Hello, I'm new to the site and very frustrated at this point. I thought I would be able to remove all files related to the above with no trouble(I've done it before with net help of course) but that isn't the case and for the past week I've been trying to deal with: insane numbers of IE popups(20 at one time and grows to 40 if I ignore it), winfixer, purityscan, my desktop becomes useless(ie I can click all I want on something but no reply), and any windows I minimize still appear on my desktop. I use Ad-Aware, Spybot S&D, CCleaner, and I just recently downloaded Hijack This and created a log for this site. I didn't delete anything because it seemed a tad overwhelming at the moment and I didn't want to make things worse. I've seen posts like this before but never done it myself. So please be gentle. Any help is appreciated at the moment. I might not reply within 24 hours just so I can relax for awhile without dealing with this mess. Logfile of HijackThis v1.99.1 Scan saved at 8:40:47 PM, on 06/30/2007 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\RunDll32.exe C:\WINDOWS\System32\RUNDLL32.EXE C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Documents and Settings\All Users\Application Data\wfmlibal.exe C:\WINDOWS\mgrs.exe C:\WINDOWS\avp.exe C:\PROGRA~1\COMMON~1\SMANTE~1\dllhost.exe C:\Program Files\Palm\Hotsync.exe C:\Program Files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe C:\WINDOWS\System32\msvofipf.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe C:\Program Files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\System32\devldr32.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\DOCUME~1\ALEXSC~1\LOCALS~1\Temp\powersv.exe C:\WINDOWS\avp.exe C:\DOCUME~1\ALEXSC~1\LOCALS~1\Temp\agentlook.exe C:\WINDOWS\avp.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\WINDOWS\System32\wuauclt.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Alex Schwartz\Desktop\Jack This.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cus.../*http://www.yahoo.com/ext/search/search.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://hsremove.com/done.htm R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ie/defaults/su/ymsgr6/*http://www.yahoo.com R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = sas.r21.mchsi.com:8000 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.r21.mchsi.com;<local> O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: msdn_lib.msdn_hlp - {19D3A5DB-A5A3-4F95-9713-833AE4B950A4} - C:\WINDOWS\System32\msdn_lib.dll O2 - BHO: (no name) - {1F6581D5-AA53-4b73-A6F9-41420C6B61F1} - C:\WINDOWS\System32\vtaqulkn.dll O2 - BHO: (no name) - {27218055-DEB8-4768-8991-30B5E14EB704} - C:\Program Files\Windows NT\hokerof43855.dll O2 - BHO: (no name) - {2D343DD6-0EA5-4229-9578-46765B1FDE52} - C:\WINDOWS\System32\geede.dll O2 - BHO: (no name) - {3D1A1CA3-8C1D-F9BC-4F17-FE8DBA558FC6} - (no file) O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: (no name) - {5dafd089-24b1-4c5e-bd42-8ca72550717b} - (no file) O2 - BHO: (no name) - {8674aea0-9d3d-11d9-99dc-00600f9a01f1} - (no file) O2 - BHO: (no name) - {B9F42C34-70E2-40D3-A961-D20DAFA10250} - (no file) O2 - BHO: (no name) - {cf021f40-3e14-23a5-cba2-717765728274} - (no file) O2 - BHO: (no name) - {D73ABC8D-4B3C-455E-A15B-C72071952A45} - (no file) O2 - BHO: (no name) - {DC192567-65F9-4AB6-ADB7-E13575F81726} - C:\WINDOWS\System32\vtuvurq.dll O2 - BHO: (no name) - {E05A5316-C580-4957-9F45-980369D9AE83} - (no file) O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [07rO3pP] ddeput.exe O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe O4 - HKLM\..\Run: [Device Detector] "C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe" -autorun O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [wfmlibal.exe] C:\Documents and Settings\All Users\Application Data\wfmlibal.exe O4 - HKLM\..\Run: [smgr] mgrs.exe O4 - HKLM\..\Run: [icq.com] rundll32.exe "C:\WINDOWS\System32\cnulthvt.dll",forkonce O4 - HKLM\..\Run: [avp] C:\WINDOWS\avp.exe O4 - HKCU\..\Run: [Arun] "C:\PROGRA~1\COMMON~1\SMANTE~1\dllhost.exe" -vt yazb O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Program Files\Palm\Hotsync.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer Wrapper) - http://chat.yahoo.com/cab/yvwrctl.cab O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab O20 - Winlogon Notify: geede - C:\WINDOWS\System32\geede.dll O20 - Winlogon Notify: RelevantKnowledge - C:\WINDOWS\System32\rlls.dll (file missing) O20 - Winlogon Notify: vtuvurq - C:\WINDOWS\SYSTEM32\vtuvurq.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\ O20 - Winlogon Notify: winzdn32 - C:\WINDOWS\SYSTEM32\winzdn32.dll O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing) O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: DomainService - - C:\WINDOWS\System32\msvofipf.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Net Agent - Unknown owner - C:\WINDOWS\dls0523pmw.exe (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Panda Process Protection Service (PavPrSrv) - Unknown owner - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe (file missing) O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
Hi AceDay Please download VundoFix.exe to your desktop. Double-click VundoFix.exe to run it. Click the Scan for Vundo button. Once it's done scanning, click the Remove Vundo button. You will receive a prompt asking if you want to remove the files, click YES Once you click yes, your desktop will go blank as it starts removing Vundo. When completed, it will prompt that it will reboot your computer, click OK. Please post the contents of C:\vundofix.txt and a new HiJackThis log. Note: It is possible that VundoFix encountered a file it could not remove. In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot. Download ComboFix from Here or Here to your Desktop. Double click combofix.exe and follow the prompts. When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply Note: Do not mouseclick combofix's window while its running. That may cause it to stall Pease, post these logs: C:\vundofix.txt C:\ComboFix.txt HiJackThis log
