Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Winfixer, VIRUS Alert in System Time [CLOSED]

Started by Throy , Jul 11 2008 11:42 AM

This topic is locked

#1
Throy

Posted 11 July 2008 - 11:42 AM

New Member

Member
3 posts

* System time has VIRUS ALERT!
* Task manager disabled
* No Control Panel
* No My Computer
* No My Documents
* Regedit disabled
* No Cmd
* No Local C: drive
* No Local D: drive

this is my Hijack log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:41: VIRUS ALERT!, on 7/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\mom.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\Research In Motion\RIMDeviceManager\RIMDeviceManager.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: {823fdc6b-7e5d-6d58-7294-abb223425138} - {83152432-2bba-4927-85d6-d5e7b6cdf328} - C:\WINDOWS\system32\qqntbv.dll (file missing)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [DelayLoad] C:\DOCUME~1\Jaytee\LOCALS~1\Temp\atmadm2.exe
O4 - HKLM\..\Run: [10c5c5d0] rundll32.exe "C:\WINDOWS\system32\amxjyomy.dll",b
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [CurseClient] C:\Program Files\Curse\CurseClient.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [RIMDeviceManager] "C:\Program Files\Common Files\Research In Motion\RIMDeviceManager\RIMDeviceManager.exe" -RunServer
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O21 - SSODL: fsrpknov - {74E20839-C58B-4AD4-B202-22131EB86284} - C:\WINDOWS\fsrpknov.dll (file missing)
O21 - SSODL: fdxbameg - {DDAD294A-111A-4D86-84CE-5BF725B08283} - C:\WINDOWS\fdxbameg.dll (file missing)
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

--
End of file - 7579 bytes

Edited by Throy, 11 July 2008 - 12:08 PM.

#2
Mike

Posted 11 July 2008 - 12:16 PM

Malware Monger

Retired Staff
2,745 posts

Hi there,

Please disable windows defender temporarily

* Click Start > Programs > Windows Defender or launch from the system tray icon.
* Click on Tools & Settings > Options.
* Under Real-time protection options, uncheck the "Real-time protection" check box.
* Click Save.
* Go to Start > Control Panel > Security > Windows Defender, at the bottom of the Window Defenders page uncheck under Administrator Options "use Windows Defender" and then Save.
* (When we are done, you can re-enable Defender using the same steps but this time place a check next to "Turn on real-time protection" check box.)

Then,

Please go here to install the recovery console and for a guide on using combofix.
Please note: Installing the Recovery Console plays a vital part in making this process of cleaning your computer safe, don't overlook this!

Now please download combofix from here or here. It is important that you save this file to your desktop.

Double click combofix.exe and follow the prompts. Please, never rename Combofix unless instructed.
When finished, it shall produce a log for you. Post that log and a Hijack This log in your next reply.

A quick heads up, if you click on combofix's window when it's running, you may cause it to stall.

Edited by Mike, 11 July 2008 - 12:18 PM.

#3
Throy

Posted 11 July 2008 - 12:24 PM

New Member

Topic Starter
Member
3 posts

I do not have anything in my start menu

#4
Mike

Posted 11 July 2008 - 12:53 PM

Malware Monger

Retired Staff
2,745 posts

Please continue with ComboFix, if you can't connect to the internet with the infected PC, download the tool from another PC and transfer it via USB or CD to the infected one
, move ComboFix to the desktop and run it as instructed.

Edited by Mike, 11 July 2008 - 12:55 PM.

#5
Throy

Posted 11 July 2008 - 01:52 PM

New Member

Topic Starter
Member
3 posts

Here are logs

ComboFix 08-07-11.1 - Jaytee 2008-07-11 15:04:33.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.296 [GMT -4:00]
Running from: C:\Documents and Settings\Jaytee\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Jaytee\Application Data\rhcpo3j0eac9
C:\WINDOWS\eorp.exe
C:\WINDOWS\gpefaowr.exe
C:\WINDOWS\system32\amxjyomy.dll
C:\WINDOWS\system32\sCeeLRqr.ini
C:\WINDOWS\system32\sCeeLRqr.ini2
C:\WINDOWS\system32\ymoyjxma.ini

.
((((((((((((((((((((((((( Files Created from 2008-06-11 to 2008-07-11 )))))))))))))))))))))))))))))))
.

