I'm trying to help fix my brother-in-laws laptop and he's been hit with that malware that was taken care of in this thread I can't fix it, so I'd like some help in doing so. Thanks alot.
Hi sappy72 Before we begin the cleanup process, it is important to do a little analysis first. We will analyze your computer with a tool called HijackThis. Please download the HijackThis zip file. Save it onto a convenient place in your computer, and then unzip the file. Rename HijackThis(.exe) to scanner(.exe). Next, run scanner(.exe). A window will pop up. • Click on the button which says Main Menu, then Do a system scan and save a logfile. • Please wait for the scan to be completed. • After the scan has completed, a text window will pop up. Please post the contents of this window here. This will also be located at hijackthis(.txt) in the same folder that HijackThis was originally saved. NOTE:: Do not fix anything using HijackThis, as this may also damage legitimate components of your computer. Best Regards
I haven't been able to get on here due to work, but now as I try on my brother-in-laws laptop, I'm about to go crazy. His computer is so slow and constantly loads all these different pages. I can't get it to stop long enough to download the required software that you need for the logs.
Hey sappy72 Let's do a little cleanup before the analysis. Do you have a second computer and a flash drive? Follow the instructions below, except to download the tool onto your flash drive first on a different computer and then load the flash drive into the infected one. Now, please download ComboFix. With ComboFix, at the download window, please rename it to Combo-Fix(.exe) before downloading it. Please disable all security programs, such as antiviruses, antispywares, and firewalls. Also disable your internet connection. • Run Combo-Fix.exe and follow the prompts. **Understand that things like your system clock changing and your desktop disappearing might happen. Do not worry, because all will be restored later. • Wait for the scan to be completed. • If it requires a reboot, please do it. • After the scan has completed entirely, please post the log here. The log will be located at C:\ComboFix(.txt) Do not click on the ComoboFix window, as it may cause it to stall. After that, follow the instructions regarding HijackThis. Best Regards
Okay, thanks. Here is the COMBO-FIX log ComboFix 08-09-05.02 - brent 2008-09-21 23:14:34.1 - NTFSx86 Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1033.18.285 [GMT -5:00] Running from: F:\Combo-Fix.exe . - REDUCED FUNCTIONALITY MODE - . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Program Files\ShoppingReport C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll C:\Temp\1cb\syscheck.log C:\temp\tn3 C:\Windows\system32\MSINET.oca C:\Windows\system32\pac.txt . ((((((((((((((((((((((((( Files Created from 2008-08-22 to 2008-09-22 ))))))))))))))))))))))))))))))) . 2008-09-05 16:01 . 2008-09-05 16:00 167,424 --a------ C:\Windows\System32\MSA.cpl 2008-09-04 18:23 . 2008-09-04 18:23 73,719 --a------ C:\Windows\stfMeane1000106.exe 2008-09-04 18:21 . 2008-09-04 18:21 <DIR> d-------- C:\Windows\System32\Xtmp 2008-09-04 18:21 . 2008-09-04 18:21 <DIR> d-------- C:\Windows\System32\hcp 2008-09-04 18:21 . 2008-09-04 18:21 <DIR> d-------- C:\Windows\System32\enB 2008-09-04 18:21 . 2008-09-21 23:15 <DIR> d-------- C:\Temp\1cb 2008-09-04 18:21 . 2008-09-04 18:21 167,976 --a------ C:\Windows\System32\drivers\core.cache.dsk 2008-09-04 18:21 . 2008-09-04 18:21 86,144 --a------ C:\Windows\System32\drivers\rspndrr.sys 2008-09-04 18:20 . 2008-09-04 18:20 <DIR> d-------- C:\Windows\System32\wTR02 2008-09-04 18:20 . 2008-09-04 18:21 <DIR> d-------- C:\Temp\dax41 2008-09-04 18:20 . 2008-09-21 23:15 <DIR> d-------- C:\Temp 2008-09-04 18:19 . 2008-09-04 18:19 34,816 --a------ C:\Windows\System32\rqRJApNE.dll 2008-09-04 18:19 . 