1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Solved: Blue screen of death

Discussion in 'Virus & Other Malware Removal' started by quickcomps, Jun 14, 2008.

Thread Status:
Not open for further replies.
Advertisement
  1. quickcomps

    quickcomps Thread Starter

    Joined:
    Jun 14, 2008
    Messages:
    12
    I was hit by a spyware and results are that my screen saver now says something like: "warning! spyware detected on your computer! install an antivirus or spyware remover to clean your computer". I have Mcafee and every 5 minutes or so it gives me a warning that it found the Joke-Bluescreen.c and if I want to delete it. I deete this file everytime but it pops up again. I tried a few spyware removers but none including Mcafee are able to cure my problem. Can someone help please.
     
  2. cybertech

    cybertech Retired Moderator

    Joined:
    Apr 16, 2002
    Messages:
    72,115
    Hi, Welcome to TSG!!


    Click here to download HJTInstall.exe
    • Save HJTInstall.exe to your desktop.
    • Doubleclick on the HJTInstall.exe icon on your desktop.
    • By default it will install to C:\Program Files\Trend Micro\HijackThis .
    • Click on Install.
    • It will create a HijackThis icon on the desktop.
    • Once installed, it will launch Hijackthis.
    • Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
    • Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
    • Come back here to this thread and Paste the log in your next reply.
    • DO NOT have Hijackthis fix anything yet. Most of what it finds will be harmless or even required.
     
  3. quickcomps

    quickcomps Thread Starter

    Joined:
    Jun 14, 2008
    Messages:
    12
    Hello Cybertech here is the result of the san by HjjackThis:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 09:58:41, on 6/17/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16674)
    Boot mode: Normal
    Running processes:
    E:\WINDOWS\System32\smss.exe
    E:\WINDOWS\system32\winlogon.exe
    E:\WINDOWS\system32\services.exe
    E:\WINDOWS\system32\lsass.exe
    E:\WINDOWS\system32\svchost.exe
    E:\WINDOWS\System32\svchost.exe
    E:\Program Files\Ahead\InCD\InCDsrv.exe
    E:\WINDOWS\system32\spoolsv.exe
    E:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    E:\WINDOWS\system32\inetsrv\inetinfo.exe
    E:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    e:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
    e:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
    E:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    E:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    E:\Program Files\McAfee\MPF\MPFSrv.exe
    E:\WINDOWS\Explorer.EXE
    E:\Program Files\Microsoft SQL Server\MSSQL$ALAMODE\Binn\sqlservr.exe
    E:\PROGRA~1\MI6841~1\MSSQL\binn\sqlservr.exe
    E:\Program Files\SiteAdvisor\6261\SAService.exe
    E:\WINDOWS\System32\svchost.exe
    e:\PROGRA~1\mcafee.com\agent\mcagent.exe
    E:\WINDOWS\system32\WgaTray.exe
    E:\Program Files\ScanSoft\OmniPageSE\opware32.exe
    E:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe
    E:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe
    E:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
    E:\Program Files\QuickTime\qttask.exe
    E:\Program Files\iTunes\iTunesHelper.exe
    E:\WINDOWS\system32\CTHELPER.EXE
    E:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
    E:\Program Files\iPod\bin\iPodService.exe
    E:\Program Files\Google\Gmail Notifier\gnotify.exe
    E:\Program Files\Logitech\MediaLife\MediaLifeService.exe
    E:\Program Files\Common Files\Real\Update_OB\realsched.exe
    E:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
    E:\WINDOWS\system32\WDBtnMgr.exe
    E:\WINDOWS\system32\lphcgwwj0ej59.exe
    E:\Program Files\SiteAdvisor\6261\SiteAdv.exe
    E:\PROGRA~1\Nero\data\Xtras\mssysmgr.exe
    E:\WINDOWS\System32\svchost.exe
    E:\WINDOWS\system32\ctfmon.exe
    E:\Program Files\eFax Messenger 4.3\J2GTray.exe
    E:\Program Files\Google\Google Updater\GoogleUpdater.exe
    E:\Program Files\Logitech\SetPoint\SetPoint.exe
    E:\Program Files\My Book\WD Backup\uBBMonitor.exe
    E:\Program Files\802.11 Wireless LAN\802.11g Wireless Cardbus & PCI Adapter HW.51 V1.00\WlanCU.exe
    E:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
    E:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    E:\Program Files\Internet Explorer\iexplore.exe
    E:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - E:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
    O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - E:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
    O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - E:\Program Files\SiteAdvisor\6261\SiteAdv.dll
    O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - E:\Program Files\McAfee\VirusScan\scriptsn.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - e:\program files\google\googletoolbar1.dll
    O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - E:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - E:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
    O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - E:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
    O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - E:\Program Files\Canon\Easy-WebPrint\Toolband.dll
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - E:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - e:\program files\google\googletoolbar1.dll
    O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - E:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
    O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - E:\Program Files\SiteAdvisor\6261\SiteAdv.dll
    O4 - HKLM\..\Run: [Omnipage] "E:\Program Files\ScanSoft\OmniPageSE\opware32.exe"
    O4 - HKLM\..\Run: [IPInSightLAN 01] "E:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe" -l
    O4 - HKLM\..\Run: [IPInSightMonitor 01] "E:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe"
    O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "E:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] E:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [QuickTime Task] "E:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "E:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
    O4 - HKLM\..\Run: [UpdReg] E:\WINDOWS\UpdReg.EXE
    O4 - HKLM\..\Run: [Jet Detection] "E:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "E:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
    O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] "E:\Program Files\Google\Gmail Notifier\gnotify.exe"
    O4 - HKLM\..\Run: [MediaLifeService] "E:\Program Files\Logitech\MediaLife\MediaLifeService.exe"
    O4 - HKLM\..\Run: [KernelFaultCheck] E:\WINDOWS\system32\dumprep 0 -k
    O4 - HKLM\..\Run: [TkBellExe] "E:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [YSearchProtection] "E:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
    O4 - HKLM\..\Run: [WD Button Manager] WDBtnMgr.exe
    O4 - HKLM\..\Run: [lphcgwwj0ej59] E:\WINDOWS\system32\lphcgwwj0ej59.exe
    O4 - HKLM\..\Run: [mcagent_exe] "E:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
    O4 - HKLM\..\Run: [SiteAdvisor] "E:\Program Files\SiteAdvisor\6261\SiteAdv.exe"
    O4 - HKLM\..\Run: [sysrest32.exe] E:\WINDOWS\system32\sysrest32.exe
    O4 - HKCU\..\Run: [MSMSGS] "E:\Program Files\Messenger\MSMSGS.EXE" /background
    O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] E:\PROGRA~1\Nero\data\Xtras\mssysmgr.exe
    O4 - HKCU\..\Run: [LDM] "E:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe"
    O4 - HKCU\..\Run: [swg] E:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [ctfmon.exe] E:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [YSearchProtection] "E:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] "E:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
    O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
    O4 - Global Startup: Adobe Gamma Loader.lnk = E:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Adobe Gamma.lnk = E:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: eFax 4.3.lnk = E:\Program Files\eFax Messenger 4.3\J2GTray.exe
    O4 - Global Startup: Google Updater.lnk = E:\Program Files\Google\Google Updater\GoogleUpdater.exe
    O4 - Global Startup: Logitech Desktop Messenger.lnk = E:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    O4 - Global Startup: Logitech SetPoint.lnk = E:\Program Files\Logitech\SetPoint\SetPoint.exe
    O4 - Global Startup: WD Backup Monitor.lnk = E:\Program Files\My Book\WD Backup\uBBMonitor.exe
    O4 - Global Startup: Wireless Configuration Utility HW.51.lnk = E:\Program Files\802.11 Wireless LAN\802.11g Wireless Cardbus & PCI Adapter HW.51 V1.00\WlanCU.exe
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O8 - Extra context menu item: Convert link target to Adobe PDF - res://E:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert link target to existing PDF - res://E:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert selected links to Adobe PDF - res://E:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 - Extra context menu item: Convert selected links to existing PDF - res://E:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 - Extra context menu item: Convert selection to Adobe PDF - res://E:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert selection to existing PDF - res://E:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert to Adobe PDF - res://E:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert to existing PDF - res://E:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - E:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
    O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - E:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
    O15 - Trusted Zone: http://linktrader.cyberspacehq.com
    O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
    O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
    O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.costcophotocenter.com/CostcoActivia.cab
    O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
    O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD42/J...65/&filename=jinstall-6u6-windows-i586-jc.cab
    O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
    O16 - DPF: {D6E7CFB5-C074-4D1C-B647-663D1A8D96BF} (Facebook Photo Uploader 4) - http://upload.facebook.com/controls/FacebookPhotoUploader4_5.cab
    O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
    O20 - Winlogon Notify: WinCtrl32 - WinCtrl32.dll (file missing)
    O23 - Service: McAfee Application Installer Cleanup (0216991213461879) (0216991213461879mcinstcleanup) - Unknown owner - E:\DOCUME~1\MainUser\LOCALS~1\Temp\021699~1.EXE (file missing)
    O23 - Service: Adobe LM Service - Adobe Systems - E:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Google Updater Service (gusvc) - Google - E:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InCD Helper (InCDsrv) - Nero AG - E:\Program Files\Ahead\InCD\InCDsrv.exe
    O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - E:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - E:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - e:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
    O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - E:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
    O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - e:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
    O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - E:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - E:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - E:\Program Files\McAfee\MPF\MPFSrv.exe
    O23 - Service: SiteAdvisor Service - Unknown owner - E:\Program Files\SiteAdvisor\6261\SAService.exe
    --
    End of file - 13331 bytes
     
  4. cybertech

    cybertech Retired Moderator

    Joined:
    Apr 16, 2002
    Messages:
    72,115
    Please visit this webpage for instructions on installing recovery console and downloading/running ComboFix.

    Post the log from ComboFix along with a new HijackThis log.
     
  5. quickcomps

    quickcomps Thread Starter

    Joined:
    Jun 14, 2008
    Messages:
    12
    The ComboFix did not solve my problem.

