[OPERATOR]

OS is windows 2003 professional
I am trying to help a friend, her computer is bad infected, one of the big problems is, Alexa tool bar, when I boot up the computer, IE tries to go to an Alexa survey, I went to add and remove programs to try to uninstall the tool bar, which is listed. I have the HJT log here, I also installed AVG anti_spyware and it detected Alexa but it did not apparently remove it. I would appreciate any advice or hel you could give me. also be advised I cannot boot to safe mode. not has of yesterday.
Operator

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:45:25 AM, on 2/7/2008
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINNT\system32\perfs.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\routing.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\config\sy.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\SYSTEM32\3cmlink.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINNT\SYSTEM32\3cshtdwn.exe
C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
C:\WINNT\SYSTEM32\3cmlink.exe
C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtWLan.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c...rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://mirs.peoplepc...ername=PeoplePC Accelerated&userName=nicholejohnson&firstName=Geraldine&qs=DBKIPFMOPMCOMINAPCMEKDHAIHMEOKDJAIHFLENFMCBIFJJJIJMODFLMKANKCPEACLICKGGKE
LCCLPPIGKIKPIFFMHKICGHOIAMGLCPLECFFLOAFPKNHCACFDBNFLFHN|PCLNMHBHDGNMCNOPADEEAAGOB
A
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c...rch/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.c...//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - URLSearchHook: p1r Toolbar - {50eb370f-d1e4-4901-9868-40089ecf205e} - C:\Program Files\p1r\tbp1r.dll
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: p1r Toolbar - {50eb370f-d1e4-4901-9868-40089ecf205e} - C:\Program Files\p1r\tbp1r.dll
O2 - BHO: Popup-Blocker Class - {52706EF7-D7A2-49AD-A615-E903858CF284} - C:\Program Files\NetZero\qsacc\X1IEBHO.dll (file missing)
O2 - BHO: Accelerator Plugin - {656EC4B7-072B-4698-B504-2A414C1F0037} - C:\PROGRA~1\PEOPLE~1\PRPL_I~1.DLL (file missing)
O2 - BHO: AlxTB BHO - {F1FABE79-25FC-46de-8C5A-2C6DB9D64333} - C:\WINNT\system32\AlxTB1.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: ZeroBar - {F0F8ECBE-D460-4B34-B007-56A92E8F84A7} - C:\Program Files\NetZero\Toolbar.dll (file missing)
O3 - Toolbar: p1r Toolbar - {50eb370f-d1e4-4901-9868-40089ecf205e} - C:\Program Files\p1r\tbp1r.dll
O3 - Toolbar: Alexa - {3CEFF6CD-6F08-4e4d-BCCD-FF7415288C3B} - C:\WINNT\system32\SHDOCVW.DLL
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [3c1807pd] C:\WINNT\SYSTEM32\3cmlink.exe RunServices \Device\3cpipe-3c1807pd
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [NetZero_uoltray] C:\Program Files\NetZero\exec.exe regrun
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - Global Startup: WG111v2 Smart Wizard Wireless Setting.lnk = C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe
O8 - Extra context menu item: &Search - http://edits.mywebse...?p=ZUxdm486YYUS
O8 - Extra context menu item: Display All Images with Full Quality - "res://C:\Program Files\NetZero\qsacc\appres.dll/228"
O8 - Extra context menu item: Display Image with Full Quality - "res://C:\Program Files\NetZero\qsacc\appres.dll/227"
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll
O14 - IERESET.INF: START_PAGE_URL=http://mirs.peoplepc.com/?offername=PeoplePC Accelerated&userName=nicholejohnson&firstName=Geraldine&qs=DBKIPFMOPMCOMINAPCMEKDHAIHMEOKDJAIHFLENFMCBIFJJJIJMODFLMKANKCPEACLICKGGKE
LCCLPPIGKIKPIFFMHKICGHOIAMGLCPLECFFLOAFPKNHCACFDBNFLFHN|PCLNMHBHDGNMCNOPADEEAAGOB
A
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfar...p1.0.0.15-3.cab
O16 - DPF: {4CCA4E80-9259-11D9-AC6E-444553544200} (FixController Control) - http://h30155.www3.h...llMgr_v01_6.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.mi...b?1191386554713
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.mi...b?1197522882258
O23 - Service: Alretoer - Unknown owner - C:\alexamw.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: perfmons Service (perfmons) - Unknown owner - C:\WINNT\system32\perfs.exe
O23 - Service: Routing Service (Routing) - Unknown owner - C:\WINNT\system32\routing.exe
O23 - Service: Snake SockProxy Service (SkServer) - noname. http://snake.gnuchina.org - C:\WINNT\system32\config\sy.exe
O23 - Service: sylreto - Unknown owner - C:\242.exe (file missing)
O23 - Service: sylretoer - Unknown owner - C:\pro.exe (file missing)