2008-07-11 13:50 . 2008-06-19 17:24 28,544 --a------ C:\WINDOWS\system32\drivers\pavboot.sys
2008-07-11 13:48 . 2008-07-11 13:48 <DIR> d-------- C:\Program Files\Panda Security
2008-07-11 12:59 . 2008-07-11 12:59 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2008-07-11 12:59 . 2008-07-11 12:59 <DIR> d-------- C:\Documents and Settings\Jaytee\Application Data\SUPERAntiSpyware.com
2008-07-11 12:59 . 2008-07-11 12:59 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-07-11 12:58 . 2008-07-11 12:58 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-07-11 11:36 . 2008-07-11 11:36 <DIR> d-------- C:\Program Files\Trend Micro
2008-07-11 11:06 . 2008-07-11 15:01 <DIR> d--h----- C:\$AVG8.VAULT$
2008-07-11 11:03 . 2008-07-11 11:04 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg
2008-07-11 11:03 . 2008-07-11 11:03 96,520 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys
2008-07-11 11:03 . 2008-07-11 11:03 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll
2008-07-11 10:57 . 2008-07-11 10:57 <DIR> d-------- C:\Program Files\CCleaner
2008-07-11 10:47 . 2008-07-11 10:47 116,864 --a------ C:\WINDOWS\system32\mjwrrnib.dll
2008-07-11 10:46 . 2008-07-11 10:43 102,664 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys
2008-07-11 10:42 . 2008-07-11 10:48 <DIR> d-------- C:\Documents and Settings\Jaytee\.housecall6.6
2008-07-03 21:32 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2008-07-03 21:32 . 2004-08-03 23:08 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys
2008-07-03 21:32 . 2004-08-03 22:58 14,848 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys
2008-07-03 21:32 . 2004-08-03 22:58 14,848 --a--c--- C:\WINDOWS\system32\dllcache\kbdhid.sys
2008-07-02 18:39 . 2008-07-03 10:50 256 --a------ C:\WINDOWS\system32\pool.bin
2008-06-28 17:29 . 2008-07-09 10:33 664 --a------ C:\WINDOWS\system32\d3d9caps.dat
2008-06-28 02:23 . 2008-07-11 11:02 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avg8
2008-06-24 19:42 . 2004-08-04 00:56 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll
2008-06-24 19:42 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2008-06-24 19:42 . 2004-08-03 22:58 15,104 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys
2008-06-24 19:42 . 2001-08-17 22:36 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll
2008-06-24 02:43 . 2008-06-24 02:43 <DIR> d--h----- C:\WINDOWS\PIF
2008-06-20 20:47 . 2008-06-20 21:50 590 --a------ C:\WINDOWS\EF2.INI
2008-06-20 19:31 . 2008-06-20 19:31 <DIR> d-------- C:\WINDOWS\system32\config\systemprofile\Application Data\ATI
2008-06-20 19:28 . 2008-06-20 19:28 <DIR> d-------- C:\Program Files\PowerISO
2008-06-20 12:50 . 2008-06-20 12:50 <DIR> d-------- C:\VQ
2008-06-20 12:50 . 2000-07-05 10:04 893 --a------ C:\WINDOWS\system32\VQ318Vex.LOC
2008-06-20 12:49 . 1998-10-29 16:45 306,688 --a------ C:\WINDOWS\IsUninst.exe
2008-06-19 19:06 . 2008-06-19 19:06 <DIR> d-------- C:\Program Files\MSXML 6.0
2008-06-19 19:06 . 2008-06-19 19:06 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-06-19 14:25 . 2008-07-04 17:22 <DIR> d-------- C:\Documents and Settings\Jaytee\Application Data\LimeWire
2008-06-19 14:23 . 2008-06-19 14:25 <DIR> d-------- C:\Program Files\LimeWire
2008-06-19 13:55 . 2008-06-19 13:55 <DIR> d-------- C:\Program Files\Apple Software Update
2008-06-19 09:14 . 2008-06-19 09:14 <DIR> d-------- C:\Documents and Settings\Jaytee\Application Data\vlc
2008-06-19 08:50 . 2008-07-11 15:09 <DIR> d-------- C:\MDT
2008-06-19 08:49 . 2008-06-19 08:50 <DIR> d-------- C:\Documents and Settings\Jaytee\Application Data\CyberLink
2008-06-19 08:49 . 2008-06-19 08:49 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Dell
2008-06-19 08:49 . 2008-06-19 08:49 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\CyberLink
