[bluenote]

Below is Hijack Log and Scan Report from Ewido.
Ewido removes Virtumonde but it reappears when I reboot.
thanks for the help. I'm a novice here but doing my best..

Hijack Log:
ogfile of HijackThis v1.99.1
Scan saved at 5:03:34 PM, on 9/22/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\system32\SK6200dm.exe
C:\Program Files\Trend Micro\Internet Security\pccguide.exe
C:\Program Files\Trend Micro\Internet Security\PCClient.exe
C:\Program Files\Trend Micro\Internet Security\TMOAgent.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe
C:\Program Files\palmOne\Hotsync.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\WINDOWS\System32\GEARSEC.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Dantz\Retrospect\retrorun.exe
C:\Program Files\Trend Micro\Internet Security\Tmntsrv.exe
C:\Program Files\Trend Micro\Internet Security\tmproxy.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Trend Micro\Internet Security\PccPfw.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\WINDOWS\system32\wuauclt.exe
C:\HijackThis\HijackThis.exe
C:\Program Files\Mozilla Firefox\firefox.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://news.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dellnet.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: MSEvents Object - {827DC836-DD9F-4A68-A602-5812EB50A834} - C:\WINDOWS\system32\ddccd.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
O4 - HKLM\..\Run: [Hot Key Kbd 2690 Daemon] SK6200dm.exe
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security\pccguide.exe"
O4 - HKLM\..\Run: [PCClient.exe] "C:\Program Files\Trend Micro\Internet Security\PCClient.exe"
O4 - HKLM\..\Run: [TM Outbreak Agent] "C:\Program Files\Trend Micro\Internet Security\TMOAgent.exe" /run
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKCU\..\Run: [Win-Hand] C:\Program Files\Win-Hand\Win-HandAnySer.exe
O4 - Startup: palmOne Registration.lnk = C:\Program Files\palmOne\register.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: DataViz Inc Messenger.lnk = C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe
O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\palmOne\Hotsync.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar3.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar3.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar3.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar3.dll/cmsimilar.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (HKCU)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://www.pestscan....r/axscanner.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefend...can8/oscan8.cab
O16 - DPF: {638AF6A2-81A1-4655-9FFA-9FC09CDE22CF} (CScanner Object) - http://www.pestscan....er/ppctlcab.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1124253160556
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft...free/asinst.cab
O20 - Winlogon Notify: ddccd - C:\WINDOWS\system32\ddccd.dll
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: CWShredder Service - InterMute, Inc. - C:\Downloaded Programs\cwshredder.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSEC.EXE
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Trend Micro Personal Firewall (PccPfw) - Trend Micro Incorporated. - C:\Program Files\Trend Micro\Internet Security\PccPfw.exe
O23 - Service: Retrospect Launcher (RetroLauncher) - Dantz Development Corporation - C:\Program Files\Dantz\Retrospect\retrorun.exe
O23 - Service: Retrospect Helper - Dantz Development Corporation - C:\Program Files\Dantz\Retrospect\rthlpsvc.exe
O23 - Service: Trend NT Realtime Service (Tmntsrv) - Trend Micro Incorporated. - C:\Program Files\Trend Micro\Internet Security\Tmntsrv.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Incorporated. - C:\Program Files\Trend Micro\Internet Security\tmproxy.exe

EWIDO SCAN REPORT:


wido security suite - Scan report
---------------------------------------------------------

+ Created on: 4:41:03 PM, 9/22/2005
+ Report-Checksum: 8F4D6D7D

+ Scan result:

