desktop.
Post the log, mbr.log, in your next reply.

------------------------------------------------------

Alyssapie · 07-12-2009, 08:52 AM

Hi chemist! Thank you. :]

Combo-Fix Log:
ComboFix 09-07-11.02 - Alyssa 07/12/2009 10:18.1.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.446.190 [GMT -4:00]
Running from: c:\documents and settings\Alyssa\Desktop\Combo-Fix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\010112010146118114.dat
c:\windows\system32\dcebcfbeafeabaded.dll
D:\Autorun.inf

c:\windows\system32\proquota.exe was missing
Restored copy from - c:\windows\ServicePackFiles\i386\proquota.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_DRV
-------\Service_drv

((((((((((((((((((((((((( Files Created from 2009-06-12 to 2009-07-12 )))))))))))))))))))))))))))))))
.

2009-07-12 14:31 . 2008-04-14 00:12 50176 ----a-w- c:\windows\system32\proquota.exe
2009-07-12 14:31 . 2008-04-14 00:12 50176 ----a-w- c:\windows\system32\dllcache\proquota.exe
2009-07-12 13:56 . 2009-07-12 13:56 -------- dc----w- c:\documents and settings\All Users\Application Data\NortonInstaller
2009-07-10 19:09 . 2004-08-18 01:34 442368 ----a-w- c:\windows\system32\vp6vfw.dll
2009-07-10 18:32 . 2009-07-10 18:32 721904 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-07-10 18:32 . 2009-07-10 18:32 -------- d-----w- c:\documents and settings\Alyssa\Application Data\DAEMON Tools Lite
2009-07-09 15:38 . 2009-07-09 15:38 -------- d-----w- c:\documents and settings\Alyssa\Local Settings\Application Data\Identities
2009-07-09 02:10 . 2009-07-09 02:10 -------- d-----w- c:\documents and settings\Alyssa\Local Settings\Application Data\WinZip
2009-07-09 02:05 . 2009-07-09 02:10 -------- dc----w- c:\documents and settings\All Users\Application Data\WinZip
2009-07-06 21:03 . 2009-07-06 21:03 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2009-07-06 20:51 . 2009-07-06 20:51 -------- d-----w- c:\documents and settings\Alyssa\Application Data\WinPatrol
2009-07-06 20:51 . 2005-12-05 06:50 0 ----a-w- c:\documents and settings\Alyssa\Application Data\WinPatrol\Config.sys
2009-07-06 20:51 . 2005-12-05 06:50 0 ----a-w- c:\documents and settings\Alyssa\Application Data\WinPatrol\Autoexec.bat
2009-07-06 20:42 . 2009-07-06 20:42 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2009-07-06 19:42 . 2009-07-06 19:42 -------- d-----w- c:\documents and settings\Alyssa\Local Settings\Application Data\Help
2009-07-06 17:01 . 2009-07-10 15:05 -------- d-----w- c:\program files\CleanUp!
2009-07-06 14:31 . 2009-07-12 01:57 -------- d-----w- c:\documents and settings\Alyssa\Tracing
2009-07-06 14:30 . 2009-07-06 14:30 -------- dc----w- c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-07-06 14:26 . 2009-07-06 14:26 -------- d-----w- c:\program files\Microsoft
2009-07-06 14:24 . 2009-07-06 14:24 -------- d-----w- c:\program files\Common Files\Windows Live
2009-07-04 19:42 . 2009-07-04 19:42 -------- d-sh--w- c:\documents and settings\Alyssa\PrivacIE
2009-07-03 15:24 . 2009-07-09 07:09 81984 ----a-w- c:\windows\system32\bdod.bin
2009-07-03 12:25 . 2009-07-03 12:25 -------- d-sh--w- c:\documents and settings\Alyssa\IETldCache
2009-07-03 11:26 . 2009-06-02 10:12 102912 ------w- c:\windows\system32\dllcache\iecompat.dll
2009-07-03 11:25 . 2009-07-08 11:49 -------- d-----w- c:\windows\ie8updates
2009-07-03 11:24 . 2009-04-30 21:22 12800 ------w- c:\windows\system32\dllcache\xpshims.dll
2009-07-03 11:24 . 2009-04-30 21:22 246272 ------w- c:\windows\system32\dllcache\ieproxy.dll
2009-07-03 11:23 . 2009-04-29 04:46 81920 ----a-w- c:\windows\system32\ieencode.dll
2009-07-03 11:23 . 2009-04-29 04:46 81920 ----a-w- c:\windows\system32\dllcache\ieencode.dll
2009-07-03 01:49 . 2009-07-03 01:49 -------- d-----w- c:\documents and settings\Alyssa\Application Data\Template
2009-07-02 23:32 . 2009-07-02 23:32 -------- d-----w- c:\documents and settings\Alyssa\Application Data\BitDefender
2009-07-02 23:31 . 2009-07-03 12:28 -------- dc----w- c:\documents and settings\All Users\Application Data\BitDefender
2009-07-02 23:31 . 2009-07-02 23:31 -------- d-----w- c:\program files\BitDefender
2009-07-02 23:29 . 2009-07-02 23:31 -------- d-----w- c:\program files\Common Files\BitDefender
2009-07-02 23:28 . 2006-06-19 17:01 69632 ----a-w- c:\windows\system32\ztvcabinet.dll
2009-07-02 23:28 . 2006-05-25 19:52 162304 ----a-w- c:\windows\system32\ztvunrar36.dll
2009-07-02 23:28 . 2005-08-26 05:50 77312 ----a-w- c:\windows\system32\ztvunace26.dll
2009-07-02 23:28 . 2003-02-03 00:06 153088 ----a-w- c:\windows\system32\unrar3.dll
2009-07-02 23:28 . 2002-03-06 05:00 75264 ----a-w- c:\windows\system32\unacev2.dll
2009-07-02 23:28 . 2009-07-02 23:28 -------- d-----w- c:\documents and settings\Alyssa\Application Data\Simply Super Software
2009-07-02 23:28 . 2009-07-02 23:28 -------- dc----w- c:\documents and settings\All Users\Application Data\Simply Super Software
2009-07-02 22:09 . 2009-07-02 22:09 -------- d-----w- c:\documents and settings\Alyssa\Application Data\AdobeUM
2009-07-02 17:48 . 2009-07-06 20:39 -------- d-----w- c:\program files\TrojanHunter 5.1
2009-07-02 16:42 . 2009-07-02 16:42 41831992 ----a-w- c:\program files\Norman Malware Cleaner.exe
2009-07-02 00:36 . 2009-07-02 00:36 -------- d-----w- c:\documents and settings\Alyssa\Application Data\Lavasoft
2009-07-02 00:30 . 2009-07-02 00:30 -------- d-----w- c:\documents and settings\NetworkService\Application Data\Yahoo!
2009-07-02 00:29 . 2009-07-02 00:29 -------- d-----w- c:\program files\drv
2009-06-30 23:54 . 2009-07-01 04:25 -------- dc----w- c:\documents and settings\All Users\Application Data\FLEXnet
2009-06-30 23:23 . 2009-06-30 23:26 -------- d-----w- c:\program files\Advanced Windows Cleaner
2009-06-30 23:17 . 2009-06-30 23:17 -------- d-----w- c:\documents and settings\Alyssa\Application Data\Sammsoft
2009-06-30 23:09 . 2009-06-30 23:09 -------- d-----w- c:\program files\FreeRAM XP Pro
2009-06-30 22:44 . 2009-06-30 22:44 -------- d-----w- c:\program files\Common Files\Macrovision Shared
2009-06-30 21:31 . 2009-06-30 22:44 -------- d-----w- c:\documents and settings\Alyssa\Application Data\Download Manager
2009-06-30 12:54 . 2009-06-30 12:54 -------- dc----w- c:\documents and settings\All Users\Application Data\acccore
2009-06-30 12:53 . 2009-06-30 12:53 -------- d-----w- c:\documents and settings\Alyssa\Local Settings\Application Data\AOL
2009-06-30 12:53 . 2009-06-30 12:53 -------- d-----w- c:\program files\Common Files\AOL
2009-06-30 03:09 . 2009-06-30 03:09 -------- d-----w- c:\program files\uTorrent
2009-06-30 03:09 . 2009-07-12 14:38 -------- d-----w- c:\documents and settings\Alyssa\Application Data\uTorrent
2009-06-30 02:51 . 2009-06-30 02:51 -------- d-----w- c:\documents and settings\Alyssa\Application Data\Publish Providers
2009-06-30 02:40 . 2009-06-30 02:51 -------- d-----w- c:\documents and settings\Alyssa\Application Data\Sony
2009-06-30 02:40 . 2009-06-30 02:40 -------- d-----w- c:\documents and settings\Alyssa\Local Settings\Application Data\Sony
2009-06-30 01:49 . 2009-06-30 01:49 -------- dc----w- c:\documents and settings\All Users\Application Data\Sony
2009-06-30 01:49 . 2009-06-30 01:49 -------- d-----w- c:\program files\Sony
2009-06-30 01:44 . 2009-06-30 01:44 -------- d-----w- c:\program files\MSBuild
2009-06-30 01:44 . 2009-06-30 01:44 102168 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-06-30 01:40 . 2009-06-30 01:40 -------- d-----w- c:\windows\system32\XPSViewer
2009-06-30 01:40 . 2009-06-30 01:40 -------- d-----w- c:\program files\Reference Assemblies
2009-06-30 01:39 . 2006-06-29 17:07 14048 ------w- c:\windows\system32\spmsg2.dll
2009-06-30 00:22 . 2009-06-30 00:23 52770576 ----a-w- c:\documents and settings\Alyssa\Application Data\Sony Setup\64993CD0-67D1-4244-A2BC-FD73F4DA5B62\dotnetfx3.exe
2009-06-30 00:22 . 2009-06-30 00:22 -------- d-----w- c:\documents and settings\Alyssa\Application Data\Sony Setup
2009-06-29 21:40 . 2009-06-29 21:40 -------- d-----w- c:\documents and settings\Alyssa\Application Data\acccore
2009-06-29 21:40 . 2009-06-29 21:40 -------- d-----w- c:\documents and settings\Alyssa\Local Settings\Application Data\AOL OCP
2009-06-29 02:13 . 2009-06-29 02:13 -------- d-----w- c:\documents and settings\Alyssa\Application Data\DivX
2009-06-29 02:07 . 2009-06-29 02:10 -------- d-----w- c:\program files\Common Files\DivX Shared
2009-06-29 02:07 . 2009-06-30 15:26 -------- d-----w- c:\documents and settings\Alyssa\Local Settings\Application Data\WMTools Downloaded Files
2009-06-29 00:43 . 2009-07-02 22:08 -------- d-----w- c:\documents and settings\Alyssa\Local Settings\Application Data\Adobe
2009-06-26 04:08 . 2009-06-26 04:08 -------- d-----w- c:\documents and settings\Alyssa\Application Data\HPQ
2009-06-26 03:56 . 2009-06-26 03:56 -------- d-----w- c:\documents and settings\Alyssa\Local Settings\Application Data\MicroVision Applications
2009-06-26 03:33 . 2009-07-06 14:09 -------- d-----w- c:\documents and settings\Alyssa\Contacts
2009-06-25 22:59 . 2009-06-25 22:59 -------- d-----r- c:\program files\( Emulators )
2009-06-25 22:59 . 2009-06-25 23:00 -------- d-----w- c:\program files\Virtual TI-83 Plus
2009-06-25 21:29 . 2009-06-25 21:29 -------- d-----w- c:\documents and settings\Alyssa\Local Settings\Application Data\Yahoo
2009-06-25 21:27 . 2009-06-25 21:27 -------- d-----w- c:\documents and settings\Alyssa\Local Settings\Application Data\IsolatedStorage
2009-06-25 21:26 . 2009-06-25 21:26 -------- d-----w- c:\documents and settings\Alyssa\Local Settings\Application Data\HP
2009-06-25 21:26 . 2009-07-06 14:30 32584 ----a-w- c:\documents and settings\Alyssa\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-25 21:26 . 2009-06-25 21:26 129 ----a-w- c:\documents and settings\Alyssa\Local Settings\Application Data\fusioncache.dat
2009-06-25 16:01 . 2009-06-25 16:01 -------- d-----w- c:\documents and settings\Alyssa\Local Settings\Application Data\Mozilla
2009-06-25 14:37 . 2008-04-13 16:44 2560 -c--a-w- c:\documents and settings\All Users\Application Data\Microsoft\USMT\iconlib.dll
2009-06-25 13:18 . 2009-06-25 13:18 -------- d-----w- c:\documents and settings\Alyssa\Application Data\Yahoo!
2009-06-25 13:18 . 2009-06-25 13:18 -------- d-----w- c:\documents and settings\Alyssa\Local Settings\Application Data\Google
2009-06-25 13:03 . 2009-06-26 03:24 -------- d-----w- c:\documents and settings\Alyssa\Application Data\HP
2009-06-13 03:35 . 2009-06-13 03:35 -------- d-----w- c:\windows\system32\scripting
2009-06-13 03:35 . 2009-06-13 03:35 -------- d-----w- c:\windows\l2schemas
2009-06-13 03:35 . 2009-06-13 03:35 -------- d-----w- c:\windows\system32\en
2009-06-13 03:35 . 2009-06-13 03:35 -------- d-----w- c:\windows\system32\bits
2009-06-13 03:30 . 2009-06-13 03:35 -------- d-----w- c:\windows\ServicePackFiles
2009-06-13 03:05 . 2009-06-13 03:05 -------- d-----w- c:\windows\EHome