2008-06-19 08:49 . 2006-10-20 17:23 82,432 --a------ C:\WINDOWS\system32\msxml4r.dll
2008-06-19 08:49 . 2006-10-20 17:23 44,544 --a------ C:\WINDOWS\system32\msxml4a.dll
2008-06-19 08:48 . 2008-06-19 08:48 <DIR> d-------- C:\Program Files\CyberLink
2008-06-19 08:48 . 2006-10-20 17:23 1,047,552 --a------ C:\WINDOWS\system32\MFC71u.dll
2008-06-19 08:47 . 2006-10-26 19:56 32,592 --a------ C:\WINDOWS\system32\msonpmon.dll
2008-06-19 08:45 . 2008-06-19 08:45 <DIR> d-------- C:\Program Files\MSBuild
2008-06-19 08:45 . 2008-06-19 08:45 <DIR> d-------- C:\Program Files\Microsoft Works
2008-06-19 08:43 . 2008-06-19 08:43 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-06-19 08:41 . 2008-06-19 08:41 <DIR> d-------- C:\Program Files\Microsoft Visual Studio 8
2008-06-19 08:40 . 2008-06-19 08:44 <DIR> d-------- C:\WINDOWS\SHELLNEW
2008-06-19 08:39 . 2008-06-19 08:39 <DIR> dr-h----- C:\MSOCache
2008-06-19 08:39 . 2008-07-09 10:21 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-06-18 23:23 . 2008-06-18 23:23 <DIR> d-------- C:\Documents and Settings\Jaytee\Application Data\RealVNC
2008-06-18 20:40 . 2008-06-18 20:40 <DIR> d-------- C:\Documents and Settings\Jaytee\Application Data\Research In Motion
2008-06-18 20:40 . 2008-07-11 15:09 256 --a------ C:\Documents and Settings\Jaytee\pool.bin
2008-06-18 20:37 . 2007-01-18 10:24 26,496 -ra------ C:\WINDOWS\system32\drivers\RimSerial.sys
2008-06-18 20:36 . 2008-06-18 20:36 <DIR> d-------- C:\Program Files\Research In Motion
2008-06-18 20:36 . 2008-06-18 20:37 <DIR> d-------- C:\Program Files\Common Files\Research In Motion
2008-06-18 20:16 . 2008-06-18 20:16 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Messenger Plus!
2008-06-18 18:44 . 2008-06-18 18:44 <DIR> d-------- C:\Program Files\Messenger Plus! Live
2008-06-18 14:16 . 2008-06-18 14:16 <DIR> d-------- C:\Program Files\RealVNC
2008-06-18 11:59 . 2008-06-18 11:59 <DIR> d-------- C:\Documents and Settings\Jaytee\Logs
2008-06-17 09:43 . 2008-06-17 09:43 <DIR> d-------- C:\Documents and Settings\Jaytee\Application Data\Acreon
2008-06-17 09:24 . 2008-06-17 09:24 <DIR> d-------- C:\Program Files\Curse
2008-06-16 19:01 . 2008-06-16 19:01 <DIR> d-------- C:\Logs
2008-06-16 14:01 . 2008-06-17 08:58 <DIR> d-------- C:\Program Files\World of Warcraft
2008-06-16 13:34 . 2008-06-16 13:34 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\PC Drivers HeadQuarters
2008-06-16 13:33 . 2008-06-16 13:33 <DIR> d-------- C:\Program Files\DNA
2008-06-16 13:33 . 2008-06-16 13:33 <DIR> d-------- C:\Program Files\BitTorrent
2008-06-16 13:33 . 2008-07-11 15:07 <DIR> d-------- C:\Documents and Settings\Jaytee\Application Data\DNA
2008-06-16 13:33 . 2008-07-01 19:22 <DIR> d-------- C:\Documents and Settings\Jaytee\Application Data\BitTorrent
2008-06-16 13:17 . 2004-08-04 00:56 90,624 --a------ C:\WINDOWS\system32\kswdmcap.ax
2008-06-16 13:17 . 2004-08-04 00:56 90,624 --a--c--- C:\WINDOWS\system32\dllcache\kswdmcap.ax
2008-06-16 13:17 . 2004-08-04 00:56 61,952 --a------ C:\WINDOWS\system32\kstvtune.ax
2008-06-16 13:17 . 2004-08-04 00:56 61,952 --a--c--- C:\WINDOWS\system32\dllcache\kstvtune.ax
2008-06-16 13:17 . 2004-08-04 00:56 53,760 --a------ C:\WINDOWS\system32\vfwwdm32.dll
2008-06-16 13:17 . 2004-08-04 00:56 53,760 --a--c--- C:\WINDOWS\system32\dllcache\vfwwdm32.dll
2008-06-16 13:17 . 2004-08-04 00:56 43,008 --a------ C:\WINDOWS\system32\ksxbar.ax
2008-06-16 13:17 . 2004-08-04 00:56 43,008 --a--c--- C:\WINDOWS\system32\dllcache\ksxbar.ax
2008-06-16 13:17 . 2004-08-04 00:56 28,672 --a------ C:\WINDOWS\system32\vidcap.ax
2008-06-16 13:17 . 2004-08-04 00:56 28,672 --a--c--- C:\WINDOWS\system32\dllcache\vidcap.ax
2008-06-16 12:24 . 2008-06-16 14:01 <DIR> d-------- C:\Program Files\Common Files\Blizzard Entertainment