    ComboFix 08-06-16.5 - MainUser 2008-06-17 13:26:08.1 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1561 [GMT -7:00]
    Running from: E:\Documents and Settings\MainUser\Desktop\ComboFix.exe
    Command switches used :: E:\Documents and Settings\MainUser\Desktop\WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
    * Created a new restore point
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    E:\Documents and Settings\All Users\Desktop\Malware Protector 2008.lnk
    E:\Documents and Settings\All Users\Start Menu\Programs\Malware Protector 2008.lnk
    E:\Documents and Settings\MainUser\Application Data\Microsoft\Internet Explorer\Quick Launch\Malware Protector 2008.lnk
    E:\RECYCLER\desktopA.sys
    E:\WINDOWS\system32\Cache
    E:\WINDOWS\system32\mdm.exe
    E:\WINDOWS\system32\MSINET.oca
    F:\Autorun.inf
    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    -------\Service_sysrest.sys

    ((((((((((((((((((((((((( Files Created from 2008-05-17 to 2008-06-17 )))))))))))))))))))))))))))))))
    .
    2008-06-17 10:05 . 2008-06-17 10:05 <DIR> d-------- E:\Documents and Settings\MainUser\Application Data\shcnwwj0ej59
    2008-06-17 09:58 . 2008-06-17 09:58 <DIR> d-------- E:\Program Files\Trend Micro
    2008-06-17 09:00 . 2008-06-17 09:00 <DIR> d-------- E:\Documents and Settings\MainUser\Application Data\Malwarebytes
    2008-06-17 09:00 . 2008-06-17 09:00 <DIR> d-------- E:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-06-17 08:00 . 2008-06-17 08:00 <DIR> d-------- E:\Documents and Settings\MainUser\Application Data\Talkback
    2008-06-14 17:49 . 2008-06-14 17:49 <DIR> d-------- E:\WINDOWS\system32\LogFiles
    2008-06-14 09:47 . 2008-06-14 09:47 <DIR> d-------- E:\Documents and Settings\LocalService\Application Data\SiteAdvisor
    2008-06-14 09:47 . 2008-06-17 13:30 11,829 --a------ E:\WINDOWS\system32\Config.MPF
    2008-06-14 09:46 . 2008-06-17 07:59 <DIR> d-------- E:\Program Files\SiteAdvisor
    2008-06-14 09:46 . 2008-06-14 16:37 <DIR> d-------- E:\Documents and Settings\MainUser\Application Data\SiteAdvisor
    2008-06-14 09:46 . 2008-06-16 17:00 <DIR> d-------- E:\Documents and Settings\All Users\Application Data\SiteAdvisor
    2008-06-14 09:44 . 2008-06-14 09:44 <DIR> d-------- E:\Program Files\McAfee.com
    2008-06-14 09:44 . 2007-11-22 06:44 201,320 --a------ E:\WINDOWS\system32\drivers\mfehidk.sys
    2008-06-14 09:44 . 2007-07-13 06:20 113,952 --a------ E:\WINDOWS\system32\drivers\Mpfp.sys
    2008-06-14 09:44 . 2007-11-22 06:44 79,304 --a------ E:\WINDOWS\system32\drivers\mfeavfk.sys
    2008-06-14 09:44 . 2007-12-02 12:51 40,488 --a------ E:\WINDOWS\system32\drivers\mfesmfk.sys
    2008-06-14 09:44 . 2007-11-22 06:44 35,240 --a------ E:\WINDOWS\system32\drivers\mfebopk.sys
    2008-06-14 09:44 . 2007-11-22 06:44 33,832 --a------ E:\WINDOWS\system32\drivers\mferkdk.sys
    2008-06-14 09:43 . 2008-06-14 09:46 <DIR> d-------- E:\Program Files\McAfee
    2008-06-14 09:43 . 2008-06-14 09:44 <DIR> d-------- E:\Program Files\Common Files\McAfee
    2008-06-14 09:17 . 2008-06-14 09:47 <DIR> d-------- E:\Documents and Settings\All Users\Application Data\McAfee
    2008-06-13 00:24 . 2008-06-14 15:13 <DIR> d-------- E:\Program Files\Spybot - Search & Destroy
    2008-06-13 00:24 . 2008-06-14 16:03 <DIR> d-------- E:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2008-06-12 23:57 . 2008-06-12 23:57 1,152 --a------ E:\WINDOWS\system32\windrv.sys
    2008-06-12 23:19 . 2008-06-12 23:28 3,782 --a------ E:\WINDOWS\system32\tmp.reg
    2008-06-12 21:34 . 2008-06-12 21:46 <DIR> d-------- E:\Documents and Settings\All Users\Application Data\Lavasoft
    2008-06-12 18:53 . 2008-06-12 18:53 <DIR> d-------- E:\Program Files\AskSBar
    2008-06-12 18:44 . 2008-06-12 18:44 164 --a------ E:\install.dat
    2008-06-12 15:42 . 2008-06-12 15:42 109,056 --a------ E:\WINDOWS\system32\lphcgwwj0ej59.exe
    2008-06-12 15:42 . 2008-06-17 13:32 90,838 --a------ E:\WINDOWS\system32\phcgwwj0ej59.bmp
    2008-06-12 15:42 . 2008-06-12 15:42 54,156 --ah----- E:\WINDOWS\QTFont.qfn
    2008-06-12 15:42 . 2008-06-12 15:42 1,409 --a------ E:\WINDOWS\QTFont.for
    2008-06-11 00:49 . 2008-04-14 04:01 272,128 -----c--- E:\WINDOWS\system32\dllcache\bthport.sys
    2008-06-06 15:17 . 2008-04-22 21:16 6,066,176 -----c--- E:\WINDOWS\system32\dllcache\ieframe.dll
    2008-06-06 15:17 . 2007-04-17 02:32 2,455,488 -----c--- E:\WINDOWS\system32\dllcache\ieapfltr.dat
    2008-06-06 15:17 . 2007-03-07 22:10 991,232 -----c--- E:\WINDOWS\system32\dllcache\ieframe.dll.mui
    2008-06-06 15:17 . 2008-04-22 21:16 459,264 -----c--- E:\WINDOWS\system32\dllcache\msfeeds.dll
    2008-06-06 15:17 . 2008-04-22 21:16 383,488 -----c--- E:\WINDOWS\system32\dllcache\ieapfltr.dll
    2008-06-06 15:17 . 2008-04-22 21:16 267,776 -----c--- E:\WINDOWS\system32\dllcache\iertutil.dll
    2008-06-06 15:17 . 2008-04-22 21:16 63,488 -----c--- E:\WINDOWS\system32\dllcache\icardie.dll
    2008-06-06 15:17 . 2008-04-22 21:16 52,224 -----c--- E:\WINDOWS\system32\dllcache\msfeedsbs.dll
    2008-06-06 15:17 . 2008-04-22 00:39 13,824 -----c--- E:\WINDOWS\system32\dllcache\ieudinit.exe
    2008-06-06 15:16 . 2007-08-13 18:54 33,792 --a--c--- E:\WINDOWS\system32\dllcache\custsat.dll
    2008-05-28 09:28 . 2008-05-28 09:28 <DIR> d-------- E:\Program Files\Sun
    2008-05-28 00:35 . 2008-05-28 00:35 <DIR> d-------- E:\Documents and Settings\MainUser\Application Data\Symantec
    2008-05-28 00:27 . 2008-05-28 17:08 <DIR> d-------- E:\Documents and Settings\All Users\Application Data\Symantec
    2008-05-28 00:21 . 2008-06-12 19:18 <DIR> d-------- E:\Program Files\Common Files\Symantec Shared
    2008-05-24 15:22 . 2008-05-24 15:22 20 --ahs---- E:\ArcDeviceInfo
    2008-05-24 15:13 . 2008-06-11 03:08 <DIR> d-------- E:\Documents and Settings\MainUser\Application Data\uTorrent
    2008-05-24 15:13 . 2001-08-23 05:00 4,224 --a------ E:\WINDOWS\system32\beep.sys
    2008-05-24 15:12 . 2008-05-24 15:13 <DIR> d-------- E:\Program Files\uTorrent
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-06-17 05:10 --------- d-----w E:\Documents and Settings\All Users\Application Data\Google Updater
    2008-06-15 00:07 --------- d-----w E:\Program Files\Java
    2008-06-13 17:07 --------- d---a-w E:\Documents and Settings\All Users\Application Data\TEMP
    2008-06-13 16:58 --------- d-----w E:\Program Files\Lavasoft
    2008-06-13 16:58 --------- d-----w E:\Program Files\Common Files\Wise Installation Wizard
    2008-06-13 06:47 --------- d-----w E:\Documents and Settings\All Users\Application Data\Skype
    2008-06-13 04:35 --------- d-----w E:\Documents and Settings\MainUser\Application Data\Lavasoft
    2008-06-11 16:12 --------- d-----w E:\Program Files\Yahoo!
    2008-05-24 22:21 --------- d-----w E:\Documents and Settings\MainUser\Application Data\ArcSoft
    2008-05-21 23:38 --------- d-----w E:\Program Files\WinSketch v7
    2008-05-08 12:28 202,752 ----a-w E:\WINDOWS\system32\drivers\rmcast.sys
    2007-04-09 23:51 87,608 ----a-w E:\Documents and Settings\MainUser\Application Data\ezpinst.exe
    2007-04-09 23:51 47,360 ----a-w E:\Documents and Settings\MainUser\Application Data\pcouffin.sys
    2005-02-14 22:09 111 ----a-w E:\Program Files\Common Files\Register.ini
    2005-01-17 19:17 4,798,024 ----a-w E:\Program Files\Common Files\NetZeroCosmiSetup.exe
    2004-11-08 20:10 1,115,136 ----a-w E:\Program Files\Common Files\Register.exe
    2002-09-11 14:26 63,730 ----a-w E:\Program Files\viewsonicinstruct_xp.pdf
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2}]
    2008-06-12 18:53 66912 --a------ E:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}"= "E:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL" [2008-06-12 18:53 267592]
    [HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]
    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
    "{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}"= E:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL [2008-06-12 18:53 267592]
    [HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "PhotoShow Deluxe Media Manager"="E:\PROGRA~1\Nero\data\Xtras\mssysmgr.exe" [2005-02-25 17:28 212992]
    "LDM"="E:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2007-02-14 09:12 67128]
    "swg"="E:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-03-30 11:36 68856]
    "ctfmon.exe"="E:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56 15360]
    "YSearchProtection"="E:\Program Files\Yahoo!\Search Protection\SearchProtection.exe" [2007-06-08 07:59 224248]
    "SpybotSD TeaTimer"="E:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-06-05 10:48 2113360]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Omnipage"="E:\Program Files\ScanSoft\OmniPageSE\opware32.exe" [2002-06-03 11:38 49152]
    "IPInSightLAN 01"="E:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe" [2003-06-11 01:52 380928]
    "IPInSightMonitor 01"="E:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe" [2003-06-11 01:52 122880]
    "Acrobat Assistant 7.0"="E:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2006-01-12 21:52 483328]
    "NeroFilterCheck"="E:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648]
    "QuickTime Task"="E:\Program Files\QuickTime\qttask.exe" [2005-06-30 17:01 98304]
    "iTunesHelper"="E:\Program Files\iTunes\iTunesHelper.exe" [2005-06-24 15:16 278528]
    "WINDVDPatch"="CTHELPER.EXE" [2002-07-02 18:56 24576 E:\WINDOWS\system32\CTHELPER.EXE]
    "UpdReg"="E:\WINDOWS\UpdReg.EXE" [2000-05-11 01:00 90112]
    "Jet Detection"="E:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe" [2001-11-29 01:00 28672]
    "SunJavaUpdateSched"="E:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784]
    "{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="E:\Program Files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 14:48 479232]
    "MediaLifeService"="E:\Program Files\Logitech\MediaLife\MediaLifeService.exe" [2005-05-12 21:23 110739]
    "TkBellExe"="E:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-09-13 07:43 185632]
    "YSearchProtection"="E:\Program Files\Yahoo!\Search Protection\SearchProtection.exe" [2007-06-08 07:59 224248]
    "WD Button Manager"="WDBtnMgr.exe" [2008-04-15 17:45 364544 E:\WINDOWS\system32\WDBtnMgr.exe]
    "lphcgwwj0ej59"="E:\WINDOWS\system32\lphcgwwj0ej59.exe" [2008-06-12 15:42 109056]
    "mcagent_exe"="E:\Program Files\McAfee.com\Agent\mcagent.exe" [2007-11-01 19:12 582992]
    "SiteAdvisor"="E:\Program Files\SiteAdvisor\6261\SiteAdv.exe" [2007-08-24 14:57 36640]
    "sysrest32.exe"="E:\WINDOWS\system32\sysrest32.exe" [ ]
    "SMshcnwwj0ej59"="E:\Program Files\shcnwwj0ej59\shcnwwj0ej59.exe" [2008-06-11 01:59 1167360]
    E:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Adobe Acrobat Speed Launcher.lnk - E:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2005-05-16 16:42:15 25214]
    Adobe Gamma Loader.lnk - E:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-05-16 17:14:54 113664]
    Adobe Gamma.lnk - E:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-05-16 17:14:54 113664]
    eFax 4.3.lnk - E:\Program Files\eFax Messenger 4.3\J2GTray.exe [2007-09-14 18:02:29 629248]
    Google Updater.lnk - E:\Program Files\Google\Google Updater\GoogleUpdater.exe [2006-08-10 23:32:54 125624]
    Logitech Desktop Messenger.lnk - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-02-14 09:12:48 67128]
    Logitech SetPoint.lnk - E:\Program Files\Logitech\SetPoint\SetPoint.exe [2006-06-13 19:48:49 450560]
    WD Backup Monitor.lnk - E:\Program Files\My Book\WD Backup\uBBMonitor.exe [2008-04-15 17:46:09 98304]
    Wireless Configuration Utility HW.51.lnk - E:\Program Files\802.11 Wireless LAN\802.11g Wireless Cardbus & PCI Adapter HW.51 V1.00\WlanCU.exe [2004-12-14 20:53:38 454656]
    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
    "NoDispBackgroundPage"= 1 (0x1)
    "NoDispScrSavPage"= 1 (0x1)
    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
    "NoBandCustomize"= 0 (0x0)
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "msacm.dvacm"= dvacm.acm
    "VIDC.VDOM"= vdowave.drv
    "VIDC.TR20"= tr2032.dll
    "vidc.vivo"= ivvideo.dll
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\enI16.sys]
    @="Driver"
    [HKLM\~\startupfolder\E:^Documents and Settings^All Users^Start Menu^Programs^Startup^Image Transfer.lnk]
    path=E:\Documents and Settings\All Users\Start Menu\Programs\Startup\Image Transfer.lnk
    backup=E:\WINDOWS\pss\Image Transfer.lnkCommon Startup
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
    --------- 2005-07-25 13:01 1397760 E:\Program Files\Ahead\InCD\InCD.exe
    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusDisableNotify"=dword:00000001
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring"=dword:00000001
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
    "DisableMonitoring"=dword:00000001
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
    "DisableMonitoring"=dword:00000001
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=dword:00000001
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "E:\\Program Files\\iTunes\\iTunes.exe"=
    "E:\\Program Files\\Messenger\\msmsgs.exe"=
    "E:\\Program Files\\Microsoft SQL Server\\MSSQL$ALAMODE\\Binn\\sqlservr.exe"=
    "E:\\Program Files\\a la mode\\Sched\\eSched.exe"=
    "E:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
    "E:\\Program Files\\Ahead\\Nero ShowTime\\ShowTime.exe"=
    "E:\\Program Files\\uTorrent\\uTorrent.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "E:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
    R2 MSSQL$ALAMODE;MSSQL$ALAMODE;"E:\Program Files\Microsoft SQL Server\MSSQL$ALAMODE\Binn\sqlservr.exe" -sALAMODE []
    R3 svgam;svgam;E:\WINDOWS\system32\DRIVERS\svgam.sys [2004-06-17 16:00]
    S0 enI16;enI16;E:\WINDOWS\system32\Drivers\enI16.sys []
    S2 0216991213461879mcinstcleanup;McAfee Application Installer Cleanup (0216991213461879);E:\DOCUME~1\MainUser\LOCALS~1\Temp\021699~1.EXE E:\PROGRA~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini []
    S3 PCASp50;PCASp50 NDIS Protocol Driver;E:\WINDOWS\system32\Drivers\PCASp50.sys [2004-09-07 16:42]
    S3 sonypvs1;Sony Digital Imaging Video2;E:\WINDOWS\system32\DRIVERS\sonypvs1.sys [2002-10-15 22:41]
    S3 SQLAgent$ALAMODE;SQLAgent$ALAMODE;"E:\Program Files\Microsoft SQL Server\MSSQL$ALAMODE\Binn\sqlagent.EXE" -i ALAMODE []
    .
    Contents of the 'Scheduled Tasks' folder
    "2008-06-17 06:24:01 E:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
    - E:\Program Files\Apple Software Update\SoftwareUpdate.exe
    "2008-06-15 08:00:00 E:\WINDOWS\Tasks\McDefragTask.job"
    - e:\PROGRA~1\mcafee\mqc\QcConsol.exe'
    "2008-06-14 16:44:24 E:\WINDOWS\Tasks\McQcTask.job"
    - e:\PROGRA~1\mcafee\mqc\QcConsol.exe
    .
    **************************************************************************
    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-06-17 13:31:10
    Windows 5.1.2600 Service Pack 2 NTFS
    scanning hidden processes ...
    scanning hidden autostart entries ...
    scanning hidden files ...

    E:\WINDOWS\system32\blphcgwwj0ej59.scr 60928 bytes executable
    scan completed successfully
    hidden files: 1
    **************************************************************************
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------
    PROCESS: E:\WINDOWS\explorer.exe
    -> E:\Program Files\SiteAdvisor\6261\saHook.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    E:\Program Files\Ahead\InCD\InCDsrv.exe
    E:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    E:\WINDOWS\system32\inetsrv\inetinfo.exe
    E:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    E:\PROGRA~1\COMMON~1\McAfee\MNA\McNASvc.exe
    E:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe
    E:\PROGRA~1\McAfee\VIRUSS~1\Mcshield.exe
    E:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    E:\Program Files\McAfee\MPF\MpfSrv.exe
    E:\PROGRA~1\MI6841~1\MSSQL\Binn\sqlservr.exe
    E:\Program Files\SiteAdvisor\6261\SAService.exe
    E:\WINDOWS\system32\WgaTray.exe
    E:\Program Files\iPod\bin\iPodService.exe
    E:\Program Files\Nero\data\Xtras\mssysmgr.exe
    E:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
    E:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    .
    **************************************************************************
    .
    Completion time: 2008-06-17 13:38:08 - machine was rebooted
    ComboFix-quarantined-files.txt 2008-06-17 20:38:00
    Pre-Run: 48,716,726,272 bytes free
    Post-Run: 48,725,733,376 bytes free
    WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn
    E:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    252 --- E O F --- 2008-06-11 10:03:26
     