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-12 14:04 . 2008-06-11 23:47 -------- dc----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-07-12 13:55 . 2008-06-12 01:20 -------- dc--a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-07-11 13:51 . 2007-03-10 20:16 -------- dc----w- c:\documents and settings\All Users\Application Data\Google Updater
2009-07-10 23:09 . 2009-07-10 23:09 312847 ------w- c:\windows\system32\14f2b948bc4dcf2b8c8cbafdb23b2982.TMP
2009-07-10 15:05 . 2008-06-11 23:47 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-07-06 14:26 . 2008-06-12 12:32 -------- d-----w- c:\program files\Windows Live
2009-07-03 14:52 . 2009-04-15 19:13 145544 ----a-w- c:\windows\system32\drivers\bdfm.sys
2009-07-02 02:56 . 2006-08-01 19:13 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-06-30 23:26 . 2008-06-12 23:15 -------- d-----w- c:\program files\Microsoft CAPICOM 2.1.0.2
2009-06-30 23:26 . 2007-05-14 00:03 -------- d-----w- c:\program files\AIM6
2009-06-30 23:06 . 2006-12-02 22:05 -------- d-----w- c:\program files\CCleaner
2009-06-30 22:56 . 2006-08-01 18:53 -------- d-----w- c:\program files\Common Files\Adobe
2009-06-30 12:54 . 2007-05-14 00:04 -------- dc----w- c:\documents and settings\All Users\Application Data\Viewpoint
2009-06-30 12:53 . 2007-05-14 00:05 -------- dc----w- c:\documents and settings\All Users\Application Data\AOL
2009-06-30 12:45 . 2007-05-14 00:03 -------- dc----w- c:\documents and settings\All Users\Application Data\AOL Downloads
2009-06-30 00:31 . 2006-08-01 18:43 -------- dc----w- c:\documents and settings\All Users\Application Data\WildTangent
2009-06-29 02:10 . 2008-06-17 18:02 -------- d-----w- c:\program files\DivX
2009-06-27 18:01 . 2006-08-01 18:34 -------- d-----w- c:\program files\HP
2009-06-26 03:50 . 2006-08-01 18:47 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-06-26 03:47 . 2006-08-01 18:35 -------- d-----w- c:\program files\Common Files\Sonic Shared
2009-06-26 03:47 . 2006-08-01 18:35 -------- d-----w- c:\program files\Common Files\HP
2009-06-25 21:29 . 2009-03-09 00:28 -------- dc----w- c:\documents and settings\All Users\Application Data\Yahoo!
2009-06-25 13:37 . 2009-04-12 23:58 -------- d-----w- c:\program files\Java Web Start
2009-06-13 03:39 . 2005-12-05 06:49 82623 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-06-13 03:39 . 2009-06-13 03:38 208896 ----a-w- c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\WebHelper.dll
2009-06-13 03:38 . 2009-06-13 03:38 45056 ----a-w- c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\uninstallUI\eHelpSetup.exe
2009-06-13 03:38 . 2009-06-13 03:38 61440 ----a-w- c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\modemutil.dll
2009-06-13 03:38 . 2009-06-13 03:38 44032 ----a-w- c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\Scripts\devcon.exe
2009-06-13 03:38 . 2009-06-13 03:38 40960 ----a-w- c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\ScDmi.dll
2009-06-13 03:38 . 2009-06-13 03:38 32768 ----a-w- c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\uploadHSC.dll
2009-06-13 03:38 . 2009-06-13 03:38 32768 ----a-w- c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\Scom.dll
2009-06-13 03:38 . 2009-06-13 03:38 163840 ----a-w- c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\modemcheck.dll
2009-06-13 03:38 . 2009-06-13 03:38 341048 ----a-w- c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\HPBasicDetection3.dll
2009-05-19 05:36 . 2009-06-30 12:45 97072 -c--a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\SUD4426\bsetutil.exe
2009-05-19 05:36 . 2009-06-30 12:45 2884832 -c--a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\SUD4426\vwpt.exe
2009-05-19 05:36 . 2009-06-30 12:45 28 -c--a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\SUD4426\unregister.bat
2009-05-19 05:36 . 2009-06-30 12:45 25 -c--a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\SUD4426\register.bat
2009-05-19 05:36 . 2009-06-30 12:45 1484856 -c--a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\SUD4426\toolbar.exe
2009-05-19 05:36 . 2009-06-30 12:45 142040 -c--a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\SUD4426\alsetup.exe
2009-05-19 05:36 . 2009-06-30 12:45 30512 -c--a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\SUD4426\Uninstaller.exe
2009-05-19 05:36 . 2009-06-30 12:45 111920 -c--a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\SUD4426\AOLSearch.dll
2009-05-07 15:32 . 2004-08-04 11:00 345600 ----a-w- c:\windows\system32\localspl.dll
2009-05-01 21:02 . 2009-05-01 21:02 90112 ----a-w- c:\windows\system32\dpl100.dll
2009-05-01 21:02 . 2009-05-01 21:02 823296 ----a-w- c:\windows\system32\divx_xx0c.dll
2009-05-01 21:02 . 2009-05-01 21:02 823296 ----a-w- c:\windows\system32\divx_xx07.dll
2009-05-01 21:02 . 2009-05-01 21:02 815104 ----a-w- c:\windows\system32\divx_xx0a.dll
2009-05-01 21:02 . 2009-05-01 21:02 811008 ----a-w- c:\windows\system32\divx_xx16.dll
2009-05-01 21:02 . 2009-05-01 21:02 802816 ----a-w- c:\windows\system32\divx_xx11.dll
2009-05-01 21:02 . 2009-05-01 21:02 685056 ----a-w- c:\windows\system32\DivX.dll
2009-04-29 04:46 . 2004-08-04 11:00 666624 ----a-w- c:\windows\system32\wininet.dll
2009-04-17 12:26 . 2004-08-04 11:00 1847168 ----a-w- c:\windows\system32\win32k.sys
2009-04-15 14:51 . 2004-08-04 11:00 585216 ----a-w- c:\windows\system32\rpcrt4.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-03-30 68856]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2009-07-10 288048]
"AROReminder"="c:\program files\Advanced Registry Optimizer\ARO.exe" [2007-02-02 2074752]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-05-09 7311360]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2005-07-23 237568]
"HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2006-02-16 249856]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2006-08-01 180269]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"BDAgent"="c:\program files\BitDefender\BitDefender 2009\bdagent.exe" [2009-07-03 782336]
"ftutil2"="ftutil2.dll" - c:\windows\system32\ftutil2.dll [2004-06-07 106496]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2006-06-14 16239616]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2006-05-09 1519616]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Compaq Connections\\5577497\\Program\\Compaq Connections.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015
"1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016
"500:UDP"= 500:UDP:@xpsp2res.dll,-22017
"5353:TCP"= 5353:TCP:Adobe CSI CS4
"8085:TCP"= 8085:TCP:drv

R1 drvdrv;drvdrv;c:\program files\drv\drv.sys [7/1/2009 8:29 PM 9344]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [6/12/2008 8:27 AM 24652]
R3 bdfm;BDFM;c:\windows\system32\drivers\bdfm.sys [4/15/2009 3:13 PM 145544]
S0 d9aa3e4c115132d2aa59c76bd90d4659;d9aa3e4c115132d2aa59c76bd90d4659;c:\windows\system32\d9aa3e4c115132d2aa59c76bd90d4659.sys --> c:\windows\system32\d9aa3e4c115132d2aa59c76bd90d4659.sys [?]
S3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;c:\windows\system32\drivers\wg111v2.sys [12/26/2007 3:47 AM 272128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
drv REG_MULTI_SZ drv
bdx REG_MULTI_SZ scan
.
Contents of the 'Scheduled Tasks' folder

2009-07-12 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-02-04 02:48]
.
- - - - ORPHANS REMOVED - - - -

BHO-{D76AB2A1-00F3-42BD-F434-00BBC39C8953} - (no file)
HKCU-Run-GridinSoft Trojan Killer - c:\program files\Trojan Killer\trojankiller.exe
HKCU-Run-Aim6 - (no file)
HKLM-Run-PCDrProfiler - (no file)
SharedTaskScheduler-{D76AB2A1-00F3-42BD-F434-00BBC39C8953} - (no file)
SharedTaskScheduler-ThreadingModel - (no file)

.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uSearch Page = hxxp://www.google.com
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PRESARIO&pf=desktop
uSearch Bar = hxxp://www.google.com/ie
mDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=64&bd=PRESARIO&pf=desktop
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PRESARIO&pf=desktop
uInternet Connection Wizard,ShellNext = iexplore
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
FF - ProfilePath - c:\documents and settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\m5peofr8.default\
FF - prefs.js: browser.startup.homepage - hxxp://google.com
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Java\j2re1.4.1\bin\NPJava11.dll
FF - plugin: c:\program files\Java\j2re1.4.1\bin\NPJava12.dll
FF - plugin: c:\program files\Java\j2re1.4.1\bin\NPJava13.dll
FF - plugin: c:\program files\Java\j2re1.4.1\bin\NPJava32.dll
FF - plugin: c:\program files\Java\j2re1.4.1\bin\NPJPI141.dll
FF - plugin: c:\program files\Java\j2re1.4.1\bin\NPOJI610.dll
FF - plugin: c:\program files\Mozilla FireFox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-12 10:37
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(500)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
c:\program files\BitDefender\BitDefender 2009\vsserv.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\HPZipm12.exe
c:\program files\BitDefender\BitDefender 2009\seccenter.exe
.
**************************************************************************
.
Completion time: 2009-07-12 10:46 - machine was rebooted
ComboFix-quarantined-files.txt 2009-07-12 14:46

Pre-Run: 90,854,526,976 bytes free
Post-Run: 90,770,116,608 bytes free

292 --- E O F --- 2009-07-09 07:02

MBR Log:
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.6 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK
MBR rootkit code detected !
copy of MBR has been found in sector 0x0DF93410
malicious code @ sector 0x0DF93413 !
PE file found in sector at 0x0DF93429 !

**chemist** · 07-12-2009, 02:47 PM

Hello Alyssapie.

Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions.

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding.
Ensure that there aren't any opened browsers when you are carrying out the procedures below.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

------------------------------------------------------

Please uninstall the following via Start->(or My Computer)->Control Panel->Add or Remove Programs if it still exists:

Viewpoint Media Player<<This is considered foistware instead of malware since it is installed without users approval, but doesn't spy or do anything "bad". Please read here and here

Also, remove the Viewpoint plugins from within Firefox.

------------------------------------------------------

I see you have P2P software ( uTorrent ) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares.

References for the risk of these programs are here and here.

I would strongly recommend that you uninstall it, however that choice is up to you. If you choose to remove this program, you can do so via Control Panel >> Add or Remove Programs.

------------------------------------------------------

Close any open browsers.

Disable your antivirus and antispyware applications, usually via a right-click on the System Tray icon. They may otherwise interfere with ComboFix.

Open Notepad and copy/paste all the text in the codebox below into Notepad:

Code:

http://www.techsupportforum.com/security-center/virus-trojan-spyware-help/393237-links-keep-redirecting-i-e-acting-wacko-etc.html#post2235995

Collect::
c:\program files\drv\drv.sys

Folder::
c:\program files\Common Files\Symantec Shared
c:\program files\TrojanHunter 5.1
c:\program files\drv

DDS::
uInternet Connection Wizard,ShellNext = iexplore

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000000
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=-
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
"drv"=-

Driver::
d9aa3e4c115132d2aa59c76bd90d4659
drvdrv

Save this Notepad file as CFScript.txt to your Desktop and then close the file.

Referring to the picture above, drag CFScript onto ComboFix

If you are prompted to update ComboFix and have an internet connection, please choose Yes

Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.

When finished, it shall produce a log for you. Please post that log, ComboFix.txt in your next reply.

------------------------------------------------------

**Note**

When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.

Ensure you are connected to the internet and click OK on the message box.

If you do not get a message box, please do the following:

There should be a file named [4]-Submit_date@time.zip with today's date, located here:

C:\QooBox\Quarantine\[4]-Submit_date@time.zip

Using the 'Browse' button, please submit it to this site ==> http://www.bleepingcomputer.com/subm....php?channel=4

Please let me know if you successfully submitted the file. Thanks.

------------------------------------------------------

Alyssapie · 07-13-2009, 07:21 PM

Okay, I submitted the report to the requested site. :]

Log:
ComboFix 09-07-13.01 - Alyssa 07/13/2009 20:40.2.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.446.171 [GMT -4:00]
Running from: c:\documents and settings\Alyssa\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\Alyssa\Desktop\CFScript.txt

file zipped: c:\program files\drv\drv.sys
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Common Files\Symantec Shared
c:\program files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll
c:\program files\drv
c:\program files\drv\drv.dll
c:\program files\drv\drv.sys
c:\program files\TrojanHunter 5.1
c:\program files\TrojanHunter 5.1\contmenu.dll
c:\program files\TrojanHunter 5.1\THGuard.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_D9AA3E4C115132D2AA59C76BD90D4659
-------\Legacy_DRVDRV
-------\Service_d9aa3e4c115132d2aa59c76bd90d4659
-------\Service_drvdrv

((((((((((((((((((((((((( Files Created from 2009-06-14 to 2009-07-14 )))))))))))))))))))))))))))))))
.