2008-09-04 18:19 34,816 --a------ C:\Windows\System32\hgGvUkJa.dll 2008-09-04 16:53 . 2007-06-28 18:52 765,952 --a------ C:\Windows\System32\xvidcore.dll 2008-09-04 16:53 . 2007-06-28 18:54 180,224 --a------ C:\Windows\System32\xvidvfw.dll 2008-09-04 16:53 . 2007-06-28 18:55 77,824 --a------ C:\Windows\System32\xvid.ax . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-09-22 04:23 --------- d---a-w C:\ProgramData\TEMP 2008-09-07 11:12 --------- d-----w C:\Users\brent\AppData\Roaming\LimeWire 2008-09-05 22:37 --------- d-----w C:\Users\brent\AppData\Roaming\uTorrent 2008-09-04 23:34 --------- d-----w C:\ProgramData\Roxio 2008-09-04 17:33 82 ----a-w C:\Users\brent\AppData\Roaming\wklnhst.dat 2008-08-18 00:04 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-08-17 23:00 --------- d-----w C:\Program Files\Norton Security Scan 2008-08-13 08:12 --------- d-----w C:\Program Files\Windows Mail 2008-08-09 00:53 --------- d-----w C:\Program Files\Yahoo! Games 2008-07-31 21:08 --------- d-----w C:\Program Files\AvailaSoft 2008-07-19 05:10 53,448 ----a-w C:\Windows\System32\wuauclt.exe 2008-07-19 05:10 45,768 ----a-w C:\Windows\System32\wups2.dll 2008-07-19 05:10 36,552 ----a-w C:\Windows\System32\wups.dll 2008-07-19 05:09 563,912 ----a-w C:\Windows\System32\wuapi.dll 2008-07-19 05:09 1,811,656 ----a-w C:\Windows\System32\wuaueng.dll 2008-07-19 03:44 83,456 ----a-w C:\Windows\System32\wudriver.dll 2008-07-19 03:44 1,524,736 ----a-w C:\Windows\System32\wucltux.dll 2008-07-19 03:08 163,904 ----a-w C:\Windows\System32\wuwebv.dll 2008-07-19 01:44 31,232 ----a-w C:\Windows\System32\wuapp.exe 2008-07-15 23:48 2,048 ----a-w C:\Windows\System32\tzres.dll 2008-07-10 08:11 174 --sha-w C:\Program Files\desktop.ini 2008-06-27 03:54 826,368 ----a-w C:\Windows\System32\wininet.dll 2008-06-27 03:54 56,320 ----a-w C:\Windows\System32\iesetup.dll 2008-06-27 03:54 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll 2008-06-27 03:54 26,624 ----a-w C:\Windows\System32\ieUnatt.exe 2008-06-26 00:34 7,964,672 ----a-w C:\Windows\System32\NlsLexicons0024.dll 2008-06-26 00:33 9,892,864 ----a-w C:\Windows\System32\NlsLexicons000a.dll 2008-04-29 19:30 53,914 ----a-w C:\Program Files\INSTALL.LOG 2007-12-12 11:38 626,688 ----a-w C:\Users\brent\AppData\Roaming\win32vll.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{166BE28B-0297-42F3-80AF-0D756ED7F583}] 2008-09-04 18:19 34816 --a------ C:\Windows\system32\rqRJApNE.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 125440] "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-02-11 1232896] "DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [2007-10-09 202544] "Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 4670704] "{3A3678E4-94D9-0814-0708-070700080504}"="C:\Users\brent\AppData\Roaming\win32vll.exe" [2007-12-12 626688] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-12-15 68856] "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 201728] "MSServer"="C:\Users\brent\AppData\Local\Temp\jkkHWPff.dll" [2008-09-04 34816] "BM6723bb16"="C:\Users\brent\AppData\Local\Temp\vcbxbscr.dll" [2008-09-19 95744] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "dscactivate"="C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-10-09 16384] "DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [2007-10-09 202544] "DeskSiteAlert"="C:\ProgramData\DeskSite\Binex\DeskSiteAlert.exe" [2007-08-25 42248] "MSServer"="C:\Windows\system32\rqRJApNE.dll" [2008-09-04 34816] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{166BE28B-0297-42F3-80AF-0D756ED7F583}"= "C:\Windows\system32\rqRJApNE.dll" [2008-09-04 34816] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{BA5CEE05-AB9F-4B49-B2D6-5DBD9B82BA9B}"= UDP:C:\Program Files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server "{70C89E0D-2091-4E4E-80AA-10F7DA7E99CA}"= TCP:C:\Program Files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server "{47118C35-40C9-4462-A24C-6FC6E87B4178}"= UDP:C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger "{9BEF4C77-8524-4C95-AFC5-75AF497188CF}"= TCP:C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger "{19A95997-7C30-40D6-A4A2-F7A918E5A13B}"= UDP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire "{A7FE5E69-87CC-44FD-9209-67FE4462F1EC}"= TCP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire "{481E2FFF-0BE4-42E9-B361-5CE449EFD92E}"= UDP:C:\Program Files\att-nap\McciBrowser.exe:motivebrowser.exe "{D95F3CF3-6322-4FAB-9761-E908B6E12318}"= TCP:C:\Program Files\att-nap\McciBrowser.exe:motivebrowser.exe "{AD371567-0D0E-43AD-816B-25B6B824C830}"= UDP:C:\Program Files\att-nap\McciBrowser.exe:motivebrowser.exe "{CA903BB7-F4C7-498E-811C-D0129109F5A3}"= TCP:C:\Program Files\att-nap\McciBrowser.exe:motivebrowser.exe "TCP Query User{D8119B36-18CD-4635-9629-E55C6EB03FDB}C:\\program files\\yahoo! games\\yahoo! ten pin championship bowling\\yahoo ten pin championship bowling.exe"= Disabled:UDP:C:\program files\yahoo! games\yahoo! ten pin championship bowling\yahoo ten pin championship bowling.exe:Skyworks Ten Pin Championship Bowling "UDP Query User{6ED68929-E0A9-42E4-9721-B3681F353EC3}C:\\program files\\yahoo! games\\yahoo! ten pin championship bowling\\yahoo ten pin championship bowling.exe"= Disabled:TCP:C:\program files\yahoo! games\yahoo! ten pin championship bowling\yahoo ten pin championship bowling.exe:Skyworks Ten Pin Championship Bowling "TCP Query User{5035825A-A042-45F5-84EC-71F843EE2E27}C:\\users\\brent\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pc8za7ba\\utorrent[1].exe"= UDP:C:\users\brent\appdata\local\microsoft\windows\temporary internet files\content.ie5\pc8za7ba\utorrent[1].exe:utorrent[1].exe "UDP Query User{81F1D15E-8196-4EEB-9C6F-6D249FFCF7E6}C:\\users\\brent\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pc8za7ba\\utorrent[1].exe"= TCP:C:\users\brent\appdata\local\microsoft\windows\temporary internet files\content.ie5\pc8za7ba\utorrent[1].exe:utorrent[1].exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System] "DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic| R0 AtiPcie;ATI PCI Express (3GIO) Filter;C:\Windows\system32\DRIVERS\AtiPcie.sys [2006-10-30 8192] R2 McciCMService;McciCMService;C:\Program Files\Common Files\Motive\McciCMService.exe [2008-01-28 303104] S3 btwaudio;Bluetooth Audio Device Service;C:\Windows\system32\drivers\btwaudio.sys [2007-03-29 79664] S3 btwavdt;Bluetooth AVDT Service;C:\Windows\system32\drivers\btwavdt.sys [2007-02-27 81200] S3 btwrchid;btwrchid;C:\Windows\system32\DRIVERS\btwrchid.sys [2007-02-27 16432] S3 MREMP50;MREMP50 NDIS Protocol Driver;C:\PROGRA~1\COMMON~1\Motive\MREMP50.SYS [2008-01-28 19712] S3 MRESP50;MRESP50 NDIS Protocol Driver;C:\PROGRA~1\COMMON~1\Motive\MRESP50.SYS [2008-01-28 18304] Start Pending2 DeskSiteCMA;DeskSiteCMA;C:\ProgramData\DeskSite\Binex\DeskSiteCMA.exe [2007-08-25 169224] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] bthsvcs REG_MULTI_SZ BthServ WindowsMobile REG_MULTI_SZ wcescomm rapimgr LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{00fcdaa1-c245-11dc-87ec-001d09b55d8c}] \shell\AutoRun\command - F:\setupSNK.exe . Contents of the 'Scheduled Tasks' folder . - - - - ORPHANS REMOVED - - - - HKCU-Run-6410888a - C:\Users\brent\AppData\Local\Temp\irisimmp.dll HKLM-Run-Antivirus - C:\Program Files\MS Antivirus\MSA.exe . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Users\brent\AppData\Roaming\Mozilla\Firefox\Profiles\z3pcdu57.default\ FF -: plugin - c:\Program Files\Java\jre1.6.0\bin\npjava11.dll FF -: plugin - c:\Program Files\Java\jre1.6.0\bin\npjava12.dll FF -: plugin - c:\Program Files\Java\jre1.6.0\bin\npjava13.dll FF -: plugin - c:\Program Files\Java\jre1.6.0\bin\npjava14.dll FF -: plugin - c:\Program Files\Java\jre1.6.0\bin\npjava32.dll FF -: plugin - c:\Program Files\Java\jre1.6.0\bin\npjpi160.dll FF -: plugin - c:\Program Files\Java\jre1.6.0\bin\npoji610.dll FF -: plugin - C:\Program Files\Yahoo!