[hrhlaurie]

We try to keep the pc cleaned up and run programs to keep spyware and malware off but something is in here and I don't know what. It was running really well for a couple of months and now it's wonky again.

Here is Hijack this log file and I would delete things but I don't know what I'm looking for! I can't tell what belongs and what doesn't. We're using Bit Defender Antivirus 2008 and I run Adaware every other day or so but still something must be there. Thanks for any help!!

Logfile of HijackThis v1.99.1
Scan saved at 10:25:02 AM, on 1/25/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\slserv.exe
C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\BitDefender\BitDefender 2008\bdagent .exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.emachines.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.c...//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c...rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.c...//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.comcast.n...lbar2.0/search/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.metacrawl.ws
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll
F3 - REG:win.ini: load=C:\WINDOWS\system32\geedd.exe
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll (file missing)
O3 - Toolbar: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~1\COMCAS~1.DLL
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKLM\..\Run: [ddoctorv2] "C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe" /P ddoctorv2
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [LDM] \Program\BackWeb-8876480.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 5.0\resources\en-us\local\search.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll (file missing)
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
O15 - Trusted Zone: http://*.windowsupdate.com
O16 - DPF: {01111F00-3E00-11D2-8470-0060089874ED} (Support.com Installer) - http://supportsoft.a...ad/tgctlins.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg...v45/yacscom.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photos.walmar...martActivia.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace....ploader1005.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symant...ex/symdlmgr.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1126673201234
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {A8683C98-5341-421B-B23C-8514C05354F1} (FujifilmUploader Class) - http://photo.walmart...ploadClient.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://us.dl1.yimg.c...utocomplete.cab
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe" /service (file missing)
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: SupportSoft Sprocket Service (ddoctorv2) (sprtsvc_ddoctorv2) - Unknown owner - C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe" /service /P ddoctorv2 (file missing)
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe" /service (file missing)
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe" /service (file missing)

[Advertisements]

I ran SD Fix in safe mode and here is the log:
SDFix: Version 1.112

Run by Administrator on Fri 01/25/2008 at 11:08 AM

Microsoft Windows XP [Version 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


Normal Mode:
Checking Files:

No Trojan Files Found




Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.



Final Check:

Remaining Services:
------------------



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\\Program Files\\Yahoo!\\Messenger\\YAHOOM~1 .EXE"="C:\\Program Files\\Yahoo!\\Messenger\\YAHOOM~1 .EXE:*:Enabled:Yahoo! Messenger"
"C:\\Program Files\\Yahoo!\\Messenger\\YAHOOM~1 .EXE"="C:\\Program Files\\Yahoo!\\Messenger\\YAHOOM~1 .EXE:*:Enabled:Yahoo! Messenger"
"C:\\Program Files\\Yahoo!\\Messenger\\YAHOOM~1 .EXE"="C:\\Program Files\\Yahoo!\\Messenger\\YAHOOM~1 .EXE:*:Enabled:Yahoo! Messenger"
"C:\\Program Files\\Yahoo!\\Messenger\\YAHOOM~1 .EXE"="C:\\Program Files\\Yahoo!\\Messenger\\YAHOOM~1 .EXE:*:Enabled:Yahoo! Messenger"
"C:\\Program Files\\Yahoo!\\Messenger\\YAHOOM~1 .EXE"="C:\\Program Files\\Yahoo!\\Messenger\\YAHOOM~1 .EXE:*:Enabled:Yahoo! Messenger"
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger .exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger .exe:*:Enabled:Yahoo! Messenger"
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger .exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger .exe:*:Enabled:Yahoo! Messenger"
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger .exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger .exe:*:Enabled:Yahoo! Messenger"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

Remaining Files:
---------------


Files with Hidden Attributes:

Thu 13 Jan 2005 56 ..SHR --- "C:\WINDOWS\system32\F0A1F2B5BE.sys"
Thu 13 Jan 2005 1,682 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys"
Sun 19 Sep 2004 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Thu 4 Oct 2007 20,992 ...H. --- "C:\Documents and Settings\Lovely Laurie\My Documents\~WRL1189.tmp"
Thu 4 Oct 2007 23,552 ...H. --- "C:\Documents and Settings\Lovely Laurie\My Documents\~WRL1542.tmp"
Thu 4 Oct 2007 23,552 ...H. --- "C:\Documents and Settings\Lovely Laurie\My Documents\~WRL2754.tmp"
Thu 4 Oct 2007 23,552 ...H. --- "C:\Documents and Settings\Lovely Laurie\My Documents\~WRL3074.tmp"
Fri 21 May 2004 266 A..H. --- "C:\Program Files\InterActual\InterActual Player\iti7.tmp"
Thu 21 Jun 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Fri 12 Nov 2004 37,376 ...H. --- "C:\Program Files\Common Files\Adobe\ESD\DLMCleanup.exe"
Fri 5 Oct 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\573b8bee2d25ffedabde94732ae6dbae\BIT3.tmp"
Mon 27 Mar 2006 33,792 ...H. --- "C:\Documents and Settings\Lovely Laurie\Application Data\Microsoft\Word\~WRL0005.tmp"
Tue 25 Apr 2006 32,256 ...H. --- "C:\Documents and Settings\Lovely Laurie\Application Data\Microsoft\Word\~WRL0763.tmp"
Tue 25 Apr 2006 33,792 ...H. --- "C:\Documents and Settings\Lovely Laurie\Application Data\Microsoft\Word\~WRL1672.tmp"
Thu 4 Oct 2007 19,968 ...H. --- "C:\Documents and Settings\Lovely Laurie\Application Data\Microsoft\Word\~WRL3166.tmp"
Tue 25 Apr 2006 34,816 ...H. --- "C:\Documents and Settings\Lovely Laurie\Application Data\Microsoft\Word\~WRL3514.tmp"
Thu 4 Oct 2007 20,480 ...H. --- "C:\Documents and Settings\Lovely Laurie\Application Data\Microsoft\Word\~WRL3540.tmp"
Mon 24 Dec 2007 444 ...HR --- "C:\Documents and Settings\Lovely Laurie\Application Data\SecuROM\UserData\securom_v7_01.bak"
Tue 25 Apr 2006 39,936 ...H. --- "C:\Documents and Settings\Lovely Laurie\My Documents\Laurie\Resumes\~WRL0262.tmp"
Mon 27 Mar 2006 32,768 ...H. --- "C:\Documents and Settings\Lovely Laurie\My Documents\Laurie\Resumes\~WRL0648.tmp"
Wed 29 Mar 2006 39,936 ...H. --- "C:\Documents and Settings\Lovely Laurie\My Documents\Laurie\Resumes\~WRL0727.tmp"
Tue 25 Apr 2006 37,888 ...H. --- "C:\Documents and Settings\Lovely Laurie\My Documents\Laurie\Resumes\~WRL0782.tmp"
Mon 27 Mar 2006 32,768 ...H. --- "C:\Documents and Settings\Lovely Laurie\My Documents\Laurie\Resumes\~WRL0961.tmp"
Wed 29 Mar 2006 33,792 ...H. --- "C:\Documents and Settings\Lovely Laurie\My Documents\Laurie\Resumes\~WRL1229.tmp"
Tue 25 Apr 2006 35,328 ...H. --- "C:\Documents and Settings\Lovely Laurie\My Documents\Laurie\Resumes\~WRL1257.tmp"
Wed 29 Mar 2006 34,304 ...H. --- "C:\Documents and Settings\Lovely Laurie\My Documents\Laurie\Resumes\~WRL2260.tmp"
Tue 28 Mar 2006 35,328 ...H. --- "C:\Documents and Settings\Lovely Laurie\My Documents\Laurie\Resumes\~WRL2711.tmp"
Mon 17 Apr 2006 33,792 ...H. --- "C:\Documents and Settings\Lovely Laurie\My Documents\Laurie\Resumes\~WRL2762.tmp"
Tue 25 Apr 2006 38,400 ...H. --- "C:\Documents and Settings\Lovely Laurie\My Documents\Laurie\Resumes\~WRL3339.tmp"
Tue 25 Apr 2006 32,256 ...H. --- "C:\Documents and Settings\Lovely Laurie\My Documents\Laurie\Resumes\~WRL3429.tmp"
Wed 29 Mar 2006 34,304 ...H. --- "C:\Documents and Settings\Lovely Laurie\My Documents\Laurie\Resumes\~WRL3643.tmp"
Wed 29 Mar 2006 21,504 ...H. --- "C:\Documents and Settings\Lovely Laurie\My Documents\Laurie\Resumes\~WRL3835.tmp"
Mon 10 Dec 2007 444 ...HR --- "C:\Documents and Settings\Owner\Application Data\SecuROM\UserData\securom_v7_01.bak"
Mon 17 Dec 2007 444 A..HR --- "C:\Documents and Settings\Lovely Laurie\Cookies\Application Data\SecuROM\UserData\securom_v7_01.bak"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Lovely Laurie\Local Settings\Application Data\SupportSoft\ddoctorv2\Lovely Laurie\data\sprt_articlefaq\BIT651.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Lovely Laurie\Local Settings\Application Data\SupportSoft\ddoctorv2\Lovely Laurie\data\sprt_articlefaq\BIT653.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Lovely Laurie\Local Settings\Application Data\SupportSoft\ddoctorv2\Lovely Laurie\data\sprt_articlefaq\BIT654.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Lovely Laurie\Local Settings\Application Data\SupportSoft\ddoctorv2\Lovely Laurie\data\sprt_articlefaq\BIT655.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Lovely Laurie\Local Settings\Application Data\SupportSoft\ddoctorv2\Lovely Laurie\data\sprt_articlefaq\BIT657.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Lovely Laurie\Local Settings\Application Data\SupportSoft\ddoctorv2\Lovely Laurie\data\sprt_articlefaq\BIT65D.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Lovely Laurie\Local Settings\Application Data\SupportSoft\ddoctorv2\Lovely Laurie\data\sprt_articlefaq\BIT65E.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Lovely Laurie\Local Settings\Application Data\SupportSoft\ddoctorv2\Lovely Laurie\data\sprt_protection\BIT652.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Lovely Laurie\Local Settings\Application Data\SupportSoft\ddoctorv2\Lovely Laurie\data\sprt_protection\BIT656.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Lovely Laurie\Local Settings\Application Data\SupportSoft\ddoctorv2\Lovely Laurie\data\sprt_protection\BIT658.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Lovely Laurie\Local Settings\Application Data\SupportSoft\ddoctorv2\Lovely Laurie\data\sprt_protection\BIT659.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Lovely Laurie\Local Settings\Application Data\SupportSoft\ddoctorv2\Lovely Laurie\data\sprt_protection\BIT65C.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Lovely Laurie\Local Settings\Application Data\SupportSoft\ddoctorv2\Lovely Laurie\data\sprt_protection\BIT65F.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Lovely Laurie\Local Settings\Application Data\SupportSoft\ddoctorv2\Lovely Laurie\data\sprt_trigger\BIT65A.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Lovely Laurie\Local Settings\Application Data\SupportSoft\ddoctorv2\Lovely Laurie\data\sprt_trigger\BIT65B.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Owner\Local Settings\Application Data\SupportSoft\ddoctorv2\Owner\data\sprt_articlefaq\BIT1F9.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Owner\Local Settings\Application Data\SupportSoft\ddoctorv2\Owner\data\sprt_articlefaq\BIT1FA.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Owner\Local Settings\Application Data\SupportSoft\ddoctorv2\Owner\data\sprt_articlefaq\BIT1FB.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Owner\Local Settings\Application Data\SupportSoft\ddoctorv2\Owner\data\sprt_articlefaq\BIT1FD.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Owner\Local Settings\Application Data\SupportSoft\ddoctorv2\Owner\data\sprt_articlefaq\BIT1FE.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Owner\Local Settings\Application Data\SupportSoft\ddoctorv2\Owner\data\sprt_articlefaq\BIT1FF.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Owner\Local Settings\Application Data\SupportSoft\ddoctorv2\Owner\data\sprt_articlefaq\BIT201.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Owner\Local Settings\Application Data\SupportSoft\ddoctorv2\Owner\data\sprt_articlefaq\BIT207.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Owner\Local Settings\Application Data\SupportSoft\ddoctorv2\Owner\data\sprt_articlefaq\BIT208.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Owner\Local Settings\Application Data\SupportSoft\ddoctorv2\Owner\data\sprt_protection\BIT1FC.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Owner\Local Settings\Application Data\SupportSoft\ddoctorv2\Owner\data\sprt_protection\BIT200.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Owner\Local Settings\Application Data\SupportSoft\ddoctorv2\Owner\data\sprt_protection\BIT202.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Owner\Local Settings\Application Data\SupportSoft\ddoctorv2\Owner\data\sprt_protection\BIT203.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Owner\Local Settings\Application Data\SupportSoft\ddoctorv2\Owner\data\sprt_protection\BIT206.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Owner\Local Settings\Application Data\SupportSoft\ddoctorv2\Owner\data\sprt_protection\BIT209.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Owner\Local Settings\Application Data\SupportSoft\ddoctorv2\Owner\data\sprt_trigger\BIT204.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Owner\Local Settings\Application Data\SupportSoft\ddoctorv2\Owner\data\sprt_trigger\BIT205.tmp"

Finished!

[hrhlaurie]

I ran SD Fix in safe mode and here is the log:
SDFix: Version 1.112

Run by Administrator on Fri 01/25/2008 at 11:08 AM

Microsoft Windows XP [Version 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


Normal Mode:
Checking Files:

No Trojan Files Found




Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.



Final Check:

Remaining Services:
------------------



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\\Program Files\\Yahoo!\\Messenger\\YAHOOM~1 .EXE"="C:\\Program Files\\Yahoo!\\Messenger\\YAHOOM~1 .EXE:*:Enabled:Yahoo! Messenger"
"C:\\Program Files\\Yahoo!\\Messenger\\YAHOOM~1 .EXE"="C:\\Program Files\\Yahoo!\\Messenger\\YAHOOM~1 .EXE:*:Enabled:Yahoo! Messenger"
"C:\\Program Files\\Yahoo!\\Messenger\\YAHOOM~1 .EXE"="C:\\Program Files\\Yahoo!\\Messenger\\YAHOOM~1 .EXE:*:Enabled:Yahoo! Messenger"
"C:\\Program Files\\Yahoo!\\Messenger\\YAHOOM~1 .EXE"="C:\\Program Files\\Yahoo!\\Messenger\\YAHOOM~1 .EXE:*:Enabled:Yahoo! Messenger"
"C:\\Program Files\\Yahoo!\\Messenger\\YAHOOM~1 .EXE"="C:\\Program Files\\Yahoo!\\Messenger\\YAHOOM~1 .EXE:*:Enabled:Yahoo! Messenger"
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger .exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger .exe:*:Enabled:Yahoo! Messenger"
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger .exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger .exe:*:Enabled:Yahoo! Messenger"
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger .exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger .exe:*:Enabled:Yahoo! Messenger"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

Remaining Files:
---------------


Files with Hidden Attributes:

Thu 13 Jan 2005 56 ..SHR --- "C:\WINDOWS\system32\F0A1F2B5BE.sys"
Thu 13 Jan 2005 1,682 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys"
Sun 19 Sep 2004 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Thu 4 Oct 2007 20,992 ...H. --- "C:\Documents and Settings\Lovely Laurie\My Documents\~WRL1189.tmp"
Thu 4 Oct 2007 23,552 ...H. --- "C:\Documents and Settings\Lovely Laurie\My Documents\~WRL1542.tmp"
Thu 4 Oct 2007 23,552 ...H. --- "C:\Documents and Settings\Lovely Laurie\My Documents\~WRL2754.tmp"
Thu 4 Oct 2007 23,552 ...H. --- "C:\Documents and Settings\Lovely Laurie\My Documents\~WRL3074.tmp"
Fri 21 May 2004 266 A..H. --- "C:\Program Files\InterActual\InterActual Player\iti7.tmp"
Thu 21 Jun 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Fri 12 Nov 2004 37,376 ...H. --- "C:\Program Files\Common Files\Adobe\ESD\DLMCleanup.exe"
Fri 5 Oct 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\573b8bee2d25ffedabde94732ae6dbae\BIT3.tmp"
Mon 27 Mar 2006 33,792 ...H. --- "C:\Documents and Settings\Lovely Laurie\Application Data\Microsoft\Word\~WRL0005.tmp"
Tue 25 Apr 2006 32,256 ...H. --- "C:\Documents and Settings\Lovely Laurie\Application Data\Microsoft\Word\~WRL0763.tmp"
Tue 25 Apr 2006 33,792 ...H. --- "C:\Documents and Settings\Lovely Laurie\Application Data\Microsoft\Word\~WRL1672.tmp"
Thu 4 Oct 2007 19,968 ...H. --- "C:\Documents and Settings\Lovely Laurie\Application Data\Microsoft\Word\~WRL3166.tmp"
Tue 25 Apr 2006 34,816 ...H. --- "C:\Documents and Settings\Lovely Laurie\Application Data\Microsoft\Word\~WRL3514.tmp"
Thu 4 Oct 2007 20,480 ...H. --- "C:\Documents and Settings\Lovely Laurie\Application Data\Microsoft\Word\~WRL3540.tmp"
Mon 24 Dec 2007 444 ...HR --- "C:\Documents and Settings\Lovely Laurie\Application Data\SecuROM\UserData\securom_v7_01.bak"
Tue 25 Apr 2006 39,936 ...H. --- "C:\Documents and Settings\Lovely Laurie\My Documents\Laurie\Resumes\~WRL0262.tmp"
Mon 27 Mar 2006 32,768 ...H. --- "C:\Documents and Settings\Lovely Laurie\My Documents\Laurie\Resumes\~WRL0648.tmp"
Wed 29 Mar 2006 39,936 ...H. --- "C:\Documents and Settings\Lovely Laurie\My Documents\Laurie\Resumes\~WRL0727.tmp"
Tue 25 Apr 2006 37,888 ...H. --- "C:\Documents and Settings\Lovely Laurie\My Documents\Laurie\Resumes\~WRL0782.tmp"
Mon 27 Mar 2006 32,768 ...H. --- "C:\Documents and Settings\Lovely Laurie\My Documents\Laurie\Resumes\~WRL0961.tmp"
Wed 29 Mar 2006 33,792 ...H. --- "C:\Documents and Settings\Lovely Laurie\My Documents\Laurie\Resumes\~WRL1229.tmp"
Tue 25 Apr 2006 35,328 ...H. --- "C:\Documents and Settings\Lovely Laurie\My Documents\Laurie\Resumes\~WRL1257.tmp"
Wed 29 Mar 2006 34,304 ...H. --- "C:\Documents and Settings\Lovely Laurie\My Documents\Laurie\Resumes\~WRL2260.tmp"
Tue 28 Mar 2006 35,328 ...H. --- "C:\Documents and Settings\Lovely Laurie\My Documents\Laurie\Resumes\~WRL2711.tmp"
Mon 17 Apr 2006 33,792 ...H. --- "C:\Documents and Settings\Lovely Laurie\My Documents\Laurie\Resumes\~WRL2762.tmp"
Tue 25 Apr 2006 38,400 ...H. --- "C:\Documents and Settings\Lovely Laurie\My Documents\Laurie\Resumes\~WRL3339.tmp"
Tue 25 Apr 2006 32,256 ...H. --- "C:\Documents and Settings\Lovely Laurie\My Documents\Laurie\Resumes\~WRL3429.tmp"
Wed 29 Mar 2006 34,304 ...H. --- "C:\Documents and Settings\Lovely Laurie\My Documents\Laurie\Resumes\~WRL3643.tmp"
Wed 29 Mar 2006 21,504 ...H. --- "C:\Documents and Settings\Lovely Laurie\My Documents\Laurie\Resumes\~WRL3835.tmp"
Mon 10 Dec 2007 444 ...HR --- "C:\Documents and Settings\Owner\Application Data\SecuROM\UserData\securom_v7_01.bak"
Mon 17 Dec 2007 444 A..HR --- "C:\Documents and Settings\Lovely Laurie\Cookies\Application Data\SecuROM\UserData\securom_v7_01.bak"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Lovely Laurie\Local Settings\Application Data\SupportSoft\ddoctorv2\Lovely Laurie\data\sprt_articlefaq\BIT651.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Lovely Laurie\Local Settings\Application Data\SupportSoft\ddoctorv2\Lovely Laurie\data\sprt_articlefaq\BIT653.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Lovely Laurie\Local Settings\Application Data\SupportSoft\ddoctorv2\Lovely Laurie\data\sprt_articlefaq\BIT654.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Lovely Laurie\Local Settings\Application Data\SupportSoft\ddoctorv2\Lovely Laurie\data\sprt_articlefaq\BIT655.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Lovely Laurie\Local Settings\Application Data\SupportSoft\ddoctorv2\Lovely Laurie\data\sprt_articlefaq\BIT657.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Lovely Laurie\Local Settings\Application Data\SupportSoft\ddoctorv2\Lovely Laurie\data\sprt_articlefaq\BIT65D.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Lovely Laurie\Local Settings\Application Data\SupportSoft\ddoctorv2\Lovely Laurie\data\sprt_articlefaq\BIT65E.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Lovely Laurie\Local Settings\Application Data\SupportSoft\ddoctorv2\Lovely Laurie\data\sprt_protection\BIT652.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Lovely Laurie\Local Settings\Application Data\SupportSoft\ddoctorv2\Lovely Laurie\data\sprt_protection\BIT656.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Lovely Laurie\Local Settings\Application Data\SupportSoft\ddoctorv2\Lovely Laurie\data\sprt_protection\BIT658.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Lovely Laurie\Local Settings\Application Data\SupportSoft\ddoctorv2\Lovely Laurie\data\sprt_protection\BIT659.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Lovely Laurie\Local Settings\Application Data\SupportSoft\ddoctorv2\Lovely Laurie\data\sprt_protection\BIT65C.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Lovely Laurie\Local Settings\Application Data\SupportSoft\ddoctorv2\Lovely Laurie\data\sprt_protection\BIT65F.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Lovely Laurie\Local Settings\Application Data\SupportSoft\ddoctorv2\Lovely Laurie\data\sprt_trigger\BIT65A.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Lovely Laurie\Local Settings\Application Data\SupportSoft\ddoctorv2\Lovely Laurie\data\sprt_trigger\BIT65B.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Owner\Local Settings\Application Data\SupportSoft\ddoctorv2\Owner\data\sprt_articlefaq\BIT1F9.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Owner\Local Settings\Application Data\SupportSoft\ddoctorv2\Owner\data\sprt_articlefaq\BIT1FA.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Owner\Local Settings\Application Data\SupportSoft\ddoctorv2\Owner\data\sprt_articlefaq\BIT1FB.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Owner\Local Settings\Application Data\SupportSoft\ddoctorv2\Owner\data\sprt_articlefaq\BIT1FD.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Owner\Local Settings\Application Data\SupportSoft\ddoctorv2\Owner\data\sprt_articlefaq\BIT1FE.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Owner\Local Settings\Application Data\SupportSoft\ddoctorv2\Owner\data\sprt_articlefaq\BIT1FF.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Owner\Local Settings\Application Data\SupportSoft\ddoctorv2\Owner\data\sprt_articlefaq\BIT201.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Owner\Local Settings\Application Data\SupportSoft\ddoctorv2\Owner\data\sprt_articlefaq\BIT207.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Owner\Local Settings\Application Data\SupportSoft\ddoctorv2\Owner\data\sprt_articlefaq\BIT208.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Owner\Local Settings\Application Data\SupportSoft\ddoctorv2\Owner\data\sprt_protection\BIT1FC.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Owner\Local Settings\Application Data\SupportSoft\ddoctorv2\Owner\data\sprt_protection\BIT200.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Owner\Local Settings\Application Data\SupportSoft\ddoctorv2\Owner\data\sprt_protection\BIT202.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Owner\Local Settings\Application Data\SupportSoft\ddoctorv2\Owner\data\sprt_protection\BIT203.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Owner\Local Settings\Application Data\SupportSoft\ddoctorv2\Owner\data\sprt_protection\BIT206.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Owner\Local Settings\Application Data\SupportSoft\ddoctorv2\Owner\data\sprt_protection\BIT209.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Owner\Local Settings\Application Data\SupportSoft\ddoctorv2\Owner\data\sprt_trigger\BIT204.tmp"
Thu 17 Jan 2008 0 A..H. --- "C:\Documents and Settings\Owner\Local Settings\Application Data\SupportSoft\ddoctorv2\Owner\data\sprt_trigger\BIT205.tmp"

Finished!

[hrhlaurie]

Another program run in safe mode -
SmitFraudFix v2.274

Scan done at 11:34:09.54, Fri 01/25/2008
Run from C:\Documents and Settings\Lovely Laurie\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» hosts

127.0.0.1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files


»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix.exe by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» DNS



»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End

AVG anti-spyware won't load or run properly.

Edited by hrhlaurie, 25 January 2008 - 04:27 PM.

[hrhlaurie]

When we re-booted (which we have to do 20 times a day), we got two error messages:

The first referenced c:\windows\system32\geedd.exe and said it cannot access it and we may not have permission.

The second error said it could not load or run spec. (can't read my own notes, sorry) on the registry and to make sure the file exists or remove it.

I'm sure geedd is no good and wonder if I can remove it using Hijack this but how to I prevent these things from coming back when I re-boot?

Since I couldn't get AVG to work I was going to try something called nod32 that I saw recommended somewhere but it says I'd have to uninstall Bit Defender and I hate to uninstall something we paid for to get something on a 30 day trial so I'll wait to see what you recommend. I just try everything but this stuff keeps coming back! Is there any way to prevent it for good?

Thanks!

Edited by hrhlaurie, 25 January 2008 - 04:28 PM.