Computer Is Running Slow[RESOLVED]

Fireman17

By Fireman17,
in Malware Removal

 Share Followers 0

Recommended Posts

Fireman17

Fireman17

Posted
Posted

My computer starting running slow i think i got malware on it here is my Hijackthis log.

Logfile of HijackThis v1.99.1

Scan saved at 7:07:13 AM, on 1/29/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

C:\Program Files\Common Files\Symantec Shared\ccProxy.exe

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe

C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe

C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe

C:\PROGRA~1\Grisoft\AVG7\avgemc.exe

C:\Program Files\Gizmo Project\mDNSResponder.exe

C:\Program Files\LANDesk\Shared Files\residentagent.exe

C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe

C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

C:\Program Files\Gateway\GSM\BIN\modemview.exe

C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe

C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe

C:\Program Files\Gateway\GSM\bin\usm.exe

C:\Program Files\BroadJump\Client Foundation\CFD.exe

C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

C:\Program Files\Microsoft IntelliType Pro\itype.exe

C:\Program Files\Microsoft IntelliPoint\ipoint.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\PROGRA~1\Grisoft\AVG7\avgcc.exe

C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe

C:\Program Files\Pure Networks\Network Magic\nmapp.exe

c:\Program Files\Microsoft IntelliType Pro\dpupdchk.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\AceLogix\Free Ram Optimizer\fro.exe

C:\Program Files\xchat\xchat.exe

C:\Program Files\mIRC\mirc.exe

C:\Program Files\twhirl - a twitter client\twhirl.exe

C:\Program Files\Pidgin\pidgin.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Ventrilo\Ventrilo.exe

C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe

C:\Documents and Settings\Owner\My Documents\My Music\Stuff1\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.gateway.com/g/sidepanel.html?Ch...TP&M=E-1500 SB

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

O2 - BHO: VirtualCamera IEMenu Class - {0246A1A7-820A-469A-85A7-7B7F01EB808C} - (no file)

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O2 - BHO: (no name) - {3ca4bd86-f973-4924-b05d-7d3b76fb750f} - (no file)

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\windows\system32\BAE.dll

O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe

O4 - HKLM\..\Run: [HPHUPD06] C:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe

O4 - HKLM\..\Run: [GSM] C:\Program Files\Gateway\GSM\bin\usm.exe

O4 - HKLM\..\Run: [bJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [itype] "c:\Program Files\Microsoft IntelliType Pro\itype.exe"

O4 - HKLM\..\Run: [intelliPoint] "c:\Program Files\Microsoft IntelliPoint\ipoint.exe"

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP

O4 - HKLM\..\Run: [nmctxth] "C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe"

O4 - HKLM\..\Run: [nmapp] "C:\Program Files\Pure Networks\Network Magic\nmapp.exe" -autorun -nosplash

O4 - HKLM\..\Run: [WebcamMaxMoniter] "C:\Program Files\WebcamMax\CAMTHINS.exe" /m

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Free Ram Optimizer] C:\Program Files\AceLogix\Free Ram Optimizer\fro.exe

O4 - HKCU\..\Run: [WinMem] C:\Program Files\WinCleaner Memory Optimizer\WinMemOpt.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000

O9 - Extra button: Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - C:\Program Files\VisualRoute 2008\vrie.dll (file missing)

O9 - Extra 'Tools' menuitem: VisualRoute Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - C:\Program Files\VisualRoute 2008\vrie.dll (file missing)

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O11 - Options group: [iNTERNATIONAL] International*

O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m...01/mcinsctl.cab

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1104556665484

O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/m...,26/mcgdmgr.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O16 - DPF: {D71F9A27-723E-4B8B-B428-B725E47CBA3E} (Imikimi_activex_plugin Control) - http://imikimi.com/download/imikimi_plugin.cab

O18 - Protocol: pure-go - {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Common Files\Pure Networks Shared\Platform\puresp3.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - AppInit_DLLs: c:\windows\system32\awvvuvu.dll

O20 - Winlogon Notify: gebyvss - gebyvss.dll (file missing)

O20 - Winlogon Notify: HPODatl - HPODatl.dll (file missing)

O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe

O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe

O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe

O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Gizmo Project\mDNSResponder.exe

O23 - Service: LANDesk® Management Agent (CBA8) - LANDesk Software, Ltd. - C:\Program Files\LANDesk\Shared Files\residentagent.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe

O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: IS Service (ISSVC) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe

O23 - Service: LANDesk® System Manager System Space Manager (LSM_SSM) - LANDesk® Software Ltd. - C:\Program Files\Gateway\GSM\BIN\ssm.exe

O23 - Service: LANDesk Message Handler Service (ModemView) - LANDesk® Software Ltd. - C:\Program Files\Gateway\GSM\BIN\modemview.exe

O23 - Service: Pure Networks Net2Go Service (nmraapache) - Unknown owner - C:\Program Files\Pure Networks\Network Magic\WebServer\bin\nmraapache.exe" -k runservice (file missing)

O23 - Service: Pure Networks Platform Service (nmservice) - Pure Networks, Inc. - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe

O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS

O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec Client Security\Symantec AntiVirus\SavRoam.exe

O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe

O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe

O23 - Service: Symantec SecurePort (SymSecurePort) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe

Link to post
Share on other sites
Andro1d

Andro1d

Posted
Posted

Hello and Welcome to BT. :)

I am MoNsTeReNeRgY22 and I will be assisting you with your malware problem today.

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

  1. Close any open browsers.
  2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

    -----------------------------------------------------------

    • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

      -----------------------------------------------------------


[*]Double click on combofix.exe & follow the prompts.

[*]When finished, it will produce a report for you.

[*]Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

Link to post
Share on other sites
Fireman17

Fireman17

Posted
  • Author
Posted

Here is my Combo Fix and Hijackthis after i ran the Combox Fix logs that you request.

ComboFix 08-01-30.1 - Owner 2008-01-29 11:47:04.1 - NTFSx86

Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe

* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\Documents and Settings\Owner\g2mdlhlpx.exe

C:\Program Files\outlook

C:\WINDOWS\b104.exe

C:\WINDOWS\b136.exe

C:\WINDOWS\IA

C:\WINDOWS\system32\dn8c639d91.dat

C:\WINDOWS\system32\ssembl~1

C:\WINDOWS\system32\wcpicomsv.exe

C:\WINDOWS\wr.txt

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\LEGACY_CMDSERVICE

-------\LEGACY_CORE

-------\LEGACY_DOMAINSERVICE

-------\LEGACY_NETWORK_MONITOR

((((((((((((((((((((((((( Files Created from 2007-12-28 to 2008-01-30 )))))))))))))))))))))))))))))))

.

2008-01-29 07:57 . 2008-01-29 08:07 <DIR> d-------- C:\Program Files\Paint.NET

2008-01-27 01:48 . <DIR> C:\WINDOWS\LastGood.Tmp

2008-01-23 22:42 . 2008-01-23 22:42 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\PownceDesktop.1A618255CEB975BFC863E47CA16BCF2DEB687FD9.1

2008-01-21 20:01 . 2008-01-21 20:01 <DIR> d-------- C:\Program Files\twhirl - a twitter client

2008-01-20 21:56 . 2008-01-20 21:56 <DIR> d-------- C:\Program Files\PuTTY

2008-01-19 06:12 . 2008-01-19 06:14 <DIR> d-------- C:\Program Files\WebcamMax

2008-01-18 20:56 . 2008-01-18 20:56 0 --a------ C:\Documents

2008-01-16 04:50 . 2008-01-16 04:50 1,158 --a------ C:\WINDOWS\mozver.dat

2008-01-10 10:21 . 2008-01-10 10:21 <DIR> d-------- C:\Program Files\CCleaner

2008-01-07 03:32 . 2008-01-07 03:36 <DIR> d-------- C:\ERDNT

2008-01-05 09:52 . 2004-08-03 22:58 14,848 --a--c--- C:\WINDOWS\system32\drivers\kbdhid.sys

2008-01-05 09:52 . 2004-08-03 22:58 14,848 --a--c--- C:\WINDOWS\system32\dllcache\kbdhid.sys

2008-01-02 17:44 . 2008-01-02 17:44 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\de.makesoft.twhirl.0EA062BC275E7ED1E6EC3762EFFD73C7158ADF33.1

2007-12-26 22:36 . 2007-12-26 22:37 <DIR> d-------- C:\Program Files\TalkShoe

2007-12-24 23:45 . 2007-12-24 23:46 <DIR> d-------- C:\Program Files\Pidgin

2007-12-24 19:11 . 2007-12-24 19:11 <DIR> d-------- C:\Documents and Settings\brook\Application Data\Thunderbird