\Shared\npYState.dll . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-21 23:22:02 Windows 6.0.6000 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKCU\Software\Microsoft\Windows\CurrentVersion\Run {3A3678E4-94D9-0814-0708-070700080504} = C:\Users\brent\AppData\Roaming\win32vll.exe?\?R?o?a?m?i?n?g??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\Windows\System32\Ati2evxx.exe C:\Windows\System32\audiodg.exe C:\Windows\System32\Ati2evxx.exe C:\Windows\System32\WLTRYSVC.EXE C:\Windows\System32\BCMWLTRY.EXE C:\Program Files\Common Files\Command Software\dvpapi.exe C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe C:\Program Files\Dell Support Center\bin\sprtsvc.exe C:\Program Files\SigmaTel\C-Major Audio\WDM\stacsv.exe C:\Windows\System32\drivers\XAudio.exe C:\Windows\System32\WUDFHost.exe C:\Windows\System32\rundll32.exe C:\Windows\ehome\ehmsas.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\System32\msfeedssync.exe C:\Windows\System32\WerFault.exe C:\Windows\System32\LogonUI.exe . ************************************************************************** . Completion time: 2008-09-21 23:33:40 - machine was rebooted ComboFix-quarantined-files.txt 2008-09-22 04:32:50 Pre-Run: 41,010,450,432 bytes free Post-Run: 40,960,942,080 bytes free 184 --- E O F --- 2008-09-04 23:52:09 And here is the HijackThis log Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:46:50 PM, on 9/21/2008 Platform: Windows Vista (WinNT 6.00.1904) MSIE: Internet Explorer v7.00 (7.00.6000.16711) Boot mode: Normal Running processes: C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Program Files\Dell Support Center\bin\sprtcmd.exe C:\Windows\ehome\ehtray.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Windows\System32\rundll32.exe C:\Windows\ehome\ehmsas.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\explorer.exe F:\Scanner.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.att.net/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {166BE28B-0297-42F3-80AF-0D756ED7F583} - C:\Windows\system32\rqRJApNE.dll O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter O4 - HKLM\..\Run: [DeskSiteAlert] "C:\ProgramData\DeskSite\Binex\DeskSiteAlert.exe" O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\rqRJApNE.dll,#1 O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet O4 - HKCU\..\Run: [{3A3678E4-94D9-0814-0708-070700080504}] C:\Users\brent\AppData\Roaming\win32vll.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKCU\..\Run: [BM6723bb16] Rundll32.exe "C:\Users\brent\AppData\Local\Temp\vcbxbscr.dll",s O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE') O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\npjpi160.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\npjpi160.dll O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - (no file) O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O13 - Gopher Prefix: O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe O23 - Service: DeskSiteCMA - DeskSite - C:\ProgramData\DeskSite\Binex\DeskSiteCMA.exe O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - C:\Program Files\Common Files\Command Software\dvpapi.exe O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: McciCMService - Motive Communications, Inc. - C:\Program Files\Common Files\Motive\McciCMService.exe O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Program Files\SigmaTel\C-Major Audio\WDM\STacSV.exe O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe -- End of file - 7421 bytes
Hey sappy72 Please disable all security programs, such as antiviruses, antispywares, and firewalls. Also disable your internet connection. Open Notepad and copy/paste the text in the code box below into it: Code: Driver:: rspndrr File:: C:\Windows\System32\MSA.cpl C:\Windows\stfMeane1000106.exe C:\Windows\System32\drivers\core.cache.dsk C:\Windows\System32\drivers\rspndrr.sys C:\Windows\System32\rqRJApNE.dll C:\Windows\System32\hgGvUkJa.dll C:\Users\brent\AppData\Local\Temp\vcbxbscr.dll C:\Users\brent\AppData\Local\Temp\jkkHWPff.dll Folder:: C:\Windows\System32\Xtmp C:\Windows\System32\hcp C:\Windows\System32\enB C:\Temp\1cb C:\Windows\System32\wTR02 C:\Temp\dax41 Registry:: [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSServer"=- "BM6723bb16"=- Save this as CFScript.txt in the same folder as ComboFix. Then drag the CFScript.txt into Combo-Fix.exe. This will start ComboFix again. After reboot, (in case it asks to reboot), post the ComboFix log here. The log will be located at C:\ComboFix(.txt). Do not click on the ComoboFix window, as it may cause it to stall. Please download Superantispyware Free and install it. Follow the prompts and reboot if required. Launch Superantispyware Free either by running C:\Program Files\SUPERANTISPYWARE.exe or right-click on the SuperAntispyware icon in your task bar (it looks like a bug) and click on Scan for Spyware, Adware, Malware... Configuring SuperAntispyware • Click on Preferences. • In the tab General and Startup, make sure the box Start SuperAntispyware when Windows starts is unchecked. This will prevent SuperAntispyware from starting everytime, because it may interfere with other fixes that may be run. • Navigate to the tab Scanning Control. • Make sure only these boxes are checked: Code: Close browsers before scanning Scan for tracking cookies Terminate memory threats before quarantining Scan Alternate Data Streams Use Kernel Direct File Access (recommended) Use Kernel Direct Registry Access (recommended) Use Direct Disk Access (recommended) • Click on Close. Updating SuperAntispyware • At the main window, click on Check for Updates.... • Wait for SuperAntispyware to be fully updated. Scanning Time • Boot into safe mode by repeatedly pressing the F8 key after you press the power button. If safe mode does not work, tell me and do the scan in normal mode. • Launch SuperAntispyware. • At the main window, click on Scan your Computer.... • Make sure all drives (excluding CD drives) are checked, select Perform Complete Scan, and then click on Next. • Wait for the scan to complete, and then click on Next>. This will quarantine and remove all detected items. • Reboot your computer. Post A Log • Launch SuperAntispyware • Click on Preferences • Navigate to the tab Statistics/Logs. • Choose the latest scan log, and the click on View Log.... • Copy and paste the contents of the log here in your next post. Best Regards
Here is the latest COMBO-FIX log ComboFix 08-09-05.02 - brent 2008-09-24 15:57:04.2 - NTFSx86 Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1033.18.385 [GMT -5:00] Running from: F:\Combo-Fix.exe Command switches used :: F:\CFScript.txt * Created a new restore point . - REDUCED FUNCTIONALITY MODE - . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Temp\1cb C:\Temp\dax41\A3G.log C:\temp\tn3 C:\Users\brent\AppData\Local\Temp\jkkHWPff.dll C:\Users\brent\AppData\Local\Temp\vcbxbscr.dll C:\Windows\stfMeane1000106.exe C:\Windows\System32\drivers\core.cache.dsk C:\Windows\System32\drivers\rspndrr.sys C:\Windows\System32\enB\Wi03550xi.exe C:\Windows\System32\hcp\ifd4078v1.exe C:\Windows\System32\hgGvUkJa.dll C:\Windows\System32\MSA.cpl C:\Windows\System32\rqRJApNE.dll C:\Windows\System32\wTR02\wTR022328.exe C:\Windows\System32\Xtmp\ATV5105nt.exe . ((((((((((((((((((((((((( Files Created from 2008-08-24 to 2008-09-24 ))))))))))))))))))))))))))))))) . 2008-09-04 18:21 . 2008-09-24 15:57 <DIR> d-------- C:\Windows\System32\Xtmp 2008-09-04 18:21 . 2008-09-24 15:57 <DIR> d-------- C:\Windows\System32\hcp 2008-09-04 18:21 . 2008-09-24 15:57 <DIR> d-------- C:\Windows\System32\enB 2008-09-04 18:20 . 2008-09-24 15:57 <DIR> d-------- C:\Windows\System32\wTR02 2008-09-04 18:20 . 2008-09-24 15:57 <DIR> d-------- C:\Temp\dax41 2008-09-04 18:20 . 2008-09-24 15:57 <DIR> d-------- C:\Temp 2008-09-04 16:53 . 2007-06-28 18:52 765,952 --a------ C:\Windows\System32\xvidcore.dll 2008-09-04 16:53 . 2007-06-28 18:54 180,224 --a------ C:\Windows\System32\xvidvfw.dll 2008-09-04 16:53 . 2007-06-28 18:55 77,824 --a------ C:\Windows\System32\xvid.ax . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-09-24 21:02 --------- d---a-w C:\ProgramData\TEMP 2008-09-07 11:12 --------- d-----w C:\Users\brent\AppData\Roaming\LimeWire 2008-09-05 22:37 --------- d-----w C:\Users\brent\AppData\Roaming\uTorrent 2008-09-04 23:34 --------- d-----w C:\ProgramData\Roxio 2008-09-04 17:33 82 ----a-w C:\Users\brent\AppData\Roaming\wklnhst.dat 2008-08-18 00:04 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-08-17 23:00 --------- d-----w C:\Program Files\Norton Security Scan 2008-08-13 08:12 --------- d-----w C:\Program Files\Windows Mail 2008-08-09 00:53 --------- d-----w C:\Program Files\Yahoo! Games 2008-07-31 21:08 --------- d-----w C:\Program Files\AvailaSoft 2008-07-19 05:10 53,448 ----a-w C:\Windows\System32\wuauclt.exe 2008-07-19 05:10 45,768 ----a-w C:\Windows\System32\wups2.dll 2008-07-19 05:10 36,552 ----a-w C:\Windows\System32\wups.dll 2008-07-19 05:09 563,912 ----a-w C:\Windows\System32\wuapi.dll 2008-07-19 05:09 1,811,656 ----a-w C:\Windows\System32\wuaueng.dll 2008-07-19 03:44 83,456 ----a-w C:\Windows\System32\wudriver.dll 2008-07-19 03:44 1,524,736 ----a-w C:\Windows\System32\wucltux.dll 2008-07-19 03:08 163,904 ----a-w C:\Windows\System32\wuwebv.dll 2008-07-19 01:44 31,232 ----a-w C:\Windows\System32\wuapp.exe 2008-07-15 23:48 2,048 ----a-w C:\Windows\System32\tzres.dll 2008-07-10 08:11 174 --sha-w C:\Program Files\desktop.ini 2008-06-27 03:54 826,368 ----a-w C:\Windows\System32\wininet.dll 2008-06-27 03:54 56,320 ----a-w C:\Windows\System32\iesetup.dll 2008-06-27 03:54 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll 2008-06-27 03:54 26,624 ----a-w C:\Windows\System32\ieUnatt.exe 2008-06-26 00:34 7,964,672 ----a-w C:\Windows\System32\NlsLexicons0024.dll 2008-06-26 00:33 9,892,864 ----a-w C:\Windows\System32\NlsLexicons000a.dll 2008-04-29 19:30 53,914 ----a-w C:\Program Files\INSTALL.LOG 2007-12-12 11:38 626,688 ----a-w C:\Users\brent\AppData\Roaming\win32vll.exe . ((((((((((((((((((((((((((((( snapshot@2008-09-21_23.32.05.30 ))))))))))))))))))))))))))))))))))))))))) . - 2008-09-22 04:18:53 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2008-09-24 20:59:29 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat - 2008-09-22 04:18:53 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2008-09-24 20:59:29 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2008-09-22 04:21:20 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT + 2008-09-24 21:01:58 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT - 2008-09-22 04:21:20 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT + 2008-09-24 21:01:58 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT - 2008-09-22 04:19:37 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2008-09-24 21:00:13 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2008-09-22 04:19:37 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2008-09-24 21:00:13 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2008-09-22 04:19:37 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2008-09-24 21:00:13 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2008-09-22 04:23:45 5,948 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3963527200-683259532-1957107418-1000_UserData.bin + 2008-09-24 20:50:11 5,988 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3963527200-683259532-1957107418-1000_UserData.bin - 2008-09-22 04:23:39 57,364 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin + 2008-09-24 20:50:10 57,396 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin - 2008-09-07 10:32:50 205,936 ----a-w C:\Windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S4.bin + 2008-09-22 04:35:58 208,530 ----a-w C:\Windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S4.bin . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 125440] "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-02-11 1232896] "DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [2007-10-09 202544] "Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 4670704] "{3A3678E4-94D9-0814-0708-070700080504}"="C:\Users\brent\AppData\Roaming\win32vll.exe" [2007-12-12 626688] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-12-15 68856] "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 201728] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "dscactivate"="C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-10-09 16384] "DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [2007-10-09 202544] "DeskSiteAlert"="C:\ProgramData\DeskSite\Binex\DeskSiteAlert.exe" [2007-08-25 42248] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{BA5CEE05-AB9F-4B49-B2D6-5DBD9B82BA9B}"= UDP:C:\Program Files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server "{70C89E0D-2091-4E4E-80AA-10F7DA7E99CA}"= TCP:C:\Program Files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server "{47118C35-40C9-4462-A24C-6FC6E87B4178}"= UDP:C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger "{9BEF4C77-8524-4C95-AFC5-75AF497188CF}"= TCP:C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger "{19A95997-7C30-40D6-A4A2-F7A918E5A13B}"= UDP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire "{A7FE5E69-87CC-44FD-9209-67FE4462F1EC}"= TCP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire "{481E2FFF-0BE4-42E9-B361-5CE449EFD92E}"= UDP:C:\Program Files\att-nap\McciBrowser.exe:motivebrowser.exe "{D95F3CF3-6322-4FAB-9761-E908B6E12318}"= TCP:C:\Program Files\att-nap\McciBrowser.exe:motivebrowser.exe "{AD371567-0D0E-43AD-816B-25B6B824C830}"= UDP:C:\Program Files\att-nap\McciBrowser.exe:motivebrowser.exe "{CA903BB7-F4C7-498E-811C-D0129109F5A3}"= TCP:C:\Program Files\att-nap\McciBrowser.exe:motivebrowser.exe "TCP Query User{D8119B36-18CD-4635-9629-E55C6EB03FDB}C:\\program files\\yahoo! games\\yahoo! ten pin championship bowling\\yahoo ten pin championship bowling.exe"= Disabled:UDP:C:\program files\yahoo! games\yahoo! ten pin championship bowling\yahoo ten pin championship bowling.exe:Skyworks Ten Pin Championship Bowling "UDP Query User{6ED68929-E0A9-42E4-9721-B3681F353EC3}C:\\program files\\yahoo! games\\yahoo! ten pin championship bowling\\yahoo ten pin championship bowling.exe"= Disabled:TCP:C:\program files\yahoo! games\yahoo! ten pin championship bowling\yahoo ten pin championship bowling.exe:Skyworks Ten Pin Championship Bowling "TCP Query User{5035825A-A042-45F5-84EC-71F843EE2E27}C:\\users\\brent\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pc8za7ba\\utorrent[1].exe"= UDP:C:\users\brent\appdata\local\microsoft\windows\temporary internet files\content.ie5\pc8za7ba\utorrent[1].exe:utorrent[1].exe "UDP Query User{81F1D15E-8196-4EEB-9C6F-6D249FFCF7E6}C:\\users\\brent\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pc8za7ba\\utorrent[1].exe"= TCP:C:\users\brent\appdata\local\microsoft\windows\temporary internet files\content.ie5\pc8za7ba\utorrent[1].exe:utorrent[1].exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System] "DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic| R0 AtiPcie;ATI PCI Express (3GIO) Filter;C:\Windows\system32\DRIVERS\AtiPcie.sys [2006-10-30 8192] R2 McciCMService;McciCMService;C:\Program Files\Common Files\Motive\McciCMService.exe [2008-01-28 303104] S3 btwaudio;Bluetooth Audio Device Service;C:\Windows\system32\drivers\btwaudio.sys [2007-03-29 79664] S3 btwavdt;Bluetooth AVDT Service;C:\Windows\system32\drivers\btwavdt.sys [2007-02-27 81200] S3 btwrchid;btwrchid;C:\Windows\system32\DRIVERS\btwrchid.sys [2007-02-27 16432] S3 MREMP50;MREMP50 NDIS Protocol Driver;C:\PROGRA~1\COMMON~1\Motive\MREMP50.SYS [2008-01-28 19712] S3 MRESP50;MRESP50 NDIS Protocol Driver;C:\PROGRA~1\COMMON~1\Motive\MRESP50.SYS [2008-01-28 18304] Start Pending2 DeskSiteCMA;DeskSiteCMA;C:\ProgramData\DeskSite\Binex\DeskSiteCMA.exe [2007-08-25 169224] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] bthsvcs REG_MULTI_SZ BthServ WindowsMobile REG_MULTI_SZ wcescomm rapimgr LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{00fcdaa1-c245-11dc-87ec-001d09b55d8c}] \shell\AutoRun\command - F:\setupSNK.exe . Contents of the 'Scheduled Tasks' folder . - - - - ORPHANS REMOVED - - - - BHO-{166BE28B-0297-42F3-80AF-0D756ED7F583} - C:\Windows\system32\rqRJApNE.dll HKLM-Run-MSServer - C:\Windows\system32\rqRJApNE.dll ShellExecuteHooks-{166BE28B-0297-42F3-80AF-0D756ED7F583} - C:\Windows\system32\rqRJApNE.dll ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-24 16:02:40 Windows 6.0.6000 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKCU\Software\Microsoft\Windows\CurrentVersion\Run {3A3678E4-94D9-0814-0708-070700080504} = C:\Users\brent\AppData\Roaming\win32vll.exe?\?R?o?a?m?i?n?g??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\Windows\System32\Ati2evxx.exe C:\Windows\System32\audiodg.exe C:\Windows\System32\Ati2evxx.exe C:\Windows\System32\WLTRYSVC.EXE C:\Windows\System32\BCMWLTRY.EXE C:\Program Files\Common Files\Command Software\dvpapi.exe C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe C:\Program Files\Dell Support Center\bin\sprtsvc.exe C:\Program Files\SigmaTel\C-Major Audio\WDM\stacsv.exe C:\Windows\System32\drivers\XAudio.exe C:\Windows\System32\WUDFHost.exe C:\Windows\ehome\ehmsas.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Program Files\Internet Explorer\iexplore.exe . ************************************************************************** . Completion time: 2008-09-24 16:10:57 - machine was rebooted ComboFix-quarantined-files.txt 2008-09-24 21:10:25 ComboFix2.txt 2008-09-22 04:33:41 Pre-Run: 40,785,367,040 bytes free Post-Run: 41,114,378,240 bytes free 189 --- E O F --- 2008-09-04 23:52:09
Here's the rest of what you asked for... SUPERAntiSpyware Scan Log http://www.superantispyware.com Generated 09/24/2008 at 05:21 PM Application Version : 4.21.1004 Core Rules Database Version : 3578 Trace Rules Database Version: 1566 Scan type : Complete Scan Total Scan Time : 00:43:49 Memory items scanned : 221 Memory threats detected : 0 Registry items scanned : 6195 Registry threats detected : 16 File items scanned : 79655 File threats detected : 3 Adware.Zango/ShoppingReport HKLM\Software\Microsoft\Internet Explorer\Extensions\{C5428486-50A0-4a02-9D20-520B59A9F9B3} HKU\S-1-5-21-3963527200-683259532-1957107418-1000\Software\ShoppingReport HKLM\Software\ShoppingReport HKLM\Software\ShoppingReport#affid HKLM\Software\ShoppingReport#Version HKLM\Software\ShoppingReport#ProductName HKLM\Software\ShoppingReport#requestor HKLM\Software\ShoppingReport#SG_Not_Set HKLM\Software\ShoppingReport#ie_user_agent HKLM\Software\ShoppingReport#usr_RCT HKLM\Software\Microsoft\Internet Explorer\Extensions\{C5428486-50A0-4a02-9D20-520B59A9F9B3}#Default Visible HKLM\Software\Microsoft\Internet Explorer\Extensions\{C5428486-50A0-4a02-9D20-520B59A9F9B3}#ButtonText HKLM\Software\Microsoft\Internet Explorer\Extensions\{C5428486-50A0-4a02-9D20-520B59A9F9B3}#HotIcon HKLM\Software\Microsoft\Internet Explorer\Extensions\{C5428486-50A0-4a02-9D20-520B59A9F9B3}#Icon HKLM\Software\Microsoft\Internet Explorer\Extensions\{C5428486-50A0-4a02-9D20-520B59A9F9B3}#CLSID HKLM\Software\Microsoft\Internet Explorer\Extensions\{C5428486-50A0-4a02-9D20-520B59A9F9B3}#ClsidExtension Trojan.Unclassified/BrowserDriver C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\ENB\WI03550XI.EXE.VIR Rootkit.TNCore-Installer C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\HCP\IFD4078V1.EXE.VIR Adware.Adservs C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\XTMP\ATV5105NT.EXE.VIR