2008-06-16 12:00 . 2008-06-16 12:00 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-06-14 08:28 . 2008-06-14 08:28 <DIR> d-------- C:\WINDOWS\Sun
2008-06-14 08:27 . 2008-03-25 02:37 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-06-14 08:22 . 2004-08-03 23:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys
2008-06-12 02:28 . 2008-06-12 02:28 56,108 --a------ C:\WINDOWS\system32\drivers\scdemu.sys
2008-06-11 17:44 . 2008-06-13 09:10 272,128 --------- C:\WINDOWS\system32\drivers\bthport.sys
2008-06-11 17:44 . 2008-06-13 09:10 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-11 19:09 --------- d-----w C:\Program Files\Steam
2008-07-11 16:27 --------- d-----w C:\Program Files\Windows Defender
2008-07-01 20:09 --------- d-----w C:\Documents and Settings\Jaytee\Application Data\Apple Computer
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-19 12:48 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-14 12:27 --------- d-----w C:\Program Files\Java
2008-06-08 23:35 --------- d-----w C:\Program Files\QuickTime
2008-06-08 23:35 --------- d-----w C:\Program Files\iTunes
2008-06-08 23:35 --------- d-----w C:\Program Files\iPod
2008-06-08 23:35 --------- d-----w C:\Program Files\Bonjour
2008-06-08 23:35 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-06-08 23:34 --------- d-----w C:\Program Files\Common Files\Apple
2008-06-08 23:34 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2008-06-08 12:40 --------- d-----w C:\Program Files\AVG
2008-06-08 12:26 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-06-08 12:21 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-06-08 12:03 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-06-08 05:32 --------- d-----w C:\Documents and Settings\Jaytee\Application Data\ATI
2008-06-08 04:26 --------- d-----w C:\Program Files\ATI Technologies
2008-06-08 04:21 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-06-08 04:20 --------- d-----w C:\Program Files\Broadcom
2008-06-08 04:19 --------- d-----w C:\Program Files\DIFX
2008-06-08 04:17 --------- d-----w C:\Program Files\Dell
2008-06-08 04:05 --------- d-----w C:\Program Files\AVG(2)
2008-06-08 04:05 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg8(2)
2008-06-08 04:03 --------- d-----w C:\Program Files\Mozilla Firefox(2)
2008-06-07 19:30 --------- d-----w C:\Program Files\Common Files\Java
2008-06-07 18:34 --------- d-----w C:\Program Files\Windows Live
2008-06-07 17:16 --------- d-----w C:\Program Files\AMD
2008-06-07 17:15 --------- d-----w C:\Program Files\SigmaTel
2008-06-07 17:03 --------- d-----w C:\Program Files\microsoft frontpage
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 13:35 90112]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:00 15360]
"Steam"="c:\program files\steam\steam.exe" [2008-06-08 19:08 1271032]
"BitTorrent DNA"="C:\Program Files\DNA\btdna.exe" [2008-06-16 13:33 289088]
"CurseClient"="C:\Program Files\Curse\CurseClient.exe" [2008-05-19 10:57 1400832]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 12:24 1694208]
"RIMDeviceManager"="C:\Program Files\Common Files\Research In Motion\RIMDeviceManager\RIMDeviceManager.exe" [2007-07-17 13:46 1328400]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-05-28 10:33 1506544]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY.exe" [2007-03-16 18:10 1392640]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 07:00 33648]
"PDVDDXSrv"="C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2006-10-20 17:23 118784]
"PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2008-06-16 04:52 167936]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-07-11 11:03 1232152]
"SigmatelSysTrayApp"="stsystra.exe" [2007-02-19 14:26 303104 C:\WINDOWS\stsystra.exe]