Here you go hilu, I appreciate the help. So far everything is running a little better but by the time I say that something will go wrong. Ha ha! Vundofix text file: VundoFix V6.5.4 Checking Java version... Sun Java not detected Scan started at 1:19:17 PM 07/01/2007 Listing files found while scanning.... C:\windows\system32\awtuvtr.dll C:\windows\system32\bmfhmgxa.exe C:\windows\system32\boesfwcl.exe C:\windows\system32\cnulthvt.dll C:\windows\system32\doiycbfb.exe C:\WINDOWS\System32\edeeg.bak1 C:\WINDOWS\System32\edeeg.bak2 C:\WINDOWS\System32\edeeg.ini C:\WINDOWS\System32\eppdxmvm.dll C:\windows\system32\fccbyvw.dll C:\windows\system32\fwkplyem.exe C:\WINDOWS\System32\geede.dll C:\windows\system32\hllfdlwo.dll C:\windows\system32\msvofipf.exe C:\WINDOWS\System32\mvmxdppe.ini C:\windows\system32\pgdyxswj.exe C:\windows\system32\tvhtlunc.ini C:\windows\system32\vaysildi.exe C:\WINDOWS\System32\vtaqulkn.dll C:\WINDOWS\System32\vtuvurq.dll Beginning removal... Attempting to delete C:\windows\system32\awtuvtr.dll C:\windows\system32\awtuvtr.dll Has been deleted! Attempting to delete C:\windows\system32\bmfhmgxa.exe C:\windows\system32\bmfhmgxa.exe Has been deleted! Attempting to delete C:\windows\system32\boesfwcl.exe C:\windows\system32\boesfwcl.exe Has been deleted! Attempting to delete C:\windows\system32\cnulthvt.dll C:\windows\system32\cnulthvt.dll Has been deleted! Attempting to delete C:\windows\system32\doiycbfb.exe C:\windows\system32\doiycbfb.exe Has been deleted! Attempting to delete C:\WINDOWS\System32\edeeg.bak1 C:\WINDOWS\System32\edeeg.bak1 Has been deleted! Attempting to delete C:\WINDOWS\System32\edeeg.bak2 C:\WINDOWS\System32\edeeg.bak2 Has been deleted! Attempting to delete C:\WINDOWS\System32\edeeg.ini C:\WINDOWS\System32\edeeg.ini Has been deleted! Attempting to delete C:\WINDOWS\System32\eppdxmvm.dll C:\WINDOWS\System32\eppdxmvm.dll Has been deleted! Attempting to delete C:\windows\system32\fccbyvw.dll C:\windows\system32\fccbyvw.dll Has been deleted! Attempting to delete C:\windows\system32\fwkplyem.exe C:\windows\system32\fwkplyem.exe Has been deleted! Attempting to delete C:\WINDOWS\System32\geede.dll C:\WINDOWS\System32\geede.dll Could not be deleted. Attempting to delete C:\windows\system32\hllfdlwo.dll C:\windows\system32\hllfdlwo.dll Has been deleted! Attempting to delete C:\windows\system32\msvofipf.exe C:\windows\system32\msvofipf.exe Could not be deleted. Attempting to delete C:\WINDOWS\System32\mvmxdppe.ini C:\WINDOWS\System32\mvmxdppe.ini Has been deleted! Attempting to delete C:\windows\system32\pgdyxswj.exe C:\windows\system32\pgdyxswj.exe Has been deleted! Attempting to delete C:\windows\system32\tvhtlunc.ini C:\windows\system32\tvhtlunc.ini Has been deleted! Attempting to delete C:\windows\system32\vaysildi.exe C:\windows\system32\vaysildi.exe Has been deleted! Attempting to delete C:\WINDOWS\System32\vtaqulkn.dll C:\WINDOWS\System32\vtaqulkn.dll Has been deleted! Attempting to delete C:\WINDOWS\System32\vtuvurq.dll C:\WINDOWS\System32\vtuvurq.dll Could not be deleted. Performing Repairs to the registry. Done! Beginning removal... Attempting to delete C:\WINDOWS\System32\geede.dll C:\WINDOWS\System32\geede.dll Has been deleted! Attempting to delete C:\windows\system32\msvofipf.exe C:\windows\system32\msvofipf.exe Could not be deleted. Attempting to delete C:\WINDOWS\System32\vtuvurq.dll C:\WINDOWS\System32\vtuvurq.dll Has been deleted! Performing Repairs to the registry. Done! Combofix text file: ComboFix 07-06-18.2 - C:\Documents and Settings\Alex Schwartz\Desktop\ComboFix.exe "Alex Schwartz" - 2007-07-01 13:38:54 - Service Pack 1 NTFS (((((((((((((((((((((((((((((((((((((((((((( V Log ))))))))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\system32\winzdn32.dll * * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\DOCUME~1\ALEXSC~1\APPLIC~1.\.rdr.ini C:\DOCUME~1\ALEXSC~1\APPLIC~1.\WinAntiSpyware 2007 C:\DOCUME~1\ALEXSC~1\APPLIC~1.\WinAntiSpyware 2007\Logs\update.log C:\DOCUME~1\ALLUSE~1\APPLIC~1.\WinAntiSpyware 2007 C:\DOCUME~1\ALLUSE~1\APPLIC~1.\WinAntiSpyware 2007\Data\Abbr C:\DOCUME~1\ALLUSE~1\APPLIC~1.\WinAntiSpyware 2007\Data\ProductCode C:\Program Files\Common Files\smante~1 C:\Program Files\Common Files\smante~1\dllhost.exe C:\Program Files\Common Files\WinAntiSpyware 2007 C:\Program Files\Common Files\WinAntiSpyware 2007\err.log C:\Program Files\Common Files\WinAntiSpyware 2007\uwas7cw.exe C:\Program Files\Common Files\WinAntiSpyware 2007\WAS7Mon.exe C:\Program Files\Common Files\Yazzle1162OinAdmin.exe C:\Program Files\Common Files\Yazzle1716OinAdmin.exe C:\Program Files\Common Files\Yazzle1716OinUninstaller.exe C:\Program Files\fnts~1 C:\Program Files\fnts~1\m?dtc.exe C:\Program Files\Internet Explorer\profsyzyzoz.html C:\Temp\0b9 C:\Temp\0b9\tmpTF.log C:\Temp\tn3 C:\WINDOWS\avp.exe C:\WINDOWS\b122.exe C:\WINDOWS\cs_cache.ini C:\WINDOWS\rau001978.exe C:\WINDOWS\svchost.exe C:\WINDOWS\system32\driver.exe C:\WINDOWS\system32\drivers\core.cache.dsk C:\WINDOWS\system32\drivers\core.sys C:\WINDOWS\system32\rlvknlg.exe C:\WINDOWS\system32\winsys64.exe C:\WINDOWS\system32\wmvds32.dll C:\WINDOWS\Uninst2.htm C:\WINDOWS\Unist1.htm ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) -------\LEGACY_CORE -------\LEGACY_NET_AGENT -------\LEGACY_WINDOWS_OVERLAY_COMPONENTS -------\core -------\Net Agent ((((((((((((((((((((((((( Files Created from 2007-06-01 to 2007-07-01 ))))))))))))))))))))))))))))))) 2007-07-01 13:39 31,254 --a------ C:\WINDOWS\system32\rqrrspm.dll 2007-07-01 13:38 49,152 --a------ C:\WINDOWS\nircmd.exe 2007-07-01 13:28 24,576 --a------ C:\WINDOWS\system32\VundoFixSVC.exe 2007-07-01 13:19 <DIR> d-------- C:\VundoFix Backups 2007-06-30 18:09 28,160 --a------ C:\WINDOWS\system32\sysmon32.exe 2007-06-28 08:43 11,776 --a------ C:\WINDOWS\mgrs.exe 2007-06-28 08:42 56,832 --a------ C:\DOCUME~1\ALLUSE~1\APPLIC~1\wfmlibal.exe 2007-06-28 08:42 4 --a------ C:\WINDOWS\system32\stfv.bin 2007-06-28 08:41 28,928 --a------ C:\WINDOWS\system32\updatetc.exe 2007-06-28 08:41 25,088 --a------ C:\WINDOWS\system32\msdn_lib.dll 2007-06-28 08:41 19,456 --a------ C:\WINDOWS\system32\180ax.exe 2007-06-28 08:41 17,920 --a------ C:\WINDOWS\system32\salm.exe 2007-06-28 08:41 13,312 --a------ C:\WINDOWS\saiemod.dll 2007-06-28 08:41 12 --a------ C:\WINDOWS\system32\gtv_sd.bin 2007-06-28 08:40 <DIR> d-------- C:\WINDOWS\system32\o05PrEz 2007-06-26 22:12 <DIR> d-------- C:\Program Files\Enigma Software Group 2007-06-25 12:47 122,944 --------- C:\WINDOWS\system32\msvofipf.exe 2007-06-24 10:12 89,088 --a------ C:\WINDOWS\system32\atl71.dll 2007-06-24 10:12 79,872 --a------ C:\WINDOWS\system32\drivers\FOPN.sys 2007-06-24 10:12 1,060,864 --a------ C:\WINDOWS\system32\mfc71.dll 2007-06-24 10:12 <DIR> dr------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\SalesMonitor 2007-06-24 10:08 46,592 --a------ C:\WINDOWS\oomoeke.exe 2007-06-24 10:08 <DIR> d-------- C:\WINDOWS\system32\win 2007-06-24 10:08 <DIR> d-------- C:\WINDOWS\system32\o02PrEz 2007-06-24 10:08 <DIR> d-------- C:\WINDOWS\system32\H5 2007-06-24 10:08 <DIR> d-------- C:\WINDOWS\system32\H4 2007-06-24 10:08 <DIR> d-------- C:\WINDOWS\system32\H3 2007-06-24 10:08 <DIR> d-------- C:\WINDOWS\system32\H2 2007-06-24 10:08 <DIR> d-------- C:\WINDOWS\system32\H1 2007-06-24 10:08 <DIR> d-------- C:\Temp\iee 2007-06-24 10:08 <DIR> d-------- C:\Temp 2007-06-20 23:37 <DIR> d-------- C:\Program Files\iTunes 2007-06-20 23:37 <DIR> d-------- C:\Program Files\iPod 2007-06-20 23:34 <DIR> d-------- C:\Program Files\Apple Software Update 2007-06-15 14:43 53,248 --a------ C:\WINDOWS\uni_eh43.exe 2007-06-15 14:42 53,248 --a------ C:\WINDOWS\uninst1014.exe (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-06-29 12:12:47 -------- d-----w C:\Program Files\Windows NT 2007-06-22 03:00:32 -------- d--h--w C:\Program Files\InstallShield Installation Information 2007-06-21 04:36:38 -------- d-----w C:\Program Files\QuickTime 2007-06-18 16:46:20 9,417 ----a-w C:\WINDOWS\mozver.dat 2007-06-18 16:46:18 -------- d-----w C:\Program Files\DivX 2007-06-03 22:40:46 -------- d-----w C:\DOCUME~1\ALEXSC~1\APPLIC~1\BitTorrent 2007-05-03 01:56:55 -------- d-----w