[98sports]

So I havent had a spyware or virus problem since about 2004. Seems like those trojan developers really made some strides in those 4 years.

Late yesterday evening, after downloading a torrent, my desktop changed to a red biohazard stating that my privacy was in danger. IE and Firefox were now useless because they kept getting sent to Ultimate Cleaner 2007s webpage. Half my desktop icons are gone. Next to the time on the toolbar there is a nice VIRUS ALERT! warning, and the start menu is relatively useless as I cant access my programs or my control panel from it. Ive run about 3 spyware programs and now my system is slightly more stable and the desktop wallpaper is gone but pretty much everything else remains... Help, Im awfully frustrated and tired.


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 02:43: VIRUS ALERT!, on 13/07/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\oodag.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Softwin\BitDefender8\bdnagent.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\BitComet\BitComet.exe
C:\Documents and Settings\utilisateur\Bureau\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarerefer...=...6Ojg5&lid=2
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: {b367cbd8-18de-5dd8-bdd4-568379bfa267} - {762afb97-3865-4ddb-8dd5-ed818dbc763b} - C:\WINDOWS\system32\ditetp.dll (file missing)
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [BDNewsAgent] "C:\Program Files\Softwin\BitDefender8\bdnagent.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [bc861b80] rundll32.exe "C:\WINDOWS\system32\ynixtjal.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - HKCU\..\Run: [InstallProgram] C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\smchk.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - S-1-5-18 Startup: IEHOME.LNK = C:\Documents and Settings\Default User\Local Settings\Temp\iehome.bat (User 'SYSTEM')
O4 - .DEFAULT Startup: IEHOME.LNK = C:\Documents and Settings\Default User\Local Settings\Temp\iehome.bat (User 'Default user')
O4 - .DEFAULT User Startup: IEHOME.LNK = C:\Documents and Settings\Default User\Local Settings\Temp\iehome.bat (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail....es/MSNPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1166045974905
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
O23 - Service: BitDefender Communicator (XCOMM) - Softwin - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
O24 - Desktop Component 0: Privacy Protection - file:///C:\WINDOWS\privacy_danger\index.htm

--
End of file - 8064 bytes

[Advertisements]

Hello

Before we begin, you should save these instructions in Notepad to your desktop, or print them, for easy reference. Much of our fix will be done in Safe mode, and you will be unable to access this thread at that time. If you have questions at any point, or are unsure of the instructions, feel free to post here and ask for clarification before proceeding.


Please download SmitfraudFix (by S!Ri) to your Desktop.

Next, please reboot your computer in Safe Mode by doing the following :

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
• Instead of Windows loading as normal, a menu with options should appear;
• Select the first option, to run Windows in Safe Mode, then press "Enter".
• Choose your usual account.

Once in Safe Mode, double-click on SmitfraudFix.exe
Select option #2 - Clean by typing 2 and press "Enter" to delete infected files.

You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing Y and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection.

The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing Y and press "Enter".

The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart it into Normal Windows.
A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report into your next reply.
The report can also be found at the root of the system drive, usually at C:\rapport.txt

Warning : running option #2 on a non infected computer will remove your Desktop background.




Please download Deckard's System Scanner (DSS) and save it to your Desktop.

• Close all other windows before proceeding.
• Double-click on dss.exe and follow the prompts.
• If your anti-virus or firewall complains, please allow this script to run as it is not malicious.
• When it has finished, dss will open two Notepads main.txt and extra.txt -- please copy (CTRL+A and then CTRL+C) and paste (CTRL+V) the contents of main.txt and extra.txt in your next reply.

[Rorschach112]

Hello

Before we begin, you should save these instructions in Notepad to your desktop, or print them, for easy reference. Much of our fix will be done in Safe mode, and you will be unable to access this thread at that time. If you have questions at any point, or are unsure of the instructions, feel free to post here and ask for clarification before proceeding.


Please download SmitfraudFix (by S!Ri) to your Desktop.

Next, please reboot your computer in Safe Mode by doing the following :

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
• Instead of Windows loading as normal, a menu with options should appear;
• Select the first option, to run Windows in Safe Mode, then press "Enter".
• Choose your usual account.

Once in Safe Mode, double-click on SmitfraudFix.exe
Select option #2 - Clean by typing 2 and press "Enter" to delete infected files.

You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing Y and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection.

The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing Y and press "Enter".

The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart it into Normal Windows.
A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report into your next reply.
The report can also be found at the root of the system drive, usually at C:\rapport.txt

Warning : running option #2 on a non infected computer will remove your Desktop background.