  6. quickcomps

    quickcomps Thread Starter

    Joined:
    Jun 14, 2008
    Messages:
    12
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 13:38:51, on 6/17/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16674)
    Boot mode: Normal
    Running processes:
    E:\WINDOWS\System32\smss.exe
    E:\WINDOWS\system32\winlogon.exe
    E:\WINDOWS\system32\services.exe
    E:\WINDOWS\system32\lsass.exe
    E:\WINDOWS\system32\svchost.exe
    E:\WINDOWS\System32\svchost.exe
    E:\Program Files\Ahead\InCD\InCDsrv.exe
    E:\WINDOWS\system32\spoolsv.exe
    E:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    E:\WINDOWS\system32\inetsrv\inetinfo.exe
    E:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    e:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
    e:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
    E:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    E:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    E:\Program Files\McAfee\MPF\MPFSrv.exe
    E:\Program Files\Microsoft SQL Server\MSSQL$ALAMODE\Binn\sqlservr.exe
    E:\PROGRA~1\MI6841~1\MSSQL\binn\sqlservr.exe
    E:\Program Files\SiteAdvisor\6261\SAService.exe
    E:\WINDOWS\System32\svchost.exe
    e:\PROGRA~1\mcafee.com\agent\mcagent.exe
    E:\WINDOWS\system32\CF24123.exe
    E:\WINDOWS\System32\svchost.exe
    E:\WINDOWS\system32\WgaTray.exe
    E:\Program Files\ScanSoft\OmniPageSE\opware32.exe
    E:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe
    E:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe
    E:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
    E:\Program Files\QuickTime\qttask.exe
    E:\Program Files\iTunes\iTunesHelper.exe
    E:\WINDOWS\system32\CTHELPER.EXE
    E:\Program Files\iPod\bin\iPodService.exe
    E:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
    E:\Program Files\Google\Gmail Notifier\gnotify.exe
    E:\Program Files\Logitech\MediaLife\MediaLifeService.exe
    E:\Program Files\Common Files\Real\Update_OB\realsched.exe
    E:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
    E:\WINDOWS\system32\WDBtnMgr.exe
    E:\WINDOWS\system32\lphcgwwj0ej59.exe
    E:\Program Files\SiteAdvisor\6261\SiteAdv.exe
    E:\PROGRA~1\Nero\data\Xtras\mssysmgr.exe
    E:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    E:\WINDOWS\system32\ctfmon.exe
    E:\Program Files\eFax Messenger 4.3\J2GTray.exe
    E:\Program Files\Google\Google Updater\GoogleUpdater.exe
    E:\Program Files\Logitech\SetPoint\SetPoint.exe
    E:\Program Files\My Book\WD Backup\uBBMonitor.exe
    E:\Program Files\802.11 Wireless LAN\802.11g Wireless Cardbus & PCI Adapter HW.51 V1.00\WlanCU.exe
    E:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
    E:\Program Files\shcnwwj0ej59\shcnwwj0ej59.exe
    E:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    E:\WINDOWS\explorer.exe
    E:\WINDOWS\system32\notepad.exe
    E:\WINDOWS\regedit.exe
    E:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - E:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
    O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - E:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
    O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - E:\Program Files\SiteAdvisor\6261\SiteAdv.dll
    O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - E:\Program Files\McAfee\VirusScan\scriptsn.dll
    O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
    O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - E:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - E:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
    O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - E:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
    O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - E:\Program Files\Canon\Easy-WebPrint\Toolband.dll
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - E:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
    O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
    O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - E:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
    O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - E:\Program Files\SiteAdvisor\6261\SiteAdv.dll
    O4 - HKLM\..\Run: [Omnipage] "E:\Program Files\ScanSoft\OmniPageSE\opware32.exe"
    O4 - HKLM\..\Run: [IPInSightLAN 01] "E:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe" -l
    O4 - HKLM\..\Run: [IPInSightMonitor 01] "E:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe"
    O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "E:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] E:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [QuickTime Task] "E:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "E:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
    O4 - HKLM\..\Run: [UpdReg] E:\WINDOWS\UpdReg.EXE
    O4 - HKLM\..\Run: [Jet Detection] "E:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "E:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
    O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] "E:\Program Files\Google\Gmail Notifier\gnotify.exe"
    O4 - HKLM\..\Run: [MediaLifeService] "E:\Program Files\Logitech\MediaLife\MediaLifeService.exe"
    O4 - HKLM\..\Run: [TkBellExe] "E:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [YSearchProtection] "E:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
    O4 - HKLM\..\Run: [WD Button Manager] WDBtnMgr.exe
    O4 - HKLM\..\Run: [lphcgwwj0ej59] E:\WINDOWS\system32\lphcgwwj0ej59.exe
    O4 - HKLM\..\Run: [mcagent_exe] "E:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
    O4 - HKLM\..\Run: [SiteAdvisor] "E:\Program Files\SiteAdvisor\6261\SiteAdv.exe"
    O4 - HKLM\..\Run: [sysrest32.exe] E:\WINDOWS\system32\sysrest32.exe
    O4 - HKLM\..\Run: [SMshcnwwj0ej59] E:\Program Files\shcnwwj0ej59\shcnwwj0ej59.exe
    O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] E:\PROGRA~1\Nero\data\Xtras\mssysmgr.exe
    O4 - HKCU\..\Run: [LDM] "E:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe"
    O4 - HKCU\..\Run: [swg] E:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [ctfmon.exe] E:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [YSearchProtection] "E:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] "E:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
    O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
    O4 - Global Startup: Adobe Gamma Loader.lnk = E:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Adobe Gamma.lnk = E:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: eFax 4.3.lnk = E:\Program Files\eFax Messenger 4.3\J2GTray.exe
    O4 - Global Startup: Google Updater.lnk = E:\Program Files\Google\Google Updater\GoogleUpdater.exe
    O4 - Global Startup: Logitech Desktop Messenger.lnk = E:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    O4 - Global Startup: Logitech SetPoint.lnk = E:\Program Files\Logitech\SetPoint\SetPoint.exe
    O4 - Global Startup: WD Backup Monitor.lnk = E:\Program Files\My Book\WD Backup\uBBMonitor.exe
    O4 - Global Startup: Wireless Configuration Utility HW.51.lnk = E:\Program Files\802.11 Wireless LAN\802.11g Wireless Cardbus & PCI Adapter HW.51 V1.00\WlanCU.exe
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O8 - Extra context menu item: Convert link target to Adobe PDF - res://E:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert link target to existing PDF - res://E:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert selected links to Adobe PDF - res://E:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 - Extra context menu item: Convert selected links to existing PDF - res://E:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 - Extra context menu item: Convert selection to Adobe PDF - res://E:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert selection to existing PDF - res://E:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert to Adobe PDF - res://E:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert to existing PDF - res://E:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - E:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
    O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - E:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
    O15 - Trusted Zone: http://linktrader.cyberspacehq.com
    O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
    O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
    O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.costcophotocenter.com/CostcoActivia.cab
    O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
    O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD42/J...65/&filename=jinstall-6u6-windows-i586-jc.cab
    O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
    O16 - DPF: {D6E7CFB5-C074-4D1C-B647-663D1A8D96BF} (Facebook Photo Uploader 4) - http://upload.facebook.com/controls/FacebookPhotoUploader4_5.cab
    O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
    O23 - Service: McAfee Application Installer Cleanup (0216991213461879) (0216991213461879mcinstcleanup) - Unknown owner - E:\DOCUME~1\MainUser\LOCALS~1\Temp\021699~1.EXE (file missing)
    O23 - Service: Adobe LM Service - Adobe Systems - E:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Google Updater Service (gusvc) - Google - E:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InCD Helper (InCDsrv) - Nero AG - E:\Program Files\Ahead\InCD\InCDsrv.exe
    O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - E:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - E:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - e:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
    O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - E:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
    O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - e:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
    O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - E:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - E:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - E:\Program Files\McAfee\MPF\MPFSrv.exe
    O23 - Service: SiteAdvisor Service - Unknown owner - E:\Program Files\SiteAdvisor\6261\SAService.exe
    --
    End of file - 13570 bytes
     
  7. cybertech

    cybertech Retired Moderator

    Joined:
    Apr 16, 2002
    Messages:
    72,115
    I didn't expect to fix all of the problems! You have multiple infections so it may take a few scans to get the machine cleaned up.


    Open Notepad and copy and paste the text in the quote box below into it:

    Save the file to you desktop and name it CFScript.txt

    Then drag the CFScript.txt into the ComboFix.exe as shown in the screenshot below.

    [​IMG]

    This will start ComboFix again. It may ask to reboot. Post the contents of Combofix.txt in your next reply.


    Please download ATF Cleaner by Atribune.
    This program is for XP and Windows 2000 only
    • Double-click ATF-Cleaner.exe to run the program.
    • Under Main choose: Select All
    • Click the Empty Selected button.

    Click Exit on the Main menu to close the program.



    Download (save and select your desktop to save it to) SUPERAntiSpyware Free for Home Users
    • Double-click SUPERAntiSpyware.exe and use the default settings for installation.
    • An icon will be created on your desktop. Double-click that icon to launch the program.
    • If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download and unzip them from here.)
    • Under "Configuration and Preferences", click the Preferences button.
    • Click the Scanning Control tab.
    • Under Scanner Options make sure the following are checked (leave all others unchecked):
      • Close browsers before scanning.
      • Scan for tracking cookies.
      • Terminate memory threats before quarantining.
    • Click the "Close" button to leave the control center screen.
    • Back on the main screen, under "Scan for Harmful Software" click Scan your computer.
    • On the left, make sure you check C:\Fixed Drive and all other fixed drives..
    • On the right, under "Complete Scan", choose Perform Complete Scan.
    • Click "Next" to start the scan. Please be patient while it scans your computer.
    • After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
    • Make sure everything has a checkmark next to it and click "Next".
    • A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
    • If asked if you want to reboot, click "Yes".
    • To retrieve the removal information after reboot, launch SUPERAntispyware again.
      • Click Preferences, then click the Statistics/Logs tab.
      • Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
      • If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
      • Please copy and paste the Scan Log results in your next reply with a new hijackthis log.
    • Click Close to exit the program.


    Please perform a scan with Kaspersky Webscan Online Virus Scanner
    • Read the Requirements and Privacy statement, then select "Accept".
    • A new window will appear promting you to install an ActiveX component from Kaspersky - "Do you want to install this software?".
    • Click "Yes" or select "Install" to download the ActiveX controls that allows ActiveScan to run.
    • When the download is complete it will say ready, click "Next".
    • Click "Scan Settings" and check the option to use the Extended Database if available otherwise Standard).
    • Click "Scan Options" and select both "Scan Archives" and "Scan Mail Bases".
    • Click "OK".
    • Under "Select a target to scan", click on "My Computer".
    • When the scan is complete choose to save the results as "Save as Text" named kaspersky.txt to your desktop and post them in your next reply.

    Kaspersky does not remove anything but will provide a log of anything it finds. On August 8th, 2006 Kaspersky updated the software used for Free Online Virus Scanner. In order to continue using the online scanner you will need to uninstall the old version (if previously used) from your Add/Remove Programs list and then install the latest version. To do this, follow the steps here and reboot afterwards if your system does not reboot automatically or it will show 'Kaspersky Online Scanner license key was not found!
     
  8. quickcomps

    quickcomps Thread Starter

    Joined:
    Jun 14, 2008
    Messages:
    12
    ComboFix 08-06-16.5 - MainUser 2008-06-18 9:17:54.2 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1553 [GMT -7:00]
    Running from: E:\Documents and Settings\MainUser\Desktop\ComboFix.exe
    Command switches used :: E:\Documents and Settings\MainUser\Desktop\CFScript.txt
    * Created a new restore point
    FILE ::
    E:\WINDOWS\system32\blphcgwwj0ej59.scr
    E:\WINDOWS\system32\lphcgwwj0ej59.exe
    E:\WINDOWS\system32\phcgwwj0ej59.bmp
    .
    /wow section - STAGE 41
    pv: No matching processes found
    The process cannot access the file because it is being used by another process.
    The process cannot access the file because it is being used by another process.
    The process cannot access the file because it is being used by another process.
    The process cannot access the file because it is being used by another process.
    The process cannot access the file because it is being used by another process.

