1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Many issues, confused :(

Discussion in 'Virus & Other Malware Removal' started by narski1, Apr 3, 2008.

Thread Status:
Not open for further replies.
Advertisement
  1. narski1

    narski1 Thread Starter

    Joined:
    Apr 3, 2008
    Messages:
    7
    McAfee has been telling me I have generic.dx trojan on my computer and doesn't seem able to remove it. Also I have had some flickering of the display ( not the entire monitor, just sometimes the background to a running program). Since it isn't the entire screen I was thinking it was more of a windows problem than my graphics cards. The most annoying problem I have is that when windows starts up explorer seems to finish loading, then it flickers off, then back on. When this happens the windows background I have can still be seen but the task bar and shortcut icons all disappear. Here is my HijackThis log file:
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 11:40:31 AM, on 4/3/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16608)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    c:\program files\common files\mcafee\mna\mcnasvc.exe
    c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
    C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Program Files\McAfee\MPF\MPFSrv.exe
    C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Linksys\WUSB300N\WLService.exe
    C:\Program Files\Linksys\WUSB300N\WUSB300N.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\dllhost.exe
    C:\PROGRA~1\McAfee.com\Agent\mcagent.exe
    C:\WINDOWS\ehome\ehtray.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    C:\WINDOWS\eHome\ehmsas.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe
    C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\WINDOWS\system32\rundll32.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
    O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
    O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
    O4 - HKCU\..\Run: [EasyLinkAdvisor] "C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1203629531656
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
    O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
    O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
    O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
    O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
    O23 - Service: WUSB300NSvc - Unknown owner - C:\Program Files\Linksys\WUSB300N\WLService.exe

    --
    End of file - 8292 bytes

    Please Help!
     
  2. cybertech

    cybertech Retired Moderator

    Joined:
    Apr 16, 2002
    Messages:
    72,115
    Hi Welcome to TSG!!


    Please visit this webpage for instructions for downloading and running ComboFix.

    Post the log from ComboFix when you've accomplished that, along with a new HijackThis log.
     
  3. narski1

    narski1 Thread Starter

    Joined:
    Apr 3, 2008
    Messages:
    7
    Thanks, I'll dowload and do the scan asap. Been a really hectic week, sorry it took me so long to check. Give me a day to accomplish this, still have so much other things to do.
     
  4. cybertech

    cybertech Retired Moderator

    Joined:
    Apr 16, 2002
    Messages:
    72,115
    No problem.
     
  5. narski1

    narski1 Thread Starter

    Joined:
    Apr 3, 2008
    Messages:
    7
    ComboFix:
    ComboFix 08-04-04.1 - user 2008-04-06 14:23:34.1 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1870 [GMT -7:00]
    Running from: C:\Documents and Settings\user\Desktop\ComboFix.exe
    * Created a new restore point
    * Resident AV is active


    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    J:\Autorun.inf

    .
    ((((((((((((((((((((((((( Files Created from 2008-03-06 to 2008-04-06 )))))))))))))))))))))))))))))))
    .

    2008-04-04 07:56 . 2008-04-04 07:56 <DIR> d-------- C:\Documents and Settings\user\Logs
    2008-04-03 12:39 . 2008-04-06 09:05 54,156 --ah----- C:\WINDOWS\QTFont.qfn
    2008-04-03 12:39 . 2008-04-03 12:39 1,409 --a------ C:\WINDOWS\QTFont.for
    2008-04-03 12:38 . 2008-04-03 12:38 <DIR> d-------- C:\Program Files\iPod
    2008-04-03 11:17 . 2008-04-03 11:17 <DIR> d-------- C:\Program Files\Trend Micro
    2008-04-03 10:32 . 2008-04-03 10:33 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
    2008-04-03 10:32 . 2008-04-03 11:12 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2008-04-02 15:42 . 2008-04-06 09:59 <DIR> d-------- C:\Documents and Settings\user\Application Data\AVG7
    2008-04-02 15:42 . 2008-04-02 15:42 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
    2008-04-02 15:42 . 2008-04-02 15:42 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
    2008-04-02 15:42 . 2008-04-02 15:45 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg7
    2008-03-29 14:19 . 2008-03-29 14:19 <DIR> d-------- C:\Documents and Settings\user\Application Data\gtk-2.0
    2008-03-29 13:42 . 2008-03-29 14:20 <DIR> d-------- C:\Documents and Settings\user\Application Data\Wireshark
    2008-03-29 13:29 . 2008-03-29 13:29 <DIR> d-------- C:\Program Files\Wireshark
    2008-03-29 13:29 . 2008-03-29 13:29 <DIR> d-------- C:\Program Files\WinPcap
    2008-03-28 23:37 . 2008-03-28 23:37 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
    2008-03-28 23:37 . 2008-03-28 23:37 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts
    2008-03-26 14:15 . 2008-03-26 14:15 <DIR> d-------- C:\Documents and Settings\user\Application Data\Ceedo
    2008-03-25 14:07 . 2008-03-25 14:07 <DIR> d-------- C:\Logs
    2008-03-20 02:00 . 2008-03-26 12:36 <DIR> d-------- C:\Program Files\Xvid
    2008-03-18 13:43 . 2008-03-26 12:37 <DIR> d-------- C:\Program Files\GSpot
    2008-03-18 13:13 . 2008-03-18 13:13 8 --a------ C:\WINDOWS\system32\sd3859.bin
    2008-03-18 13:09 . 2008-03-18 13:09 8 --a------ C:\WINDOWS\system32\sd243f.bin
    2008-03-15 15:53 . 2008-03-15 15:53 <DIR> d-------- C:\Program Files\Google
    2008-03-07 21:28 . 2008-03-07 21:28 <DIR> d-------- C:\Documents and Settings\user\Application Data\vlc