2007-12-21 23:02 . 2008-01-29 04:37 54,156 --ah----- C:\WINDOWS\QTFont.qfn

2007-12-21 23:02 . 2007-12-21 23:02 1,409 --a------ C:\WINDOWS\QTFont.for

2007-12-18 01:14 . 2007-12-18 01:14 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Snitter.88C687E32FFE9452F058A6F4E67005F998FC3136.1

2007-12-10 19:49 . 2007-12-10 19:50 <DIR> d-------- C:\Program Files\Ventrilo

2007-12-06 18:57 . 2007-12-06 18:57 <DIR> d-------- C:\Documents and Settings\Owner\dwhelper

2007-12-03 23:07 . 2007-12-03 23:07 <DIR> d-------- C:\Program Files\Pure Networks

2007-12-03 23:02 . 2007-09-20 10:16 23,864 --a------ C:\WINDOWS\system32\drivers\pnarp.sys

2007-12-03 23:01 . 2007-12-03 23:01 <DIR> d-------- C:\Program Files\Common Files\Pure Networks Shared

2007-12-03 23:01 . 2007-09-20 10:16 24,888 --a------ C:\WINDOWS\system32\drivers\purendis.sys

2007-12-03 21:21 . 2008-01-06 16:33 <DIR> d-------- C:\Program Files\VisualRoute 2008

2007-12-03 20:38 . 2007-12-03 21:23 <DIR> d-------- C:\Program Files\VisualRoute Lite Edition

2007-12-03 20:38 . 2007-12-03 21:18 <DIR> d-------- C:\Documents and Settings\Owner\vw

2007-12-02 23:33 . 2008-01-25 05:26 <DIR> d-------- C:\Program Files\mIRC

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-01-30 05:51 --------- d-----w C:\Documents and Settings\Owner\Application Data\X-Chat 2

2008-01-30 05:51 --------- d-----w C:\Documents and Settings\Owner\Application Data\mIRC

2008-01-30 05:51 --------- d-----w C:\Documents and Settings\Owner\Application Data\.purple

2008-01-29 23:59 --------- d-----w C:\Program Files\Mozilla Thunderbird

2008-01-29 17:47 --------- d-----w C:\Documents and Settings\Owner\Application Data\skypePM

2008-01-29 17:47 --------- d-----w C:\Documents and Settings\Owner\Application Data\Skype

2008-01-26 04:09 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg7

2008-01-25 22:46 --------- d-----w C:\Documents and Settings\Owner\Application Data\LimeWire

2008-01-13 06:15 --------- d-----w C:\Documents and Settings\Owner\Application Data\AVG7

2008-01-08 18:36 --------- d-----w C:\Program Files\Common Files\Symantec Shared

2008-01-04 23:23 --------- d-----w C:\Documents and Settings\brook\Application Data\LimeWire

2008-01-02 20:43 --------- d-----w C:\Program Files\LimeWire

2007-12-25 01:09 --------- d-----w C:\Program Files\Imikimi

2007-12-24 20:52 --------- d-----w C:\Documents and Settings\brook\Application Data\AVG7

2007-12-18 07:10 --------- d-----w C:\Program Files\Common Files\Adobe AIR

2007-12-18 02:00 --------- d-----w C:\Documents and Settings\Owner\Application Data\gtk-2.0

2007-12-17 17:19 --------- d--h--w C:\Program Files\InstallShield Installation Information

2007-12-11 01:47 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard

2007-12-04 05:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Pure Networks

2007-11-17 07:33 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3ca4bd86-f973-4924-b05d-7d3b76fb750f}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 13:00 15360]

"Free Ram Optimizer"="C:\Program Files\AceLogix\Free Ram Optimizer\fro.exe" [2003-08-22 08:19 57344]

"WinMem"="C:\Program Files\WinCleaner Memory Optimizer\WinMemOpt.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 22:24 32768]

"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 13:50 155648]

"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2005-06-02 11:21 48752]

"vptray"="C:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe" [2005-08-18 19:22 85696]

"HPHUPD06"="C:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe" [2004-06-06 22:53 49152]

"GSM"="C:\Program Files\Gateway\GSM\bin\usm.exe" [2005-05-31 23:05 9216]

"BJCFD"="C:\Program Files\BroadJump\Client Foundation\CFD.exe" [2002-09-10 20:26 368706]

"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11 132496]

"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 05:24 286720]

"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 02:06 40048]

"itype"="c:\Program Files\Microsoft IntelliType Pro\itype.exe" [2007-08-31 11:13 988584]

"IntelliPoint"="c:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2007-08-31 11:01 1037736]

"SoundMan"="SOUNDMAN.EXE" [2007-04-16 14:28 577536 C:\WINDOWS\soundman.exe]

"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-12-21 08:34 579072]

"nmctxth"="C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2007-10-01 20:08 451896]

"nmapp"="C:\Program Files\Pure Networks\Network Magic\nmapp.exe" [2007-10-29 22:04 451896]

"WebcamMaxMoniter"="C:\Program Files\WebcamMax\CAMTHINS.exe" [2007-03-07 05:46 81920]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-11-15 16:19 219136]

C:\Documents and Settings\brook\Start Menu\Programs\Startup\

LimeWire On Startup.lnk - C:\Program Files\LimeWire\LimeWire.exe [2006-08-16 13:16:24 159744]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\

Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\gebyvss]

gebyvss.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\HPODatl]

HPODatl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\windows\system32\awvvuvu.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]

path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk

backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk]

path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk

backup=C:\WINDOWS\pss\HP Image Zone Fast Start.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]

--a--c--- 2004-05-12 15:18 241664 C:\Program Files\HP\hpcoretech\hpcmpmgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]

--a--c--- 2004-02-12 13:38 49152 C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHmon06]

--a--c--- 2004-06-06 22:42 659456 C:\WINDOWS\system32\hphmon06.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM]

C:\Program Files\MySpace\IM\MySpaceIM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Recguard]

%WINDIR%\SMINST\RECGUARD.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]

--a------ 2007-08-31 15:46 1460560 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]

--a--c--- 2006-11-10 11:35 90112 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]

C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WebcamMaxMoniter]

--a------ 2007-03-07 05:46 81920 C:\Program Files\WebcamMax\CAMTHINS.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winlog]

R2 CamthWDM;WebcamMax, WDM Video Capture;C:\WINDOWS\system32\DRIVERS\CamthWDM.sys [2007-01-10 23:39]

R2 CBA8;LANDesk® Management Agent;"C:\Program Files\LANDesk\Shared Files\residentagent.exe" [2005-04-28 14:05]

R2 CISMBIOS;CiSMBios Driver;C:\WINDOWS\system32\Drivers\CISMBIOS.SYS [2005-05-31 22:53]

R2 ModemView;LANDesk Message Handler Service;C:\Program Files\Gateway\GSM\BIN\modemview.exe [2005-05-31 23:13]

R3 ICFWDM;ICFWDM;C:\WINDOWS\system32\drivers\icfwdm.sys [2002-06-20 11:35]

S2 LSM_SSM;LANDesk® System Manager System Space Manager;C:\Program Files\Gateway\GSM\BIN\ssm.exe [2005-05-31 23:04]

S3 el575nd5;3Com Megahertz 10/100 LAN CardBus PC Card Driver;C:\WINDOWS\system32\DRIVERS\el575nd5.sys [2001-08-17 20:10]

S3 NTPASp50;NTPASp50 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\NTPASp50.sys [2004-08-10 08:57]

S3 SUPERWEBCAM;SuperWebcam, WDM Virtual Video Capture Device;C:\WINDOWS\system32\DRIVERS\superwebcam.sys [2006-06-27 07:56]

S3 SWLD23U;Netopia 802.11b WLAN USB Adapter;C:\WINDOWS\system32\DRIVERS\SWLD23U.sys [2003-12-17 11:58]

S3 swlubtl;WLAN USB Boot Device;C:\WINDOWS\system32\Drivers\swlubtl.sys [2003-05-02 16:26]

.

Contents of the 'Scheduled Tasks' folder

"2005-03-23 04:05:05 C:\WINDOWS\Tasks\ISP signup reminder 1.job"

- C:\WINDOWS\system32\OOBE\oobebaln.exe

"2005-03-23 04:05:05 C:\WINDOWS\Tasks\ISP signup reminder 2.job"

- C:\WINDOWS\system32\OOBE\oobebaln.exe

"2005-03-23 04:05:05 C:\WINDOWS\Tasks\ISP signup reminder 3.job"

- C:\WINDOWS\system32\OOBE\oobebaln.exe

"2007-10-04 09:34:47 C:\WINDOWS\Tasks\Microsoft_Hardware_Launch_IPoint_exe.job"

- c:\Program Files\Microsoft IntelliPoint\ipoint.exe

"2007-10-04 09:34:47 C:\WINDOWS\Tasks\Microsoft_Hardware_Launch_IType_exe.job"

- c:\Program Files\Microsoft IntelliType Pro\itype.exe

"2005-03-23 04:04:30 C:\WINDOWS\Tasks\Symantec NetDetect.job"

- C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE

.