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    E:\Documents and Settings\All Users\Desktop\Malware Protector 2008.lnk
    E:\Documents and Settings\All Users\Start Menu\Programs\Malware Protector 2008
    E:\Documents and Settings\All Users\Start Menu\Programs\Malware Protector 2008.lnk
    E:\Documents and Settings\All Users\Start Menu\Programs\Malware Protector 2008\How to Register Malware Protector 2008.lnk
    E:\Documents and Settings\All Users\Start Menu\Programs\Malware Protector 2008\License Agreement.lnk
    E:\Documents and Settings\All Users\Start Menu\Programs\Malware Protector 2008\Malware Protector 2008.lnk
    E:\Documents and Settings\All Users\Start Menu\Programs\Malware Protector 2008\Register Malware Protector 2008.lnk
    E:\Documents and Settings\All Users\Start Menu\Programs\Malware Protector 2008\Uninstall.lnk
    E:\Documents and Settings\MainUser\Application Data\Microsoft\Internet Explorer\Quick Launch\Malware Protector 2008.lnk
    E:\Documents and Settings\MainUser\Application Data\shcnwwj0ej59
    E:\Program Files\shcnwwj0ej59
    E:\WINDOWS\system32\lphcgwwj0ej59.exe
    E:\WINDOWS\system32\phcgwwj0ej59.bmp
    .
    ((((((((((((((((((((((((( Files Created from 2008-05-18 to 2008-06-18 )))))))))))))))))))))))))))))))
    .
    2008-06-18 09:17 . 2008-06-18 09:17 <DIR> d-------- E:\Documents and Settings\NetworkService\Application Data\SiteAdvisor
    2008-06-17 09:58 . 2008-06-17 09:58 <DIR> d-------- E:\Program Files\Trend Micro
    2008-06-17 09:00 . 2008-06-17 09:00 <DIR> d-------- E:\Documents and Settings\MainUser\Application Data\Malwarebytes
    2008-06-17 09:00 . 2008-06-17 09:00 <DIR> d-------- E:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-06-17 08:00 . 2008-06-17 08:00 <DIR> d-------- E:\Documents and Settings\MainUser\Application Data\Talkback
    2008-06-14 17:49 . 2008-06-14 17:49 <DIR> d-------- E:\WINDOWS\system32\LogFiles
    2008-06-14 09:47 . 2008-06-14 09:47 <DIR> d-------- E:\Documents and Settings\LocalService\Application Data\SiteAdvisor
    2008-06-14 09:47 . 2008-06-18 09:34 11,991 --a------ E:\WINDOWS\system32\Config.MPF
    2008-06-14 09:46 . 2008-06-17 07:59 <DIR> d-------- E:\Program Files\SiteAdvisor
    2008-06-14 09:46 . 2008-06-17 13:39 <DIR> d-------- E:\Documents and Settings\MainUser\Application Data\SiteAdvisor
    2008-06-14 09:46 . 2008-06-17 17:00 <DIR> d-------- E:\Documents and Settings\All Users\Application Data\SiteAdvisor
    2008-06-14 09:44 . 2008-06-14 09:44 <DIR> d-------- E:\Program Files\McAfee.com
    2008-06-14 09:44 . 2007-11-22 06:44 201,320 --a------ E:\WINDOWS\system32\drivers\mfehidk.sys
    2008-06-14 09:44 . 2007-07-13 06:20 113,952 --a------ E:\WINDOWS\system32\drivers\Mpfp.sys
    2008-06-14 09:44 . 2007-11-22 06:44 79,304 --a------ E:\WINDOWS\system32\drivers\mfeavfk.sys
    2008-06-14 09:44 . 2007-12-02 12:51 40,488 --a------ E:\WINDOWS\system32\drivers\mfesmfk.sys
    2008-06-14 09:44 . 2007-11-22 06:44 35,240 --a------ E:\WINDOWS\system32\drivers\mfebopk.sys
    2008-06-14 09:44 . 2007-11-22 06:44 33,832 --a------ E:\WINDOWS\system32\drivers\mferkdk.sys
    2008-06-14 09:43 . 2008-06-14 09:46 <DIR> d-------- E:\Program Files\McAfee
    2008-06-14 09:43 . 2008-06-14 09:44 <DIR> d-------- E:\Program Files\Common Files\McAfee
    2008-06-14 09:17 . 2008-06-14 09:47 <DIR> d-------- E:\Documents and Settings\All Users\Application Data\McAfee
    2008-06-13 00:24 . 2008-06-14 15:13 <DIR> d-------- E:\Program Files\Spybot - Search & Destroy
    2008-06-13 00:24 . 2008-06-14 16:03 <DIR> d-------- E:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2008-06-12 23:57 . 2008-06-12 23:57 1,152 --a------ E:\WINDOWS\system32\windrv.sys
    2008-06-12 23:19 . 2008-06-12 23:28 3,782 --a------ E:\WINDOWS\system32\tmp.reg
    2008-06-12 21:34 . 2008-06-12 21:46 <DIR> d-------- E:\Documents and Settings\All Users\Application Data\Lavasoft
    2008-06-12 18:53 . 2008-06-12 18:53 <DIR> d-------- E:\Program Files\AskSBar
    2008-06-12 18:44 . 2008-06-12 18:44 164 --a------ E:\install.dat
    2008-06-12 15:42 . 2008-06-12 15:42 54,156 --ah----- E:\WINDOWS\QTFont.qfn
    2008-06-12 15:42 . 2008-06-12 15:42 1,409 --a------ E:\WINDOWS\QTFont.for
    2008-06-11 00:49 . 2008-04-14 04:01 272,128 -----c--- E:\WINDOWS\system32\dllcache\bthport.sys
    2008-06-06 15:17 . 2008-04-22 21:16 6,066,176 -----c--- E:\WINDOWS\system32\dllcache\ieframe.dll
    2008-06-06 15:17 . 2007-04-17 02:32 2,455,488 -----c--- E:\WINDOWS\system32\dllcache\ieapfltr.dat
    2008-06-06 15:17 . 2007-03-07 22:10 991,232 -----c--- E:\WINDOWS\system32\dllcache\ieframe.dll.mui
    2008-06-06 15:17 . 2008-04-22 21:16 459,264 -----c--- E:\WINDOWS\system32\dllcache\msfeeds.dll
    2008-06-06 15:17 . 2008-04-22 21:16 383,488 -----c--- E:\WINDOWS\system32\dllcache\ieapfltr.dll
    2008-06-06 15:17 . 2008-04-22 21:16 267,776 -----c--- E:\WINDOWS\system32\dllcache\iertutil.dll
    2008-06-06 15:17 . 2008-04-22 21:16 63,488 -----c--- E:\WINDOWS\system32\dllcache\icardie.dll
    2008-06-06 15:17 . 2008-04-22 21:16 52,224 -----c--- E:\WINDOWS\system32\dllcache\msfeedsbs.dll
    2008-06-06 15:17 . 2008-04-22 00:39 13,824 -----c--- E:\WINDOWS\system32\dllcache\ieudinit.exe
    2008-06-06 15:16 . 2007-08-13 18:54 33,792 --a--c--- E:\WINDOWS\system32\dllcache\custsat.dll
    2008-05-28 09:28 . 2008-05-28 09:28 <DIR> d-------- E:\Program Files\Sun
    2008-05-28 00:35 . 2008-05-28 00:35 <DIR> d-------- E:\Documents and Settings\MainUser\Application Data\Symantec
    2008-05-28 00:27 . 2008-05-28 17:08 <DIR> d-------- E:\Documents and Settings\All Users\Application Data\Symantec
    2008-05-28 00:21 . 2008-06-12 19:18 <DIR> d-------- E:\Program Files\Common Files\Symantec Shared
    2008-05-24 15:22 . 2008-05-24 15:22 20 --ahs---- E:\ArcDeviceInfo
    2008-05-24 15:13 . 2008-06-11 03:08 <DIR> d-------- E:\Documents and Settings\MainUser\Application Data\uTorrent
    2008-05-24 15:13 . 2001-08-23 05:00 4,224 --a------ E:\WINDOWS\system32\beep.sys
    2008-05-24 15:12 . 2008-05-24 15:13 <DIR> d-------- E:\Program Files\uTorrent
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-06-18 06:10 --------- d-----w E:\Documents and Settings\All Users\Application Data\Google Updater
    2008-06-15 00:07 --------- d-----w E:\Program Files\Java
    2008-06-13 17:07 --------- d---a-w E:\Documents and Settings\All Users\Application Data\TEMP
    2008-06-13 16:58 --------- d-----w E:\Program Files\Lavasoft
    2008-06-13 16:58 --------- d-----w E:\Program Files\Common Files\Wise Installation Wizard
    2008-06-13 06:47 --------- d-----w E:\Documents and Settings\All Users\Application Data\Skype
    2008-06-13 04:35 --------- d-----w E:\Documents and Settings\MainUser\Application Data\Lavasoft
    2008-06-11 16:12 --------- d-----w E:\Program Files\Yahoo!
    2008-05-24 22:21 --------- d-----w E:\Documents and Settings\MainUser\Application Data\ArcSoft
    2008-05-21 23:38 --------- d-----w E:\Program Files\WinSketch v7
    2008-05-08 12:28 202,752 ----a-w E:\WINDOWS\system32\drivers\rmcast.sys
    2007-04-09 23:51 87,608 ----a-w E:\Documents and Settings\MainUser\Application Data\ezpinst.exe
    2007-04-09 23:51 47,360 ----a-w E:\Documents and Settings\MainUser\Application Data\pcouffin.sys
    2005-02-14 22:09 111 ----a-w E:\Program Files\Common Files\Register.ini
    2005-01-17 19:17 4,798,024 ----a-w E:\Program Files\Common Files\NetZeroCosmiSetup.exe
    2004-11-08 20:10 1,115,136 ----a-w E:\Program Files\Common Files\Register.exe
    2002-09-11 14:26 63,730 ----a-w E:\Program Files\viewsonicinstruct_xp.pdf
    .
    ((((((((((((((((((((((((((((( [email protected]_13.37.39.31 )))))))))))))))))))))))))))))))))))))))))
    .
    - 2008-06-17 20:30:18 2,048 --s-a-w E:\WINDOWS\bootstat.dat
    + 2008-06-18 16:33:38 2,048 --s-a-w E:\WINDOWS\bootstat.dat
    - 2008-06-17 18:12:18 32,768 ----a-w E:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
    + 2008-06-18 16:05:42 32,768 ----a-w E:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
    - 2008-06-17 18:12:18 32,768 ----a-w E:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
    + 2008-06-18 16:05:42 32,768 ----a-w E:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
    - 2008-06-17 18:12:18 32,768 --sha-w E:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
    + 2008-06-18 16:05:42 32,768 --sha-w E:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
    - 2008-06-17 20:30:51 226,068 ----a-w E:\WINDOWS\system32\inetsrv\MetaBase.bin
    + 2008-06-18 16:34:45 226,064 ----a-w E:\WINDOWS\system32\inetsrv\MetaBase.bin
    + 2008-06-18 16:33:53 16,384 ----atw E:\WINDOWS\Temp\Perflib_Perfdata_b8.dat
    + 2008-06-18 16:33:54 16,384 ----atw E:\WINDOWS\Temp\Perflib_Perfdata_fc.dat
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2}]