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-04-06 02:05 --------- d-----w C:\Documents and Settings\user\Application Data\Azureus
    2008-04-03 19:39 --------- d-----w C:\Program Files\iTunes
    2008-04-03 19:38 --------- d-----w C:\Program Files\QuickTime
    2008-04-03 17:18 --------- d-----w C:\Program Files\Cheat Engine
    2008-04-02 17:27 --------- d-----w C:\Documents and Settings\All Users\Application Data\WinZip
    2008-03-28 23:37 --------- d-----w C:\Program Files\SpeedFan
    2008-03-28 01:07 --------- d-----w C:\Documents and Settings\user\Application Data\AdobeUM
    2008-03-26 23:06 --------- d-----w C:\Program Files\McAfee
    2008-03-26 23:06 --------- d-----w C:\Program Files\Common Files\Blizzard Entertainment
    2008-03-26 19:36 --------- d-----w C:\Program Files\DivX
    2008-03-26 19:36 --------- d-----w C:\Program Files\AC3Filter
    2008-03-11 18:54 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ghost Controls
    2008-03-11 00:21 --------- d-----w C:\Documents and Settings\user\Application Data\Apple Computer
    2008-03-06 21:16 --------- d-----w C:\Program Files\Azureus
    2008-03-04 15:04 --------- d-----w C:\Documents and Settings\user\Application Data\CyberLink
    2008-03-04 15:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\CyberLink
    2008-02-26 16:03 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-02-26 13:54 --------- d-----w C:\Program Files\MSXML 6.0
    2008-02-26 12:29 --------- d-----w C:\Program Files\RegCure
    2008-02-26 12:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\DVD Shrink
    2008-02-26 11:57 --------- d-----w C:\Program Files\DVD Region-Free
    2008-02-26 11:55 --------- d-----w C:\Program Files\DVD Shrink
    2008-02-26 11:55 --------- d-----w C:\Program Files\DVD Decrypter
    2008-02-25 20:57 --------- d-----w C:\Program Files\Ghost Control
    2008-02-25 20:25 --------- d-----w C:\Documents and Settings\All Users\Application Data\Azureus
    2008-02-25 18:33 --------- d-----w C:\Program Files\MSBuild
    2008-02-25 18:31 --------- d-----w C:\Program Files\Reference Assemblies
    2008-02-23 22:17 --------- d-----w C:\Documents and Settings\All Users\Application Data\FLEXnet
    2008-02-23 20:43 --------- d-----w C:\Program Files\Linksys
    2008-02-23 20:14 --------- d-----w C:\Program Files\Common Files\Adobe
    2008-02-23 20:08 --------- d-----w C:\Program Files\Common Files\Macrovision Shared
    2008-02-23 18:56 --------- d--ha-w C:\Documents and Settings\All Users\Application Data\GTek
    2008-02-23 18:56 --------- d--h--w C:\Documents and Settings\user\Application Data\GTek
    2008-02-23 18:56 --------- d-----w C:\Program Files\Linksys EasyLink Advisor
    2008-02-23 16:51 --------- d-----w C:\Program Files\Microsoft SQL Server
    2008-02-23 16:47 --------- d-----w C:\Program Files\Microsoft Visual Studio .NET 2003
    2008-02-23 16:47 --------- d-----w C:\Program Files\Common Files\Crystal Decisions
    2008-02-23 16:46 --------- d-----w C:\Program Files\Microsoft Works
    2008-02-23 16:46 --------- d-----w C:\Program Files\Microsoft Small Business
    2008-02-23 16:38 --------- d-----w C:\Program Files\Microsoft ActiveSync
    2008-02-23 16:38 --------- d-----w C:\Program Files\Common Files\L&H
    2008-02-23 16:37 --------- d-----w C:\Program Files\Microsoft.NET
    2008-02-23 16:10 --------- d-----w C:\Program Files\PowerISO
    2008-02-23 00:58 --------- d-----w C:\Program Files\DFX
    2008-02-23 00:58 --------- d-----w C:\Documents and Settings\All Users\Application Data\DFX
    2008-02-23 00:57 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
    2008-02-22 21:44 --------- d-----w C:\Program Files\VideoLAN
    2008-02-22 00:20 --------- d-----w C:\Program Files\YourWare Solutions
    2008-02-21 23:57 --------- d-----w C:\Program Files\Bonjour
    2008-02-21 23:57 --------- d-----w C:\Program Files\Apple Software Update
    2008-02-21 23:57 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
    2008-02-21 23:56 --------- d-----w C:\Program Files\Common Files\Apple
