Please help! Windows Antivirus strikes again [Closed]

Need a geek? Geeks to Go offers free, quality tech support -- in terms anyone can understand. Volunteers are waiting to help, friendly, technology experts who have knowledge to share, and enjoy helping others. Feel free to browse the site as a guest. However, you must log in to reply to existing topics, or to start a new topic of your own. Other benefits of joining include richer forum features, and removal of all advertising. Learn more in our Welcome Guide Infected? Malware and Spyware Cleaning Guide. What are you waiting for? Click here to join for free today!

> Geeks to Go! » Security » Virus, Spyware and Trojan Removal

2 Pages

1 2 >

Please help! Windows Antivirus strikes again [Closed], Windows antivirus not allowing me to open malware or anything

Options

Steadythisknife View Member Profile	Nov 3 2009, 06:59 PM Post #1
Member Posts: 15 OS: Windows xp	Hey guys. I have had a problem trying to battle this Windows Antivirus Pro for a couple days. My biggest problem is I can not open ANY programs at all. I can barely get on the internet but I figured it out. I downloaded Malwarebyes, only problem is I can not open it to install or run it! I am also unable to start my computer in Safe Mode, it just goes back to the screen that allows me to Start windows normally or last known working... I am using windows xp home edition srv pk 3. I am not sure what other info you would need, but if anyone has any ideas that would be greatly appreciated. This is so frustrating!

chamber View Member Profile	Nov 4 2009, 07:46 AM Post #2
Face Burnin' Malware Fighter Posts: 2,711 From: ~/ OS: Linux all the way!	Hi, Please download exeHelper to your desktop. Double-click on exeHelper.com to run the fix. A black window should pop up, press any key to close once the fix is completed. Post the contents of exehelperlog.txt (Will be created in the directory where you ran exeHelper.com, and should open at the end of the scan) Note: If the window shows a message that says "Error deleting file", please re-run the program before posting a log - and post the two logs together (they will both be in the one file). Download ComboFix from one of these locations: Link 1 Link 2 * IMPORTANT !!! Save ComboFix.exe to your Desktop Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link HERE Double click on ComboFix.exe & follow the prompts. As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware. Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console. Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures. Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message: Click on Yes, to continue scanning for malware. When finished, it shall produce a log for you. Please include the C:\ComboFix.txt** log in your next reply. Notes: 1. Do not mouse-click Combofix's window while it is running. That may cause it to stall. 2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

Steadythisknife View Member Profile	Nov 4 2009, 10:26 AM Post #3
Member Posts: 15 OS: Windows xp	Thanks for your response. I am at work right now so as soon as I get home to the infected computer I will attempt these steps. I just hope downloading those items, once they are saved I can open them up. Like I said I have attempted to download other malware, spyware software and just like anything else on my desktop (other folders as well) they do not open. Also just a note, the system tray icons that once were there upon start up no longer load. The only icons that now load there are the volume control, and wireless connection icon. I did make an attempt to go into security settings through control panel and it would not allow me to disable antivirus. Just FYI's incase it helps.

chamber View Member Profile	Nov 4 2009, 10:31 AM Post #4
Face Burnin' Malware Fighter Posts: 2,711 From: ~/ OS: Linux all the way!	Don't worry, we'll sort something out.

Steadythisknife View Member Profile	Nov 4 2009, 06:35 PM Post #5
Member Posts: 15 OS: Windows xp	Ok at the top part where it says turn off the anti virus. When I go to security center it shows it on and I can't make it say off. It does not show as running in task manager so I'm not sure what to do. But I have this for now. Suddenly I am able to open programs today. EDIT: Meant to say does NOT show running in task manager. This post has been edited by Steadythisknife: Nov 5 2009, 07:03 AM

Steadythisknife View Member Profile	Nov 4 2009, 06:36 PM Post #6
Member Posts: 15 OS: Windows xp	exeHelper by Raktor Build 20091021 Run at 19:27:34 on 11/04/09 Now searching... Checking for numerical processes... Checking for bad processes... Checking for bad files... Deleting file C:\WINDOWS\system32\~.exe Deleting file C:\WINDOWS\system32\logon.exe Checking for bad registry entries... Resetting filetype association for .exe Resetting filetype association for .com Resetting userinit and shell values... Resetting policies... --Finished--

chamber View Member Profile	Nov 5 2009, 01:50 AM Post #7
Face Burnin' Malware Fighter Posts: 2,711 From: ~/ OS: Linux all the way!	Ok. Carry on with ComboFix now then.