**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-01-29 23:56:45

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

------------------------ Other Running Processes ------------------------

.

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

C:\Program Files\Common Files\Symantec Shared\ccProxy.exe

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe

C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe

C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe

C:\PROGRA~1\Grisoft\AVG7\avgemc.exe

C:\Program Files\Gizmo Project\mDNSResponder.exe

C:\Program Files\LANDesk\Shared Files\residentagent.exe

C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe

C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

C:\Program Files\Gateway\GSM\BIN\modemview.exe

C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS

C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe

C:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe

C:\Program Files\Gateway\GSM\bin\usm.exe

C:\Program Files\BroadJump\Client Foundation\CFD.exe

C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe

C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

C:\Program Files\Microsoft IntelliType Pro\itype.exe

C:\Program Files\Microsoft IntelliPoint\ipoint.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe

C:\Program Files\WebcamMax\CAMTHINS.exe

C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe

C:\Program Files\Symantec Client Security\Symantec AntiVirus\DoScan.exe

c:\Program Files\Microsoft IntelliType Pro\dpupdchk.exe

.

**************************************************************************

.

Completion time: 2008-01-30 0:04:37 - machine was rebooted

ComboFix-quarantined-files.txt 2008-01-30 06:04:33

.

2008-01-23 08:37:09 --- E O F ---

Logfile of HijackThis v1.99.1

Scan saved at 12:15:35 AM, on 1/30/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

C:\Program Files\Common Files\Symantec Shared\ccProxy.exe

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe

C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe

C:\Program Files\Gateway\GSM\bin\usm.exe

C:\Program Files\BroadJump\Client Foundation\CFD.exe

C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Microsoft IntelliType Pro\itype.exe

C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe

C:\Program Files\Microsoft IntelliPoint\ipoint.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\PROGRA~1\Grisoft\AVG7\avgcc.exe

C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe

C:\Program Files\Pure Networks\Network Magic\nmapp.exe

C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe

C:\Program Files\WebcamMax\CAMTHINS.exe

C:\PROGRA~1\Grisoft\AVG7\avgemc.exe

c:\Program Files\Microsoft IntelliType Pro\dpupdchk.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Gizmo Project\mDNSResponder.exe

C:\Program Files\AceLogix\Free Ram Optimizer\fro.exe

C:\Program Files\LANDesk\Shared Files\residentagent.exe

C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe

C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

C:\Program Files\Gateway\GSM\BIN\modemview.exe

C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe

C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe

C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\twhirl - a twitter client\twhirl.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\Program Files\Pidgin\pidgin.exe

C:\Program Files\xchat\xchat.exe

C:\Program Files\Skype\Plugin Manager\skypePM.exe

C:\Documents and Settings\Owner\My Documents\My Music\Stuff1\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

O2 - BHO: VirtualCamera IEMenu Class - {0246A1A7-820A-469A-85A7-7B7F01EB808C} - (no file)

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O2 - BHO: (no name) - {3ca4bd86-f973-4924-b05d-7d3b76fb750f} - (no file)

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\windows\system32\BAE.dll

O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe

O4 - HKLM\..\Run: [HPHUPD06] C:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe

O4 - HKLM\..\Run: [GSM] C:\Program Files\Gateway\GSM\bin\usm.exe

O4 - HKLM\..\Run: [bJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [itype] "c:\Program Files\Microsoft IntelliType Pro\itype.exe"

O4 - HKLM\..\Run: [intelliPoint] "c:\Program Files\Microsoft IntelliPoint\ipoint.exe"

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP

O4 - HKLM\..\Run: [nmctxth] "C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe"

O4 - HKLM\..\Run: [nmapp] "C:\Program Files\Pure Networks\Network Magic\nmapp.exe" -autorun -nosplash

O4 - HKLM\..\Run: [WebcamMaxMoniter] "C:\Program Files\WebcamMax\CAMTHINS.exe" /m

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Free Ram Optimizer] C:\Program Files\AceLogix\Free Ram Optimizer\fro.exe

O4 - HKCU\..\Run: [WinMem] C:\Program Files\WinCleaner Memory Optimizer\WinMemOpt.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000

O9 - Extra button: Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - C:\Program Files\VisualRoute 2008\vrie.dll (file missing)

O9 - Extra 'Tools' menuitem: VisualRoute Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - C:\Program Files\VisualRoute 2008\vrie.dll (file missing)

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O11 - Options group: [iNTERNATIONAL] International*

O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m...01/mcinsctl.cab

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1104556665484

O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/m...,26/mcgdmgr.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O16 - DPF: {D71F9A27-723E-4B8B-B428-B725E47CBA3E} (Imikimi_activex_plugin Control) - http://imikimi.com/download/imikimi_plugin.cab

O18 - Protocol: pure-go - {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Common Files\Pure Networks Shared\Platform\puresp3.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - AppInit_DLLs: c:\windows\system32\awvvuvu.dll

O20 - Winlogon Notify: gebyvss - gebyvss.dll (file missing)

O20 - Winlogon Notify: HPODatl - HPODatl.dll (file missing)

O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe

O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe

O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe

O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Gizmo Project\mDNSResponder.exe

O23 - Service: LANDesk® Management Agent (CBA8) - LANDesk Software, Ltd. - C:\Program Files\LANDesk\Shared Files\residentagent.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe

O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: IS Service (ISSVC) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe

O23 - Service: LANDesk® System Manager System Space Manager (LSM_SSM) - LANDesk® Software Ltd. - C:\Program Files\Gateway\GSM\BIN\ssm.exe

O23 - Service: LANDesk Message Handler Service (ModemView) - LANDesk® Software Ltd. - C:\Program Files\Gateway\GSM\BIN\modemview.exe

O23 - Service: Pure Networks Net2Go Service (nmraapache) - Unknown owner - C:\Program Files\Pure Networks\Network Magic\WebServer\bin\nmraapache.exe" -k runservice (file missing)

O23 - Service: Pure Networks Platform Service (nmservice) - Pure Networks, Inc. - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe

O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS

O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec Client Security\Symantec AntiVirus\SavRoam.exe

O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe

O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe

O23 - Service: Symantec SecurePort (SymSecurePort) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe

Link to post
Share on other sites
Andro1d

Andro1d

Posted
Posted

Go to Microsoft's website => http://support.microsoft.com/kb/310994

Select the download that's appropriate for your Operating System.

KB310994.gif

Download the file & save it as it's originally named, next to ComboFix.exe.

rc1.gif

Now close all open windows and programs, then drag the setup package onto ComboFix.exe and drop it. Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console. When complete, a log named CF_RC.txt will open. Please post the contents of that log.

Please do not reboot your machine until we have reviewed the log.

Link to post
Share on other sites
Fireman17

Fireman17

Posted
  • Author
Posted

Here is that log file..

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

Link to post
Share on other sites
Andro1d

Andro1d

Posted
Posted

Hello again,

Step 1

I do not recommend that you have more than one anti virus product installed and running on your computer at a time. The reason for this is that if both products have their automatic (Real-Time) protection switched on, then those products which do not encrypt the virus strings within them can cause other anti virus products to cause "false alarms". It can also lead to a clash as both products fight for access to files which are opened again this is the resident/automatic protection. In general terms, the two programs may conflict and cause:

1) False Alarms: When the anti virus software tells you that your PC has a virus when it actually doesn't.

2) System Performance Problems: Your system may lock up due to both products attempting to access the same file at the same time.

Therefore please go to Add or Remove in the control panel and remove either Symantec AntiVirus or AVG7.

Step 2

A. Please RUN HijackThis

  • Click the SCAN button to produce a log.
  • Place a check mark beside each one of the following items:
    O2 - BHO: (no name) - {3ca4bd86-f973-4924-b05d-7d3b76fb750f} - (no file)
    O16 - DPF: {D71F9A27-723E-4B8B-B428-B725E47CBA3E} (Imikimi_activex_plugin Control) - http://imikimi.com/download/imikimi_plugin.cab
    O20 - AppInit_DLLs: c:\windows\system32\awvvuvu.dll
    O20 - Winlogon Notify: gebyvss - gebyvss.dll (file missing)
    O20 - Winlogon Notify: HPODatl - HPODatl.dll (file missing)
  • Now with all the items selected, and all windows closed except for HJT, delete them by clicking the FIX checked button. Close the HijackThis window.

