Malware Infection

[Futility]

Hey guys, thanks again for all that you do. Today I was using Firefox and started getting message prompts to "protect" my system against malware. Also, my desktop background has been changed and currently says: "Warning! You are in danger. Your computer is infected with spyware. [Insert two more paragraphs of text about the dangers of spyware, etc]"

There was also a program running in the system tray that was masquerading as a spyware prevention/removal tool.

Here is the DDS log (others are attached below):

DDS (Ver_09-06-26.01) - NTFSx86
Run by Compaq_Administrator at 11:52:22.01 on Mon 07/13/2009
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_14
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1545 [GMT -5:00]


============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\Ati2evxx.exe
svchost.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\arservice.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\HPZipm12.exe
svchost.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\iPod\bin\iPodService.exe
C:\Documents and Settings\Compaq_Administrator\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.yahoo.com/
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PRESARIO&pf=desktop
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PRESARIO&pf=desktop
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
BHO: {D5BF49A0-94F3-52BD-F434-3604812C8955} - No File
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [<NO NAME>] c:\windows\temp\ovzq5b0qr.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [D-Link Wireless G WDA-1320] c:\program files\d-link\wireless g wda-1320\AirGCFG.exe
mRun: [ANIWZCS2Service] c:\program files\ani\aniwzcs2 service\WZCSLDR2.exe
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [HPDJ Taskbar Utility] c:\windows\system32\spool\drivers\w32x86\3\hpztsb04.exe
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [StartCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: [15403594] c:\documents and settings\all users\application data\15403594\15403594.exe
StartupFolder: c:\docume~1\compaq~1\startm~1\programs\startup\openof~1.lnk - c:\program files\openoffice.org 3\program\quickstart.exe
IE: {E2D4D26B-0180-43a4-B05F-462D6D54C789} - c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\iebutton\support.htm
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} - hxxp://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab
DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} - hxxp://upload.facebook.com/controls/FacebookPhotoUploader3.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} - hxxp://www.crucial.com/controls/cpcScanner.cab
DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Notify: AtiExtEvent - Ati2evxx.dll

================= FIREFOX ===================

FF - ProfilePath -
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}

============= SERVICES / DRIVERS ===============

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2008-8-4 28544]
R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]
R3 A3AB;D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB);c:\windows\system32\drivers\A3AB.sys [2005-8-25 466880]
S3 Alpham;Ideazon Fang Composite Keyboard Driver;c:\windows\system32\drivers\Alpham.sys [2005-12-4 34944]
S3 AtiHdmiService;ATI Function Driver for HDMI Service;c:\windows\system32\drivers\AtiHdmi.sys [2007-7-20 99856]
S3 DNINDIS5;DNINDIS5 NDIS Protocol Driver;c:\windows\system32\DNINDIS5.sys [2007-5-4 17149]
S3 N3AB;N3AB Wireless Network Adapter Service;c:\windows\system32\drivers\N3AB.sys [2007-5-6 457312]

=============== Created Last 30 ================

2009-07-13 11:25 <DIR> --d----- c:\docume~1\alluse~1\applic~1\15403594
2009-06-23 17:03 <DIR> --dsh--- c:\documents and settings\compaq_administrator\PrivacIE
2009-06-23 16:48 <DIR> --d----- c:\program files\Realtek
2009-06-23 16:35 <DIR> --dsh--- c:\documents and settings\compaq_administrator\IETldCache
2009-06-23 15:11 <DIR> --d----- c:\program files\common files\ATI Technologies
2009-06-23 15:09 <DIR> --d----- c:\program files\ATI Technologies

==================== Find3M ====================

2009-04-06 22:53 16,384 a--sh--- c:\windows\system32\config\systemprofile\local settings\application data\microsoft\feeds cache\index.dat
2009-01-06 07:00 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009010620090107\index.dat
2009-04-06 22:53 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009040620090407\index.dat

============= FINISH: 11:53:35.01 ===============

[Futility]

Also, I've noticed another symptom. When searching and clicking results via Google, Firefox is often re-routed to a completely different website, which displays an advertisement or referral service. This happens most frequently when I'm searching items related to popular keywords.

Sorry that this is technically a "bump" before 72 hours has passed, but I want to ensure I'm posting all relevant information.

[tetonbob]

Hello, and Welcome to TSF.

Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe.

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

---------------------------------------------------------------------------------------------

Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate.

Stay with me until given the 'all clear' even if symptoms diminish. Lack of symptoms does not always mean the job is complete.

Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by me or another helper at this forum.

---------------------------------------------------------------------------------------------

1. I see no AntiVirus application installed. An AntiVirus is a must have for machines connected to the internet today.
   
   Connecting to the Internet without antivirus protection is a "Welcome" doormat for malware. It can take as little as eight seconds to infect an unprotected computer.
   
   There are excellent free AntiVirus applications available today, so there's no reason to be unprotected.
   
   We will address that during the course of this fix. I will tell you when.
   
   ---------------------------------------------------------------------------------------------
   
2. Download ComboFix from this location:
   
   Link 1
   
   * IMPORTANT !!! Place combofix.exe on your Desktop
   
3. Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.
   
   
   You can get help on disabling your protection programs here
   
4. Double click on combofix.exe & follow the prompts.
   
5. As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
   
   Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
   
   
   
   
   
   The Windows recovery console will allow you to boot up into a special recovery mode that allows us to help you in the case that your computer has a problem after an attempted removal of malware.
   
   With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal.
   
   Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement.
   
   ComboFix will now automatically install the Microsoft Windows Recovery Console onto your computer, which will show up as a new option when booting up your computer. Do not select the Microsoft Windows Recovery Console option when you start your computer unless requested to by a helper.
   
   Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see a message that says:
   
   The Recovery Console was successfully installed.
   
   
   
   Click on Yes, to continue scanning for malware.
   
6. Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.
   
7. When finished, it shall produce a log for you. Post that log in your next reply
   
   Note:
   Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
   
   ---------------------------------------------------------------------------------------------
   
8. Ensure your AntiVirus and AntiSpyware applications are re-enabled.
   
   ---------------------------------------------------------------------------------------------

[Futility]

UPDATE: I was trying to avoid restarting my computer, knowing that the infection will often gets worse. Unfortunately restarting was unavoidable and now the infection is preventing me from opening any program. I can sidestep the problem by quickly getting into Task Manager as XP loads and killing the processes that are obviously spyware. The problem is now exactly as described in the following thread I found:

Infected: WARNING! you're in danger! Your computer is infected with Spyware!

Again, sorry for the premature "bump," but that's not the intent of my post. (As an aside, how can I edit my above posts? The permissions posted at the bottom say I'm allowed to, but I must be overlooking the Edit link somewhere)

[Futility]

My apologies, we posted this at almost the exact same time! I am subscribed to the thread and will perform all requested actions ASAP, starting now.

[Futility]

All symptoms of Malware have disappeared after running ComboFix (thank you x1000!), but I will definitely stick around and make sure everything is clean - as well as your recommendations for anti-virus/anti-malware software.




Here is the ComboFix log (sorry for the formatting - even with word wrap off it's breaking up lines):

ComboFix 09-07-14.08 - Compaq_Administrator 07/15/2009 15:16.3.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1649 [GMT -5:00]
Running from: c:\documents and settings\Compaq_Administrator\Desktop\Combo-Fix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\15403594
c:\documents and settings\All Users\Application Data\15403594\15403594
c:\documents and settings\All Users\Application Data\15403594\15403594.exe
c:\windows\kb913800.exe
c:\windows\system32\ATIODCLI.exe
c:\windows\system32\ATIODE.exe
c:\windows\system32\config\systemprofile\Desktop\System Security 2009.lnk
c:\windows\system32\config\systemprofile\Start Menu\Programs\MS AntiSpyware 2009
c:\windows\system32\config\systemprofile\Start Menu\Programs\MS AntiSpyware 2009\MS AntiSpyware 2009.lnk
c:\windows\system32\config\systemprofile\Start Menu\Programs\System Security
c:\windows\system32\config\systemprofile\Start Menu\Programs\System Security\System Security
c:\windows\system32\drivers\SKYNETavnojwsw.sys
c:\windows\system32\SKYNETnkyxudru.dat
c:\windows\system32\SKYNETsjpkdsbi.dat
c:\windows\system32\SKYNETuxfumuyn.dll
c:\windows\system32\SKYNETvdmovqjx.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_SKYNETymypltep


((((((((((((((((((((((((( Files Created from 2009-06-15 to 2009-07-15 )))))))))))))))))))))))))))))))
.

2009-06-25 11:24 . 2009-06-25 11:24 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2009-06-25 09:12 . 2009-06-25 09:12 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2009-06-23 22:03 . 2009-06-23 22:03 -------- d-sh--w- c:\documents and settings\Compaq_Administrator\PrivacIE
2009-06-23 21:49 . 2006-07-22 12:40 143360 ------w- c:\windows\system32\RtlCPAPI.dll
2009-06-23 21:49 . 2006-05-16 23:04 2879488 ------w- c:\windows\SkyTel.exe
2009-06-23 21:49 . 2005-07-15 21:48 40960 ------w- c:\windows\system32\ChCfg.exe
2009-06-23 21:48 . 2009-06-23 21:48 -------- d-----w- c:\program files\Realtek
2009-06-23 21:48 . 2005-04-17 03:20 487424 ------w- c:\windows\RtlExUpd.dll
2009-06-23 21:47 . 2009-06-23 21:47 -------- d-----w- C:\SWSetup
2009-06-23 21:36 . 2009-06-23 21:36 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2009-06-23 21:35 . 2009-06-23 21:35 -------- d-sh--w- c:\documents and settings\Compaq_Administrator\IETldCache
2009-06-23 21:09 . 2009-06-02 10:12 102912 ------w- c:\windows\system32\dllcache\iecompat.dll
2009-06-23 21:09 . 2009-06-23 21:09 -------- d-----w- c:\windows\ie8updates
2009-06-23 21:08 . 2004-08-04 03:32 84480 ----a-w- c:\windows\system32\drivers\ac97via.sys
2009-06-23 21:08 . 2004-08-04 03:32 84480 ----a-w- c:\windows\system32\dllcache\ac97via.sys
2009-06-23 21:08 . 2009-04-30 21:22 12800 ------w- c:\windows\system32\dllcache\xpshims.dll
2009-06-23 21:08 . 2009-04-30 21:22 246272 ------w- c:\windows\system32\dllcache\ieproxy.dll
2009-06-23 21:06 . 2009-06-23 21:07 -------- dc-h--w- c:\windows\ie8
2009-06-23 20:33 . 2009-06-23 20:33 -------- d-----w- c:\documents and settings\All Users\Application Data\ATI
2009-06-23 20:28 . 2009-06-23 20:28 -------- d-----w- C:\ATI
2009-06-23 20:15 . 2009-06-23 20:15 -------- d-----w- c:\documents and settings\Compaq_Administrator\Local Settings\Application Data\ATI
2009-06-23 20:15 . 2009-06-23 20:15 -------- d-----w- c:\documents and settings\Compaq_Administrator\Application Data\ATI
2009-06-23 20:11 . 2009-06-23 20:11 9158 ----a-r- c:\documents and settings\Compaq_Administrator\Application Data\Microsoft\Installer\{89DE67AD-08B8-4699-A55D-CA5C0AF82BF3}\ARPPRODUCTICON.exe
2009-06-23 20:11 . 2009-06-23 20:11 -------- d-----w- c:\program files\Common Files\ATI Technologies
2009-06-23 20:09 . 2009-05-16 02:05 593920 ------w- c:\windows\system32\ati2sgag.exe
2009-06-23 20:09 . 2009-06-23 20:31 -------- d-----w- c:\program files\ATI Technologies
2009-06-23 20:07 . 2009-06-23 20:07 0 ----a-w- c:\windows\ativpsrm.bin
2009-06-23 20:07 . 2009-05-16 02:51 311296 ----a-w- c:\windows\system32\atiiiexx.dll
2009-06-23 20:07 . 2009-05-16 03:39 442368 ----a-w- c:\windows\system32\ATIDEMGX.dll
2009-06-23 20:07 . 2009-05-16 02:54 887724 ----a-w- c:\windows\system32\ativva6x.dat
2009-06-23 20:07 . 2009-05-16 02:54 3 ----a-w- c:\windows\system32\ativva5x.dat
2009-06-23 20:07 . 2009-04-23 19:04 189051 ----a-w- c:\windows\system32\atiicdxx.dat
2009-06-18 08:19 . 2009-06-18 08:19 -------- d-----w- c:\documents and settings\Compaq_Administrator\Application Data\HP
2009-06-18 08:19 . 2009-06-18 08:19 -------- d-----w- c:\documents and settings\Compaq_Administrator\Local Settings\Application Data\IsolatedStorage
2009-06-18 08:19 . 2009-06-18 08:19 -------- d-----w- c:\documents and settings\Compaq_Administrator\Local Settings\Application Data\HP

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-23 21:48 . 2007-01-15 21:19 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-06-17 07:25 . 2008-01-16 04:04 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
2009-06-13 16:42 . 2007-01-15 20:48 -------- d-----w- c:\program files\Java
2009-06-13 16:41 . 2009-06-13 16:41 152576 ----a-w- c:\documents and settings\Compaq_Administrator\Application Data\Sun\Java\jre1.6.0_14\lzma.dll
2009-06-07 21:07 . 2009-06-07 21:06 -------- d-----w- c:\program files\iTunes
2009-06-07 21:06 . 2009-06-07 21:06 -------- d-----w- c:\program files\iPod
2009-06-07 21:06 . 2008-12-19 00:34 -------- d-----w- c:\program files\Common Files\Apple
2009-06-07 21:05 . 2009-06-07 21:05 -------- d-----w- c:\program files\QuickTime
2009-06-07 21:01 . 2009-06-07 21:01 75048 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.2.0.23\SetupAdmin.exe
2009-06-04 20:46 . 2007-05-05 05:11 -------- d-----w- c:\program files\World of Warcraft
2009-05-29 18:36 . 2009-04-11 05:06 2060288 ----a-w- c:\windows\system32\usbaaplrc.dll
2009-05-29 18:36 . 2008-12-19 00:35 39424 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2009-05-27 20:54 . 2008-10-14 18:27 1 ----a-w- c:\documents and settings\Compaq_Administrator\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2009-05-27 05:05 . 2009-05-27 05:05 -------- d-----w- c:\program files\Microsoft CAPICOM 2.1.0.2
2009-05-27 00:38 . 2008-09-02 04:26 -------- d-----w- c:\program files\Steam
2009-05-21 16:33 . 2009-01-08 06:41 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-05-20 21:12 . 2009-05-20 21:12 -------- d-----w- c:\program files\Microsoft Silverlight
2009-05-18 20:37 . 2009-05-18 20:37 152576 ----a-w- c:\documents and settings\Compaq_Administrator\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-05-16 03:58 . 2008-08-26 12:33 4069888 ----a-w- c:\windows\system32\drivers\ati2mtag.sys
2009-05-16 03:38 . 2008-08-26 12:33 335872 ----a-w- c:\windows\system32\ati2dvag.dll
2009-05-16 03:18 . 2009-03-16 20:17 204800 ----a-w- c:\windows\system32\atipdlxx.dll
2009-05-16 03:17 . 2009-03-16 20:16 155648 ----a-w- c:\windows\system32\Oemdspif.dll
2009-05-16 03:17 . 2009-03-16 20:16 26112 ----a-w- c:\windows\system32\Ati2mdxx.exe
2009-05-16 03:17 . 2009-03-16 20:16 43520 ----a-w- c:\windows\system32\ati2edxx.dll
2009-05-16 03:17 . 2009-03-16 20:16 155648 ----a-w- c:\windows\system32\ati2evxx.dll
2009-05-16 03:15 . 2009-03-16 20:15 602112 ----a-w- c:\windows\system32\ati2evxx.exe
2009-05-16 03:14 . 2009-03-16 20:13 53248 ----a-w- c:\windows\system32\ATIDDC.DLL
2009-05-16 03:07 . 2008-08-26 12:33 2987136 ----a-w- c:\windows\system32\ati3duag.dll
2009-05-16 02:55 . 2009-03-16 20:04 11423744 ----a-w- c:\windows\system32\atioglxx.dll
2009-05-16 02:54 . 2008-08-26 12:33 2122624 ----a-w- c:\windows\system32\ativvaxx.dll
2009-05-16 02:38 . 2009-03-16 19:40 49664 ----a-w- c:\windows\system32\atimpc32.dll
2009-05-16 02:38 . 2009-03-16 19:40 49664 ----a-w- c:\windows\system32\amdpcom32.dll
2009-05-16 02:33 . 2009-03-16 19:36 479232 ----a-w- c:\windows\system32\atikvmag.dll
2009-05-16 02:31 . 2009-03-16 19:35 139264 ----a-w- c:\windows\system32\atiadlxx.dll
2009-05-16 02:31 . 2009-03-16 19:34 17408 ----a-w- c:\windows\system32\atitvo32.dll
2009-05-16 02:30 . 2009-03-16 19:34 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll
2009-05-16 02:26 . 2009-03-16 19:35 376832 ----a-w- c:\windows\system32\atiok3x2.dll
2009-05-16 02:24 . 2008-08-26 12:33 651264 ----a-w- c:\windows\system32\ati2cqag.dll
2009-05-16 01:35 . 2009-03-16 19:35 45056 ----a-w- c:\windows\system32\aticalrt.dll
2009-05-16 01:34 . 2009-03-16 19:34 45056 ----a-w- c:\windows\system32\aticalcl.dll
2009-05-16 01:33 . 2009-03-16 19:33 3158016 ----a-w- c:\windows\system32\aticaldd.dll
2009-05-13 05:15 . 2004-08-09 21:00 915456 ----a-w- c:\windows\system32\wininet.dll
2009-05-07 15:32 . 2004-08-09 21:00 345600 ----a-w- c:\windows\system32\localspl.dll
2009-05-05 19:33 . 2009-03-03 19:56 118784 ----a-w- c:\windows\system32\atibtmon.exe
2009-05-03 00:52 . 2007-01-15 21:17 48168 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-17 12:26 . 2004-08-09 21:00 1847168 ----a-w- c:\windows\system32\win32k.sys
2009-06-13 16:14 . 2008-08-05 07:03 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-16 13529088]
"D-Link Wireless G WDA-1320"="c:\program files\D-Link\Wireless G WDA-1320\AirGCFG.exe" [2005-12-14 2711552]
"ANIWZCS2Service"="c:\program files\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [2005-11-30 49152]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-16 86016]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb04.exe" [2001-12-06 196608]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-05-30 292136]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-21 148888]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-05-20 98304]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2006-07-21 16261632]

c:\documents and settings\Compaq_Administrator\Start Menu\Programs\Startup\
OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2008-9-12 384000]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-2.0.3-enUS-downloader.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-2.0.3.6299-to-2.0.12.6546-enUS-downloader.exe"=
"c:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Documents and Settings\\Compaq_Administrator\\Desktop\\eclipse\\eclipse.exe"=
"c:\\Program Files\\Steam\\steamapps\\resistance8501\\team fortress 2\\hl2.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [8/4/2008 10:54 PM 28544]
R3 A3AB;D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB);c:\windows\system32\drivers\A3AB.sys [8/25/2005 3:00 PM 466880]
S3 Alpham;Ideazon Fang Composite Keyboard Driver;c:\windows\system32\drivers\Alpham.sys [12/4/2005 1:55 PM 34944]
S3 AtiHdmiService;ATI Function Driver for HDMI Service;c:\windows\system32\drivers\AtiHdmi.sys [7/20/2007 6:40 PM 99856]
S3 DNINDIS5;DNINDIS5 NDIS Protocol Driver;c:\windows\system32\DNINDIS5.sys [5/4/2007 11:58 PM 17149]
S3 N3AB;N3AB Wireless Network Adapter Service;c:\windows\system32\drivers\N3AB.sys [5/6/2007 12:05 AM 457312]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
yushnoxj

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-15403594 - c:\documents and settings\All Users\Application Data\15403594\15403594.exe


.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PRESARIO&pf=desktop
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PRESARIO&pf=desktop
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
FF - ProfilePath - c:\documents and settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\kvrcrmjq.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-15 15:23
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1240301691-4027900951-2110323911-1007\Software\SecuROM\License information*]
"datasecu"=hex:80,d2,57,4d,c4,e4,04,ba,31,8c,0d,cb,14,d5,9a,07,8b,2a,ab,2d,c4,
ec,77,f6,f5,cc,80,05,eb,c0,fa,ef,2d,ae,46,3d,b4,5a,02,ee,e6,72,40,b1,f0,a5,\
"rkeysecu"=hex:cb,bd,f2,61,5a,4e,c6,95,f2,29,8b,82,ba,6b,3d,44
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(572)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2009-07-15 15:26
ComboFix-quarantined-files.txt 2009-07-15 20:25
ComboFix2.txt 2009-01-08 05:36

Pre-Run: 100,514,353,152 bytes free
Post-Run: 100,880,924,672 bytes free

208 --- E O F --- 2009-06-23 21:09

[tetonbob]

Looks much better. Let's get some protection on that machine now.


Install this FREE AntiVirus program, update it, and run a full system scan. This is in addition to the quick scan suggested upon installation.

Avira AntiVir Personal

There is an installation guide here

When the scan is complete, click on the Report button. A log file will open. Please post that in your next reply.

Do not install more than one antivirus program because they will conflict with each other. It is imperative that you update your antivirus software at least once a week (even more if you wish). If you do not update your antivirus software then it will not be able to catch new malware that may have come out.

---------------------------------------------------------------------------------------------

[Futility]

Avira full system scan log:




Avira AntiVir Personal
Report file date: Wednesday, July 15, 2009 16:01

Scanning for 1540055 virus strains and unwanted programs.

Licensee : Avira AntiVir Personal - FREE Antivirus
Serial number : 0000149996-ADJIE-0000001
Platform : Windows XP
Windows version : (Service Pack 3) [5.1.2600]
Boot mode : Normally booted
Username : SYSTEM
Computer name : JTDESKTOP

Version information:
BUILD.DAT : 9.0.0.403 17961 Bytes 6/3/2009 17:05:00
AVSCAN.EXE : 9.0.3.6 466689 Bytes 5/11/2009 15:14:47
AVSCAN.DLL : 9.0.3.0 40705 Bytes 2/27/2009 16:58:24
LUKE.DLL : 9.0.3.2 209665 Bytes 2/20/2009 17:35:49
LUKERES.DLL : 9.0.2.0 12033 Bytes 2/27/2009 16:58:52
ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 10/27/2008 18:30:36
ANTIVIR1.VDF : 7.1.4.132 5707264 Bytes 6/24/2009 20:57:34
ANTIVIR2.VDF : 7.1.4.221 1273856 Bytes 7/12/2009 20:57:48
ANTIVIR3.VDF : 7.1.4.240 333312 Bytes 7/15/2009 20:57:51
Engineversion : 8.2.0.215
AEVDF.DLL : 8.1.1.1 106868 Bytes 4/30/2009 17:52:04
AESCRIPT.DLL : 8.1.2.16 438651 Bytes 7/15/2009 20:58:10
AESCN.DLL : 8.1.2.3 127347 Bytes 5/14/2009 17:02:01
AERDL.DLL : 8.1.2.4 430452 Bytes 7/15/2009 20:58:08
AEPACK.DLL : 8.1.3.18 401783 Bytes 5/27/2009 22:07:20
AEOFFICE.DLL : 8.1.0.38 196987 Bytes 7/15/2009 20:58:06
AEHEUR.DLL : 8.1.0.141 1855864 Bytes 7/15/2009 20:58:05
AEHELP.DLL : 8.1.4.5 229748 Bytes 7/15/2009 20:57:56
AEGEN.DLL : 8.1.1.48 348532 Bytes 7/15/2009 20:57:55
AEEMU.DLL : 8.1.0.9 393588 Bytes 10/9/2008 20:32:40
AECORE.DLL : 8.1.7.5 180597 Bytes 7/15/2009 20:57:52
AEBB.DLL : 8.1.0.3 53618 Bytes 10/9/2008 20:32:40
AVWINLL.DLL : 9.0.0.3 18177 Bytes 12/12/2008 14:47:59
AVPREF.DLL : 9.0.0.1 43777 Bytes 12/5/2008 16:32:15
AVREP.DLL : 8.0.0.3 155905 Bytes 1/20/2009 20:34:28
AVREG.DLL : 9.0.0.0 36609 Bytes 12/5/2008 16:32:09
AVARKT.DLL : 9.0.0.3 292609 Bytes 3/24/2009 21:05:41
AVEVTLOG.DLL : 9.0.0.7 167169 Bytes 1/30/2009 16:37:08
SQLITE3.DLL : 3.6.1.0 326401 Bytes 1/28/2009 21:03:49
SMTPLIB.DLL : 9.2.0.25 28417 Bytes 2/2/2009 14:21:33
NETNT.DLL : 9.0.0.0 11521 Bytes 12/5/2008 16:32:10
RCIMAGE.DLL : 9.0.0.25 2438913 Bytes 5/15/2009 21:39:58
RCTEXT.DLL : 9.0.37.0 86785 Bytes 4/17/2009 16:19:48

Configuration settings for the scan:
Jobname.............................: Complete system scan
Configuration file..................: c:\program files\avira\antivir desktop\sysscan.avp
Logging.............................: low
Primary action......................: interactive
Secondary action....................: ignore
Scan master boot sector.............: on
Scan boot sector....................: on
Boot sectors........................: C:, D:,
Process scan........................: on
Scan registry.......................: on
Search for rootkits.................: on
Integrity checking of system files..: off
Scan all files......................: All files
Scan archives.......................: on
Recursion depth.....................: 20
Smart extensions....................: on
Macro heuristic.....................: on
File heuristic......................: medium

Start of the scan: Wednesday, July 15, 2009 16:01

Starting search for hidden objects.
'74811' objects were checked, '0' hidden objects were found.

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'wscntfy.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'dllhost.exe' - '1' Module(s) have been scanned
Scan process 'mcrdsvc.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'HPZipm12.exe' - '1' Module(s) have been scanned
Scan process 'LSSrvc.exe' - '1' Module(s) have been scanned
Scan process 'jqs.exe' - '1' Module(s) have been scanned
Scan process 'ehSched.exe' - '1' Module(s) have been scanned
Scan process 'ehrecvr.exe' - '1' Module(s) have been scanned
Scan process 'DKService.exe' - '1' Module(s) have been scanned
Scan process 'mDNSResponder.exe' - '1' Module(s) have been scanned
Scan process 'arservice.exe' - '1' Module(s) have been scanned
Scan process 'AppleMobileDeviceService.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
37 processes with 37 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!
Master boot sector HD1
[INFO] No virus was found!
Master boot sector HD2
[INFO] No virus was found!
Master boot sector HD3
[INFO] No virus was found!
Master boot sector HD4
[INFO] No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Boot sector 'D:\'
[INFO] No virus was found!

Starting to scan executable files (registry).
The registry was scanned ( '68' files ).


Starting the file scan:

Begin scan in 'C:\' <PRESARIO>
C:\hiberfil.sys
[WARNING] The file could not be opened!
[NOTE] This file is a Windows system file.
[NOTE] This file cannot be opened for scanning.
C:\pagefile.sys
[WARNING] The file could not be opened!
[NOTE] This file is a Windows system file.
[NOTE] This file cannot be opened for scanning.
C:\Documents and Settings\Compaq_Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\kvrcrmjq.default\Cache\D035549Dd01
[DETECTION] Contains HEUR/HTML.Malware suspicious code
C:\Qoobox\Quarantine\C\Documents and Settings\All Users\Application Data\15403594\15403594.exe.vir
[DETECTION] Is the TR/Redol.A Trojan
C:\Qoobox\Quarantine\C\WINDOWS\system32\SKYNETuxfumuyn.dll.vir
[DETECTION] Is the TR/Monder.4403.3 Trojan
C:\Qoobox\Quarantine\C\WINDOWS\system32\SKYNETvdmovqjx.dll.vir
[DETECTION] Is the TR/Vundo.Gen Trojan
C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\SKYNETavnojwsw.sys.vir
[DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP609\A0035029.exe
[DETECTION] Is the TR/Trash.Gen Trojan
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP609\A0035030.exe
[DETECTION] Is the TR/Trash.Gen Trojan
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP698\A0047686.sys
[DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP698\A0047687.dll
[DETECTION] Is the TR/Monder.4403.3 Trojan
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP698\A0047688.dll
[DETECTION] Is the TR/Vundo.Gen Trojan
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP698\A0047713.exe
[DETECTION] Is the TR/Redol.A Trojan
C:\WINDOWS\system32\config\systemprofile\Application Data\91162efba350c243
[DETECTION] Is the TR/Agent.3261.A Trojan
Begin scan in 'D:\' <PRESARIO_RP>

Beginning disinfection:
C:\Documents and Settings\Compaq_Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\kvrcrmjq.default\Cache\D035549Dd01
[DETECTION] Contains HEUR/HTML.Malware suspicious code
[NOTE] The detection was classified as suspicious.
[WARNING] The file was ignored!
C:\Qoobox\Quarantine\C\Documents and Settings\All Users\Application Data\15403594\15403594.exe.vir
[DETECTION] Is the TR/Redol.A Trojan
[WARNING] The file was ignored!
C:\Qoobox\Quarantine\C\WINDOWS\system32\SKYNETuxfumuyn.dll.vir
[DETECTION] Is the TR/Monder.4403.3 Trojan
[WARNING] The file was ignored!
C:\Qoobox\Quarantine\C\WINDOWS\system32\SKYNETvdmovqjx.dll.vir
[DETECTION] Is the TR/Vundo.Gen Trojan
[WARNING] The file was ignored!
C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\SKYNETavnojwsw.sys.vir
[DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan
[WARNING] The file was ignored!
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP609\A0035029.exe
[DETECTION] Is the TR/Trash.Gen Trojan
[WARNING] The file was ignored!
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP609\A0035030.exe
[DETECTION] Is the TR/Trash.Gen Trojan
[WARNING] The file was ignored!
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP698\A0047686.sys
[DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan
[WARNING] The file was ignored!
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP698\A0047687.dll
[DETECTION] Is the TR/Monder.4403.3 Trojan
[WARNING] The file was ignored!
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP698\A0047688.dll
[DETECTION] Is the TR/Vundo.Gen Trojan
[WARNING] The file was ignored!
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP698\A0047713.exe
[DETECTION] Is the TR/Redol.A Trojan
[WARNING] The file was ignored!
C:\WINDOWS\system32\config\systemprofile\Application Data\91162efba350c243
[DETECTION] Is the TR/Agent.3261.A Trojan
[WARNING] The file was ignored!


End of the scan: Wednesday, July 15, 2009 22:28
Used time: 1:01:51 Hour(s)

The scan has been done completely.

14649 Scanned directories
738790 Files were scanned
11 Viruses and/or unwanted programs were found
1 Files were classified as suspicious
0 files were deleted
0 Viruses and unwanted programs were repaired
0 Files were moved to quarantine
0 Files were renamed
2 Files cannot be scanned
738776 Files not concerned
18093 Archives were scanned
14 Warnings
3 Notes
74811 Objects were scanned with rootkit scan
0 Hidden objects were found

[tetonbob]

Hi -

[WARNING] The file was ignored!

Is there a reason no action was taken on all the finds? Avira should be allowed to fix what it finds.

[Futility]

Sorry - there weren't explicit instructions on what to have Avira do with it, so I played it safe. I'll re-run the scan and allow it to take action on all flagged files.

[Futility]

New Avira scan:




Avira AntiVir Personal
Report file date: Thursday, July 16, 2009 00:43

Scanning for 1540055 virus strains and unwanted programs.

Licensee : Avira AntiVir Personal - FREE Antivirus
Serial number : 0000149996-ADJIE-0000001
Platform : Windows XP
Windows version : (Service Pack 3) [5.1.2600]
Boot mode : Normally booted
Username : SYSTEM
Computer name : JTDESKTOP

Version information:
BUILD.DAT : 9.0.0.403 17961 Bytes 6/3/2009 17:05:00
AVSCAN.EXE : 9.0.3.6 466689 Bytes 5/11/2009 15:14:47
AVSCAN.DLL : 9.0.3.0 40705 Bytes 2/27/2009 16:58:24
LUKE.DLL : 9.0.3.2 209665 Bytes 2/20/2009 17:35:49
LUKERES.DLL : 9.0.2.0 12033 Bytes 2/27/2009 16:58:52
ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 10/27/2008 18:30:36
ANTIVIR1.VDF : 7.1.4.132 5707264 Bytes 6/24/2009 20:57:34
ANTIVIR2.VDF : 7.1.4.221 1273856 Bytes 7/12/2009 20:57:48
ANTIVIR3.VDF : 7.1.4.240 333312 Bytes 7/15/2009 20:57:51
Engineversion : 8.2.0.215
AEVDF.DLL : 8.1.1.1 106868 Bytes 4/30/2009 17:52:04
AESCRIPT.DLL : 8.1.2.16 438651 Bytes 7/15/2009 20:58:10
AESCN.DLL : 8.1.2.3 127347 Bytes 5/14/2009 17:02:01
AERDL.DLL : 8.1.2.4 430452 Bytes 7/15/2009 20:58:08
AEPACK.DLL : 8.1.3.18 401783 Bytes 5/27/2009 22:07:20
AEOFFICE.DLL : 8.1.0.38 196987 Bytes 7/15/2009 20:58:06
AEHEUR.DLL : 8.1.0.141 1855864 Bytes 7/15/2009 20:58:05
AEHELP.DLL : 8.1.4.5 229748 Bytes 7/15/2009 20:57:56
AEGEN.DLL : 8.1.1.48 348532 Bytes 7/15/2009 20:57:55
AEEMU.DLL : 8.1.0.9 393588 Bytes 10/9/2008 20:32:40
AECORE.DLL : 8.1.7.5 180597 Bytes 7/15/2009 20:57:52
AEBB.DLL : 8.1.0.3 53618 Bytes 10/9/2008 20:32:40
AVWINLL.DLL : 9.0.0.3 18177 Bytes 12/12/2008 14:47:59
AVPREF.DLL : 9.0.0.1 43777 Bytes 12/5/2008 16:32:15
AVREP.DLL : 8.0.0.3 155905 Bytes 1/20/2009 20:34:28
AVREG.DLL : 9.0.0.0 36609 Bytes 12/5/2008 16:32:09
AVARKT.DLL : 9.0.0.3 292609 Bytes 3/24/2009 21:05:41
AVEVTLOG.DLL : 9.0.0.7 167169 Bytes 1/30/2009 16:37:08
SQLITE3.DLL : 3.6.1.0 326401 Bytes 1/28/2009 21:03:49
SMTPLIB.DLL : 9.2.0.25 28417 Bytes 2/2/2009 14:21:33
NETNT.DLL : 9.0.0.0 11521 Bytes 12/5/2008 16:32:10
RCIMAGE.DLL : 9.0.0.25 2438913 Bytes 5/15/2009 21:39:58
RCTEXT.DLL : 9.0.37.0 86785 Bytes 4/17/2009 16:19:48

Configuration settings for the scan:
Jobname.............................: Complete system scan
Configuration file..................: c:\program files\avira\antivir desktop\sysscan.avp
Logging.............................: low
Primary action......................: interactive
Secondary action....................: ignore
Scan master boot sector.............: on
Scan boot sector....................: on
Boot sectors........................: C:, D:,
Process scan........................: on
Scan registry.......................: on
Search for rootkits.................: on
Integrity checking of system files..: off
Scan all files......................: All files
Scan archives.......................: on
Recursion depth.....................: 20
Smart extensions....................: on
Macro heuristic.....................: on
File heuristic......................: medium

Start of the scan: Thursday, July 16, 2009 00:43

Starting search for hidden objects.
'74834' objects were checked, '0' hidden objects were found.

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'wscntfy.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'dllhost.exe' - '1' Module(s) have been scanned
Scan process 'mcrdsvc.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'LSSrvc.exe' - '1' Module(s) have been scanned
Scan process 'jqs.exe' - '1' Module(s) have been scanned
Scan process 'ehSched.exe' - '1' Module(s) have been scanned
Scan process 'ehrecvr.exe' - '1' Module(s) have been scanned
Scan process 'DKService.exe' - '1' Module(s) have been scanned
Scan process 'mDNSResponder.exe' - '1' Module(s) have been scanned
Scan process 'arservice.exe' - '1' Module(s) have been scanned
Scan process 'AppleMobileDeviceService.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
35 processes with 35 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!
Master boot sector HD1
[INFO] No virus was found!
Master boot sector HD2
[INFO] No virus was found!
Master boot sector HD3
[INFO] No virus was found!
Master boot sector HD4
[INFO] No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Boot sector 'D:\'
[INFO] No virus was found!

Starting to scan executable files (registry).
The registry was scanned ( '68' files ).


Starting the file scan:

Begin scan in 'C:\' <PRESARIO>
C:\hiberfil.sys
[WARNING] The file could not be opened!
[NOTE] This file is a Windows system file.
[NOTE] This file cannot be opened for scanning.
C:\pagefile.sys
[WARNING] The file could not be opened!
[NOTE] This file is a Windows system file.
[NOTE] This file cannot be opened for scanning.
C:\Documents and Settings\Compaq_Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\kvrcrmjq.default\Cache\D035549Dd01
[DETECTION] Contains HEUR/HTML.Malware suspicious code
C:\Qoobox\Quarantine\C\Documents and Settings\All Users\Application Data\15403594\15403594.exe.vir
[DETECTION] Is the TR/Redol.A Trojan
C:\Qoobox\Quarantine\C\WINDOWS\system32\SKYNETuxfumuyn.dll.vir
[DETECTION] Is the TR/Monder.4403.3 Trojan
C:\Qoobox\Quarantine\C\WINDOWS\system32\SKYNETvdmovqjx.dll.vir
[DETECTION] Is the TR/Vundo.Gen Trojan
C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\SKYNETavnojwsw.sys.vir
[DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP609\A0035029.exe
[DETECTION] Is the TR/Trash.Gen Trojan
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP609\A0035030.exe
[DETECTION] Is the TR/Trash.Gen Trojan
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP698\A0047686.sys
[DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP698\A0047687.dll
[DETECTION] Is the TR/Monder.4403.3 Trojan
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP698\A0047688.dll
[DETECTION] Is the TR/Vundo.Gen Trojan
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP698\A0047713.exe
[DETECTION] Is the TR/Redol.A Trojan
C:\WINDOWS\system32\config\systemprofile\Application Data\91162efba350c243
[DETECTION] Is the TR/Agent.3261.A Trojan
Begin scan in 'D:\' <PRESARIO_RP>

Beginning disinfection:
C:\Documents and Settings\Compaq_Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\kvrcrmjq.default\Cache\D035549Dd01
[DETECTION] Contains HEUR/HTML.Malware suspicious code
[NOTE] The detection was classified as suspicious.
[NOTE] The file was moved to '4a91cccb.qua'!
C:\Qoobox\Quarantine\C\Documents and Settings\All Users\Application Data\15403594\15403594.exe.vir
[DETECTION] Is the TR/Redol.A Trojan
[NOTE] The file was moved to '4a92ccd1.qua'!
C:\Qoobox\Quarantine\C\WINDOWS\system32\SKYNETuxfumuyn.dll.vir
[DETECTION] Is the TR/Monder.4403.3 Trojan
[NOTE] The file was moved to '4ab7cce7.qua'!
C:\Qoobox\Quarantine\C\WINDOWS\system32\SKYNETvdmovqjx.dll.vir
[DETECTION] Is the TR/Vundo.Gen Trojan
[NOTE] The file was moved to '4bc5be90.qua'!
C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\SKYNETavnojwsw.sys.vir
[DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan
[NOTE] The file was moved to '4b35f800.qua'!
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP609\A0035029.exe
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file was moved to '4a8ecccc.qua'!
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP609\A0035030.exe
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file was moved to '4bf1d15d.qua'!
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP698\A0047686.sys
[DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan
[NOTE] The file was moved to '4b0ee995.qua'!
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP698\A0047687.dll
[DETECTION] Is the TR/Monder.4403.3 Trojan
[NOTE] The file was moved to '4b0fe1ed.qua'!
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP698\A0047688.dll
[DETECTION] Is the TR/Vundo.Gen Trojan
[NOTE] The file was moved to '49b986a5.qua'!
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP698\A0047713.exe
[DETECTION] Is the TR/Redol.A Trojan
[NOTE] The file was moved to '49b69efd.qua'!
C:\WINDOWS\system32\config\systemprofile\Application Data\91162efba350c243
[DETECTION] Is the TR/Agent.3261.A Trojan
[NOTE] The file was moved to '4a8fcccd.qua'!


End of the scan: Thursday, July 16, 2009 01:45
Used time: 58:48 Minute(s)

The scan has been done completely.

14650 Scanned directories
738789 Files were scanned
11 Viruses and/or unwanted programs were found
1 Files were classified as suspicious
0 files were deleted
0 Viruses and unwanted programs were repaired
12 Files were moved to quarantine
0 Files were renamed
2 Files cannot be scanned
738775 Files not concerned
18104 Archives were scanned
2 Warnings
14 Notes
74834 Objects were scanned with rootkit scan
0 Hidden objects were found

[tetonbob]

Ok, that's understandable. Thanks for running it again.

Please run DDS once again, and post it's logs. You can attach the attach.txt but there's no need to zip it.

[Futility]

DDS (Ver_09-06-26.01) - NTFSx86
Run by Compaq_Administrator at 14:07:13.14 on Thu 07/16/2009
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_14
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1555 [GMT -5:00]

AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir Desktop\sched.exe
svchost.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\arservice.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\HPZipm12.exe
svchost.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Compaq_Administrator\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.yahoo.com/
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PRESARIO&pf=desktop
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PRESARIO&pf=desktop
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [D-Link Wireless G WDA-1320] c:\program files\d-link\wireless g wda-1320\AirGCFG.exe
mRun: [ANIWZCS2Service] c:\program files\ani\aniwzcs2 service\WZCSLDR2.exe
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [HPDJ Taskbar Utility] c:\windows\system32\spool\drivers\w32x86\3\hpztsb04.exe
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [StartCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
StartupFolder: c:\docume~1\compaq~1\startm~1\programs\startup\openof~1.lnk - c:\program files\openoffice.org 3\program\quickstart.exe
IE: {E2D4D26B-0180-43a4-B05F-462D6D54C789} - c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\iebutton\support.htm
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} - hxxp://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab
DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} - hxxp://upload.facebook.com/controls/FacebookPhotoUploader3.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} - hxxp://www.crucial.com/controls/cpcScanner.cab
DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Notify: AtiExtEvent - Ati2evxx.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\compaq~1\applic~1\mozilla\firefox\profiles\kvrcrmjq.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}

============= SERVICES / DRIVERS ===============

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2008-8-4 28544]
R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2009-7-15 11608]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2009-7-15 108289]
R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2009-7-15 185089]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-7-15 55640]
R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]
R3 A3AB;D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB);c:\windows\system32\drivers\A3AB.sys [2005-8-25 466880]
S3 Alpham;Ideazon Fang Composite Keyboard Driver;c:\windows\system32\drivers\Alpham.sys [2005-12-4 34944]
S3 AtiHdmiService;ATI Function Driver for HDMI Service;c:\windows\system32\drivers\AtiHdmi.sys [2007-7-20 99856]
S3 DNINDIS5;DNINDIS5 NDIS Protocol Driver;c:\windows\system32\DNINDIS5.sys [2007-5-4 17149]
S3 N3AB;N3AB Wireless Network Adapter Service;c:\windows\system32\drivers\N3AB.sys [2007-5-6 457312]

=============== Created Last 30 ================

2009-07-15 15:54 55,640 a------- c:\windows\system32\drivers\avgntflt.sys
2009-07-15 15:54 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Avira
2009-07-15 15:54 <DIR> --d----- c:\program files\Avira
2009-07-15 15:24 <DIR> --d----- c:\windows\system32\dllcache\cache
2009-07-15 15:07 219,648 a------- c:\windows\PEV.exe
2009-07-15 15:07 161,792 a------- c:\windows\SWREG.exe
2009-07-15 15:07 98,816 a------- c:\windows\sed.exe
2009-07-15 15:07 <DIR> --ds---- C:\Combo-Fix
2009-06-23 17:03 <DIR> --dsh--- c:\documents and settings\compaq_administrator\PrivacIE
2009-06-23 16:49 2,879,488 -------- c:\windows\SkyTel.exe
2009-06-23 16:49 143,360 -------- c:\windows\system32\RtlCPAPI.dll
2009-06-23 16:49 40,960 -------- c:\windows\system32\ChCfg.exe
2009-06-23 16:48 <DIR> --d----- c:\program files\Realtek
2009-06-23 16:48 487,424 -------- c:\windows\RtlExUpd.dll
2009-06-23 16:47 <DIR> --d----- C:\SWSetup
2009-06-23 16:35 <DIR> --dsh--- c:\documents and settings\compaq_administrator\IETldCache
2009-06-23 16:09 102,912 -------- c:\windows\system32\dllcache\iecompat.dll
2009-06-23 16:09 <DIR> --d----- c:\windows\ie8updates
2009-06-23 16:08 84,480 a------- c:\windows\system32\drivers\ac97via.sys
2009-06-23 16:08 84,480 a------- c:\windows\system32\dllcache\ac97via.sys
2009-06-23 16:08 246,272 -------- c:\windows\system32\dllcache\ieproxy.dll
2009-06-23 16:08 12,800 -------- c:\windows\system32\dllcache\xpshims.dll
2009-06-23 16:06 <DIR> -cd-h--- c:\windows\ie8
2009-06-23 15:28 <DIR> --d----- C:\ATI
2009-06-23 15:11 <DIR> --d----- c:\program files\common files\ATI Technologies
2009-06-23 15:09 593,920 -------- c:\windows\system32\ati2sgag.exe
2009-06-23 15:09 <DIR> --d----- c:\program files\ATI Technologies
2009-06-23 15:07 0 a------- c:\windows\ativpsrm.bin
2009-06-23 15:07 17,917 a------- c:\windows\atiogl.xml
2009-06-23 15:07 311,296 a------- c:\windows\system32\atiiiexx.dll
2009-06-23 15:07 7,167 a----r-- c:\windows\system32\atifglpf.xml
2009-06-23 15:07 442,368 a------- c:\windows\system32\ATIDEMGX.dll
2009-06-23 15:07 887,724 a------- c:\windows\system32\ativva6x.dat
2009-06-23 15:07 189,051 a------- c:\windows\system32\atiicdxx.dat
2009-06-23 15:07 3 a------- c:\windows\system32\ativva5x.dat

==================== Find3M ====================

2009-05-29 13:36 2,060,288 a------- c:\windows\system32\usbaaplrc.dll
2009-05-29 13:36 39,424 a------- c:\windows\system32\drivers\usbaapl.sys
2009-05-21 11:33 410,984 a------- c:\windows\system32\deploytk.dll
2009-05-15 22:58 4,069,888 a------- c:\windows\system32\dllcache\ati2mtag.sys
2009-05-15 22:38 335,872 a------- c:\windows\system32\ati2dvag.dll
2009-05-15 22:18 204,800 a------- c:\windows\system32\atipdlxx.dll
2009-05-15 22:17 155,648 a------- c:\windows\system32\Oemdspif.dll
2009-05-15 22:17 26,112 a------- c:\windows\system32\Ati2mdxx.exe
2009-05-15 22:17 43,520 a------- c:\windows\system32\ati2edxx.dll
2009-05-15 22:17 155,648 a------- c:\windows\system32\ati2evxx.dll
2009-05-15 22:15 602,112 a------- c:\windows\system32\ati2evxx.exe
2009-05-15 22:14 53,248 a------- c:\windows\system32\ATIDDC.DLL
2009-05-15 22:07 2,987,136 a------- c:\windows\system32\ati3duag.dll
2009-05-15 21:55 11,423,744 a------- c:\windows\system32\atioglxx.dll
2009-05-15 21:54 2,122,624 a------- c:\windows\system32\ativvaxx.dll
2009-05-15 21:38 49,664 a------- c:\windows\system32\atimpc32.dll
2009-05-15 21:38 49,664 a------- c:\windows\system32\amdpcom32.dll
2009-05-15 21:33 479,232 a------- c:\windows\system32\atikvmag.dll
2009-05-15 21:31 139,264 a------- c:\windows\system32\atiadlxx.dll
2009-05-15 21:31 17,408 a------- c:\windows\system32\atitvo32.dll
2009-05-15 21:26 376,832 a------- c:\windows\system32\atiok3x2.dll
2009-05-15 21:24 651,264 a------- c:\windows\system32\ati2cqag.dll
2009-05-15 20:35 45,056 a------- c:\windows\system32\aticalrt.dll
2009-05-15 20:34 45,056 a------- c:\windows\system32\aticalcl.dll
2009-05-15 20:33 3,158,016 a------- c:\windows\system32\aticaldd.dll
2009-05-13 00:15 915,456 a------- c:\windows\system32\wininet.dll
2009-05-13 00:15 915,456 a------- c:\windows\system32\dllcache\cache\wininet.dll
2009-05-13 00:15 5,936,128 -------- c:\windows\system32\dllcache\mshtml.dll
2009-05-13 00:15 915,456 -------- c:\windows\system32\dllcache\wininet.dll
2009-05-07 10:32 345,600 a------- c:\windows\system32\localspl.dll
2009-05-07 10:32 345,600 -------- c:\windows\system32\dllcache\localspl.dll
2009-05-05 14:33 118,784 a------- c:\windows\system32\atibtmon.exe
2009-04-30 16:22 1,985,024 -------- c:\windows\system32\dllcache\iertutil.dll
2009-04-30 16:22 11,064,832 -------- c:\windows\system32\dllcache\ieframe.dll
2009-04-30 16:22 1,207,808 -------- c:\windows\system32\dllcache\urlmon.dll
2009-04-30 16:22 25,600 -------- c:\windows\system32\dllcache\jsproxy.dll
2009-04-30 16:22 385,536 -------- c:\windows\system32\dllcache\iedkcs32.dll
2009-04-30 06:21 173,056 -------- c:\windows\system32\dllcache\ie4uinit.exe
2009-04-28 23:55 133,120 a------- c:\windows\system32\dllcache\extmgr.dll
2009-04-28 04:05 13,824 a------- c:\windows\system32\dllcache\ieudinit.exe
2008-11-05 12:13 1,452 a------- c:\docume~1\compaq~1\applic~1\wklnhst.dat
2009-04-06 22:53 16,384 a--sh--- c:\windows\system32\config\systemprofile\local settings\application data\microsoft\feeds cache\index.dat
2009-01-06 07:00 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009010620090107\index.dat
2009-04-06 22:53 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009040620090407\index.dat

============= FINISH: 14:07:43.09 ===============

[tetonbob]

Looking good, next steps...

Uninstall the following via the Add/Remove Panel (Start->(Settings)->Control Panel->Add/Remove Programs):

Java DB 10.4.1.3
Java(TM) SE Development Kit 6 Update 11

These are all outdated, and security risks by having them installed still. Unfortunately, Java does not uninstall these older versions when you update, nor tell you that you should. Going forward, Java will overwrite existing installs, so removing older versions should not be required after this.

Leave Java(TM) 6 Update 14 alone, as it has the most recent security updates.

---------------------------------------------------------------------------------------------

Please download ATF Cleaner by Atribune.

• Double-click ATF-Cleaner.exe to run the program.
  Under Main choose: Select All
  Click the Empty Selected button.

If you use Firefox browser

• Click Firefox at the top and choose: Select All
  Click the Empty Selected button.
  NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

• Click Opera at the top and choose: Select All
  Click the Empty Selected button.
  NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

---------------------------------------------------------------------------------------------

Please run this online scan to help look for remnants. One vendor's definitions may find what another's does not.


Go here to run an online scannner from ESET.

• Note: You will need to use Internet explorer for this scan
• Turn off the real time scanner of any existing antivirus program while performing the online scan
• Tick the box next to YES, I accept the Terms of Use.
• Click Start
• When asked, allow the activex control to install
• Click Start
• Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
• Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
• Click Scan
• Wait for the scan to finish
• Use notepad to open the logfile located at C:\Program Files\Eset\Eset Online Scanner\log.txt
• Copy and paste that log as a reply to this topic and also let me know how things are now.

[Futility]

All symptoms have disappeared and everything seems to be running just fine! :)

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=6
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.5886
# api_version=3.0.2
# EOSSerial=6666ed50eb70ac4b99e53c9a4bb30604
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2009-07-16 10:05:57
# local_time=2009-07-16 05:05:57 (-0600, Central Daylight Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=1797 37 100 100 904662031250
# scanned=115809
# found=2
# cleaned=0
# scan_time=4616
D:\I386\APPS\APP19100\src\CompaqPresario_Spring06.exe a variant of Win32/AdInstaller application 00000000000000000000000000000000 I
D:\I386\APPS\APP19100\src\HPPavillion_Spring06.exe a variant of Win32/AdInstaller application 00000000000000000000000000000000 I

[tetonbob]

The items Eset found are part of your OEM recovery partition, so we shall leave them be.

Other than that....We should be done here. Some final housekeeping instructions, and protection information for you.

Your logs appear clean.You should be good to go. We still have a few items to address.


Disconnect from the internet and disable your AntiVirus temporarily.

Go to -> Run -> copy/paste in the following single line command & click OK

combofix /u

This will uninstall ComboFix. It will also implement some cleanup procedures and reset System Restore points.

Re-enable your AntiVirus now. Reconnect to the internet at your leisure.

Delete any remaining tools we've used (DDS and GMER) and logs from them.

Empty your Recycle Bin.

Now that your system is clean, to help protect your computer in the future I recommend that you follow these steps and look into the following free programs:

• Microsoft Windows Update - http://www.windowsupdate.com
  Visit regularly. This will ensure your computer always has the latest security updates. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
  
  
• SpywareBlaster to help prevent spyware from installing in the first place.
  • Install & update SpywareBlaster with the latest definitions.
    After you have updated, click the button - enable protection for all unprotected items
• WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites - green to go, yellow for caution and red to stop, helping you avoid the dangerous sites. WOT has an addon available for both Firefox and IE.
  
  
• Winpatrol
  
  Winpatrol is heuristic protection program, meaning it looks for patterns in codes that work like malware. It also takes a snapshot of your system's critical resources and alerts you to any changes that may occur without you knowing. You can read more about Winpatrol's features here.
  
  You can get a free copy of Winpatrol or use the Plus version for more features.
  
  You can read Winpatrol's FAQ if you run into problems.
  
  
• MVPS HOST FILE
  The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer.
  
• ANTIVIRUS SOFTWARE
  It is very important that you have anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future. It is imperative that you update your antivirus software at least once a week (even more if you wish). If you do not update your antivirus software then it will not be able to catch new malware that may have come out.
  
  Do not install more than one AntiVirus program because they will conflict with each other.
  
  
• Scan here http://secunia.com/software_inspector/ for out of date & vulnerable common applications on your computer
  
  
• http://www.trillian.cc ? Trillian or http://www.miranda-im.com ? Miranda-IM - These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN)
  
  
• http://www.aumha.org/downloads/erunt-setup.exe - ERUNT - A useful freeware utility for users of Windows 2000/XP//Vista. It's made up of two parts - ERUNT & NTREGOPT.
  
  ERUNT will create daily complete backups of your computer's Registry. Whilst System Restore does the same thing, a corrupt registry file may prevent Windows from booting & this effectively renders disables System Restore. With ERUNT, you're able to restore the damaged Registry.
  
  NTREGOPT works by recreating each registry hive "from scratch", thus removing any slack space that may be left from previously modified or deleted keys. In other words, it compacts the Registry to a small size which allows Windows to load & perform faster.

In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles

• How did I get infected in the first place?
• PC Safety and Security--What Do I Need?

If you want to fight back the Malware Writers that have made your life a misery, please take a look here and read what you can do against it.

Please respond to this thread one more time so we can mark this thread as resolved.

[Futility]

Thank you for all your help tetonbob! Everything is peachy over here and thanks to you, I doubt I'll be back anytime soon. :)

[tetonbob]

Cheers, Futility, glad to help. We hope any visit to this section of the forum is a one time event! Enjoy the rest of the forums as much as you like.

As this issue is resolved, this topic will be archived.