Steadythisknife View Member Profile	Nov 6 2009, 04:47 PM Post #8
Member Posts: 15 OS: Windows xp	Ok finally got combofix results. ComboFix 09-11-05.05 - myself 11/06/2009 17:34.1.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1015.730 [GMT -5:00] Running from: c:\documents and settings\myself\Desktop\ComboFix.exe AV: Antivirus System PRO On-access scanning enabled (Updated) {A8D49023-CEF0-4614-B2F4-E86F1AF0D636} * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\myself\Desktop\exeHelper.com c:\recycler\S-1-5-21-839522115-562591055-842925246-1003 c:\windows\system32\dadirova.dll c:\windows\system32\dukovolo.dll c:\windows\system32\fabireze.dll c:\windows\system32\fepabavi.dll c:\windows\system32\iehelper.dll.vir c:\windows\system32\jiyayuda.dll c:\windows\system32\kalahavi.dll c:\windows\system32\nehozipa.dll c:\windows\system32\powenewe.dll c:\windows\system32\sekelumo.dll c:\windows\system32\tageruzi.dll c:\windows\system32\verimowe.dll c:\windows\system32\wezewugi.dll c:\windows\system32\winusime.dll c:\windows\Tasks\bsvvsnlx.job . ((((((((((((((((((((((((( Files Created from 2009-10-06 to 2009-11-06 ))))))))))))))))))))))))))))))) . 2009-11-05 00:23 . 2009-11-05 00:23 -------- d-----w- c:\documents and settings\myself\Application Data\Malwarebytes 2009-11-05 00:18 . 2009-09-10 19:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-11-05 00:18 . 2009-11-05 00:48 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-11-05 00:18 . 2009-11-05 00:18 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2009-11-05 00:18 . 2009-09-10 19:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-11-04 02:13 . 2009-11-04 02:13 -------- d-----w- c:\program files\Antivirus System PRO 2009-11-03 01:43 . 2009-11-03 01:43 -------- d-----w- c:\windows\system32\LogFiles 2009-10-31 17:32 . 2009-10-31 17:33 -------- d-----w- C:\avlog 2009-10-31 17:15 . 2009-10-31 17:36 -------- d-----w- c:\program files\jlfvmj 2009-10-20 09:45 . 2009-10-20 09:45 -------- d-----w- c:\documents and settings\myself\Local Settings\Application Data\Windows Live Writer 2009-10-20 04:19 . 2009-11-05 01:27 -------- d-----w- c:\documents and settings\myself\Application Data\skypePM 2009-10-20 04:16 . 2009-11-05 02:26 -------- d-----w- c:\documents and settings\myself\Application Data\Skype 2009-10-20 02:59 . 2009-11-01 07:45 -------- d-----w- c:\documents and settings\myself\Application Data\StumbleUpon 2009-10-20 00:24 . 2009-10-20 00:24 -------- d-----w- c:\program files\Guitar Pro 5 2009-10-19 23:47 . 2009-10-19 23:47 -------- d-s---w- c:\documents and settings\myself\UserData 2009-10-19 21:46 . 2009-10-19 21:46 1961720 ----a-w- c:\documents and settings\myself\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-11-04 00:37 . 2009-10-20 09:42 55640 ----a-w- c:\documents and settings\myself\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-11-03 01:37 . 2009-03-08 06:48 -------- d-----w- c:\program files\Microsoft Works 2009-10-20 04:19 . 2009-10-20 04:19 32 ----a-w- c:\documents and settings\All Users\Application Data\ezsid.dat 2009-10-19 23:06 . 2008-08-01 16:53 76487 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat 2008-05-07 08:34 . 2009-03-08 06:49 15523560 ----a-w- c:\program files\U1 Setup.exe 2009-08-05 00:15 . 2009-08-05 00:15 89600 --sha-w- c:\windows\system32\jutovofa.dll 2009-08-06 05:30 . 2009-08-06 05:30 90112 --sha-w- c:\windows\system32\revubiti.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-09-24 104984] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-09-24 121368] "Persistence"="c:\windows\system32\igfxpers.exe" [2007-09-24 100888] "AsusTray"="c:\program files\EeePC\ACPI\AsTray.exe" [2008-12-04 114688] "AsusACPIServer"="c:\program files\EeePC\ACPI\AsAcpiSvr.exe" [2008-12-18 622592] "AsusEPCMonitor"="c:\program files\EeePC\ACPI\AsEPCMon.exe" [2008-05-21 94208] "IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2008-04-14 208952] "MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2008-04-14 59392] "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 455168] "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 455168] "ETDWare"="c:\program files\Elantech\ETDCtrl.exe" [2009-01-23 416768] "combofix"="c:\combofix\CF25872.exe" [2009-11-06 389120] "RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2008-03-06 16858112] "Alcmtr"="ALCMTR.EXE" - c:\windows\Alcmtr.exe [2005-05-03 69632] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Asus Power Management Utility.lnk - c:\program files\ASUS\EeePC\Asus Power Management Utility\Asus Power Management Utility.exe [2009-3-8 294912] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "LoadAppInit_DLLs"=1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\security center] "UpdatesDisableNotify"=dword:00000001 "FirewallOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\WINDOWS\\explorer.exe"= "c:\\WINDOWS\\system32\\winlogon.exe"= "c:\\WINDOWS\\system32\\services.exe"= "c:\\WINDOWS\\system32\\lsass.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "c:\\Program Files\\ASUS\\EeePC\\Asus Power Management Utility\\Asus Power Management Utility.exe"= R3 AsusACPI;ASUS ACPI Driver;c:\windows\system32\drivers\ASUSACPI.SYS [3/8/2009 1:45 AM 10752] R3 Ktp;Elantech Smart-Pad;c:\windows\system32\drivers\ETD.sys [2/23/2009 12:09 AM 93696] R3 L1e;Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller;c:\windows\system32\drivers\l1e51x86.sys [11/4/2008 1:23 AM 38400] R3 rtl8187Se;Realtek RTL8187SE Wireless LAN PCIE Network Adapter;c:\windows\system32\drivers\rtl8187Se.sys [3/8/2009 1:45 AM 306176] S3 StumbleUponUpdateService;StumbleUponUpdateService;"c:\program files\StumbleUpon\StumbleUponUpdateService.exe" --> c:\program files\StumbleUpon\StumbleUponUpdateService.exe [?] --- Other Services/Drivers In Memory --- NewlyCreated - MBR Deregistered - mbr . Contents of the 'Scheduled Tasks' folder 2009-11-05 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job - c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 15:20] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.com/ uInternet Connection Wizard,ShellNext = hxxp://eeepc.asus.com/global IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm IE: StumbleUpon PhotoBlog It! - StumbleUponIEBar.dll/blogimage . - - - - ORPHANS REMOVED - - - - BHO-{00ba504b-4c32-4937-9043-808a07fbe68d} - powenewe.dll BHO-{C277B942-1F68-486b-8F95-6E486A13F148} - c:\windows\system32\iehelper.dll HKCU-Run-AvScan - c:\program files\Antivirus System PRO\avscan.exe HKLM-Run-sawetajiz - c:\windows\system32\winusime.dll HKLM-Run-loyasanoso - fabireze.dll SharedTaskScheduler-{df24a576-f681-4218-8477-eeca29c6cd76} - c:\windows\system32\gomebomu.dll SharedTaskScheduler-{039a90cd-09de-40f7-ace7-1579c4efdaf8} - c:\windows\system32\winusime.dll SSODL-raloyazod-{df24a576-f681-4218-8477-eeca29c6cd76} - c:\windows\system32\gomebomu.dll SSODL-golahezih-{039a90cd-09de-40f7-ace7-1579c4efdaf8} - c:\windows\system32\winusime.dll AddRemove-StumbleUponIEToolbar - c:\program files\StumbleUpon\uninstall.exe ************************************************************************ catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-11-06 17:42 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ********************************************************************** . ------------------------ Other Running Processes ------------------------ . c:\windows\system32\igfxsrvc.exe c:\windows\system32\igfxext.exe . ************************************************************************ . Completion time: 2009-11-06 17:44 - machine was rebooted ComboFix-quarantined-files.txt 2009-11-06 22:44 Pre-Run: 153,440,505,856 bytes free Post-Run: 153,539,899,392 bytes free WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect - - End Of File - - 9CE64F295EE298EDDA54E56B69726F0A