Please download Deckard's System Scanner (DSS) and save it to your Desktop.

• Close all other windows before proceeding.
• Double-click on dss.exe and follow the prompts.
• If your anti-virus or firewall complains, please allow this script to run as it is not malicious.
• When it has finished, dss will open two Notepads main.txt and extra.txt -- please copy (CTRL+A and then CTRL+C) and paste (CTRL+V) the contents of main.txt and extra.txt in your next reply.

[98sports]

Unfortunately very little progress came from that.

I ran smitfraud in safe mode and everything was progressing until the registry cleanup... once I selected yes I was given a notice from my computer that the administrator has restricted access to the registry (I believe the administrator is the virus preventing itself from getting erased -- CTL-ALT-DEL garnered the same response until after the SmitFraudFix). At that point the disk cleanup runs for about a minute and then in the smitfraud screen Im told that certain files cant be accessed. Anyways, the program stops and leaves me with this log:

SmitFraudFix v2.329

Scan done at 10:53:20.04, 13/07/2008
Run from C:\Documents and Settings\utilisateur\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» hosts


127.0.0.1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files


»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» 404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{F79CF356-FB19-4094-B338-2B8A215EE893}: DhcpNameServer=192.168.2.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{F79CF356-FB19-4094-B338-2B8A215EE893}: DhcpNameServer=192.168.2.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{F79CF356-FB19-4094-B338-2B8A215EE893}: DhcpNameServer=192.168.2.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{F79CF356-FB19-4094-B338-2B8A215EE893}: DhcpNameServer=192.168.2.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.2.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.2.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.2.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.2.1


»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End

It does not prompt me to restart but I did anyways... in normal mode. Tried running that DSS program but after 2 minutes I get a windows message saying that the program encountered an error blah blah blah....


So yeah, still in trouble here for sure. The desktop has cleaned up and the porn popups have stopped but my taskbar still displays VIRUS ALERT, my start menu is still useless, and that ghost administrator is still worrying me.

Thanks again

[Rorschach112]

Hello

Please visit this web page for instructions for downloading and running ComboFix

http://www.bleepingc...to-use-combofix

This includes installing the Windows XP Recovery Console in case you have not installed it yet.

For more information on the Windows XP Recovery Console read http://support.microsoft.com/kb/314058.

Once you install the Recovery Console, when you reboot your computer, you'll see the option for the Recovery Console now as well. Don't select Recovery Console as we don't need it. By default, your main OS is selected there. The screen stays for 2 seconds and then it proceeds to load Windows. That is normal.

Post the log from ComboFix when you've accomplished that, along with a new HijackThis log.

[98sports]

Well I ran a script to enable regedit and that allowed me to successfully (I think anyways) run SmitFraudFix. This was the resulting log: SmitFraudFix v2.329

Rapport fait à 12:31:53.00, 13/07/2008
Executé à partir de C:\Documents and Settings\utilisateur\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode sans echec

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus


»»»»»»»»»»»»»»»»»»»»»»»» hosts


127.0.0.1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés


»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» 404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{F79CF356-FB19-4094-B338-2B8A215EE893}: DhcpNameServer=192.168.2.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{F79CF356-FB19-4094-B338-2B8A215EE893}: DhcpNameServer=192.168.2.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{F79CF356-FB19-4094-B338-2B8A215EE893}: DhcpNameServer=192.168.2.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{F79CF356-FB19-4094-B338-2B8A215EE893}: DhcpNameServer=192.168.2.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.2.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.2.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.2.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.2.1


»»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre

Nettoyage terminé.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Après SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

I tried DSS again but unfortunately the result was the same as last time.

And with regards to your most recent post, I followed the instructions but my computer isnt letting me start the program up as has been the case with a few spyware detectors over the past 12 hours (So far Malwarebytes, Spybot S&D, and now ComboFix).

[Rorschach112]

Do this

Please download Runscanner to your desktop and run it.

• When the first page comes up select Beginner Mode
• On the next page select Save a binary .Run file (Recommended) then click Start full scan at the top.
• At this time Runscanner.exe may request access to the Internet through your firewall please allow it to do so, it will then run for two or three minutes.
• On completion it will ask for a location to save the file and a name. It will do this for both the .run file and the log file
• Call the .run file "Select a name" and save it to your desktop. You will see the .run file on your desktop. Upload that file here. If the forum doesn't let you upload it then please zip the .run file by right clicking and selecting send to Zip file

Then upload that as an attachment in your next post (you may have to zip the .run file to upload it here).