2009-07-12 14:31 . 2008-04-14 00:12 50176 ----a-w- c:\windows\system32\proquota.exe
2009-07-12 14:31 . 2008-04-14 00:12 50176 ----a-w- c:\windows\system32\dllcache\proquota.exe
2009-07-12 13:56 . 2009-07-12 13:56 -------- dc----w- c:\documents and settings\All Users\Application Data\NortonInstaller
2009-07-10 19:09 . 2004-08-18 01:34 442368 ----a-w- c:\windows\system32\vp6vfw.dll
2009-07-10 18:32 . 2009-07-10 18:32 721904 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-07-10 18:32 . 2009-07-10 18:32 -------- d-----w- c:\documents and settings\Alyssa\Application Data\DAEMON Tools Lite
2009-07-09 15:38 . 2009-07-09 15:38 -------- d-----w- c:\documents and settings\Alyssa\Local Settings\Application Data\Identities
2009-07-09 02:10 . 2009-07-09 02:10 -------- d-----w- c:\documents and settings\Alyssa\Local Settings\Application Data\WinZip
2009-07-09 02:05 . 2009-07-09 02:10 -------- dc----w- c:\documents and settings\All Users\Application Data\WinZip
2009-07-06 21:03 . 2009-07-06 21:03 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2009-07-06 20:51 . 2009-07-06 20:51 -------- d-----w- c:\documents and settings\Alyssa\Application Data\WinPatrol
2009-07-06 20:51 . 2005-12-05 06:50 0 ----a-w- c:\documents and settings\Alyssa\Application Data\WinPatrol\Config.sys
2009-07-06 20:51 . 2005-12-05 06:50 0 ----a-w- c:\documents and settings\Alyssa\Application Data\WinPatrol\Autoexec.bat
2009-07-06 20:42 . 2009-07-06 20:42 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2009-07-06 19:42 . 2009-07-06 19:42 -------- d-----w- c:\documents and settings\Alyssa\Local Settings\Application Data\Help
2009-07-06 17:01 . 2009-07-10 15:05 -------- d-----w- c:\program files\CleanUp!
2009-07-06 14:31 . 2009-07-14 01:05 -------- d-----w- c:\documents and settings\Alyssa\Tracing
2009-07-06 14:30 . 2009-07-06 14:30 -------- dc----w- c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-07-06 14:26 . 2009-07-06 14:26 -------- d-----w- c:\program files\Microsoft
2009-07-06 14:24 . 2009-07-06 14:24 -------- d-----w- c:\program files\Common Files\Windows Live
2009-07-04 19:42 . 2009-07-04 19:42 -------- d-sh--w- c:\documents and settings\Alyssa\PrivacIE
2009-07-03 15:24 . 2009-07-09 07:09 81984 ----a-w- c:\windows\system32\bdod.bin
2009-07-03 12:25 . 2009-07-03 12:25 -------- d-sh--w- c:\documents and settings\Alyssa\IETldCache
2009-07-03 11:26 . 2009-06-02 10:12 102912 ------w- c:\windows\system32\dllcache\iecompat.dll
2009-07-03 11:25 . 2009-07-08 11:49 -------- d-----w- c:\windows\ie8updates
2009-07-03 11:24 . 2009-04-30 21:22 12800 ------w- c:\windows\system32\dllcache\xpshims.dll
2009-07-03 11:24 . 2009-04-30 21:22 246272 ------w- c:\windows\system32\dllcache\ieproxy.dll
2009-07-03 11:23 . 2009-04-29 04:46 81920 ----a-w- c:\windows\system32\ieencode.dll
2009-07-03 11:23 . 2009-04-29 04:46 81920 ----a-w- c:\windows\system32\dllcache\ieencode.dll
2009-07-03 01:49 . 2009-07-03 01:49 -------- d-----w- c:\documents and settings\Alyssa\Application Data\Template
2009-07-02 23:32 . 2009-07-02 23:32 -------- d-----w- c:\documents and settings\Alyssa\Application Data\BitDefender
2009-07-02 23:31 . 2009-07-03 12:28 -------- dc----w- c:\documents and settings\All Users\Application Data\BitDefender
2009-07-02 23:31 . 2009-07-02 23:31 -------- d-----w- c:\program files\BitDefender
2009-07-02 23:29 . 2009-07-02 23:31 -------- d-----w- c:\program files\Common Files\BitDefender
2009-07-02 23:28 . 2006-06-19 17:01 69632 ----a-w- c:\windows\system32\ztvcabinet.dll
2009-07-02 23:28 . 2006-05-25 19:52 162304 ----a-w- c:\windows\system32\ztvunrar36.dll
2009-07-02 23:28 . 2005-08-26 05:50 77312 ----a-w- c:\windows\system32\ztvunace26.dll
2009-07-02 23:28 . 2003-02-03 00:06 153088 ----a-w- c:\windows\system32\unrar3.dll
2009-07-02 23:28 . 2002-03-06 05:00 75264 ----a-w- c:\windows\system32\unacev2.dll
2009-07-02 23:28 . 2009-07-02 23:28 -------- d-----w- c:\documents and settings\Alyssa\Application Data\Simply Super Software
2009-07-02 23:28 . 2009-07-02 23:28 -------- dc----w- c:\documents and settings\All Users\Application Data\Simply Super Software
2009-07-02 22:09 . 2009-07-02 22:09 -------- d-----w- c:\documents and settings\Alyssa\Application Data\AdobeUM
2009-07-02 16:42 . 2009-07-02 16:42 41831992 ----a-w- c:\program files\Norman Malware Cleaner.exe
2009-07-02 00:36 . 2009-07-02 00:36 -------- d-----w- c:\documents and settings\Alyssa\Application Data\Lavasoft
2009-07-02 00:30 . 2009-07-02 00:30 -------- d-----w- c:\documents and settings\NetworkService\Application Data\Yahoo!
2009-06-30 23:54 . 2009-07-01 04:25 -------- dc----w- c:\documents and settings\All Users\Application Data\FLEXnet
2009-06-30 23:23 . 2009-06-30 23:26 -------- d-----w- c:\program files\Advanced Windows Cleaner
2009-06-30 23:17 . 2009-06-30 23:17 -------- d-----w- c:\documents and settings\Alyssa\Application Data\Sammsoft
2009-06-30 23:09 . 2009-06-30 23:09 -------- d-----w- c:\program files\FreeRAM XP Pro
2009-06-30 22:44 . 2009-06-30 22:44 -------- d-----w- c:\program files\Common Files\Macrovision Shared
2009-06-30 21:31 . 2009-06-30 22:44 -------- d-----w- c:\documents and settings\Alyssa\Application Data\Download Manager
2009-06-30 12:54 . 2009-06-30 12:54 -------- dc----w- c:\documents and settings\All Users\Application Data\acccore
2009-06-30 12:53 . 2009-06-30 12:53 -------- d-----w- c:\documents and settings\Alyssa\Local Settings\Application Data\AOL
2009-06-30 12:53 . 2009-06-30 12:53 -------- d-----w- c:\program files\Common Files\AOL
2009-06-30 03:09 . 2009-06-30 03:09 -------- d-----w- c:\program files\uTorrent
2009-06-30 03:09 . 2009-07-14 01:05 -------- d-----w- c:\documents and settings\Alyssa\Application Data\uTorrent
2009-06-30 02:51 . 2009-06-30 02:51 -------- d-----w- c:\documents and settings\Alyssa\Application Data\Publish Providers
2009-06-30 02:40 . 2009-06-30 02:51 -------- d-----w- c:\documents and settings\Alyssa\Application Data\Sony
2009-06-30 02:40 . 2009-06-30 02:40 -------- d-----w- c:\documents and settings\Alyssa\Local Settings\Application Data\Sony
2009-06-30 01:49 . 2009-06-30 01:49 -------- dc----w- c:\documents and settings\All Users\Application Data\Sony
2009-06-30 01:49 . 2009-06-30 01:49 -------- d-----w- c:\program files\Sony
2009-06-30 01:44 . 2009-06-30 01:44 -------- d-----w- c:\program files\MSBuild
2009-06-30 01:44 . 2009-06-30 01:44 102168 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-06-30 01:40 . 2009-06-30 01:40 -------- d-----w- c:\windows\system32\XPSViewer
2009-06-30 01:40 . 2009-06-30 01:40 -------- d-----w- c:\program files\Reference Assemblies
2009-06-30 01:39 . 2006-06-29 17:07 14048 ------w- c:\windows\system32\spmsg2.dll
2009-06-30 00:22 . 2009-06-30 00:23 52770576 ----a-w- c:\documents and settings\Alyssa\Application Data\Sony Setup\64993CD0-67D1-4244-A2BC-FD73F4DA5B62\dotnetfx3.exe
2009-06-30 00:22 . 2009-06-30 00:22 -------- d-----w- c:\documents and settings\Alyssa\Application Data\Sony Setup
2009-06-29 21:40 . 2009-06-29 21:40 -------- d-----w- c:\documents and settings\Alyssa\Application Data\acccore
2009-06-29 21:40 . 2009-06-29 21:40 -------- d-----w- c:\documents and settings\Alyssa\Local Settings\Application Data\AOL OCP
2009-06-29 02:13 . 2009-06-29 02:13 -------- d-----w- c:\documents and settings\Alyssa\Application Data\DivX
2009-06-29 02:07 . 2009-06-29 02:10 -------- d-----w- c:\program files\Common Files\DivX Shared
2009-06-29 02:07 . 2009-06-30 15:26 -------- d-----w- c:\documents and settings\Alyssa\Local Settings\Application Data\WMTools Downloaded Files
2009-06-29 00:43 . 2009-07-02 22:08 -------- d-----w- c:\documents and settings\Alyssa\Local Settings\Application Data\Adobe
2009-06-26 04:08 . 2009-06-26 04:08 -------- d-----w- c:\documents and settings\Alyssa\Application Data\HPQ
2009-06-26 03:56 . 2009-06-26 03:56 -------- d-----w- c:\documents and settings\Alyssa\Local Settings\Application Data\MicroVision Applications
2009-06-26 03:33 . 2009-07-06 14:09 -------- d-----w- c:\documents and settings\Alyssa\Contacts
2009-06-25 22:59 . 2009-06-25 22:59 -------- d-----r- c:\program files\( Emulators )
2009-06-25 22:59 . 2009-06-25 23:00 -------- d-----w- c:\program files\Virtual TI-83 Plus
2009-06-25 21:29 . 2009-06-25 21:29 -------- d-----w- c:\documents and settings\Alyssa\Local Settings\Application Data\Yahoo
2009-06-25 21:27 . 2009-06-25 21:27 -------- d-----w- c:\documents and settings\Alyssa\Local Settings\Application Data\IsolatedStorage
2009-06-25 21:26 . 2009-06-25 21:26 -------- d-----w- c:\documents and settings\Alyssa\Local Settings\Application Data\HP
2009-06-25 21:26 . 2009-07-06 14:30 32584 ----a-w- c:\documents and settings\Alyssa\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-25 21:26 . 2009-06-25 21:26 129 ----a-w- c:\documents and settings\Alyssa\Local Settings\Application Data\fusioncache.dat
2009-06-25 16:01 . 2009-06-25 16:01 -------- d-----w- c:\documents and settings\Alyssa\Local Settings\Application Data\Mozilla
2009-06-25 14:37 . 2008-04-13 16:44 2560 -c--a-w- c:\documents and settings\All Users\Application Data\Microsoft\USMT\iconlib.dll
2009-06-25 13:18 . 2009-06-25 13:18 -------- d-----w- c:\documents and settings\Alyssa\Application Data\Yahoo!
2009-06-25 13:18 . 2009-06-25 13:18 -------- d-----w- c:\documents and settings\Alyssa\Local Settings\Application Data\Google
2009-06-25 13:03 . 2009-06-26 03:24 -------- d-----w- c:\documents and settings\Alyssa\Application Data\HP

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-14 00:31 . 2007-05-14 00:04 -------- dc----w- c:\documents and settings\All Users\Application Data\Viewpoint
2009-07-13 15:53 . 2007-03-10 20:16 -------- dc----w- c:\documents and settings\All Users\Application Data\Google Updater
2009-07-12 15:49 . 2008-06-11 23:47 -------- dc----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-07-12 13:55 . 2008-06-12 01:20 -------- dc--a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-07-10 23:09 . 2009-07-10 23:09 312847 ------w- c:\windows\system32\14f2b948bc4dcf2b8c8cbafdb23b2982.TMP
2009-07-10 15:05 . 2008-06-11 23:47 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-07-06 14:26 . 2008-06-12 12:32 -------- d-----w- c:\program files\Windows Live
2009-07-03 14:52 . 2009-04-15 19:13 145544 ----a-w- c:\windows\system32\drivers\bdfm.sys
2009-06-30 23:26 . 2008-06-12 23:15 -------- d-----w- c:\program files\Microsoft CAPICOM 2.1.0.2
2009-06-30 23:26 . 2007-05-14 00:03 -------- d-----w- c:\program files\AIM6
2009-06-30 23:06 . 2006-12-02 22:05 -------- d-----w- c:\program files\CCleaner
2009-06-30 22:56 . 2006-08-01 18:53 -------- d-----w- c:\program files\Common Files\Adobe
2009-06-30 12:53 . 2007-05-14 00:05 -------- dc----w- c:\documents and settings\All Users\Application Data\AOL
2009-06-30 12:45 . 2007-05-14 00:03 -------- dc----w- c:\documents and settings\All Users\Application Data\AOL Downloads
2009-06-30 00:31 . 2006-08-01 18:43 -------- dc----w- c:\documents and settings\All Users\Application Data\WildTangent
2009-06-29 02:10 . 2008-06-17 18:02 -------- d-----w- c:\program files\DivX
2009-06-27 18:01 . 2006-08-01 18:34 -------- d-----w- c:\program files\HP
2009-06-26 03:50 . 2006-08-01 18:47 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-06-26 03:47 . 2006-08-01 18:35 -------- d-----w- c:\program files\Common Files\Sonic Shared
2009-06-26 03:47 . 2006-08-01 18:35 -------- d-----w- c:\program files\Common Files\HP
2009-06-25 21:29 . 2009-03-09 00:28 -------- dc----w- c:\documents and settings\All Users\Application Data\Yahoo!
2009-06-25 13:37 . 2009-04-12 23:58 -------- d-----w- c:\program files\Java Web Start
2009-06-13 03:39 . 2005-12-05 06:49 82623 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-06-13 03:39 . 2009-06-13 03:38 208896 ----a-w- c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\WebHelper.dll
2009-06-13 03:38 . 2009-06-13 03:38 45056 ----a-w- c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\uninstallUI\eHelpSetup.exe
2009-06-13 03:38 . 2009-06-13 03:38 61440 ----a-w- c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\modemutil.dll
2009-06-13 03:38 . 2009-06-13 03:38 44032 ----a-w- c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\Scripts\devcon.exe
2009-06-13 03:38 . 2009-06-13 03:38 40960 ----a-w- c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\ScDmi.dll
2009-06-13 03:38 . 2009-06-13 03:38 32768 ----a-w- c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\uploadHSC.dll
2009-06-13 03:38 . 2009-06-13 03:38 32768 ----a-w- c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\Scom.dll
2009-06-13 03:38 . 2009-06-13 03:38 163840 ----a-w- c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\modemcheck.dll
2009-06-13 03:38 . 2009-06-13 03:38 341048 ----a-w- c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\HPBasicDetection3.dll
2009-05-19 05:36 . 2009-06-30 12:45 97072 -c--a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\SUD4426\bsetutil.exe
2009-05-19 05:36 . 2009-06-30 12:45 2884832 -c--a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\SUD4426\vwpt.exe
2009-05-19 05:36 . 2009-06-30 12:45 28 -c--a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\SUD4426\unregister.bat
2009-05-19 05:36 . 2009-06-30 12:45 25 -c--a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\SUD4426\register.bat
2009-05-19 05:36 . 2009-06-30 12:45 1484856 -c--a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\SUD4426\toolbar.exe
2009-05-19 05:36 . 2009-06-30 12:45 142040 -c--a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\SUD4426\alsetup.exe
2009-05-19 05:36 . 2009-06-30 12:45 30512 -c--a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\SUD4426\Uninstaller.exe
2009-05-19 05:36 . 2009-06-30 12:45 111920 -c--a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\SUD4426\AOLSearch.dll
2009-05-07 15:32 . 2004-08-04 11:00 345600 ----a-w- c:\windows\system32\localspl.dll
2009-05-01 21:02 . 2009-05-01 21:02 90112 ----a-w- c:\windows\system32\dpl100.dll
2009-05-01 21:02 . 2009-05-01 21:02 823296 ----a-w- c:\windows\system32\divx_xx0c.dll
2009-05-01 21:02 . 2009-05-01 21:02 823296 ----a-w- c:\windows\system32\divx_xx07.dll
2009-05-01 21:02 . 2009-05-01 21:02 815104 ----a-w- c:\windows\system32\divx_xx0a.dll
2009-05-01 21:02 . 2009-05-01 21:02 811008 ----a-w- c:\windows\system32\divx_xx16.dll
2009-05-01 21:02 . 2009-05-01 21:02 802816 ----a-w- c:\windows\system32\divx_xx11.dll
2009-05-01 21:02 . 2009-05-01 21:02 685056 ----a-w- c:\windows\system32\DivX.dll
2009-04-29 04:46 . 2004-08-04 11:00 666624 ----a-w- c:\windows\system32\wininet.dll
2009-04-17 12:26 . 2004-08-04 11:00 1847168 ----a-w- c:\windows\system32\win32k.sys
2009-04-15 14:51 . 2004-08-04 11:00 585216 ----a-w- c:\windows\system32\rpcrt4.dll
2009-06-03 03:00 . 2009-06-25 14:49 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-03-30 68856]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2009-07-10 288048]
"AROReminder"="c:\program files\Advanced Registry Optimizer\ARO.exe" [2007-02-02 2074752]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-05-09 7311360]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2005-07-23 237568]
"HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2006-02-16 249856]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2006-08-01 180269]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"BDAgent"="c:\program files\BitDefender\BitDefender 2009\bdagent.exe" [2009-07-03 782336]
"ftutil2"="ftutil2.dll" - c:\windows\system32\ftutil2.dll [2004-06-07 106496]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2006-06-14 16239616]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2006-05-09 1519616]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Compaq Connections\\5577497\\Program\\Compaq Connections.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015
"1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016
"500:UDP"= 500:UDP:@xpsp2res.dll,-22017
"5353:TCP"= 5353:TCP:Adobe CSI CS4
"8085:TCP"= 8085:TCP:drv