C:\DOCUME~1\ALEXSC~1\APPLIC~1\MusicIP 2007-05-03 01:56:23 -------- d-----w C:\Program Files\Winamp 2007-04-23 00:15:18 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll 2007-04-23 00:15:18 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll 2007-04-17 03:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll 2007-04-17 03:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll 2007-04-17 03:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll 2007-04-17 03:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll 2007-04-17 03:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll 2007-04-17 03:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll 2007-04-17 03:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe 2007-04-17 03:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx [2001-04-16 17:39] {19D3A5DB-A5A3-4F95-9713-833AE4B950A4}=C:\WINDOWS\System32\msdn_lib.dll [2007-06-28 08:41] {27218055-DEB8-4768-8991-30B5E14EB704}=C:\Program Files\Windows NT\hokerof43855.dll [2007-06-14 06:54] {43CBE820-B564-4B5A-BD5E-F365C19E445C}=C:\WINDOWS\System32\rqrrspm.dll [2007-07-01 13:39] {53707962-6F74-2D53-2644-206D7942484F}=C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2004-05-12 02:03] {B7143108-4CC4-40F2-A7F0-4172F493BEB6}=C:\WINDOWS\System32\geede.dll [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Cmaudio"="cmicnfg.cpl" [] "nwiz"="nwiz.exe" [] "07rO3pP"="ddeput.exe" [] "HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [2003-06-25 12:24] "HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-10-23 20:51] "Device Detector"="C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe" [2004-09-02 16:51] "IPHSend"="C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe" [2006-02-17 11:59] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-06-01 16:51] "wfmlibal.exe"="C:\Documents and Settings\All Users\Application Data\wfmlibal.exe" [2007-06-28 08:42] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Arun"="C:\PROGRA~1\COMMON~1\SMANTE~1\dllhost.exe" [] [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0] Source= C:\Program Files\Internet Explorer\profsyzyzoz.html FriendlyName= [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{43CBE820-B564-4B5A-BD5E-F365C19E445C}"="C:\WINDOWS\System32\rqrrspm.dll" [2007-07-01 13:39] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\rqrrspm] rqrrspm.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "Alerter"=3 (0x3) "TrkWks"=2 (0x2) "MSDTC"=3 (0x3) "ClipSrv"=3 (0x3) Contents of the 'Scheduled Tasks' folder 2007-06-21 04:34:53 C:\WINDOWS\tasks\AppleSoftwareUpdate.job Hijack This log: Logfile of HijackThis v1.99.1 Scan saved at 1:37:50 PM, on 07/01/2007 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\msvofipf.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\WINDOWS\System32\RunDll32.exe C:\WINDOWS\System32\RUNDLL32.EXE C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Documents and Settings\All Users\Application Data\wfmlibal.exe C:\WINDOWS\mgrs.exe C:\WINDOWS\avp.exe C:\PROGRA~1\COMMON~1\SMANTE~1\dllhost.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\Palm\Hotsync.exe C:\Program Files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe C:\Program Files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe C:\WINDOWS\System32\devldr32.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Documents and Settings\Alex Schwartz\Desktop\Jack This.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cus.../*http://www.yahoo.com/ext/search/search.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://hsremove.com/done.htm R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ie/defaults/su/ymsgr6/*http://www.yahoo.com R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = sas.r21.mchsi.com:8000 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.r21.mchsi.com;<local> O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: msdn_lib.msdn_hlp - {19D3A5DB-A5A3-4F95-9713-833AE4B950A4} - C:\WINDOWS\System32\msdn_lib.dll O2 - BHO: (no name) - {27218055-DEB8-4768-8991-30B5E14EB704} - C:\Program Files\Windows NT\hokerof43855.dll O2 - BHO: (no name) - {3D1A1CA3-8C1D-F9BC-4F17-FE8DBA558FC6} - (no file) O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: (no name) - {5dafd089-24b1-4c5e-bd42-8ca72550717b} - (no file) O2 - BHO: (no name) - {8674aea0-9d3d-11d9-99dc-00600f9a01f1} - (no file) O2 - BHO: (no name) - {B7143108-4CC4-40F2-A7F0-4172F493BEB6} - C:\WINDOWS\System32\geede.dll (file missing) O2 - BHO: (no name) - {B9F42C34-70E2-40D3-A961-D20DAFA10250} - (no file) O2 - BHO: (no name) - {cf021f40-3e14-23a5-cba2-717765728274} - (no file) O2 - BHO: (no name) - {D73ABC8D-4B3C-455E-A15B-C72071952A45} - (no file) O2 - BHO: (no name) - {E05A5316-C580-4957-9F45-980369D9AE83} - (no file) O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [07rO3pP] ddeput.exe O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe O4 - HKLM\..\Run: [Device Detector] "C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe" -autorun O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [wfmlibal.exe] C:\Documents and Settings\All Users\Application Data\wfmlibal.exe O4 - HKLM\..\Run: [smgr] mgrs.exe O4 - HKLM\..\Run: [avp] C:\WINDOWS\avp.exe O4 - HKCU\..\Run: [Arun] "C:\PROGRA~1\COMMON~1\SMANTE~1\dllhost.exe" -vt yazb O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Program Files\Palm\Hotsync.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer Wrapper) - http://chat.yahoo.com/cab/yvwrctl.cab O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab O20 - Winlogon Notify: RelevantKnowledge - C:\WINDOWS\System32\rlls.dll (file missing) O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\ O20 - Winlogon Notify: winzdn32 - C:\WINDOWS\SYSTEM32\winzdn32.dll O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing) O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: DomainService - - C:\WINDOWS\System32\msvofipf.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Net Agent - Unknown owner - C:\WINDOWS\dls0523pmw.exe (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Panda Process Protection Service (PavPrSrv) - Unknown owner - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe (file missing) O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
Hi I can't see any evidence of anti-virus or firewall software. Anti-virus software are programs that detect, cleanse, and erase harmful virus files on a computer, Web server, or network. Please download a free anti-virus software: Antivir Avast Firewalls protect against hackers and malicious intruders. Please download a free firewall: ZoneAlarm Comodo post: fresh HiJackThis log
Here's my newest log from Hijack This. Logfile of HijackThis v1.99.1 Scan saved at 12:59:19 AM, on 07/07/2007 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Comodo\Firewall\cmdagent.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\WINDOWS\System32\RunDll32.exe C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Documents and Settings\All Users\Application Data\wfmlibal.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\Comodo\Firewall\CPF.exe C:\Program Files\Palm\Hotsync.exe C:\Program Files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\WINDOWS\System32\devldr32.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Alex Schwartz\Desktop\Jack This.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ie/defaults/su/ymsgr6/*http://www.yahoo.com R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = sas.r21.mchsi.com:8000 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.r21.mchsi.com;<local> O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {06DA67B8-A8F6-46D1-A1A3-D6AF5A3A6EC2} - C:\WINDOWS\System32\awtss.dll O2 - BHO: (no name) - {1F6581D5-AA53-4b73-A6F9-41420C6B61F1} - C:\WINDOWS\System32\wivoxwoh.dll O2 - BHO: (no name) - {3D1A1CA3-8C1D-F9BC-4F17-FE8DBA558FC6} - (no file) O2 - BHO: (no name) - {43CBE820-B564-4B5A-BD5E-F365C19E445C} - C:\WINDOWS\System32\rqrrspm.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: (no name) - {5dafd089-24b1-4c5e-bd42-8ca72550717b} - (no file) O2 - BHO: (no name) - {8674aea0-9d3d-11d9-99dc-00600f9a01f1} - (no file) O2 - BHO: (no name) - {B7143108-4CC4-40F2-A7F0-4172F493BEB6} - C:\WINDOWS\System32\geede.dll (file missing) O2 - BHO: (no name) - {B9F42C34-70E2-40D3-A961-D20DAFA10250} - (no file) O2 - BHO: (no name) - {cf021f40-3e14-23a5-cba2-717765728274} - (no file) O2 - BHO: (no name) - {D73ABC8D-4B3C-455E-A15B-C72071952A45} - (no file) O2 - BHO: (no name) - {E05A5316-C580-4957-9F45-980369D9AE83} - (no file) O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [07rO3pP] ddeput.exe O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [Device Detector] "C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe" -autorun O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [wfmlibal.exe] C:\Documents and Settings\All Users\Application Data\wfmlibal.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [icq.com] rundll32.exe "C:\WINDOWS\System32\lglwvxtf.dll",forkonce O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background O4 - HKCU\..\Run: [Arun] "C:\PROGRA~1\COMMON~1\SMANTE~1\dllhost.exe" -vt yazb O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Program Files\Palm\Hotsync.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer Wrapper) - http://chat.yahoo.com/cab/yvwrctl.cab O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab O20 - Winlogon Notify: awtss - C:\WINDOWS\System32\awtss.dll O20 - Winlogon Notify: rqrrspm - C:\WINDOWS\SYSTEM32\rqrrspm.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\ O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing) O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Panda Process Protection Service (PavPrSrv) - Unknown owner - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe (file missing) O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
Hi AceDay open HiJackThis clic "do a system scan only" Check the following entries (if still present) : R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customiz...//www.yahoo.com O2 - BHO: (no name) - {06DA67B8-A8F6-46D1-A1A3-D6AF5A3A6EC2} - C:\WINDOWS\System32\awtss.dll O2 - BHO: (no name) - {1F6581D5-AA53-4b73-A6F9-41420C6B61F1} - C:\WINDOWS\System32\wivoxwoh.dll O2 - BHO: (no name) - {3D1A1CA3-8C1D-F9BC-4F17-FE8DBA558FC6} - (no file) O2 - BHO: (no name) - {43CBE820-B564-4B5A-BD5E-F365C19E445C} - C:\WINDOWS\System32\rqrrspm.dll O2 - BHO: (no name) - {5dafd089-24b1-4c5e-bd42-8ca72550717b} - (no file) O2 - BHO: (no name) - {8674aea0-9d3d-11d9-99dc-00600f9a01f1} - (no file) O2 - BHO: (no name) - {B7143108-4CC4-40F2-A7F0-4172F493BEB6} - C:\WINDOWS\System32\geede.dll (file missing) O2 - BHO: (no name) - {B9F42C34-70E2-40D3-A961-D20DAFA10250} - (no file) O2 - BHO: (no name) - {cf021f40-3e14-23a5-cba2-717765728274} - (no file) O2 - BHO: (no name) - {D73ABC8D-4B3C-455E-A15B-C72071952A45} - (no file) O2 - BHO: (no name) - {E05A5316-C580-4957-9F45-980369D9AE83} - (no file) O4 - HKLM\..\Run: [07rO3pP] ddeput.exe O4 - HKLM\..\Run: [wfmlibal.exe] C:\Documents and Settings\All Users\Application Data\wfmlibal.exe O4 - HKLM\..\Run: [icq.com] rundll32.exe "C:\WINDOWS\System32\lglwvxtf.dll",forkonce O20 - Winlogon Notify: awtss - C:\WINDOWS\System32\awtss.dll O20 - Winlogon Notify: rqrrspm - C:\WINDOWS\SYSTEM32\rqrrspm.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\ clic "fix checked" ------------------------------------------------------------------- Please Open notepad and copy/paste the text in the quotebox below into it: Save this as ComboFix-Do.txt Then drag the ComboFix-Do.txt into ComboFix.exe as you see in the screenshot below. This will start ComboFix again. After reboot (in case it asks to reboot) --------------------------------------------------------------------------------- please download ATF Cleaner by Atribune. Double-click ATF-Cleaner.exe to run the program. Under Main choose: Select All Click the Empty Selected button. If you use Firefox browser Click Firefox at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click No at the prompt. If you use Opera browser Click Opera at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click No at the prompt. Click Exit on the Main menu to close the program. For Technical Support, double-click the e-mail address located at the bottom of each menu. This will remove all files from the items that are checked so if you have some cookies you'd like to save. please move them to a different directory first. ------------------------------------------------------------------------------------ Please download AVG Anti-Spyware to your Desktop or to your usual Download Folder. * Install AVG Anti-Spyware by double clicking the installer. * Follow the prompts. Make sure that Launch AVG Anti-Spyware is checked. * On the main screen under Your Computer's security. * Click on Change state next to Resident shield. It should now change to inactive. * Click on Change state next to Automatic updates. It should now change to inactive. * Next to Last Update, click on Update now. (You will need an active internet connection to perform this) * Wait until you see the Update succesfull message. * Right-click the AVG Anti-Spyware Tray Icon and uncheck Start with Windows. * Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes. If you are having problems with the updater, you can use this link to manually update ewido. AVG Anti-Spyware manual updates. Download the Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that AVG Anti-Spyware is closed before installing the update. -------------------------------------------------------------------- Reboot your computer in Safe Mode. * If the computer is running, shut down Windows, and then turn off the power. * Wait 30 seconds, and then turn the computer on. * Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again. * Ensure that the Safe Mode option is selected. * Press Enter. The computer then begins to start in Safe mode. * Login on your usual account. --------------------------------------------------------------------- Now we need to do a search. Start > Search > For Files and Folders Expand Search Options, check Advanced Options, check Search system folders, Search hidden files and folders, and Search Subfolders. Paste this into the Search for files and folders named box: ddeput.exe If any of these files are found please delete them. --------------------------------------------------------------------------------- Close ALL open Windows / Programs / Folders. Please start AVG Anti-Spyware and run a full scan. * Click on Scanner on the toolbar. * Click on the Settings tab. * Under How to act? * Click on Recommended Action and choose Quarantine from the popup menu. * Under How to scan? * All checkboxes should be ticked. * Under Possibly unwanted software: * All checkboxes should be ticked. * Under Reports: * Select Automatically generate report after every scan and uncheck Only if threats were found. * Under What to scan? * Select Scan every file. * Click on the Scan tab. * Click on Complete System Scan to start the scan process. * Let the program scan the machine. * When the scan has finished, follow the instructions below. IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button. * Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2) *At the bottom of the window click on the Apply all Actions button. (3) * When done, click the Save Scan Report button. (4) *Click the Save Report as button. * Save the report to your Desktop. * Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes. Reboot back into Normal Mode ---------------------------------------------------------------- post: C:\combofix.txt AVG anti-spyware log fresh HiJackThis log
Here's my latest logs and here's hoping I'm near the end. I didn't think the AVG log was gonna be so large. I appreciate your help hilu. Hijack This log: Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Comodo\Firewall\cmdagent.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\WINDOWS\System32\RunDll32.exe C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Documents and Settings\All Users\Application Data\wfmlibal.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\Comodo\Firewall\CPF.exe C:\Program Files\Palm\Hotsync.exe C:\Program Files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\WINDOWS\System32\devldr32.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Alex Schwartz\Desktop\Jack This.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ie/defaults/su/ymsgr6/*http://www.yahoo.com R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = sas.r21.mchsi.com:8000 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.r21.mchsi.com;<local> O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {06DA67B8-A8F6-46D1-A1A3-D6AF5A3A6EC2} - C:\WINDOWS\System32\awtss.dll O2 - BHO: (no name) - {1F6581D5-AA53-4b73-A6F9-41420C6B61F1} - C:\WINDOWS\System32\wivoxwoh.dll O2 - BHO: (no name) - {3D1A1CA3-8C1D-F9BC-4F17-FE8DBA558FC6} - (no file) O2 - BHO: (no name) - {43CBE820-B564-4B5A-BD5E-F365C19E445C} - C:\WINDOWS\System32\rqrrspm.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: (no name) - {5dafd089-24b1-4c5e-bd42-8ca72550717b} - (no file) O2 - BHO: (no name) - {8674aea0-9d3d-11d9-99dc-00600f9a01f1} - (no file) O2 - BHO: (no name) - {B7143108-4CC4-40F2-A7F0-4172F493BEB6} - C:\WINDOWS\System32\geede.dll (file missing) O2 - BHO: (no name) - {B9F42C34-70E2-40D3-A961-D20DAFA10250} - (no file) O2 - BHO: (no name) - {cf021f40-3e14-23a5-cba2-717765728274} - (no file) O2 - BHO: (no name) - {D73ABC8D-4B3C-455E-A15B-C72071952A45} - (no file) O2 - BHO: (no name) - {E05A5316-C580-4957-9F45-980369D9AE83} - (no file) O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [07rO3pP] ddeput.exe O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [Device Detector] "C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe" -autorun O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [wfmlibal.exe] C:\Documents and Settings\All Users\Application Data\wfmlibal.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [icq.com] rundll32.exe "C:\WINDOWS\System32\lglwvxtf.dll",forkonce O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background O4 - HKCU\..\Run: [Arun] "C:\PROGRA~1\COMMON~1\SMANTE~1\dllhost.exe" -vt yazb O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Program Files\Palm\Hotsync.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer Wrapper) - http://chat.yahoo.com/cab/yvwrctl.cab O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab O20 - Winlogon Notify: awtss - C:\WINDOWS\System32\awtss.dll O20 - Winlogon Notify: rqrrspm - C:\WINDOWS\SYSTEM32\rqrrspm.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\ O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing) O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Panda Process Protection Service (PavPrSrv) - Unknown owner - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe (file missing) O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe Combofix: 2007-07-11 14:16 <DIR> d-------- C:\Program Files\Error Expert 2007-07-10 20:23 <DIR> d-------- C:\Program Files\Lionhead Studios 2007-07-10 07:35 31,254 --a------ C:\WINDOWS\system32\rqrqnnm.dll 2007-07-10 07:17 31,254 --a------ C:\WINDOWS\system32\nnnnono.dll 2007-07-10 07:16 <DIR> d-------- C:\WINDOWS\system32\o09PrEz 2007-07-10 07:16 <DIR> d-------- C:\Program Files\svhost 2007-07-10 07:12 36,352 --a------ C:\WINDOWS\poolsv.exe 2007-07-09 09:59 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2007-07-08 23:17 60,928 --------- C:\WINDOWS\system32\rivk.dll 2007-07-08 23:17 <DIR> d--hs---- C:\WINDOWS\QWxleCBTY2h3YXJ0eg 2007-07-08 23:17 <DIR> d-------- C:\Program Files\WinPop 2007-07-08 23:14 172,032 --a------ C:\WINDOWS\system32\launvxy.dll 2007-07-08 23:13 <DIR> d-------- C:\WINDOWS\system32\X9 2007-07-08 23:13 <DIR> d-------- C:\WINDOWS\system32\X5 2007-07-08 23:13 <DIR> d-------- C:\WINDOWS\system32\X4 2007-07-08 23:13 <DIR> d-------- C:\WINDOWS\system32\X3 2007-07-08 23:13 <DIR> d-------- C:\WINDOWS\system32\X2 2007-07-05 22:56 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Comodo 2007-07-05 22:56 <DIR> d-------- C:\DOCUME~1\ALEXSC~1\APPLIC~1\Comodo 2007-07-05 22:49 <DIR> d-------- C:\Program Files\Comodo 2007-07-05 22:45 95,872 --a------ C:\WINDOWS\system32\AvastSS.scr 2007-07-05 22:45 94,552 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2007-07-05 22:45 85,952 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2007-07-05 22:45 745,600 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-07-05 22:45 43,176 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2007-07-05 22:45 26,888 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-07-05 22:45 23,416 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2007-07-05 22:45 <DIR> d-------- C:\Program Files\Alwil Software 2007-07-05 20:19 135,168 --a------ C:\WINDOWS\tk58.exe 2007-07-01 13:38 49,152 --a------ C:\WINDOWS\nircmd.exe 2007-07-01 13:19 <DIR> d-------- C:\VundoFix Backups 2007-06-30 18:09 28,160 --a------ C:\WINDOWS\system32\sysmon32.exe 2007-06-28 08:43 11,776 --a------ C:\WINDOWS\mgrs.exe 2007-06-28 08:42 56,832 --a------ C:\DOCUME~1\ALLUSE~1\APPLIC~1\wfmlibal.exe 2007-06-28 08:42 4 --a------ C:\WINDOWS\system32\stfv.bin 2007-06-28 08:41 28,928 --a------ C:\WINDOWS\system32\updatetc.exe 2007-06-28 08:41 19,456 --a------ C:\WINDOWS\system32\180ax.exe 2007-06-28 08:41 17,920 --a------ C:\WINDOWS\system32\salm.exe 2007-06-28 08:41 13,312 --a------ C:\WINDOWS\saiemod.dll 2007-06-28 08:41 12 --a------ C:\WINDOWS\system32\gtv_sd.bin 2007-06-28 08:40 <DIR> d-------- C:\WINDOWS\system32\o05PrEz 2007-06-26 22:12 <DIR> d-------- C:\Program Files\Enigma Software Group 2007-06-24 10:12 89,088 --a------ C:\WINDOWS\system32\atl71.dll 2007-06-24 10:12 79,872 --a------ C:\WINDOWS\system32\drivers\FOPN.sys 2007-06-24 10:12 1,060,864 --a------ C:\WINDOWS\system32\mfc71.dll 2007-06-24 10:12 <DIR> dr------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\SalesMonitor 2007-06-24 10:08 46,592 --a------ C:\WINDOWS\oomoeke.exe 2007-06-24 10:08 <DIR> d-------- C:\WINDOWS\system32\win 2007-06-24 10:08 <DIR> d-------- C:\WINDOWS\system32\o02PrEz 2007-06-24 10:08 <DIR> d-------- C:\WINDOWS\system32\H5 2007-06-24 10:08 <DIR> d-------- C:\WINDOWS\system32\H4 2007-06-24 10:08 <DIR> d-------- C:\WINDOWS\system32\H3 2007-06-24 10:08 <DIR> d-------- C:\WINDOWS\system32\H2 2007-06-24 10:08 <DIR> d-------- C:\WINDOWS\system32\H1 2007-06-24 10:08 <DIR> d-------- C:\Temp\iee 2007-06-24 10:08 <DIR> d-------- C:\Temp 2007-06-20 23:37 <DIR> d-------- C:\Program Files\iTunes 2007-06-20 23:37 <DIR> d-------- C:\Program Files\iPod 2007-06-20 23:34 <DIR> d-------- C:\Program Files\Apple Software Update 2007-06-15 14:43 53,248 --a------ C:\WINDOWS\uni_eh43.exe 2007-06-15 14:42 53,248 --a------ C:\WINDOWS\uninst1014.exe (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-07-11 18:42:13 -------- d--h--w C:\Program Files\InstallShield Installation Information 2007-07-11 04:51:59 -------- d-----w C:\Program Files\D-Tools 2007-07-11 01:46:21 163,644 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2007-07-11 00:59:08 -------- d-----w C:\Program Files\Google 2007-07-09 12:36:40 -------- d-----w C:\DOCUME~1\ALEXSC~1\APPLIC~1\BitTorrent 2007-07-09 04:23:05 -------- d-----w C:\Program Files\Windows NT 2007-06-21 04:36:38 -------- d-----w C:\Program Files\QuickTime 2007-06-18 16:46:20 9,417 ----a-w C:\WINDOWS\mozver.dat 2007-06-18 16:46:18 -------- d-----w C:\Program Files\DivX 2007-04-23 00:15:18 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll 2007-04-23 00:15:18 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll 2007-04-17 03:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll 2007-04-17 03:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll 2007-04-17 03:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll 2007-04-17 03:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll 2007-04-17 03:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll 2007-04-17 03:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll 2007-04-17 03:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe 2007-04-17 03:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll 2005-07-29 21:24:26 472 --sha-r C:\WINDOWS\QWxleCBTY2h3YXJ0eg\kqU5yF1nsZ1asrLXy0.vbs ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx [2001-04-16 17:39] {53707962-6F74-2D53-2644-206D7942484F}=C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2004-05-12 02:03] {cdc41c99-8bed-46bc-97b6-9ec228afe395}=C:\WINDOWS\System32\launvxy.dll [2007-07-08 23:14] {F1D18367-ED25-4A59-9881-8897EE3736C9}=C:\WINDOWS\System32\awtss.dll [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Cmaudio"="cmicnfg.cpl" [] "nwiz"="nwiz.exe" [] "HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [2003-06-25 12:24] "HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-10-23 20:51] "Device Detector"="C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe" [2004-09-02 16:51] "IPHSend"="C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe" [2006-02-17 11:59] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-06-01 16:51] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-04-30 10:42] "COMODO Firewall Pro"="C:\Program Files\Comodo\Firewall\CPF.exe" [2007-07-05 22:49] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 04:25] "Salestart"="C:\Program Files\Common Files\WinAntiSpyware 2007\WAS7Mon.exe" [] "DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2003-12-27 21:43] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "WinPop"="C:\Program Files\WinPop\winpop.exe" [2007-07-08 23:17] [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0] Source= C:\Program Files\Internet Explorer\profsyzyzoz.html FriendlyName= [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" [2007-05-30 07:29] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Driver] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Guard] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "Alerter"=3 (0x3) "TrkWks"=2 (0x2) "MSDTC"=3 (0x3) "ClipSrv"=3 (0x3) Contents of the 'Scheduled Tasks' folder 2007-07-10 22:18:01 C:\WINDOWS\tasks\AppleSoftwareUpdate.job
I looked at my AVG log and cut out all the tracking cookies. If you think you need them give me an email and I'll send them your way. Everything else should be there from the log HKLM\SOFTWARE\SecureWin -> Adware.Adlogix : Cleaned with backup (quarantined). C:\System Volume Information\_restore{639BACFA-FDBF-4193-99DD-0AE02BFFB2A3}\RP514\A0069547.exe -> Adware.Adstart : Cleaned with backup (quarantined). C:\System Volume Information\_restore{639BACFA-FDBF-4193-99DD-0AE02BFFB2A3}\RP514\A0069548.exe -> Adware.Adstart : Cleaned with backup (quarantined). C:\System Volume Information\_restore{639BACFA-FDBF-4193-99DD-0AE02BFFB2A3}\RP514\A0069549.exe -> Adware.Adstart : Cleaned with backup (quarantined). C:\System Volume Information\_restore{639BACFA-FDBF-4193-99DD-0AE02BFFB2A3}\RP517\A0070640.dll -> Adware.Adstart : Cleaned with backup (quarantined). C:\WINDOWS\system32\X5\wb73.exe -> Adware.Agent : Cleaned with backup (quarantined). C:\System Volume Information\_restore{639BACFA-FDBF-4193-99DD-0AE02BFFB2A3}\RP514\A0069550.exe -> Adware.Apropos : Cleaned with backup (quarantined). C:\WINDOWS\QWxleCBTY2h3YXJ0eg\trzE4.tmp -> Adware.CommAd : Cleaned with backup (quarantined). C:\System Volume Information\_restore{639BACFA-FDBF-4193-99DD-0AE02BFFB2A3}\RP514\A0069511.exe -> Adware.EZula : Cleaned with backup (quarantined). HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} -> Adware.Generic : Cleaned with backup (quarantined). HKU\S-1-5-21-2506784691-2463499124-1038605604-1005\Software\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} -> Adware.Generic : Cleaned with backup (quarantined). C:\System Volume Information\_restore{639BACFA-FDBF-4193-99DD-0AE02BFFB2A3}\RP514\A0069535.exe -> Adware.MegaSearch : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\Program Files\FNTS~1\mѕdtc.exe.vir -> Adware.PurityScan : Cleaned with backup (quarantined). C:\Program Files\WinPop\winpop.exe -> Adware.Rond : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\WINDOWS\b122.exe.vir -> Adware.Softomate : Cleaned with backup (quarantined). C:\System Volume Information\_restore{00CEB201-41C7-4C22-B6ED-8D7CFAD330E0}\RP383\A0055206.exe -> Adware.Softomate : Cleaned with backup (quarantined). C:\System Volume Information\_restore{639BACFA-FDBF-4193-99DD-0AE02BFFB2A3}\RP514\A0069487.exe -> Adware.SurfAccuracy : Cleaned with backup (quarantined). C:\WINDOWS\system32\H4\mwspasrt83122.exe -> Adware.TTC : Cleaned with backup (quarantined). C:\WINDOWS\system32\X2\mwspasrt83122.exe -> Adware.TTC : Cleaned with backup (quarantined). C:\VundoFix Backups\awtuvtr.