[98sports]

I dont seem to be allowed to post any attachments regardless of the type of file (even the .txt file wasnt uploaded).

Are there any restrictions on this forum for new users who wish to upload attachments...

[98sports]

Yeah I really cant seem to get the attachments going...

Runscanner logfile http://www.runscanner.net

* = signed file
- = file not found

000 General info
----------------
Computer name : NOM-BCAF3ADB7CD
Creation time : 13/07/2008 1:10:20 PM
Hosts <> 127.0.0.1 : 0
Hosts file location : %SystemRoot%\System32\drivers\etc
IE version : 6.0.2900.2180
OS : Microsoft Windows XP
OS Build : 2600
OS SP : Service Pack 2
RunScanner Version : 1.6.3.0
User Language : Anglais (Canada)
User rights : Administrator
Windows folder : C:\WINDOWS

001 Running processes
---------------------
* c:\windows\system32\winlogon.exe (Microsoft Corporation)
* c:\windows\system32\alg.exe (Microsoft Corporation)
* c:\windows\system32\services.exe (Microsoft Corporation)
c:\program files\fichiers communs\softwin\bitdefender scan server\bdss.exe
* c:\program files\bitcomet\bitcomet.exe (www.BitComet.com)
c:\program files\fichiers communs\softwin\bitdefender communicator\xcommsvr.exe (Softwin)
* c:\windows\system32\csrss.exe (Microsoft Corporation)
* c:\windows\system32\dllhost.exe (Microsoft Corporation)
* c:\windows\system32\ctfmon.exe (Microsoft Corporation)
c:\windows\system32\dvdramsv.exe (Matsushita Electric Industrial Co., Ltd.)
* c:\windows\system32\rundll32.exe (Microsoft Corporation)
* c:\windows\explorer.exe (Microsoft Corporation)
* c:\windows\system32\svchost.exe (Microsoft Corporation)
* c:\windows\system32\svchost.exe (Microsoft Corporation)
* c:\windows\system32\svchost.exe (Microsoft Corporation)
* c:\windows\system32\svchost.exe (Microsoft Corporation)
* c:\windows\system32\svchost.exe (Microsoft Corporation)
* c:\windows\system32\svchost.exe (Microsoft Corporation)
* c:\windows\system32\svchost.exe (Microsoft Corporation)
* c:\windows\system32\svchost.exe (Microsoft Corporation)
* c:\windows\system32\smss.exe (Microsoft Corporation)
c:\program files\intel\wireless\bin\evteng.exe (Intel Corporation)
c:\program files\intel\wireless\bin\regsrvc.exe (Intel Corporation)
* c:\program files\internet explorer\iexplore.exe (Microsoft Corporation)
* c:\windows\system32\lsass.exe (Microsoft Corporation)
* c:\windows\ehome\mcrdsvc.exe (Microsoft Corporation)
* c:\windows\ehome\ehrecvr.exe (Microsoft Corporation)
c:\windows\system32\oodag.exe (O&O Software GmbH)
* c:\docume~1\utilis~1\locals~1\temp\rar$ex00.719\runscanner.exe (Runscanner.net)
* c:\windows\ehome\ehsched.exe (Microsoft Corporation)
c:\program files\toshiba\configfree\cfsvcs.exe (TOSHIBA CORPORATION)
* c:\windows\system32\spoolsv.exe (Microsoft Corporation)
c:\program files\superantispyware\superantispyware.exe (SUPERAntiSpyware.com)
c:\program files\toshiba\toshiba applet\tappsrv.exe (TOSHIBA Corp.)
* c:\program files\windows live\messenger\msnmsgr.exe (Microsoft Corporation)
* c:\windows\system32\wscntfy.exe (Microsoft Corporation)
c:\program files\winrar\winrar.exe
c:\program files\intel\wireless\bin\s24evmon.exe (Intel Corporation)

002 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run (+subkeys)
-----------------------------------------------------------------
c:\windows\system32\ynixtjal.dll
c:\program files\softwin\bitdefender8\bdnagent.exe
c:\program files\java\jre1.5.0_06\bin\jusched.exe (Sun Microsystems, Inc.)