R3 bdfm;BDFM;c:\windows\system32\drivers\bdfm.sys [4/15/2009 3:13 PM 145544]
S3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;c:\windows\system32\drivers\wg111v2.sys [12/26/2007 3:47 AM 272128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bdx REG_MULTI_SZ scan
.
Contents of the 'Scheduled Tasks' folder

2009-07-14 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-02-04 02:48]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uSearch Page = hxxp://www.google.com
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PRESARIO&pf=desktop
uSearch Bar = hxxp://www.google.com/ie
mDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=64&bd=PRESARIO&pf=desktop
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PRESARIO&pf=desktop
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
FF - ProfilePath - c:\documents and settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\m5peofr8.default\
FF - prefs.js: browser.startup.homepage - hxxp://google.com
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Java\j2re1.4.1\bin\NPJava11.dll
FF - plugin: c:\program files\Java\j2re1.4.1\bin\NPJava12.dll
FF - plugin: c:\program files\Java\j2re1.4.1\bin\NPJava13.dll
FF - plugin: c:\program files\Java\j2re1.4.1\bin\NPJava32.dll
FF - plugin: c:\program files\Java\j2re1.4.1\bin\NPJPI141.dll
FF - plugin: c:\program files\Java\j2re1.4.1\bin\NPOJI610.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-13 21:04
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(2960)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\program files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll
c:\windows\system32\nvcpl.dll
c:\windows\system32\nvshell.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
c:\program files\BitDefender\BitDefender 2009\vsserv.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\HPZipm12.exe
c:\windows\system32\wscntfy.exe
c:\program files\BitDefender\BitDefender 2009\seccenter.exe
.
**************************************************************************
.
Completion time: 2009-07-14 21:11 - machine was rebooted
ComboFix-quarantined-files.txt 2009-07-14 01:11
ComboFix2.txt 2009-07-12 14:46

Pre-Run: 90,728,333,312 bytes free
Post-Run: 90,730,586,112 bytes free

278 --- E O F --- 2009-07-09 07:02

**chemist** · 07-13-2009, 09:22 PM

Hello again, Alyssapie. Thanks for submitting the file. Please tell us how your system is behaving.

Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions.

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding.
Ensure that there aren't any opened browsers when you are carrying out the procedures below.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

------------------------------------------------------

Open Notepad and copy/paste the entire contents of the codebox below into Notepad (don't forget to copy and paste REGEDIT4):

Code:

REGEDIT4

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"8085:TCP"=-

Save the file as fix.reg and choose to Save as type: - All Files then close the Notepad file.
It should look like this:

Double-click on fix.reg and choose Yes to merge/add it to the registry. Please delete the file afterwards.

------------------------------------------------------

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version Java components and update.

Download the latest version of Java Runtime Environment (JRE) 6 and Save it to your Desktop.
Scroll down to where it says Java Runtime Environment (JRE) 6 Update 14 The Java SE Runtime Environment (JRE) allows end-users to run Java applications.
Click the Download button to the right.
Select the Windows platform from the dropdown menu.
Read the License Agreement and then check the box that says: I agree to the Java SE Runtime Environment 6 with JavaFX License Agreement
Click Continue The page will refresh.
Click on the link to download Windows Offline Installation and Save the file to your Desktop.
Close any programs you may have running - especially your web browser.
Go to Start(or My Computer) > Control Panel and double-click on Add or Remove Programs and remove all older versions of Java.
Click (highlight) any item with Java Runtime Environment (JRE, J2SE, Java(TM) SE or Java(TM) 6) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java version.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u14-windows-i586-p.exe to install the newest version.

After the install is complete, go back to your Control Panel(using Classic View) and click the Java icon. (looks like a coffee cup)
- On the General tab, under Temporary Internet Files, click the Settings button.
- Next, click on the Delete Files button.
- There are two options in the window to clear the cache - Leave BOTH Checked
  - Applications and Applets
  - Trace and Log Files
- Click OK on Delete Temporary Files Window.
  Note: This deletes ALL the Downloaded Applications and Applets from the CACHE
- Click OK to leave the Temporary Files Window.
- Click OK to leave the Java Control Panel.
- Delete jre-6u14-windows-i586-p.exe from your desktop.

------------------------------------------------------

Please download ATF-Cleaner by Atribune and Save it to your Desktop.

Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

If you use Firefox browser

Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

------------------------------------------------------

Please run this online scan to help look for remnants.

Establish an internet connection & perform an online scan at Kaspersky Online Scanner

Ensure your external and/or USB drives are inserted during the scan.

Click Accept, when prompted to download and install the program files and database of malware definitions.

Click Run at any Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.
Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
Once the scan is complete, it will display if your system has been infected.
It does not provide an option to clean/disinfect. We only require a report from it.
Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
Click View scan report at the bottom.
Click the Save Report As... button.
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply.

**Note**

To optimize scanning time and produce a more sensible report for review:

Close any open programs.
Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.

Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.

------------------------------------------------------

Please post the following in your next reply:

Kaspersky report
report on system behavior

Alyssapie · 07-15-2009, 05:00 PM

Hi chemist! Sorry for the slight delay.
My computer seems to be working as normal now! Now more annoying redirecting, or it acting really slow. Thank you!! <3

Report:
--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0 REPORT
Wednesday, July 15, 2009
Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Program database last update: Wednesday, July 15, 2009 19:50:19
Records in database: 2471976
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\

Scan statistics:
Files scanned: 78053
Threat name: 4
Infected objects: 9
Suspicious objects: 0
Duration of the scan: 03:11:56

File name / Threat name / Threats count
C:\Qoobox\Quarantine\C\Program Files\drv\drv.dll.vir Infected: Trojan-Downloader.Win32.Agent.chpc 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\dcebcfbeafeabaded.dll.vir Infected: Worm.Win32.AutoRun.raz 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\_dcebcfbeafeabaded_.dll.zip Infected: Worm.Win32.AutoRun.raz 2
C:\Qoobox\Quarantine\[4]-Submit_2009-07-13_20.39.56.zip Infected: Rootkit.Win32.Small.adn 1
C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP760\A0112089.dll Infected: Trojan-Downloader.Win32.Agent.chpc 1
C:\WINDOWS\system32\14f2b948bc4dcf2b8c8cbafdb23b2982.TMP Infected: Worm.Win32.AutoRun.raz 1
D:\I386\APPS\APP25742\src\CompaqPresario_Spring06.exe Infected: not-a-virus:AdWare.Win32.WeatherBug.a 1
D:\I386\APPS\APP25742\src\HPPavillion_Spring06.exe Infected: not-a-virus:AdWare.Win32.WeatherBug.a 1

The selected area was scanned.

**chemist** · 07-15-2009, 07:41 PM

Hello again, Alyssapie.

QooBox is ComboFix's quarantine folder. System Volume Information is where Windows keeps old system restore points. Both will get deleted when we uninstall ComboFix.

The two Spring06.exe files were factory installed on your recovery partition, so we will leave those be.

------------------------------------------------------

Go to Start > Run and copy/paste the following into the Run box and click OK:

cmd /c del /a/f/q "C:\WINDOWS\system32\14f2b948bc4dcf2b8c8cbafdb23b2982.TMP"

A DOS window will open and close again, this is normal.

------------------------------------------------------

Congratulations. Well done! Your logs appear clean. You should be good to go.

Please disable BitDefender before uninstalling ComboFix and then re-enable it after doing so.

Go to Start >> Run and Copy/Paste the following single-line command into the Run box and click OK:

combofix /u

This will uninstall ComboFix and delete ComboFix's quarantine folder. It will also implement some cleanup procedures, remove old System Restore Points which contain previous infections, and create a fresh, clean System Restore Point.

Please re-enable your antivirus program and any other antispyware programs disabled earlier if you haven't already.

Please re-enable TeaTimer:

Open Spybot Search & Destroy.
In the Mode menu click "Advanced mode" if not already selected.
Choose "Yes" at the Warning prompt.
Expand the "Tools" menu.
Click "Resident".
Check the "Resident "TeaTimer" (Protection of overall system settings) active." box.
In the File menu click "Exit" to exit Spybot Search & Destroy.

------------------------------------------------------

You can safely delete any tools downloaded or any logs, files, and any shortcuts on your desktop that were created during this fix.

------------------------------------------------------

MICROSOFT UPDATES
It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft and download all the critical updates to help prevent possible re-infection.

SPYWARE PREVENTION
This is a good time to set up protection against further attacks. In light of your recent problem, I'm sure you'd like to avoid any future infections. Please read these well written articles:

How Did I Get Infected In The First Place? by TonyKlein
How to Prevent Malware by miekiemoes

To help protect your computer in the future I recommend that you get the following free programs if you do not already have them:

WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware, or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
- Green to go
- Yellow for caution
- Red to stop
WOT has an add-on available for both Firefox and IE.
SpywareBlaster prevents the installation of ActiveX-based malware, blocks cookies, and restricts the actions of "bad" sites in Internet Explorer. See tutorial here
MVPS HOSTS FILE replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. It basically prevents your computer from connecting to those sites by redirecting the attempted connections to 127.0.0.1, which is the IP of your local computer. See guide here and for Windows Vista here
- Download Host.zip and Save it to your Desktop.
- Right-click hosts.zip and select 'Extract all files' or 'Extract files...'.
- Follow the prompts and click 'Finish'.
- This will open the newly created hosts folder on your Desktop.
- Double-click on the included mvps.bat file, this will rename the existing HOSTS file to HOSTS.MVP, then it will copy the included updated HOSTS file to the correct location on your machine.
- Once updated you should see another prompt that the task was completed.
IE-Spyad is another excellent program that places over 5000 dubious websites and domains in the IE Restricted list, which will help prevent attempts to infect your system. It basically prevents any downloads from the sites listed, although you will still be able to connect to the site. See tutorial here

Keep your antivirus program and antispyware programs updated and scan with them on a regular basis.

Please respond to this thread one more time so we can mark this thread as resolved.

Alyssapie · 07-15-2009, 08:40 PM

Got it. Thank you so much! You guys are awesome. <3

**chemist** · 07-15-2009, 10:18 PM

You're very welcome, Alyssapie! Glad to have helped.

07-11-2009, 07:30 PM	#2 (permalink)
chemist Moderator, Analyst, Security Team; Rangemaster, TSF Academy Join Date: Oct 2007 Location: Georgia Posts: 10,604 OS: XP SP3	Re: Links keep redirecting, I.E acting wacko, etc. Hello and Welcome to TSF. Please Subscribe to this Thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant notification by email, then click Add Subscription. Please note that the forum is very busy and if I don't hear from you within three days this thread will be closed. ------------------------------------------------------ One or more of the identified infections is a backdoor trojan. This type of infection allows hackers to remotely control your computer, log keystrokes, steal critical system information, and download and execute files without your knowledge. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation. Please read this: How Do I Handle Possible Identify Theft, Internet Fraud, and CC Fraud? ------------------------------------------------------ It appears that you have two antivirus programs installed and running, BitDefender and SpywareDoctor. While this may seem like better protection, they can actually conflict with one another and cause system instability or even system hangs. Please choose one to keep and uninstall the other via Add or Remove Programs in your Control Panel. I suggest you uninstall SpywareDoctor. ------------------------------------------------------ You also have remnants of Norton(Symantec) on your system. They can conflict with your installed AntiVirus program and cause undesirable system behavior. Please uninstall the following via the Add or Remove Programs section of your Control Panel if they still exist: Symantec KB-DocID:2003093015493306 Decline any prompt to restart your computer. ------------------------------------------------------ Please download the Norton Removal Tool and Save it to your Desktop. Close all programs and double-click the Norton_Removal_Tool.exe then click Run Follow the on-screen instructions. Restart the computer if asked. Then delete Norton_Removal_Tool.exe from your desktop. ------------------------------------------------------ Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate. Please stay with me until given the 'all clear' even if symptoms seemingly abate. Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by a helper. ------------------------------------------------------ While Spybot's TeaTimer is an excellent tool for the prevention of spyware, it can sometimes prevent tools from fixing certain things. Please disable TeaTimer for now until you are clean. TeaTimer can be re-activated once your logs are clean. Open Spybot Search & Destroy. In the Mode menu click Advanced mode if not already selected. Choose Yes at the Warning prompt. Expand the Tools menu. Click Resident. Uncheck the Resident "TeaTimer" (Protection of overall system settings) active. box. If TeaTimer gives you a warning that changes were made, click the Allow Change box when prompted. In the File menu click Exit to exit Spybot Search & Destroy. ------------------------------------------------------ Download ResetTeaTimer and Save it to your Desktop. Double-click ResetTeaTimer.zip Double-click ResetTeaTimer.bat and click Run to remove all entries set by TeaTimer. A DOS window will open and close again, this is normal. ------------------------------------------------------ If for some reason during these fixes you receive prompts from Spybot about whether to Allow or Deny any changes, please Allow them all. ------------------------------------------------------ Download ComboFix and Save it to your Desktop. * IMPORTANT !!! Save Combo-Fix.exe to your Desktop ------------------------------------------------------ Disable your AntiVirus and AntiSpyware applications, usually via a right-click on the System Tray icon. They may otherwise interfere with our tools. Get help here Double-click on Combo-Fix.exe & follow the prompts. As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware. Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console. Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures. Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message: Click on Yes to continue scanning for malware. Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal. When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply. ------------------------------------------------------ Download mbr.exe and Save it to your Desktop. Double-click mbr.exe to run it. It shall produce a log on your desktop. Post the log, mbr.log*, in your next reply. ------------------------------------------------------ __________________ Our help is free but please donate Proud member of ASAP Proud member of UNITE Last edited by chemist; 07-11-2009 at 08:39 PM.*