    2008-02-21 23:56 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
    2008-02-21 23:40 36,734 ----a-w C:\WINDOWS\system32\OggDSuninst.exe
    2008-02-21 23:39 --------- d-----w C:\Program Files\viewsonic
    2008-02-21 23:38 --------- d-----w C:\Documents and Settings\user\Application Data\Leadertech
    2008-02-21 23:33 --------- d-----w C:\Program Files\Common Files\McAfee
    2008-02-21 23:33 --------- d-----w C:\Documents and Settings\user\Application Data\Logitech
    2008-02-21 23:33 --------- d-----w C:\Documents and Settings\LocalService\Application Data\DivX
    2008-02-21 23:25 --------- d-----w C:\Program Files\Logitech
    2008-02-21 23:25 --------- d-----w C:\Program Files\Common Files\Logitech
    2008-02-21 23:14 --------- d-----w C:\Program Files\Lavasoft
    2008-02-21 23:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
    2008-02-21 23:11 --------- d-----w C:\Documents and Settings\user\Application Data\DivX
    2008-02-21 22:37 --------- d-----w C:\Program Files\TGTSoft
    2008-02-21 22:27 --------- d-----w C:\Documents and Settings\All Users\Application Data\McAfee
    2008-02-21 22:26 --------- d-----w C:\Program Files\McAfee.com
    2008-02-21 21:52 --------- d-----w C:\Program Files\Windows Media Connect 2
    2008-02-21 21:18 --------- d-----w C:\Program Files\Ahead
    2008-02-19 03:45 --------- d-----w C:\Program Files\MainConcept
    2008-02-19 03:44 --------- d-----w C:\Program Files\CyberLink
    2008-02-19 03:43 --------- d-----w C:\Documents and Settings\All Users\Application Data\nView_Profiles
    2008-02-19 03:36 --------- d-----w C:\Program Files\ASUS
    2008-02-19 03:35 --------- d-----w C:\Program Files\Common Files\InstallShield
    2008-02-19 03:31 86,016 ----a-w C:\WINDOWS\system32\OpenAL32.dll
    2008-02-19 03:31 262,144 ----a-w C:\WINDOWS\system32\wrap_oal.dll
    2008-02-19 03:24 --------- d-----w C:\Program Files\Futuremark
    2008-02-19 03:16 315,392 ----a-w C:\WINDOWS\HideWin.exe
    2008-02-19 03:16 --------- d-----w C:\Program Files\Realtek
    2008-02-19 03:12 --------- d-----w C:\Documents and Settings\user\Application Data\InstallShield
    2008-02-19 03:07 155,995 ----a-w C:\WINDOWS\java\Packages\2IDBNN9J.ZIP
    2008-02-19 03:04 --------- d-----w C:\Program Files\microsoft frontpage
    2008-02-19 03:01 --------- d-----w C:\Program Files\Windows Plus
    2008-01-29 19:02 107,368 ----a-w C:\WINDOWS\system32\GEARAspi.dll
    2002-09-11 14:26 63,730 ----a-w C:\Program Files\viewsonicinstruct_xp.pdf
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-10-08 05:01 15360]
    "STYLEXP"="C:\Program Files\TGTSoft\StyleXP\StyleXP.exe" [2006-05-24 11:31 1372160]
    "FreeRAM XP"="C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" [2006-03-23 01:13 1591808]
    "EasyLinkAdvisor"="C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" [2007-03-15 19:16 454784]
    "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-05 14:56 64512]
    "RTHDCPL"="RTHDCPL.EXE" [2007-10-16 19:30 16855552 C:\WINDOWS\RTHDCPL.exe]
    "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 02:41 8523776]
    "nwiz"="nwiz.exe" [2007-12-05 02:41 1626112 C:\WINDOWS\system32\nwiz.exe]
    "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 02:41 81920]
    "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 21:24 32768]
    "Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2004-10-21 14:28 29696 C:\WINDOWS\KHALMNPR.Exe]
    "mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2007-08-03 23:33 582992]
    "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
    "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-04-02 15:42 219136]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
    "InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
    "{93994DE8-8239-4655-B1D1-5F4E91300429}"= C:\Program Files\DVD Region-Free\DVDShell.dll [2003-08-26 11:58 49152]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "msacm.l3acm"= l3codecx.acm
    "MSVideo8"= VfWWDM32.dll
    "vidc.asv2"= asusasv2.dll
    "msacm.ac3filter"= ac3filter.acm
    "msacm.divxa32"= DivXa32.acm

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Service Manager.lnk]
    backup=C:\WINDOWS\pss\Service Manager.lnkCommon Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC]
    --a------ 2008-04-02 15:43 579072 C:\PROGRA~1\Grisoft\AVG7\avgcc.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusDisableNotify"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\Messenger\\msmsgs.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "C:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
    "C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "C:\\Games\\Hellgate London\\Launcher.exe"=
    "C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
    "C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
    "C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
    "C:\\Program Files\\iTunes\\iTunes.exe"=

    R0 nvgts;nvgts;C:\WINDOWS\system32\DRIVERS\nvgts.sys [2007-08-09 03:11]
    R2 WUSB300NSvc;WUSB300NSvc;"C:\Program Files\Linksys\WUSB300N\WLService.exe" "WUSB300N.exe" []
    R3 3xHybrid;3xHybrid service;C:\WINDOWS\system32\DRIVERS\3xHybrid.sys [2005-12-26 01:08]
    S3 USB_RNDIS_XP;Linksys Wireless-G USB Network Adapter with SpeedBooster Driver;C:\WINDOWS\system32\DRIVERS\usb8023.sys [2004-10-08 05:01]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{93dba132-fb79-11dc-bd37-001d7e9b0501}]
    \Shell\AutoRun\command - K:\Autorun.exe /run
    \Shell\Shell00\Command - K:\Autorun.exe /run
    \Shell\Shell01\Command - K:\Autorun.exe /action
    \Shell\Shell02\Command - K:\Autorun.exe /uninstall

    .
    Contents of the 'Scheduled Tasks' folder
    "2008-02-21 22:26:10 C:\WINDOWS\Tasks\McDefragTask.job"
    - c:\program files\mcafee\mqc\QcConsol.exe'
    "2008-03-01 09:02:36 C:\WINDOWS\Tasks\McQcTask.job"
    - c:\program files\mcafee\mqc\QcConsol.exe
    "2008-04-06 16:04:36 C:\WINDOWS\Tasks\RegCure Program Check.job"
    - C:\Program Files\RegCure\RegCure.exe
    "2008-03-06 14:48:17 C:\WINDOWS\Tasks\RegCure.job"
    - C:\Program Files\RegCure\RegCure.exe
    .
    **************************************************************************

    catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-04-06 14:26:37
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-04-06 14:26:58
    ComboFix-quarantined-files.txt 2008-04-06 21:26:55
    Pre-Run: 158,485,180,416 bytes free
    Post-Run: 158,475,190,272 bytes free
    .
    2008-03-27 16:08:40 --- E O F ---
     
  6. narski1

    narski1 Thread Starter

    Joined:
    Apr 3, 2008
    Messages:
    7
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 4:28:57 PM, on 4/6/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16608)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    c:\program files\common files\mcafee\mna\mcnasvc.exe
    c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
    C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Program Files\McAfee\MPF\MPFSrv.exe
    C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Linksys\WUSB300N\WLService.exe
    C:\Program Files\Linksys\WUSB300N\WUSB300N.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\PROGRA~1\McAfee.com\Agent\mcagent.exe
    C:\WINDOWS\ehome\ehtray.exe
    C:\WINDOWS\eHome\ehmsas.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe
    C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    C:\WINDOWS\System32\svchost.exe
    C:\PROGRA~1\McAfee\VIRUSS~1\mcvsshld.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\WINDOWS\system32\notepad.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\WINDOWS\system32\NOTEPAD.EXE

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
    O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
    O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
    O4 - HKCU\..\Run: [EasyLinkAdvisor] "C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1203629531656
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
    O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
    O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
    O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
    O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
    O23 - Service: WUSB300NSvc - Unknown owner - C:\Program Files\Linksys\WUSB300N\WLService.exe

    --
    End of file - 8072 bytes
     
  7. narski1

    narski1 Thread Starter

    Joined:
    Apr 3, 2008
    Messages:
    7
    Sorry for the triple post, was just trying to break it up a bit. I've still got the mystery trojans popping up with McAfee but the startup issue seems to have gone away for now. I'm still having a few issues with flickering graphics but what is more concerning is I'm now having system lag. Watching video, listening to music, etc will now skip time to time. I do know that with my system specs that should never happen. New computer too... Thanks for any and all help.
     
  8. cybertech

    cybertech Retired Moderator

    Joined:
    Apr 16, 2002
    Messages:
    72,115
    Please download ATF Cleaner by Atribune.
    This program is for XP and Windows 2000 only
    • Double-click ATF-Cleaner.exe to run the program.
    • Under Main choose: Select All
    • Click the Empty Selected button.

    Click Exit on the Main menu to close the program.



    Download (save and select your desktop to save it to) SUPERAntiSpyware Free for Home Users
    • Double-click SUPERAntiSpyware.exe and use the default settings for installation.
    • An icon will be created on your desktop. Double-click that icon to launch the program.
    • If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download and unzip them from here.)
    • Under "Configuration and Preferences", click the Preferences button.
    • Click the Scanning Control tab.
    • Under Scanner Options make sure the following are checked (leave all others unchecked):
      • Close browsers before scanning.
      • Scan for tracking cookies.
      • Terminate memory threats before quarantining.
    • Click the "Close" button to leave the control center screen.
    • Back on the main screen, under "Scan for Harmful Software" click Scan your computer.
    • On the left, make sure you check C:\Fixed Drive and all other fixed drives..
    • On the right, under "Complete Scan", choose Perform Complete Scan.
    • Click "Next" to start the scan. Please be patient while it scans your computer.
    • After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
    • Make sure everything has a checkmark next to it and click "Next".
    • A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
    • If asked if you want to reboot, click "Yes".
    • To retrieve the removal information after reboot, launch SUPERAntispyware again.
      • Click Preferences, then click the Statistics/Logs tab.
      • Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
      • If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
      • Please copy and paste the Scan Log results in your next reply with a new hijackthis log.
    • Click Close to exit the program.


    Please perform a scan with Kaspersky Webscan Online Virus Scanner
    • Read the Requirements and Privacy statement, then select "Accept".
    • A new window will appear promting you to install an ActiveX component from Kaspersky - "Do you want to install this software?".
    • Click "Yes" or select "Install" to download the ActiveX controls that allows ActiveScan to run.
    • When the download is complete it will say ready, click "Next".
    • Click "Scan Settings" and check the option to use the Extended Database if available otherwise Standard).
    • Click "Scan Options" and select both "Scan Archives" and "Scan Mail Bases".
    • Click "OK".
    • Under "Select a target to scan", click on "My Computer".
    • When the scan is complete choose to save the results as "Save as Text" named kaspersky.txt to your desktop and post them in your next reply.

    Kaspersky does not remove anything but will provide a log of anything it finds. On August 8th, 2006 Kaspersky updated the software used for Free Online Virus Scanner. In order to continue using the online scanner you will need to uninstall the old version (if previously used) from your Add/Remove Programs list and then install the latest version. To do this, follow the steps here and reboot afterwards if your system does not reboot automatically or it will show 'Kaspersky Online Scanner license key was not found!
     
  9. narski1

    narski1 Thread Starter

    Joined:
    Apr 3, 2008
    Messages:
    7
    Will do, thanks. I will post how everything works out tomorrow. Currently about 5pm here and I work tonight at midnight, have to get some sleep lol. Thanks again.
     
  10. cybertech

    cybertech Retired Moderator

    Joined:
    Apr 16, 2002
    Messages:
    72,115
    OK, sounds good.
     
  11. narski1

    narski1 Thread Starter

    Joined:
    Apr 3, 2008
    Messages:
    7
    Scan Statistics
    Total number of scanned objects 116842
    Number of viruses found 5
    Number of infected objects 48
    Number of suspicious objects 0
    Duration of the scan process 02:35:39

    Infected Object Name Virus Name Last Action
    C:\BT Files\Nero 8 Ultra Edition 8.3.0 Multilanguage FULL Retail\Nero 8.3.0.iso/Nero PhotoShow Express/nero_photoshow_express_5_setup.exe/data0017 Infected: not-a-virus:AdTool.Win32.MyWebSearch.bm skipped
    C:\BT Files\Nero 8 Ultra Edition 8.3.0 Multilanguage FULL Retail\Nero 8.3.0.iso/Nero PhotoShow Express/nero_photoshow_express_5_setup.exe Infected: not-a-virus:AdTool.Win32.MyWebSearch.bm skipped
    C:\BT Files\Nero 8 Ultra Edition 8.3.0 Multilanguage FULL Retail\Nero 8.3.0.iso/Toolbar.exe Infected: not-a-virus:AdTool.Win32.MyWebSearch.bm skipped
    C:\BT Files\Nero 8 Ultra Edition 8.3.0 Multilanguage FULL Retail\Nero 8.3.0.iso ISOimage: infected - 3 skipped
    C:\BT Files\Nero 8 Ultra Edition 8.3.0 Multilanguage FULL Retail-1\Nero 8.3.0.iso/Nero PhotoShow Express/nero_photoshow_express_5_setup.exe/data0017 Infected: not-a-virus:AdTool.Win32.MyWebSearch.bm skipped
    C:\BT Files\Nero 8 Ultra Edition 8.3.0 Multilanguage FULL Retail-1\Nero 8.3.0.iso/Nero PhotoShow Express/nero_photoshow_express_5_setup.exe Infected: not-a-virus:AdTool.Win32.MyWebSearch.bm skipped
    C:\BT Files\Nero 8 Ultra Edition 8.3.0 Multilanguage FULL Retail-1\Nero 8.3.0.iso/Toolbar.exe Infected: not-a-virus:AdTool.Win32.MyWebSearch.bm skipped
    C:\BT Files\Nero 8 Ultra Edition 8.3.0 Multilanguage FULL Retail-1\Nero 8.3.0.iso ISOimage: infected - 3 skipped
    C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\McAfee\MNA\NAData Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\McAfee\MSC\Logs\Events.dat Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\McAfee\MSC\Logs\{69ADD831-91F3-4E4D-AAD9-9B7417A54075}.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\McAfee\MSC\Logs\{FBDE3560-88F5-4589-B4D6-3CF417FD2E1E}.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\McAfee\MSC\McUsers.dat Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\McAfee\VirusScan\Data\TFR2.tmp Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\McAfee\VirusScan\Logs\OAS.Log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\eHome\logs\ehRecvr.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
    C:\Documents and Settings\All Users\Documents\Recorded TV\TempRec\TempSBE\MSDVRMM_2296535171_18219008_103316 Object is locked skipped
    C:\Documents and Settings\All Users\Documents\Recorded TV\TempRec\TempSBE\SBE1.tmp Object is locked skipped
    C:\Documents and Settings\All Users\Documents\Recorded TV\TempRec\{262FBF16-815A-4C09-B015-F43FA72ED1CC}.TmpSBE Object is locked skipped
    C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp Object is locked skipped
    C:\Documents and Settings\All Users\DRM\drmstore.hds Object is locked skipped
    C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\user\Application Data\GTek\GTUpdate\AUpdate\EasyLinkAdvisor\gdql_lsa_LinksysAgent.log Object is locked skipped
    C:\Documents and Settings\user\Application Data\GTek\GTUpdate\AUpdate\EasyLinkAdvisor\glog.log Object is locked skipped
    C:\Documents and Settings\user\Application Data\GTek\GTUpdate\AUpdate\EasyLinkAdvisor\LinksysAgent.log Object is locked skipped
    C:\Documents and Settings\user\Application Data\GTek\GTUpdate\AUpdate\EasyLinkAdvisor\LinksysAgent_GTActions.log Object is locked skipped
    C:\Documents and Settings\user\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\user\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\user\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\user\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\user\Local Settings\Temp\Perflib_Perfdata_fa0.dat Object is locked skipped
    C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\user\My Documents\My Music\iTunes\iTunes Library.itl Object is locked skipped
    C:\Documents and Settings\user\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\user\ntuser.dat.LOG Object is locked skipped
    C:\Multimedia\DFX Audio Enhancer v8.5 + PATCH\DFX_Audio_Enhancer_v8.35\dfxInstall-Musicmatch.exe/data0000.cab/is67533.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.if skipped
    C:\Multimedia\DFX Audio Enhancer v8.5 + PATCH\DFX_Audio_Enhancer_v8.35\dfxInstall-Musicmatch.exe/data0000.cab Infected: not-a-virus:AdWare.Win32.Virtumonde.if skipped
    C:\Multimedia\DFX Audio Enhancer v8.5 + PATCH\DFX_Audio_Enhancer_v8.35\dfxInstall-Musicmatch.exe Rsrc-Package: infected - 2 skipped
    C:\Multimedia\DFX Audio Enhancer v8.5 + PATCH\DFX_Audio_Enhancer_v8.35\dfxInstall-Winamp.exe/data0000.cab/is67533.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.if skipped
    C:\Multimedia\DFX Audio Enhancer v8.5 + PATCH\DFX_Audio_Enhancer_v8.35\dfxInstall-Winamp.exe/data0000.cab Infected: not-a-virus:AdWare.Win32.Virtumonde.if skipped
    C:\Multimedia\DFX Audio Enhancer v8.5 + PATCH\DFX_Audio_Enhancer_v8.35\dfxInstall-Winamp.exe Rsrc-Package: infected - 2 skipped
    C:\Multimedia\DFX Audio Enhancer v8.5 + PATCH\DFX_Audio_Enhancer_v8.35\dfxInstall-WMP.exe/data0000.cab/is67533.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.if skipped
    C:\Multimedia\DFX Audio Enhancer v8.5 + PATCH\DFX_Audio_Enhancer_v8.35\dfxInstall-WMP.exe/data0000.cab Infected: not-a-virus:AdWare.Win32.Virtumonde.if skipped
    C:\Multimedia\DFX Audio Enhancer v8.5 + PATCH\DFX_Audio_Enhancer_v8.35\dfxInstall-WMP.exe Rsrc-Package: infected - 2 skipped
    C:\Program Archives\Utilities\PlumChoice DO NOT DELETE\l2mfix.exe/l2mfix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
    C:\Program Archives\Utilities\PlumChoice DO NOT DELETE\l2mfix.exe ZIP: infected - 1 skipped
    C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Data\master.mdf Object is locked skipped
    C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Data\mastlog.ldf Object is locked skipped
    C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Data\model.mdf Object is locked skipped
    C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Data\modellog.ldf Object is locked skipped
    C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Data\tempdb.mdf Object is locked skipped
    C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Data\templog.ldf Object is locked skipped
    C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\LOG\ERRORLOG Object is locked skipped
    C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
    C:\System Volume Information\_restore{1550072B-980D-44B8-9DA2-E488CCAF2CD1}\RP100\change.log Object is locked skipped
    C:\System Volume Information\_restore{1550072B-980D-44B8-9DA2-E488CCAF2CD1}\RP39\A0004421.exe/data0000.cab/is67533.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.if skipped
    C:\System Volume Information\_restore{1550072B-980D-44B8-9DA2-E488CCAF2CD1}\RP39\A0004421.exe/data0000.cab Infected: not-a-virus:AdWare.Win32.Virtumonde.if skipped
    C:\System Volume Information\_restore{1550072B-980D-44B8-9DA2-E488CCAF2CD1}\RP39\A0004421.exe Rsrc-Package: infected - 2 skipped
    C:\System Volume Information\_restore{1550072B-980D-44B8-9DA2-E488CCAF2CD1}\RP54\A0005862.EXE Infected: not-a-virus:RiskTool.Win32.HideWindows skipped
    C:\System Volume Information\_restore{1550072B-980D-44B8-9DA2-E488CCAF2CD1}\RP58\A0008063.exe/l2mfix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
    C:\System Volume Information\_restore{1550072B-980D-44B8-9DA2-E488CCAF2CD1}\RP58\A0008063.exe ZIP: infected - 1 skipped
    C:\System Volume Information\_restore{1550072B-980D-44B8-9DA2-E488CCAF2CD1}\RP89\A0019425.exe/WISE0056.BIN Infected: not-a-virus:AdWare.Win32.Gator.1050 skipped
    C:\System Volume Information\_restore{1550072B-980D-44B8-9DA2-E488CCAF2CD1}\RP89\A0019425.exe WiseSFX: infected - 1 skipped
    C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
    C:\WINDOWS\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{1C3CD854-496A-46DC-B086-A87D27790E03}.crmlog Object is locked skipped
    C:\WINDOWS\SchedLgU.Txt Object is locked skipped
    C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
    C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
    C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
    C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\default Object is locked skipped
    C:\WINDOWS\system32\config\default.LOG Object is locked skipped
    C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
    C:\WINDOWS\system32\config\Media Ce.evt Object is locked skipped
    C:\WINDOWS\system32\config\SAM Object is locked skipped
    C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
    C:\WINDOWS\system32\config\software Object is locked skipped
    C:\WINDOWS\system32\config\software.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\system Object is locked skipped
    C:\WINDOWS\system32\config\system.LOG Object is locked skipped
    C:\WINDOWS\system32\h323log.txt Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
    C:\WINDOWS\Temp\mcmsc_6OxTY77EnvdWUlo Object is locked skipped
    C:\WINDOWS\Temp\mcmsc_94XkaEbYWsLWbGT Object is locked skipped
    C:\WINDOWS\Temp\mcmsc_FuPTHvVt9RbFuK9 Object is locked skipped
    C:\WINDOWS\Temp\mcmsc_hKijfRPY9mPfcba Object is locked skipped
    C:\WINDOWS\Temp\mcmsc_k8jTB898qFQGcfC Object is locked skipped
    C:\WINDOWS\Temp\Perflib_Perfdata_2c0.dat Object is locked skipped
    C:\WINDOWS\WindowsUpdate.log Object is locked skipped
    D:\$OEM$\$$\SYSTEM32\CMDOW.EXE Infected: not-a-virus:RiskTool.Win32.HideWindows skipped
    J:\XPS Files\DFX Audio Enhancer v8.5 + PATCH\DFX_Audio_Enhancer_v8.35\dfxInstall-Musicmatch.exe/data0000.cab/is67533.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.if skipped
    J:\XPS Files\DFX Audio Enhancer v8.5 + PATCH\DFX_Audio_Enhancer_v8.35\dfxInstall-Musicmatch.exe/data0000.cab Infected: not-a-virus:AdWare.Win32.Virtumonde.if skipped
    J:\XPS Files\DFX Audio Enhancer v8.5 + PATCH\DFX_Audio_Enhancer_v8.35\dfxInstall-Musicmatch.exe Rsrc-Package: infected - 2 skipped
    J:\XPS Files\DFX Audio Enhancer v8.5 + PATCH\DFX_Audio_Enhancer_v8.35\dfxInstall-Winamp.exe/data0000.cab/is67533.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.if skipped
    J:\XPS Files\DFX Audio Enhancer v8.5 + PATCH\DFX_Audio_Enhancer_v8.35\dfxInstall-Winamp.exe/data0000.cab Infected: not-a-virus:AdWare.Win32.Virtumonde.if skipped
    J:\XPS Files\DFX Audio Enhancer v8.5 + PATCH\DFX_Audio_Enhancer_v8.35\dfxInstall-Winamp.exe Rsrc-Package: infected - 2 skipped
    J:\XPS Files\DFX Audio Enhancer v8.5 + PATCH\DFX_Audio_Enhancer_v8.35\dfxInstall-WMP.exe/data0000.cab/is67533.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.if skipped
    J:\XPS Files\DFX Audio Enhancer v8.5 + PATCH\DFX_Audio_Enhancer_v8.35\dfxInstall-WMP.exe/data0000.cab Infected: not-a-virus:AdWare.Win32.Virtumonde.if skipped
    J:\XPS Files\DFX Audio Enhancer v8.5 + PATCH\DFX_Audio_Enhancer_v8.35\dfxInstall-WMP.exe Rsrc-Package: infected - 2 skipped
    J:\XPS Files\Multimedia\DFX Audio Enhancer v8.5 + PATCH\DFX_Audio_Enhancer_v8.35\dfxInstall-Musicmatch.exe/data0000.cab/is67533.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.if skipped
    J:\XPS Files\Multimedia\DFX Audio Enhancer v8.5 + PATCH\DFX_Audio_Enhancer_v8.35\dfxInstall-Musicmatch.exe/data0000.cab Infected: not-a-virus:AdWare.Win32.Virtumonde.if skipped
    J:\XPS Files\Multimedia\DFX Audio Enhancer v8.5 + PATCH\DFX_Audio_Enhancer_v8.35\dfxInstall-Musicmatch.exe Rsrc-Package: infected - 2 skipped
    J:\XPS Files\Multimedia\DFX Audio Enhancer v8.5 + PATCH\DFX_Audio_Enhancer_v8.35\dfxInstall-Winamp.exe/data0000.cab/is67533.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.if skipped
    J:\XPS Files\Multimedia\DFX Audio Enhancer v8.5 + PATCH\DFX_Audio_Enhancer_v8.35\dfxInstall-Winamp.exe/data0000.cab Infected: not-a-virus:AdWare.Win32.Virtumonde.if skipped
    J:\XPS Files\Multimedia\DFX Audio Enhancer v8.5 + PATCH\DFX_Audio_Enhancer_v8.35\dfxInstall-Winamp.exe Rsrc-Package: infected - 2 skipped
    J:\XPS Files\Multimedia\DFX Audio Enhancer v8.5 + PATCH\DFX_Audio_Enhancer_v8.35\dfxInstall-WMP.exe/data0000.cab/is67533.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.if skipped
    J:\XPS Files\Multimedia\DFX Audio Enhancer v8.5 + PATCH\DFX_Audio_Enhancer_v8.35\dfxInstall-WMP.exe/data0000.cab Infected: not-a-virus:AdWare.Win32.Virtumonde.if skipped
    J:\XPS Files\Multimedia\DFX Audio Enhancer v8.5 + PATCH\DFX_Audio_Enhancer_v8.35\dfxInstall-WMP.exe Rsrc-Package: infected - 2 skipped
    J:\XPS Files\Utilities\PlumChoice DO NOT DELETE\l2mfix.exe/l2mfix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
    J:\XPS Files\Utilities\PlumChoice DO NOT DELETE\l2mfix.exe ZIP: infected - 1 skipped
    Scan process completed.

    SuperAnti didn't find anything but as you can see Kaspersky had a seizure when scanning. I've been meaning to drop McAfee so I cancelled my subscription and purchased the Kaspersky Internet Security Package. Just set the scan settings to max sensitivity and am currently scanning. Will post sometime later today the results from that scan. Can then run combo and Hijack again if needed. Thanks and nice cat :)
     
  12. cybertech

    cybertech Retired Moderator

    Joined:
    Apr 16, 2002
    Messages:
    72,115
    :) Thanks!


    Just for your own information l2mfix.exe is not a tool you want to keep around. These tools are updated so frequently that the tools can be outdated within a few days, sometimes within just hours.



    Open Notepad and copy and paste the text in the quote box below into it:

    Save the file to you desktop and name it CFScript.txt

    Then drag the CFScript.txt into the ComboFix.exe as shown in the screenshot below.

    [​IMG]

    This will start ComboFix again. It may ask to reboot. Post the contents of Combofix.txt in your next reply together with a new HijackThis log.
     
  13. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Similar Threads - Many issues confused
  1. FusionTecg
    Replies:
    16
    Views:
    1,539
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/699940

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice