Hijackthis Log - Spybot Can't Get Rid Of Virtumonde - Help![RESOLVED]

DaDooDaidy · November 8, 2007

Logfile of HijackThis v1.99.1

Scan saved at 9:02:03 PM, on 11/7/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Unable to get Internet Explorer version!

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Intel\ASF Agent\ASFAgent.exe

C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\fxssvc.exe

d:\apps\timbuktupro\tb2launch.exe

d:\apps\timbuktupro\tb2pro.exe

d:\apps\timbuktupro\TNOTIFY.EXE

C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files\InCode Solutions\RemoveIT Pro v4\removeit.exe

C:\Program Files\InCode Solutions\RemoveIT Pro v4\HLP.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe

D:\Apps\MozillaFirefox\firefox.exe

C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost

N3 - Netscape 7: user_pref("browser.startup.homepage", "http://home.netscape.com/bookmark/7_1/home.html"); (C:\Documents and Settings\Toomay Technologies\Application Data\Mozilla\Profiles\default\fjdfuyfh.slt\prefs.js)

N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://D%3A%5CApps%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Toomay Technologies\Application Data\Mozilla\Profiles\default\fjdfuyfh.slt\prefs.js)

O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll

O3 - Toolbar: (no name) - {11A69AE4-FBED-4832-A2BF-45AF82825583} - (no file)

O4 - HKLM\..\RunOnce: [spybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [LDM] D:\Apps\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\Run: [RemoveIT Pro v4Ent] C:\Program Files\InCode Solutions\RemoveIT Pro v4\removeit.exe

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll

O13 - DefaultPrefix:

O13 - WWW Prefix:

O13 - Home Prefix:

O13 - Mosaic Prefix:

O13 - FTP Prefix:

O13 - Gopher Prefix:

O15 - ProtocolDefaults: '@ivt' protocol is in My Computer Zone, should be Intranet Zone (HKLM)

O15 - ProtocolDefaults: 'file' protocol is in My Computer Zone, should be Internet Zone (HKLM)

O15 - ProtocolDefaults: 'ftp' protocol is in My Computer Zone, should be Internet Zone (HKLM)

O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone (HKLM)

O15 - ProtocolDefaults: 'https' protocol is in My Computer Zone, should be Internet Zone (HKLM)

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1175192453156

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1175192156937

O17 - HKLM\System\CCS\Services\Tcpip\..\{EEC031E1-756A-457E-B6D4-C970BCB7C18D}: NameServer = 208.57.0.11,208.57.0.10

O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - D:\Apps\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll

O23 - Service: ASF Agent (ASFAgent) - Intel Corporation - C:\Program Files\Intel\ASF Agent\ASFAgent.exe

O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - D:\Apps\Symantec\pcAnywhere\awhost32.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)

O23 - Service: Symantec Password Validation (ccPwdSvc) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe (file missing)

O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)

O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h cltCommon (file missing)

O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe

O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - D:\Apps\NortonAV7\isPwdSvc.exe

O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)

O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)

O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe

O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

O23 - Service: ScriptBlocking Service (SBService) - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe (file missing)

O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

O23 - Service: Tb2 Launch (Tb2Launch) - Netopia, Inc. - d:\apps\timbuktupro\tb2launch.exe

Andro1d · November 8, 2007

Hello and Welcome to BT.

I am MoNsTeReNeRgY22 and I will be assisting you with your malware problem today.

Step 1

Download ComboFix from Here or Here to your Desktop.

Double click combofix.exe and follow the prompts.
When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply

Note: Do not mouseclick combofix's window while its running. That may cause it to stall

Step 2

Open HijackThis, click Config, click Misc Tools

Click "Open Uninstall Manager"

Click "Save List" (generates uninstall_list.txt)

Click Save, copy and paste the results in your next post along with teh ComboFix log.

DaDooDaidy · November 8, 2007

Hello and Welcome to BT.
I am MoNsTeReNeRgY22 and I will be assisting you with your malware problem today.
Step 1
Download ComboFix from Here or Here to your Desktop.
Double click combofix.exe and follow the prompts.
When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply
Note: Do not mouseclick combofix's window while its running. That may cause it to stall
Step 2
Open HijackThis, click Config, click Misc Tools
Click "Open Uninstall Manager"
Click "Save List" (generates uninstall_list.txt)
Click Save, copy and paste the results in your next post along with teh ComboFix log.

I seem to be stuck on Step 1. ComboFix.exe appears to be running fine. Two DOS windows are open that are blank for about 10 minutes. The first window says C:\WINDOWS\SYSTEM32.EXE in the title bar and the second window is blank. I've done this twice and the same thing happened. I did Step 2 after the first attempt, but no log file was produced and HijinxThis closed. I did not click in combofix's window. Am I just support to wait? Because all my desktop icons have disappeared when the two blank dos windows appear. Help.

DaDooDaidy · November 8, 2007

UPDATE!

I got some other instructions from the downloads I did yesterday. That file that couldn't be deleted is gone. Thanks for your help on that.

I used RemoveIT Pro v4 with Unlocker Assistant to get rid of ddaby.dll and SpyBot blocked it from getting added to the registry.

I have a slightly different problem now that I hope you can help me with. I may have reversed some changes with SpyBot that I didn't mean to do. My Programs list in the start menu is gone, but programs still work. I may have lost iTunes. Please let me know what I can do to help restore some of the stuff.

Edited November 8, 2007 by DaDooDaidy

Andro1d · November 9, 2007

Try doing last Good Known Configuration.

DaDooDaidy · November 9, 2007

Try doing last Good Known Configuration.

No, I'm afraid that didn't work.

I keep getting a Windows Installer thing periodically.

I am unable to use the modem.

Edited November 9, 2007 by DaDooDaidy

Andro1d · November 10, 2007

Hello, try using System Restore.

If you have any questions look at the following link or ask here.

http://www.microsoft.com/windowsxp/using/h...temrestore.mspx

DaDooDaidy · November 10, 2007

Hello, try using System Restore.
If you have any questions look at the following link or ask here.
http://www.microsoft.com/windowsxp/using/h...temrestore.mspx

Thank you for that link, which looks very helpful. Unfortunately, I can't get to either option, so I can't do it. I must backup and reinstall Windows. Why me?!

Andro1d · November 10, 2007

Download Deckard's System Scanner (DSS) to your Desktop.

Close all applications and windows.
Double-click on DSS.exe to run it, and follow the prompts.
When it has finished, dss will open two Notepads main.txt and extra.txt -- please copy (CTRL+A and then CTRL+C) and paste (CTRL+V) the contents of main.txt and extra.txt in your next reply.

Extra Note: When running DSS, some firewalls may warn that sigcheck.exe is trying to access the internet - please ensure that you allow sigcheck.exe permission to do so. Also, it may happen that your Antivirus flags DSS as suspicious. Please allow the Deckard's System Scanner to run and don't let your Antivirus delete it. (In this case, it may be better to temporary disable your Antivirus)

Edited November 10, 2007 by MoNsTeReNeRgY22

DaDooDaidy · November 10, 2007

Here are the files. I also have a hijackthis.log file and a hijackthis dialog window open. What do I do next?

main.txt

Deckard's System Scanner v20071014.68

Run by Toomay Technologies on 2007-11-10 11:35:41

Computer is in Normal Mode.

--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Failed to create restore point; System Restore is disabled (service is not running).

-- Last 5 Restore Point(s) --

36: 2007-11-07 15:04:51 UTC - RP1076 - Software Distribution Service 3.0

35: 2007-11-06 17:01:58 UTC - RP1075 - Last known good configuration

34: 2007-11-06 00:16:24 UTC - RP1074 - System Checkpoint

33: 2007-11-04 01:37:21 UTC - RP1073 - System Checkpoint

32: 2007-11-02 23:57:52 UTC - RP1072 - System Checkpoint

-- First Restore Point --

1: 2007-09-23 23:32:53 UTC - RP1041 - System Checkpoint

Backed up registry hives.

Performed disk cleanup.

-- HijackThis (run as Toomay Technologies.exe) ---------------------------------

Unable to find log (file not found); running clone.

-- HijackThis Clone ------------------------------------------------------------

Emulating logfile of Trend Micro HijackThis v2.0.2

Scan saved at 2007-11-10 11:37:30

Platform: Windows XP Service Pack 2 (5.01.2600)

MSIE: Internet Explorer (6.0.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\SYSTEM32\smss.exe

C:\WINDOWS\SYSTEM32\winlogon.exe

C:\WINDOWS\SYSTEM32\services.exe

C:\WINDOWS\SYSTEM32\lsass.exe

C:\WINDOWS\SYSTEM32\svchost.exe

C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

C:\WINDOWS\SYSTEM32\spoolsv.exe

C:\Program Files\Intel\ASF Agent\ASFAgent.exe

C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe

C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

C:\WINDOWS\SYSTEM32\nvsvc32.exe

D:\Apps\timbuktupro\tb2launch.exe

C:\WINDOWS\SYSTEM32\fxssvc.exe

D:\Apps\timbuktupro\tb2pro.exe

D:\Apps\timbuktupro\TNotify.exe

C:\WINDOWS\explorer.exe

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\Program Files\InCode Solutions\RemoveIT Pro v4\HLP.exe

C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

C:\Documents and Settings\Toomay Technologies\Desktop\dss.exe

C:\Documents and Settings\Toomay Technologies\Desktop\Toomay Technologies.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com

O2 - BHO: (no name) - {1C1DD717-53B2-485E-A17B-C9977C205E10} - (no file)

O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBHO.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O2 - BHO: (no name) - {AF4535AA-6BBA-4B92-9F85-7A5488F03926} - (no file)

O2 - BHO: (no name) - {C2FB8A5C-CEC8-4E21-93F3-FF0CE1331C86} - (no file)

O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll

O4 - HKLM\..\Run: [unlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"

O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [LDM] D:\Apps\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\Run: [RemoveIT Pro v4Ent] C:\Program Files\InCode Solutions\RemoveIT Pro v4\removeit.exe

O4 - HKUS\S-1-5-18\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'Default user')

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O15 - Trusted Zone: https://turbotax.com (HKCU)

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1175192453156

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1175192156937

O17 - HKLM\SYSTEM\CCS\Services\Tcpip\..\{EEC031E1-756A-457E-B6D4-C970BCB7C18D}: NameServer = 208.57.0.11,208.57.0.10

O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - D:\Apps\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll

O23 - Service: ASF Agent (ASFAgent) - Intel Corporation - C:\Program Files\Intel\ASF Agent\ASFAgent.exe

O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe

O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - D:\Apps\Symantec\pcAnywhere\AWHOST32.EXE

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

O23 - Service: Symantec Password Validation (ccPwdSvc) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe

O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - D:\Apps\NortonAV7\isPwdSvc.exe

O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_2.EXE

O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

O23 - Service: Intel NCS NetService (NetSvc) - IntelÂ® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe

O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\SYSTEM32\nvsvc32.exe

O23 - Service: ScriptBlocking Service (SBService) - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe

O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

O23 - Service: Tb2 Launch (Tb2Launch) - Netopia, Inc. - D:\Apps\timbuktupro\tb2launch.exe

--

End of file - 6953 bytes

-- File Associations -----------------------------------------------------------

All associations okay.

-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R0 agp440 (Intel AGP Bus Filter) - c:\windows\\systemroot\system32\drivers\agp440.sys (file missing)

R0 Gernuwa - c:\windows\system32\drivers\gernuwa.sys <Not Verified; Symantec Corporation; pcAnywhere>

R1 AW_HOST - c:\windows\system32\drivers\aw_host5.sys <Not Verified; Symantec Corporation; pcAnywhere>

R1 awlegacy - c:\windows\system32\drivers\awlegacy.sys <Not Verified; Symantec Corporation; pcAnywhere>

R1 omci (OMCI WDM Device Driver) - c:\windows\system32\drivers\omci.sys <Not Verified; Dell Computer Corporation; OMCI Driver>

R1 Tb2Device (TB2 Remote Control Driver) - c:\windows\netopiarc\tb2device.sys

R2 AsfAlrt - c:\windows\system32\drivers\asfalrt.sys <Not Verified; Intel Corporation; Intel Alert on LANÂ® 2>

R2 MCSTRM - c:\windows\system32\drivers\mcstrm.sys <Not Verified; RealNetworks, Inc.; RealNetworks Virtual Path ManagerÂ® (32-bit)>

R2 MDC8021X (AEGIS Protocol (IEEE 802.1x) v2.3.1.6) - c:\windows\system32\drivers\mdc8021x.sys <Not Verified; Meetinghouse Data Communications; AEGIS Client 2.3.1>

S1 Tb2MirrorSys (TB2 Remote Control Mirror Driver) - netopiarc\tb2mirrorsys.sys (file missing)

S3 catchme - c:\docume~1\toomay~1\locals~1\temp\catchme.sys (file missing)

-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 ASFAgent (ASF Agent) - c:\program files\intel\asf agent\asfagent.exe <Not Verified; Intel Corporation; IntelÂ® PRO Alerting Suite ASF 1.0 and ASF 2.0 Compatible>

R2 Tb2Launch (Tb2 Launch) - "d:\apps\timbuktupro\tb2launch.exe" <Not Verified; Netopia, Inc.; Timbuktu Pro for Windows>

S2 SBService (ScriptBlocking Service) - c:\progra~1\common~1\symant~1\script~1\sbserv.exe (file missing)

S3 awhost32 (pcAnywhere Host Service) - d:\apps\symantec\pcanywhere\awhost32.exe <Not Verified; Symantec Corporation; pcAnywhere>

S3 ccPwdSvc (Symantec Password Validation) - "c:\program files\common files\symantec shared\ccpwdsvc.exe" (file missing)

-- Device Manager: Disabled ----------------------------------------------------

No disabled devices found.

-- Scheduled Tasks -------------------------------------------------------------

2007-11-05 20:02:14 602 --a------ C:\WINDOWS\Tasks\Norton Internet Security - Run Full System Scan - Toomay Technologies.job

-- Files created between 2007-10-10 and 2007-11-10 -----------------------------

2007-11-09 17:08:16 0 d-------- C:44e4deb25fec79f4a780a36a9

2007-11-09 16:47:53 0 d-------- C:\43b7207fd9cdf2d7af24befb

2007-11-08 10:55:44 317 ---hs---- C:\WINDOWS\system32\jjjlm.ini2

2007-11-07 21:01:05 0 d-------- C:\HJT

2007-11-07 19:58:16 0 d-------- C:\Documents and Settings\Toomay Technologies\Application Data\Lavasoft

2007-11-07 19:57:54 0 d-------- C:\Program Files\Lavasoft

2007-11-07 17:48:44 0 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy

2007-11-07 14:36:01 0 d--hs---- C:\GA6P

2007-11-07 14:30:21 8704 --a------ C:\WINDOWS\system32\SpOrder.dll <Not Verified; Microsoft Corporation; MicrosoftÂ® WindowsÂ® Operating System>

2007-11-07 12:47:11 0 d-------- C:\Program Files\InCode Solutions

2007-11-07 10:29:13 0 d-------- C:\Program Files\NoAdware5.0

2007-11-07 07:07:26 0 d-------- C:\Program Files\MSXML 4.0

2007-11-06 21:39:22 0 d-------- C:\WINDOWS\system32\SoftwareDistribution

2007-11-06 21:04:49 87104 --a------ C:\WINDOWS\system32\hjfiyxxs.dll

2007-11-06 21:04:18 0 --a------ C:\WINDOWS\system32\ifbkicst.dll

-- Find3M Report ---------------------------------------------------------------

2007-11-10 11:37:46 0 d-------- C:\Program Files\Common Files\Symantec Shared

2007-11-10 10:22:55 0 d-------- C:\Program Files\Sagekey Software

2007-11-07 17:08:27 0 d-------- C:\Program Files\Common Files

2007-11-07 07:21:17 0 d-------- C:\Program Files\Messenger

2007-11-06 21:20:01 0 d-------- C:\Program Files\Symantec

2007-08-28 15:08:27 4 --a------ C:\WINDOWS\system32\C8DE69

-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1C1DD717-53B2-485E-A17B-C9977C205E10}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AF4535AA-6BBA-4B92-9F85-7A5488F03926}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C2FB8A5C-CEC8-4E21-93F3-FF0CE1331C86}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe" [09/07/2006 09:19 AM]

"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [01/09/2007 09:59 PM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [10/13/2004 08:24 AM]

"LDM"="D:\Apps\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" []

"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [08/31/2007 04:46 PM]

"RemoveIT Pro v4Ent"="C:\Program Files\InCode Solutions\RemoveIT Pro v4\removeit.exe" [11/07/2007 03:28 PM]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]

"ALUAlert"=C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe

C:\Documents and Settings\Toomay Technologies\Start Menu\Programs\Startup\

DESKTOP.INI [3/20/2004 9:58:38 AM]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

"Authentication Packages"= msv1_0 C:\WINDOWS\system32\mljjj.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]

@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]

@="Volume shadow copy"

*Newly Created Service* - COMHOST

-- Hosts -----------------------------------------------------------------------

127.0.0.1 007guard.com

127.0.0.1 www.007guard.com

127.0.0.1 008i.com

127.0.0.1 008k.com

127.0.0.1 www.008k.com

127.0.0.1 00hq.com

127.0.0.1 www.00hq.com

127.0.0.1 010402.com

127.0.0.1 032439.com

127.0.0.1 www.032439.com

7429 more entries in hosts file.

-- End of Deckard's System Scanner: finished at 2007-11-10 11:38:41 ------------

extra.txt

Deckard's System Scanner v20071014.68

Extra logfile - please post this as an attachment with your post.

--------------------------------------------------------------------------------

-- System Information ----------------------------------------------------------

Microsoft Windows XP Professional (build 2600) SP 2.0

Architecture: X86; Language: English

CPU 0: IntelÂ® PentiumÂ® 4 CPU 2.80GHz

Percentage of Memory in Use: 56%

Physical Memory (total/avail): 1023 MiB / 441.56 MiB

Pagefile Memory (total/avail): 2464.01 MiB / 2078.53 MiB

Virtual Memory (total/avail): 2047.88 MiB / 1936.39 MiB

A: is Removable (No Media)

C: is Fixed (NTFS) - 74.46 GiB total, 61.3 GiB free.

D: is Fixed (NTFS) - 74.5 GiB total, 0.16 GiB free.

E: is CDROM (No Media)

F: is CDROM (No Media)

U: is Network (NTFS)

Z: is Network (NTFS)

\\.\PHYSICALDRIVE1 - Maxtor 6Y080L0 - 74.5 GiB - 1 partition

\PARTITION0 - Installable File System - 74.5 GiB - D:

\\.\PHYSICALDRIVE0 - Maxtor 6Y080L0 - 74.5 GiB - 2 partitions

\PARTITION0 - Unknown - 39.19 MiB

\PARTITION1 (bootable) - Installable File System - 74.46 GiB - C:

-- Security Center -------------------------------------------------------------

AUOptions is scheduled to auto-install.

Windows Internal Firewall is disabled.

FW: Norton Internet Security v2007 (Symantec Corporation)

AV: Norton Internet Security v2007 (Symantec Corporation)

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

-- Environment Variables -------------------------------------------------------

ALLUSERSPROFILE=C:\Documents and Settings\All Users

APPDATA=C:\Documents and Settings\Toomay Technologies\Application Data

CLASSPATH=.;C:\Program Files\Java\j2re1.4.2_03\lib\ext\QTJava.zip

CLIENTNAME=Console

CommonProgramFiles=C:\Program Files\Common Files

COMPUTERNAME=ABDAT10407

ComSpec=C:\WINDOWS\system32\cmd.exe

FP_NO_HOST_CHECK=NO

HOMEDRIVE=C:

HOMEPATH=\Documents and Settings\Toomay Technologies

LOGONSERVER=\\ABDAT10407

NUMBER_OF_PROCESSORS=1

OS=Windows_NT

Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\Common Files\Adaptec Shared\System;D:\Apps\Symantec\pcAnywhere\;C:\Program Files\QuickTime\QTSystem\

PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH

PROCESSOR_ARCHITECTURE=x86

PROCESSOR_IDENTIFIER=x86 Family 15 Model 3 Stepping 4, GenuineIntel

PROCESSOR_LEVEL=15

PROCESSOR_REVISION=0304

ProgramFiles=C:\Program Files

PROMPT=$P$G

QTJAVA=C:\Program Files\Java\j2re1.4.2_03\lib\ext\QTJava.zip

SESSIONNAME=Console

SystemDrive=C:

SystemRoot=C:\WINDOWS

TEMP=C:\DOCUME~1\TOOMAY~1\LOCALS~1\Temp

TMP=C:\DOCUME~1\TOOMAY~1\LOCALS~1\Temp

USERDOMAIN=ABDAT10407

USERNAME=Toomay Technologies

USERPROFILE=C:\Documents and Settings\Toomay Technologies

windir=C:\WINDOWS

-- User Profiles ---------------------------------------------------------------

Toomay Technologies (admin)

User1 (admin)

Administrator (admin)

-- Add/Remove Programs ---------------------------------------------------------

Ad-Aware SE Personal --> C:\PROGRA~1\Lavasoft\AD-AWA~1\UNWISE.EXE C:\PROGRA~1\Lavasoft\AD-AWA~1\INSTALL.LOG

HijackThis 1.99.1 --> C:\Documents and Settings\Toomay Technologies\Desktop\HijackThis.exe /uninstall

Spybot - Search & Destroy --> "C:\Program Files\Spybot - Search & Destroy\unins000.exe"

Unlocker 1.8.5 --> C:\Program Files\Unlocker\uninst.exe

-- Application Event Log -------------------------------------------------------

Event Record #/Type33683 / Warning

Event Submitted/Written: 11/10/2007 08:35:54 AM

Event ID/Source: 1001 / MsiInstaller

Event Description:

Detection of product '{AAA11090-6E99-4655-AAF5-57EB5F677D0C}', feature 'MarketResearch' failed during request for component '{54DF6C52-5A64-4FBE-B81A-3DD95E0D854D}'

Event Record #/Type33682 / Warning

Event Submitted/Written: 11/10/2007 08:35:53 AM

Event ID/Source: 1001 / MsiInstaller

Event Description:

Detection of product '{AAA11090-6E99-4655-AAF5-57EB5F677D0C}', feature 'MarketResearch' failed during request for component '{54DF6C52-5A64-4FBE-B81A-3DD95E0D854D}'

Event Record #/Type33681 / Warning

Event Submitted/Written: 11/10/2007 08:35:53 AM

Event ID/Source: 1001 / MsiInstaller

Event Description:

Detection of product '{AAA11090-6E99-4655-AAF5-57EB5F677D0C}', feature 'MarketResearch' failed during request for component '{54DF6C52-5A64-4FBE-B81A-3DD95E0D854D}'

Event Record #/Type33680 / Warning

Event Submitted/Written: 11/10/2007 08:35:53 AM

Event ID/Source: 1001 / MsiInstaller

Event Description:

Detection of product '{AAA11090-6E99-4655-AAF5-57EB5F677D0C}', feature 'MarketResearch' failed during request for component '{54DF6C52-5A64-4FBE-B81A-3DD95E0D854D}'

Event Record #/Type33679 / Warning

Event Submitted/Written: 11/10/2007 08:35:53 AM

Event ID/Source: 1001 / MsiInstaller

Event Description:

Detection of product '{AAA11090-6E99-4655-AAF5-57EB5F677D0C}', feature 'MarketResearch' failed during request for component '{54DF6C52-5A64-4FBE-B81A-3DD95E0D854D}'

-- Security Event Log ----------------------------------------------------------

No Errors/Warnings found.

-- System Event Log ------------------------------------------------------------

Event Record #/Type3803 / Warning

Event Submitted/Written: 11/10/2007 08:58:54 AM

Event ID/Source: 4226 / Tcpip

Event Description:

TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.

Event Record #/Type3802 / Warning

Event Submitted/Written: 11/10/2007 08:21:46 AM

Event ID/Source: 4226 / Tcpip

Event Description:

TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.

Event Record #/Type3792 / Warning

Event Submitted/Written: 11/09/2007 07:23:51 PM

Event ID/Source: 3019 / MRxSmb

Event Description:

The redirector failed to determine the connection type.

Event Record #/Type3791 / Warning

Event Submitted/Written: 11/09/2007 07:23:51 PM

Event ID/Source: 3019 / MRxSmb

Event Description:

The redirector failed to determine the connection type.

Event Record #/Type3786 / Warning

Event Submitted/Written: 11/09/2007 07:15:13 PM

Event ID/Source: 3019 / MRxSmb

Event Description:

The redirector failed to determine the connection type.

-- End of Deckard's System Scanner: finished at 2007-11-10 11:38:41 ------------

hijackthis.log

Logfile of HijackThis v1.99.1

Scan saved at 11:37:32 AM, on 11/10/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Unable to get Internet Explorer version!

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Intel\ASF Agent\ASFAgent.exe

C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

C:\WINDOWS\System32\nvsvc32.exe

d:\apps\timbuktupro\tb2launch.exe

C:\WINDOWS\system32\fxssvc.exe

d:\apps\timbuktupro\tb2pro.exe

d:\apps\timbuktupro\TNOTIFY.EXE

C:\WINDOWS\Explorer.EXE

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\Program Files\InCode Solutions\RemoveIT Pro v4\HLP.exe

C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

C:\Documents and Settings\Toomay Technologies\Desktop\dss.exe

C:\DOCUME~1\TOOMAY~1\Desktop\Toomay Technologies.exe