07-12-2009, 08:52 AM	#3 (permalink)
Alyssapie Registered User Join Date: Jul 2009 Location: Cincinnati, OH Posts: 15 OS: Windows XP SP3	Re: Links keep redirecting, I.E acting wacko, etc. Hi chemist! Thank you. :] Combo-Fix Log: ComboFix 09-07-11.02 - Alyssa 07/12/2009 10:18.1.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.446.190 [GMT -4:00] Running from: c:\documents and settings\Alyssa\Desktop\Combo-Fix.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\010112010146118114.dat c:\windows\system32\dcebcfbeafeabaded.dll D:\Autorun.inf c:\windows\system32\proquota.exe was missing Restored copy from - c:\windows\ServicePackFiles\i386\proquota.exe . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_DRV -------\Service_drv ((((((((((((((((((((((((( Files Created from 2009-06-12 to 2009-07-12 ))))))))))))))))))))))))))))))) . 2009-07-12 14:31 . 2008-04-14 00:12 50176 ----a-w- c:\windows\system32\proquota.exe 2009-07-12 14:31 . 2008-04-14 00:12 50176 ----a-w- c:\windows\system32\dllcache\proquota.exe 2009-07-12 13:56 . 2009-07-12 13:56 -------- dc----w- c:\documents and settings\All Users\Application Data\NortonInstaller 2009-07-10 19:09 . 2004-08-18 01:34 442368 ----a-w- c:\windows\system32\vp6vfw.dll 2009-07-10 18:32 . 2009-07-10 18:32 721904 ----a-w- c:\windows\system32\drivers\sptd.sys 2009-07-10 18:32 . 2009-07-10 18:32 -------- d-----w- c:\documents and settings\Alyssa\Application Data\DAEMON Tools Lite 2009-07-09 15:38 . 2009-07-09 15:38 -------- d-----w- c:\documents and settings\Alyssa\Local Settings\Application Data\Identities 2009-07-09 02:10 . 2009-07-09 02:10 -------- d-----w- c:\documents and settings\Alyssa\Local Settings\Application Data\WinZip 2009-07-09 02:05 . 2009-07-09 02:10 -------- dc----w- c:\documents and settings\All Users\Application Data\WinZip 2009-07-06 21:03 . 2009-07-06 21:03 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache 2009-07-06 20:51 . 2009-07-06 20:51 -------- d-----w- c:\documents and settings\Alyssa\Application Data\WinPatrol 2009-07-06 20:51 . 2005-12-05 06:50 0 ----a-w- c:\documents and settings\Alyssa\Application Data\WinPatrol\Config.sys 2009-07-06 20:51 . 2005-12-05 06:50 0 ----a-w- c:\documents and settings\Alyssa\Application Data\WinPatrol\Autoexec.bat 2009-07-06 20:42 . 2009-07-06 20:42 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache 2009-07-06 19:42 . 2009-07-06 19:42 -------- d-----w- c:\documents and settings\Alyssa\Local Settings\Application Data\Help 2009-07-06 17:01 . 2009-07-10 15:05 -------- d-----w- c:\program files\CleanUp! 2009-07-06 14:31 . 2009-07-12 01:57 -------- d-----w- c:\documents and settings\Alyssa\Tracing 2009-07-06 14:30 . 2009-07-06 14:30 -------- dc----w- c:\documents and settings\All Users\Application Data\Messenger Plus! 2009-07-06 14:26 . 2009-07-06 14:26 -------- d-----w- c:\program files\Microsoft 2009-07-06 14:24 . 2009-07-06 14:24 -------- d-----w- c:\program files\Common Files\Windows Live 2009-07-04 19:42 . 2009-07-04 19:42 -------- d-sh--w- c:\documents and settings\Alyssa\PrivacIE 2009-07-03 15:24 . 2009-07-09 07:09 81984 ----a-w- c:\windows\system32\bdod.bin 2009-07-03 12:25 . 2009-07-03 12:25 -------- d-sh--w- c:\documents and settings\Alyssa\IETldCache 2009-07-03 11:26 . 2009-06-02 10:12 102912 ------w- c:\windows\system32\dllcache\iecompat.dll 2009-07-03 11:25 . 2009-07-08 11:49 -------- d-----w- c:\windows\ie8updates 2009-07-03 11:24 . 2009-04-30 21:22 12800 ------w- c:\windows\system32\dllcache\xpshims.dll 2009-07-03 11:24 . 2009-04-30 21:22 246272 ------w- c:\windows\system32\dllcache\ieproxy.dll 2009-07-03 11:23 . 2009-04-29 04:46 81920 ----a-w- c:\windows\system32\ieencode.dll 2009-07-03 11:23 . 2009-04-29 04:46 81920 ----a-w- c:\windows\system32\dllcache\ieencode.dll 2009-07-03 01:49 . 2009-07-03 01:49 -------- d-----w- c:\documents and settings\Alyssa\Application Data\Template 2009-07-02 23:32 . 2009-07-02 23:32 -------- d-----w- c:\documents and settings\Alyssa\Application Data\BitDefender 2009-07-02 23:31 . 2009-07-03 12:28 -------- dc----w- c:\documents and settings\All Users\Application Data\BitDefender 2009-07-02 23:31 . 2009-07-02 23:31 -------- d-----w- c:\program files\BitDefender 2009-07-02 23:29 . 2009-07-02 23:31 -------- d-----w- c:\program files\Common Files\BitDefender 2009-07-02 23:28 . 2006-06-19 17:01 69632 ----a-w- c:\windows\system32\ztvcabinet.dll 2009-07-02 23:28 . 2006-05-25 19:52 162304 ----a-w- c:\windows\system32\ztvunrar36.dll 2009-07-02 23:28 . 2005-08-26 05:50 77312 ----a-w- c:\windows\system32\ztvunace26.dll 2009-07-02 23:28 . 2003-02-03 00:06 153088 ----a-w- c:\windows\system32\unrar3.dll 2009-07-02 23:28 . 2002-03-06 05:00 75264 ----a-w- c:\windows\system32\unacev2.dll 2009-07-02 23:28 . 2009-07-02 23:28 -------- d-----w- c:\documents and settings\Alyssa\Application Data\Simply Super Software 2009-07-02 23:28 . 2009-07-02 23:28 -------- dc----w- c:\documents and settings\All Users\Application Data\Simply Super Software 2009-07-02 22:09 . 2009-07-02 22:09 -------- d-----w- c:\documents and settings\Alyssa\Application Data\AdobeUM 2009-07-02 17:48 . 2009-07-06 20:39 -------- d-----w- c:\program files\TrojanHunter 5.1 2009-07-02 16:42 . 2009-07-02 16:42 41831992 ----a-w- c:\program files\Norman Malware Cleaner.exe 2009-07-02 00:36 . 2009-07-02 00:36 -------- d-----w- c:\documents and settings\Alyssa\Application Data\Lavasoft 2009-07-02 00:30 . 2009-07-02 00:30 -------- d-----w- c:\documents and settings\NetworkService\Application Data\Yahoo! 2009-07-02 00:29 . 2009-07-02 00:29 -------- d-----w- c:\program files\drv 2009-06-30 23:54 . 2009-07-01 04:25 -------- dc----w- c:\documents and settings\All Users\Application Data\FLEXnet 2009-06-30 23:23 . 2009-06-30 23:26 -------- d-----w- c:\program files\Advanced Windows Cleaner 2009-06-30 23:17 . 2009-06-30 23:17 -------- d-----w- c:\documents and settings\Alyssa\Application Data\Sammsoft 2009-06-30 23:09 . 2009-06-30 23:09 -------- d-----w- c:\program files\FreeRAM XP Pro 2009-06-30 22:44 . 2009-06-30 22:44 -------- d-----w- c:\program files\Common Files\Macrovision Shared 2009-06-30 21:31 . 2009-06-30 22:44 -------- d-----w- c:\documents and settings\Alyssa\Application Data\Download Manager 2009-06-30 12:54 . 2009-06-30 12:54 -------- dc----w- c:\documents and settings\All Users\Application Data\acccore 2009-06-30 12:53 . 2009-06-30 12:53 -------- d-----w- c:\documents and settings\Alyssa\Local Settings\Application Data\AOL 2009-06-30 12:53 . 2009-06-30 12:53 -------- d-----w- c:\program files\Common Files\AOL 2009-06-30 03:09 . 2009-06-30 03:09 -------- d-----w- c:\program files\uTorrent 2009-06-30 03:09 . 2009-07-12 14:38 -------- d-----w- c:\documents and settings\Alyssa\Application Data\uTorrent 2009-06-30 02:51 . 2009-06-30 02:51 -------- d-----w- c:\documents and settings\Alyssa\Application Data\Publish Providers 2009-06-30 02:40 . 2009-06-30 02:51 -------- d-----w- c:\documents and settings\Alyssa\Application Data\Sony 2009-06-30 02:40 . 2009-06-30 02:40 -------- d-----w- c:\documents and settings\Alyssa\Local Settings\Application Data\Sony 2009-06-30 01:49 . 2009-06-30 01:49 -------- dc----w- c:\documents and settings\All Users\Application Data\Sony 2009-06-30 01:49 . 2009-06-30 01:49 -------- d-----w- c:\program files\Sony 2009-06-30 01:44 . 2009-06-30 01:44 -------- d-----w- c:\program files\MSBuild 2009-06-30 01:44 . 2009-06-30 01:44 102168 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat 2009-06-30 01:40 . 2009-06-30 01:40 -------- d-----w- c:\windows\system32\XPSViewer 2009-06-30 01:40 . 2009-06-30 01:40 -------- d-----w- c:\program files\Reference Assemblies 2009-06-30 01:39 . 2006-06-29 17:07 14048 ------w- c:\windows\system32\spmsg2.dll 2009-06-30 00:22 . 2009-06-30 00:23 52770576 ----a-w- c:\documents and settings\Alyssa\Application Data\Sony Setup\64993CD0-67D1-4244-A2BC-FD73F4DA5B62\dotnetfx3.exe 2009-06-30 00:22 . 2009-06-30 00:22 -------- d-----w- c:\documents and settings\Alyssa\Application Data\Sony Setup 2009-06-29 21:40 . 2009-06-29 21:40 -------- d-----w- c:\documents and settings\Alyssa\Application Data\acccore 2009-06-29 21:40 . 2009-06-29 21:40 -------- d-----w- c:\documents and settings\Alyssa\Local Settings\Application Data\AOL OCP 2009-06-29 02:13 . 2009-06-29 02:13 -------- d-----w- c:\documents and settings\Alyssa\Application Data\DivX 2009-06-29 02:07 . 2009-06-29 02:10 -------- d-----w- c:\program files\Common Files\DivX Shared 2009-06-29 02:07 . 2009-06-30 15:26 -------- d-----w- c:\documents and settings\Alyssa\Local Settings\Application Data\WMTools Downloaded Files 2009-06-29 00:43 . 2009-07-02 22:08 -------- d-----w- c:\documents and settings\Alyssa\Local Settings\Application Data\Adobe 2009-06-26 04:08 . 2009-06-26 04:08 -------- d-----w- c:\documents and settings\Alyssa\Application Data\HPQ 2009-06-26 03:56 . 2009-06-26 03:56 -------- d-----w- c:\documents and settings\Alyssa\Local Settings\Application Data\MicroVision Applications 2009-06-26 03:33 . 2009-07-06 14:09 -------- d-----w- c:\documents and settings\Alyssa\Contacts 2009-06-25 22:59 . 2009-06-25 22:59 -------- d-----r- c:\program files\( Emulators ) 2009-06-25 22:59 . 2009-06-25 23:00 -------- d-----w- c:\program files\Virtual TI-83 Plus 2009-06-25 21:29 . 2009-06-25 21:29 -------- d-----w- c:\documents and settings\Alyssa\Local Settings\Application Data\Yahoo 2009-06-25 21:27 . 2009-06-25 21:27 -------- d-----w- c:\documents and settings\Alyssa\Local Settings\Application Data\IsolatedStorage 2009-06-25 21:26 . 2009-06-25 21:26 -------- d-----w- c:\documents and settings\Alyssa\Local Settings\Application Data\HP 2009-06-25 21:26 . 2009-07-06 14:30 32584 ----a-w- c:\documents and settings\Alyssa\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-06-25 21:26 . 2009-06-25 21:26 129 ----a-w- c:\documents and settings\Alyssa\Local Settings\Application Data\fusioncache.dat 2009-06-25 16:01 . 2009-06-25 16:01 -------- d-----w- c:\documents and settings\Alyssa\Local Settings\Application Data\Mozilla 2009-06-25 14:37 . 2008-04-13 16:44 2560 -c--a-w- c:\documents and settings\All Users\Application Data\Microsoft\USMT\iconlib.dll 2009-06-25 13:18 . 2009-06-25 13:18 -------- d-----w- c:\documents and settings\Alyssa\Application Data\Yahoo! 2009-06-25 13:18 . 2009-06-25 13:18 -------- d-----w- c:\documents and settings\Alyssa\Local Settings\Application Data\Google 2009-06-25 13:03 . 2009-06-26 03:24 -------- d-----w- c:\documents and settings\Alyssa\Application Data\HP 2009-06-13 03:35 . 2009-06-13 03:35 -------- d-----w- c:\windows\system32\scripting 2009-06-13 03:35 . 2009-06-13 03:35 -------- d-----w- c:\windows\l2schemas 2009-06-13 03:35 . 2009-06-13 03:35 -------- d-----w- c:\windows\system32\en 2009-06-13 03:35 . 2009-06-13 03:35 -------- d-----w- c:\windows\system32\bits 2009-06-13 03:30 . 2009-06-13 03:35 -------- d-----w- c:\windows\ServicePackFiles 2009-06-13 03:05 . 2009-06-13 03:05 -------- d-----w- c:\windows\EHome . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-07-12 14:04 . 2008-06-11 23:47 -------- dc----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2009-07-12 13:55 . 2008-06-12 01:20 -------- dc--a-w- c:\documents and settings\All Users\Application Data\TEMP 2009-07-11 13:51 . 2007-03-10 20:16 -------- dc----w- c:\documents and settings\All Users\Application Data\Google Updater 2009-07-10 23:09 . 2009-07-10 23:09 312847 ------w- c:\windows\system32\14f2b948bc4dcf2b8c8cbafdb23b2982.TMP 2009-07-10 15:05 . 2008-06-11 23:47 -------- d-----w- c:\program files\Spybot - Search & Destroy 2009-07-06 14:26 . 2008-06-12 12:32 -------- d-----w- c:\program files\Windows Live 2009-07-03 14:52 . 2009-04-15 19:13 145544 ----a-w- c:\windows\system32\drivers\bdfm.sys 2009-07-02 02:56 . 2006-08-01 19:13 -------- d-----w- c:\program files\Common Files\Symantec Shared 2009-06-30 23:26 . 2008-06-12 23:15 -------- d-----w- c:\program files\Microsoft CAPICOM 2.1.0.2 2009-06-30 23:26 . 2007-05-14 00:03 -------- d-----w- c:\program files\AIM6 2009-06-30 23:06 . 2006-12-02 22:05 -------- d-----w- c:\program files\CCleaner 2009-06-30 22:56 . 2006-08-01 18:53 -------- d-----w- c:\program files\Common Files\Adobe 2009-06-30 12:54 . 2007-05-14 00:04 -------- dc----w- c:\documents and settings\All Users\Application Data\Viewpoint 2009-06-30 12:53 . 2007-05-14 00:05 -------- dc----w- c:\documents and settings\All Users\Application Data\AOL 2009-06-30 12:45 . 2007-05-14 00:03 -------- dc----w- c:\documents and settings\All Users\Application Data\AOL Downloads 2009-06-30 00:31 . 2006-08-01 18:43 -------- dc----w- c:\documents and settings\All Users\Application Data\WildTangent 2009-06-29 02:10 . 2008-06-17 18:02 -------- d-----w- c:\program files\DivX 2009-06-27 18:01 . 2006-08-01 18:34 -------- d-----w- c:\program files\HP 2009-06-26 03:50 . 2006-08-01 18:47 -------- d--h--w- c:\program files\InstallShield Installation Information 2009-06-26 03:47 . 2006-08-01 18:35 -------- d-----w- c:\program files\Common Files\Sonic Shared 2009-06-26 03:47 . 2006-08-01 18:35 -------- d-----w- c:\program files\Common Files\HP 2009-06-25 21:29 . 2009-03-09 00:28 -------- dc----w- c:\documents and settings\All Users\Application Data\Yahoo! 2009-06-25 13:37 . 2009-04-12 23:58 -------- d-----w- c:\program files\Java Web Start 2009-06-13 03:39 . 2005-12-05 06:49 82623 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat 2009-06-13 03:39 . 2009-06-13 03:38 208896 ----a-w- c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\WebHelper.dll 2009-06-13 03:38 . 2009-06-13 03:38 45056 ----a-w- c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\uninstallUI\eHelpSetup.exe 2009-06-13 03:38 . 2009-06-13 03:38 61440 ----a-w- c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\modemutil.dll 2009-06-13 03:38 . 2009-06-13 03:38 44032 ----a-w- c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\Scripts\devcon.exe 2009-06-13 03:38 . 2009-06-13 03:38 40960 ----a-w- c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\ScDmi.dll 2009-06-13 03:38 . 2009-06-13 03:38 32768 ----a-w- c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\uploadHSC.dll 2009-06-13 03:38 . 2009-06-13 03:38 32768 ----a-w- c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\Scom.dll 2009-06-13 03:38 . 2009-06-13 03:38 163840 ----a-w- c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\modemcheck.dll 2009-06-13 03:38 . 2009-06-13 03:38 341048 ----a-w- c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\HPBasicDetection3.dll 2009-05-19 05:36 . 2009-06-30 12:45 97072 -c--a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\SUD4426\bsetutil.exe 2009-05-19 05:36 . 2009-06-30 12:45 2884832 -c--a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\SUD4426\vwpt.exe 2009-05-19 05:36 . 2009-06-30 12:45 28 -c--a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\SUD4426\unregister.bat 2009-05-19 05:36 . 2009-06-30 12:45 25 -c--a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\SUD4426\register.bat 2009-05-19 05:36 . 2009-06-30 12:45 1484856 -c--a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\SUD4426\toolbar.exe 2009-05-19 05:36 . 2009-06-30 12:45 142040 -c--a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\SUD4426\alsetup.exe 2009-05-19 05:36 . 2009-06-30 12:45 30512 -c--a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\SUD4426\Uninstaller.exe 2009-05-19 05:36 . 2009-06-30 12:45 111920 -c--a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\SUD4426\AOLSearch.dll 2009-05-07 15:32 . 2004-08-04 11:00 345600 ----a-w- c:\windows\system32\localspl.dll 2009-05-01 21:02 . 2009-05-01 21:02 90112 ----a-w- c:\windows\system32\dpl100.dll 2009-05-01 21:02 . 2009-05-01 21:02 823296 ----a-w- c:\windows\system32\divx_xx0c.dll 2009-05-01 21:02 . 2009-05-01 21:02 823296 ----a-w- c:\windows\system32\divx_xx07.dll 2009-05-01 21:02 . 2009-05-01 21:02 815104 ----a-w- c:\windows\system32\divx_xx0a.dll 2009-05-01 21:02 . 2009-05-01 21:02 811008 ----a-w- c:\windows\system32\divx_xx16.dll 2009-05-01 21:02 . 2009-05-01 21:02 802816 ----a-w- c:\windows\system32\divx_xx11.dll 2009-05-01 21:02 . 2009-05-01 21:02 685056 ----a-w- c:\windows\system32\DivX.dll 2009-04-29 04:46 . 2004-08-04 11:00 666624 ----a-w- c:\windows\system32\wininet.dll 2009-04-17 12:26 . 2004-08-04 11:00 1847168 ----a-w- c:\windows\system32\win32k.sys 2009-04-15 14:51 . 2004-08-04 11:00 585216 ----a-w- c:\windows\system32\rpcrt4.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-03-30 68856] "uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2009-07-10 288048] "AROReminder"="c:\program files\Advanced Registry Optimizer\ARO.exe" [2007-02-02 2074752] "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-05-09 7311360] "Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2005-07-23 237568] "HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2006-02-16 249856] "HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2006-08-01 180269] "AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712] "BDAgent"="c:\program files\BitDefender\BitDefender 2009\bdagent.exe" [2009-07-03 782336] "ftutil2"="ftutil2.dll" - c:\windows\system32\ftutil2.dll [2004-06-07 106496] "RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2006-06-14 16239616] "nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2006-05-09 1519616] c:\documents and settings\All Users\Start Menu\Programs\Startup\ HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472] [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Compaq Connections\\5577497\\Program\\Compaq Connections.exe"= "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\AIM6\\aim6.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"= "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015 "1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016 "500:UDP"= 500:UDP:@xpsp2res.dll,-22017 "5353:TCP"= 5353:TCP:Adobe CSI CS4 "8085:TCP"= 8085:TCP:drv R1 drvdrv;drvdrv;c:\program files\drv\drv.sys [7/1/2009 8:29 PM 9344] R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [6/12/2008 8:27 AM 24652] R3 bdfm;BDFM;c:\windows\system32\drivers\bdfm.sys [4/15/2009 3:13 PM 145544] S0 d9aa3e4c115132d2aa59c76bd90d4659;d9aa3e4c115132d2aa59c76bd90d4659;c:\windows\system32\d9aa3e4c115132d2aa59c76bd90d4659.sys --> c:\windows\system32\d9aa3e4c115132d2aa59c76bd90d4659.sys [?] S3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;c:\windows\system32\drivers\wg111v2.sys [12/26/2007 3:47 AM 272128] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] drv REG_MULTI_SZ drv bdx REG_MULTI_SZ scan . Contents of the 'Scheduled Tasks' folder 2009-07-12 c:\windows\Tasks\Google Software Updater.job - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-02-04 02:48] . - - - - ORPHANS REMOVED - - - - BHO-{D76AB2A1-00F3-42BD-F434-00BBC39C8953} - (no file) HKCU-Run-GridinSoft Trojan Killer - c:\program files\Trojan Killer\trojankiller.exe HKCU-Run-Aim6 - (no file) HKLM-Run-PCDrProfiler - (no file) SharedTaskScheduler-{D76AB2A1-00F3-42BD-F434-00BBC39C8953} - (no file) SharedTaskScheduler-ThreadingModel - (no file) . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.com/ uSearch Page = hxxp://www.google.com uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PRESARIO&pf=desktop uSearch Bar = hxxp://www.google.com/ie mDefault_Search_URL = hxxp://www.google.com/ie mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=64&bd=PRESARIO&pf=desktop mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PRESARIO&pf=desktop uInternet Connection Wizard,ShellNext = iexplore uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s mSearchAssistant = hxxp://www.google.com/ie FF - ProfilePath - c:\documents and settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\m5peofr8.default\ FF - prefs.js: browser.startup.homepage - hxxp://google.com FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll FF - plugin: c:\program files\Java\j2re1.4.1\bin\NPJava11.dll FF - plugin: c:\program files\Java\j2re1.4.1\bin\NPJava12.dll FF - plugin: c:\program files\Java\j2re1.4.1\bin\NPJava13.dll FF - plugin: c:\program files\Java\j2re1.4.1\bin\NPJava32.dll FF - plugin: c:\program files\Java\j2re1.4.1\bin\NPJPI141.dll FF - plugin: c:\program files\Java\j2re1.4.1\bin\NPOJI610.dll FF - plugin: c:\program files\Mozilla FireFox\plugins\npViewpoint.dll FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll . ************************************************************************ catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-07-12 10:37 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ********************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'explorer.exe'(500) c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Other Running Processes ------------------------ . c:\program files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe c:\program files\BitDefender\BitDefender 2009\vsserv.exe c:\windows\system32\nvsvc32.exe c:\windows\system32\HPZipm12.exe c:\program files\BitDefender\BitDefender 2009\seccenter.exe . ********************************************************************** . Completion time: 2009-07-12 10:46 - machine was rebooted ComboFix-quarantined-files.txt 2009-07-12 14:46 Pre-Run: 90,854,526,976 bytes free Post-Run: 90,770,116,608 bytes free 292 --- E O F --- 2009-07-09 07:02 MBR Log:** Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.6 by Gmer, http://www.gmer.net device: opened successfully user: MBR read successfully kernel: MBR read successfully user & kernel MBR OK MBR rootkit code detected ! copy of MBR has been found in sector 0x0DF93410 malicious code @ sector 0x0DF93413 ! PE file found in sector at 0x0DF93429 !