B. 1. Please open Notepad

  • Click Start , then Run
  • Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

File::

c:\windows\system32\awvvuvu.dll

3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

CFScript.gif

5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

  • Combofix.txt
  • A new HijackThis log.

Step 3

Please go HERE to run Panda's ActiveScan

  • Once you are on the Panda site click the Scan your PC button
  • A new window will open...click the Check Now button
  • Enter your Country
  • Enter your State/Province
  • Enter your e-mail address and click send
  • Select either Home User or Company
  • Click the big Scan Now button
  • If it wants to install an ActiveX component allow it
  • It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
  • When download is complete, click on My Computer to start the scan
  • When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location. Post the contents of the ActiveScan report

Link to post
Share on other sites
Andro1d

Andro1d

Posted
Posted

Ok, lemme see the following first, then we can go from there.

Open HijackThis, click Config, click Misc Tools

Click "Open Uninstall Manager"

Click "Save List" (generates uninstall_list.txt)

Click Save, copy and paste the results in your next post.

Link to post
Share on other sites
Fireman17

Fireman17

Posted
  • Author
Posted

Here is the uninstall_list.txe log i know i am missing alot of stuff in the add/remove not this the anti virus.

Adobe AIR

Adobe AIR

Adobe Flash Media Encoder 2

AVG 7.5

CCleaner (remove only)

HijackThis 1.99.1

Imikimi Plugin

LimeWire PRO 4.12.6

Microsoft .NET Framework 2.0 Service Pack 1

mIRC

Mozilla Firefox (2.0.0.11)

Mozilla Thunderbird (2.0.0.9)

Network Magic

Pidgin

PuTTY version 0.60

Security Update for Windows Internet Explorer 7 (KB942615)

Security Update for Windows XP (KB941568)

Security Update for Windows XP (KB941569)

Security Update for Windows XP (KB941644)

Security Update for Windows XP (KB943460)

Security Update for Windows XP (KB943485)

Security Update for Windows XP (KB944653)

Skypeâ„¢ 3.6

TalkShoe Live! 2.0

TBS WMP Plug-in

twhirl

twhirl - a twitter client

Unlocker 1.8.5

Update for Windows XP (KB942763)

Ventrilo Client

WebcamMax

Windows Driver Package - Pure Networks, Inc. Pure Networks Device Discovery Driver (08/24/2007 4.6.7236.0)

Windows Driver Package - Pure Networks, Inc. Pure Networks Wireless Driver (08/24/2007 4.6.7236.0)

Windows Media Player Firefox Plugin

Link to post
Share on other sites
Fireman17

Fireman17

Posted
  • Author
Posted (edited)

Here ComboFix , HijackThis after i ran Combofix the way you ask me and Panda Logs. Right now im Running AVG 7.5 Anti Virus Free Version.

ComboFix 08-01-30.1 - Owner 2008-01-31 3:20:47.2 - NTFSx86

Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe

Command switches used :: C:\Documents and Settings\Owner\Desktop\CFScript.txt

FILE

c:\windows\system32\awvvuvu.dll

.

((((((((((((((((((((((((( Files Created from 2007-12-28 to 2008-01-31 )))))))))))))))))))))))))))))))

.

2008-01-30 12:17 . 2004-08-03 23:00 260,272 --a------ C:\cmldr

2008-01-30 12:17 . 2007-10-07 19:40 211 --a------ C:\Boot.bak

2008-01-29 07:57 . 2008-01-29 08:07 <DIR> d-------- C:\Program Files\Paint.NET

2008-01-23 22:42 . 2008-01-23 22:42 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\PownceDesktop.1A618255CEB975BFC863E47CA16BCF2DEB687FD9.1

2008-01-21 20:01 . 2008-01-21 20:01 <DIR> d-------- C:\Program Files\twhirl - a twitter client

2008-01-20 21:56 . 2008-01-20 21:56 <DIR> d-------- C:\Program Files\PuTTY

2008-01-19 06:12 . 2008-01-19 06:14 <DIR> d-------- C:\Program Files\WebcamMax

2008-01-18 20:56 . 2008-01-18 20:56 0 --a------ C:\Documents

2008-01-16 04:50 . 2008-01-16 04:50 1,158 --a------ C:\WINDOWS\mozver.dat

2008-01-10 10:21 . 2008-01-10 10:21 <DIR> d-------- C:\Program Files\CCleaner

2008-01-07 03:32 . 2008-01-07 03:36 <DIR> d-------- C:\ERDNT

2008-01-05 09:52 . 2004-08-03 22:58 14,848 --a--c--- C:\WINDOWS\system32\drivers\kbdhid.sys

2008-01-05 09:52 . 2004-08-03 22:58 14,848 --a--c--- C:\WINDOWS\system32\dllcache\kbdhid.sys

2008-01-02 17:44 . 2008-01-02 17:44 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\de.makesoft.twhirl.0EA062BC275E7ED1E6EC3762EFFD73C7158ADF33.1

2007-12-26 22:36 . 2007-12-26 22:37 <DIR> d-------- C:\Program Files\TalkShoe

2007-12-24 23:45 . 2007-12-24 23:46 <DIR> d-------- C:\Program Files\Pidgin

2007-12-24 19:11 . 2007-12-24 19:11 <DIR> d-------- C:\Documents and Settings\brook\Application Data\Thunderbird

2007-12-21 23:02 . 2008-01-31 02:20 54,156 --ah----- C:\WINDOWS\QTFont.qfn

2007-12-21 23:02 . 2007-12-21 23:02 1,409 --a------ C:\WINDOWS\QTFont.for

2007-12-18 01:14 . 2007-12-18 01:14 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Snitter.88C687E32FFE9452F058A6F4E67005F998FC3136.1

2007-12-10 19:49 . 2007-12-10 19:50 <DIR> d-------- C:\Program Files\Ventrilo

2007-12-06 18:57 . 2007-12-06 18:57 <DIR> d-------- C:\Documents and Settings\Owner\dwhelper

2007-12-03 23:07 . 2007-12-03 23:07 <DIR> d-------- C:\Program Files\Pure Networks

2007-12-03 23:02 . 2007-09-20 10:16 23,864 --a------ C:\WINDOWS\system32\drivers\pnarp.sys

2007-12-03 23:01 . 2007-12-03 23:01 <DIR> d-------- C:\Program Files\Common Files\Pure Networks Shared

2007-12-03 23:01 . 2007-09-20 10:16 24,888 --a------ C:\WINDOWS\system32\drivers\purendis.sys

2007-12-03 21:21 . 2008-01-06 16:33 <DIR> d-------- C:\Program Files\VisualRoute 2008

2007-12-03 20:38 . 2007-12-03 21:23 <DIR> d-------- C:\Program Files\VisualRoute Lite Edition

2007-12-03 20:38 . 2007-12-03 21:18 <DIR> d-------- C:\Documents and Settings\Owner\vw

2007-12-02 23:33 . 2008-01-30 13:00 <DIR> d-------- C:\Program Files\mIRC

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-01-31 09:22 --------- d-----w C:\Documents and Settings\Owner\Application Data\Skype

2008-01-31 09:20 --------- d-----w C:\Documents and Settings\Owner\Application Data\X-Chat 2

2008-01-31 09:20 --------- d-----w C:\Documents and Settings\Owner\Application Data\mIRC

2008-01-31 09:20 --------- d-----w C:\Documents and Settings\Owner\Application Data\.purple

2008-01-31 08:04 --------- d-----w C:\Program Files\Mozilla Thunderbird

2008-01-31 06:40 --------- d-----w C:\Documents and Settings\Owner\Application Data\skypePM

2008-01-26 04:09 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg7

2008-01-25 22:46 --------- d-----w C:\Documents and Settings\Owner\Application Data\LimeWire

2008-01-13 06:15 --------- d-----w C:\Documents and Settings\Owner\Application Data\AVG7

2008-01-08 18:36 --------- d-----w C:\Program Files\Common Files\Symantec Shared

2008-01-04 23:23 --------- d-----w C:\Documents and Settings\brook\Application Data\LimeWire

2008-01-02 20:43 --------- d-----w C:\Program Files\LimeWire

2007-12-25 01:09 --------- d-----w C:\Program Files\Imikimi

2007-12-24 20:52 --------- d-----w C:\Documents and Settings\brook\Application Data\AVG7

2007-12-18 07:10 --------- d-----w C:\Program Files\Common Files\Adobe AIR

2007-12-18 02:00 --------- d-----w C:\Documents and Settings\Owner\Application Data\gtk-2.0

2007-12-17 17:19 --------- d--h--w C:\Program Files\InstallShield Installation Information

2007-12-11 01:47 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard

2007-12-04 05:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Pure Networks

2007-11-17 07:33 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat

2007-11-07 09:26 721,920 ----a-w C:\WINDOWS\system32\lsasrv.dll

2007-10-29 22:43 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll

2007-10-27 23:40 222,720 ----a-w C:\WINDOWS\system32\wmasf.dll

2007-10-24 07:47 96,760 ----a-w C:\WINDOWS\system32\dfshim.dll

2007-10-24 07:47 84,480 ----a-w C:\WINDOWS\system32\mscories.dll

2007-10-24 07:47 282,112 ----a-w C:\WINDOWS\system32\mscoree.dll

2007-10-24 07:47 158,720 ----a-w C:\WINDOWS\system32\mscorier.dll

2007-10-10 23:56 824,832 ----a-w C:\WINDOWS\system32\wininet.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 13:00 15360]

"Free Ram Optimizer"="C:\Program Files\AceLogix\Free Ram Optimizer\fro.exe" [2003-08-22 08:19 57344]

"WinMem"="C:\Program Files\WinCleaner Memory Optimizer\WinMemOpt.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 22:24 32768]

"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 13:50 155648]

"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2005-06-02 11:21 48752]

"vptray"="C:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe" [2005-08-18 19:22 85696]

"HPHUPD06"="C:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe" [2004-06-06 22:53 49152]

"GSM"="C:\Program Files\Gateway\GSM\bin\usm.exe" [2005-05-31 23:05 9216]

"BJCFD"="C:\Program Files\BroadJump\Client Foundation\CFD.exe" [2002-09-10 20:26 368706]

"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11 132496]

"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 05:24 286720]

"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 02:06 40048]

"itype"="c:\Program Files\Microsoft IntelliType Pro\itype.exe" [2007-08-31 11:13 988584]

"IntelliPoint"="c:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2007-08-31 11:01 1037736]

"SoundMan"="SOUNDMAN.EXE" [2007-04-16 14:28 577536 C:\WINDOWS\soundman.exe]

"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-12-21 08:34 579072]

"nmctxth"="C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2007-10-01 20:08 451896]

"nmapp"="C:\Program Files\Pure Networks\Network Magic\nmapp.exe" [2007-10-29 22:04 451896]

"WebcamMaxMoniter"="C:\Program Files\WebcamMax\CAMTHINS.exe" [2007-03-07 05:46 81920]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-11-15 16:19 219136]

C:\Documents and Settings\brook\Start Menu\Programs\Startup\

LimeWire On Startup.lnk - C:\Program Files\LimeWire\LimeWire.exe [2006-08-16 13:16:24 159744]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\

Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]

path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk

backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk]

path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk

backup=C:\WINDOWS\pss\HP Image Zone Fast Start.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]

--a--c--- 2004-05-12 15:18 241664 C:\Program Files\HP\hpcoretech\hpcmpmgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]

--a--c--- 2004-02-12 13:38 49152 C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHmon06]

--a--c--- 2004-06-06 22:42 659456 C:\WINDOWS\system32\hphmon06.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM]

C:\Program Files\MySpace\IM\MySpaceIM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Recguard]

%WINDIR%\SMINST\RECGUARD.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]

--a------ 2007-08-31 15:46 1460560 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]

--a--c--- 2006-11-10 11:35 90112 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]

C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WebcamMaxMoniter]

--a------ 2007-03-07 05:46 81920 C:\Program Files\WebcamMax\CAMTHINS.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winlog]

R2 CamthWDM;WebcamMax, WDM Video Capture;C:\WINDOWS\system32\DRIVERS\CamthWDM.sys [2007-01-10 23:39]

R2 CBA8;LANDesk® Management Agent;"C:\Program Files\LANDesk\Shared Files\residentagent.exe" [2005-04-28 14:05]

R2 CISMBIOS;CiSMBios Driver;C:\WINDOWS\system32\Drivers\CISMBIOS.SYS [2005-05-31 22:53]

R2 ModemView;LANDesk Message Handler Service;C:\Program Files\Gateway\GSM\BIN\modemview.exe [2005-05-31 23:13]

R3 ICFWDM;ICFWDM;C:\WINDOWS\system32\drivers\icfwdm.sys [2002-06-20 11:35]

S2 LSM_SSM;LANDesk® System Manager System Space Manager;C:\Program Files\Gateway\GSM\BIN\ssm.exe [2005-05-31 23:04]

S3 el575nd5;3Com Megahertz 10/100 LAN CardBus PC Card Driver;C:\WINDOWS\system32\DRIVERS\el575nd5.sys [2001-08-17 20:10]

S3 NTPASp50;NTPASp50 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\NTPASp50.sys [2004-08-10 08:57]

S3 SUPERWEBCAM;SuperWebcam, WDM Virtual Video Capture Device;C:\WINDOWS\system32\DRIVERS\superwebcam.sys [2006-06-27 07:56]

S3 SWLD23U;Netopia 802.11b WLAN USB Adapter;C:\WINDOWS\system32\DRIVERS\SWLD23U.sys [2003-12-17 11:58]

S3 swlubtl;WLAN USB Boot Device;C:\WINDOWS\system32\Drivers\swlubtl.sys [2003-05-02 16:26]

.

Contents of the 'Scheduled Tasks' folder

"2005-03-23 04:05:05 C:\WINDOWS\Tasks\ISP signup reminder 1.job"

- C:\WINDOWS\system32\OOBE\oobebaln.exe

"2005-03-23 04:05:05 C:\WINDOWS\Tasks\ISP signup reminder 2.job"

- C:\WINDOWS\system32\OOBE\oobebaln.exe

"2005-03-23 04:05:05 C:\WINDOWS\Tasks\ISP signup reminder 3.job"

- C:\WINDOWS\system32\OOBE\oobebaln.exe

"2007-10-04 09:34:47 C:\WINDOWS\Tasks\Microsoft_Hardware_Launch_IPoint_exe.job"

- c:\Program Files\Microsoft IntelliPoint\ipoint.exe

"2007-10-04 09:34:47 C:\WINDOWS\Tasks\Microsoft_Hardware_Launch_IType_exe.job"

- c:\Program Files\Microsoft IntelliType Pro\itype.exe

"2005-03-23 04:04:30 C:\WINDOWS\Tasks\Symantec NetDetect.job"

- C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE

.

**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-01-31 03:25:38

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

Completion time: 2008-01-31 3:27:00

ComboFix-quarantined-files.txt 2008-01-31 09:26:50

ComboFix2.txt 2008-01-30 06:04:37

.

2008-01-23 08:37:09 --- E O F ---

Logfile of HijackThis v1.99.1

Scan saved at 3:29:19 AM, on 1/31/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

C:\Program Files\Common Files\Symantec Shared\ccProxy.exe

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe

C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe

C:\Program Files\Gateway\GSM\bin\usm.exe

C:\Program Files\BroadJump\Client Foundation\CFD.exe

C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Microsoft IntelliType Pro\itype.exe

C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe

C:\Program Files\Microsoft IntelliPoint\ipoint.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe

C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe

C:\Program Files\WebcamMax\CAMTHINS.exe

C:\PROGRA~1\Grisoft\AVG7\avgemc.exe

c:\Program Files\Microsoft IntelliType Pro\dpupdchk.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Gizmo Project\mDNSResponder.exe

C:\Program Files\LANDesk\Shared Files\residentagent.exe

C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe

C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

C:\Program Files\Gateway\GSM\BIN\modemview.exe

C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe

C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe

C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe

C:\Program Files\AceLogix\Free Ram Optimizer\fro.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Documents and Settings\Owner\My Documents\My Music\Stuff1\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

O2 - BHO: VirtualCamera IEMenu Class - {0246A1A7-820A-469A-85A7-7B7F01EB808C} - (no file)

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\windows\system32\BAE.dll

O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe

O4 - HKLM\..\Run: [HPHUPD06] C:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe

O4 - HKLM\..\Run: [GSM] C:\Program Files\Gateway\GSM\bin\usm.exe

O4 - HKLM\..\Run: [bJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [itype] "c:\Program Files\Microsoft IntelliType Pro\itype.exe"

O4 - HKLM\..\Run: [intelliPoint] "c:\Program Files\Microsoft IntelliPoint\ipoint.exe"

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP

O4 - HKLM\..\Run: [nmctxth] "C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe"