--
End of file - 7522 bytes

[Advertisements]

Ok then lets get this show on the road and see about giving you some help. This is a long fix so I would recommend copying to a text file for reference

@echo off
sc stop Alretoer
sc delete Alretoer
sc stop perfmons
sc delete perfmons
sc stop Routing
sc delete Routing
sc stop sylreto
sc delete sylreto
sc stop sylretoer
sc delete sylretoer
sc stop SkServer
sc delete SkServer
exit

First you will need to create the batch fix to do that copy and paste ALL of the above in the quote box to a notepad file.
Then in the text file go to FILE > SAVE AS and in the dropdown box select SAVE AS TYPE to ALL FILES
Then in the FILE NAME box type fix.bat

This will create a batch file

Then run fix.bat by double clicking you may see a black box appear this is normal

NEXT

Please re-open HiJackThis and scan. Check the boxes next to all the entries listed below.

R3 - URLSearchHook: p1r Toolbar - {50eb370f-d1e4-4901-9868-40089ecf205e} - C:\Program Files\p1r\tbp1r.dll
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: p1r Toolbar - {50eb370f-d1e4-4901-9868-40089ecf205e} - C:\Program Files\p1r\tbp1r.dll
O2 - BHO: AlxTB BHO - {F1FABE79-25FC-46de-8C5A-2C6DB9D64333} - C:\WINNT\system32\AlxTB1.dll
O3 - Toolbar: p1r Toolbar - {50eb370f-d1e4-4901-9868-40089ecf205e} - C:\Program Files\p1r\tbp1r.dll
O3 - Toolbar: Alexa - {3CEFF6CD-6F08-4e4d-BCCD-FF7415288C3B} - C:\WINNT\system32\SHDOCVW.DLL
O8 - Extra context menu item: &Search - http://edits.mywebse...?p=ZUxdm486YYUS
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfar...p1.0.0.15-3.cab
O23 - Service: Alretoer - Unknown owner - C:\alexamw.exe
O23 - Service: perfmons Service (perfmons) - Unknown owner - C:\WINNT\system32\perfs.exe
O23 - Service: Routing Service (Routing) - Unknown owner - C:\WINNT\system32\routing.exe
O23 - Service: sylreto - Unknown owner - C:\242.exe (file missing)
O23 - Service: sylretoer - Unknown owner - C:\pro.exe (file missing)
O23 - Service: Snake SockProxy Service (SkServer) - noname. http://snake.gnuchina.org - C:\WINNT\system32\config\sy.exe


Now close all windows other than HiJackThis, then click Fix Checked. Close HiJackThis.

NEXT

Please download the OTMoveIt2 by OldTimer.

• Save it to your desktop.
• Please double-click OTMoveIt2.exe to run it.
• Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  

  C:\Program Files\p1r
  C:\WINNT\system32\AlxTB1.dll
  C:\alexamw.exe
  C:\WINNT\system32\perfs.exe
  C:\WINNT\system32\routing.exe
  C:\242.exe 
  C:\pro.exe
  C:\WINNT\system32\config\sy.exe

• Return to OTMoveIt2, right click in the "Paste List of Files/Folders to be Moved" window (under the light blue bar) and choose Paste.
  
• Click the red Moveit! button.
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
• Close OTMoveIt2

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

FINALLY FOR NOW

Download ComboFix from Here or Here to your Desktop.

• Double click combofix.exe and follow the prompts.
• When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply

Note: Do not mouseclick combofix's window while its running. That may cause it to stall

Logs required : OTMoveit and Combofix

[Essexboy]

Ok then lets get this show on the road and see about giving you some help. This is a long fix so I would recommend copying to a text file for reference

@echo off
sc stop Alretoer
sc delete Alretoer
sc stop perfmons
sc delete perfmons
sc stop Routing
sc delete Routing
sc stop sylreto
sc delete sylreto
sc stop sylretoer
sc delete sylretoer
sc stop SkServer
sc delete SkServer
exit

First you will need to create the batch fix to do that copy and paste ALL of the above in the quote box to a notepad file.
Then in the text file go to FILE > SAVE AS and in the dropdown box select SAVE AS TYPE to ALL FILES
Then in the FILE NAME box type fix.bat

This will create a batch file

Then run fix.bat by double clicking you may see a black box appear this is normal

NEXT

Please re-open HiJackThis and scan. Check the boxes next to all the entries listed below.

R3 - URLSearchHook: p1r Toolbar - {50eb370f-d1e4-4901-9868-40089ecf205e} - C:\Program Files\p1r\tbp1r.dll
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: p1r Toolbar - {50eb370f-d1e4-4901-9868-40089ecf205e} - C:\Program Files\p1r\tbp1r.dll
O2 - BHO: AlxTB BHO - {F1FABE79-25FC-46de-8C5A-2C6DB9D64333} - C:\WINNT\system32\AlxTB1.dll
O3 - Toolbar: p1r Toolbar - {50eb370f-d1e4-4901-9868-40089ecf205e} - C:\Program Files\p1r\tbp1r.dll
O3 - Toolbar: Alexa - {3CEFF6CD-6F08-4e4d-BCCD-FF7415288C3B} - C:\WINNT\system32\SHDOCVW.DLL
O8 - Extra context menu item: &Search - http://edits.mywebse...?p=ZUxdm486YYUS
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfar...p1.0.0.15-3.cab
O23 - Service: Alretoer - Unknown owner - C:\alexamw.exe
O23 - Service: perfmons Service (perfmons) - Unknown owner - C:\WINNT\system32\perfs.exe
O23 - Service: Routing Service (Routing) - Unknown owner - C:\WINNT\system32\routing.exe
O23 - Service: sylreto - Unknown owner - C:\242.exe (file missing)
O23 - Service: sylretoer - Unknown owner - C:\pro.exe (file missing)
O23 - Service: Snake SockProxy Service (SkServer) - noname. http://snake.gnuchina.org - C:\WINNT\system32\config\sy.exe


Now close all windows other than HiJackThis, then click Fix Checked. Close HiJackThis.

NEXT

Please download the OTMoveIt2 by OldTimer.

• Save it to your desktop.
• Please double-click OTMoveIt2.exe to run it.
• Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  

  C:\Program Files\p1r
  C:\WINNT\system32\AlxTB1.dll
  C:\alexamw.exe
  C:\WINNT\system32\perfs.exe
  C:\WINNT\system32\routing.exe
  C:\242.exe 
  C:\pro.exe
  C:\WINNT\system32\config\sy.exe

• Return to OTMoveIt2, right click in the "Paste List of Files/Folders to be Moved" window (under the light blue bar) and choose Paste.
  
• Click the red Moveit! button.
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
• Close OTMoveIt2

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

FINALLY FOR NOW

Download ComboFix from Here or Here to your Desktop.

• Double click combofix.exe and follow the prompts.
• When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply

Note: Do not mouseclick combofix's window while its running. That may cause it to stall

Logs required : OTMoveit and Combofix

[OPERATOR]

Ok then lets get this show on the road and see about giving you some help. This is a long fix so I would recommend copying to a text file for reference

@echo off
sc stop Alretoer
sc delete Alretoer
sc stop perfmons
sc delete perfmons
sc stop Routing
sc delete Routing
sc stop sylreto
sc delete sylreto
sc stop sylretoer
sc delete sylretoer
sc stop SkServer
sc delete SkServer
exit

First you will need to create the batch fix to do that copy and paste ALL of the above in the quote box to a notepad file.
Then in the text file go to FILE > SAVE AS and in the dropdown box select SAVE AS TYPE to ALL FILES
Then in the FILE NAME box type fix.bat

This will create a batch file

Then run fix.bat by double clicking you may see a black box appear this is normal

NEXT

Please re-open HiJackThis and scan. Check the boxes next to all the entries listed below.

R3 - URLSearchHook: p1r Toolbar - {50eb370f-d1e4-4901-9868-40089ecf205e} - C:\Program Files\p1r\tbp1r.dll
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: p1r Toolbar - {50eb370f-d1e4-4901-9868-40089ecf205e} - C:\Program Files\p1r\tbp1r.dll
O2 - BHO: AlxTB BHO - {F1FABE79-25FC-46de-8C5A-2C6DB9D64333} - C:\WINNT\system32\AlxTB1.dll
O3 - Toolbar: p1r Toolbar - {50eb370f-d1e4-4901-9868-40089ecf205e} - C:\Program Files\p1r\tbp1r.dll
O3 - Toolbar: Alexa - {3CEFF6CD-6F08-4e4d-BCCD-FF7415288C3B} - C:\WINNT\system32\SHDOCVW.DLL
O8 - Extra context menu item: &Search - http://edits.mywebse...?p=ZUxdm486YYUS
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfar...p1.0.0.15-3.cab
O23 - Service: Alretoer - Unknown owner - C:\alexamw.exe
O23 - Service: perfmons Service (perfmons) - Unknown owner - C:\WINNT\system32\perfs.exe
O23 - Service: Routing Service (Routing) - Unknown owner - C:\WINNT\system32\routing.exe
O23 - Service: sylreto - Unknown owner - C:\242.exe (file missing)
O23 - Service: sylretoer - Unknown owner - C:\pro.exe (file missing)
O23 - Service: Snake SockProxy Service (SkServer) - noname. http://snake.gnuchina.org - C:\WINNT\system32\config\sy.exe


Now close all windows other than HiJackThis, then click Fix Checked. Close HiJackThis.

NEXT

Please download the OTMoveIt2 by OldTimer.

• Save it to your desktop.
• Please double-click OTMoveIt2.exe to run it.
• Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  

  C:\Program Files\p1r
  C:\WINNT\system32\AlxTB1.dll
  C:\alexamw.exe
  C:\WINNT\system32\perfs.exe
  C:\WINNT\system32\routing.exe
  C:\242.exe 
  C:\pro.exe
  C:\WINNT\system32\config\sy.exe

• Return to OTMoveIt2, right click in the "Paste List of Files/Folders to be Moved" window (under the light blue bar) and choose Paste.
  
• Click the red Moveit! button.
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
• Close OTMoveIt2

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

FINALLY FOR NOW

Download ComboFix from Here or Here to your Desktop.

• Double click combofix.exe and follow the prompts.
• When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply

Note: Do not mouseclick combofix's window while its running. That may cause it to stall

Logs required : OTMoveit and Combofix

[Essexboy]

Did you do the fix

[OPERATOR]

Sorry It has taken so long, here are the logs of the fixes that you requested for me to do, Thank you for taking the time to help me.

C:\Program Files\p1r moved successfully.
File/Folder C:\WINNT\system32\AlxTB1.dll not found.
C:\alexamw.exe moved successfully.
File/Folder C:\WINNT\system32\perfs.exe not found.
File/Folder C:\WINNT\system32\routing.exe not found.
File/Folder C:\242.exe not found.
File/Folder C:\pro.exe not found.
C:\WINNT\system32\config\sy.exe moved successfully.

OTMoveIt2 v1.0.19 log created on 02092008_144925



ComboFix 08-02.05.3 - Administrator 02/09/2008 14:56:44.1 - FAT32x86
Microsoft Windows 2000 Professional 5.0.2195.4.1252.1.1033.18.199 [GMT -8:00]
Running from: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\689LB671\ComboFix[1].exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\Program Files\alexa toolbar
C:\Program Files\alexa toolbar\uninstall.exe
C:\Program Files\FunWebProducts
C:\Program Files\FunWebProducts\Shared\000CC3F0.dat
C:\Program Files\MalwareCrush
C:\Program Files\myglobalsearch
C:\Program Files\myglobalsearch\bar\History\search
C:\WINNT\system32\alxres.dll
C:\WINNT\system32\drivers\npf.sys
C:\WINNT\system32\Packet.dll
C:\WINNT\system32\WanPacket.dll
C:\WINNT\system32\Wpcap.dll
C:\WINNT\Web\default.htt

----- BITS: Possible infected sites -----

hxxp://www.download.windowsupdate.com

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_NPF
-------\nm
-------\NPF


((((((((((((((((((((((((( Files Created from 2008-01-09 to 2008-02-09 )))))))))))))))))))))))))))))))
.

2008-02-09 14:49 . 08-02-09 14:49 <DIR> d-------- C:\_OTMoveIt
2008-02-09 11:41 . 08-02-09 11:41 23,600 --a------ C:\WINNT\system32\drivers\tvichw32.sys
2008-02-09 10:14 . 08-02-09 10:14 <DIR> dr-h----- C:\$VAULT$.AVG
2008-02-09 10:10 . 08-02-09 10:10 <DIR> d-------- C:\Documents and Settings\Default User\Application Data\AVG7
2008-02-09 10:10 . 08-02-09 10:10 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\AVG7
2008-02-09 10:09 . 08-02-09 10:09 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg7
2008-02-09 10:09 . 08-02-09 10:09 26,944 --a------ C:\WINNT\system32\drivers\avg7rsnt.sys
2008-02-07 09:45 . 08-02-07 09:45 <DIR> d-------- C:\Program Files\Trend Micro
2008-02-07 06:51 . 08-02-07 06:51 <DIR> d-------- C:\Program Files\Common Files\Adaptec Shared
2008-02-07 06:51 . 08-02-07 06:51 49,152 --a------ C:\WINNT\system32\cdrtc.dll
2008-02-07 06:51 . 08-02-07 06:51 45,056 --a------ C:\WINNT\system32\cdral.dll
2008-02-07 06:51 . 08-02-09 09:48 44,288 --a------ C:\WINNT\system32\drivers\cdr4_2K.sys
2008-02-07 06:51 . 08-02-07 06:51 23,420 --a------ C:\WINNT\system32\drivers\cdralw2k.sys
2008-02-07 06:35 . 08-02-07 06:35 <DIR> d-------- C:\Program Files\CCleaner
2008-02-06 21:50 . 08-02-06 21:50 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Grisoft
2008-02-06 21:49 . 08-02-06 21:49 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-02-06 21:49 . 07-05-30 04:10 10,872 --a------ C:\WINNT\system32\drivers\AvgAsCln.sys
2008-02-06 19:27 . 08-02-06 19:27 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Yahoo!
2008-02-06 18:19 . 08-02-06 18:19 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\TEMP
2008-02-06 18:18 . 08-02-06 18:18 <DIR> d-------- C:\Program Files\Spyware Doctor
2008-02-06 18:18 . 02-05-15 16:16 462,848 --a------ C:\WINNT\system32\msaatext.dll
2008-02-06 18:18 . 02-05-15 16:16 360,448 --a------ C:\WINNT\system32\oleacc.dll
2008-02-06 18:18 . 02-05-15 16:16 356,352 --a------ C:\WINNT\system32\oleaccrc.dll
2008-02-06 18:11 . 08-02-06 18:11 <DIR> d-------- C:\Documents and Settings\Default User\Application Data\Yahoo!
2008-02-06 18:01 . 08-02-06 18:01 <DIR> d-------- C:\Program Files\Yahoo!
2008-02-06 17:14 . 99-12-02 15:30 258,320 --a------ C:\WINNT\system32\msh263.drv
2008-02-06 17:14 . 03-06-19 11:05 51,472 --a------ C:\WINNT\system32\vfwwdm32.dll
2008-02-06 17:14 . 03-06-19 11:05 51,472 --a------ C:\WINNT\system32\dllcache\vfwwdm32.dll
2008-02-06 17:14 . 99-11-30 23:39 45,840 --a------ C:\WINNT\system32\iyuv_32.dll
2008-02-06 17:14 . 99-11-30 23:39 45,840 --a------ C:\WINNT\system32\dllcache\iyuv_32.dll
2008-02-06 17:14 . 99-11-30 23:39 12,560 --a------ C:\WINNT\system32\tsbyuv.dll
2008-02-06 17:14 . 99-11-30 23:39 12,560 --a------ C:\WINNT\system32\dllcache\tsbyuv.dll
2008-02-06 17:09 . 08-02-06 17:49 241 --a------ C:\WINNT\QSync.INI
2008-02-06 17:06 . 08-02-06 17:06 <DIR> d-------- C:\Program Files\Common Files\Logitech
2008-02-06 17:05 . 08-02-06 17:05 <DIR> d-------- C:\Program Files\Windows Media Components
2008-02-06 17:01 . 08-02-06 17:01 <DIR> d-------- C:\Program Files\Logitech
2008-02-06 16:00 . 08-02-06 16:00 <DIR> d-------- C:\WINNT\OPTIONS
2008-02-06 16:00 . 08-02-06 16:00 <DIR> d-------- C:\Program Files\NETGEAR
2008-02-06 16:00 . 06-04-10 18:41 200,704 --a------ C:\WINNT\system32\WG1v2Lib.dll
2008-02-06 16:00 . 06-03-27 17:53 167,808 --a------ C:\WINNT\system32\drivers\wg111v2.sys
2008-02-06 16:00 . 03-11-18 09:27 155,648 --a------ C:\WINNT\system32\IpLib.dll
2008-02-06 16:00 . 05-12-29 00:16 114,688 -ra------ C:\WINNT\system32\EnumDev111.dll
2008-02-06 16:00 . 05-04-01 11:43 66,048 --a------ C:\WINNT\system32\drivers\EAPPkt.sys
2008-02-06 16:00 . 02-10-02 08:57 13,532 --a------ C:\WINNT\system32\drivers\SjyPkt.sys
2008-02-01 03:21 . 08-02-01 03:21 245,408 --a------ C:\WINNT\system32\unicows.dll
2008-01-31 09:19 . 08-01-31 09:19 45,056 --a------ C:\WINNT\system32\Indt2.sys
2008-01-27 02:04 . 08-01-27 02:04 <DIR> d-------- C:\WINNT\system32\Windows Media
2008-01-27 02:03 . 08-01-27 02:03 <DIR> d-------- C:\WINNT\msiinst.tmp
2008-01-27 02:03 . 08-01-27 02:03 <DIR> d--h----- C:\WINNT\$NtUpdateRollupPackUninstall$
2008-01-27 01:34 . 03-06-19 11:05 92,032 --------- C:\WINNT\system32\dllcache\KRNL386.EXE
2008-01-27 01:34 . 03-06-19 11:05 90,384 --------- C:\WINNT\system32\dllcache\cryptdlg.dll
2008-01-27 01:34 . 02-08-29 07:14 44,032 --------- C:\WINNT\system32\dllcache\msxml3r.dll
2008-01-27 00:42 . 08-01-27 00:42 1,694,560 --a------ C:\Program Files\setup.exe
2008-01-26 22:17 . 08-01-26 22:17 121 --a------ C:\WINNT\TheGard
2008-01-09 01:35 . 08-01-09 01:35 1,041 --a------ C:\WINNT\run.vbs
2008-01-09 01:35 . 08-01-09 01:35 510 --a------ C:\WINNT\run2.vbs

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-07 07:05 --------- d-----w C:\Documents and Settings\Default User\Application Data\ScamBlocker
2008-01-05 12:09 63,302 ----a-w C:\Program Files\MySpaceIM_Setup.exe
2007-12-29 13:27 155,995 ----a-w C:\WINNT\java\Packages\G4CYGGJV.ZIP
2007-12-28 10:20 2,400,784 ----a-w C:\Program Files\WLinstaller.exe
2007-12-27 05:56 --------- d-----w C:\Program Files\Adaptec
2007-12-26 12:41 --------- d-----w C:\Documents and Settings\Administrator\Application Data\ArcSoft
2007-12-26 12:06 --------- d-----w C:\Documents and Settings\Administrator\Application Data\EPSON
2007-12-26 12:03 --------- d-----w C:\Program Files\ArcSoft
2007-12-26 12:00 --------- d-----w C:\Program Files\Common Files\Python
2007-12-26 11:55 --------- d-----w C:\Program Files\EPSON
2007-12-26 09:10 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-26 09:10 --------- d-----w C:\Program Files\Common Files\InstallShield
2007-12-26 09:09 6,278,656 ----a-w C:\Program Files\epson10609.exe
2007-12-24 13:06 --------- d-----w C:\Documents and Settings\Administrator\Application Data\MySpace
2007-12-21 11:15 --------- d-----w C:\Documents and Settings\Administrator\Application Data\AdobeUM
2007-12-21 11:14 --------- d-----w C:\Program Files\Common Files\Adobe
2007-12-21 10:53 16,706,160 ----a-w C:\Program Files\AdbeRdr60_enu_full.exe
2007-12-19 01:25 50,176 ----a-w C:\WINNT\system32\reg.exe
2007-12-15 07:37 --------- d-----w C:\Program Files\Ken Ward's Zipper
2007-11-30 23:59 31,274,056 ----a-w C:\WINNT\wmback.exe
2007-07-31 07:56 271 ---h--w C:\Program Files\desktop.ini
2007-07-31 07:56 21,952 ---h--w C:\Program Files\folder.htt
1999-12-07 20:00 32,528 ----a-w C:\WINNT\inf\wbfirdma.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NetZero_uoltray"="C:\Program Files\NetZero\exec.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"="mobsync.exe" [03-06-19 11:05 111376 C:\WINNT\system32\mobsync.exe]
"3c1807pd"="C:\WINNT\SYSTEM32\3cmlink.exe" [05-11-18 13:12 73728]
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [07-11-30 15:58 26112]
"LVCOMS"="C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE" [02-12-10 17:54 127022]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [08-02-09 10:09 579072]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [08-02-09 10:09 219136]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"^SetupICWDesktop"="C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe" [03-06-19 11:05 186640]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
WG111v2 Smart Wizard Wireless Setting.lnk - C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe [2008-02-06 16:00:08 745472]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sr.sys]
@="FSFilter System Recovery"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SRService]
@="Service"

R1 Avg7RsNT;AVG7 Resident Driver NT;C:\WINNT\system32\Drivers\avg7rsnt.sys [08-02-09 10:09 ]
R2 EAPPkt;Realtek EAPPkt Protocol;C:\WINNT\system32\DRIVERS\EAPPkt.sys [05-04-01 11:43 ]
R3 3c1807pd;U.S. Robotics V.92 Fax Win Int;C:\WINNT\system32\DRIVERS\3c1807pd.sys [05-11-18 13:02 ]
R3 als4k;Avance Wave Audio Miniport Driver (WDM);C:\WINNT\system32\drivers\als4000.sys [00-01-14 17:10 ]
R3 ALS4KMF;ALS4KMF;C:\WINNT\system32\drivers\mf.sys [03-06-19 11:05 ]
R3 alsgame;Gameport for ALS4000 (WDM);C:\WINNT\system32\drivers\alsgame.sys [99-09-10 13:46 ]
R3 ati2mtaa;ati2mtaa;C:\WINNT\system32\DRIVERS\ati2mtaa.sys [01-01-25 10:02 ]
R3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;C:\WINNT\system32\DRIVERS\wg111v2.sys [06-03-27 17:53 ]
R3 SjyPkt;SjyPkt;C:\WINNT\System32\Drivers\SjyPkt.sys [02-10-02 08:57 ]
S2 perfmons;perfmons Service;C:\WINNT\system32\perfs.exe []
S2 Routing;Routing Service;C:\WINNT\system32\routing.exe []
S2 SkServer;Snake SockProxy Service;C:\WINNT\system32\config\sy.exe []
S4 Alretoer;Alretoer;C:\alexamw.exe []
S4 sylreto;sylreto;C:\242.exe []
S4 sylretoer;sylretoer;C:\pro.exe []
Start Pending2 Authorization;rdljlJpSKRIHjDNjm;C:\WINNT\System32\svchost.exe [99-12-07 12:00 ]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Authorization REG_MULTI_SZ Authorization

*Newly Created Service* - IPNAT
*Newly Created Service* - RASAUTO
*Newly Created Service* - SHAREDACCESS
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-09 15:03:48
Windows 5.0.2195 Service Pack 4 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\SYSTEM32\3cshtdwn.exe
C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtWLan.exe
.
**************************************************************************
.
Completion time: 2008-02-09 15:06:05 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-09 23:06:02
.
2007-12-21 08:02:05 --- E O F ---

[Essexboy]

No problem, I was just a tad confused when you quoted my post and nothing else

There are still a few meanies to kill so I will use a deep search method

We will now do a deep search of your processes and files

Download avz4.zip from here

• Unzip it to your desktop to a folder named avz4
• Double click on AVZ.exe to run it.
• Run an update by clicking the Auto Update button on the Right of the Log window:
• Click Start to begin the update

Note: If you recieve an error message, chose a different source, then click Start again

• Start AVZ.
  
• Choose from the menu "File" => "Standard scripts " and mark the "Healing/Quarantine and Advanced System Investigation" check box.
• Click on the “Execute selected scripts”.
• Automatic scanning, healing and system check will be executed.
• A logfile (avz_sysinfo.htm) will be created and saved in the LOG folder in the AVZ directory as virusinfo_syscure.zip.
• It is necessary to reboot your machine, because AVZ might disturb some program operations (like antiviruses and firewall) during the system scan.
• All applications will work properly after the system restart.

When restarted

• Start AVZ.
  
• Choose from the menu "File" => "Standard scripts " and mark the “Advanced System Investigation" check box.
• Click on the "Execute selected scripts".
• A system check will be automatically performed, and the created logfile (avz_sysinfo.htm) will be saved in the LOG folder in the AVZ directory as virusinfo_syscheck.zip.

Attach both zip files to your next post

[Essexboy]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.