    2008-06-12 18:53 66912 --a------ E:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}"= "E:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL" [2008-06-12 18:53 267592]
    [HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]
    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
    "{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}"= E:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL [2008-06-12 18:53 267592]
    [HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "PhotoShow Deluxe Media Manager"="E:\PROGRA~1\Nero\data\Xtras\mssysmgr.exe" [2005-02-25 17:28 212992]
    "LDM"="E:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2007-02-14 09:12 67128]
    "swg"="E:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-03-30 11:36 68856]
    "ctfmon.exe"="E:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56 15360]
    "YSearchProtection"="E:\Program Files\Yahoo!\Search Protection\SearchProtection.exe" [2007-06-08 07:59 224248]
    "SpybotSD TeaTimer"="E:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-06-05 10:48 2113360]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Omnipage"="E:\Program Files\ScanSoft\OmniPageSE\opware32.exe" [2002-06-03 11:38 49152]
    "IPInSightLAN 01"="E:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe" [2003-06-11 01:52 380928]
    "IPInSightMonitor 01"="E:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe" [2003-06-11 01:52 122880]
    "Acrobat Assistant 7.0"="E:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2006-01-12 21:52 483328]
    "NeroFilterCheck"="E:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648]
    "QuickTime Task"="E:\Program Files\QuickTime\qttask.exe" [2005-06-30 17:01 98304]
    "iTunesHelper"="E:\Program Files\iTunes\iTunesHelper.exe" [2005-06-24 15:16 278528]
    "WINDVDPatch"="CTHELPER.EXE" [2002-07-02 18:56 24576 E:\WINDOWS\system32\CTHELPER.EXE]
    "UpdReg"="E:\WINDOWS\UpdReg.EXE" [2000-05-11 01:00 90112]
    "Jet Detection"="E:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe" [2001-11-29 01:00 28672]
    "SunJavaUpdateSched"="E:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784]
    "{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="E:\Program Files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 14:48 479232]
    "MediaLifeService"="E:\Program Files\Logitech\MediaLife\MediaLifeService.exe" [2005-05-12 21:23 110739]
    "TkBellExe"="E:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-09-13 07:43 185632]
    "YSearchProtection"="E:\Program Files\Yahoo!\Search Protection\SearchProtection.exe" [2007-06-08 07:59 224248]
    "WD Button Manager"="WDBtnMgr.exe" [2008-04-15 17:45 364544 E:\WINDOWS\system32\WDBtnMgr.exe]
    "mcagent_exe"="E:\Program Files\McAfee.com\Agent\mcagent.exe" [2007-11-01 19:12 582992]
    "SiteAdvisor"="E:\Program Files\SiteAdvisor\6261\SiteAdv.exe" [2007-08-24 14:57 36640]
    E:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Adobe Acrobat Speed Launcher.lnk - E:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2005-05-16 16:42:15 25214]
    Adobe Gamma Loader.lnk - E:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-05-16 17:14:54 113664]
    Adobe Gamma.lnk - E:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-05-16 17:14:54 113664]
    eFax 4.3.lnk - E:\Program Files\eFax Messenger 4.3\J2GTray.exe [2007-09-14 18:02:29 629248]
    Google Updater.lnk - E:\Program Files\Google\Google Updater\GoogleUpdater.exe [2006-08-10 23:32:54 125624]
    Logitech Desktop Messenger.lnk - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-02-14 09:12:48 67128]
    Logitech SetPoint.lnk - E:\Program Files\Logitech\SetPoint\SetPoint.exe [2006-06-13 19:48:49 450560]
    WD Backup Monitor.lnk - E:\Program Files\My Book\WD Backup\uBBMonitor.exe [2008-04-15 17:46:09 98304]
    Wireless Configuration Utility HW.51.lnk - E:\Program Files\802.11 Wireless LAN\802.11g Wireless Cardbus & PCI Adapter HW.51 V1.00\WlanCU.exe [2004-12-14 20:53:38 454656]
    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
    "NoBandCustomize"= 0 (0x0)
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "msacm.dvacm"= dvacm.acm
    "VIDC.VDOM"= vdowave.drv
    "VIDC.TR20"= tr2032.dll
    "vidc.vivo"= ivvideo.dll
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\enI16.sys]
    @="Driver"
    [HKLM\~\startupfolder\E:^Documents and Settings^All Users^Start Menu^Programs^Startup^Image Transfer.lnk]
    path=E:\Documents and Settings\All Users\Start Menu\Programs\Startup\Image Transfer.lnk
    backup=E:\WINDOWS\pss\Image Transfer.lnkCommon Startup
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
    --------- 2005-07-25 13:01 1397760 E:\Program Files\Ahead\InCD\InCD.exe
    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusDisableNotify"=dword:00000001
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring"=dword:00000001
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
    "DisableMonitoring"=dword:00000001
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
    "DisableMonitoring"=dword:00000001
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=dword:00000001
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "E:\\Program Files\\iTunes\\iTunes.exe"=
    "E:\\Program Files\\Messenger\\msmsgs.exe"=
    "E:\\Program Files\\Microsoft SQL Server\\MSSQL$ALAMODE\\Binn\\sqlservr.exe"=
    "E:\\Program Files\\a la mode\\Sched\\eSched.exe"=
    "E:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
    "E:\\Program Files\\Ahead\\Nero ShowTime\\ShowTime.exe"=
    "E:\\Program Files\\uTorrent\\uTorrent.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "E:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
    R2 MSSQL$ALAMODE;MSSQL$ALAMODE;"E:\Program Files\Microsoft SQL Server\MSSQL$ALAMODE\Binn\sqlservr.exe" -sALAMODE []
    R3 svgam;svgam;E:\WINDOWS\system32\DRIVERS\svgam.sys [2004-06-17 16:00]
    S0 enI16;enI16;E:\WINDOWS\system32\Drivers\enI16.sys []
    S2 0216991213461879mcinstcleanup;McAfee Application Installer Cleanup (0216991213461879);E:\DOCUME~1\MainUser\LOCALS~1\Temp\021699~1.EXE E:\PROGRA~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini []
    S3 PCASp50;PCASp50 NDIS Protocol Driver;E:\WINDOWS\system32\Drivers\PCASp50.sys [2004-09-07 16:42]
    S3 sonypvs1;Sony Digital Imaging Video2;E:\WINDOWS\system32\DRIVERS\sonypvs1.sys [2002-10-15 22:41]
    S3 SQLAgent$ALAMODE;SQLAgent$ALAMODE;"E:\Program Files\Microsoft SQL Server\MSSQL$ALAMODE\Binn\sqlagent.EXE" -i ALAMODE []
    S3 sysrest.sys;sysrest.sys;E:\WINDOWS\system32\sysrest.sys []
    .
    Contents of the 'Scheduled Tasks' folder
    "2008-06-17 06:24:01 E:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
    - E:\Program Files\Apple Software Update\SoftwareUpdate.exe
    "2008-06-15 08:00:00 E:\WINDOWS\Tasks\McDefragTask.job"
    - e:\PROGRA~1\mcafee\mqc\QcConsol.exe'
    "2008-06-14 16:44:24 E:\WINDOWS\Tasks\McQcTask.job"
    - e:\PROGRA~1\mcafee\mqc\QcConsol.exe
    .
    **************************************************************************
    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-06-18 09:36:11
    Windows 5.1.2600 Service Pack 2 NTFS
    scanning hidden processes ...
    scanning hidden autostart entries ...
    scanning hidden files ...
    scan completed successfully
    hidden files: 0
    **************************************************************************
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------
    PROCESS: E:\WINDOWS\explorer.exe
    -> E:\Program Files\SiteAdvisor\6261\saHook.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    E:\Program Files\Ahead\InCD\InCDsrv.exe
    E:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    E:\WINDOWS\system32\inetsrv\inetinfo.exe
    E:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    E:\PROGRA~1\COMMON~1\McAfee\MNA\McNASvc.exe
    E:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe
    E:\PROGRA~1\McAfee\VIRUSS~1\Mcshield.exe
    E:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    E:\Program Files\McAfee\MPF\MpfSrv.exe
    E:\PROGRA~1\MI6841~1\MSSQL\Binn\sqlservr.exe
    E:\Program Files\SiteAdvisor\6261\SAService.exe
    E:\WINDOWS\system32\WgaTray.exe
    E:\Program Files\iPod\bin\iPodService.exe
    E:\Program Files\Nero\data\Xtras\mssysmgr.exe
    E:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
    E:\PROGRA~1\McAfee\MSC\mcuimgr.exe
    .
    **************************************************************************
    .
    Completion time: 2008-06-18 9:42:18 - machine was rebooted
    ComboFix-quarantined-files.txt 2008-06-18 16:42:13
    ComboFix2.txt 2008-06-17 20:38:09
    Pre-Run: 48,936,558,592 bytes free
    Post-Run: 49,000,574,976 bytes free
    266 --- E O F --- 2008-06-11 10:03:26
     