Steadythisknife View Member Profile	Nov 6 2009, 04:49 PM Post #9
Member Posts: 15 OS: Windows xp	Ok finally have the results of combofix. ComboFix 09-11-05.05 - myself 11/06/2009 17:34.1.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1015.730 [GMT -5:00] Running from: c:\documents and settings\myself\Desktop\ComboFix.exe AV: Antivirus System PRO On-access scanning enabled (Updated) {A8D49023-CEF0-4614-B2F4-E86F1AF0D636} * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\myself\Desktop\exeHelper.com c:\recycler\S-1-5-21-839522115-562591055-842925246-1003 c:\windows\system32\dadirova.dll c:\windows\system32\dukovolo.dll c:\windows\system32\fabireze.dll c:\windows\system32\fepabavi.dll c:\windows\system32\iehelper.dll.vir c:\windows\system32\jiyayuda.dll c:\windows\system32\kalahavi.dll c:\windows\system32\nehozipa.dll c:\windows\system32\powenewe.dll c:\windows\system32\sekelumo.dll c:\windows\system32\tageruzi.dll c:\windows\system32\verimowe.dll c:\windows\system32\wezewugi.dll c:\windows\system32\winusime.dll c:\windows\Tasks\bsvvsnlx.job . ((((((((((((((((((((((((( Files Created from 2009-10-06 to 2009-11-06 ))))))))))))))))))))))))))))))) . 2009-11-05 00:23 . 2009-11-05 00:23 -------- d-----w- c:\documents and settings\myself\Application Data\Malwarebytes 2009-11-05 00:18 . 2009-09-10 19:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-11-05 00:18 . 2009-11-05 00:48 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-11-05 00:18 . 2009-11-05 00:18 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2009-11-05 00:18 . 2009-09-10 19:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-11-04 02:13 . 2009-11-04 02:13 -------- d-----w- c:\program files\Antivirus System PRO 2009-11-03 01:43 . 2009-11-03 01:43 -------- d-----w- c:\windows\system32\LogFiles 2009-10-31 17:32 . 2009-10-31 17:33 -------- d-----w- C:\avlog 2009-10-31 17:15 . 2009-10-31 17:36 -------- d-----w- c:\program files\jlfvmj 2009-10-20 09:45 . 2009-10-20 09:45 -------- d-----w- c:\documents and settings\myself\Local Settings\Application Data\Windows Live Writer 2009-10-20 04:19 . 2009-11-05 01:27 -------- d-----w- c:\documents and settings\myself\Application Data\skypePM 2009-10-20 04:16 . 2009-11-05 02:26 -------- d-----w- c:\documents and settings\myself\Application Data\Skype 2009-10-20 02:59 . 2009-11-01 07:45 -------- d-----w- c:\documents and settings\myself\Application Data\StumbleUpon 2009-10-20 00:24 . 2009-10-20 00:24 -------- d-----w- c:\program files\Guitar Pro 5 2009-10-19 23:47 . 2009-10-19 23:47 -------- d-s---w- c:\documents and settings\myself\UserData 2009-10-19 21:46 . 2009-10-19 21:46 1961720 ----a-w- c:\documents and settings\myself\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-11-04 00:37 . 2009-10-20 09:42 55640 ----a-w- c:\documents and settings\myself\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-11-03 01:37 . 2009-03-08 06:48 -------- d-----w- c:\program files\Microsoft Works 2009-10-20 04:19 . 2009-10-20 04:19 32 ----a-w- c:\documents and settings\All Users\Application Data\ezsid.dat 2009-10-19 23:06 . 2008-08-01 16:53 76487 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat 2008-05-07 08:34 . 2009-03-08 06:49 15523560 ----a-w- c:\program files\U1 Setup.exe 2009-08-05 00:15 . 2009-08-05 00:15 89600 --sha-w- c:\windows\system32\jutovofa.dll 2009-08-06 05:30 . 2009-08-06 05:30 90112 --sha-w- c:\windows\system32\revubiti.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-09-24 104984] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-09-24 121368] "Persistence"="c:\windows\system32\igfxpers.exe" [2007-09-24 100888] "AsusTray"="c:\program files\EeePC\ACPI\AsTray.exe" [2008-12-04 114688] "AsusACPIServer"="c:\program files\EeePC\ACPI\AsAcpiSvr.exe" [2008-12-18 622592] "AsusEPCMonitor"="c:\program files\EeePC\ACPI\AsEPCMon.exe" [2008-05-21 94208] "IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2008-04-14 208952] "MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2008-04-14 59392] "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 455168] "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 455168] "ETDWare"="c:\program files\Elantech\ETDCtrl.exe" [2009-01-23 416768] "combofix"="c:\combofix\CF25872.exe" [2009-11-06 389120] "RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2008-03-06 16858112] "Alcmtr"="ALCMTR.EXE" - c:\windows\Alcmtr.exe [2005-05-03 69632] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Asus Power Management Utility.lnk - c:\program files\ASUS\EeePC\Asus Power Management Utility\Asus Power Management Utility.exe [2009-3-8 294912] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "LoadAppInit_DLLs"=1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\security center] "UpdatesDisableNotify"=dword:00000001 "FirewallOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\WINDOWS\\explorer.exe"= "c:\\WINDOWS\\system32\\winlogon.exe"= "c:\\WINDOWS\\system32\\services.exe"= "c:\\WINDOWS\\system32\\lsass.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "c:\\Program Files\\ASUS\\EeePC\\Asus Power Management Utility\\Asus Power Management Utility.exe"= R3 AsusACPI;ASUS ACPI Driver;c:\windows\system32\drivers\ASUSACPI.SYS [3/8/2009 1:45 AM 10752] R3 Ktp;Elantech Smart-Pad;c:\windows\system32\drivers\ETD.sys [2/23/2009 12:09 AM 93696] R3 L1e;Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller;c:\windows\system32\drivers\l1e51x86.sys [11/4/2008 1:23 AM 38400] R3 rtl8187Se;Realtek RTL8187SE Wireless LAN PCIE Network Adapter;c:\windows\system32\drivers\rtl8187Se.sys [3/8/2009 1:45 AM 306176] S3 StumbleUponUpdateService;StumbleUponUpdateService;"c:\program files\StumbleUpon\StumbleUponUpdateService.exe" --> c:\program files\StumbleUpon\StumbleUponUpdateService.exe [?] --- Other Services/Drivers In Memory --- NewlyCreated - MBR Deregistered - mbr . Contents of the 'Scheduled Tasks' folder 2009-11-05 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job - c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 15:20] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.com/ uInternet Connection Wizard,ShellNext = hxxp://eeepc.asus.com/global IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm IE: StumbleUpon PhotoBlog It! - StumbleUponIEBar.dll/blogimage . - - - - ORPHANS REMOVED - - - - BHO-{00ba504b-4c32-4937-9043-808a07fbe68d} - powenewe.dll BHO-{C277B942-1F68-486b-8F95-6E486A13F148} - c:\windows\system32\iehelper.dll HKCU-Run-AvScan - c:\program files\Antivirus System PRO\avscan.exe HKLM-Run-sawetajiz - c:\windows\system32\winusime.dll HKLM-Run-loyasanoso - fabireze.dll SharedTaskScheduler-{df24a576-f681-4218-8477-eeca29c6cd76} - c:\windows\system32\gomebomu.dll SharedTaskScheduler-{039a90cd-09de-40f7-ace7-1579c4efdaf8} - c:\windows\system32\winusime.dll SSODL-raloyazod-{df24a576-f681-4218-8477-eeca29c6cd76} - c:\windows\system32\gomebomu.dll SSODL-golahezih-{039a90cd-09de-40f7-ace7-1579c4efdaf8} - c:\windows\system32\winusime.dll AddRemove-StumbleUponIEToolbar - c:\program files\StumbleUpon\uninstall.exe ************************************************************************ catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-11-06 17:42 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ********************************************************************** . ------------------------ Other Running Processes ------------------------ . c:\windows\system32\igfxsrvc.exe c:\windows\system32\igfxext.exe . ************************************************************************ . Completion time: 2009-11-06 17:44 - machine was rebooted ComboFix-quarantined-files.txt 2009-11-06 22:44 Pre-Run: 153,440,505,856 bytes free Post-Run: 153,539,899,392 bytes free WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect - - End Of File - - 9CE64F295EE298EDDA54E56B69726F0A

Steadythisknife View Member Profile	Nov 6 2009, 04:53 PM Post #10
Member Posts: 15 OS: Windows xp	Oops. Didn't mean to double post. Do those programs I ran actually fix things or is it just to gather a log? I ask because now all my start up icons are in the start bar again. And I can click on icons and programs and have them open. This post has been edited by Steadythisknife: Nov 6 2009, 04:55 PM

chamber View Member Profile	Nov 7 2009, 03:35 AM Post #11
Face Burnin' Malware Fighter Posts: 2,711 From: ~/ OS: Linux all the way!	Some programs will fix things, some gather logs, some do both. 1) CFScript 1. Close any open browsers. 2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. 3. Open notepad and copy/paste the text in the quotebox below into it: QUOTE File:: c:\windows\system32\revubiti.dll c:\windows\system32\jutovofa.dll Folder:: c:\program files\jlfvmj Registry:: [HKEY_LOCAL_MACHINE\software\microsoft\security center] "UpdatesDisableNotify"=dword:00000000 "FirewallOverride"=dword:00000000 Driver:: Save this as CFScript.txt, in the same location as ComboFix.exe Refering to the picture above, drag CFScript into ComboFix.exe When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply. 2) Malwarebytes Please download Malwarebytes' Anti-Malware from Here. Double Click mbam-setup.exe to install the application. Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish. If an update is found, it will download and install the latest version. Once the program has loaded, select "Perform Quick Scan", then click Scan. The scan may take some time to finish,so please be patient. When the scan is complete, click OK, then Show Results to view the results. Make sure that everything is checked, and click Remove Selected. When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note) The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM. Copy&Paste the entire report in your next reply. Extra Note: If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediatly. 3) OTL Download OTL to your desktop. Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted. When the window appears, underneath Output at the top change it to Minimal Output. Check the boxes beside LOP Check and Purity Check. Under the Custom Scan box paste this in netsvcs msconfig safebootminimal safebootnetwork activex drivers32 %SYSTEMDRIVE%\.exe HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions %SYSTEMDRIVE%\eventlog.dll /s /md5 %SYSTEMDRIVE%\scecli.dll /s /md5 %SYSTEMDRIVE%\netlogon.dll /s /md5 %SYSTEMDRIVE%\cngaudit.dll /s /md5 %SYSTEMDRIVE%\sceclt.dll /s /md5 %SYSTEMDRIVE%\ntelogon.dll /s /md5 %SYSTEMDRIVE%\logevent.dll /s /md5 %SYSTEMDRIVE%\iaStor.sys /s /md5 %SYSTEMDRIVE%\nvstor.sys /s /md5 %SYSTEMDRIVE%\atapi.sys /s /md5 %SYSTEMDRIVE%\IdeChnDr.sys /s /md5 %SYSTEMDRIVE%\viasraid.sys /s /md5 %SYSTEMDRIVE%\AGP440.sys /s /md5 %SYSTEMDRIVE%\vaxscsi.sys /s /md5 Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long. When the scan completes, it will open two notepad windows. OTL.Txt* and Extras.Txt. These are saved in the same location as OTL. Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them all in. In your reply I would like to see copied and pasted, 1) ComboFix log 2) Malwarebytes log 3) OTL logs

Steadythisknife View Member Profile	Nov 7 2009, 07:15 AM Post #12
Member Posts: 15 OS: Windows xp	Results for combofix ComboFix 09-11-05.05 - myself 11/07/2009 7:29.2.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1015.747 [GMT -5:00] Running from: c:\documents and settings\myself\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\myself\Desktop\CFScript.txt AV: Antivirus System PRO On-access scanning enabled (Updated) {A8D49023-CEF0-4614-B2F4-E86F1AF0D636} FILE :: "c:\windows\system32\jutovofa.dll" "c:\windows\system32\revubiti.dll" . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\program files\jlfvmj c:\windows\system32\jutovofa.dll c:\windows\system32\revubiti.dll . ((((((((((((((((((((((((( Files Created from 2009-10-07 to 2009-11-07 ))))))))))))))))))))))))))))))) . 2009-11-05 00:23 . 2009-11-05 00:23 -------- d-----w- c:\documents and settings\myself\Application Data\Malwarebytes 2009-11-05 00:18 . 2009-09-10 19:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-11-05 00:18 . 2009-11-05 00:48 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-11-05 00:18 . 2009-11-05 00:18 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2009-11-05 00:18 . 2009-09-10 19:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-11-04 02:13 . 2009-11-04 02:13 -------- d-----w- c:\program files\Antivirus System PRO 2009-11-03 01:43 . 2009-11-03 01:43 -------- d-----w- c:\windows\system32\LogFiles 2009-10-31 17:32 . 2009-10-31 17:33 -------- d-----w- C:\avlog 2009-10-20 09:45 . 2009-10-20 09:45 -------- d-----w- c:\documents and settings\myself\Local Settings\Application Data\Windows Live Writer 2009-10-20 04:19 . 2009-11-05 01:27 -------- d-----w- c:\documents and settings\myself\Application Data\skypePM 2009-10-20 04:16 . 2009-11-05 02:26 -------- d-----w- c:\documents and settings\myself\Application Data\Skype 2009-10-20 02:59 . 2009-11-01 07:45 -------- d-----w- c:\documents and settings\myself\Application Data\StumbleUpon 2009-10-20 00:24 . 2009-10-20 00:24 -------- d-----w- c:\program files\Guitar Pro 5 2009-10-19 23:47 . 2009-10-19 23:47 -------- d-s---w- c:\documents and settings\myself\UserData 2009-10-19 21:46 . 2009-10-19 21:46 1961720 ----a-w- c:\documents and settings\myself\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-11-04 00:37 . 2009-10-20 09:42 55640 ----a-w- c:\documents and settings\myself\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-11-03 01:37 . 2009-03-08 06:48 -------- d-----w- c:\program files\Microsoft Works 2009-10-20 04:19 . 2009-10-20 04:19 32 ----a-w- c:\documents and settings\All Users\Application Data\ezsid.dat 2009-10-19 23:06 . 2008-08-01 16:53 76487 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat 2008-05-07 08:34 . 2009-03-08 06:49 15523560 ----a-w- c:\program files\U1 Setup.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-09-24 104984] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-09-24 121368] "Persistence"="c:\windows\system32\igfxpers.exe" [2007-09-24 100888] "AsusTray"="c:\program files\EeePC\ACPI\AsTray.exe" [2008-12-04 114688] "AsusACPIServer"="c:\program files\EeePC\ACPI\AsAcpiSvr.exe" [2008-12-18 622592] "AsusEPCMonitor"="c:\program files\EeePC\ACPI\AsEPCMon.exe" [2008-05-21 94208] "IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2008-04-14 208952] "MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2008-04-14 59392] "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 455168] "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 455168] "ETDWare"="c:\program files\Elantech\ETDCtrl.exe" [2009-01-23 416768] "RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2008-03-06 16858112] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Asus Power Management Utility.lnk - c:\program files\ASUS\EeePC\Asus Power Management Utility\Asus Power Management Utility.exe [2009-3-8 294912] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "c:\\Program Files\\ASUS\\EeePC\\Asus Power Management Utility\\Asus Power Management Utility.exe"= R3 AsusACPI;ASUS ACPI Driver;c:\windows\system32\drivers\ASUSACPI.SYS [3/8/2009 1:45 AM 10752] R3 Ktp;Elantech Smart-Pad;c:\windows\system32\drivers\ETD.sys [2/23/2009 12:09 AM 93696] R3 L1e;Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller;c:\windows\system32\drivers\l1e51x86.sys [11/4/2008 1:23 AM 38400] R3 rtl8187Se;Realtek RTL8187SE Wireless LAN PCIE Network Adapter;c:\windows\system32\drivers\rtl8187Se.sys [3/8/2009 1:45 AM 306176] S3 StumbleUponUpdateService;StumbleUponUpdateService;"c:\program files\StumbleUpon\StumbleUponUpdateService.exe" --> c:\program files\StumbleUpon\StumbleUponUpdateService.exe [?] --- Other Services/Drivers In Memory --- NewlyCreated - MBR Deregistered - mbr Deregistered - PROCEXP113 . Contents of the 'Scheduled Tasks' folder 2009-11-07 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job - c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 15:20] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.com/ uInternet Connection Wizard,ShellNext = hxxp://eeepc.asus.com/global IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm IE: StumbleUpon PhotoBlog It! - StumbleUponIEBar.dll/blogimage . ************************************************************************ catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-11-07 07:34 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************ . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(488) c:\windows\system32\igfxdev.dll . Completion time: 2009-11-07 7:36 ComboFix-quarantined-files.txt 2009-11-07 12:36 ComboFix2.txt 2009-11-06 22:44 Pre-Run: 153,343,836,160 bytes free Post-Run: 153,572,413,440 bytes free - - End Of File - - E12787478A6288F3706BDCA685955071 Results for malwarebyes Malwarebytes' Anti-Malware 1.41 Database version: 3115 Windows 5.1.2600 Service Pack 3 11/7/2009 7:54:20 AM mbam-log-2009-11-07 (07-54-20).txt Scan type: Full Scan (C:\\|) Objects scanned: 119047 Time elapsed: 8 minute(s), 28 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 34 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: C:\Qoobox\Quarantine\C\WINDOWS\system32\dadirova.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Qoobox\Quarantine\C\WINDOWS\system32\fabireze.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Qoobox\Quarantine\C\WINDOWS\system32\iehelper.dll.vir.vir (Trojan.BHO) -> Quarantined and deleted successfully. C:\Qoobox\Quarantine\C\WINDOWS\system32\jutovofa.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Qoobox\Quarantine\C\WINDOWS\system32\nehozipa.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Qoobox\Quarantine\C\WINDOWS\system32\powenewe.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Qoobox\Quarantine\C\WINDOWS\system32\revubiti.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Qoobox\Quarantine\C\WINDOWS\system32\sekelumo.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Qoobox\Quarantine\C\WINDOWS\system32\tageruzi.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Qoobox\Quarantine\C\WINDOWS\system32\verimowe.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Qoobox\Quarantine\C\WINDOWS\system32\wezewugi.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{934F6501-2E50-4F30-B1A3-8F0DF77B68CF}\RP11\A0000502.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{934F6501-2E50-4F30-B1A3-8F0DF77B68CF}\RP11\A0000507.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{934F6501-2E50-4F30-B1A3-8F0DF77B68CF}\RP11\A0000511.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{934F6501-2E50-4F30-B1A3-8F0DF77B68CF}\RP11\A0000517.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{934F6501-2E50-4F30-B1A3-8F0DF77B68CF}\RP11\A0000518.exe (Worm.Emold) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{934F6501-2E50-4F30-B1A3-8F0DF77B68CF}\RP11\A0000521.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{934F6501-2E50-4F30-B1A3-8F0DF77B68CF}\RP12\A0000617.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{934F6501-2E50-4F30-B1A3-8F0DF77B68CF}\RP12\A0000619.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{934F6501-2E50-4F30-B1A3-8F0DF77B68CF}\RP12\A0000623.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{934F6501-2E50-4F30-B1A3-8F0DF77B68CF}\RP12\A0000624.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{934F6501-2E50-4F30-B1A3-8F0DF77B68CF}\RP12\A0000625.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{934F6501-2E50-4F30-B1A3-8F0DF77B68CF}\RP12\A0000626.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{934F6501-2E50-4F30-B1A3-8F0DF77B68CF}\RP12\A0000627.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{934F6501-2E50-4F30-B1A3-8F0DF77B68CF}\RP12\A0000628.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{934F6501-2E50-4F30-B1A3-8F0DF77B68CF}\RP12\A0000731.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{934F6501-2E50-4F30-B1A3-8F0DF77B68CF}\RP12\A0000732.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{934F6501-2E50-4F30-B1A3-8F0DF77B68CF}\RP6\A0000137.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{934F6501-2E50-4F30-B1A3-8F0DF77B68CF}\RP6\A0000138.dll (Trojan.BHO) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{934F6501-2E50-4F30-B1A3-8F0DF77B68CF}\RP6\A0000150.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{934F6501-2E50-4F30-B1A3-8F0DF77B68CF}\RP6\A0000167.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{934F6501-2E50-4F30-B1A3-8F0DF77B68CF}\RP6\A0000168.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{934F6501-2E50-4F30-B1A3-8F0DF77B68CF}\RP6\A0000169.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{934F6501-2E50-4F30-B1A3-8F0DF77B68CF}\RP6\A0000208.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

chamber View Member Profile	Nov 7 2009, 08:24 AM Post #14
Face Burnin' Malware Fighter Posts: 2,711 From: ~/ OS: Linux all the way!	Hi, 1) OTL Run OTL Under the Custom Scans/Fixes box at the bottom, paste in the following CODE :OTL [2009/11/03 19:44:47 \| 00,400,192 \| ---- \| C] () -- C:\Documents and Settings\myself\Desktop\Silent Runners.vbs [2009/10/31 12:35:40 \| 00,000,754 \| ---- \| C] () -- C:\Documents and Settings\myself\Desktop\Antivirus System PRO.lnk :Services :Reg :Files :Commands [purity] [emptytemp] [Reboot] Then click the Run Fix button at the top Let the program run unhindered, reboot the PC when it is done Open OTL again and click the Quick Scan button. Post the log it produces in your next reply. 2) JavaRa Please download JavaRa to your desktop and unzip it to its own folder Run JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions. Accept any prompts. Open JavaRa.exe again and select Search For Updates. Select Update Using Sun Java's Website then click Search and click on the Open Webpage button. Download and install the latest Java Runtime Environment (JRE) version for your computer. 3) Kaspersky Using Internet Explorer or Firefox, visit Kaspersky Online Scanner 1. Click Accept, when prompted to download and install the program files and database of malware definitions. 2. To optimize scanning time and produce a more sensible report for review: Close any open programs Turn off the real time scanner of any existing antivirus program while performing the online scan. Click HERE to see how to disable the most common antivirus programs. 3. Click Run at the Security prompt. The program will then begin downloading and installing and will also update the database. Please be patient as this can take quite a long time to download. Once the update is complete, click on Settings. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button: Spyware, adware, dialers, and other riskware Archives E-mail databases Click on My Computer under the green Scan bar to the left to start the scan. Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it. Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined. Click View report... at the bottom. Click the Save report... button. Change the Files of type dropdown box to Text file (.txt) and name the file KasReport.txt to save the file to your desktop so that you may post it in your next reply In your reply I would like to see copied and pasted, 1) OTL logs 2) Kaspersky scan