07-12-2009, 02:47 PM	#4 (permalink)
chemist Moderator, Analyst, Security Team; Rangemaster, TSF Academy Join Date: Oct 2007 Location: Georgia Posts: 10,604 OS: XP SP3	Re: Links keep redirecting, I.E acting wacko, etc. Hello Alyssapie. Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ Please uninstall the following via Start->(or My Computer)->Control Panel->Add or Remove Programs if it still exists: Viewpoint Media Player<<This is considered foistware instead of malware since it is installed without users approval, but doesn't spy or do anything "bad". Please read here and here Also, remove the Viewpoint plugins from within Firefox. ------------------------------------------------------ I see you have P2P software ( uTorrent ) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information. Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares. References for the risk of these programs are here and here. I would strongly recommend that you uninstall it, however that choice is up to you. If you choose to remove this program, you can do so via Control Panel >> Add or Remove Programs. ------------------------------------------------------ Close any open browsers. Disable your antivirus and antispyware applications, usually via a right-click on the System Tray icon. They may otherwise interfere with ComboFix. Open Notepad and copy/paste all the text in the codebox below into Notepad: Code: http://www.techsupportforum.com/security-center/virus-trojan-spyware-help/393237-links-keep-redirecting-i-e-acting-wacko-etc.html#post2235995 Collect:: c:\program files\drv\drv.sys Folder:: c:\program files\Common Files\Symantec Shared c:\program files\TrojanHunter 5.1 c:\program files\drv DDS:: uInternet Connection Wizard,ShellNext = iexplore Registry:: [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000000 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=- [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] "drv"=- Driver:: d9aa3e4c115132d2aa59c76bd90d4659 drvdrv Save this Notepad file as CFScript.txt to your Desktop and then close the file. Referring to the picture above, drag CFScript onto ComboFix If you are prompted to update ComboFix and have an internet connection, please choose Yes Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal. When finished, it shall produce a log for you. Please post that log, ComboFix.txt in your next reply. ------------------------------------------------------ Note When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture files to submit for analysis. Ensure you are connected to the internet and click OK on the message box. If you do not get a message box, please do the following: There should be a file named [4]-Submit_date@time.zip with today's date, located here: C:\QooBox\Quarantine\[4]-Submit_date@time.zip Using the 'Browse' button, please submit it to this site ==> http://www.bleepingcomputer.com/subm....php?channel=4 Please let me know if you successfully submitted the file. Thanks. ------------------------------------------------------ __________________ Our help is free but please donate Proud member of ASAP Proud member of UNITE