HKLM\SOFTWARE\Classes\CLSID\{2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} -> Spyware.MiniBug : Cleaned with backup
:mozilla.7:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Overture : Cleaned with backup
:mozilla.11:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Overture : Cleaned with backup
:mozilla.14:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
:mozilla.15:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.26:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
:mozilla.27:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.28:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.29:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.30:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.31:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.32:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.49:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
:mozilla.50:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
:mozilla.51:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
:mozilla.66:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Bfast : Cleaned with backup
:mozilla.82:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.83:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.84:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.85:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.116:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.121:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Falkag : Cleaned with backup
:mozilla.151:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.152:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.153:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.154:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.155:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.163:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.164:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.165:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.166:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.167:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.168:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.169:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.170:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.171:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.172:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.173:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.174:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.175:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.176:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.177:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.178:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.179:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.180:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.181:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.182:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.183:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.184:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.185:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.186:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.187:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.188:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.189:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.190:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.191:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.192:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.193:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.194:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.195:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.196:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.197:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.198:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.199:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.200:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.201:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.202:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.203:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.204:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.205:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.206:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.207:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.224:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.225:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.226:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.227:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.228:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.318:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.319:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.320:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.321:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.322:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.368:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.369:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.370:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.371:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.372:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.373:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.374:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.375:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.376:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.436:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.437:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.531:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Specificclick : Cleaned with backup
:mozilla.532:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Specificclick : Cleaned with backup
:mozilla.541:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Bluestreak : Cleaned with backup
:mozilla.544:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Linksynergy : Cleaned with backup
:mozilla.545:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Linksynergy : Cleaned with backup
:mozilla.550:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Commission-junction : Cleaned with backup
:mozilla.551:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Commission-junction : Cleaned with backup
:mozilla.564:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.565:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.566:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.583:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.584:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.690:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.724:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.247realmedia : Cleaned with backup
:mozilla.731:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies-1.txt -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.55:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup
:mozilla.56:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup
:mozilla.63:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies.txt -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.64:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies.txt -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.65:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies.txt -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.93:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies.txt -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.94:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies.txt -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.95:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies.txt -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.96:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies.txt -> Spyware.Cookie.Revenue : Cleaned with backup
:mozilla.186:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies.txt -> Spyware.Cookie.Adtech : Cleaned with backup
:mozilla.187:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies.txt -> Spyware.Cookie.Adtech : Cleaned with backup
:mozilla.247:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.346:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies.txt -> Spyware.Cookie.Adocean : Cleaned with backup
:mozilla.347:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies.txt -> Spyware.Cookie.Adocean : Cleaned with backup
:mozilla.430:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies.txt -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.431:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies.txt -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.542:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.544:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.588:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.615:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies.txt -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.665:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies.txt -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.678:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies.txt -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.755:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies.txt -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.763:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies.txt -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.784:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies.txt -> Spyware.Cookie.Qksrv : Cleaned with backup
:mozilla.785:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies.txt -> Spyware.Cookie.Qksrv : Cleaned with backup
:mozilla.817:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies.txt -> Spyware.Cookie.Coremetrics : Cleaned with backup
:mozilla.818:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.819:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.820:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.821:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.822:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.823:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.825:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.832:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.834:C:\Documents and Settings\Susan\Application Data\Mozilla\Firefox\Profiles\default.s76\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.8:C:\Documents and Settings\Susan\Application Data\Mozilla\Profiles\default\bcvfo3pa.slt\cookies.txt -> Spyware.Cookie.Centrport : Cleaned with backup
:mozilla.10:C:\Documents and Settings\Susan\Application Data\Mozilla\Profiles\default\bcvfo3pa.slt\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.20:C:\Documents and Settings\Susan\Application Data\Mozilla\Profiles\default\bcvfo3pa.slt\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.21:C:\Documents and Settings\Susan\Application Data\Mozilla\Profiles\default\bcvfo3pa.slt\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.22:C:\Documents and Settings\Susan\Application Data\Mozilla\Profiles\default\bcvfo3pa.slt\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.23:C:\Documents and Settings\Susan\Application Data\Mozilla\Profiles\default\bcvfo3pa.slt\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.24:C:\Documents and Settings\Susan\Application Data\Mozilla\Profiles\default\bcvfo3pa.slt\cookies.txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
:mozilla.27:C:\Documents and Settings\Susan\Application Data\Mozilla\Profiles\default\bcvfo3pa.slt\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.31:C:\Documents and Settings\Susan\Application Data\Mozilla\Profiles\default\bcvfo3pa.slt\cookies.txt -> Spyware.Cookie.Specificpop : Cleaned with backup
:mozilla.33:C:\Documents and Settings\Susan\Application Data\Mozilla\Profiles\default\bcvfo3pa.slt\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
C:\Documents and Settings\Susan\Local Settings\Application Data\Wildtangent\Cdacache\00\00\0F.dat/files\wtvh.dll -> Spyware.WildTangent : Cleaned with backup
C:\RECYCLER\S-1-5-21-3613478615-2639864554-1753843077-1007\Dc3121\[email protected][2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
C:\WINDOWS\SYSTEM32\ddccd.dll -> Spyware.Virtumonde : Cleaned with backup


::Report End

[Advertisements]

Welcome bluenote to Geeks to Go!

Please disable SpybotSD’s protection, as it may hinder the removal of the infection. You can enable it after you're clean.

Open Spybot and click on Mode and check Advanced Mode
Check yes to next window.
Click on Tools in bottom left hand corner.
Click on Resident icon.
Uncheck Teatimer box and/or Uncheck Resident.
Close Spybot.

***

Please print these instructions out for use in Safe Mode.
Please note: your AntiVirus program may prompt you to a malicious program running. Allow the entire script to run.

Please download VundoFix.exe to your desktop.

• Double-click VundoFix.exe to extract the files
• This will create a VundoFix folder on your desktop.
• After the files are extracted, please reboot your computer into Safe Mode. You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight Safe Mode then hit enter.
• Once in safe mode open the VundoFix folder and doubleclick on KillVundo.bat
• You will first be presented with a warning and a list of forums to seek help at.
  it should look like this
  

  VundoFix V2.1 by Atri
  By pressing enter you agree that you are using this at your own risk
  Please seek assistance at one of the following forums:
  http://www.atribune.org/forums
  http://www.247fixes.com/forums
  http://www.geekstogo.com/forum
  http://forums.net-integration.net
  

• At this point press enter one time.
  
• Next you will see:
  

  Type in the filepath as instructed by the forum staff
  Then Press Enter, Then F6, Then Enter Again to continue with the fix.

• At this point please type the following file path (make sure to enter it exactly as below!):
  • C:\WINDOWS\system32\ddccd.dll
• Press Enter, then press the F6 key, then press Enter one more time to continue with the fix.
  
• Next you will see:
  

  Please type in the second filepath as instructed by the forum staff
  Then Press Enter, Then F6, Then Enter Again to continue with the fix.

• At this point please type the following file path (make sure to enter it exactly as below!):C:\WINDOWS\system32\dccdd.*
  This will be the vundo filename spelt backwards. for example if the vundo dll was vundo.dll you would have the user enter odnuv.*
• Press Enter, then press the F6 key, then press Enter one more time to continue with the fix.
  
• The fix will run then HijackThis will open.
• In HijackThis, please place a check next to the following items and click FIX CHECKED:O2 - BHO: MSEvents Object - {827DC836-DD9F-4A68-A602-5812EB50A834} - C:\WINDOWS\system32\ddccd.dll
  
  O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
  
  O20 - Winlogon Notify: ddccd - C:\WINDOWS\system32\ddccd.dll
• After you have fixed these items, close Hijackthis and Press any key to Force a reboot of your computer.
• Pressing any key will cause a "Blue Screen of Death" this is normal, do not worry!
• Once your machine reboots please continue with the instructions below.

Download and install Cleanup from here (Alternate site if the above is not working, go Here)

Open Cleanup! by double-clicking the icon on your desktop (or from the Start > All Programs menu).
Set the program up as follows:
Click "Options..."
Move the arrow down to "Custom CleanUp!"
Put a check next to the following (Make sure nothing else is checked!):

• Empty Recycle Bins
• Delete Cookies
• Delete Prefetch files
• Cleanup! All Users

Click OK
Press the CleanUp! button to start the program.

It may ask you to reboot at the end, click NO.

Then, please run this online virus scan: ActiveScan

Copy the results of the ActiveScan and paste them here along with a new HijackThis log and the vundofix.txt file from the vundofix folder into this topic.

[g2i2r4]

Welcome bluenote to Geeks to Go!

Please disable SpybotSD’s protection, as it may hinder the removal of the infection. You can enable it after you're clean.

Open Spybot and click on Mode and check Advanced Mode
Check yes to next window.
Click on Tools in bottom left hand corner.
Click on Resident icon.
Uncheck Teatimer box and/or Uncheck Resident.
Close Spybot.

***

Please print these instructions out for use in Safe Mode.
Please note: your AntiVirus program may prompt you to a malicious program running. Allow the entire script to run.

Please download VundoFix.exe to your desktop.

• Double-click VundoFix.exe to extract the files
• This will create a VundoFix folder on your desktop.
• After the files are extracted, please reboot your computer into Safe Mode. You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight Safe Mode then hit enter.
• Once in safe mode open the VundoFix folder and doubleclick on KillVundo.bat
• You will first be presented with a warning and a list of forums to seek help at.
  it should look like this
  

  VundoFix V2.1 by Atri
  By pressing enter you agree that you are using this at your own risk
  Please seek assistance at one of the following forums:
  http://www.atribune.org/forums
  http://www.247fixes.com/forums
  http://www.geekstogo.com/forum
  http://forums.net-integration.net
  

• At this point press enter one time.
  
• Next you will see:
  

  Type in the filepath as instructed by the forum staff
  Then Press Enter, Then F6, Then Enter Again to continue with the fix.

• At this point please type the following file path (make sure to enter it exactly as below!):
  • C:\WINDOWS\system32\ddccd.dll
• Press Enter, then press the F6 key, then press Enter one more time to continue with the fix.
  
• Next you will see:
  

  Please type in the second filepath as instructed by the forum staff
  Then Press Enter, Then F6, Then Enter Again to continue with the fix.

• At this point please type the following file path (make sure to enter it exactly as below!):C:\WINDOWS\system32\dccdd.*
  This will be the vundo filename spelt backwards. for example if the vundo dll was vundo.dll you would have the user enter odnuv.*
• Press Enter, then press the F6 key, then press Enter one more time to continue with the fix.
  
• The fix will run then HijackThis will open.
• In HijackThis, please place a check next to the following items and click FIX CHECKED:O2 - BHO: MSEvents Object - {827DC836-DD9F-4A68-A602-5812EB50A834} - C:\WINDOWS\system32\ddccd.dll
  
  O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
  
  O20 - Winlogon Notify: ddccd - C:\WINDOWS\system32\ddccd.dll
• After you have fixed these items, close Hijackthis and Press any key to Force a reboot of your computer.
• Pressing any key will cause a "Blue Screen of Death" this is normal, do not worry!
• Once your machine reboots please continue with the instructions below.

Download and install Cleanup from here (Alternate site if the above is not working, go Here)

Open Cleanup! by double-clicking the icon on your desktop (or from the Start > All Programs menu).
Set the program up as follows:
Click "Options..."
Move the arrow down to "Custom CleanUp!"
Put a check next to the following (Make sure nothing else is checked!):

• Empty Recycle Bins
• Delete Cookies
• Delete Prefetch files
• Cleanup! All Users

Click OK
Press the CleanUp! button to start the program.

It may ask you to reboot at the end, click NO.

Then, please run this online virus scan: ActiveScan

Copy the results of the ActiveScan and paste them here along with a new HijackThis log and the vundofix.txt file from the vundofix folder into this topic.

[bluenote]

Hi thanks.
Here are the logs, was able to complete all instructions except when i clicked "fix checked" in Hijack This, I couldn't find the line:
02-BHO: MSEvents Object...-C:\WINDOWS\system32\ddccd.dll

**
PANDA
Detected Disinfected
Virus 0 0
Spyware 0 0
Hacking Tools 0 0
Dialers 0 0
Security Risks 0 0
Suspicious files 0 0

VUNDOFIX LOG

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 [email protected]
Suspending PID 160 'smss.exe'
Threads [164][168][172]

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 [email protected]
Killing PID 1540 'explorer.exe'
Killing PID 1540 'explorer.exe'
Killing PID 1540 'explorer.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 [email protected]
Error, Cannot find a process with an image name of rundll32.exe

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 [email protected]
Killing PID 232 'winlogon.exe'
Killing PID 232 'winlogon.exe'
File Deleted sucessfully.
Files Deleted sucessfully.


HIJACK
Logfile of HijackThis v1.99.1
Scan saved at 7:06:27 PM, on 9/22/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\system32\SK6200dm.exe
C:\Program Files\Trend Micro\Internet Security\pccguide.exe
C:\Program Files\Trend Micro\Internet Security\PCClient.exe
C:\Program Files\Trend Micro\Internet Security\TMOAgent.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe
C:\Program Files\palmOne\Hotsync.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\WINDOWS\System32\GEARSEC.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Trend Micro\Internet Security\Tmntsrv.exe
C:\Program Files\Trend Micro\Internet Security\tmproxy.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Trend Micro\Internet Security\PccPfw.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\Dantz\Retrospect\retrorun.exe
C:\WINDOWS\System32\vssvc.exe
C:\WINDOWS\System32\dllhost.exe
C:\WINDOWS\System32\dllhost.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\WINDOWS\msagent\AgentSvr.exe
C:\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://news.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dellnet.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
O4 - HKLM\..\Run: [Hot Key Kbd 2690 Daemon] SK6200dm.exe
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security\pccguide.exe"
O4 - HKLM\..\Run: [PCClient.exe] "C:\Program Files\Trend Micro\Internet Security\PCClient.exe"
O4 - HKLM\..\Run: [TM Outbreak Agent] "C:\Program Files\Trend Micro\Internet Security\TMOAgent.exe" /run
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKCU\..\Run: [Win-Hand] C:\Program Files\Win-Hand\Win-HandAnySer.exe
O4 - Startup: palmOne Registration.lnk = C:\Program Files\palmOne\register.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: DataViz Inc Messenger.lnk = C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe
O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\palmOne\Hotsync.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar3.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar3.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar3.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar3.dll/cmsimilar.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (HKCU)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://www.pestscan....r/axscanner.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefend...can8/oscan8.cab
O16 - DPF: {638AF6A2-81A1-4655-9FFA-9FC09CDE22CF} (CScanner Object) - http://www.pestscan....er/ppctlcab.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1124253160556
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft...free/asinst.cab
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: CWShredder Service - InterMute, Inc. - C:\Downloaded Programs\cwshredder.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSEC.EXE
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Trend Micro Personal Firewall (PccPfw) - Trend Micro Incorporated. - C:\Program Files\Trend Micro\Internet Security\PccPfw.exe
O23 - Service: Retrospect Launcher (RetroLauncher) - Dantz Development Corporation - C:\Program Files\Dantz\Retrospect\retrorun.exe
O23 - Service: Retrospect Helper - Dantz Development Corporation - C:\Program Files\Dantz\Retrospect\rthlpsvc.exe
O23 - Service: Trend NT Realtime Service (Tmntsrv) - Trend Micro Incorporated. - C:\Program Files\Trend Micro\Internet Security\Tmntsrv.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Incorporated. - C:\Program Files\Trend Micro\Internet Security\tmproxy.exe

[g2i2r4]

The logs look clean, weldone

Is the computer running ok?
If so, shall I post you some tips for the future and close this topic?

[bluenote]

Hi,

Looks good, thanks again. I have turned off the computer and turned it back on and the virus did not reappear.

Question: Do you know anything about Eudora mail program? I'm getting a message when it opens that Eudora could not install Eurora MAPI system because MAPI.DLL and MAPI32.DLL could not be renamed.

On a separate note, I was able to fix a message that said phonebook dialer could not be found. It would come up when I browsed web pages. (my vpn connection was searching for a dialup connection)

In terms of security:

Have turned Spybot back on.
I added spyware blaster. (already had Ad Aware)
I added IE-SPYAD
I uninstalled Ewido as I don't think it is a free program.
I uninstalled CWShredder as it was crashing.
I disabled some commands (java? activex?) on both Explorer browser and Firefox (my preferred browser) according to instructions on castlecops site (see below for site address ) and Jason Levine's browser security tests: http://castlecops.co...tlite7736-.html
Also, as per site above, I have put cookies on high security rather than medium, forcing a prompt.
My Trend Micro subscription is expiring, so I will renew for $24.95 unless you have strong conviction that other antivirus software is much better.

[g2i2r4]

Ewido is free for two weeks, it's a trial.

I asked one of our experts (Noadhfear ) what Antivirus he would recommend:

http://www.my-etrust.com/microsoft/

A lot less resource intensive, easy interface, good AV, free year trial.
It will save you the money and you can try and see if you like it.

As for the Eudora:
Go to Tools | options | MAPI and set it to "never".

Let me know if this works.


EDIT:
As there has been no reply from the original poster for more than two weeks this topic is now closed.

If you are the original poster and still need assistance, please send me a PM.

Edited by g2i2r4, 15 October 2005 - 04:14 PM.