HELP Newbie Problems - Here's my Hijack log [RESOLVED]

Need a geek? Geeks to Go offers free, quality tech support -- in terms anyone can understand. Volunteers are waiting to help, friendly, technology experts who have knowledge to share, and enjoy helping others. Feel free to browse the site as a guest. However, you must log in to reply to existing topics, or to start a new topic of your own. Other benefits of joining include richer forum features, and removal of all advertising. Learn more in our Welcome Guide Infected? Malware and Spyware Cleaning Guide. What are you waiting for? Click here to join for free today!

> Geeks to Go! » Security » Virus, Spyware and Trojan Removal

HELP Newbie Problems - Here's my Hijack log [RESOLVED]

Options

Lenox View Member Profile	Nov 15 2007, 07:02 PM Post #1
Member Posts: 10 OS: Windows XP	Hello - I am totally new to this forum and seeking online help, but I'm excitied to come across you guys! The other night I left my computer on and in the morn I found that my browser had been changed to a "search" tool bar, that two random new security systems "Online Security Guide" and Live Safety Center" had been added to my desktop, and random "System Alerts" were poppin up on my lower tool bar. SO - I followed the instruction on your site and installed and ran all of the programs including the Panda thing and while the system alert pop ups wnet away, random porn related browsers keep opening if I am online, the two unwanted security software icons are still on my desktop, and my computer is still taking 2 minutes to boot up andis running at about 50% normal speed. Here's are my logs: SUPERAntiSpyware Scan Log Generated 11/14/2007 at 02:43 PM Application Version : 3.6.1000 Core Rules Database Version : 3344 Trace Rules Database Version: 1345 Scan type : Complete Scan Total Scan Time : 01:07:24 Memory items scanned : 409 Memory threats detected : 2 Registry items scanned : 5949 Registry threats detected : 23 File items scanned : 56603 File threats detected : 139 Adware.Vundo-Variant C:\WINDOWS\SYSTEM32\YWXHUXIS.DLL C:\WINDOWS\SYSTEM32\YWXHUXIS.DLL Software\Microsoft\Windows NT\CurrentVersion\WinLogon\Notify\ywxhuxis C:\WINDOWS\SYSTEM32\MTVXMIKQ.DLL Adware.Vundo Variant C:\WINDOWS\SYSTEM32\MLLJK.DLL C:\WINDOWS\SYSTEM32\MLLJK.DLL HKLM\Software\Classes\CLSID\{057EC1CA-D7C3-43AB-B759-591F8AE5ABAC} HKCR\CLSID\{057EC1CA-D7C3-43AB-B759-591F8AE5ABAC} HKCR\CLSID\{057EC1CA-D7C3-43AB-B759-591F8AE5ABAC}\InprocServer32 HKCR\CLSID\{057EC1CA-D7C3-43AB-B759-591F8AE5ABAC}\InprocServer32#ThreadingModel HKLM\Software\Classes\CLSID\{A95B2816-1D7E-4561-A202-68C0DE02353A} HKCR\CLSID\{A95B2816-1D7E-4561-A202-68C0DE02353A} HKCR\CLSID\{A95B2816-1D7E-4561-A202-68C0DE02353A}\InprocServer32 HKCR\CLSID\{A95B2816-1D7E-4561-A202-68C0DE02353A}\InprocServer32#ThreadingModel HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{057EC1CA-D7C3-43AB-B759-591F8AE5ABAC} HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A95B2816-1D7E-4561-A202-68C0DE02353A} HKCR\CLSID\{A95B2816-1D7E-4561-A202-68C0DE02353A} Unclassified.Unknown Origin HKLM\Software\Classes\CLSID\{11A69AE4-FBED-4832-A2BF-45AF82825583} HKCR\CLSID\{11A69AE4-FBED-4832-A2BF-45AF82825583} HKCR\CLSID\{11A69AE4-FBED-4832-A2BF-45AF82825583} HKCR\CLSID\{11A69AE4-FBED-4832-A2BF-45AF82825583}\InprocServer32 HKCR\CLSID\{11A69AE4-FBED-4832-A2BF-45AF82825583}\InprocServer32#ThreadingModel HKLM\Software\Microsoft\Internet Explorer\Toolbar#{11A69AE4-FBED-4832-A2BF-45AF82825583} HKU\S-1-5-21-9143414-692712705-828138379-1006\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser#{11A69AE4-FBED-4832-A2BF-45AF82825583} Browser Hijacker.Internet Explorer Zone Hijack HKU\S-1-5-21-9143414-692712705-828138379-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\amaena.com HKU\S-1-5-21-9143414-692712705-828138379-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\amaena.com#* HKU\S-1-5-21-9143414-692712705-828138379-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\amaena.com\www HKU\S-1-5-21-9143414-692712705-828138379-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\amaena.com\www#* Adware.Tracking Cookie C:\Documents and Settings\Scot\Cookies\scot@msnportal.112.2o7[1].txt C:\Documents and Settings\Scot\Cookies\scot@goclick[2].txt C:\Documents and Settings\Camilla\Local Settings\Temp\Cookies\camilla@atwola[2].txt C:\Documents and Settings\Camilla\Local Settings\Temp\Cookies\camilla@partner2profit[1].txt C:\Documents and Settings\Camilla\Local Settings\Temp\Cookies\camilla@precisionclick[2].txt Trojan.Unknown Origin C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO1.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO10.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO100.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO108.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO109.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO10A.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO10B.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO10C.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO11.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO12.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO13.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO14.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO15.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO16.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO17.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO18.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO19.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO1A.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO1B.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO1C.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO1D.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO1D4.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO1D5.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO1D6.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO1D7.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO1D8.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO1D9.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO1DA.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO1DB.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO1DC.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO1DD.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO1E.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO1E1.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO1E2.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO1E3.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO1E4.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO1E5.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO1F.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO2.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO20.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO21.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO22.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO23.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO24.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO25.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO25F.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO26.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO260.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO261.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO262.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO263.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO27.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO28.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO29.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO2A.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO2B.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO2C.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO2D.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO3.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO30F.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO310.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO311.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO312.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO313.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO314.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO315.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO316.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO317.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO318.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO319.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO31A.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO31B.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO31C.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO31D.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO3CB.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO3CC.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO3CD.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO3CE.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO3CF.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO4.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO5.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO6.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO65.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO66.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO67.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO68.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO69.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO6A6.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO6A7.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO6A8.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO6A9.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO6AA.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO7.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO8.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO9.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO9E1.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO9E2.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO9E3.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO9E4.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICO9E5.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICOA.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICOB.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICOBEA.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICOBEB.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICOBEC.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICOBED.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICOBEE.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICOC.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICOC77.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICOC78.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICOC79.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICOC7A.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICOC7B.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICOC7C.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICOC7D.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICOC7E.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICOC7F.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICOC80.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICOC81.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICOC82.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICOC83.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICOC84.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICOC85.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICOD.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICOE.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICOF.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICOFC.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICOFD.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICOFE.TMP C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\ICOFF.TMP Trojan.Downloader-Gen/DDC C:\DOCUMENTS AND SETTINGS\SCOT\LOCAL SETTINGS\TEMP\OLKHITFB.EXE ACTIVSCAN Incident Status Location Adware:adware/cws Not disinfected C:\Documents and Settings\Scot\Favorites\Health Hacktool:Exploit/iFrame Not disinfected Archive Folders\Inbox\Mail Delivery (failure camilla@camillaflowers.com) Virus:W32/Netsky.P.worm Disinfected Archive Folders\Inbox\Mail Delivery (failure camilla@camillaflowers.com) \message.scr Potentially unwanted tool:Application/PRScheduler Not disinfected C:\WINDOWS\pss\PowerReg SchedulerV2.exeStartup Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 4:18:20 PM, on 11/15/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16544) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\WINDOWS\system32\RioMSC.exe c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\WINDOWS\system32\igfxpers.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2M1.EXE C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\system32\igfxsrvc.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/mywaybiz R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/mywaybiz O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll O3 - Toolbar: (no name) - {11A69AE4-FBED-4832-A2BF-45AF82825583} - (no file) O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [EPSON Stylus Photo RX500] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2K1.EXE /P24 "EPSON Stylus Photo RX500" /O6 "USB001" /M "Stylus Photo RX500" O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [EPSON Stylus Photo RX600] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2M1.EXE /P24 "EPSON Stylus Photo RX600" /O6 "USB001" /M "Stylus Photo RX600" O4 - HKLM\..\Run: [EPSON Stylus Photo RX600 (Copy 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2M1.EXE /P33 "EPSON Stylus Photo RX600 (Copy 1)" /O6 "USB001" /M "Stylus Photo RX600" O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe" O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKCU\..\Run: [EPSON Stylus Photo RX500] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2K1.EXE /P24 "EPSON Stylus Photo RX500" /M "Stylus Photo RX500" /EF "HKCU" O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\BPGame.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1130301169937 O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1195089410953 O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur...loadManager.ocx O16 - DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} (SABScanProcesses Class) - http://www.superadblocker.com/activex/sabspx.cab O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe O23 - Service: Rio MSC Manager (RioMSC) - Digital Networks North America, Inc. - C:\WINDOWS\system32\RioMSC.exe O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe -- End of file - 7936 bytes Thank for your help. I apologize in advance if I did something wrong in posting this.

Ryan View Member Profile	Nov 18 2007, 11:40 PM Post #2
GeekU Teacher Posts: 4,169 From: USA OS: Vista Ultimate X64	Welcome to Geekstogo! I'm Ryan, and I'll be helping you clean your computer. Please download VundoFix.exe to your desktop. Double-click VundoFix.exe to run it. Click the Scan for Vundo button. Once it's done scanning, click the Remove Vundo button. You will receive a prompt asking if you want to remove the files, click YES Once you click yes, your desktop will go blank as it starts removing Vundo. When completed, it will prompt that it will reboot your computer, click OK. Please post the contents of C:\vundofix.txt and a new HiJackThis log. Note: It is possible that VundoFix encountered a file it could not remove. In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot. -Ryan

Lenox View Member Profile	Nov 19 2007, 02:16 AM Post #3
Member Posts: 10 OS: Windows XP	Hi Ryan - thanks for your help. I have a feeling this is going to be a tough one. Since I had not heard from anyone as of this evening, I followed the instructions from a previsou post named "www.geekstogo.com/forum/black-door-Trojan-t173518.html When I ran VundoFis it found three items and I deleted them. So now when I run this there is nothing found and hence no log. But here is my HJT log. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:13:53 AM, on 11/19/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16544) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\RioMSC.exe c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\WINDOWS\system32\igfxpers.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2M1.EXE C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/mywaybiz R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/mywaybiz O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll O2 - BHO: {18d8322e-3794-2708-f024-3ad2d3e856de} - {ed658e3d-2da3-420f-8072-4973e2238d81} - C:\WINDOWS\system32\hrlqamnr.dll (file missing) O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [EPSON Stylus Photo RX500] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2K1.EXE /P24 "EPSON Stylus Photo RX500" /O6 "USB001" /M "Stylus Photo RX500" O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [EPSON Stylus Photo RX600] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2M1.EXE /P24 "EPSON Stylus Photo RX600" /O6 "USB001" /M "Stylus Photo RX600" O4 - HKLM\..\Run: [EPSON Stylus Photo RX600 (Copy 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2M1.EXE /P33 "EPSON Stylus Photo RX600 (Copy 1)" /O6 "USB001" /M "Stylus Photo RX600" O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe" O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\isuspm.exe -startup O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [EPSON Stylus Photo RX500] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2K1.EXE /P24 "EPSON Stylus Photo RX500" /M "Stylus Photo RX500" /EF "HKCU" O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup O4 - Startup: PowerReg SchedulerV2.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: AdwareFilter Background Protection.lnk = C:\Program Files\AdwareFilter\adwarefilter.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\BPGame.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1130301169937 O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1195089410953 O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur...loadManager.ocx O16 - DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} (SABScanProcesses Class) - http://www.superadblocker.com/activex/sabspx.cab O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe O23 - Service: Rio MSC Manager (RioMSC) - Digital Networks North America, Inc. - C:\WINDOWS\system32\RioMSC.exe O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe -- End of file - 7971 bytes

Ryan View Member Profile	Nov 19 2007, 03:17 PM Post #4
GeekU Teacher Posts: 4,169 From: USA OS: Vista Ultimate X64	Open HiJack This and scan. When it finishes, put an X in the box next to these following item(s) O2 - BHO: {18d8322e-3794-2708-f024-3ad2d3e856de} - {ed658e3d-2da3-420f-8072-4973e2238d81} - C:\WINDOWS\system32\hrlqamnr.dll (file missing) Close all open windows except for HiJack This and click fix checked. Reboot your computer. Please rescan with HijackThis and post a fresh log, along with an Uninstall List, in this same topic, and let us know how your system's working. To obtain an Uninstall list. Open HijackThis, click Config, click Misc Tools Click "Open Uninstall Manager" Click "Save List" (generates uninstall_list.txt) -Ryan

Lenox View Member Profile	Nov 19 2007, 03:46 PM Post #5
Member Posts: 10 OS: Windows XP	Hi Ryan - so far so good. Things seem to be back to normal other than my desktop display and a few other programs that seem to now have a new "look" to them. Here are the logs. Please let me know what you think. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 1:35:38 PM, on 11/19/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16544) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\RioMSC.exe c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\WINDOWS\system32\igfxpers.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2M1.EXE C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/mywaybiz R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/mywaybiz O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [EPSON Stylus Photo RX500] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2K1.EXE /P24 "EPSON Stylus Photo RX500" /O6 "USB001" /M "Stylus Photo RX500" O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [EPSON Stylus Photo RX600] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2M1.EXE /P24 "EPSON Stylus Photo RX600" /O6 "USB001" /M "Stylus Photo RX600" O4 - HKLM\..\Run: [EPSON Stylus Photo RX600 (Copy 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2M1.EXE /P33 "EPSON Stylus Photo RX600 (Copy 1)" /O6 "USB001" /M "Stylus Photo RX600" O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe" O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\isuspm.exe -startup O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [EPSON Stylus Photo RX500] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2K1.EXE /P24 "EPSON Stylus Photo RX500" /M "Stylus Photo RX500" /EF "HKCU" O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup O4 - Startup: PowerReg SchedulerV2.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: AdwareFilter Background Protection.lnk = C:\Program Files\AdwareFilter\adwarefilter.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\BPGame.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1130301169937 O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1195089410953 O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur...loadManager.ocx O16 - DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} (SABScanProcesses Class) - http://www.superadblocker.com/activex/sabspx.cab O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe O23 - Service: Rio MSC Manager (RioMSC) - Digital Networks North America, Inc. - C:\WINDOWS\system32\RioMSC.exe O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe -- End of file - 7836 bytes UNINSTALL LIST REPORT ABBYY FineReader 5.0 Sprint Plus Adobe Flash Player 9 ActiveX Adobe Reader 8.1.1 AppCore ArcSoft Software Suite Arthur's Reading Race AV AVG Anti-Spyware 7.5 Barbie™ Mermaid Adventure™ CD-ROM Bodog Poker Version 2.6.0.18 ccCommon Dell Driver Reset Tool DellSupport EPSON CardMonitor EPSON Copy Utility EPSON Photo Print EPSON PhotoStarter3.2 EPSON Printer Software EPSON Scan EPSON Smart Panel EPSON SPRX600 Reference Guide Exl-Plan Free Full Tilt Poker Google Earth HijackThis 2.0.2 Hotfix for Windows XP (KB914440) Hotfix for Windows XP (KB915865) Image Resizer Powertoy for Windows XP Intel® Extreme Graphics 2 Driver Intel® PRO Network Adapters and Drivers Intel® PROSet for Wired Connections Internet Explorer Default Page JumpStart 1st Grade Math v1.0 LiveUpdate 3.2 (Symantec Corporation) LiveUpdate Notice (Symantec Corporation) Macromedia Flash Player Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Hotfix (KB928366) Microsoft .NET Framework 2.0 Microsoft Bootvis Microsoft Internationalized Domain Names Mitigation APIs Microsoft National Language Support Downlevel APIs Microsoft Office 2003 Web Components Microsoft Office Accounting 2007 Microsoft Office Accounting 2007 Microsoft Office Accounting ADP Payroll Addin Microsoft Office Accounting Equifax Addin Microsoft Office Accounting Fixed Asset Manager Microsoft Office Accounting PayPal Addin Microsoft Office Professional Edition 2003 Microsoft Office Small Business Connectivity Components Microsoft Plus! Digital Media Edition Installer Microsoft Plus! Photo Story 2 LE Microsoft SQL Server 2005 Microsoft SQL Server 2005 Express Edition (MSSMLBIZ) Microsoft SQL Server Native Client Microsoft SQL Server Setup Support Files (English) Microsoft SQL Server VSS Writer Microsoft Visual C++ 2005 Redistributable Microsoft Web Publishing Wizard 1.52 MSRedist MSXML 6.0 Parser (KB933579) MyFonts Order M684045 Norton AntiVirus Norton Confidential Browser Component Norton Confidential Web Protection Component Norton Internet Security Norton Internet Security Norton Internet Security Norton Internet Security Norton Internet Security (Symantec Corporation) Norton Protection Center Panda ActiveScan QuickTime Reader Rabbit's Reading 2 Rio Internet Update Rio Music Manager ScanToWeb Security Update for Microsoft .NET Framework 2.0 (KB928365) Security Update for Step By Step Interactive Training (KB898458) Security Update for Step By Step Interactive Training (KB923723) Security Update for Windows Internet Explorer 7 (KB928090) Security Update for Windows Internet Explorer 7 (KB929969) Security Update for Windows Internet Explorer 7 (KB931768) Security Update for Windows Internet Explorer 7 (KB933566) Security Update for Windows Internet Explorer 7 (KB937143) Security Update for Windows Internet Explorer 7 (KB938127) Security Update for Windows Internet Explorer 7 (KB939653) Security Update for Windows Media Player (KB911564) Security Update for Windows Media Player 10 (KB911565) Security Update for Windows Media Player 10 (KB917734) Security Update for Windows Media Player 10 (KB936782) Security Update for Windows Media Player 6.4 (KB925398) Security Update for Windows XP (KB890046) Security Update for Windows XP (KB893066) Security Update for Windows XP (KB893756) Security Update for Windows XP (KB896358) Security Update for Windows XP (KB896423) Security Update for Windows XP (KB896424) Security Update for Windows XP (KB896428) Security Update for Windows XP (KB896688) Security Update for Windows XP (KB899587) Security Update for Windows XP (KB899591) Security Update for Windows XP (KB900725) Security Update for Windows XP (KB901017) Security Update for Windows XP (KB901214) Security Update for Windows XP (KB902400) Security Update for Windows XP (KB904706) Security Update for Windows XP (KB905414) Security Update for Windows XP (KB905749) Security Update for Windows XP (KB905915) Security Update for Windows XP (KB908519) Security Update for Windows XP (KB908531) Security Update for Windows XP (KB911280) Security Update for Windows XP (KB911562) Security Update for Windows XP (KB911567) Security Update for Windows XP (KB911927) Security Update for Windows XP (KB912812) Security Update for Windows XP (KB912919) Security Update for Windows XP (KB913446) Security Update for Windows XP (KB913580) Security Update for Windows XP (KB914388) Security Update for Windows XP (KB914389) Security Update for Windows XP (KB916281) Security Update for Windows XP (KB917159) Security Update for Windows XP (KB917344) Security Update for Windows XP (KB917422) Security Update for Windows XP (KB917953) Security Update for Windows XP (KB918118) Security Update for Windows XP (KB918439) Security Update for Windows XP (KB918899) Security Update for Windows XP (KB919007) Security Update for Windows XP (KB920213) Security Update for Windows XP (KB920214) Security Update for Windows XP (KB920670) Security Update for Windows XP (KB920683) Security Update for Windows XP (KB920685) Security Update for Windows XP (KB921398) Security Update for Windows XP (KB921503) Security Update for Windows XP (KB921883) Security Update for Windows XP (KB922616) Security Update for Windows XP (KB922760) Security Update for Windows XP (KB922819) Security Update for Windows XP (KB923191) Security Update for Windows XP (KB923414) Security Update for Windows XP (KB923689) Security Update for Windows XP (KB923694) Security Update for Windows XP (KB923980) Security Update for Windows XP (KB924191) Security Update for Windows XP (KB924270) Security Update for Windows XP (KB924496) Security Update for Windows XP (KB924667) Security Update for Windows XP (KB925454) Security Update for Windows XP (KB925486) Security Update for Windows XP (KB925902) Security Update for Windows XP (KB926255) Security Update for Windows XP (KB926436) Security Update for Windows XP (KB927779) Security Update for Windows XP (KB927802) Security Update for Windows XP (KB928255) Security Update for Windows XP (KB928843) Security Update for Windows XP (KB929123) Security Update for Windows XP (KB930178) Security Update for Windows XP (KB931261) Security Update for Windows XP (KB931784) Security Update for Windows XP (KB932168) Security Update for Windows XP (KB933729) Security Update for Windows XP (KB935839) Security Update for Windows XP (KB935840) Security Update for Windows XP (KB936021) Security Update for Windows XP (KB938829) Security Update for Windows XP (KB941202) Security Update for Windows XP (KB943460) SPBBC 32bit Spybot - Search & Destroy 1.4 StuffIt Standard SUPERAntiSpyware Free Edition Symantec Technical Support Web Controls TrueForms 4.5 California Forms Ultimate Business Plan Starter Update for Windows XP (KB894391) Update for Windows XP (KB898461) Update for Windows XP (KB900485) Update for Windows XP (KB904942) Update for Windows XP (KB910437) Update for Windows XP (KB916595) Update for Windows XP (KB920872) Update for Windows XP (KB922582) Update for Windows XP (KB927891) Update for Windows XP (KB929338) Update for Windows XP (KB930916) Update for Windows XP (KB931836) Update for Windows XP (KB933360) Update for Windows XP (KB936357) Update for Windows XP (KB938828) Viewpoint Media Player WebCyberCoach 3.2 Dell WebSite Complete Deluxe Edition Windows Genuine Advantage v1.3.0254.0 Windows Installer 3.1 (KB893803) Windows Internet Explorer 7 Windows Media Format Runtime Windows Media Player 10 Windows Media Player 10 Windows XP Hotfix - KB885836 Windows XP Hotfix - KB886185 Windows XP Hotfix - KB887742 Windows XP Hotfix - KB888302 Windows XP Hotfix - KB890859 There you go.

Ryan View Member Profile	Nov 19 2007, 04:16 PM Post #6
GeekU Teacher Posts: 4,169 From: USA OS: Vista Ultimate X64	== Clear Temporary Files == Please download ATF Cleaner by Atribune. This program is for XP and Windows 2000 only Close all Internet Explorer, Firefox, and Opera windows before continuing. Double-click ATF-Cleaner.exe to run the program. Under Main choose: Select All Click the Empty Selected button. If you use Firefox browser Click Firefox at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click No at the prompt. If you use Opera browser Click Opera at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click No at the prompt. Click Exit on the Main menu to close the program. For Technical Support, double-click the e-mail address located at the bottom of each menu. == Clear System Restore== Let's make a new restore point and clear the others: Go - Start>Programmes>Accessories>System Tools>System Restore>Create a New Restore point. Go - Start>Programmes>Accessories>System Tools>Disc Cleanup>"More Options" Tab>Remove All But Most Recent Point. Please do this for each hard drive that you have connected to the computer == Kaspersky Web Scanner == Please do an online scan with Kaspersky WebScanner You will need to use Internet Explorer to do this Click on Kaspersky Online Scanner You will be promted to install an ActiveX component from Kaspersky, Click Yes. The program will launch and then begin downloading the latest definition files: Once the files have been downloaded click on NEXT Now click on Scan Settings In the scan settings make that the following are selected: Scan using the following Anti-Virus database: Extended (if available otherwise Standard) Scan Options: Scan Archives Scan Mail Bases Click OK Now under select a target to scan: Select My Computer This will program will start and scan your system. The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected. Now click on the Save as Text button: Save the file to your desktop. == Request Logs == Please post the log from the Kaspersky scan. -Ryan

Lenox View Member Profile	Nov 19 2007, 06:09 PM Post #7
Member Posts: 10 OS: Windows XP	Hi Ryan - I followed all of your instructions. I guess there is still some stuff there! Kaspersky reported (2) Viruses and (3) Infected Objects. Here's the report: ------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT Monday, November 19, 2007 4:04:35 PM Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 20/11/2007 Kaspersky Anti-Virus database records: 461941 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: C:\ D:\ E:\ Scan Statistics: Total number of scanned objects: 60993 Number of viruses found: 2 Number of infected objects: 3 Number of suspicious objects: 0 Duration of the scan process: 01:00:58 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\2007-11-19_Log.ALUSchedulerSvc.LiveUpdate Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\Shared\QBackup\index.qbs Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBConfig.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBDebug.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBDetect.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBNotify.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBRefr.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetCfg.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetCfg2.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetDev.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetLoc.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBSetUsr.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBStHash.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\BBValid.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\SPPolicy.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\SPStart.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SPBBC\SPStop.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\Quarantine\APAFFF89FB Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\Quarantine\APEBA447E7 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtErEvt.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtETmp\3D8DF568.TMP Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtETmp\A1407DB1.TMP Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtMoEvt.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtNvEvt.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtScEvt.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtTxFEvt.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SRTSP\SrtViEvt.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\SubEng\submissions.idx Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Temp\Perflib_Perfdata_538.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Scot\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Scot\Desktop\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped C:\Documents and Settings\Scot\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Scot\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Scot\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Scot\Local Settings\History\History.IE5\MSHist012007111920071120\index.dat Object is locked skipped C:\Documents and Settings\Scot\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped C:\Documents and Settings\Scot\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Scot\NTUSER.DAT Object is locked skipped C:\Documents and Settings\Scot\ntuser.dat.LOG Object is locked skipped C:\Program Files\Common Files\Symantec Shared\EENGINE\EPERSIST.DAT Object is locked skipped C:\Program Files\Common Files\Symantec Shared\NFWEVT.LOG Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDALRT.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDCON.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDDBG.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDFW.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDIDS.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDSYS.log Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\master.mdf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\mastlog.ldf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\model.mdf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\modellog.ldf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\msdbdata.mdf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\msdblog.ldf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\tempdb.mdf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data\templog.ldf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\LOG\ERRORLOG Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\LOG\log_331.trc Object is locked skipped C:\Program Files\Norton Internet Security\Norton AntiVirus\AVApp.log Object is locked skipped C:\Program Files\Norton Internet Security\Norton AntiVirus\AVError.log Object is locked skipped C:\Program Files\Norton Internet Security\Norton AntiVirus\AVVirus.log Object is locked skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP2\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\DEFAULT Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SYSTEM Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\fmdmfhlv.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.aps skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\ljjptxpn.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.aps skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed. What next???

Ryan View Member Profile	Nov 19 2007, 09:26 PM Post #8
GeekU Teacher Posts: 4,169 From: USA OS: Vista Ultimate X64	Please download VundoFix.exe to your desktop if you don't already have it. Open a new notepad window Paste the list of files from the box below into the notepad window. CODE C:\WINDOWS\system32\fmdmfhlv.dll C:\WINDOWS\system32\ljjptxpn.dl Save this as vundofix.vft and Save as type "all files". Double-click VundoFix.exe to run it. Drag vundofix.vft onto the listbox (white box) of VundoFix. Click the "Remove Vundo" button. You will receive a prompt asking if you want to remove the files, click YES Once you click yes, your desktop will go blank as it starts removing Vundo. When completed, it will prompt that it will reboot your computer, click OK. Please post the contents of C:\vundofix.txt and a new HiJackThis log in a reply to this thread. Note: It is possible that VundoFix encountered a file it could not remove. In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button" when VundoFix appears upon rebooting -Ryan

Lenox View Member Profile	Nov 19 2007, 10:03 PM Post #9
Member Posts: 10 OS: Windows XP	Hi Ryan - I don't know if that worked. When I posted the CODE from the vft file it only listed one of the two .dll's that I had copied into there. Is that normal? Anyways , here are my logs - thanks for your patience. VundoFix V6.6.1 Checking Java version... Java version is 1.4.2.3 Old versions of java are exploitable and should be removed. Scan started at 7:55:50 PM 11/15/2007 Listing files found while scanning.... No infected files were found. Beginning removal... VundoFix V6.6.1 Checking Java version... Java version is 1.4.2.3 Old versions of java are exploitable and should be removed. Scan started at 9:00:04 AM 11/16/2007 Listing files found while scanning.... C:\windows\system32\jprueqqm.dll C:\windows\system32\ldeflwqq.dll C:\WINDOWS\system32\pyqddmld.dll Beginning removal... Attempting to delete C:\windows\system32\jprueqqm.dll C:\windows\system32\jprueqqm.dll Has been deleted! Attempting to delete C:\windows\system32\ldeflwqq.dll C:\windows\system32\ldeflwqq.dll Has been deleted! Attempting to delete C:\WINDOWS\system32\pyqddmld.dll C:\WINDOWS\system32\pyqddmld.dll Could not be deleted. Performing Repairs to the registry. Done! Beginning removal... Attempting to delete C:\WINDOWS\system32\pyqddmld.dll C:\WINDOWS\system32\pyqddmld.dll Has been deleted! Performing Repairs to the registry. Done! VundoFix V6.6.2 Checking Java version... Scan started at 10:50:28 PM 11/18/2007 Listing files found while scanning.... C:\windows\system32\eiezgzeb.dllbox C:\windows\system32\pyqddmld.dllbox C:\windows\system32\ywxhuxis.dllbox Beginning removal... Attempting to delete C:\windows\system32\eiezgzeb.dllbox C:\windows\system32\eiezgzeb.dllbox Has been deleted! Attempting to delete C:\windows\system32\pyqddmld.dllbox C:\windows\system32\pyqddmld.dllbox Has been deleted! Attempting to delete C:\windows\system32\ywxhuxis.dllbox C:\windows\system32\ywxhuxis.dllbox Has been deleted! Performing Repairs to the registry. Done! VundoFix V6.6.2 Checking Java version... Scan started at 11:54:06 PM 11/18/2007 Listing files found while scanning.... No infected files were found. Beginning removal... Beginning removal... Attempting to delete C:\WINDOWS\system32\fmdmfhlv.dll C:\WINDOWS\system32\fmdmfhlv.dll Has been deleted! Performing Repairs to the registry. Done! Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 8:01:29 PM, on 11/19/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16544) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\RioMSC.exe c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\WINDOWS\system32\igfxpers.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2M1.EXE C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE C:\Program Files\Symantec\LiveUpdate\AUPDATE.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/mywaybiz R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/mywaybiz O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [EPSON Stylus Photo RX500] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2K1.EXE /P24 "EPSON Stylus Photo RX500" /O6 "USB001" /M "Stylus Photo RX500" O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [EPSON Stylus Photo RX600] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2M1.EXE /P24 "EPSON Stylus Photo RX600" /O6 "USB001" /M "Stylus Photo RX600" O4 - HKLM\..\Run: [EPSON Stylus Photo RX600 (Copy 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2M1.EXE /P33 "EPSON Stylus Photo RX600 (Copy 1)" /O6 "USB001" /M "Stylus Photo RX600" O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe" O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\isuspm.exe -startup O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [EPSON Stylus Photo RX500] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2K1.EXE /P24 "EPSON Stylus Photo RX500" /M "Stylus Photo RX500" /EF "HKCU" O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup O4 - Startup: PowerReg SchedulerV2.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: AdwareFilter Background Protection.lnk = C:\Program Files\AdwareFilter\adwarefilter.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\BPGame.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1130301169937 O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1195089410953 O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur...loadManager.ocx O16 - DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} (SABScanProcesses Class) - http://www.superadblocker.com/activex/sabspx.cab O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe O23 - Service: Rio MSC Manager (RioMSC) - Digital Networks North America, Inc. - C:\WINDOWS\system32\RioMSC.exe O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe -- End of file - 8057 bytes

Ryan View Member Profile	Nov 19 2007, 10:10 PM Post #10
GeekU Teacher Posts: 4,169 From: USA OS: Vista Ultimate X64	== Remove Programs == Please go to Add/Remove Programs in the Control Panel, and remove the following programs Java 2 Runtime Environment, SE v1.4.2_03 Reboot your computer. == Install Latest Java == Please go to THIS page, and click on the Download link that is in the Java Runtime Environment (JRE) 6 section. Click the radio button next to Accept License Agreement after reviewing it. The page will refresh - this is normal. Download the Windows Offline Installation, Multi-language. You will want to save this to a location you will remember. Once it has finished downloading, double click it, and follow the prompts to install. If it asks to reboot, select Yes. How's the computer running? -Ryan

Lenox View Member Profile	Nov 19 2007, 10:19 PM Post #11
Member Posts: 10 OS: Windows XP	I went there and it doesn't show up. The computer is definitely running better than earlier, but my tool bars and programs still don't look like they used to. For example, the bottom task bar is flat gray and the "Start" icon is a rectangle as opposed to normal where it is usually a blue fade with a green rounded start button.

Ryan View Member Profile	Nov 20 2007, 06:14 PM Post #12
GeekU Teacher Posts: 4,169 From: USA OS: Vista Ultimate X64	If you right click on the taskbar and select Properties, you should see a tab labelled "Start Menu". If you go there, you should see two options: Start Menu and Classic Start Menu. Select Start Menu, and it should be fixed. Congratulations, your log is clean For information on how to protect yourself in the future, read Infection Prevention Do you have any other questions or concerns? This thread will be left open for a few more days, so feel free to ask. -Ryan

Lenox View Member Profile	Nov 20 2007, 06:29 PM Post #13
Member Posts: 10 OS: Windows XP	Hi Ryan A few questions: 1.) do I need to worry about removing the Java stuff that I couldn't find? 2.) what about only one of the code lines shoing up in the Vundo Fix txt when I followed your instruction? 3.) My task bar won't switch back even though the option shows up after going to properties and followingyour instructions

Ryan View Member Profile	Nov 22 2007, 10:12 AM Post #14
GeekU Teacher Posts: 4,169 From: USA OS: Vista Ultimate X64	1. I wouldn't worry, but you should still update Java. 2. Oops, left of an L at the end of the file. Please follow the steps in post 8 again, but paste C:\WINDOWS\system32\ljjptxpn.dll into the notepad file. 3. I'm not sure why it's not changing, but the people helping in the Windows forum should have a better idea. Posting in that area will get you better help for this question. -Ryan

Ryan View Member Profile	Nov 25 2007, 10:06 PM Post #15
GeekU Teacher Posts: 4,169 From: USA OS: Vista Ultimate X64	Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

« Next Oldest · Virus, Spyware and Trojan Removal · Next Newest »

1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)

0 Members:

Topic Title	Replies / Views	Topic Information
Virus, Spyware and Trojan Removal Have done all the prelims, here's my HiJack Log [RESOLVED] 12	28 / 799	6th September 2005 - 11:37 PM kebudackle started - last by Trevuren
Virus, Spyware and Trojan Removal Help.. here is my hijack log... [RESOLVED]	5 / 357	25th September 2005 - 04:24 AM surfsand started - last by Crustyoldbloke
Virus, Spyware and Trojan Removal Did i missed out anything?Here's my hijack log [RESOLVED] 12	15 / 670	2nd May 2006 - 07:07 AM ahusni started - last by Buckeye_Sam
Virus, Spyware and Trojan Removal Here's my hijack log.	1 / 219	18th April 2008 - 05:20 AM Garret B started - last by Rorschach112