07-13-2009, 07:21 PM	#5 (permalink)
Alyssapie Registered User Join Date: Jul 2009 Location: Cincinnati, OH Posts: 15 OS: Windows XP SP3	Re: Links keep redirecting, I.E acting wacko, etc. Okay, I submitted the report to the requested site. :] Log: ComboFix 09-07-13.01 - Alyssa 07/13/2009 20:40.2.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.446.171 [GMT -4:00] Running from: c:\documents and settings\Alyssa\Desktop\Combo-Fix.exe Command switches used :: c:\documents and settings\Alyssa\Desktop\CFScript.txt file zipped: c:\program files\drv\drv.sys . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\program files\Common Files\Symantec Shared c:\program files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll c:\program files\drv c:\program files\drv\drv.dll c:\program files\drv\drv.sys c:\program files\TrojanHunter 5.1 c:\program files\TrojanHunter 5.1\contmenu.dll c:\program files\TrojanHunter 5.1\THGuard.exe . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_D9AA3E4C115132D2AA59C76BD90D4659 -------\Legacy_DRVDRV -------\Service_d9aa3e4c115132d2aa59c76bd90d4659 -------\Service_drvdrv ((((((((((((((((((((((((( Files Created from 2009-06-14 to 2009-07-14 ))))))))))))))))))))))))))))))) . 2009-07-12 14:31 . 2008-04-14 00:12 50176 ----a-w- c:\windows\system32\proquota.exe 2009-07-12 14:31 . 2008-04-14 00:12 50176 ----a-w- c:\windows\system32\dllcache\proquota.exe 2009-07-12 13:56 . 2009-07-12 13:56 -------- dc----w- c:\documents and settings\All Users\Application Data\NortonInstaller 2009-07-10 19:09 . 2004-08-18 01:34 442368 ----a-w- c:\windows\system32\vp6vfw.dll 2009-07-10 18:32 . 2009-07-10 18:32 721904 ----a-w- c:\windows\system32\drivers\sptd.sys 2009-07-10 18:32 . 2009-07-10 18:32 -------- d-----w- c:\documents and settings\Alyssa\Application Data\DAEMON Tools Lite 2009-07-09 15:38 . 2009-07-09 15:38 -------- d-----w- c:\documents and settings\Alyssa\Local Settings\Application Data\Identities 2009-07-09 02:10 . 2009-07-09 02:10 -------- d-----w- c:\documents and settings\Alyssa\Local Settings\Application Data\WinZip 2009-07-09 02:05 . 2009-07-09 02:10 -------- dc----w- c:\documents and settings\All Users\Application Data\WinZip 2009-07-06 21:03 . 2009-07-06 21:03 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache 2009-07-06 20:51 . 2009-07-06 20:51 -------- d-----w- c:\documents and settings\Alyssa\Application Data\WinPatrol 2009-07-06 20:51 . 2005-12-05 06:50 0 ----a-w- c:\documents and settings\Alyssa\Application Data\WinPatrol\Config.sys 2009-07-06 20:51 . 2005-12-05 06:50 0 ----a-w- c:\documents and settings\Alyssa\Application Data\WinPatrol\Autoexec.bat 2009-07-06 20:42 . 2009-07-06 20:42 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache 2009-07-06 19:42 . 2009-07-06 19:42 -------- d-----w- c:\documents and settings\Alyssa\Local Settings\Application Data\Help 2009-07-06 17:01 . 2009-07-10 15:05 -------- d-----w- c:\program files\CleanUp! 2009-07-06 14:31 . 2009-07-14 01:05 -------- d-----w- c:\documents and settings\Alyssa\Tracing 2009-07-06 14:30 . 2009-07-06 14:30 -------- dc----w- c:\documents and settings\All Users\Application Data\Messenger Plus! 2009-07-06 14:26 . 2009-07-06 14:26 -------- d-----w- c:\program files\Microsoft 2009-07-06 14:24 . 2009-07-06 14:24 -------- d-----w- c:\program files\Common Files\Windows Live 2009-07-04 19:42 . 2009-07-04 19:42 -------- d-sh--w- c:\documents and settings\Alyssa\PrivacIE 2009-07-03 15:24 . 2009-07-09 07:09 81984 ----a-w- c:\windows\system32\bdod.bin 2009-07-03 12:25 . 2009-07-03 12:25 -------- d-sh--w- c:\documents and settings\Alyssa\IETldCache 2009-07-03 11:26 . 2009-06-02 10:12 102912 ------w- c:\windows\system32\dllcache\iecompat.dll 2009-07-03 11:25 . 2009-07-08 11:49 -------- d-----w- c:\windows\ie8updates 2009-07-03 11:24 . 2009-04-30 21:22 12800 ------w- c:\windows\system32\dllcache\xpshims.dll 2009-07-03 11:24 . 2009-04-30 21:22 246272 ------w- c:\windows\system32\dllcache\ieproxy.dll 2009-07-03 11:23 . 2009-04-29 04:46 81920 ----a-w- c:\windows\system32\ieencode.dll 2009-07-03 11:23 . 2009-04-29 04:46 81920 ----a-w- c:\windows\system32\dllcache\ieencode.dll 2009-07-03 01:49 . 2009-07-03 01:49 -------- d-----w- c:\documents and settings\Alyssa\Application Data\Template 2009-07-02 23:32 . 2009-07-02 23:32 -------- d-----w- c:\documents and settings\Alyssa\Application Data\BitDefender 2009-07-02 23:31 . 2009-07-03 12:28 -------- dc----w- c:\documents and settings\All Users\Application Data\BitDefender 2009-07-02 23:31 . 2009-07-02 23:31 -------- d-----w- c:\program files\BitDefender 2009-07-02 23:29 . 2009-07-02 23:31 -------- d-----w- c:\program files\Common Files\BitDefender 2009-07-02 23:28 . 2006-06-19 17:01 69632 ----a-w- c:\windows\system32\ztvcabinet.dll 2009-07-02 23:28 . 2006-05-25 19:52 162304 ----a-w- c:\windows\system32\ztvunrar36.dll 2009-07-02 23:28 . 2005-08-26 05:50 77312 ----a-w- c:\windows\system32\ztvunace26.dll 2009-07-02 23:28 . 2003-02-03 00:06 153088 ----a-w- c:\windows\system32\unrar3.dll 2009-07-02 23:28 . 2002-03-06 05:00 75264 ----a-w- c:\windows\system32\unacev2.dll 2009-07-02 23:28 . 2009-07-02 23:28 -------- d-----w- c:\documents and settings\Alyssa\Application Data\Simply Super Software 2009-07-02 23:28 . 2009-07-02 23:28 -------- dc----w- c:\documents and settings\All Users\Application Data\Simply Super Software 2009-07-02 22:09 . 2009-07-02 22:09 -------- d-----w- c:\documents and settings\Alyssa\Application Data\AdobeUM 2009-07-02 16:42 . 2009-07-02 16:42 41831992 ----a-w- c:\program files\Norman Malware Cleaner.exe 2009-07-02 00:36 . 2009-07-02 00:36 -------- d-----w- c:\documents and settings\Alyssa\Application Data\Lavasoft 2009-07-02 00:30 . 2009-07-02 00:30 -------- d-----w- c:\documents and settings\NetworkService\Application Data\Yahoo! 2009-06-30 23:54 . 2009-07-01 04:25 -------- dc----w- c:\documents and settings\All Users\Application Data\FLEXnet 2009-06-30 23:23 . 2009-06-30 23:26 -------- d-----w- c:\program files\Advanced Windows Cleaner 2009-06-30 23:17 . 2009-06-30 23:17 -------- d-----w- c:\documents and settings\Alyssa\Application Data\Sammsoft 2009-06-30 23:09 . 2009-06-30 23:09 -------- d-----w- c:\program files\FreeRAM XP Pro 2009-06-30 22:44 . 2009-06-30 22:44 -------- d-----w- c:\program files\Common Files\Macrovision Shared 2009-06-30 21:31 . 2009-06-30 22:44 -------- d-----w- c:\documents and settings\Alyssa\Application Data\Download Manager 2009-06-30 12:54 . 2009-06-30 12:54 -------- dc----w- c:\documents and settings\All Users\Application Data\acccore 2009-06-30 12:53 . 2009-06-30 12:53 -------- d-----w- c:\documents and settings\Alyssa\Local Settings\Application Data\AOL 2009-06-30 12:53 . 2009-06-30 12:53 -------- d-----w- c:\program files\Common Files\AOL 2009-06-30 03:09 . 2009-06-30 03:09 -------- d-----w- c:\program files\uTorrent 2009-06-30 03:09 . 2009-07-14 01:05 -------- d-----w- c:\documents and settings\Alyssa\Application Data\uTorrent 2009-06-30 02:51 . 2009-06-30 02:51 -------- d-----w- c:\documents and settings\Alyssa\Application Data\Publish Providers 2009-06-30 02:40 . 2009-06-30 02:51 -------- d-----w- c:\documents and settings\Alyssa\Application Data\Sony 2009-06-30 02:40 . 2009-06-30 02:40 -------- d-----w- c:\documents and settings\Alyssa\Local Settings\Application Data\Sony 2009-06-30 01:49 . 2009-06-30 01:49 -------- dc----w- c:\documents and settings\All Users\Application Data\Sony 2009-06-30 01:49 . 2009-06-30 01:49 -------- d-----w- c:\program files\Sony 2009-06-30 01:44 . 2009-06-30 01:44 -------- d-----w- c:\program files\MSBuild 2009-06-30 01:44 . 2009-06-30 01:44 102168 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat 2009-06-30 01:40 . 2009-06-30 01:40 -------- d-----w- c:\windows\system32\XPSViewer 2009-06-30 01:40 . 2009-06-30 01:40 -------- d-----w- c:\program files\Reference Assemblies 2009-06-30 01:39 . 2006-06-29 17:07 14048 ------w- c:\windows\system32\spmsg2.dll 2009-06-30 00:22 . 2009-06-30 00:23 52770576 ----a-w- c:\documents and settings\Alyssa\Application Data\Sony Setup\64993CD0-67D1-4244-A2BC-FD73F4DA5B62\dotnetfx3.exe 2009-06-30 00:22 . 2009-06-30 00:22 -------- d-----w- c:\documents and settings\Alyssa\Application Data\Sony Setup 2009-06-29 21:40 . 2009-06-29 21:40 -------- d-----w- c:\documents and settings\Alyssa\Application Data\acccore 2009-06-29 21:40 . 2009-06-29 21:40 -------- d-----w- c:\documents and settings\Alyssa\Local Settings\Application Data\AOL OCP 2009-06-29 02:13 . 2009-06-29 02:13 -------- d-----w- c:\documents and settings\Alyssa\Application Data\DivX 2009-06-29 02:07 . 2009-06-29 02:10 -------- d-----w- c:\program files\Common Files\DivX Shared 2009-06-29 02:07 . 2009-06-30 15:26 -------- d-----w- c:\documents and settings\Alyssa\Local Settings\Application Data\WMTools Downloaded Files 2009-06-29 00:43 . 2009-07-02 22:08 -------- d-----w- c:\documents and settings\Alyssa\Local Settings\Application Data\Adobe 2009-06-26 04:08 . 2009-06-26 04:08 -------- d-----w- c:\documents and settings\Alyssa\Application Data\HPQ 2009-06-26 03:56 . 2009-06-26 03:56 -------- d-----w- c:\documents and settings\Alyssa\Local Settings\Application Data\MicroVision Applications 2009-06-26 03:33 . 2009-07-06 14:09 -------- d-----w- c:\documents and settings\Alyssa\Contacts 2009-06-25 22:59 . 2009-06-25 22:59 -------- d-----r- c:\program files\( Emulators ) 2009-06-25 22:59 . 2009-06-25 23:00 -------- d-----w- c:\program files\Virtual TI-83 Plus 2009-06-25 21:29 . 2009-06-25 21:29 -------- d-----w- c:\documents and settings\Alyssa\Local Settings\Application Data\Yahoo 2009-06-25 21:27 . 2009-06-25 21:27 -------- d-----w- c:\documents and settings\Alyssa\Local Settings\Application Data\IsolatedStorage 2009-06-25 21:26 . 2009-06-25 21:26 -------- d-----w- c:\documents and settings\Alyssa\Local Settings\Application Data\HP 2009-06-25 21:26 . 2009-07-06 14:30 32584 ----a-w- c:\documents and settings\Alyssa\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-06-25 21:26 . 2009-06-25 21:26 129 ----a-w- c:\documents and settings\Alyssa\Local Settings\Application Data\fusioncache.dat 2009-06-25 16:01 . 2009-06-25 16:01 -------- d-----w- c:\documents and settings\Alyssa\Local Settings\Application Data\Mozilla 2009-06-25 14:37 . 2008-04-13 16:44 2560 -c--a-w- c:\documents and settings\All Users\Application Data\Microsoft\USMT\iconlib.dll 2009-06-25 13:18 . 2009-06-25 13:18 -------- d-----w- c:\documents and settings\Alyssa\Application Data\Yahoo! 2009-06-25 13:18 . 2009-06-25 13:18 -------- d-----w- c:\documents and settings\Alyssa\Local Settings\Application Data\Google 2009-06-25 13:03 . 2009-06-26 03:24 -------- d-----w- c:\documents and settings\Alyssa\Application Data\HP . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-07-14 00:31 . 2007-05-14 00:04 -------- dc----w- c:\documents and settings\All Users\Application Data\Viewpoint 2009-07-13 15:53 . 2007-03-10 20:16 -------- dc----w- c:\documents and settings\All Users\Application Data\Google Updater 2009-07-12 15:49 . 2008-06-11 23:47 -------- dc----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2009-07-12 13:55 . 2008-06-12 01:20 -------- dc--a-w- c:\documents and settings\All Users\Application Data\TEMP 2009-07-10 23:09 . 2009-07-10 23:09 312847 ------w- c:\windows\system32\14f2b948bc4dcf2b8c8cbafdb23b2982.TMP 2009-07-10 15:05 . 2008-06-11 23:47 -------- d-----w- c:\program files\Spybot - Search & Destroy 2009-07-06 14:26 . 2008-06-12 12:32 -------- d-----w- c:\program files\Windows Live 2009-07-03 14:52 . 2009-04-15 19:13 145544 ----a-w- c:\windows\system32\drivers\bdfm.sys 2009-06-30 23:26 . 2008-06-12 23:15 -------- d-----w- c:\program files\Microsoft CAPICOM 2.1.0.2 2009-06-30 23:26 . 2007-05-14 00:03 -------- d-----w- c:\program files\AIM6 2009-06-30 23:06 . 2006-12-02 22:05 -------- d-----w- c:\program files\CCleaner 2009-06-30 22:56 . 2006-08-01 18:53 -------- d-----w- c:\program files\Common Files\Adobe 2009-06-30 12:53 . 2007-05-14 00:05 -------- dc----w- c:\documents and settings\All Users\Application Data\AOL 2009-06-30 12:45 . 2007-05-14 00:03 -------- dc----w- c:\documents and settings\All Users\Application Data\AOL Downloads 2009-06-30 00:31 . 2006-08-01 18:43 -------- dc----w- c:\documents and settings\All Users\Application Data\WildTangent 2009-06-29 02:10 . 2008-06-17 18:02 -------- d-----w- c:\program files\DivX 2009-06-27 18:01 . 2006-08-01 18:34 -------- d-----w- c:\program files\HP 2009-06-26 03:50 . 2006-08-01 18:47 -------- d--h--w- c:\program files\InstallShield Installation Information 2009-06-26 03:47 . 2006-08-01 18:35 -------- d-----w- c:\program files\Common Files\Sonic Shared 2009-06-26 03:47 . 2006-08-01 18:35 -------- d-----w- c:\program files\Common Files\HP 2009-06-25 21:29 . 2009-03-09 00:28 -------- dc----w- c:\documents and settings\All Users\Application Data\Yahoo! 2009-06-25 13:37 . 2009-04-12 23:58 -------- d-----w- c:\program files\Java Web Start 2009-06-13 03:39 . 2005-12-05 06:49 82623 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat 2009-06-13 03:39 . 2009-06-13 03:38 208896 ----a-w- c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\WebHelper.dll 2009-06-13 03:38 . 2009-06-13 03:38 45056 ----a-w- c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\uninstallUI\eHelpSetup.exe 2009-06-13 03:38 . 2009-06-13 03:38 61440 ----a-w- c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\modemutil.dll 2009-06-13 03:38 . 2009-06-13 03:38 44032 ----a-w- c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\Scripts\devcon.exe 2009-06-13 03:38 . 2009-06-13 03:38 40960 ----a-w- c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\ScDmi.dll 2009-06-13 03:38 . 2009-06-13 03:38 32768 ----a-w- c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\uploadHSC.dll 2009-06-13 03:38 . 2009-06-13 03:38 32768 ----a-w- c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\Scom.dll 2009-06-13 03:38 . 2009-06-13 03:38 163840 ----a-w- c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\modemcheck.dll 2009-06-13 03:38 . 2009-06-13 03:38 341048 ----a-w- c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\HPBasicDetection3.dll 2009-05-19 05:36 . 2009-06-30 12:45 97072 -c--a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\SUD4426\bsetutil.exe 2009-05-19 05:36 . 2009-06-30 12:45 2884832 -c--a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\SUD4426\vwpt.exe 2009-05-19 05:36 . 2009-06-30 12:45 28 -c--a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\SUD4426\unregister.bat 2009-05-19 05:36 . 2009-06-30 12:45 25 -c--a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\SUD4426\register.bat 2009-05-19 05:36 . 2009-06-30 12:45 1484856 -c--a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\SUD4426\toolbar.exe 2009-05-19 05:36 . 2009-06-30 12:45 142040 -c--a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\SUD4426\alsetup.exe 2009-05-19 05:36 . 2009-06-30 12:45 30512 -c--a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\SUD4426\Uninstaller.exe 2009-05-19 05:36 . 2009-06-30 12:45 111920 -c--a-w- c:\documents and settings\All Users\Application Data\AOL Downloads\SUD4426\AOLSearch.dll 2009-05-07 15:32 . 2004-08-04 11:00 345600 ----a-w- c:\windows\system32\localspl.dll 2009-05-01 21:02 . 2009-05-01 21:02 90112 ----a-w- c:\windows\system32\dpl100.dll 2009-05-01 21:02 . 2009-05-01 21:02 823296 ----a-w- c:\windows\system32\divx_xx0c.dll 2009-05-01 21:02 . 2009-05-01 21:02 823296 ----a-w- c:\windows\system32\divx_xx07.dll 2009-05-01 21:02 . 2009-05-01 21:02 815104 ----a-w- c:\windows\system32\divx_xx0a.dll 2009-05-01 21:02 . 2009-05-01 21:02 811008 ----a-w- c:\windows\system32\divx_xx16.dll 2009-05-01 21:02 . 2009-05-01 21:02 802816 ----a-w- c:\windows\system32\divx_xx11.dll 2009-05-01 21:02 . 2009-05-01 21:02 685056 ----a-w- c:\windows\system32\DivX.dll 2009-04-29 04:46 . 2004-08-04 11:00 666624 ----a-w- c:\windows\system32\wininet.dll 2009-04-17 12:26 . 2004-08-04 11:00 1847168 ----a-w- c:\windows\system32\win32k.sys 2009-04-15 14:51 . 2004-08-04 11:00 585216 ----a-w- c:\windows\system32\rpcrt4.dll 2009-06-03 03:00 . 2009-06-25 14:49 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-03-30 68856] "uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2009-07-10 288048] "AROReminder"="c:\program files\Advanced Registry Optimizer\ARO.exe" [2007-02-02 2074752] "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-05-09 7311360] "Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2005-07-23 237568] "HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2006-02-16 249856] "HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2006-08-01 180269] "AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712] "BDAgent"="c:\program files\BitDefender\BitDefender 2009\bdagent.exe" [2009-07-03 782336] "ftutil2"="ftutil2.dll" - c:\windows\system32\ftutil2.dll [2004-06-07 106496] "RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2006-06-14 16239616] "nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2006-05-09 1519616] c:\documents and settings\All Users\Start Menu\Programs\Startup\ HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Compaq Connections\\5577497\\Program\\Compaq Connections.exe"= "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\AIM6\\aim6.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"= "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015 "1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016 "500:UDP"= 500:UDP:@xpsp2res.dll,-22017 "5353:TCP"= 5353:TCP:Adobe CSI CS4 "8085:TCP"= 8085:TCP:drv R3 bdfm;BDFM;c:\windows\system32\drivers\bdfm.sys [4/15/2009 3:13 PM 145544] S3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;c:\windows\system32\drivers\wg111v2.sys [12/26/2007 3:47 AM 272128] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] bdx REG_MULTI_SZ scan . Contents of the 'Scheduled Tasks' folder 2009-07-14 c:\windows\Tasks\Google Software Updater.job - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-02-04 02:48] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.com/ uSearch Page = hxxp://www.google.com uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PRESARIO&pf=desktop uSearch Bar = hxxp://www.google.com/ie mDefault_Search_URL = hxxp://www.google.com/ie mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=64&bd=PRESARIO&pf=desktop mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PRESARIO&pf=desktop uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s mSearchAssistant = hxxp://www.google.com/ie FF - ProfilePath - c:\documents and settings\Alyssa\Application Data\Mozilla\Firefox\Profiles\m5peofr8.default\ FF - prefs.js: browser.startup.homepage - hxxp://google.com FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll FF - plugin: c:\program files\Java\j2re1.4.1\bin\NPJava11.dll FF - plugin: c:\program files\Java\j2re1.4.1\bin\NPJava12.dll FF - plugin: c:\program files\Java\j2re1.4.1\bin\NPJava13.dll FF - plugin: c:\program files\Java\j2re1.4.1\bin\NPJava32.dll FF - plugin: c:\program files\Java\j2re1.4.1\bin\NPJPI141.dll FF - plugin: c:\program files\Java\j2re1.4.1\bin\NPOJI610.dll . ************************************************************************ catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-07-13 21:04 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ********************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'explorer.exe'(2960) c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll c:\program files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll c:\windows\system32\nvcpl.dll c:\windows\system32\nvshell.dll . ------------------------ Other Running Processes ------------------------ . c:\program files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe c:\program files\BitDefender\BitDefender 2009\vsserv.exe c:\windows\system32\nvsvc32.exe c:\windows\system32\HPZipm12.exe c:\windows\system32\wscntfy.exe c:\program files\BitDefender\BitDefender 2009\seccenter.exe . ************************************************************************ . Completion time: 2009-07-14 21:11 - machine was rebooted ComboFix-quarantined-files.txt 2009-07-14 01:11 ComboFix2.txt 2009-07-12 14:46 Pre-Run: 90,728,333,312 bytes free Post-Run: 90,730,586,112 bytes free 278 --- E O F --- 2009-07-09 07:02

