Log of AproposFix v1.1 ************ Running from directory: C:\Documents and Settings\Pauly Poop Stain\Desktop\aproposfix ************ Registry entries found: [HKEY_LOCAL_MACHINE\Software\C0XX8AF4cVs5] @="v7.ArCGLMMLMMNMK:w2wPjELMMLbOMvhmcnvrMDJDE:7SRM.C3G:CDMDEC5:.CGNDJD" "Device"="\\\\.\\zeXhX0Kt" "DriverPath"="C:\\WINDOWS\\system32\\drivers\\strkedrv.sys" "DriverName"="WmdpSrv" "UninstallerParams"="" "PageFiltering"=dword:00000001 "AutoUpdater"="C:\\WINDOWS\\system32\\rouwmpcd.exe" "Version"="2.0.100" "LastAURestoreMsgTS"="2005:10:16-04:51:37:375" [HKEY_LOCAL_MACHINE\Software\C0XX8AF4cVs5\AU2] "AP"="/DVNM=\"\\\\.\\zeXhX0Kt\" /INSC=\"AU\"" "SU"="http://au.contextplus.net/services/AUServer" "NPT"="2006:07:25-23:18:31:312" @="2006:07:25-17:18:31:328" ************ Removing hidden service: Service WmdpSrv removed. Removing hidden folder: No folder found! Deleting files: Deletion of file C:\WINDOWS\system32\drivers\strkedrv.sys succeeded! Deletion of file C:\WINDOWS\system32\rouwmpcd.exe succeeded! Backing up files: Done! Removing registry entries: REGEDIT4 [-HKEY_CURRENT_USER\Software\C0XX8AF4cVs5] [-HKEY_LOCAL_MACHINE\Software\C0XX8AF4cVs5] Done! Finished! Logfile of HijackThis v1.99.1 Scan saved at 5:36:55 AM, on 8/2/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Sygate\SPF\smc.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe C:\PROGRA~1\AVG7\avgamsvr.exe C:\PROGRA~1\AVG7\avgupsvc.exe C:\Program Files\Symantec AntiVirus\DefWatch.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Symantec AntiVirus\Rtvscan.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\hkcmd.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\PROGRA~1\SYMANT~1\VPTray.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\HJT\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://www.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://www.yahoo.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Broken Internet access because of LSP provider 'c:\program files\bonjour\mdnsnsp.dll' missing O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photos.walmart.com/WalmartActivia.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by107fd.bay107.hotmail.msn.com/resources/MsnPUpld.cab O16 - DPF: {54D53429-945C-4188-B460-C81356541882} (SaveImageFiles Class) - http://eshare.hpphoto.com/Download/HPeServicesLocalPrint.CAB O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1180428749360 O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/PhtPkMSN.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Adobe Active File Monitor V5 (AdobeActiveFileMonitor5.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\AVG7\avgupsvc.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe thank you in advance, this forum is a life saver!!!
Download and Run ComboFix *Download this file from either of the two below listed places : http://download.bleepingcomputer.com/sUBs/ComboFix.exe http://www.techsupportforum.com/sectools/sUBs/ComboFix.exe *Then double click combofix.exe & follow the prompts. *When finished, it shall produce a log for you. Post that log in your next reply Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall
here is the ComboFix log ComboFix 07-08-04.3 - "Pauly Poop Stain" 2007-08-06 11:51:43.1 [GMT -5:00] - NTFS Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.True * Created a new restore point ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\Program Files\Common Files\inetget2 C:\Program Files\Common Files\inetget2\mc-60-550-0000166.exe C:\Program Files\Common Files\inetget2\mc-67-525-0000166.exe C:\Program Files\Common Files\mc-60-550-0000166.exe C:\Program Files\Common Files\mc-67-525-0000166.exe C:\Program Files\Common Files\system32.dll C:\Program Files\dns C:\Program Files\dns\affid.dat C:\Program Files\dns\cwebpage.dll C:\Program Files\dns\regexp.dat C:\Program Files\dns\regexpDate.dat C:\Program Files\dns\uid.dat C:\Program Files\dns\urls.dat C:\Program Files\dns\version.txt C:\Program Files\dns\x.bmp ((((((((((((((((((((((((( Files Created from 2007-07-06 to 2007-08-06 ))))))))))))))))))))))))))))))) 2007-08-06 11:50 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-08-02 05:49 <DIR> d-------- C:\DOCUME~1\PAULYP~1\.housecall6.6 2007-08-02 05:25 <DIR> d-------- C:\ccleanback 2007-07-20 17:45 <DIR> d-------- C:\Program Files\Common Files\xing shared 2007-07-20 17:38 720 --a------ C:\WINDOWS\mozver.dat (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-08-06 10:37 --------- d-------- C:\Program Files\Symantec AntiVirus 2007-08-02 06:31 --------- d-------- C:\Program Files\Windows Media Connect 2 2007-07-31 04:37 --------- d-------- C:\Program Files\SpywareBlaster 2007-07-20 22:55 --------- d-------- C:\DOCUME~1\PAULYP~1\APPLIC~1\Real 2007-07-20 17:44 --------- d-------- C:\Program Files\Common Files\Real 2007-07-13 16:39 --------- d-------- C:\DOCUME~1\PAULYP~1\APPLIC~1\LimeWire 2007-06-12 21:58 --------- d-------- C:\DOCUME~1\PAULYP~1\APPLIC~1\SiteAdvisor 2007-06-12 02:22 1163592 --a------ C:\Program Files\install_flash_player.exe 2007-06-11 22:06 --------- d-------- C:\Program Files\Sygate 2007-06-11 22:03 --------- d-------- C:\Program Files\Common Files\Wise Installation Wizard 2007-06-11 21:51 --------- d-------- C:\Program Files\MSN Messenger 2007-06-03 21:12 241664 --a------ C:\hijackthis_self.exe 2007-06-01 22:40 10 --a------ C:\WINDOWS\smdat32m.sys 2007-05-16 10:12 86528 -----c--- C:\WINDOWS\system32\dllcache\directdb.dll 2007-05-16 10:12 85504 -----c--- C:\WINDOWS\system32\dllcache\wabimp.dll 2007-05-16 10:12 683520 --a------ C:\WINDOWS\system32\inetcomm.dll 2007-05-16 10:12 683520 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll 2007-05-16 10:12 510976 -----c--- C:\WINDOWS\system32\dllcache\wab32.dll 2007-05-16 10:12 1314816 -----c--- C:\WINDOWS\system32\dllcache\msoe.dll 2006-01-27 00:57 774144 --a------ C:\Program Files\RngInterstitial.dll 1998-12-09 04:53 99840 --a------ C:\Program Files\Common Files\IRAABOUT.DLL 1998-12-09 04:53 70144 --a------ C:\Program Files\Common Files\IRAMDMTR.DLL 1998-12-09 04:53 48640 --a------ C:\Program Files\Common Files\IRALPTTR.DLL 1998-12-09 04:53 31744 --a------ C:\Program Files\Common Files\IRAWEBTR.DLL 1998-12-09 04:53 186368 --a------ C:\Program Files\Common Files\IRAREG.DLL 1998-12-09 04:53 17920 --a------ C:\Program Files\Common Files\IRASRIAL.DLL 2004-08-04 07:56:57 73,728 --sha-w C:\WINDOWS\RegisteredPackages\{DD90D410-1823-43EB-9A16-A2331BF08799}$BACKUP$\System\wmplayer.exe ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2002-12-04 01:19] "HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2002-12-04 01:06] "vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2004-08-02 19:36] "SmcService"="C:\PROGRA~1\Sygate\SPF\smc.exe" [2004-10-15 19:40] [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "AVG7_Run"=C:\PROGRA~1\AVG7\avgw.exe /RUNONCE C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 22:05:56] R0 Teefer;Teefer for NT;C:\WINDOWS\system32\Drivers\Teefer.sys R1 Cdr4_xp;Cdr4_xp;C:\WINDOWS\system32\drivers\Cdr4_xp.sys R1 wpsdrvnt;wpsdrvnt;\??\C:\WINDOWS\system32\drivers\wpsdrvnt.sys R2 wg3n;SyGate for NT, wg3n;C:\WINDOWS\system32\Drivers\wg3n.sys R2 wg4n;SyGate for NT, wg4n;C:\WINDOWS\system32\Drivers\wg4n.sys R2 wg5n;SyGate for NT, wg5n;C:\WINDOWS\system32\Drivers\wg5n.sys R2 wg6n;SyGate for NT, wg6n;C:\WINDOWS\system32\Drivers\wg6n.sys R3 BCMModem;BCM V.90 56K Modem;C:\WINDOWS\system32\DRIVERS\BCMDM.sys R3 E100B;Intel(R) PRO Adapter Driver;C:\WINDOWS\system32\DRIVERS\e100b325.sys S3 iscFlash;iscFlash;\??\C:\WINDOWS\SYSTEM32\DRIVERS\iscflash.sys Contents of the 'Scheduled Tasks' folder 2007-07-31 16:16:04 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-08-06 11:56:59 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-08-06 11:58:10 C:\ComboFix-quarantined-files.txt ... 2007-08-06 11:57 --- E O F ---
Update Java Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update. *Download the latest version of Java(TM) SE Runtime Environment 6u2. *Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications". *Click the "Download" button to the right. *Check the box that says: "Accept License Agreement". *The page will refresh. *Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop. *Close any programs you may have running - especially your web browser. *Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java. *Check any item with Java Runtime Environment (JRE or J2SE) in the name. *Click the Remove or Change/Remove button. *Repeat as many times as necessary to remove each Java versions. *Reboot your computer once all Java components are removed. *Then from your desktop double-click on the download to install the newest version. ======== Please do an online scan with Kaspersky WebScanner Click on Kaspersky Online Scanner You will be prompted to install an ActiveX component from Kaspersky, Click Yes. * The program will launch and then begin downloading the latest definition files: * Once the files have been downloaded click on NEXT * Now click on Scan Settings * In the scan settings make that the following are selected: * Scan usingnthe following Anti-Virus database: Extended (if available otherwise Standard) *Scan Options: Scan Archives Scan Mail Bases * Click OK * Now under select a target to scan: Select My Computer * This will program will start and scan your system. * The scan will take a while so be patient and let it run. * Once the scan is complete it will display if your system has been infected. * Now click on the Save as Text button: * Save the file to your desktop. * Copy and paste that information in your next post.
sorry i had the remove the first two scan log posts after i realized it would take about 20 huge posts to get the whole log in.. my sister's windows user account is password protected and most of the files in the log were on her account, so next time i see her im going to have her run ccleaner, adaware, spybot and avg and then run the kaspersky once again to try and make the list much smaller