Steadythisknife View Member Profile	Nov 7 2009, 10:34 AM Post #15
Member Posts: 15 OS: Windows xp	OTL results: OTL logfile created on: 11/7/2009 9:40:58 AM - Run 2 OTL by OldTimer - Version 3.1.4.0 Folder = C:\Documents and Settings\myself\Desktop Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.5512) Locale: 00000409 \| Country: United States \| Language: ENU \| Date Format: M/d/yyyy 1015.05 Mb Total Physical Memory \| 737.30 Mb Available Physical Memory \| 72.64% Memory free 2.39 Gb Paging File \| 2.21 Gb Available in Paging File \| 92.65% Paging File free Paging file location(s): C:\pagefile.sys 1524 3048 [binary data] %SystemDrive% = C: \| %SystemRoot% = C:\WINDOWS \| %ProgramFiles% = C:\Program Files Drive C: \| 149.02 Gb Total Space \| 143.04 Gb Free Space \| 95.99% Space Free \| Partition Type: NTFS D: Drive not present or media not loaded E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: JEFF Current User Name: myself Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: On Skip Microsoft Files: On File Age = 14 Days Output = Minimal Quick Scan ========== Processes (SafeList) ========== PRC - C:\Documents and Settings\myself\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Program Files\Elantech\ETDCtrl.exe (ELANTECH Devices Corp.) PRC - C:\Program Files\EeePC\ACPI\AsAcpiSvr.exe (ASUSTeK Computer Inc.) PRC - C:\Program Files\EeePC\ACPI\AsTray.exe (ASUSTeK Computer Inc.) PRC - C:\Program Files\ASUS\EeePC\Asus Power Management Utility\Asus Power Management Utility.exe (ASUSTeK Computer Inc.) PRC - C:\Program Files\EeePC\ACPI\AsEPCMon.exe (ASUSTeK Computer Inc.) PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation) PRC - C:\WINDOWS\system32\wbem\wmiprvse.exe (Microsoft Corporation) PRC - C:\WINDOWS\NOTEPAD.EXE (Microsoft Corporation) PRC - C:\WINDOWS\RTHDCPL.exe (Realtek Semiconductor Corp.) PRC - C:\WINDOWS\system32\igfxsrvc.exe (Intel Corporation) PRC - C:\WINDOWS\system32\igfxext.exe (Intel Corporation) PRC - C:\WINDOWS\system32\hkcmd.exe (Intel Corporation) PRC - C:\WINDOWS\system32\igfxtray.exe (Intel Corporation) ========== Modules (SafeList) ========== MOD - C:\Documents and Settings\myself\Desktop\OTL.exe (OldTimer Tools) MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll (Microsoft Corporation) MOD - C:\WINDOWS\system32\wbem\framedyn.dll (Microsoft Corporation) ========== Win32 Services (SafeList) ========== SRV - (StumbleUponUpdateService) -- File not found SRV - (helpsvc) -- C:\WINDOWS\pchealth\helpctr\binaries\pchsvc.dll (Microsoft Corporation) SRV - (WLSetupSvc) -- C:\Program Files\Windows Live\installer\WLSetupSvc.exe (Microsoft Corporation) SRV - (usnjsvc) -- C:\Program Files\Windows Live\Messenger\usnsvc.exe (Microsoft Corporation) SRV - (aspnet_state) -- C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe (Microsoft Corporation) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?p...&ar=msnhome IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?p...amp;ar=iesearch IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p...amp;ar=iesearch IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?p...ER}&ar=home IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p...amp;ar=iesearch IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?p...&ar=msnhome IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 O1 HOSTS File: (27 bytes) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (StumbleUpon Launcher) - {145B29F4-A56B-4b90-BBAC-45784EBEBBB7} - C:\Program Files\StumbleUpon\StumbleUponIEBar.dll File not found O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.) O2 - BHO: (Windows Live Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (Windows Live Toolbar Helper) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (Microsoft Corporation) O3 - HKLM\..\Toolbar: (StumbleUpon Toolbar) - {5093EB4C-3E93-40AB-9266-B607BA87BDC8} - C:\Program Files\StumbleUpon\StumbleUponIEBar.dll File not found O3 - HKLM\..\Toolbar: (Windows Live Toolbar) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (Microsoft Corporation) O3 - HKCU\..\Toolbar\WebBrowser: (Windows Live Toolbar) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (Microsoft Corporation) O4 - HKLM..\Run: [AsusACPIServer] C:\Program Files\EeePC\ACPI\AsAcpiSvr.exe (ASUSTeK Computer Inc.) O4 - HKLM..\Run: [AsusEPCMonitor] C:\Program Files\EeePC\ACPI\AsEPCMon.exe (ASUSTeK Computer Inc.) O4 - HKLM..\Run: [AsusTray] C:\Program Files\EeePC\ACPI\AsTray.exe (ASUSTeK Computer Inc.) O4 - HKLM..\Run: [ETDWare] C:\Program Files\Elantech\ETDCtrl.exe (ELANTECH Devices Corp.) O4 - HKLM..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe (Intel Corporation) O4 - HKLM..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe (Intel Corporation) O4 - HKLM..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation) O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe () O4 - HKLM..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe (Intel Corporation) O4 - HKLM..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation) O4 - HKLM..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation) O4 - HKLM..\Run: [RTHDCPL] C:\WINDOWS\RTHDCPL.exe (Realtek Semiconductor Corp.) O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Asus Power Management Utility.lnk = C:\Program Files\ASUS\EeePC\Asus Power Management Utility\Asus Power Management Utility.exe (ASUSTeK Computer Inc.) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Main present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0 O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O8 - Extra context menu item: &Windows Live Search - C:\Program Files\Windows Live Toolbar\msntb.dll (Microsoft Corporation) O8 - Extra context menu item: StumbleUpon PhotoBlog It! - File not found O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation) O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation) O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone. O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.0...oUploader55.cab (Facebook Photo Uploader 5 Control) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ipp - No CLSID value found O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp - No CLSID value found O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL File not found O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation) O24 - Desktop Components:0 (My Current Home Page) - About:Home O31 - SafeBoot: AlternateShell - cmd.exe O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2008/08/01 11:54:36 \| 00,000,000 \| ---- \| M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O34 - HKLM BootExecute: (autocheck) - File not found O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation) O34 - HKLM BootExecute: () - File not found O35 - comfile [open] -- "%1" % File not found O35 - exefile [open] -- "%1" %* File not found ========== Files/Folders - Created Within 14 Days ========== [2009/11/07 09:38:26 \| 00,000,000 \| ---D \| C] -- C:\_OTL [2009/11/07 07:59:40 \| 00,528,896 \| ---- \| C] (OldTimer Tools) -- C:\Documents and Settings\myself\Desktop\OTL.exe [2009/11/07 07:42:42 \| 04,045,528 \| ---- \| C] (Malwarebytes Corporation ) -- C:\Documents and Settings\myself\Desktop\mbam-setup.exe [2009/11/07 07:36:17 \| 00,000,000 \| ---D \| C] -- C:\WINDOWS\temp [2009/11/06 17:33:45 \| 00,000,000 \| RHSD \| C] -- C:\cmdcons [2009/11/06 17:31:54 \| 00,212,480 \| ---- \| C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe [2009/11/06 17:31:54 \| 00,161,792 \| ---- \| C] (SteelWerX) -- C:\WINDOWS\SWREG.exe [2009/11/06 17:31:54 \| 00,136,704 \| ---- \| C] (SteelWerX) -- C:\WINDOWS\SWSC.exe [2009/11/06 17:31:54 \| 00,031,232 \| ---- \| C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe [2009/11/06 17:31:45 \| 00,000,000 \| ---D \| C] -- C:\WINDOWS\ERDNT [2009/11/04 19:24:10 \| 00,000,000 \| ---D \| C] -- C:\Qoobox [2009/11/04 19:23:09 \| 00,000,000 \| ---D \| C] -- C:\Documents and Settings\myself\Application Data\Malwarebytes [2009/11/04 19:18:05 \| 00,038,224 \| ---- \| C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2009/11/04 19:18:02 \| 00,019,160 \| ---- \| C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2009/11/04 19:18:02 \| 00,000,000 \| ---D \| C] -- C:\Program Files\Malwarebytes' Anti-Malware [2009/11/04 19:18:02 \| 00,000,000 \| ---D \| C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes [2009/11/03 21:13:37 \| 00,000,000 \| ---D \| C] -- C:\Program Files\Antivirus System PRO [2009/11/03 19:15:06 \| 04,045,528 \| ---- \| C] (Malwarebytes Corporation ) -- C:\Documents and Settings\myself\Desktop\mbamfusetup.exe [2009/11/02 20:53:39 \| 00,000,000 \| ---D \| C] -- C:\WINDOWS\pss [2009/11/02 20:43:53 \| 00,000,000 \| ---D \| C] -- C:\WINDOWS\System32\LogFiles [2009/10/31 12:32:37 \| 00,000,000 \| ---D \| C] -- C:\avlog [2009/10/29 21:09:05 \| 00,000,000 \| R-SD \| C] -- C:\Documents and Settings\myself\My Documents\My Stationery [2009/10/27 16:41:55 \| 00,000,000 \| ---D \| C] -- C:\Documents and Settings\myself\Desktop\New Folder [2009/03/08 01:49:55 \| 15,523,560 \| ---- \| C] (Macrovision Corporation) -- C:\Program Files\U1 Setup.exe ========== Files - Modified Within 14 Days ========== [2009/11/07 09:39:35 \| 00,001,158 \| ---- \| M] () -- C:\WINDOWS\System32\wpa.dbl [2009/11/07 09:39:30 \| 00,000,006 \| -H-- \| M] () -- C:\WINDOWS\tasks\SA.DAT [2009/11/07 09:39:27 \| 00,002,048 \| --S- \| M] () -- C:\WINDOWS\bootstat.dat [2009/11/07 09:39:24 \| 10,644,23424 \| -HS- \| M] () -- C:\hiberfil.sys [2009/11/07 09:39:00 \| 01,835,008 \| -H-- \| M] () -- C:\Documents and Settings\myself\NTUSER.DAT [2009/11/07 09:39:00 \| 00,000,178 \| -HS- \| M] () -- C:\Documents and Settings\myself\ntuser.ini [2009/11/07 09:17:00 \| 00,000,254 \| ---- \| M] () -- C:\WINDOWS\tasks\Check Updates for Windows Live Toolbar.job [2009/11/07 07:59:42 \| 00,528,896 \| ---- \| M] (OldTimer Tools) -- C:\Documents and Settings\myself\Desktop\OTL.exe [2009/11/07 07:54:33 \| 08,500,318 \| -H-- \| M] () -- C:\Documents and Settings\myself\Local Settings\Application Data\IconCache.db [2009/11/07 07:43:36 \| 00,000,696 \| ---- \| M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk [2009/11/07 07:42:42 \| 04,045,528 \| ---- \| M] (Malwarebytes Corporation ) -- C:\Documents and Settings\myself\Desktop\mbam-setup.exe [2009/11/07 07:34:37 \| 00,000,227 \| ---- \| M] () -- C:\WINDOWS\system.ini [2009/11/06 17:42:02 \| 00,000,027 \| ---- \| M] () -- C:\WINDOWS\System32\drivers\etc\hosts [2009/11/06 17:41:22 \| 00,006,456 \| -H-- \| M] () -- C:\WINDOWS\System32\virotimu [2009/11/06 17:33:50 \| 00,000,281 \| RHS- \| M] () -- C:\boot.ini [2009/11/06 17:30:12 \| 03,562,655 \| R--- \| M] () -- C:\Documents and Settings\myself\Desktop\ComboFix.exe [2009/11/06 10:53:52 \| 00,267,264 \| ---- \| M] () -- C:\WINDOWS\PEV.exe [2009/11/04 20:25:15 \| 00,002,257 \| ---- \| M] () -- C:\Documents and Settings\All Users\Desktop\Skype.lnk [2009/11/03 19:37:45 \| 00,055,640 \| ---- \| M] () -- C:\Documents and Settings\myself\Local Settings\Application Data\GDIPFONTCACHEV1.DAT [2009/11/03 19:15:20 \| 04,045,528 \| ---- \| M] (Malwarebytes Corporation ) -- C:\Documents and Settings\myself\Desktop\mbamfusetup.exe [2009/11/02 20:43:23 \| 00,228,000 \| ---- \| M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2009/11/02 20:27:36 \| 00,439,352 \| ---- \| M] () -- C:\WINDOWS\System32\PerfStringBackup.INI [2009/11/02 20:27:36 \| 00,380,918 \| ---- \| M] () -- C:\WINDOWS\System32\perfh009.dat [2009/11/02 20:27:36 \| 00,053,166 \| ---- \| M] () -- C:\WINDOWS\System32\perfc009.dat [2009/10/29 19:16:15 \| 00,049,199 \| ---- \| M] () -- C:\Documents and Settings\myself\Desktop\5280_100983296582194_100000115723023_26401_3351130_n.jpg [2009/10/29 18:07:52 \| 00,605,431 \| ---- \| M] () -- C:\Documents and Settings\myself\Desktop\tis the season.jpg [2009/10/25 06:11:34 \| 00,077,312 \| ---- \| M] () -- C:\WINDOWS\MBR.exe ========== Files Created - No Company Name ========== [2009/11/07 07:43:36 \| 00,000,696 \| ---- \| C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk [2009/11/06 17:33:50 \| 00,000,211 \| ---- \| C] () -- C:\Boot.bak [2009/11/06 17:33:47 \| 00,260,272 \| ---- \| C] () -- C:\cmldr [2009/11/06 17:31:54 \| 00,267,264 \| ---- \| C] () -- C:\WINDOWS\PEV.exe [2009/11/06 17:31:54 \| 00,098,816 \| ---- \| C] () -- C:\WINDOWS\sed.exe [2009/11/06 17:31:54 \| 00,080,412 \| ---- \| C] () -- C:\WINDOWS\grep.exe [2009/11/06 17:31:54 \| 00,077,312 \| ---- \| C] () -- C:\WINDOWS\MBR.exe [2009/11/06 17:31:54 \| 00,068,096 \| ---- \| C] () -- C:\WINDOWS\zip.exe [2009/11/06 17:29:58 \| 03,562,655 \| R--- \| C] () -- C:\Documents and Settings\myself\Desktop\ComboFix.exe [2009/10/29 19:18:45 \| 00,049,199 \| ---- \| C] () -- C:\Documents and Settings\myself\Desktop\5280_100983296582194_100000115723023_26401_3351130_n.jpg [2009/10/29 18:07:47 \| 00,605,431 \| ---- \| C] () -- C:\Documents and Settings\myself\Desktop\tis the season.jpg [2009/10/20 04:42:38 \| 08,500,318 \| -H-- \| C] () -- C:\Documents and Settings\myself\Local Settings\Application Data\IconCache.db [2009/10/20 04:42:38 \| 00,055,640 \| ---- \| C] () -- C:\Documents and Settings\myself\Local Settings\Application Data\GDIPFONTCACHEV1.DAT [2009/10/20 04:42:38 \| 00,000,128 \| ---- \| C] () -- C:\Documents and Settings\myself\Local Settings\Application Data\fusioncache.dat [2009/10/20 04:42:38 \| 00,000,062 \| -HS- \| C] () -- C:\Documents and Settings\myself\Application Data\desktop.ini [2009/10/19 23:19:36 \| 00,000,032 \| ---- \| C] () -- C:\Documents and Settings\All Users\Application Data\ezsid.dat [2009/03/08 02:40:36 \| 00,000,061 \| ---- \| C] () -- C:\WINDOWS\smscfg.ini [2009/03/08 01:44:42 \| 00,200,704 \| ---- \| C] () -- C:\WINDOWS\System32\igfxCoIn_v4704.dll [2008/11/14 18:12:56 \| 00,012,208 \| ---- \| C] () -- C:\WINDOWS\AsTrayLang.ini [2008/08/01 11:37:52 \| 00,005,312 \| ---- \| C] () -- C:\WINDOWS\System32\OEMINFO.INI [2008/08/01 11:37:44 \| 00,000,477 \| ---- \| C] () -- C:\WINDOWS\win.ini [2008/08/01 11:37:43 \| 00,000,227 \| ---- \| C] () -- C:\WINDOWS\system.ini [2008/08/01 04:46:23 \| 00,000,062 \| -HS- \| C] () -- C:\Documents and Settings\All Users\Application Data\desktop.ini [2008/07/30 19:31:52 \| 00,021,864 \| ---- \| C] () -- C:\WINDOWS\AsAcpiSvrLang.ini ========== LOP Check ========== [2009/11/01 02:45:30 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\myself\Application Data\StumbleUpon [2009/11/07 09:17:00 \| 00,000,254 \| ---- \| M] () -- C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job [2008/04/14 07:00:00 \| 00,000,065 \| RH-- \| M] () -- C:\WINDOWS\Tasks\desktop.ini [2009/11/07 09:39:30 \| 00,000,006 \| -H-- \| M] () -- C:\WINDOWS\Tasks\SA.DAT ========== Purity Check ========== < End of report > All processes killed ========== OTL ========== C:\Documents and Settings\myself\Desktop\Silent Runners.vbs moved successfully. C:\Documents and Settings\myself\Desktop\Antivirus System PRO.lnk moved successfully. ========== SERVICES/DRIVERS ========== ========== REGISTRY ========== ========== FILES ========== ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 32768 bytes User: Guest ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 32902 bytes User: myself ->Temp folder emptied: 808285 bytes ->Temporary Internet Files folder emptied: 36950068 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 2577 bytes Windows Temp folder emptied: 483 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 36.07 mb OTL by OldTimer - Version 3.1.4.0 log created on 11072009_093826 Files\Folders moved on Reboot... Registry entries deleted on Reboot... Kaspersky results -------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER 7.0: scan report Saturday, November 7, 2009 Operating system: Microsoft Windows XP Home Edition Service Pack 3 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Last database update: Saturday, November 07, 2009 15:28:29 Records in database: 3171035 -------------------------------------------------------------------------------- Scan settings: scan using the following database: extended Scan archives: yes Scan e-mail databases: yes Scan area - My Computer: C:\ Scan statistics: Objects scanned: 26584 Threats found: 1 Infected objects found: 4 Suspicious objects found: 0 Scan duration: 00:50:09 File name / Threat / Threats count C:\Qoobox\Quarantine\C\WINDOWS\system32\jiyayuda.dll.vir Infected: Packed.Win32.Katusha.g 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\kalahavi.dll.vir Infected: Packed.Win32.Katusha.g 1 C:\System Volume Information\_restore{934F6501-2E50-4F30-B1A3-8F0DF77B68CF}\RP12\A0000621.dll Infected: Packed.Win32.Katusha.g 1 C:\System Volume Information\_restore{934F6501-2E50-4F30-B1A3-8F0DF77B68CF}\RP12\A0000622.dll Infected: Packed.Win32.Katusha.g 1 Selected area has been scanned.

« Next Oldest · Virus, Spyware and Trojan Removal · Next Newest »

2 Pages

1 2 >

1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)

0 Members:

Topic Title	Replies / Views	Topic Information
Windows XP�, 2000, 2003, NT Please Help! windows doesnt work, black screen and mouse! 12	17 / 1,672	17th April 2008 - 12:30 AM chill11 started - last by wannabe1
Virus, Spyware and Trojan Removal Please help! hwyai yuqhu.dll downapup [Closed]	5 / 354	5th February 2009 - 05:48 PM mchavoc started - last by handhfan
Windows XP�, 2000, 2003, NT Please help! Windows shows only background on startup with no icon	2 / 321	9th September 2009 - 07:55 PM tomcruise3230 started - last by rshaffer61
Applications Please help! windows movie maker problem	0 / 84	1st March 2010 - 08:40 AM razmack started - last by razmack