07-13-2009, 09:22 PM	#6 (permalink)
chemist Moderator, Analyst, Security Team; Rangemaster, TSF Academy Join Date: Oct 2007 Location: Georgia Posts: 10,604 OS: XP SP3	Re: Links keep redirecting, I.E acting wacko, etc. Hello again, Alyssapie. Thanks for submitting the file. Please tell us how your system is behaving. Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ Open Notepad and copy/paste the entire contents of the codebox below into Notepad (don't forget to copy and paste REGEDIT4): Code: REGEDIT4 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List] "8085:TCP"=- Save the file as fix.reg and choose to Save as type: - All Files then close the Notepad file. It should look like this: Double-click on fix.reg and choose Yes to merge/add it to the registry. Please delete the file afterwards. ------------------------------------------------------ Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update. Download the latest version of Java Runtime Environment (JRE) 6 and Save it to your Desktop. Scroll down to where it says Java Runtime Environment (JRE) 6 Update 14 The Java SE Runtime Environment (JRE) allows end-users to run Java applications. Click the Download button to the right. Select the Windows platform from the dropdown menu. Read the License Agreement and then check the box that says: I agree to the Java SE Runtime Environment 6 with JavaFX License Agreement Click Continue The page will refresh. Click on the link to download Windows Offline Installation and Save the file to your Desktop. Close any programs you may have running - especially your web browser. Go to Start(or My Computer) > Control Panel and double-click on Add or Remove Programs and remove all older versions of Java. Click (highlight) any item with Java Runtime Environment (JRE, J2SE, Java(TM) SE or Java(TM) 6) in the name. Click the Remove or Change/Remove button. Repeat as many times as necessary to remove each Java version. Reboot your computer once all Java components are removed. Then from your desktop double-click on jre-6u14-windows-i586-p.exe to install the newest version. After the install is complete, go back to your Control Panel(using Classic View) and click the Java icon. (looks like a coffee cup) On the General tab, under Temporary Internet Files, click the Settings button. Next, click on the Delete Files button. There are two options in the window to clear the cache - Leave BOTH Checked Applications and Applets Trace and Log Files Click OK on Delete Temporary Files Window. Note: This deletes ALL the Downloaded Applications and Applets from the CACHE Click OK to leave the Temporary Files Window. Click OK to leave the Java Control Panel. Delete jre-6u14-windows-i586-p.exe from your desktop. ------------------------------------------------------ Please download ATF-Cleaner by Atribune and Save it to your Desktop. Double-click ATF-Cleaner.exe to run the program. Under Main choose: Select All Click the Empty Selected button. If you use Firefox browser Click Firefox at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click No at the prompt. If you use Opera browser Click Opera at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click No at the prompt. Click Exit on the Main menu to close the program. For Technical Support, double-click the e-mail address located at the bottom of each menu. ------------------------------------------------------ Please run this online scan to help look for remnants. Establish an internet connection & perform an online scan at Kaspersky Online Scanner Ensure your external and/or USB drives are inserted during the scan. Click Accept, when prompted to download and install the program files and database of malware definitions. Click Run at any Security prompt. The program will then begin downloading and installing and will also update the database. Please be patient as this can take several minutes. Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan. Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it. Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined. Click View scan report at the bottom. Click the Save Report As... button. Click the Save as Text button to save the file to your desktop so that you may post it in your next reply. Note To optimize scanning time and produce a more sensible report for review: Close any open programs. Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan. Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%. ------------------------------------------------------ Please post the following in your next reply: Kaspersky report report on system behavior __________________ Our help is free but please donate Proud member of ASAP Proud member of UNITE

07-15-2009, 05:00 PM	#7 (permalink)
Alyssapie Registered User Join Date: Jul 2009 Location: Cincinnati, OH Posts: 15 OS: Windows XP SP3	Re: Links keep redirecting, I.E acting wacko, etc. Hi chemist! Sorry for the slight delay. My computer seems to be working as normal now! Now more annoying redirecting, or it acting really slow. Thank you!! <3 Report: -------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER 7.0 REPORT Wednesday, July 15, 2009 Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Program database last update: Wednesday, July 15, 2009 19:50:19 Records in database: 2471976 -------------------------------------------------------------------------------- Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: C:\ D:\ E:\ Scan statistics: Files scanned: 78053 Threat name: 4 Infected objects: 9 Suspicious objects: 0 Duration of the scan: 03:11:56 File name / Threat name / Threats count C:\Qoobox\Quarantine\C\Program Files\drv\drv.dll.vir Infected: Trojan-Downloader.Win32.Agent.chpc 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\dcebcfbeafeabaded.dll.vir Infected: Worm.Win32.AutoRun.raz 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\_dcebcfbeafeabaded_.dll.zip Infected: Worm.Win32.AutoRun.raz 2 C:\Qoobox\Quarantine\[4]-Submit_2009-07-13_20.39.56.zip Infected: Rootkit.Win32.Small.adn 1 C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP760\A0112089.dll Infected: Trojan-Downloader.Win32.Agent.chpc 1 C:\WINDOWS\system32\14f2b948bc4dcf2b8c8cbafdb23b2982.TMP Infected: Worm.Win32.AutoRun.raz 1 D:\I386\APPS\APP25742\src\CompaqPresario_Spring06.exe Infected: not-a-virus:AdWare.Win32.WeatherBug.a 1 D:\I386\APPS\APP25742\src\HPPavillion_Spring06.exe Infected: not-a-virus:AdWare.Win32.WeatherBug.a 1 The selected area was scanned.

07-15-2009, 07:41 PM	#8 (permalink)
chemist Moderator, Analyst, Security Team; Rangemaster, TSF Academy Join Date: Oct 2007 Location: Georgia Posts: 10,604 OS: XP SP3	Re: Links keep redirecting, I.E acting wacko, etc. Hello again, Alyssapie. QooBox is ComboFix's quarantine folder. System Volume Information is where Windows keeps old system restore points. Both will get deleted when we uninstall ComboFix. The two Spring06.exe files were factory installed on your recovery partition, so we will leave those be. ------------------------------------------------------ Go to Start > Run and copy/paste the following into the Run box and click OK: cmd /c del /a/f/q "C:\WINDOWS\system32\14f2b948bc4dcf2b8c8cbafdb23b2982.TMP" A DOS window will open and close again, this is normal. ------------------------------------------------------ Congratulations. Well done! Your logs appear clean. You should be good to go. Please disable BitDefender before uninstalling ComboFix and then re-enable it after doing so. Go to Start >> Run and Copy/Paste the following single-line command into the Run box and click OK: combofix /u This will uninstall ComboFix and delete ComboFix's quarantine folder. It will also implement some cleanup procedures, remove old System Restore Points which contain previous infections, and create a fresh, clean System Restore Point. Please re-enable your antivirus program and any other antispyware programs disabled earlier if you haven't already. Please re-enable TeaTimer: Open Spybot Search & Destroy. In the Mode menu click "Advanced mode" if not already selected. Choose "Yes" at the Warning prompt. Expand the "Tools" menu. Click "Resident". Check the "Resident "TeaTimer" (Protection of overall system settings) active." box. In the File menu click "Exit" to exit Spybot Search & Destroy. ------------------------------------------------------ You can safely delete any tools downloaded or any logs, files, and any shortcuts on your desktop that were created during this fix. ------------------------------------------------------ MICROSOFT UPDATES It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft and download all the critical updates to help prevent possible re-infection. SPYWARE PREVENTION This is a good time to set up protection against further attacks. In light of your recent problem, I'm sure you'd like to avoid any future infections. Please read these well written articles: How Did I Get Infected In The First Place? by TonyKlein How to Prevent Malware by miekiemoes To help protect your computer in the future I recommend that you get the following free programs if you do not already have them: WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware, or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites: Green to go Yellow for caution Red to stop WOT has an add-on available for both Firefox and IE. SpywareBlaster prevents the installation of ActiveX-based malware, blocks cookies, and restricts the actions of "bad" sites in Internet Explorer. See tutorial here MVPS HOSTS FILE replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. It basically prevents your computer from connecting to those sites by redirecting the attempted connections to 127.0.0.1, which is the IP of your local computer. See guide here and for Windows Vista here Download Host.zip and Save it to your Desktop. Right-click hosts.zip and select 'Extract all files' or 'Extract files...'. Follow the prompts and click 'Finish'. This will open the newly created hosts folder on your Desktop. Double-click on the included mvps.bat file, this will rename the existing HOSTS file to HOSTS.MVP, then it will copy the included updated HOSTS file to the correct location on your machine. Once updated you should see another prompt that the task was completed. IE-Spyad is another excellent program that places over 5000 dubious websites and domains in the IE Restricted list, which will help prevent attempts to infect your system. It basically prevents any downloads from the sites listed, although you will still be able to connect to the site. See tutorial here Keep your antivirus program and antispyware programs updated and scan with them on a regular basis. Please respond to this thread one more time so we can mark this thread as resolved. __________________ Our help is free but please donate Proud member of ASAP Proud member of UNITE

07-15-2009, 08:40 PM	#9 (permalink)
Alyssapie Registered User Join Date: Jul 2009 Location: Cincinnati, OH Posts: 15 OS: Windows XP SP3	Re: Links keep redirecting, I.E acting wacko, etc. Got it. Thank you so much! You guys are awesome. <3

07-15-2009, 10:18 PM	#10 (permalink)
chemist Moderator, Analyst, Security Team; Rangemaster, TSF Academy Join Date: Oct 2007 Location: Georgia Posts: 10,604 OS: XP SP3	Re: Links keep redirecting, I.E acting wacko, etc. You're very welcome, Alyssapie! Glad to have helped. __________________ Our help is free but please donate Proud member of ASAP Proud member of UNITE