  9. quickcomps

    quickcomps Thread Starter

    Joined:
    Jun 14, 2008
    Messages:
    12
    SUPERAntiSpyware Scan Log
    http://www.superantispyware.com
    Generated 06/18/2008 at 01:00 PM
    Application Version : 4.15.1000
    Core Rules Database Version : 3484
    Trace Rules Database Version: 1475
    Scan type : Complete Scan
    Total Scan Time : 03:00:19
    Memory items scanned : 507
    Memory threats detected : 0
    Registry items scanned : 8899
    Registry threats detected : 0
    File items scanned : 285280
    File threats detected : 2
    Adware.Tracking Cookie
    .tribalfusion.com [ E:\Documents and Settings\MainUser\Application Data\Mozilla\Firefox\Profiles\rzqw7xwd.default\cookies.txt ]
    .tribalfusion.com [ E:\Documents and Settings\MainUser\Application Data\Mozilla\Firefox\Profiles\rzqw7xwd.default\cookies.txt ]
    .tribalfusion.com [ E:\Documents and Settings\MainUser\Application Data\Mozilla\Firefox\Profiles\rzqw7xwd.default\cookies.txt ]
    .tribalfusion.com [ E:\Documents and Settings\MainUser\Application Data\Mozilla\Firefox\Profiles\rzqw7xwd.default\cookies.txt ]
    .atdmt.com [ E:\Documents and Settings\MainUser\Application Data\Mozilla\Firefox\Profiles\rzqw7xwd.default\cookies.txt ]
    .xiti.com [ E:\Documents and Settings\MainUser\Application Data\Mozilla\Firefox\Profiles\rzqw7xwd.default\cookies.txt ]
    .smartadserver.com [ E:\Documents and Settings\MainUser\Application Data\Mozilla\Firefox\Profiles\rzqw7xwd.default\cookies.txt ]
    .advertising.com [ E:\Documents and Settings\MainUser\Application Data\Mozilla\Firefox\Profiles\rzqw7xwd.default\cookies.txt ]
    .advertising.com [ E:\Documents and Settings\MainUser\Application Data\Mozilla\Firefox\Profiles\rzqw7xwd.default\cookies.txt ]
    .advertising.com [ E:\Documents and Settings\MainUser\Application Data\Mozilla\Firefox\Profiles\rzqw7xwd.default\cookies.txt ]
    .advertising.com [ E:\Documents and Settings\MainUser\Application Data\Mozilla\Firefox\Profiles\rzqw7xwd.default\cookies.txt ]
    .doubleclick.net [ E:\Documents and Settings\MainUser\Application Data\Mozilla\Firefox\Profiles\rzqw7xwd.default\cookies.txt ]
    .statcounter.com [ E:\Documents and Settings\MainUser\Application Data\Mozilla\Firefox\Profiles\rzqw7xwd.default\cookies.txt ]
    ad.yieldmanager.com [ E:\Documents and Settings\MainUser\Application Data\Mozilla\Firefox\Profiles\rzqw7xwd.default\cookies.txt ]
    ad.yieldmanager.com [ E:\Documents and Settings\MainUser\Application Data\Mozilla\Firefox\Profiles\rzqw7xwd.default\cookies.txt ]
    media.adrevolver.com [ E:\Documents and Settings\MainUser\Application Data\Mozilla\Firefox\Profiles\rzqw7xwd.default\cookies.txt ]
    .adrevolver.com [ E:\Documents and Settings\MainUser\Application Data\Mozilla\Firefox\Profiles\rzqw7xwd.default\cookies.txt ]
    .dynamic.media.adrevolver.com [ E:\Documents and Settings\MainUser\Application Data\Mozilla\Firefox\Profiles\rzqw7xwd.default\cookies.txt ]
    .adrevolver.com [ E:\Documents and Settings\MainUser\Application Data\Mozilla\Firefox\Profiles\rzqw7xwd.default\cookies.txt ]
    .ads.pointroll.com [ E:\Documents and Settings\MainUser\Application Data\Mozilla\Firefox\Profiles\rzqw7xwd.default\cookies.txt ]
    .ads.pointroll.com [ E:\Documents and Settings\MainUser\Application Data\Mozilla\Firefox\Profiles\rzqw7xwd.default\cookies.txt ]
    .ads.pointroll.com [ E:\Documents and Settings\MainUser\Application Data\Mozilla\Firefox\Profiles\rzqw7xwd.default\cookies.txt ]
    .ads.pointroll.com [ E:\Documents and Settings\MainUser\Application Data\Mozilla\Firefox\Profiles\rzqw7xwd.default\cookies.txt ]
    .ads.pointroll.com [ E:\Documents and Settings\MainUser\Application Data\Mozilla\Firefox\Profiles\rzqw7xwd.default\cookies.txt ]
    .ads.pointroll.com [ E:\Documents and Settings\MainUser\Application Data\Mozilla\Firefox\Profiles\rzqw7xwd.default\cookies.txt ]
    .ads.pointroll.com [ E:\Documents and Settings\MainUser\Application Data\Mozilla\Firefox\Profiles\rzqw7xwd.default\cookies.txt ]
    .specificclick.net [ E:\Documents and Settings\MainUser\Application Data\Mozilla\Firefox\Profiles\rzqw7xwd.default\cookies.txt ]
    .specificclick.net [ E:\Documents and Settings\MainUser\Application Data\Mozilla\Firefox\Profiles\rzqw7xwd.default\cookies.txt ]
    .specificclick.net [ E:\Documents and Settings\MainUser\Application Data\Mozilla\Firefox\Profiles\rzqw7xwd.default\cookies.txt ]
    .specificclick.net [ E:\Documents and Settings\MainUser\Application Data\Mozilla\Firefox\Profiles\rzqw7xwd.default\cookies.txt ]
    .specificclick.net [ E:\Documents and Settings\MainUser\Application Data\Mozilla\Firefox\Profiles\rzqw7xwd.default\cookies.txt ]
    .specificclick.net [ E:\Documents and Settings\MainUser\Application Data\Mozilla\Firefox\Profiles\rzqw7xwd.default\cookies.txt ]
    .adopt.specificclick.net [ E:\Documents and Settings\MainUser\Application Data\Mozilla\Firefox\Profiles\rzqw7xwd.default\cookies.txt ]
    .adopt.specificclick.net [ E:\Documents and Settings\MainUser\Application Data\Mozilla\Firefox\Profiles\rzqw7xwd.default\cookies.txt ]
    .adopt.specificclick.net [ E:\Documents and Settings\MainUser\Application Data\Mozilla\Firefox\Profiles\rzqw7xwd.default\cookies.txt ]
    .adopt.specificclick.net [ E:\Documents and Settings\MainUser\Application Data\Mozilla\Firefox\Profiles\rzqw7xwd.default\cookies.txt ]
    .adopt.specificclick.net [ E:\Documents and Settings\MainUser\Application Data\Mozilla\Firefox\Profiles\rzqw7xwd.default\cookies.txt ]
    .specificclick.net [ E:\Documents and Settings\MainUser\Application Data\Mozilla\Firefox\Profiles\rzqw7xwd.default\cookies.txt ]
    .findarticles.com [ E:\Documents and Settings\MainUser\Application Data\Mozilla\Firefox\Profiles\rzqw7xwd.default\cookies.txt ]
    .findarticles.com [ E:\Documents and Settings\MainUser\Application Data\Mozilla\Firefox\Profiles\rzqw7xwd.default\cookies.txt ]
    .kanoodle.com [ E:\Documents and Settings\MainUser\Application Data\Mozilla\Firefox\Profiles\rzqw7xwd.default\cookies.txt ]
    .media.bahai.org [ E:\Documents and Settings\MainUser\Application Data\Mozilla\Firefox\Profiles\rzqw7xwd.default\cookies.txt ]
    .media6degrees.com [ E:\Documents and Settings\MainUser\Application Data\Mozilla\Firefox\Profiles\rzqw7xwd.default\cookies.txt ]
    .qnsr.com [ E:\Documents and Settings\MainUser\Application Data\Mozilla\Firefox\Profiles\rzqw7xwd.default\cookies.txt ]
    .redorbit.com [ E:\Documents and Settings\MainUser\Application Data\Mozilla\Firefox\Profiles\rzqw7xwd.default\cookies.txt ]
    .stats.sphere.com [ E:\Documents and Settings\MainUser\Application Data\Mozilla\Firefox\Profiles\rzqw7xwd.default\cookies.txt ]
    .techfinder.itweek.co.uk [ E:\Documents and Settings\MainUser\Application Data\Mozilla\Firefox\Profiles\rzqw7xwd.default\cookies.txt ]
    .tracking.sms.ac [ E:\Documents and Settings\MainUser\Application Data\Mozilla\Firefox\Profiles\rzqw7xwd.default\cookies.txt ]
    .tracking.sms.ac [ E:\Documents and Settings\MainUser\Application Data\Mozilla\Firefox\Profiles\rzqw7xwd.default\cookies.txt ]
    .whatcounts.com [ E:\Documents and Settings\MainUser\Application Data\Mozilla\Firefox\Profiles\rzqw7xwd.default\cookies.txt ]
    .windowsmedia.com [ E:\Documents and Settings\MainUser\Application Data\Mozilla\Firefox\Profiles\rzqw7xwd.default\cookies.txt ]
    ad1.clickhype.com [ E:\Documents and Settings\MainUser\Application Data\Mozilla\Firefox\Profiles\rzqw7xwd.default\cookies.txt ]
    vhost.oddcast.com [ E:\Documents and Settings\MainUser\Application Data\Mozilla\Firefox\Profiles\rzqw7xwd.default\cookies.txt ]
    vhost.oddcast.com [ E:\Documents and Settings\MainUser\Application Data\Mozilla\Firefox\Profiles\rzqw7xwd.default\cookies.txt ]
    vhost.oddcast.com [ E:\Documents and Settings\MainUser\Application Data\Mozilla\Firefox\Profiles\rzqw7xwd.default\cookies.txt ]
    vhost.oddcast.com [ E:\Documents and Settings\MainUser\Application Data\Mozilla\Firefox\Profiles\rzqw7xwd.default\cookies.txt ]
    vhost.oddcast.com [ E:\Documents and Settings\MainUser\Application Data\Mozilla\Firefox\Profiles\rzqw7xwd.default\cookies.txt ]
    vhost.oddcast.com [ E:\Documents and Settings\MainUser\Application Data\Mozilla\Firefox\Profiles\rzqw7xwd.default\cookies.txt ]
    vhost.oddcast.com [ E:\Documents and Settings\MainUser\Application Data\Mozilla\Firefox\Profiles\rzqw7xwd.default\cookies.txt ]
    vhost.oddcast.com [ E:\Documents and Settings\MainUser\Application Data\Mozilla\Firefox\Profiles\rzqw7xwd.default\cookies.txt ]
    Rogue.AdvancedXPDefender
    E:\SYSTEM VOLUME INFORMATION\_RESTORE{927E208F-2C85-45CD-AF3A-AE5C8DFDA6B8}\RP10\A0002414.EXE
    Rogue.AdvancedXPFixer
    E:\SYSTEM VOLUME INFORMATION\_RESTORE{927E208F-2C85-45CD-AF3A-AE5C8DFDA6B8}\RP12\A0002679.DLL
     