O4 - HKLM\..\Run: [nmapp] "C:\Program Files\Pure Networks\Network Magic\nmapp.exe" -autorun -nosplash

O4 - HKLM\..\Run: [WebcamMaxMoniter] "C:\Program Files\WebcamMax\CAMTHINS.exe" /m

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Free Ram Optimizer] C:\Program Files\AceLogix\Free Ram Optimizer\fro.exe

O4 - HKCU\..\Run: [WinMem] C:\Program Files\WinCleaner Memory Optimizer\WinMemOpt.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000

O9 - Extra button: Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - C:\Program Files\VisualRoute 2008\vrie.dll (file missing)

O9 - Extra 'Tools' menuitem: VisualRoute Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - C:\Program Files\VisualRoute 2008\vrie.dll (file missing)

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O11 - Options group: [iNTERNATIONAL] International*

O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m...01/mcinsctl.cab

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1104556665484

O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/m...,26/mcgdmgr.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O18 - Protocol: pure-go - {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Common Files\Pure Networks Shared\Platform\puresp3.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe

O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe

O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe

O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Gizmo Project\mDNSResponder.exe

O23 - Service: LANDesk® Management Agent (CBA8) - LANDesk Software, Ltd. - C:\Program Files\LANDesk\Shared Files\residentagent.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe

O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: IS Service (ISSVC) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe

O23 - Service: LANDesk® System Manager System Space Manager (LSM_SSM) - LANDesk® Software Ltd. - C:\Program Files\Gateway\GSM\BIN\ssm.exe

O23 - Service: LANDesk Message Handler Service (ModemView) - LANDesk® Software Ltd. - C:\Program Files\Gateway\GSM\BIN\modemview.exe

O23 - Service: Pure Networks Net2Go Service (nmraapache) - Unknown owner - C:\Program Files\Pure Networks\Network Magic\WebServer\bin\nmraapache.exe" -k runservice (file missing)

O23 - Service: Pure Networks Platform Service (nmservice) - Pure Networks, Inc. - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe

O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS

O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec Client Security\Symantec AntiVirus\SavRoam.exe

O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe

O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe

O23 - Service: Symantec SecurePort (SymSecurePort) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe

Panda's ActiveScan Log for Jan 31 5:44am done after all the aothers.

Incident Status Location

Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.zedo.com/]

Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[c5.zedo.com/]

Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.c5.zedo.com/]

Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.zedo.com/]

Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.tribalfusion.com/]

Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.doubleclick.net/]

Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.realmedia.com/]

Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.fastclick.net/]

Spyware:Cookie/Apmebf Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.apmebf.com/]

Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.fastclick.net/]

Spyware:Cookie/Traffic Marketplace Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.trafficmp.com/]

Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.casalemedia.com/]

Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[ad.yieldmanager.com/]

Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.atdmt.com/]

Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.adrevolver.com/]

Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.ads.pointroll.com/]

Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.questionmarket.com/]

Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.advertising.com/]

Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.mediaplex.com/]

Spyware:Cookie/Bluestreak Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.bluestreak.com/]

Spyware:Cookie/Azjmp Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.azjmp.com/]

Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[server.iad.liveperson.net/hc/73993052]

Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[server.iad.liveperson.net/]

Spyware:Cookie/Adtech Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.adtech.de/]

Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.bs.serving-sys.com/]

Spyware:Cookie/WUpd Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.revenue.net/]

Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.serving-sys.com/]

Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.xiti.com/]

Spyware:Cookie/Searchportal Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[searchportal.information.com/]

Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\brook\Cookies\brook@adrevolver[2].txt

Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\brook\Cookies\brook@atdmt[2].txt

Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\brook\Cookies\brook@atdmt[3].txt

Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\brook\Cookies\brook@atdmt[4].txt

Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\brook\Cookies\[email protected][2].txt

Virus:Generic Malware Disinfected C:\Documents and Settings\brook\Desktop\WebfettiSetup2.2.60.11-2.exe

Spyware:Cookie/Traffic Marketplace Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\q0p7vjd8.default\cookies.txt[.trafficmp.com/]

Spyware:Cookie/Ccbill Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\q0p7vjd8.default\cookies.txt[.ccbill.com/]

Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\q0p7vjd8.default\cookies.txt[.com.com/]

Spyware:Cookie/adultfriendfinder Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\q0p7vjd8.default\cookies.txt[.adultfriendfinder.com/]

Spyware:Cookie/Toplist Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\q0p7vjd8.default\cookies.txt[.toplist.cz/]

Spyware:Cookie/onestat.com Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\q0p7vjd8.default\cookies.txt[stat.onestat.com/]

Spyware:Cookie/Yadro Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\q0p7vjd8.default\cookies.txt[.yadro.ru/]

Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\q0p7vjd8.default\cookies.txt[.xiti.com/]

Spyware:Cookie/Searchportal Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\q0p7vjd8.default\cookies.txt[searchportal.information.com/]

Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\q0p7vjd8.default\cookies.txt[.go.com/]

Spyware:Cookie/bravenetA Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\q0p7vjd8.default\cookies.txt[.bravenet.com/]

Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\q0p7vjd8.default\cookies.txt[.serving-sys.com/]

Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\q0p7vjd8.default\cookies.txt[.bs.serving-sys.com/]

Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\q0p7vjd8.default\cookies.txt[.serving-sys.com/]

Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Owner\Cookies\owner@atdmt[2].txt

Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Owner\Cookies\[email protected][2].txt

Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Owner\Cookies\owner@doubleclick[1].txt

Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Owner\Cookies\owner@questionmarket[2].txt

Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Owner\Cookies\owner@serving-sys[1].txt

Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\Documents and Settings\Owner\Desktop\ComboFix.exe[327882R2FWJFW\nircmd.com]

Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\Documents and Settings\Owner\Desktop\ComboFix.exe[327882R2FWJFW\nircmd.cfexe]

Virus:Generic Trojan Disinfected C:\Documents and Settings\Owner\My Documents\My Music\Stuff1\Programs\mirc.6.3-patch-Fawkess.exe

Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bi1734bm.default\cookies.txt[.atdmt.com/]

Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bi1734bm.default\cookies.txt[.mediaplex.com/]

Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bi1734bm.default\cookies.txt[.doubleclick.net/]

Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bi1734bm.default\cookies.txt[.ads.pointroll.com/]

Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bi1734bm.default\cookies.txt[.advertising.com/]

Spyware:Cookie/Bluestreak Not disinfected C:\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bi1734bm.default\cookies.txt[.bluestreak.com/]

Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bi1734bm.default\cookies.txt[.realmedia.com/]

Spyware:Cookie/Traffic Marketplace Not disinfected C:\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bi1734bm.default\cookies.txt[.trafficmp.com/]

Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Robert\Cookies\robert@advertising[1].txt

Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Robert\Cookies\robert@advertising[3].txt

Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Robert\Cookies\robert@doubleclick[1].txt

Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Robert\Cookies\robert@fastclick[1].txt

Spyware:Cookie/Overture Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bfe8f2z6.default\cookies.txt[.perf.overture.com/]

Spyware:Cookie/Overture Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bfe8f2z6.default\cookies.txt[.overture.com/]

Spyware:Cookie/Atlas DMT Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bfe8f2z6.default\cookies.txt[.atdmt.com/]

Spyware:Cookie/YieldManager Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bfe8f2z6.default\cookies.txt[ad.yieldmanager.com/]

Spyware:Cookie/Traffic Marketplace Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bfe8f2z6.default\cookies.txt[.trafficmp.com/]

Spyware:Cookie/YieldManager Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bfe8f2z6.default\cookies.txt[ad.yieldmanager.com/]

Spyware:Cookie/RealMedia Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bfe8f2z6.default\cookies.txt[.realmedia.com/]

Spyware:Cookie/Advertising Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bfe8f2z6.default\cookies.txt[.advertising.com/]

Spyware:Cookie/Doubleclick Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bfe8f2z6.default\cookies.txt[.doubleclick.net/]

Spyware:Cookie/Tribalfusion Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bfe8f2z6.default\cookies.txt[.tribalfusion.com/]

Spyware:Cookie/Bluestreak Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bfe8f2z6.default\cookies.txt[.bluestreak.com/]

Spyware:Cookie/FastClick Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bfe8f2z6.default\cookies.txt[.fastclick.net/]

Spyware:Cookie/Mediaplex Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bfe8f2z6.default\cookies.txt[.mediaplex.com/]

Spyware:Cookie/Atwola Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Cookies\robert@atwola[1].txt

Spyware:Cookie/BurstNet Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Cookies\robert@burstnet[1].txt

Spyware:Cookie/Com.com Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Cookies\robert@com[1].txt

Spyware:Cookie/Belnk Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Cookies\[email protected][2].txt

Spyware:Cookie/Com.com Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Cookies\[email protected][1].txt

Spyware:Cookie/Kmpads Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Cookies\robert@kmpads[1].txt

Spyware:Cookie/BurstBeacon Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Cookies\[email protected][1].txt

Virus:Generic Trojan Disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Local Settings\Temp\b104.exe

Adware:Adware/Yazzle Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Local Settings\Temp\b116.exe

Adware:Adware/PurityScan Not disinfected C:\My Backup -- 22-03-05 2002\Program Files\Common Files\W?nSxS\regsvr32.exe

Adware:Adware/Yazzle Not disinfected C:\My Backup -- 22-03-05 2002\Program Files\Common Files\Yazzle1122OinUninstaller.exe

Adware:Adware/Yazzle Not disinfected C:\My Backup -- 22-03-05 2002\Program Files\Common Files\Yazzle1396OinUninstaller.exe

Spyware:Spyware/MarketScore Not disinfected C:\My Backup -- 22-03-05 2002\WINDOWS\system32\rlxf.dll

Virus:Generic Trojan Disinfected C:\Program Files\mIRC\mirc.6.3-patch-Fawkess.exe

Virus:Generic Trojan Disinfected C:\QooBox\Quarantine\C\WINDOWS\b104.exe.vir

Adware:Adware/DeluxeComunications Not disinfected C:\QooBox\Quarantine\C\WINDOWS\b136.exe.vir

Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\WINDOWS\Nircmd.exe

Edited by Fireman17
Link to post
Share on other sites
Andro1d

Andro1d

Posted
Posted (edited)

Hello again,

Step 1

Please download the OTMoveIt2 by OldTimer.

  • Save it to your desktop.
  • Please double-click OTMoveIt2.exe to run it. (Vista users, please right click on OTMoveit2.exe and select "Run as an Administrator")
  • Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
    C:\My Backup -- 22-03-05 2002\WINDOWS\system32\rlxf.dll
    C:\My Backup -- 22-03-05 2002\Program Files\Common Files\W?nSxS
    C:\My Backup -- 22-03-05 2002\Program Files\Common Files\Yazzle1122OinUninstaller.exe 
    C:\My Backup -- 22-03-05 2002\Program Files\Common Files\Yazzle1396OinUninstaller.exe


  • Return to OTMoveIt2, right click in the "Paste List of Files/Folders to be Moved" window (under the light blue bar) and choose Paste.
  • Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
    EmptyTemp
    purity


  • Return to OTMoveIt2, right click in the "Paste List Of Files/Patterns To Search For and Move" window (under the yellow bar) and choose Paste.
  • Click the red Moveit! button.
  • A log of files and folders moved will be created in the c:\_OTMoveIt\MovedFiles folder in the form of Date and Time (mmddyyyy_hhmmss.log). Please open this log in Notepad and post its contents in your next reply.
  • Close OTMoveIt2

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Step 2

Since your not using Norton, were gonna run the removal tool to compleltly remove it.

Please download the Norton Removal Tool from HERE and Save it to your Desktop

  • Close all programs and double click the Norton_Removal_Tool.exe
  • Follow the on-screen instructions
  • Restart the computer if asked
  • Then delete Norton_Removal_Tool.exe from your desktop

Edited by MoNsTeReNeRgY22
Link to post
Share on other sites
Fireman17

Fireman17

Posted
  • Author
Posted

I run the Step one and got the logs here. Running the notron removeing tool it does not run all the way tru it says i have remove programs before i can use in the add/remove but i dont see them in there.

OTmoveit Log

LoadLibrary failed for C:\My Backup -- 22-03-05 2002\WINDOWS\system32\rlxf.dll

C:\My Backup -- 22-03-05 2002\WINDOWS\system32\rlxf.dll NOT unregistered.

C:\My Backup -- 22-03-05 2002\WINDOWS\system32\rlxf.dll moved successfully.

File/Folder C:\My Backup -- 22-03-05 2002\Program Files\Common Files\W?nSxS not found.

C:\My Backup -- 22-03-05 2002\Program Files\Common Files\Yazzle1122OinUninstaller.exe moved successfully.

C:\My Backup -- 22-03-05 2002\Program Files\Common Files\Yazzle1396OinUninstaller.exe moved successfully.

[Custom Input]

< EmptyTemp >

File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_354.dat scheduled to be deleted on reboot.

File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_a94.dat scheduled to be deleted on reboot.

Temp folders emptied.

IE temp folders emptied.

< purity >

OTMoveIt2 v1.0.17 log created on 01312008_181220

Link to post
Share on other sites
Andro1d

Andro1d

Posted
Posted

Hello,

Lets make sure your clean of all malware before we go in and try to remove Norton.

Please do an online scan with Kaspersky WebScanner

Click on Accept

You will be promted to install an ActiveX component from Kaspersky, Click Yes.

  • The program will launch and then begin downloading the latest definition files:
  • Once the files have been downloaded click on NEXT

  • Now click on Scan Settings
  • In the scan settings make that the following are selected:
    • Scan using the following Anti-Virus database:

    • Extended (if available otherwise Standard)

    • Scan Options:

    • Scan Archives
      Scan Mail Bases

    [*]Click OK

    [*]Now under select a target to scan:

    • Select My Computer

    [*]This will program will start and scan your system.

    [*]The scan will take a while so be patient and let it run.

    [*]Once the scan is complete it will display if your system has been infected.

    • Now click on the Save as Text button:

    [*]Save the file to your desktop.

    [*]Copy and paste that information in your next post.

Link to post
Share on other sites
Fireman17

Fireman17

Posted
  • Author
Posted (edited)

I am haveing trouble posting the Kaspersky WebScanner logs that i done it did come up finding stuff on my computer but i know i need get the log on here so you can go over it but its not showing up when copy and paste it. For some reason the log is in a html file is that seems to be a problem when copying the stuff from it and pasteing it.

Edited by Fireman17
Link to post
Share on other sites
Andro1d

Andro1d

Posted
Posted

Ok, we can try a different scanner.

Please go HERE to run Panda's ActiveScan

  • Once you are on the Panda site click the Scan your PC button
  • A new window will open...click the Check Now button
  • Enter your Country
  • Enter your State/Province
  • Enter your e-mail address and click send
  • Select either Home User or Company
  • Click the big Scan Now button
  • If it wants to install an ActiveX component allow it
  • It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
  • When download is complete, click on My Computer to start the scan
  • When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location. Post the contents of the ActiveScan report

Link to post
Share on other sites
Fireman17

Fireman17

Posted
  • Author
Posted

here is my Panda Scan logs

Incident Status Location

Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.zedo.com/]

Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[c5.zedo.com/]

Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.c5.zedo.com/]

Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.zedo.com/]

Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.tribalfusion.com/]

Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.doubleclick.net/]

Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.realmedia.com/]

Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.fastclick.net/]

Spyware:Cookie/Apmebf Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.apmebf.com/]

Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.fastclick.net/]

Spyware:Cookie/Traffic Marketplace Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.trafficmp.com/]

Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.casalemedia.com/]

Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[ad.yieldmanager.com/]

Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.atdmt.com/]

Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.adrevolver.com/]

Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.ads.pointroll.com/]

Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.questionmarket.com/]

Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.advertising.com/]

Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.mediaplex.com/]

Spyware:Cookie/Bluestreak Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.bluestreak.com/]

Spyware:Cookie/Azjmp Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.azjmp.com/]

Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[server.iad.liveperson.net/hc/73993052]

Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[server.iad.liveperson.net/]

Spyware:Cookie/Adtech Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.adtech.de/]

Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.bs.serving-sys.com/]

Spyware:Cookie/WUpd Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.revenue.net/]

Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.serving-sys.com/]

Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[.xiti.com/]

Spyware:Cookie/Searchportal Not disinfected C:\Documents and Settings\brook\Application Data\Mozilla\Firefox\Profiles\49y4vjsi.default\cookies.txt[searchportal.information.com/]

Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\brook\Cookies\brook@adrevolver[2].txt

Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\brook\Cookies\brook@atdmt[2].txt

Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\brook\Cookies\brook@atdmt[3].txt

Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\brook\Cookies\brook@atdmt[4].txt

Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\brook\Cookies\[email protected][2].txt

Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\q0p7vjd8.default\cookies.txt[.com.com/]

Spyware:Cookie/Traffic Marketplace Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\q0p7vjd8.default\cookies.txt[.trafficmp.com/]

Spyware:Cookie/adultfriendfinder Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\q0p7vjd8.default\cookies.txt[.adultfriendfinder.com/]

Spyware:Cookie/Toplist Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\q0p7vjd8.default\cookies.txt[.toplist.cz/]

Spyware:Cookie/onestat.com Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\q0p7vjd8.default\cookies.txt[stat.onestat.com/]

Spyware:Cookie/Yadro Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\q0p7vjd8.default\cookies.txt[.yadro.ru/]

Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\q0p7vjd8.default\cookies.txt[.xiti.com/]

Spyware:Cookie/Searchportal Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\q0p7vjd8.default\cookies.txt[searchportal.information.com/]

Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\q0p7vjd8.default\cookies.txt[.go.com/]

Spyware:Cookie/bravenetA Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\q0p7vjd8.default\cookies.txt[.bravenet.com/]

Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\q0p7vjd8.default\cookies.txt[.serving-sys.com/]

Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\q0p7vjd8.default\cookies.txt[.bs.serving-sys.com/]

Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\q0p7vjd8.default\cookies.txt[.serving-sys.com/]

Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\Documents and Settings\Owner\My Documents\My Music\Stuff1\Computer STuff\ComboFix.exe[327882R2FWJFW\nircmd.com]

Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\Documents and Settings\Owner\My Documents\My Music\Stuff1\Computer STuff\ComboFix.exe[327882R2FWJFW\nircmd.cfexe]

Virus:W32/Virutas.Z Disinfected C:\Documents and Settings\Owner\My Documents\My Music\Stuff1\Xmas-RCPCorp-2007.zip[iDServe.exe]

Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bi1734bm.default\cookies.txt[.atdmt.com/]

Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bi1734bm.default\cookies.txt[.mediaplex.com/]

Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bi1734bm.default\cookies.txt[.doubleclick.net/]

Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bi1734bm.default\cookies.txt[.ads.pointroll.com/]

Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bi1734bm.default\cookies.txt[.advertising.com/]

Spyware:Cookie/Bluestreak Not disinfected C:\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bi1734bm.default\cookies.txt[.bluestreak.com/]

Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bi1734bm.default\cookies.txt[.realmedia.com/]

Spyware:Cookie/Traffic Marketplace Not disinfected C:\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bi1734bm.default\cookies.txt[.trafficmp.com/]

Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Robert\Cookies\robert@advertising[1].txt

Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Robert\Cookies\robert@advertising[3].txt

Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Robert\Cookies\robert@doubleclick[1].txt

Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Robert\Cookies\robert@fastclick[1].txt

Spyware:Cookie/Overture Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bfe8f2z6.default\cookies.txt[.perf.overture.com/]

Spyware:Cookie/Overture Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bfe8f2z6.default\cookies.txt[.overture.com/]

Spyware:Cookie/Atlas DMT Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bfe8f2z6.default\cookies.txt[.atdmt.com/]

Spyware:Cookie/YieldManager Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bfe8f2z6.default\cookies.txt[ad.yieldmanager.com/]

Spyware:Cookie/Traffic Marketplace Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bfe8f2z6.default\cookies.txt[.trafficmp.com/]

Spyware:Cookie/YieldManager Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bfe8f2z6.default\cookies.txt[ad.yieldmanager.com/]

Spyware:Cookie/RealMedia Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bfe8f2z6.default\cookies.txt[.realmedia.com/]

Spyware:Cookie/Advertising Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bfe8f2z6.default\cookies.txt[.advertising.com/]

Spyware:Cookie/Doubleclick Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bfe8f2z6.default\cookies.txt[.doubleclick.net/]

Spyware:Cookie/Tribalfusion Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bfe8f2z6.default\cookies.txt[.tribalfusion.com/]

Spyware:Cookie/Bluestreak Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bfe8f2z6.default\cookies.txt[.bluestreak.com/]

Spyware:Cookie/FastClick Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bfe8f2z6.default\cookies.txt[.fastclick.net/]

Spyware:Cookie/Mediaplex Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Application Data\Mozilla\Firefox\Profiles\bfe8f2z6.default\cookies.txt[.mediaplex.com/]

Spyware:Cookie/Atwola Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Cookies\robert@atwola[1].txt

Spyware:Cookie/BurstNet Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Cookies\robert@burstnet[1].txt

Spyware:Cookie/Com.com Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Cookies\robert@com[1].txt

Spyware:Cookie/Belnk Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Cookies\[email protected][2].txt

Spyware:Cookie/Com.com Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Cookies\[email protected][1].txt

Spyware:Cookie/Kmpads Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Cookies\robert@kmpads[1].txt

Spyware:Cookie/BurstBeacon Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Cookies\[email protected][1].txt

Adware:Adware/Yazzle Not disinfected C:\My Backup -- 22-03-05 2002\Documents and Settings\Robert\Local Settings\Temp\b116.exe

Adware:Adware/PurityScan Not disinfected C:\My Backup -- 22-03-05 2002\Program Files\Common Files\W?nSxS\regsvr32.exe

Adware:Adware/DeluxeComunications Not disinfected C:\QooBox\Quarantine\C\WINDOWS\b136.exe.vir

Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\WINDOWS\Nircmd.exe

Adware:Adware/Yazzle Not disinfected C:\_OTMoveIt\MovedFiles1312008_181220\My Backup -- 22-03-05 2002\Program Files\Common Files\Yazzle1122OinUninstaller.exe

Adware:Adware/Yazzle Not disinfected C:\_OTMoveIt\MovedFiles1312008_181220\My Backup -- 22-03-05 2002\Program Files\Common Files\Yazzle1396OinUninstaller.exe

Spyware:Spyware/MarketScore Not disinfected C:\_OTMoveIt\MovedFiles1312008_181220\My Backup -- 22-03-05 2002\WINDOWS\system32\rlxf.dll

Link to post
Share on other sites
Andro1d

Andro1d

Posted
Posted

Nice job your log looks clean!

How is it running?

Please use the following suggestion to help prevent reinfection.

  • Make sure you have an Internet Connection.
  • Double-click OTMoveIt2.exe to run it. (Vista users, please right click on OTMoveit2.exe and select "Run as an Administrator")
  • Click on the CleanUp! button
  • A list of tool components used in the Cleanup of malware will be downloaded.
  • If your Firewall or Real Time protection attempts to block OtMoveit2 to rech the Internet, please allow the application to do so.
  • Click Yes to beging the Cleanup process and remove these components, including this application.
  • You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.

Also, you may delete any tools I had you download during the cleaning process.

Reset and Re-enable your System Restore to remove infected files that have been backed up by Windows. The files in System Restore are protected to prevent any programs from changing those files. This is the only way to clean these files: (You will lose all previous restore points which are likely to be infected)Now we need to make a new System Restore Point for your PC, please do the following

  • Click Start, Settings, Control Panel
  • Double-click the System icon
  • Click the Performance tab, File System, Troubleshooting tab
  • Check "Turn off System Restore" and click "Apply". Please give a moment as it will delete the old System Restore points
  • Then uncheck "Turn off System Restore" which will create a new System Restore point
  • Click OK

I highly recommend downloading the following programs, to keep malware of your computer to begin with.

The following is a list of tools and utilities that I like to suggest to people. This list is full of great tools and utilities to help you understand how you got infected and how to keep from getting infected again.

SUPERAntiSpyware - A very powerful tool which searches and kills malware that infects your system.

SpywareBlaster - Great prevention tool to keep malware from installing on your system.

**Tutorial on installing & using this product can be found HERE**

SpywareGuard - Works as a Spyware "Shield" to protect your computer from getting malware in the first place.

**Tutorial on installing & using this product can be found HERE**

IE-SpyAd - Puts over 5000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all.

**Tutorial on installing & using this product can be found HERE**

ATF Cleaner - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out malware that like to reside in the temp folders.

Antivirus Program An Antivirus program is a must in today's digital world! I recommend avast! 4 Home Edition, AVG, or Anti-Vir.

DO NOT install more than one Antivirus program. They will conflict, and provide less protection, not more.

Firewall A firewall is definitely a must have to protect your computer from hackers. I recommend Comodo, Online Armor, or Outpost.

**Tutorial on Firewalls can be found HERE**

Windows Updates - It is very important to make sure that both Internet Explorer and Windows are kept current with the latest critical security patches from Microsoft. To do this just start Internet Explorer and select Tools > Windows Update, and follow the online instructions from there.

You must stay on top of your updates at all times, for the above mentioned applications.

It is vitally important to stay on top of your critical updates provided by Microsoft.

And finally a little action-smiley-036.gifHow did I get infected in the first place?(by Tony Klein)

Good luck and safe surfing :)

Link to post
Share on other sites
Fireman17

Fireman17

Posted
  • Author
Posted

Thank You for helping with this issue my computer is running alot faster. I am gald there are people still there helping aothers issue like this and teaching what do and what not do and how you got this etc. The world is messing that now days. I belive this tread can be lock now.

Link to post
Share on other sites
Andro1d

Andro1d

Posted
Posted

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :)

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Followers 0
Go to topic listing