003 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run (+subkeys)
-----------------------------------------------------------------
- c:\program files\bittorrent\bittorrent.exe
- c:\docume~1\utilis~1\locals~1\temp\smchk.exe
c:\program files\superantispyware\superantispyware.exe (SUPERAntiSpyware.com)
c:\program files\toshiba\toscdspd\toscdspd.exe (TOSHIBA)

010 HKLM\SYSTEM\CurrentControlSet\Services (Services)
-----------------------------------------------------
c:\program files\fichiers communs\softwin\bitdefender communicator\xcommsvr.exe (BitDefender Communicator)
c:\program files\fichiers communs\softwin\bitdefender scan server\bdss.exe (BitDefender Scan Server)
c:\program files\toshiba\configfree\cfsvcs.exe (ConfigFree Service)
c:\windows\system32\dvdramsv.exe (DVD-RAM_Service)
c:\program files\fichiers communs\installshield\driver\1050\intel 32\idrivert.exe (InstallDriver Table Manager)
c:\program files\intel\wireless\bin\evteng.exe (Intel® PROSet/Wireless Event Log)
c:\program files\intel\wireless\bin\regsrvc.exe (Intel® PROSet/Wireless Registry Service)
c:\program files\intel\wireless\bin\s24evmon.exe (Intel® PROSet/Wireless Service)
c:\windows\system32\oodag.exe (O&O Defrag)
c:\program files\toshiba\toshiba applet\tappsrv.exe (TOSHIBA Application Service)

011 HKLM\SYSTEM\CurrentControlSet\Services (drivers)
----------------------------------------------------
C:\WINDOWS\system32\drivers\aegisp.sys (AEGIS Protocol (IEEE 802.1x) v3.5.3.0)
c:\windows\system32\drivers\beep.sys (Beep)
C:\WINDOWS\system32\drivers\tosrfec.sys (Bluetooth ACPI from TOSHIBA)
- c:\windows\system32\drivers\changer.sys (Changer)
C:\WINDOWS\system32\dla\dlaboiom.sys (DLABOIOM)
C:\WINDOWS\system32\drivers\dlacdbhm.sys (DLACDBHM)
C:\WINDOWS\system32\dla\dladresn.sys (DLADResN)
C:\WINDOWS\system32\dla\dlaifs_m.sys (DLAIFS_M)
C:\WINDOWS\system32\dla\dlaopiom.sys (DLAOPIOM)
C:\WINDOWS\system32\dla\dlapoolm.sys (DLAPoolM)
C:\WINDOWS\system32\drivers\dlartl_n.sys (DLARTL_N)
C:\WINDOWS\system32\dla\dlaudf_m.sys (DLAUDF_M)
C:\WINDOWS\system32\dla\dlaudfam.sys (DLAUDFAM)
C:\WINDOWS\system32\drivers\drvmcdb.sys (DRVMCDB)
C:\WINDOWS\system32\drivers\drvnddm.sys (DRVNDDM)
- c:\windows\system32\drivers\i2omgmt.sys (i2omgmt)
C:\WINDOWS\system32\drivers\iviaspi.sys (IVI ASPI Shell)
- c:\windows\system32\drivers\lbrtfdc.sys (lbrtfdc)
C:\WINDOWS\system32\drivers\meiudf.sys (meiudf)
c:\progra~1\common~1\motive\mrendis5.sys (MRENDIS5 NDIS Protocol Driver)
C:\WINDOWS\system32\drivers\pfc.sys (Padus ASPI Shell)
- c:\windows\system32\drivers\pcidump.sys (PCIDump)
- c:\windows\system32\drivers\pdcomp.sys (PDCOMP)
- c:\windows\system32\drivers\pdframe.sys (PDFRAME)
- c:\windows\system32\drivers\pdreli.sys (PDRELI)
- c:\windows\system32\drivers\pdrframe.sys (PDRFRAME)
C:\WINDOWS\system32\drivers\pxhelp20.sys (PxHelp20)
c:\program files\superantispyware\sasdifsv.sys (SASDIFSV)
c:\program files\superantispyware\sasenum.sys (SASENUM)
c:\program files\superantispyware\saskutil.sys (SASKUTIL)
c:\windows\system32\drivers\scdemu.sys (SCDEmu)
C:\WINDOWS\system32\drivers\sptd.sys (sptd)
c:\windows\system32\drivers\tbiosdrv.sys (TBiosDrv)
C:\WINDOWS\system32\drivers\nbsmi.sys (Toshiba Mobile PC Service)
C:\WINDOWS\system32\drivers\netdevio.sys (TOSHIBA Network Device Usermode I/O Protocol)
C:\WINDOWS\system32\drivers\tvs.sys (TOSHIBA Virtual Sound with SRS technologies)
- c:\windows\system32\drivers\wdica.sys (WDICA)
C:\WINDOWS\system32\drivers\s24trans.sys (WLAN Transport)

041 HKLM-HKCU\Software\Microsoft\Internet Explorer\Toolbar
----------------------------------------------------------
c:\program files\canon\easy-webprint\toolband.dll {327C2873-E90D-4c37-AA9D-10AC9BABA46C}

047 Trusted zones
-----------------
Zone: //@install.mar@ : msni //@install.mar@
Zone: //@mail.mar@ : msni //@mail.mar@

050 HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
-----------------------------------------------------------------------------
c:\program files\superantispyware\sasseh.dll (SuperAdBlocker.com) {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}

052 HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
----------------------------------------------------------------------------------
* c:\program files\bitcomet\tools\bitcometbho_1.2.2.28.dll (BitComet) {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}
- c:\windows\system32\ditetp.dll {762afb97-3865-4ddb-8dd5-ed818dbc763b}
c:\program files\java\jre1.5.0_06\bin\ssv.dll (Sun Microsystems, Inc.) {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}

061 HKLM-HCKU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
---------------------------------------------------------------------------------
c:\program files\softwin\bitdefender8\bdshelxt.dll (SOFTWIN S.R.L.) {D653647D-D607-4DF6-A5B8-48D2BA195F7B}
- deskpan.dll {42071714-76d4-11d1-8b24-00a0c9068ff3}
c:\program files\poweriso\pwrisosh.dll (PowerISO Computing, Inc.) {967B2D40-8B7D-4127-9049-61EA0C2C6DCE}
c:\program files\sonic\recordnow!\shlext.dll {E91B2703-013E-4A99-AD33-2B6FB00AA356}
c:\program files\sonic\recordnow!\shlext.dll {DEE12703-6333-4D4E-8F34-738C4DCC2E04}
c:\program files\winrar\rarext.dll {B41DB860-8EE4-11D2-9906-E49FADC173CA}

062 HKLM-HKCU\Software\Classes\Folder\Shellex\ColumnHandlers
------------------------------------------------------------
c:\program files\adobe\acrobat 7.0\activex\pdfshell.dll (Adobe Systems, Inc.) {F9DB5320-233E-11D1-9F84-707F02C10627}

063 HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute
---------------------------------------------------------------------
C:\WINDOWS\system32\oodbs.exe (O&O Software GmbH)

067 HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
---------------------------------------------------------------------
c:\program files\superantispyware\saswinlo.dll (SUPERAntiSpyware.com)

069 HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors
--------------------------------------------------------
C:\WINDOWS\system32\tbtmon.dll (Toshiba America Business Solutions, Inc.)

070 HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages
---------------------------------------------------------------------
- c:\windows\system32\ljjbrqop

100 Internet Explorer settings
------------------------------
SearchUrl HKCU : http://home.microsof...search.asp?p=%s

104 HKLM\Software\Microsoft\Code Store Database\Distribution Units
------------------------------------------------------------------
- c:\windows\downloaded program files\msnpupld.dll {4F1E5B1A-2A80-42CA-8532-2D05CB959537}

105 HKCU\Software\Microsoft\Internet Explorer\MenuExt
-----------------------------------------------------
&D&ownload &with BitComet : res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
&D&ownload all video with BitComet : res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
&D&ownload all with BitComet : res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
E&xport to Microsoft Excel : res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
Easy-WebPrint Ajouter à la liste d'impressions : res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
Easy-WebPrint Impression rapide : res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
Easy-WebPrint Imprimer : res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
Easy-WebPrint Prévisualiser : res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html

173 HKCR\*\shellex\ContextMenuHandlers
--------------------------------------
c:\program files\softwin\bitdefender8\bdshelxt.dll (SOFTWIN S.R.L.) {D653647D-D607-4DF6-A5B8-48D2BA195F7B}
c:\program files\poweriso\pwrisosh.dll (PowerISO Computing, Inc.) {967B2D40-8B7D-4127-9049-61EA0C2C6DCE}
c:\program files\superantispyware\sasctxmn.dll (SUPERAntiSpyware.com) SUPERAntiSpyware Context Menu
c:\program files\winrar\rarext.dll {B41DB860-8EE4-11D2-9906-E49FADC173CA}

221 HKLM\Software\Classes\*\ShellEx\ContextMenuHandlers
-------------------------------------------------------
c:\program files\softwin\bitdefender8\bdshelxt.dll (SOFTWIN S.R.L.) {D653647D-D607-4DF6-A5B8-48D2BA195F7B}
c:\program files\poweriso\pwrisosh.dll (PowerISO Computing, Inc.) {967B2D40-8B7D-4127-9049-61EA0C2C6DCE}
c:\program files\superantispyware\sasctxmn.dll (SUPERAntiSpyware.com) SUPERAntiSpyware Context Menu
c:\program files\winrar\rarext.dll {B41DB860-8EE4-11D2-9906-E49FADC173CA}

225 HKCU\Software\Classes\Folder\ShellEx\ContextMenuHandlers
------------------------------------------------------------
c:\program files\softwin\bitdefender8\bdshelxt.dll (SOFTWIN S.R.L.) {D653647D-D607-4DF6-A5B8-48D2BA195F7B}
c:\program files\softwin\bitdefender8\bdshelxt.dll (SOFTWIN S.R.L.) {D653647D-D607-4DF6-A5B8-48D2BA195F7B}
c:\program files\poweriso\pwrisosh.dll (PowerISO Computing, Inc.) {967B2D40-8B7D-4127-9049-61EA0C2C6DCE}
c:\program files\poweriso\pwrisosh.dll (PowerISO Computing, Inc.) {967B2D40-8B7D-4127-9049-61EA0C2C6DCE}
c:\program files\winrar\rarext.dll {B41DB860-8EE4-11D2-9906-E49FADC173CA}
c:\program files\winrar\rarext.dll {B41DB860-8EE4-11D2-9906-E49FADC173CA}

227 HKLM\Software\Classes\Directory\ShellEx\ContextMenuHandlers
---------------------------------------------------------------
c:\program files\poweriso\pwrisosh.dll (PowerISO Computing, Inc.) {967B2D40-8B7D-4127-9049-61EA0C2C6DCE}
c:\program files\superantispyware\sasctxmn.dll (SUPERAntiSpyware.com) SUPERAntiSpyware Context Menu
c:\program files\winrar\rarext.dll {B41DB860-8EE4-11D2-9906-E49FADC173CA}

231 HKLM\Software\Classes\Folder\Shellex\ColumnHandlers
-------------------------------------------------------
c:\program files\adobe\acrobat 7.0\activex\pdfshell.dll (Adobe Systems, Inc.) PDF Column Info


----END

Still trying to find a way to get you the .run file (I zipped it and everything).

[Rorschach112]

Can you host it a site like mediafire.com and post the link here

[98sports]

.run file : http://www.mediafire.com/?zzbnlanf4xd

.log file : http://www.mediafire.com/?uyjegmvcxtm

Thank you so much, you have no idea how appreciative I am of your help here.

[Rorschach112]

Hello

Download the attachment at the end of this post (this will be your runscanner file fixed by me)

• Unzip it to your desktop then double click the runscanner icon this will run the program.
• You will notice several entries in red.
• Click the button at the top called Fix selected items
• Accept the warning(s) and repeat until they are all gone.
• Reboot your PC

Please download Deckard's System Scanner (DSS) and save it to your Desktop.

• Close all other windows before proceeding.
• Double-click on dss.exe and follow the prompts.
• If your anti-virus or firewall complains, please allow this script to run as it is not malicious.
• When it has finished, dss will open two Notepads main.txt and extra.txt -- please copy (CTRL+A and then CTRL+C) and paste (CTRL+V) the contents of main.txt and extra.txt in your next reply.

[98sports]

So step 1 went off without a hitch... but DSS still stops after 2 minutes and leaves me with the windows has encountered an error message (for the record, the file included in the error report is: C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\4c7d_appcompat.txt).

Is my computer FUBAR'd....

[Rorschach112]

Nope, do this

Please visit this web page for instructions for downloading and running ComboFix

http://www.bleepingc...to-use-combofix

This includes installing the Windows XP Recovery Console in case you have not installed it yet.

For more information on the Windows XP Recovery Console read http://support.microsoft.com/kb/314058.

Once you install the Recovery Console, when you reboot your computer, you'll see the option for the Recovery Console now as well. Don't select Recovery Console as we don't need it. By default, your main OS is selected there. The screen stays for 2 seconds and then it proceeds to load Windows. That is normal.

Post the log from ComboFix when you've accomplished that, along with a new HijackThis log.

[98sports]

Combo fix doesnt work either (it just doesnt start up) whether I drag the Windows Recovery into it or not. Spybot doesnt work. Malwarebytes doesnt either. And as stated DSS doesnt finish.

[Rorschach112]

Rename ComboFix.exe to ABC.exe and try run it