C:\Documents and Settings\Jaytee\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2007-08-24 04:45:42 101784]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 10:13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Steam\\steamapps\\shhrambo\\counter-strike\\hl.exe"=
"C:\\Program Files\\DNA\\btdna.exe"=
"C:\\Program Files\\BitTorrent\\bittorrent.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

R0 pavboot;pavboot;C:\WINDOWS\system32\drivers\pavboot.sys [2008-06-19 17:24]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-07-11 11:03]
R2 avg8wd;AVG Free8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-07-11 11:02]
S3 DCamUSBLTN;M318B Digital Video Camera;C:\WINDOWS\system32\DRIVERS\vq318vid.sys [2002-04-22 09:28]

*Newly Created Service* - PAVBOOT
.
Contents of the 'Scheduled Tasks' folder
"2008-07-05 20:05:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-07-11 19:12:07 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
- - - - ORPHANS REMOVED - - - -

BHO-{83152432-2bba-4927-85d6-d5e7b6cdf328} - C:\WINDOWS\system32\qqntbv.dll
HKLM-Run-10c5c5d0 - C:\WINDOWS\system32\amxjyomy.dll
SSODL-fsrpknov-{74E20839-C58B-4AD4-B202-22131EB86284} - C:\WINDOWS\fsrpknov.dll
SSODL-fdxbameg-{DDAD294A-111A-4D86-84CE-5BF725B08283} - C:\WINDOWS\fdxbameg.dll

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-11 15:09:38
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\WLTRYSVC.EXE
C:\WINDOWS\system32\BCMWLTRY.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\cmd.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe
.
**************************************************************************
.
Completion time: 2008-07-11 15:14:37 - machine was rebooted
ComboFix-quarantined-files.txt 2008-07-11 19:14:29

Pre-Run: 16,597,413,888 bytes free
Post-Run: 16,845,361,152 bytes free

248 --- E O F --- 2008-07-11 12:46:11

Here is Hijack

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:51, on 7/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\mom.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Curse\CurseClient.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\Research In Motion\RIMDeviceManager\RIMDeviceManager.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\AVG\AVG8\avgui.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [CurseClient] C:\Program Files\Curse\CurseClient.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [RIMDeviceManager] "C:\Program Files\Common Files\Research In Motion\RIMDeviceManager\RIMDeviceManager.exe" -RunServer
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

--
End of file - 6925 bytes

#6
Mike

Posted 11 July 2008 - 03:32 PM

Malware Monger

Retired Staff
2,745 posts

Hi there,

I would like you to install the Recovery Console.
The Windows recovery console will allow you to boot up into a special recovery mode that allows us to help you in the case that your computer has a problem after an attempted removal of malware.

Go to Microsoft's website => http://support.microsoft.com/kb/310994
Select the download that's appropriate for your Operating System.

Posted Image

Download the file & save it as it's originally named, next to ComboFix.exe.

Posted Image

Now close all open windows and programs, then drag the setup package onto ComboFix.exe and drop it. Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console.

After you have done this proceed with the next steps.

Now,

Please click Start then Run, in the window appears type in Notepad.exe.
Highlight the entire content of the codebox below. Copy (Control + C) and Paste (Control + V) the content into the notepad window:

Collect::
C:\WINDOWS\system32\mjwrrnib.dll

DirLook::
C:\VQ
C:\MDT

Now in Notepad, go to File and in the menu that drops down click on Save As...
Save the file as CFScript.txt

Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.
Posted Image

After that please reboot your computer if it asks you to and post ComboFix.txt (the report the ComboFix will generate) in your next reply.

Then,

Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

Post back with the logs please.

#7
Mike

Posted 16 July 2008 - 03:55 AM

Malware Monger

Retired Staff
2,745 posts

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.