  10. quickcomps

    quickcomps Thread Starter

    Joined:
    Jun 14, 2008
    Messages:
    12
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 13:17:02, on 6/18/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16674)
    Boot mode: Normal
    Running processes:
    E:\WINDOWS\System32\smss.exe
    E:\WINDOWS\system32\winlogon.exe
    E:\WINDOWS\system32\services.exe
    E:\WINDOWS\system32\lsass.exe
    E:\WINDOWS\system32\svchost.exe
    E:\WINDOWS\System32\svchost.exe
    E:\Program Files\Ahead\InCD\InCDsrv.exe
    E:\WINDOWS\system32\spoolsv.exe
    E:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    E:\WINDOWS\system32\inetsrv\inetinfo.exe
    E:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    E:\WINDOWS\Explorer.EXE
    e:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
    e:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
    E:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    E:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    E:\Program Files\McAfee\MPF\MPFSrv.exe
    E:\Program Files\Microsoft SQL Server\MSSQL$ALAMODE\Binn\sqlservr.exe
    E:\PROGRA~1\MI6841~1\MSSQL\binn\sqlservr.exe
    e:\PROGRA~1\mcafee.com\agent\mcagent.exe
    E:\Program Files\SiteAdvisor\6261\SAService.exe
    E:\WINDOWS\System32\svchost.exe
    E:\Program Files\ScanSoft\OmniPageSE\opware32.exe
    E:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe
    E:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe
    E:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
    E:\Program Files\QuickTime\qttask.exe
    E:\Program Files\iTunes\iTunesHelper.exe
    E:\WINDOWS\system32\CTHELPER.EXE
    E:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
    E:\Program Files\Google\Gmail Notifier\gnotify.exe
    E:\Program Files\Logitech\MediaLife\MediaLifeService.exe
    E:\Program Files\Common Files\Real\Update_OB\realsched.exe
    E:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
    E:\WINDOWS\system32\WDBtnMgr.exe
    E:\Program Files\SiteAdvisor\6261\SiteAdv.exe
    E:\PROGRA~1\Nero\data\Xtras\mssysmgr.exe
    E:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    E:\WINDOWS\system32\ctfmon.exe
    E:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    E:\Program Files\iPod\bin\iPodService.exe
    E:\Program Files\eFax Messenger 4.3\J2GTray.exe
    E:\WINDOWS\system32\WgaTray.exe
    E:\WINDOWS\System32\svchost.exe
    E:\WINDOWS\system32\wuauclt.exe
    E:\Program Files\Google\Google Updater\GoogleUpdater.exe
    E:\Program Files\Logitech\SetPoint\SetPoint.exe
    E:\Program Files\My Book\WD Backup\uBBMonitor.exe
    E:\Program Files\802.11 Wireless LAN\802.11g Wireless Cardbus & PCI Adapter HW.51 V1.00\WlanCU.exe
    E:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
    e:\PROGRA~1\mcafee\msc\mcuimgr.exe
    E:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - E:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
    O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - E:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
    O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - E:\Program Files\SiteAdvisor\6261\SiteAdv.dll
    O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - E:\Program Files\McAfee\VirusScan\scriptsn.dll
    O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
    O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - E:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - E:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
    O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - E:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
    O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - E:\Program Files\Canon\Easy-WebPrint\Toolband.dll
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - E:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
    O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
    O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - E:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
    O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - E:\Program Files\SiteAdvisor\6261\SiteAdv.dll
    O4 - HKLM\..\Run: [Omnipage] "E:\Program Files\ScanSoft\OmniPageSE\opware32.exe"
    O4 - HKLM\..\Run: [IPInSightLAN 01] "E:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe" -l
    O4 - HKLM\..\Run: [IPInSightMonitor 01] "E:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe"
    O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "E:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] E:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [QuickTime Task] "E:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "E:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
    O4 - HKLM\..\Run: [UpdReg] E:\WINDOWS\UpdReg.EXE
    O4 - HKLM\..\Run: [Jet Detection] "E:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "E:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
    O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] "E:\Program Files\Google\Gmail Notifier\gnotify.exe"
    O4 - HKLM\..\Run: [MediaLifeService] "E:\Program Files\Logitech\MediaLife\MediaLifeService.exe"
    O4 - HKLM\..\Run: [TkBellExe] "E:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [YSearchProtection] "E:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
    O4 - HKLM\..\Run: [WD Button Manager] WDBtnMgr.exe
    O4 - HKLM\..\Run: [mcagent_exe] "E:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
    O4 - HKLM\..\Run: [SiteAdvisor] "E:\Program Files\SiteAdvisor\6261\SiteAdv.exe"
    O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] E:\PROGRA~1\Nero\data\Xtras\mssysmgr.exe
    O4 - HKCU\..\Run: [LDM] "E:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe"
    O4 - HKCU\..\Run: [swg] E:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [ctfmon.exe] E:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [YSearchProtection] "E:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] "E:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
    O4 - HKCU\..\Run: [SUPERAntiSpyware] E:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
    O4 - Global Startup: Adobe Gamma Loader.lnk = E:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Adobe Gamma.lnk = E:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: eFax 4.3.lnk = E:\Program Files\eFax Messenger 4.3\J2GTray.exe
    O4 - Global Startup: Google Updater.lnk = E:\Program Files\Google\Google Updater\GoogleUpdater.exe
    O4 - Global Startup: Logitech Desktop Messenger.lnk = E:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    O4 - Global Startup: Logitech SetPoint.lnk = E:\Program Files\Logitech\SetPoint\SetPoint.exe
    O4 - Global Startup: WD Backup Monitor.lnk = E:\Program Files\My Book\WD Backup\uBBMonitor.exe
    O4 - Global Startup: Wireless Configuration Utility HW.51.lnk = E:\Program Files\802.11 Wireless LAN\802.11g Wireless Cardbus & PCI Adapter HW.51 V1.00\WlanCU.exe
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O8 - Extra context menu item: Convert link target to Adobe PDF - res://E:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert link target to existing PDF - res://E:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert selected links to Adobe PDF - res://E:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 - Extra context menu item: Convert selected links to existing PDF - res://E:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 - Extra context menu item: Convert selection to Adobe PDF - res://E:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert selection to existing PDF - res://E:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert to Adobe PDF - res://E:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert to existing PDF - res://E:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - E:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
    O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - E:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
    O15 - Trusted Zone: http://linktrader.cyberspacehq.com
    O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
    O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
    O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.costcophotocenter.com/CostcoActivia.cab
    O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
    O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD42/J...65/&filename=jinstall-6u6-windows-i586-jc.cab
    O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
    O16 - DPF: {D6E7CFB5-C074-4D1C-B647-663D1A8D96BF} (Facebook Photo Uploader 4) - http://upload.facebook.com/controls/FacebookPhotoUploader4_5.cab
    O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - E:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
    O20 - Winlogon Notify: !SASWinLogon - E:\Program Files\SUPERAntiSpyware\SASWINLO.dll
    O23 - Service: McAfee Application Installer Cleanup (0216991213461879) (0216991213461879mcinstcleanup) - Unknown owner - E:\DOCUME~1\MainUser\LOCALS~1\Temp\021699~1.EXE (file missing)
    O23 - Service: Adobe LM Service - Adobe Systems - E:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Google Updater Service (gusvc) - Google - E:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InCD Helper (InCDsrv) - Nero AG - E:\Program Files\Ahead\InCD\InCDsrv.exe
    O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - E:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - E:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - e:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
    O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - E:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
    O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - e:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
    O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - E:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - E:\Program Files\McAfee\MPF\MPFSrv.exe
    O23 - Service: SiteAdvisor Service - Unknown owner - E:\Program Files\SiteAdvisor\6261\SAService.exe
    --
    End of file - 13325 bytes
     
  11. quickcomps

    quickcomps Thread Starter

    Joined:
    Jun 14, 2008
    Messages:
    12
    --------------------------------------------------------------------------------
    KASPERSKY ONLINE SCANNER 7 REPORT
    Wednesday, June 18, 2008
    Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600)
    Kaspersky Online Scanner 7 version: 7.0.25.0
    Program database last update: Wednesday, June 18, 2008 15:36:21
    Records in database: 878919
    --------------------------------------------------------------------------------
    Scan settings:
    Scan using the following database: extended
    Scan archives: yes
    Scan mail databases: yes
    Scan area - My Computer:
    D:\
    E:\
    F:\
    Scan statistics:
    Files scanned: 225340
    Threat name: 0
    Infected objects: 0
    Suspicious objects: 0
    Duration of the scan: 03:20:55
    No malware has been detected. The scan area is clean.
    The selected area was scanned.
     
  12. quickcomps

    quickcomps Thread Starter

    Joined:
    Jun 14, 2008
    Messages:
    12
    Problem appears to be gone. Thanks so much.
     
  13. cybertech

    cybertech Retired Moderator

    Joined:
    Apr 16, 2002
    Messages:
    72,115
    Run HJT again and put a check in the following:

    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
    O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
    O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
    O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - E:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)

    Close all applications and browser windows before you click "fix checked".


    Follow these steps to uninstall Combofix and tools used in the removal of malware
    • Click START then RUN
    • Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.
      [​IMG]


    It's a good idea to Flush your System Restore after removing malware:
    Turn off system restore and then turn it back on: http://support.microsoft.com/kb/310405



    Now you should Clean up your PC


    Here are some additional links for you to check out to help you with your computer security.

    How did I get infected in the first place.

    Secunia software inspector & update checker

    Good free tools and advice on how to tighten your security settings.

    Security Help Tools



    You're welcome!
     
  14. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/721450

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice