[SOLVED] Help! my financial accounts have been accessed! Nasty Virus!

[jkchoi24]

First, I want to thank all the volunteers for helping everyone! This is a great site and it's a God Sent gift for

someone like me!

Second, I want to emphasize that I am a novice tech person. SO would you PLEASE explain everything step by step

(sorry- not too computer savvy, at all). Please speak in everyday language. Thanks.

Okay, so I am 99% sure I have a virus or.. trojan hoarse(?). PLEASE HELP!! It's as if someone is remotely controlling my pc! While I am using the computer, my window's start menu will pop-up, random programs are opened
(anyhting from MS WORD, Notepad, new browser window and go to a new site which I've never visited before, etc.). I can't do anything to stop it but to just trun off my pc to stop this from happening. It happens several times a
day. I thought it was only when I am connected to an internet but it still happens when I have unplugged the LAN line!

Before this started happening, I had Norton Virus 2006 on all the time when using my pc(but not upto date on virus since January 2009- didn't renew my subscription). Also, I was accessing the internet via wireless router. I don't
know how to set-up a password for my wireless router so I left it nprotected. So once this started happening, I disconnected my wireless router and used just LAN line but it continued. Also, before this phenomenon started to occur, I was visiting a site similar to YOUTUBE, but a Chinese site- hxxp://v.yoku.com to watch videos. It's not a p2p- I never downloaded anything but watched the videos online(could this still cause virus? I want to know if this was the site that caused it- so I'll know not to visit again in the future. but I didn't download anything!).

It was when I was visiting this site that I noticed this happening to my pc- someone randomly remote accessing my pc. I stopped going to that site but it continued. Like I said, it still happens even when I have unplugged the LAN line.

Since this "remote controlling my pc" thing began, I ran my Norton(remember, it was installed BEFORE this my pc was infected) to scan my hard drive and it found NOTHING. I did a full system scan and NOthing was found. At this point, I wasn't sure if my pc was infected(sorry- not too computer savvy) so I let several days pass by. Then I

notice my pc freezing more often so I posted for a help on yahoo forum and someone told me to install an AVAST(amalwarebyte???)(this was before I found your site). I downloaded AVAST through cnet and then ran the oftware. It did a full system scan during re-booting process of my pc. IT FOUND NOTHING. After finding your site, I have uninstalled AVAST and only have the NOrton 2006 running right now.

Also, since this virus thing started happening, I thought someone was accessing my PC remotely so I went into the control panel and Systems menu, then disbled the "allow remote access invitation." Of course, this did not help.

It doesn't matter if I am connected to internet- it just randomly controls my pc all by itself- just happened!

this virus just resized my notepad window as I was typeing on it and opened a new program on it's own!

I got an email from PAYPAL account about 3 days after this "remotly controlling my pc" started happening. They said that someone has been accessing my PAYPAL account several times and thus they put a freeze on my account. I had not used my paypal account near over a year! This is when I knew my pc was infected with something for sure! I have all of my financial datas on my pc AND I have any and all of my web email account's log-in ID names on my pC(I know...I was stupid)!!!!

I am so scared. Do I need to cancel my email accounts too? can I just change my passwords? PLEASE HELP!

Since then, I backed up my pc data to a USB AND A DVD. I am scared that the datas that I have backed up are infected! I've ran AVAST and norton on these drives as well but NOthing has been detected(but then again, those 2
softwares didn't detect this virus on my pc hard drive either!). PLease help.

I am running a windows xp. It's a SONY VAIO SZ series notebook and it didn't come with a boot disc. This notebook has a hidden recovery partition. I can restore C- drive to a factory condition by hitting f10(or f8?? unsure) key

While starting CHOOSE Restore C drive Option to format the comp. Is this going to be a problem(that I don't have a bootable CD)?
If so, I may be able to obtain a recovery disk using SONY software but unsure(I have to contact SONY).

I hear that the virus could still remian even after I re-install the hard drive..is that true? I am so scared!

Please help. I am in major crisis with all of my financial and email datas exposed!

I thank you SO VERY MUCH for having read this LONG post and hope to hear from you soon.

Desperately, June

PS: by the way, since I've experienced this virus, remotely contrlling my pc experience, whenI try to open MS word program, it gave me a following warning message. I am posting this because your site said to post everything in detail. MS word showed me this message and I clicked on diable this add-on. However, I never added this add-on before.
Message from MS word:
"word experienced a serious error the last time the add-in "c:\documents and
settings\jc\applicationdata\microsoft\wrd\startup\word code cleaner.dot" was opened. Would you like to disable this add in? TO reactivete this add-in, click About Microsoft office word on the help menu, and then click disabled items" I chose "diable this add-in.

=============================
below I am posting my DDS.txt - copy/pasted directly into Reply box.
have I attached the attach and ark files correctly?
again, i have built in booting ability but do not have bootable disk. is that a problem?

[jkchoi24]

DDS (Ver_09-10-26.01) - NTFSx86
Run by jc at 16:49:09.50 on Fri 10/30/2009
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_16
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1369 [GMT 9:00]

AV: Norton Internet Security 2006 *On-access scanning enabled* (Outdated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}
FW: Norton Internet Security 2006 *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
svchost.exe
svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\npkcmsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
C:\Program Files\Sony\SmartWi Connection Utility\SmartWiService.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
C:\Program Files\Sony\ISB Utility\ISBMgr.exe
C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Protector Suite QL\menusw.exe
C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe
C:\Program Files\Sony\SmartWi Connection Utility\WCULauncher.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\HP\HP UT\bin\hppusg.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Sony\SmartWi Connection Utility\SmartWiTogglet.exe
C:\WINDOWS\system32\CTFMON.EXE
C:\Documents and Settings\jc\Local Settings\Application Data\PeeringPortal\Pino\pino.exe
C:\PROGRA~1\HEWLET~1\Toolbox\STATUS~1\STATUS~1.EXE
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\jc\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.naver.com
uInternet Settings,ProxyOverride = <local>
uURLSearchHooks: AOLSearchHook Class: {54eb34ea-e6be-4cfd-9f4f-c4a0c2eafa22} - c:\program files\aol\aol search enhancement\AOLSearch.dll
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: AOLSearchHook Class: {54eb34ea-e6be-4cfd-9f4f-c4a0c2eafa22} - c:\program files\aol\aol search enhancement\AOLSearch.dll
BHO: CNisExtBho Class: {9ecb9560-04f9-4bbc-943d-298ddf1699e1} - c:\program files\common files\symantec shared\adblocking\NISShExt.dll
BHO: CNavExtBho Class: {a8f38d8d-e480-4d52-b7a2-731bb6995fdd} - c:\program files\norton internet security\norton antivirus\NavShExt.dll
BHO: AcroIEToolbarHelper Class: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Norton Internet Security 2006: {0b53eac3-8d69-4b9e-9b19-a37c9a5676a7} - c:\program files\common files\symantec shared\adblocking\NISShExt.dll
TB: Norton AntiVirus: {c4069e3a-68f1-403e-b40e-20066696354b} - c:\program files\norton internet security\norton antivirus\NavShExt.dll
TB: Veoh Web Player Video Finder: {0fbb9689-d3d7-4f7a-a2e2-585b10099bfc} - c:\program files\veoh networks\veohwebplayer\VeohIEToolbar.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll
EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [VeohPlugin] "c:\program files\veoh networks\veohwebplayer\veohwebplayer.exe"
uRun: [Pino] c:\documents and settings\jc\local settings\application data\peeringportal\pino\pino.exe
mRun: [igfxtray] c:\windows\system32\igfxtray.exe
mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe
mRun: [igfxpers] c:\windows\system32\igfxpers.exe
mRun: [Apoint] c:\program files\apoint\Apoint.exe
mRun: [IntelZeroConfig] "c:\program files\intel\wireless\bin\ZCfgSvc.exe"
mRun: [IntelWireless] "c:\program files\intel\wireless\bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
mRun: [EOUApp] "c:\program files\intel\wireless\bin\EOUWiz.exe"
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [VAIO Recovery] c:\windows\sonysys\vaio recovery\PartSeal.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [SonyPowerCfg] "c:\program files\sony\vaio power management\SPMgr.exe"
mRun: [ISBMgr.exe] c:\program files\sony\isb utility\ISBMgr.exe
mRun: [VAIO Update 2] "c:\program files\sony\vaio update 2\VAIOUpdt.exe" /Stationary
mRun: [NapsterShell] c:\program files\napster\napster.exe /systray
mRun: [Biomenu] "c:\program files\protector suite ql\menusw.exe"
mRun: [VAIOCameraUtility] "c:\program files\sony\vaio camera utility\VCUServe.exe"
mRun: [WCULauncher] c:\program files\sony\smartwi connection utility\WCULauncher.exe
mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe"
mRun: [URLLSTCK.exe] c:\program files\norton internet security\UrlLstCk.exe
mRun: [PartSeal] c:\windows\sonysys\vaio recovery\PartSeal.exe
mRun: [<NO NAME>]
mRun: [HPUsageTracking] "c:\program files\hp\hp ut\bin\hppusg.exe" "c:\program files\hp\hp ut\"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
mRun: [Symantec PIF AlertEng] "c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\pifsvc.exe" /a /m "c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\AlertEng.dll"
mRun: [Acrobat Assistant 7.0] "c:\program files\adobe\acrobat 7.0\distillr\Acrotray.exe"
mRun: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
mRun: [TomcatStartup 2.5] c:\program files\hewlett-packard\toolbox\hpbpsttp.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobea~1.lnk - c:\windows\installer\{ac76ba86-1042-0000-7760-100000000002}\SC_Acrobat.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\blueto~1.lnk - c:\program files\toshiba\bluetooth toshiba stack\TosBtMng.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpimag~1.lnk - c:\program files\hp\digital imaging\bin\hpqthb08.exe
IE: Adobe PDF? ?? - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office11\EXCEL.EXE/3000
IE: ?? PDF? ?? - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: ?? ??? Adobe PDF? ?? - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: ?? ??? ?? PDF? ?? - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: ?? ??? Adobe PDF? ?? - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: ?? ??? ?? PDF? ?? - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: ??? ??? Adobe PDF? ?? - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: ??? ??? ?? PDF? ?? - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office11\REFIEBAR.DLL
DPF: {20BBA18F-5BC8-47B5-8FC9-5DFCA8E56A4B} - hxxp://mpi.dacom.net/XMPI/js/LGDacom_XMPI_20090320.cab
DPF: {286A75C3-11FB-4FB4-AC4A-4DD1B0750050} - hxxp://download.banktown.com/kbstarActiveX/6.2.0.2_20081220/down/INIS60.cab
DPF: {2A6EA6C1-4F09-4CE0-8E2B-95A4D7205B32} - hxxp://imgcdn.pandora.tv/static/smarton/smarton.cab
DPF: {38147BAB-2268-46C3-AC6D-C7FC5FB46519} - hxxp://www.jisanresort.co.kr/season/XClient.cab
DPF: {39461460-2552-4D51-A062-3AB6A7B902E9} - hxxp://img.shinhan.com/shttp/install/down/INIS70.cab
DPF: {39FC0CF9-86F3-4502-B773-D16706EDEC83} - hxxp://img.shinhan.com/rib/common/keyStroke/SoftCamp/403125/SCSK4.cab
DPF: {46681002-27E5-4759-8200-E7097D1C3CDD} - hxxp://img.emart.co.kr/front/WebRoot/common/ocx/SKCrypAX.cab
DPF: {48ECCD73-123C-4C25-A64C-76E8E8A30CAF} - hxxp://mpi.dacom.net/XPayMPI/XPayMPIOCX.cab
DPF: {5CA5E00D-80A8-475A-BF08-816FD56DBC38} - hxxp://support.kornet.net/sw5/order/Speed/cab/KTSpeedNewCtrl.cab
DPF: {7E9FDB80-5316-11D4-B02C-00C04F0CD404} - hxxp://download.kbstar.com/security/XecureWeb/xw_install_v7227.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {8DC067B8-911D-473A-90F1-1171B887CDE0} - hxxp://cyimg7.cyworld.com/ImageUpload/CyPictureU1233.cab?20081124
DPF: {95A57FEB-0909-4FEA-B819-63DA7C4D9E1E} - hxxp://img.shinhan.com/rib/ko/print/PrintmadeActiveX.cab
DPF: {B3B331AC-F3E5-4B4C-8D28-777ABF5E7611} - hxxp://bank.kbstar.com/initech/plugin/nomerge/INIIE8Assist.cab
DPF: {CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {D6FCA8ED-4715-43DE-9BD2-2789778A5B09} - hxxps://vbv.shinhancard.com/popup/npkcx.cab
DPF: {D912AABC-6CB0-416F-85B6-CABBB86FD558} - hxxp://plugin.inicis.com/wallet60/INIwallet60.cab
DPF: {D96D2F74-0B74-47D2-964F-B67E9F69F1CD} - hxxp://www.congnamul.com/ActiveX/Release/CongnamulMap4Asp_V2_0_0_16.cab
DPF: {DC4207CE-C03E-4449-ACB1-032CA4137053} - hxxp://download.kbstar.com/security/nprotect/netizenv4/npz.cab
DPF: {E78928A6-3D2A-4BF7-A100-F3FBAA351B49} - hxxps://www.vpay.co.kr/kvpfiles/KVPISPCTLD.cab
DPF: {F0320816-41D9-49DD-B2F3-8E7B0AE32796} - hxxp://live.afreeca.com:8057/AFCStarter.cab
DPF: {FDE21640-4361-43E7-82B7-D1E32B33349A} - hxxp://install.peeringportal.com/pino/install/package/nppinoinst090222.cab
Handler: s-http - {D37E6C5F-1C0F-47C0-A3B6-403EEC555402} - c:\program files\initech\shttp\InitechSHTTPInterface.10113.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Name-Space Handler: http\s-http - {D37E6C5F-1C0F-47C0-A3B6-403EEC555402} - c:\program files\initech\shttp\InitechSHTTPInterface.10113.dll
Notify: igfxcui - igfxdev.dll
Notify: psfus - fusstub.dll
Notify: VESWinlogon - VESWinlogon.dll
LSA: Notification Packages = scecli fusstub

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\jc\applic~1\mozilla\firefox\profiles\zkixrjii.default\
FF - prefs.js: browser.startup.homepage - hxxps://webid2.gs.com/cgi-bin/external/login.cgi?From=aHR0cHM6Ly9wb3J0YWwuZ3MuY29tL2dzL3BvcnRhbC9ob21l&auth_mask=8291&icorn_id_cookie_name=GSId&icorn_sso_token_name=GSSSO&failed_cookie_name=GSFailedLogins&version=APACHE_ICORN_V4R1_6
FF - plugin: c:\program files\mozilla firefox\plugins\npINISAFEWeb60.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPTURNMED.dll
FF - plugin: c:\program files\pandora.tv\launcher\npmini.dll
FF - plugin: c:\program files\veoh networks\veohwebplayer\NPVeohTVPlugin.dll
FF - plugin: c:\program files\veoh networks\veohwebplayer\npWebPlayerVideoPluginATL.dll
FF - plugin: c:\windows\downloaded program files\nppinoldr1.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}

============= SERVICES / DRIVERS ===============

R0 shpf;Sony HDD Protection Filter Driver;c:\windows\system32\drivers\shpf.sys [2006-7-23 9216]
R2 FdRedir;FdRedir;c:\program files\common files\protector suite ql\drivers\FdRedir.sys [2006-2-23 13440]
R2 FileDisk2;FileDisk Protector Kernel Driver;c:\program files\common files\protector suite ql\drivers\filedisk.sys [2006-2-23 33024]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2008-11-16 99376]
R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [2006-7-23 36352]
R3 SonyImgF;Sony Image Conversion Filter Driver;c:\windows\system32\drivers\SonyImgF.sys [2006-7-23 30080]
R3 SPI;Sony Programmable I/O Control Device;c:\windows\system32\drivers\SonyPI.sys [2006-7-23 71961]
R3 ti21sony;ti21sony;c:\windows\system32\drivers\ti21sony.sys [2006-7-23 226304]
S3 HPPLSBULK;HPPLSBULK;c:\windows\system32\drivers\hpplsbulk.sys [2008-11-22 9344]
S3 NPFWFLT;NPFWFLT;c:\windows\system32\npfwflt.sys [2009-3-1 41600]
S3 nsar;nsar;\??\c:\program files\naver\security\nsar.sys --> c:\program files\naver\security\nsar.sys [?]
S3 NSavFlt;NSavFlt;c:\windows\system32\drivers\NSavFlt.sys [2009-7-10 59136]
S3 scsk5;SCSK5 Driver Service;c:\windows\system32\drivers\scsk5.sys --> c:\windows\system32\drivers\scsk5.sys [?]
S3 scskusbf;USB SCSK Filter Driver Service;c:\windows\system32\drivers\scskusbf.sys [2009-9-20 18184]
S3 scskusbs;USB SCSK Driver Service;c:\windows\system32\drivers\scskusbs.sys [2009-9-20 175872]
S3 SEMWModem;Sony Ericsson SEMWModem;c:\windows\system32\drivers\GCXX.sys [2006-7-23 114944]
S3 SEMWWNIC;Sony Ericsson SEMWWNIC;c:\windows\system32\drivers\GCXXNet.sys [2006-7-23 53248]

=============== Created Last 30 ================

2009-10-29 03:41:25 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll
2009-09-30 12:40:53 10 ----a-w- c:\documents and settings\jc\DOT_001
2009-09-30 12:37:13 10 ----a-w- c:\documents and settings\jc\DOT4_001

==================== Find3M ====================

2009-10-26 11:54:43 18184 ----a-w- c:\windows\system32\drivers\scskusbf.sys
2009-10-26 11:54:43 175872 ----a-w- c:\windows\system32\drivers\scskusbs.sys
2009-10-21 12:45:57 46640 ----a-w- c:\windows\system32\npPCStatusUninst.exe
2009-09-27 15:07:53 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-08-04 15:13:08 2145280 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-08-04 14:20:09 2023936 ----a-w- c:\windows\system32\ntkrnlpa.exe
2009-04-16 16:02:27 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009041720090418\index.dat

============= FINISH: 16:49:19.93 ===============

[Ried]

Hello June and welcome.

I know this is scary, I'll get you through it. The first thing you need to do is get to a known clean computer and change all your login and passwords to any financial sites you frequent.

Do not use the affected computer to access any of those sites again, until we've cleaned it up.

While starting CHOOSE Restore C drive Option to format the comp. Is this going to be a problem(that I don't have a bootable CD)? If so, I may be able to obtain a recovery disk using SONY software but unsure(I have to contact SONY).

I hear that the virus could still remian even after I re-install the hard drive..is that true?

Malware that survives a format and reinstall are very few and far between. Most often when people tell you it survives, it's because they did not reformat (wipe the hard drive clean) before reinstalling Windows. They've only reinstalled Windows on top of itself as a repair, or they did have infected files in their backups and put it right back on when they reinstalled.

I'd like to take a deeper look. Please download rsit.exe and save it to your desktop.

• Double click on RSIT.exe to run it.
• Click Continue at the disclaimer screen.
• Once it has finished, two logs will open. Please post the contents of both log.txt (<<will be maximized) and info.txt (<<will be minimized)

If you do not see the info.txt you can find it in the C:\rsit folder. Please attach that .txt

[jkchoi24]

Hi Reid, thanks for getting to my post so promptly! I am so happy you are here to help Btw, my English is my second language so my apology for my poor grammer in advance.

Per your instruction, I've run the RSIT.exe and attaching the two files. I just wanted to inform you that I picked 3months under the RSIT menu- it asked for me to choose how many months of logs it wanted me to perform.

One more thing, if there are file names in the file directories, with its name appearing to be in all question marks(like this-->c:\??????.ext\????\....), it seems to be doing this with some Korean software programs I've installed. It could be infected files as well- since I could have been infected by a virus program written in Korean(I am a USA citizen but visiting Korea at the moment, hence used Korean internet server). I thought it was worth mentioning it. Should I uninstall any and all Korean softwares(I don't need them)?

Thanks, June

Logfile of random's system information tool 1.06 (written by random/random)
Run by jc at 2009-10-31 08:38:11
Microsoft Windows XP Professional Service Pack 3
System drive C: has 60 GB (67%) free of 89 GB
Total RAM: 2046 MB (62% free)

HijackThis download failed

======Scheduled tasks folder======

C:\WINDOWS\tasks\Norton AntiVirus - Run Full System Scan - jc.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 63136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2008-06-11 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22}]
AOLSearchHook Class - C:\Program Files\AOL\AOL Search Enhancement\AOLSearch.dll [2005-10-15 102400]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9ECB9560-04F9-4bbc-943D-298DDF1699E1}]
CNisExtBho Class - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll [2005-10-23 94336]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A8F38D8D-E480-4D52-B7A2-731BB6995FDD}]
CNavExtBho Class - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll [2007-05-24 140912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]
AcroIEToolbarHelper Class - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [2004-12-14 225280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-09-28 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-09-28 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - Norton Internet Security 2006 - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll [2005-10-23 94336]
{C4069E3A-68F1-403E-B40E-20066696354B} - Norton AntiVirus - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll [2007-05-24 140912]
{0FBB9689-D3D7-4f7a-A2E2-585B10099BFC} - Veoh Web Player Video Finder - C:\Program Files\Veoh Networks\VeohWebPlayer\VeohIEToolbar.dll [2009-04-04 429816]
{47833539-D0C5-4125-9FA8-0819E2EAAC93} - Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [2004-12-14 225280]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"=C:\WINDOWS\system32\igfxtray.exe [2005-12-18 98304]
"igfxhkcmd"=C:\WINDOWS\system32\hkcmd.exe [2005-12-18 77824]
"igfxpers"=C:\WINDOWS\system32\igfxpers.exe [2005-12-18 118784]
"Apoint"=C:\Program Files\Apoint\Apoint.exe [2004-11-18 118784]
"IntelZeroConfig"=C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe [2006-03-01 667718]
"IntelWireless"=C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe [2006-03-01 602182]
"EOUApp"=C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe [2006-03-01 569413]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2006-06-21 7561216]
"VAIO Recovery"=C:\WINDOWS\Sonysys\VAIO Recovery\PartSeal.exe [2003-04-20 28672]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-09-28 149280]
"SonyPowerCfg"=C:\Program Files\Sony\VAIO Power Management\SPMgr.exe [2006-06-14 217088]
"ISBMgr.exe"=C:\Program Files\Sony\ISB Utility\ISBMgr.exe [2004-02-21 32768]
"VAIO Update 2"=C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe [2005-10-12 151552]
"NapsterShell"=C:\Program Files\Napster\napster.exe [2006-06-30 319488]
"Biomenu"=C:\Program Files\Protector Suite QL\menusw.exe [2006-02-23 1354240]
"VAIOCameraUtility"=C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe [2005-12-28 69632]
"WCULauncher"=C:\Program Files\Sony\SmartWi Connection Utility\WCULauncher.exe [2006-02-08 73728]
"ccApp"=C:\Program Files\Common Files\Symantec Shared\ccApp.exe [2007-01-22 52840]
"URLLSTCK.exe"=C:\Program Files\Norton Internet Security\UrlLstCk.exe [2007-01-17 23168]
"PartSeal"=C:\WINDOWS\Sonysys\VAIO Recovery\PartSeal.exe [2003-04-20 28672]
""= []
"HPUsageTracking"=C:\Program Files\HP\HP UT\bin\hppusg.exe [2005-02-07 36864]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2008-06-12 34672]
"HP Software Update"=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2007-05-08 54840]
"KernelFaultCheck"=C:\WINDOWS\system32\dumprep 0 -k []
"Symantec PIF AlertEng"=C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe [2008-01-29 583048]
"Acrobat Assistant 7.0"=C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe [2004-12-14 483328]
"Logitech Hardware Abstraction Layer"=KHALMNPR.EXE []
"TomcatStartup 2.5"=C:\Program Files\Hewlett-Packard\Toolbox\hpbpsttp.exe [2004-11-13 245760]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2008-04-14 1695232]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"VeohPlugin"=C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe [2009-04-04 3558648]
"Pino"=C:\Documents and Settings\jc\Local Settings\Application Data\PeeringPortal\Pino\pino.exe [2009-09-24 889192]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1042-0000-7760-100000000002}\SC_Acrobat.exe
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
Bluetooth Manager.lnk - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
HP Image Zone Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2005-12-18 135168]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\psfus]
C:\WINDOWS\system32\fusstub.dll [2006-02-23 39936]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\VESWinlogon]
C:\WINDOWS\system32\VESWinlogon.dll [2006-03-10 73728]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"notification packages"=scecli
fusstub

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=8

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\NATEON\BIN\NateOnMain.exe"="C:\Program Files\NATEON\BIN\NateOnMain.exe:*:Enabled:NATE ON"
"C:\Program Files\NATEON\Addin\7AEF7E74-08E8-47b9-96F3-BC4A07E4D5E8\AVChatAgent.exe"="C:\Program Files\NATEON\Addin\7AEF7E74-08E8-47b9-96F3-BC4A07E4D5E8\AVChatAgent.exe:*:Enabled:NATEON AVCHAT"
"C:\Program Files\DAUM\PotPlayer\daumvsvr.exe"="C:\Program Files\DAUM\PotPlayer\daumvsvr.exe:*:Enabled:DaumCP VoD Server"
"C:\Program Files\DAUM\PotPlayer\PotPlayerMini.exe"="C:\Program Files\DAUM\PotPlayer\PotPlayerMini.exe:*:Enabled:?? ?????"
"C:\Program Files\PANDORA.TV\Video Streamer\VideoStreamer.exe"="C:\Program Files\PANDORA.TV\Video Streamer\VideoStreamer.exe:*:Enabled:VideoStreamer.exe"
"C:\Program Files\PANDORA.TV\Video Streamer\VSStream.exe"="C:\Program Files\PANDORA.TV\Video Streamer\VSStream.exe:*:Enabled:VSStream.exe"
"C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe"="C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe:*:Enabled:Veoh Web Player "
"C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe"="C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe:*:Enabled:javaw"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\Naver\NaverPCGreen\NPCGreen.npc"="C:\Program Files\Naver\NaverPCGreen\NPCGreen.npc:*:Enabled:NaverPCGreen"
"C:\Documents and Settings\jc\Local Settings\Application Data\PeeringPortal\Pino\pino.exe"="C:\Documents and Settings\jc\Local Settings\Application Data\PeeringPortal\Pino\pino.exe:*:Enabled:Pino"
"C:\WINDOWS\system32\sessmgr.exe"="C:\WINDOWS\system32\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019"
"C:\Program Files\DAUM\PotPlayer\PotPlayer.exe"="C:\Program Files\DAUM\PotPlayer\PotPlayer.exe:*:Enabled:?? ?????"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======List of files/folders created in the last 3 months======

2009-10-31 08:38:11 ----D---- C:\rsit
2009-10-29 12:45:29 ----HDC---- C:\WINDOWS\$NtUninstallKB973354$
2009-10-29 12:45:17 ----HDC---- C:\WINDOWS\$NtUninstallKB973540_WM9$
2009-10-29 12:43:33 ----HDC---- C:\WINDOWS\$NtUninstallKB971486$
2009-10-29 12:43:20 ----HDC---- C:\WINDOWS\$NtUninstallKB973525$
2009-10-29 12:42:01 ----HDC---- C:\WINDOWS\$NtUninstallKB970653-v3$
2009-10-29 12:32:21 ----D---- C:\Program Files\Alwil Software
2009-09-28 00:08:12 ----A---- C:\WINDOWS\system32\javaws.exe
2009-09-28 00:08:12 ----A---- C:\WINDOWS\system32\javaw.exe
2009-09-28 00:08:12 ----A---- C:\WINDOWS\system32\java.exe
2009-09-28 00:08:12 ----A---- C:\WINDOWS\system32\deploytk.dll
2009-09-17 12:59:01 ----A---- C:\WINDOWS\system32\hidserv.dll
2009-09-04 21:51:32 ----D---- C:\Documents and Settings\jc\Application Data\AdobeUM
2009-08-11 08:46:21 ----A---- C:\WINDOWS\system32\msxml4a.dll
2009-08-11 08:46:21 ----A---- C:\WINDOWS\system32\_psisdecd.dll
2009-08-10 05:00:02 ----D---- C:\Documents and Settings\jc\Application Data\gtk-2.0
2009-08-06 09:10:58 ----D---- C:\WINDOWS\system32\XPSViewer
2009-08-06 09:10:54 ----D---- C:\Program Files\MSBuild
2009-08-06 09:10:41 ----D---- C:\Program Files\Reference Assemblies
2009-08-06 09:10:11 ----N---- C:\WINDOWS\system32\prntvpt.dll
2009-08-06 09:10:10 ----N---- C:\WINDOWS\system32\xpssvcs.dll
2009-08-06 09:10:10 ----N---- C:\WINDOWS\system32\xpsshhdr.dll
2009-08-06 09:10:10 ----D---- C:\38816f3c857a50de81
2009-08-06 0901 ----D---- C:\b6cf71510af51a340f2930eaf17ac8
2009-08-06 09:05:57 ----D---- C:\7b91da21811eed2965285777

======List of files/folders modified in the last 3 months======

2009-10-31 08:32:48 ----D---- C:\WINDOWS\Temp
2009-10-31 08:31:09 ----D---- C:\Program Files\Mozilla Firefox
2009-10-30 00:28:01 ----D---- C:\WINDOWS
2009-10-30 00:24:16 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-10-30 00:23:44 ----A---- C:\WINDOWS\system.ini
2009-10-29 23:43:45 ----D---- C:\WINDOWS\system32
2009-10-29 23:43:39 ----D---- C:\WINDOWS\system32\drivers
2009-10-29 21:36:34 ----D---- C:\Program Files\Common Files\Symantec Shared
2009-10-29 20:50:53 ----D---- C:\WINDOWS\system32\CatRoot2
2009-10-29 20:37:05 ----D---- C:\WINDOWS\system32\config
2009-10-29 20:16:25 ----D---- C:\Documents and Settings\jc\Application Data\Adobe
2009-10-29 19:37:43 ----D---- C:\Documents and Settings\jc\Application Data\U3
2009-10-29 18:15:12 ----D---- C:\Documents and Settings\All Users\Application Data\Adobe
2009-10-29 13:52:21 ----HD---- C:\WINDOWS\inf
2009-10-29 13:52:10 ----HD---- C:\WINDOWS\$hf_mig$
2009-10-29 13:45:33 ----D---- C:\WINDOWS\Prefetch
2009-10-29 13:44:45 ----D---- C:\Program Files\Microsoft Silverlight
2009-10-29 12:45:32 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-10-29 12:45:32 ----D---- C:\Program Files\Outlook Express
2009-10-29 12:45:26 ----A---- C:\WINDOWS\imsins.BAK
2009-10-29 12:45:10 ----SHD---- C:\WINDOWS\Installer
2009-10-29 12:45:10 ----HD---- C:\Config.Msi
2009-10-29 12:43:25 ----D---- C:\WINDOWS\ie8updates
2009-10-29 12:42:04 ----D---- C:\WINDOWS\system32\CatRoot
2009-10-29 12:32:21 ----RD---- C:\Program Files
2009-10-28 21:30:16 ----HD---- C:\Program Files\InstallShield Installation Information
2009-10-28 21:29:55 ----D---- C:\Program Files\Common Files
2009-10-26 20:54:33 ----A---- C:\WINDOWS\system32\npd_log.txt
2009-10-26 13:48:24 ----SD---- C:\Documents and Settings\jc\Application Data\Microsoft
2009-10-25 16:08:39 ----SD---- C:\WINDOWS\Downloaded Program Files
2009-10-21 21:45:57 ----A---- C:\WINDOWS\system32\npPCStatusUninst.exe
2009-09-28 00:07:50 ----D---- C:\Program Files\Java
2009-09-26 10:00:57 ----D---- C:\Documents and Settings\jc\Application Data\dvdcss
2009-09-24 13:07:14 ----D---- C:\Program Files\DAUM
2009-09-24 05:43:01 ----D---- C:\Program Files\Naver
2009-09-07 17:19:54 ----D---- C:\Program Files\NATEON
2009-09-04 21:49:11 ----D---- C:\Program Files\Common Files\Adobe
2009-09-04 21:47:58 ----RSD---- C:\WINDOWS\Fonts
2009-09-04 16:42:45 ----D---- C:\Documents and Settings\jc\Application Data\EstSoft
2009-09-04 16:41:49 ----D---- C:\Program Files\ESTsoft
2009-09-04 16:41:41 ----D---- C:\Documents and Settings\All Users\Application Data\ESTsoft
2009-09-04 16:41:40 ----D---- C:\WINDOWS\Resources
2009-09-04 16:07:03 ----D---- C:\Documents and Settings\All Users\Application Data\WinZip
2009-09-04 1654 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft
2009-08-11 08:42:16 ----D---- C:\WINDOWS\system32\ReinstallBackups
2009-08-11 00:13:46 ----D---- C:\WINDOWS\network diagnostic
2009-08-07 07:58:07 ----RSD---- C:\WINDOWS\assembly
2009-08-07 07:56:05 ----D---- C:\WINDOWS\Microsoft.NET
2009-08-07 07:46:43 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-08-07 07:46:21 ----D---- C:\WINDOWS\WinSxS
2009-08-06 09:10:54 ----D---- C:\WINDOWS\system32\en-US
2009-08-06 09:10:28 ----D---- C:\WINDOWS\system32\spool
2009-08-05 00:13:08 ----A---- C:\WINDOWS\system32\ntoskrnl.exe
2009-08-04 23:20:09 ----A---- C:\WINDOWS\system32\ntkrnlpa.exe
2009-08-01 23:53:28 ----D---- C:\Documents and Settings\All Users\Application Data\Symantec

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 DMICall;Sony DMI Call service; C:\WINDOWS\system32\DRIVERS\DMICall.sys [2000-12-06 3952]
R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys []
R1 FsVga;FsVga; C:\WINDOWS\system32\DRIVERS\fsvga.sys [2006-02-28 12160]
R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 36352]
R1 SAVRTPEL;SAVRTPEL; \??\C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVRTPEL.SYS []
R1 SPBBCDrv;SPBBCDrv; \??\C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys []
R1 SYMTDI;SYMTDI; C:\WINDOWS\System32\Drivers\SYMTDI.SYS [2007-10-02 189320]
R1 Tosrfcom;Bluetooth RFCOMM from TOSHIBA; C:\WINDOWS\System32\Drivers\tosrfcom.sys [2005-08-02 64896]
R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.4.10.0; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2006-07-23 21275]
R2 FdRedir;FdRedir; \??\C:\Program Files\Common Files\Protector Suite QL\Drivers\FdRedir.sys []
R2 FileDisk2;FileDisk Protector Kernel Driver; \??\C:\Program Files\Common Files\Protector Suite QL\Drivers\filedisk.sys []
R2 mdmxsdk;mdmxsdk; C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys [2005-10-06 12544]
R2 s24trans;WLAN Transport; C:\WINDOWS\system32\DRIVERS\s24trans.sys [2006-03-01 13568]
R2 symlcbrd;symlcbrd; \??\C:\WINDOWS\system32\drivers\symlcbrd.sys []
R3 ApfiltrService;Alps Pointing-device Filter Driver; C:\WINDOWS\system32\DRIVERS\Apfiltr.sys [2004-11-23 108767]
R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-14 60800]
R3 CmBatt;Microsoft AC Adapter Driver; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2008-04-14 13952]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys []
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-14 144384]
R3 HSF_DPV;HSF_DPV; C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys [2005-10-19 998656]
R3 HSFHWAZL;HSFHWAZL; C:\WINDOWS\system32\DRIVERS\HSFHWAZL.sys [2005-10-19 202112]
R3 IFXTPM;IFXTPM; C:\WINDOWS\system32\DRIVERS\IFXTPM.SYS [2005-10-22 36352]
R3 Mvc25U870_VID_1262&PID_25FD;Sony Visual Communication Camera VGP-VCC2; C:\WINDOWS\System32\Drivers\Mvc25U870.sys [2005-12-29 55680]
R3 NAVENG;NAVENG; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20090112.003\NAVENG.Sys []
R3 NAVEX15;NAVEX15; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20090112.003\NavEx15.Sys []
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-14 61824]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2006-06-21 3662400]
R3 SAVRT;SAVRT; \??\C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVRT.SYS []
R3 SNC;Sony Notebook Control Device; C:\WINDOWS\System32\Drivers\SonyNC.sys [2000-11-10 48896]
R3 SonyImgF;Sony Image Conversion Filter Driver; C:\WINDOWS\system32\DRIVERS\SonyImgF.sys [2006-03-07 30080]
R3 SPI;Sony Programmable I/O Control Device; C:\WINDOWS\system32\DRIVERS\SonyPI.sys [2003-06-19 71961]
R3 STHDA;SigmaTel High Definition Audio CODEC; C:\WINDOWS\system32\drivers\sthda.sys [2006-05-26 1177032]
R3 StillCam;Still Serial Digital Camera Driver; C:\WINDOWS\system32\DRIVERS\serscan.sys [2001-08-17 6784]
R3 SYMDNS;SYMDNS; C:\WINDOWS\System32\Drivers\SYMDNS.SYS [2007-10-02 12680]
R3 SymEvent;SymEvent; \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS []
R3 SYMFW;SYMFW; C:\WINDOWS\System32\Drivers\SYMFW.SYS [2007-10-02 98184]
R3 SYMIDS;SYMIDS; C:\WINDOWS\System32\Drivers\SYMIDS.SYS [2007-10-02 31624]
R3 SYMIDSCO;SYMIDSCO; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\SymcData\idsdefs\20091020.001\symidsco.sys []
R3 SYMNDIS;SYMNDIS; C:\WINDOWS\System32\Drivers\SYMNDIS.SYS [2007-10-02 28040]
R3 SYMREDRV;SYMREDRV; C:\WINDOWS\System32\Drivers\SYMREDRV.SYS [2007-10-02 23944]
R3 ti21sony;ti21sony; C:\WINDOWS\system32\drivers\ti21sony.sys [2006-02-22 226304]
R3 tosporte;Bluetooth Port Driver from Toshiba; C:\WINDOWS\system32\DRIVERS\tosporte.sys [2006-02-11 47488]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-14 30208]
R3 usbhub;Microsoft USB Standard Hub Driver; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-14 59520]
R3 usbstor;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608]
R3 w39n51;Intel(R) PRO/Wireless 3945ABG Adapter Driver; C:\WINDOWS\system32\DRIVERS\w39n51.sys [2006-02-26 1428480]
R3 winachsf;winachsf; C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys [2005-10-19 721280]
R3 yukonwxp;NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller; C:\WINDOWS\system32\DRIVERS\yk51x86.sys [2005-10-18 241408]
S1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
S3 CCDECODE;Closed Caption Decoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-14 17024]
S3 Dot4Scan;Scan Class Driver for IEEE-1284.4; C:\WINDOWS\system32\DRIVERS\Dot4Scan.sys [2001-08-17 8704]
S3 hidusb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
S3 HPPLSBULK;HPPLSBULK; C:\WINDOWS\system32\drivers\hpplsbulk.sys [2005-02-03 9344]
S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2005-01-18 49664]
S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2004-12-25 16496]
S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2004-12-25 21568]
S3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\ialmnt5.sys [2005-12-18 1353820]
S3 LMouKE;Logitech SetPoint Mouse Filter Driver; C:\WINDOWS\system32\DRIVERS\LMouKE.Sys []
S3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2006-02-28 12160]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-14 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-14 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-14 10880]
S3 NPFWFLT;NPFWFLT; \??\C:\WINDOWS\system32\NPFWFLT.SYS []
S3 npkcrypt;npkcrypt; \??\C:\WINDOWS\system32\npkcrypt.sys []
S3 nsar;nsar; \??\C:\Program Files\Naver\Security\nsar.sys []
S3 NSavFlt;NSavFlt; \??\C:\WINDOWS\system32\drivers\NSavFlt.sys []
S3 PCTINDIS5;PCTINDIS5 NDIS Protocol Driver; \??\C:\WINDOWS\system32\PCTINDIS5.SYS []
S3 scsk5;SCSK5 Driver Service; C:\WINDOWS\system32\drivers\scsk5.sys []
S3 scskusbf;USB SCSK Filter Driver Service; C:\WINDOWS\system32\drivers\scskusbf.sys [2009-10-26 18184]
S3 scskusbs;USB SCSK Driver Service; C:\WINDOWS\system32\drivers\scskusbs.sys [2009-10-26 175872]
S3 SEMWModem;Sony Ericsson SEMWModem; C:\WINDOWS\system32\DRIVERS\GCXX.sys [2005-01-03 114944]
S3 SEMWWNIC;Sony Ericsson SEMWWNIC; C:\WINDOWS\system32\DRIVERS\GCXXNet.sys [2005-01-03 53248]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-14 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-14 15232]
S3 TcUsb;TC USB Kernel Driver; C:\WINDOWS\System32\Drivers\tcusb.sys [2006-01-28 28800]
S3 toshidpt;TOSHIBA Bluetooth HID port driver; C:\WINDOWS\system32\drivers\Toshidpt.sys [2005-07-12 3712]
S3 Tosrfbd;Bluetooth RFBUS from TOSHIBA; C:\WINDOWS\System32\Drivers\tosrfbd.sys [2006-04-14 108928]
S3 Tosrfbnp;Bluetooth RFBNEP from TOSHIBA; C:\WINDOWS\System32\Drivers\tosrfbnp.sys [2006-03-17 37632]
S3 Tosrfhid;Bluetooth RFHID from TOSHIBA; C:\WINDOWS\system32\DRIVERS\Tosrfhid.sys [2006-02-09 62848]
S3 tosrfnds;Bluetooth Personal Area Network from TOSHIBA; C:\WINDOWS\system32\DRIVERS\tosrfnds.sys [2005-01-07 18612]
S3 TosRfSnd;Bluetooth Audio Device (WDM) from TOSHIBA; C:\WINDOWS\system32\drivers\TosRfSnd.sys [2006-03-16 52864]
S3 Tosrfusb;Bluetooth USB Controller; C:\WINDOWS\System32\Drivers\tosrfusb.sys [2006-02-24 40192]
S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
S3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-14 15104]
S3 uxxyipoc;uxxyipoc; \??\C:\DOCUME~1\jc\LOCALS~1\Temp\uxxyipoc.sys []
S3 WSTCODEC;World Standard Teletext Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-14 19200]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Automatic LiveUpdate Scheduler;Automatic LiveUpdate Scheduler; C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe [2006-07-26 100032]
R2 ccEvtMgr;Symantec Event Manager; C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe [2007-01-22 192104]
R2 ccProxy;Symantec Network Proxy; C:\Program Files\Common Files\Symantec Shared\ccProxy.exe [2007-09-13 202088]
R2 ccSetMgr;Symantec Settings Manager; C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe [2007-01-22 169576]
R2 EvtEng;Intel(R) PROSet/Wireless Event Log; C:\Program Files\Intel\Wireless\Bin\EvtEng.exe [2006-03-01 114753]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-09-28 153376]
R2 LiveUpdate Notice Service;LiveUpdate Notice Service; C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe [2008-01-29 583048]
R2 navapsvc;Norton AntiVirus Auto-Protect Service; C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe [2007-05-24 139888]
R2 npkcmsvc;npkcmsvc; C:\WINDOWS\system32\npkcmsvc.exe [2009-07-17 178664]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2006-06-21 143428]
R2 RegSrvc;Intel(R) PROSet/Wireless Registry Service; C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe [2006-03-01 217164]
R2 S24EventMonitor;Intel(R) PROSet/Wireless Service; C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe [2006-03-01 540745]
R2 SmartWiService;SmartWiService; C:\Program Files\Sony\SmartWi Connection Utility\SmartWiService.exe [2006-02-08 94208]
R2 SNDSrvc;Symantec Network Drivers Service; C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe [2007-10-02 214408]
R2 SPBBCSvc;Symantec SPBBCSvc; C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe [2005-09-16 1160800]
R2 Symantec Core LC;Symantec Core LC; C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe [2008-11-16 1251720]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2004-08-11 38912]
R2 VAIO Event Service;VAIO Event Service; C:\Program Files\Sony\VAIO Event Service\VESMgr.exe [2006-04-14 176128]
R2 VzCdbSvc;VAIO Entertainment Database Service; C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe [2005-11-29 131072]
R2 VzFw;VAIO Entertainment File Import Service; C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe [2005-11-29 118784]
R3 NSCService;Norton Protection Center Service; C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE [2006-12-16 750720]
R3 Vcsw;VAIO Entertainment UPnP Client Adapter; C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe [2006-04-05 274432]
S2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2007-08-09 73728]
S3 Adobe LM Service;Adobe LM Service; C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [2008-11-18 68096]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 ccISPwdSvc;Symantec Internet Security Password Validation; C:\Program Files\Norton Internet Security\ccPwdSvc.exe [2007-01-17 72328]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 comHost;COM Host; C:\Program Files\Norton Internet Security\comHost.exe [2007-01-17 45696]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 LiveUpdate;LiveUpdate; C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE [2006-07-26 2119360]
S3 MSCSPTISRV;MSCSPTISRV; C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe [2006-04-28 53337]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-29 89136]
S3 PACSPTISVR;PACSPTISVR; C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe [2006-04-28 49241]
S3 SAVScan;Symantec AVScan; C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe [2005-08-27 198368]
S3 SPTISRV;Sony SPTI Service; C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe [2006-04-28 69718]
S3 VAIO Entertainment TV Device Arbitration Service;VAIO Entertainment TV Device Arbitration Service; C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe [2005-11-26 73728]
S3 WmcCds;Windows Media Connect (WMC); c:\program files\windows media connect\mswmccds.exe [2004-08-11 483328]
S3 WmcCdsLs;Windows Media Connect (WMC) Helper; C:\Program Files\Windows Media Connect\mswmcls.exe [2004-08-11 28160]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

[jkchoi24]

Dear Reid,
I unplugged the LAN line while I was running the RSIT.exe and recording the log and info files. I thought it was better to unplug my internet connection while running the program. Was I suppose to be connected to internet connection? Just wondering because I saw that in the log.txt that it says "HijackThis download failed"

Just to be clear going forward, should I be connected to internet connection when performing any actions you tell me to do?

[Ried]

Hi June, I just got online. Please give me several minutes to go over your logs and I'll have the next set of instructions for you.

In answer to your question - yes, keep internet connection unless I mention otherwise. In this case it did not do any harm because the section I want to see, HJT portion would not be reporting.

[Ried]

Okay June, let's get started. Please keep internet connected.

Download ComboFix from one of these locations:

Link 1
Link 2


* IMPORTANT- Save ComboFix.exe to your Desktop

====================================================


Disable your AntiVirus and AntiSpyware applications as they will interfere with our tools and the removal.


====================================================


Double click on combofix.exe & follow the prompts.

• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:





Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply for further review.

[jkchoi24]

Hi Reid, per your instruction, I've ran the combofix.

I did turn off my Norton 2006 off(it only has an option to disable for "until system restarts") before running the combofix. However, it seem to be running while combofix was running because when comofix was trying to create a log file, the notrton internet program popped a window asking, "do you want to allow COmbofix to connect?"

I clicked allow this program to connect.

Did this hinder what you needed me to do? should I run it again? I can try to turn off the norton properly this time.
===============
ComboFix 09-10-30.01 - jc 10/31/2009 12:16.1.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1328 [GMT 9:00]
Running from: c:\documents and settings\jc\Desktop\ComboFix.exe
AV: Norton Internet Security 2006 *On-access scanning disabled* (Outdated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security 2006 *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\recycler\S-1-5-21-3768998587-3165375610-3404083129-500
c:\recycler\S-1-5-21-3846139699-2452428867-2838668386-500
c:\windows\setup.exe
c:\windows\system32\_000006_.tmp.dll
c:\windows\system32\_000007_.tmp.dll
c:\windows\system32\_000008_.tmp.dll
c:\windows\system32\_000009_.tmp.dll
c:\windows\system32\_000021_.tmp.dll
c:\windows\system32\_000023_.tmp.dll
c:\windows\system32\_000024_.tmp.dll
c:\windows\system32\_000025_.tmp.dll
c:\windows\system32\_000026_.tmp.dll
c:\windows\system32\FirstLoad.dll
c:\windows\system32\npZ.ocx

.
((((((((((((((((((((((((( Files Created from 2009-09-28 to 2009-10-31 )))))))))))))))))))))))))))))))
.

2009-10-30 23:38 . 2009-10-30 23:38 -------- d-----w- C:\rsit
2009-10-29 03:41 . 2009-07-10 13:27 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll
2009-10-29 03:32 . 2009-10-29 03:32 -------- d-----w- c:\program files\Alwil Software
2009-10-25 07:08 . 2009-10-25 07:08 -------- d-----w- c:\documents and settings\jc\Local Settings\Application Data\PeeringPortal

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-31 03:12 . 2008-11-16 07:26 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-10-29 15:27 . 2008-11-16 08:00 90248 ----a-w- c:\documents and settings\jc\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-10-29 10:37 . 2008-11-17 13:42 -------- d-----w- c:\documents and settings\jc\Application Data\U3
2009-10-29 04:44 . 2009-06-03 11:31 -------- d-----w- c:\program files\Microsoft Silverlight
2009-10-28 12:30 . 2006-07-22 19:40 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-10-26 11:54 . 2009-09-19 15:26 18184 ----a-w- c:\windows\system32\drivers\scskusbf.sys
2009-10-26 11:54 . 2009-09-19 15:26 175872 ----a-w- c:\windows\system32\drivers\scskusbs.sys
2009-10-21 12:45 . 2008-12-02 04:41 46640 ----a-w- c:\windows\system32\npPCStatusUninst.exe
2009-09-27 15:07 . 2009-09-27 15:08 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-09-27 15:07 . 2006-07-22 20:06 -------- d-----w- c:\program files\Java
2009-09-26 01:00 . 2009-01-16 09:46 -------- d-----w- c:\documents and settings\jc\Application Data\dvdcss
2009-09-24 04:07 . 2009-03-06 15:09 -------- d-----w- c:\program files\DAUM
2009-09-23 20:43 . 2009-07-10 09:53 -------- d-----w- c:\program files\Naver
2009-09-07 08:19 . 2008-11-17 12:41 -------- d-----w- c:\program files\NATEON
2009-09-04 12:51 . 2009-09-04 12:51 -------- d-----w- c:\documents and settings\jc\Application Data\AdobeUM
2009-09-04 12:49 . 2008-11-18 06:58 -------- d-----w- c:\program files\Common Files\Adobe
2009-09-04 07:42 . 2009-02-25 04:06 -------- d-----w- c:\documents and settings\jc\Application Data\EstSoft
2009-09-04 07:41 . 2009-02-25 04:05 -------- d-----w- c:\program files\ESTsoft
2009-09-04 07:41 . 2009-03-10 11:48 -------- d-----w- c:\documents and settings\All Users\Application Data\ESTsoft
2009-09-04 07:07 . 2008-11-21 12:57 -------- d-----w- c:\documents and settings\All Users\Application Data\WinZip
2009-08-04 15:13 . 2009-07-14 13:14 2145280 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-08-04 14:20 . 2009-07-14 13:14 2023936 ----a-w- c:\windows\system32\ntkrnlpa.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"VeohPlugin"="c:\program files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe" [2009-04-03 3558648]
"Pino"="c:\documents and settings\jc\Local Settings\Application Data\PeeringPortal\Pino\pino.exe" [2009-09-24 889192]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-12-17 98304]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-12-17 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-12-17 118784]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2004-11-18 118784]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2006-02-28 667718]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2006-02-28 602182]
"EOUApp"="c:\program files\Intel\Wireless\Bin\EOUWiz.exe" [2006-02-28 569413]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-06-21 7561216]
"VAIO Recovery"="c:\windows\Sonysys\VAIO Recovery\PartSeal.exe" [2003-04-20 28672]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-09-27 149280]
"SonyPowerCfg"="c:\program files\Sony\VAIO Power Management\SPMgr.exe" [2006-06-13 217088]
"ISBMgr.exe"="c:\program files\Sony\ISB Utility\ISBMgr.exe" [2004-02-20 32768]
"VAIO Update 2"="c:\program files\Sony\VAIO Update 2\VAIOUpdt.exe" [2005-10-12 151552]
"NapsterShell"="c:\program files\Napster\napster.exe" [2006-06-29 319488]
"Biomenu"="c:\program files\Protector Suite QL\menusw.exe" [2006-02-23 1354240]
"VAIOCameraUtility"="c:\program files\Sony\VAIO Camera Utility\VCUServe.exe" [2005-12-27 69632]
"WCULauncher"="c:\program files\Sony\SmartWi Connection Utility\WCULauncher.exe" [2006-02-08 73728]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2007-01-22 52840]
"URLLSTCK.exe"="c:\program files\Norton Internet Security\UrlLstCk.exe" [2007-01-16 23168]
"PartSeal"="c:\windows\Sonysys\VAIO Recovery\PartSeal.exe" [2003-04-20 28672]
"HPUsageTracking"="c:\program files\HP\HP UT\bin\hppusg.exe" [2005-02-07 36864]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-11 34672]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 583048]
"Acrobat Assistant 7.0"="c:\program files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2004-12-13 483328]
"TomcatStartup 2.5"="c:\program files\Hewlett-Packard\Toolbox\hpbpsttp.exe" [2004-11-12 245760]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - c:\windows\Installer\{AC76BA86-1042-0000-7760-100000000002}\SC_Acrobat.exe [2009-9-4 25214]
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-11-18 113664]
Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2006-4-8 1773568]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-4 258048]
HP Image Zone Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-4 53248]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]
2006-02-23 02:11 39936 ----a-w- c:\windows\system32\fusstub.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
2006-03-09 21:51 73728 ----a-w- c:\windows\system32\VESWinlogon.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli fusstub

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\NATEON\\BIN\\NateOnMain.exe"=
"c:\\Program Files\\NATEON\\Addin\\7AEF7E74-08E8-47b9-96F3-BC4A07E4D5E8\\AVChatAgent.exe"=
"c:\\Program Files\\DAUM\\PotPlayer\\daumvsvr.exe"=
"c:\\Program Files\\DAUM\\PotPlayer\\PotPlayerMini.exe"=
"c:\\Program Files\\PANDORA.TV\\Video Streamer\\VideoStreamer.exe"=
"c:\\Program Files\\Veoh Networks\\VeohWebPlayer\\veohwebplayer.exe"=
"c:\\Program Files\\Hewlett-Packard\\Toolbox\\jre\\bin\\javaw.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Documents and Settings\\jc\\Local Settings\\Application Data\\PeeringPortal\\Pino\\pino.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\DAUM\\PotPlayer\\PotPlayer.exe"=

R0 shpf;Sony HDD Protection Filter Driver;c:\windows\system32\drivers\shpf.sys [7/23/2006 3:31 AM 9216]
R2 FdRedir;FdRedir;c:\program files\Common Files\Protector Suite QL\Drivers\FdRedir.sys [2/23/2006 11:13 AM 13440]
R2 FileDisk2;FileDisk Protector Kernel Driver;c:\program files\Common Files\Protector Suite QL\Drivers\filedisk.sys [2/23/2006 11:13 AM 33024]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [11/16/2008 5:14 PM 99376]
R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [7/23/2006 3:31 AM 36352]
R3 SonyImgF;Sony Image Conversion Filter Driver;c:\windows\system32\drivers\SonyImgF.sys [7/23/2006 3:31 AM 30080]
R3 SPI;Sony Programmable I/O Control Device;c:\windows\system32\drivers\SonyPI.sys [7/23/2006 3:31 AM 71961]
R3 ti21sony;ti21sony;c:\windows\system32\drivers\ti21sony.sys [7/23/2006 3:31 AM 226304]
S3 HPPLSBULK;HPPLSBULK;c:\windows\system32\drivers\hpplsbulk.sys [11/22/2008 5:07 AM 9344]
S3 NPFWFLT;NPFWFLT;c:\windows\system32\npfwflt.sys [3/1/2009 11:23 PM 41600]
S3 nsar;nsar;\??\c:\program files\Naver\Security\nsar.sys --> c:\program files\Naver\Security\nsar.sys [?]
S3 NSavFlt;NSavFlt;c:\windows\system32\drivers\NSavFlt.sys [7/10/2009 6:53 PM 59136]
S3 scsk5;SCSK5 Driver Service;c:\windows\system32\drivers\scsk5.sys --> c:\windows\system32\drivers\scsk5.sys [?]
S3 scskusbf;USB SCSK Filter Driver Service;c:\windows\system32\drivers\scskusbf.sys [9/20/2009 12:26 AM 18184]
S3 scskusbs;USB SCSK Driver Service;c:\windows\system32\drivers\scskusbs.sys [9/20/2009 12:26 AM 175872]
S3 SEMWModem;Sony Ericsson SEMWModem;c:\windows\system32\drivers\GCXX.sys [7/23/2006 4:46 AM 114944]
S3 SEMWWNIC;Sony Ericsson SEMWWNIC;c:\windows\system32\drivers\GCXXNet.sys [7/23/2006 4:46 AM 53248]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - CLASSPNP_2
*NewlyCreated* - COMHOST
*NewlyCreated* - MBR
*NewlyCreated* - PCIIDEX_2
*NewlyCreated* - UXXYIPOC
*Deregistered* - CLASSPNP_2
*Deregistered* - mbr
*Deregistered* - PCIIDEX_2
*Deregistered* - uxxyipoc
.
Contents of the 'Scheduled Tasks' folder

2009-10-30 c:\windows\Tasks\Norton AntiVirus - Run Full System Scan - jc.job
- c:\progra~1\NORTON~1\NORTON~1\Navw32.exe [2005-10-07 20:13]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.naver.com
uInternet Settings,ProxyOverride = <local>
IE: Adobe PDF? ?? - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: ?? PDF? ?? - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: ?? ??? Adobe PDF? ?? - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: ?? ??? ?? PDF? ?? - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: ?? ??? Adobe PDF? ?? - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: ?? ??? ?? PDF? ?? - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: ??? ??? Adobe PDF? ?? - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: ??? ??? ?? PDF? ?? - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
Handler: s-http - {D37E6C5F-1C0F-47C0-A3B6-403EEC555402} - c:\program files\INITECH\SHTTP\InitechSHTTPInterface.10113.dll
Name-Space Handler: http\s-http - {D37E6C5F-1C0F-47C0-A3B6-403EEC555402} - c:\program files\INITECH\SHTTP\InitechSHTTPInterface.10113.dll
DPF: {20BBA18F-5BC8-47B5-8FC9-5DFCA8E56A4B} - hxxp://mpi.dacom.net/XMPI/js/LGDacom_XMPI_20090320.cab
DPF: {286A75C3-11FB-4FB4-AC4A-4DD1B0750050} - hxxp://download.banktown.com/kbstarActiveX/6.2.0.2_20081220/down/INIS60.cab
DPF: {2A6EA6C1-4F09-4CE0-8E2B-95A4D7205B32} - hxxp://imgcdn.pandora.tv/static/smarton/smarton.cab
DPF: {38147BAB-2268-46C3-AC6D-C7FC5FB46519} - hxxp://www.jisanresort.co.kr/season/XClient.cab
DPF: {46681002-27E5-4759-8200-E7097D1C3CDD} - hxxp://img.emart.co.kr/front/WebRoot/common/ocx/SKCrypAX.cab
DPF: {48ECCD73-123C-4C25-A64C-76E8E8A30CAF} - hxxp://mpi.dacom.net/XPayMPI/XPayMPIOCX.cab
DPF: {5CA5E00D-80A8-475A-BF08-816FD56DBC38} - hxxp://support.kornet.net/sw5/order/Speed/cab/KTSpeedNewCtrl.cab
DPF: {7E9FDB80-5316-11D4-B02C-00C04F0CD404} - hxxp://download.kbstar.com/security/XecureWeb/xw_install_v7227.cab
DPF: {8DC067B8-911D-473A-90F1-1171B887CDE0} - hxxp://cyimg7.cyworld.com/ImageUpload/CyPictureU1233.cab?20081124
DPF: {95A57FEB-0909-4FEA-B819-63DA7C4D9E1E} - hxxp://img.shinhan.com/rib/ko/print/PrintmadeActiveX.cab
DPF: {B3B331AC-F3E5-4B4C-8D28-777ABF5E7611} - hxxp://bank.kbstar.com/initech/plugin/nomerge/INIIE8Assist.cab
DPF: {D912AABC-6CB0-416F-85B6-CABBB86FD558} - hxxp://plugin.inicis.com/wallet60/INIwallet60.cab
DPF: {D96D2F74-0B74-47D2-964F-B67E9F69F1CD} - hxxp://www.congnamul.com/ActiveX/Release/CongnamulMap4Asp_V2_0_0_16.cab
DPF: {E78928A6-3D2A-4BF7-A100-F3FBAA351B49} - hxxps://www.vpay.co.kr/kvpfiles/KVPISPCTLD.cab
DPF: {F0320816-41D9-49DD-B2F3-8E7B0AE32796} - hxxp://live.afreeca.com:8057/AFCStarter.cab
DPF: {FDE21640-4361-43E7-82B7-D1E32B33349A} - hxxp://install.peeringportal.com/pino/install/package/nppinoinst090222.cab
FF - ProfilePath - c:\documents and settings\jc\Application Data\Mozilla\Firefox\Profiles\zkixrjii.default\
FF - prefs.js: browser.startup.homepage - hxxps://webid2.gs.com/cgi-bin/external/login.cgi?From=aHR0cHM6Ly9wb3J0YWwuZ3MuY29tL2dzL3BvcnRhbC9ob21l&auth_mask=8291&icorn_id_cookie_name=GSId&icorn_sso_token_name=GSSSO&failed_cookie_name=GSFailedLogins&version=APACHE_ICORN_V4R1_6
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npINISAFEWeb60.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPTURNMED.dll
FF - plugin: c:\program files\PANDORA.TV\Launcher\npmini.dll
FF - plugin: c:\program files\Veoh Networks\VeohWebPlayer\NPVeohTVPlugin.dll
FF - plugin: c:\program files\Veoh Networks\VeohWebPlayer\npWebPlayerVideoPluginATL.dll
FF - plugin: c:\windows\Downloaded Program Files\nppinoldr1.dll
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-Logitech Hardware Abstraction Layer - KHALMNPR.EXE



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-31 12:22
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-2244050480-266170072-2891423639-1006\Software\Microsoft\Internet Explorer\MenuExt\ ÁÝÐ\Õ *Á¹lÐ|¹ *A*d*o*b*e* *P*D*F*\¸ *À¼XÖ]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
@="res://c:\\Program Files\\Adobe\\Acrobat 7.0\\Acrobat\\AcroIEFavClient.dll/AcroIECaptureSelLinks.html"
"Contexts"=dword:00000010

[HKEY_USERS\S-1-5-21-2244050480-266170072-2891423639-1006\Software\Microsoft\Internet Explorer\MenuExt\ ÁÝÐ\Õ *Á¹lÐ|¹ *0®tÈ *P*D*F*\¸ *À¼XÖ]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"Contexts"=dword:00000010
@="res://c:\\Program Files\\Adobe\\Acrobat 7.0\\Acrobat\\AcroIEFavClient.dll/AcroIEAppendSelLinks.html"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(940)
c:\windows\system32\fusstub.dll
c:\program files\Protector Suite QL\infra.dll
c:\program files\Protector Suite QL\homefus.dll
c:\windows\system32\biologon.dll
c:\program files\Protector Suite QL\homepass.dll
c:\program files\Protector Suite QL\passport.dll
c:\program files\Protector Suite QL\BhTcAll.dll
c:\program files\Protector Suite QL\BhDevTfm.dll
c:\program files\Protector Suite QL\remote.dll
c:\windows\system32\VESWinlogon.dll
c:\program files\Protector Suite QL\mysafe.dll
c:\program files\Protector Suite QL\AlgVer.dll
c:\program files\Protector Suite QL\TCBioLib.dll
c:\program files\Protector Suite QL\config.dll

- - - - - - - > 'lsass.exe'(996)
c:\windows\system32\fusstub.dll
c:\program files\Protector Suite QL\infra.dll
c:\program files\Protector Suite QL\homefus.dll
.
Completion time: 2009-10-31 12:23
ComboFix-quarantined-files.txt 2009-10-31 03:23

Pre-Run: 62,417,600,512 bytes free
Post-Run: 63,991,123,968 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - E69F29019D13CE788846176A39E2D7BA

[Ried]

Hi June, no worries - you did great when you instructed Norton to allow ComboFix to connect.

ComboFix seems to have handled the malware that was present. What we need to do now is run this online scan to search for any remnants. It can take some time, (several hours) so please be patient and allow it to run it's full course:

Establish an internet connection & perform an online scan with Firefox or Internet Explorer at Kaspersky Online Scanner

**Note**

To optimize scanning time and produce a more sensible report for review:

• Close any open programs
• Turn off the real time scanner of any existing antivirus program while performing the online scan.

Click Accept, when prompted to download and install the program files and database of malware definitions.

• Click Run at the Security prompt.
• The program will then begin downloading and installing and will also update the database.
• Please be patient as this can take several minutes.
• Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
• Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
• Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
• Click View scan report at the bottom.
• Click the Save Report As... button.
• Click the Save as Text button to save the file to your desktop so that you may post it in your next reply.

[jkchoi24]

Dear Reid,
before I carryout your above instruction, is there's anyway to check if the CD-rom in the CD drive and USB, in which I have backed up my files and data, are also infected as well? Do i connect them while running the on-line scan?

Please let me know

[Ried]

Yes, connect those and set Kaspersky's online scan to scan those drives as well.

[jkchoi24]

While I was waiting your reply, I was trying to access data from my backed up files on the CD-rom I mentioned. Just as I begin to access those files, the "remote accessing" thing began and forze my pc. I rebooted my pc. Does this mean files on my cd-rom is infected? is there's anyway to salvage the data on this CD (and the USB)? Because I had to delete these backed up files from my current hard drive hence these are my only copies.

Thanks

[jkchoi24]

hi Reid,
How do I set the online scan to scan these drives(USB and CD in the CD-rom) as well? Sorry- I am not too good with computer stuff

[Ried]

Please stand by, I'm loading the online scanner now so I can provide you with detailed instructions.

[Ried]

My apologies for the delay, we are having quite a wind storm here and my internet got knocked out for a bit.

You will have to scan the other drives separately. First, scan My Computer and save that report to your desktop. You should then be able to click 'Folders' just below 'My Computer'. In the pop up box that appears, click the letter of the drive that has your backups, then click OK, then Scan. Save that report as well. Repeat for as many different drive letters that you have.

[jkchoi24]

Dear Reid,

thanks for your instruction. I can't thank you enough for all of your hard work and assistance thus far!

I have run the Kaspersky scan on all of my drives. Are all of my drives clean?

Also you mentioned that it seems all the viruses are removed but I experienced the "remote controlling phenomenon" three times, again, while I was running Kaspersky. It tried to stop the Kaspersky scan by trying to close my browser. Also, music started playing out of no where! only thing I have opened was the Kaspersky scan. I couldn't stop the music! Please help....Is it hiding somewhere?

below are my Kaspersky reports...
Sincerely,
June

[jkchoi24]

sorry- I could upload the files- the virus was freezing my pc!

Also my pc is freezing often now. The CPU usage goes from 5% to 70% by itself when the computer freezes and then back to 4%....

[Ried]

Unfortunately, there's nothing of note in any of the Kaspersky results.

Where did you download this from? Adobe Acrobat 7.0 Professional - Korean

Also, I'd like to take a look with another tool.

Please download System Repair Engineer. On that webpage, scroll down to the second download.

1. Extract it to Desktop & double click SREngLdR.exe to run it

2. Look toward the bottom and tick "Verify Digital Signatures".

3. Select 'Smart Scan' &

4. Click on the [Scan] button

5. When finished, click on the [Save Reports] button & save the log to Desktop

5. Attach the log in your next reply. Dont post it.

You may have to rename SREngLOG.log to SREngLOG.txt to upload it.

I do need some sleep. I'll reply to your response as soon as I can. In the meantime, disconnect this PC from the internet after you've posted. If you don't have another computer to check here for my replies, then reconnect to the internet and check back approximately 6 hours from now.

[jkchoi24]

Dear Reid,

Thank you for all of your hard work and assistance. I hope you get some much needed sleep! I don't have a different pc so I'll diconnect after posting this and check back in 6 hours.

I am posting the System Repair Engineer log text below as an attachment.
While I was running it, it asked the following:
System Repair Engineer has detected a valid 3rd party upload plug-in which have valid digital signatures in Upload sub-directory. When you use "Cpoy suspicious files to SuspiciousFiles sub directory automatically" function, System Repair will send the information to the 3rd party upload plug-in in background automatically.

I didn't click that option "Cpoy suspicious files to SuspiciousFiles sub directory automatically". Should I have done so?

Aslo, following are what happened since my last post.
IE and firefoc opened up all by itself and Norton gave me the following messages(I set up Norton so that it'll ask my permission for certain outbound traffics).



Message from attck #1
An unrecognized program is attempting to use msmsg.exe to connect to a computer at 168.126.63.1 using port 0.
program: msmsgs.exe
path: C:\Program Files\Messenger\
date and time: 10/31/2009....
Launcher:C:\WINDOWS\system32\svchost.exe
Remote address:168.126.63.1 : 53
Local address:192.168.10.5 : 0
Protocol: UDP
Location: default

message from attack #2:
An unrecognized program is attempting to use msmsg.exe to connect to a computer at 168.126.63.1 using port 0.
program: javaw.exe
path:C:\Program Files\Java\jre6\bin\
date and time: 10/31/2009....
launcher: C:\program files\Java\jre6\bin\javaw.exe
Remote address:168.126.63.1 : 53
Local address:192.168.10.5 : 0
Protocol: UDP
Location: default

Message from attck #3
An unrecognized program is attempting to use iexplore.exe to connect to a computer at 168.126.63.1 using port 0.

program: iexplore.exe
path: C:\Programs File\Internet Explorer\
date and time: 10/31/2009
Launcher: C:\Program Files\Adobe\Acrobat 7.0\Acrobat...
Remote address:168.126.63.1 : 53
Local address:192.168.10.5 : 0
Protocol: UDP
Location: default


Also, the adobe acrobat 7.0 Korean is from my previous work. It belongs to my co-worker but it's NOT an illegal copy, I don't believe. It has proper key code(I believe it's proper- there's no crack script). I installed this program way before all of these symptoms happened and it didn't cause any problems before. Should I delete this program, just in case?

Reid, my mouse is freezing up and my pc is crashing every 5 mintues now. someone has created new toolbars and changed my screensaver all by itself! It's officially crazy! I am afraid that if it gets any worse, I won't be able to log into your site to obtain further help! Would you recommend that I just reformat the hard drive and reinstall everything? Where is this thing hiding? Help me....

[jkchoi24]

Hi Reid, was just wondering...
what are those message from Norton?
Is someone trying to use these programs to access the internet from my pc? Just to be clear, I never use MS messenger service!.Also I wasn't using IE nor firefox during this time when these messages from Norton kept popping open.
Whose IP address are those listed in the message?
SHould I allow these attempts to connect or keep blocking them?

Lastly, was I suppose to remove that file mentioned by Kaspersky? It did say it detected the following suspicious program but I didn't let Kaspersky fix the problem from C drive. Was I suppose to remove it using Kaspersky?

File name / Threat / Threats count
C:\WINDOWS\system32\nprotect\temp\npnuninst.exe.npz
Suspicious: Password-protected-EXE


Thanks so much and I'll check back in 5 hours