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined). C:\VundoFix Backups\efccyaa.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined). C:\VundoFix Backups\gebbaya.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined). C:\VundoFix Backups\ljjkllk.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined). C:\VundoFix Backups\vtuvurq.dll.bad -> Adware.Virtumonde : Cleaned with backup (quarantined). C:\WINDOWS\tk58.exe -> Adware.ZQuest : Cleaned with backup (quarantined). C:\WINDOWS\system32\H3\wr620.exe -> Downloader.Agent.bls : Cleaned with backup (quarantined). C:\WINDOWS\trzE5.tmp -> Downloader.Agent.bls : Cleaned with backup (quarantined). C:\WINDOWS\trzE6.tmp -> Downloader.Agent.bls : Cleaned with backup (quarantined). C:\WINDOWS\mgrs.exe -> Downloader.Alphabet : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\WINDOWS\system32\driver.exe.vir -> Downloader.Alphabet.c : Cleaned with backup (quarantined). C:\WINDOWS\system32\sysmon32.exe -> Downloader.Alphabet.c : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\WINDOWS\avp.exe.vir -> Downloader.Alphabet.f : Cleaned with backup (quarantined). C:\System Volume Information\_restore{639BACFA-FDBF-4193-99DD-0AE02BFFB2A3}\RP514\A0069496.exe -> Downloader.Dyfuca.ey : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\Program Files\Common Files\Yazzle1162OinAdmin.exe.vir -> Downloader.PurityScan.eg : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\Program Files\Common Files\Yazzle1281OinAdmin.exe.vir -> Downloader.PurityScan.eg : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\Program Files\Common Files\Yazzle1716OinAdmin.exe.vir -> Downloader.PurityScan.eg : Cleaned with backup (quarantined). C:\System Volume Information\_restore{00CEB201-41C7-4C22-B6ED-8D7CFAD330E0}\RP383\A0055195.exe -> Downloader.PurityScan.eg : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\Program Files\Common Files\Yazzle1122OinAdmin.exe.vir -> Downloader.PurityScan.eh : Cleaned with backup (quarantined). C:\System Volume Information\_restore{00CEB201-41C7-4C22-B6ED-8D7CFAD330E0}\RP383\A0055193.exe -> Downloader.PurityScan.eh : Cleaned with backup (quarantined). C:\WINDOWS\b128.exe -> Downloader.PurityScan.eh : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\WINDOWS\svhost.exe.vir -> Downloader.Small : Cleaned with backup (quarantined). C:\System Volume Information\_restore{00CEB201-41C7-4C22-B6ED-8D7CFAD330E0}\RP383\A0055204.exe -> Downloader.Small : Cleaned with backup (quarantined). C:\WINDOWS\b104.exe -> Downloader.Small.buy : Cleaned with backup (quarantined). C:\WINDOWS\system32\X3\w73r.exe -> Downloader.Small.eqn : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\WINDOWS\system32\wmvds32.dll.vir -> Downloader.VB.asx : Cleaned with backup (quarantined). C:\WINDOWS\system32\o02PrEz\o02PrEz1065.exe -> Downloader.VB.awj : Cleaned with backup (quarantined). C:\WINDOWS\system32\o09PrEz\o09PrEz1099.exe -> Downloader.VB.awj : Cleaned with backup (quarantined). C:\WINDOWS\poolsv.exe -> Downloader.VB.aya : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\WINDOWS\b136.exe.vir -> Dropper.Agent.bfr : Cleaned with backup (quarantined). C:\System Volume Information\_restore{00CEB201-41C7-4C22-B6ED-8D7CFAD330E0}\RP383\A0055208.exe -> Dropper.Agent.bfr : Cleaned with backup (quarantined). C:\WINDOWS\system32\H2\wen2.exe -> Dropper.Agent.bfr : Cleaned with backup (quarantined). C:\WINDOWS\system32\X4\wen22.exe -> Dropper.Agent.bfr : Cleaned with backup (quarantined). C:\WINDOWS\oomoeke.exe -> Dropper.Agent.mu : Cleaned with backup (quarantined). C:\WINDOWS\system32\H5\bk53.exe -> Dropper.Agent.mu : Cleaned with backup (quarantined). C:\Documents and Settings\All Users\Application Data\wfmlibal.exe -> Hijacker.Agent.ka : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\WINDOWS\svchost.exe.vir -> Logger.Agent.or : Cleaned with backup (quarantined). C:\WINDOWS\Downloaded Program Files\UWA7P_0001_N91M0809NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.o : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\Program Files\Common Files\WinAntiSpyware 2007\WAS7Mon.exe.vir -> Not-A-Virus.Downloader.Win32.WinFixer.x : Cleaned with backup (quarantined). C:\System Volume Information\_restore{00CEB201-41C7-4C22-B6ED-8D7CFAD330E0}\RP383\A0055203.exe -> Not-A-Virus.Downloader.Win32.WinFixer.x : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\Program Files\Network Monitor\trzE0.tmp.vir -> Not-A-Virus.Monitor.Win32.NetMon.a : Cleaned with backup (quarantined). C:\WINDOWS\system32\Tools\Restart.exe -> Not-A-Virus.Tool.Win32.RestartCounter : Cleaned with backup (quarantined). C:\QooBox\Quarantine\catchme2007-07-01_134447.54.zip/core.sys -> Rootkit.Agent.eq : Cleaned with backup (quarantined). C:\QooBox\Quarantine\catchme2007-07-11_150620.75.zip/core.sys -> Rootkit.Agent.eq : Cleaned with backup (quarantined). C:\VundoFix Backups\fwkplyem.exe.bad -> Trojan.Agent.anr : Cleaned with backup (quarantined). C:\VundoFix Backups\bmfhmgxa.exe.bad -> Trojan.Agent.aoy : Cleaned with backup (quarantined). C:\VundoFix Backups\boesfwcl.exe.bad -> Trojan.Agent.aoy : Cleaned with backup (quarantined). C:\VundoFix Backups\chgeawdd.exe.bad -> Trojan.Agent.aoy : Cleaned with backup (quarantined). C:\VundoFix Backups\ckyupygt.exe.bad -> Trojan.Agent.aoy : Cleaned with backup (quarantined). C:\VundoFix Backups\doiycbfb.exe.bad -> Trojan.Agent.aoy : Cleaned with backup (quarantined). C:\VundoFix Backups\msvofipf.exe.bad -> Trojan.Agent.aoy : Cleaned with backup (quarantined). C:\VundoFix Backups\pgdyxswj.exe.bad -> Trojan.Agent.aoy : Cleaned with backup (quarantined). C:\VundoFix Backups\qcnapsmx.exe.bad -> Trojan.Agent.aoy : Cleaned with backup (quarantined). C:\VundoFix Backups\vaysildi.exe.bad -> Trojan.Agent.aoy : Cleaned with backup (quarantined). C:\VundoFix Backups\yeaeqmfa.exe.bad -> Trojan.Agent.aoy : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\WINDOWS\system32\winzdn32.dll.vir -> Trojan.Agent.qt : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\Program Files\Common Files\WinAntiSpyware 2007\uwas7cw.exe.vir -> Trojan.Fakealert.fb : Cleaned with backup (quarantined). C:\System Volume Information\_restore{00CEB201-41C7-4C22-B6ED-8D7CFAD330E0}\RP383\A0055202.exe -> Trojan.Fakealert.fb : Cleaned with backup (quarantined). C:\QooBox\Quarantine\C\WINDOWS\uninstall_nmon.vbs.vir -> Trojan.Small : Cleaned with backup (quarantined). C:\System Volume Information\_restore{00CEB201-41C7-4C22-B6ED-8D7CFAD330E0}\RP383\A0055199.vbs -> Trojan.Small : Cleaned with backup (quarantined). C:\WINDOWS\QWxleCBTY2h3YXJ0eg\kqU5yF1nsZ1asrLXy0.vbs -> Trojan.Small : Cleaned with backup (quarantined). C:\Program Files\WinPop\UnInstall.exe -> Trojan.Small.oa : Cleaned with backup (quarantined).
Hi That didn't work at all. Did you run ComboFix exactly as instructed above (it's not enough just doubleclick it)?
Yes, I ran Combfix as you said and so far my pc is running better than it has in a while. I wasn't even able to defrag my pc. Now it works just fine.
Hi ok 1. Click Start Go to Control Panel Go to Add/Remove Programs Find and click Remove for the following (if present): WinPop 2. open HiJackThis clic "do a system scan only" Check the following entries (if still present) : O2 - BHO: (no name) - {06DA67B8-A8F6-46D1-A1A3-D6AF5A3A6EC2} - C:\WINDOWS\System32\awtss.dll O2 - BHO: (no name) - {1F6581D5-AA53-4b73-A6F9-41420C6B61F1} - C:\WINDOWS\System32\wivoxwoh.dll O2 - BHO: (no name) - {3D1A1CA3-8C1D-F9BC-4F17-FE8DBA558FC6} - (no file) O2 - BHO: (no name) - {43CBE820-B564-4B5A-BD5E-F365C19E445C} - C:\WINDOWS\System32\rqrrspm.dll O2 - BHO: (no name) - {5dafd089-24b1-4c5e-bd42-8ca72550717b} - (no file) O2 - BHO: (no name) - {8674aea0-9d3d-11d9-99dc-00600f9a01f1} - (no file) O2 - BHO: (no name) - {B7143108-4CC4-40F2-A7F0-4172F493BEB6} - C:\WINDOWS\System32\geede.dll (file missing) O2 - BHO: (no name) - {B9F42C34-70E2-40D3-A961-D20DAFA10250} - (no file) O2 - BHO: (no name) - {cf021f40-3e14-23a5-cba2-717765728274} - (no file) O2 - BHO: (no name) - {D73ABC8D-4B3C-455E-A15B-C72071952A45} - (no file) O2 - BHO: (no name) - {E05A5316-C580-4957-9F45-980369D9AE83} - (no file) O4 - HKLM\..\Run: [07rO3pP] ddeput.exe O4 - HKLM\..\Run: [wfmlibal.exe] C:\Documents and Settings\All Users\Application Data\wfmlibal.exe O4 - HKLM\..\Run: [icq.com] rundll32.exe "C:\WINDOWS\System32\lglwvxtf.dll",forkonce O20 - Winlogon Notify: awtss - C:\WINDOWS\System32\awtss.dll O20 - Winlogon Notify: rqrrspm - C:\WINDOWS\SYSTEM32\rqrrspm.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\ clic "fix checked" ------------------------------------------------------------------- 3.Please Open notepad and copy/paste the text in the quotebox below into it: Save this as CFScript.txt Then drag the CFScript.txt into ComboFix.exe as you see in the screenshot below. This will start ComboFix again. After reboot (in case it asks to reboot), --------------------------------------------------------------------------- Reboot your computer in Safe Mode. If the computer is running, shut down Windows, and then turn off the power. Wait 30 seconds, and then turn the computer on. Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again. Ensure that the Safe Mode option is selected. Press Enter. The computer then begins to start in Safe mode. Login on your usual account. ----------------------------------------------------------------------- Now we need to do a search. Start > Search > For Files and Folders Expand Search Options, check Advanced Options, check Search system folders, Search hidden files and folders, and Search Subfolders. Paste this into the Search for files and folders named box: ddeput.exe If any of these files are found please delete them. Reboot back into Normal Mode --------------------------------------------------------------------- post: Combofix.txt fresh hiJackThis log
I apologize about the long wait but here are the two logs you have asked for: Hijack this: Logfile of HijackThis v1.99.1 Scan saved at 9:36:10 PM, on 07/29/2007 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\System32\RunDll32.exe C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Comodo\Firewall\CPF.exe C:\Program Files\QuickTime\QTTask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Palm\Hotsync.exe C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Comodo\Firewall\cmdagent.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\System32\devldr32.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Alex Schwartz\Desktop\Stuff\Jack This.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = sas.r21.mchsi.com:8000 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.r21.mchsi.com;<local> O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {3D1A1CA3-8C1D-F9BC-4F17-FE8DBA558FC6} - (no file) O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: (no name) - {cdc41c99-8bed-46bc-97b6-9ec228afe395} - C:\WINDOWS\System32\launvxy.dll O2 - BHO: (no name) - {DCD53738-C4F9-414A-A03C-C7405A4AC844} - C:\WINDOWS\System32\opnkjif.dll (file missing) O2 - BHO: (no name) - {F116E937-5F68-4D7E-9647-14BD1A1C934F} - C:\WINDOWS\System32\geeba.dll (file missing) O2 - BHO: (no name) - {F1D18367-ED25-4A59-9881-8897EE3736C9} - (no file) O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [Device Detector] "C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe" -autorun O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKCU\..\Run: [Arun] "C:\WINDOWS\STEM32~1\dllhost.exe" -vt yazb O4 - HKCU\..\Run: [Dripaks] "C:\Documents and Settings\Alex Schwartz\My Documents\?icrosoft.NET\?canregw.exe" O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Program Files\Palm\Hotsync.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O15 - Trusted Zone: *.drivecleaner.com O15 - Trusted Zone: *.errorprotector.com O15 - Trusted Zone: *.systemdoctor.com O15 - Trusted Zone: *.winantispyware.com O15 - Trusted Zone: *.winantivirus.com O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O16 - DPF: {8C875948-9C60-4381-9248-0DF180542D53} - http://installs.spamblockerutility.com/installs/spamblockerutility/programs/spamblockerutility.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer Wrapper) - http://chat.yahoo.com/cab/yvwrctl.cab O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab O20 - Winlogon Notify: opnkjif - opnkjif.dll (file missing) O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing) O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Panda Process Protection Service (PavPrSrv) - Unknown owner - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe (file missing) O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe Combo Fix: 2007-07-29 11:29 66,112 --a------ C:\WINDOWS\system32\nrkowsgk.exe 2007-07-28 07:20 66,112 --a------ C:\WINDOWS\system32\chbslgrm.exe 2007-07-27 07:19 66,112 --a------ C:\WINDOWS\system32\ydichukr.exe 2007-07-27 07:18 66,112 --a------ C:\WINDOWS\system32\xvhkjqcy.exe 2007-07-25 20:23 66,624 --a------ C:\WINDOWS\system32\dhpwijje.dll 2007-07-25 20:18 66,112 --a------ C:\WINDOWS\system32\jikpgsoc.exe 2007-07-25 07:29 31,254 --a------ C:\WINDOWS\system32\gebbyxv.dll 2007-07-25 07:29 1,126,352 -r-hs---- C:\WINDOWS\oomoekeA.exe 2007-07-25 07:29 <DIR> d-------- C:\WINDOWS\system32\T9 2007-07-25 07:29 <DIR> d-------- C:\WINDOWS\system32\T5 2007-07-25 07:29 <DIR> d-------- C:\WINDOWS\system32\T11 2007-07-25 07:29 <DIR> d-------- C:\WINDOWS\system32\b02FdUe 2007-07-25 07:29 <DIR> d-------- C:\Temp\brr 2007-07-25 07:29 <DIR> d-------- C:\Temp\0c2 2007-07-22 19:30 <DIR> d-------- C:\Program Files\GameSpy Arcade 2007-07-22 19:27 <DIR> d-------- C:\Program Files\Microsoft Games 2007-07-21 21:49 94,208 --a------ C:\WINDOWS\DIIUnin.exe 2007-07-21 21:49 2,829 --a------ C:\WINDOWS\DIIUnin.pif 2007-07-21 21:49 18,436 --a------ C:\WINDOWS\DIIUnin.dat 2007-07-21 21:42 <DIR> d-------- C:\Program Files\Diablo II 2007-07-21 21:24 21,840 --a----t- C:\WINDOWS\system32\SIntfNT.dll 2007-07-21 21:24 17,212 --a----t- C:\WINDOWS\system32\SIntf32.dll 2007-07-21 21:24 12,067 --a----t- C:\WINDOWS\system32\SIntf16.dll 2007-07-19 00:42 <DIR> d-------- C:\Program Files\iPod 2007-07-19 00:41 <DIR> d-------- C:\Program Files\iTunes 2007-07-19 00:40 <DIR> d-------- C:\Program Files\QuickTime 2007-07-19 00:38 <DIR> d-------- C:\Program Files\Apple Software Update 2007-07-19 00:38 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple 2007-07-11 14:16 <DIR> d-------- C:\Program Files\Error Expert 2007-07-10 07:35 31,254 --a------ C:\WINDOWS\system32\rqrqnnm.dll 2007-07-10 07:17 31,254 --a------ C:\WINDOWS\system32\nnnnono.dll 2007-07-10 07:16 <DIR> d-------- C:\WINDOWS\system32\o09PrEz 2007-07-10 07:16 <DIR> d-------- C:\Program Files\svhost 2007-07-09 09:59 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2007-07-08 23:17 <DIR> d--hs---- C:\WINDOWS\QWxleCBTY2h3YXJ0eg 2007-07-08 23:14 171,520 --a------ C:\WINDOWS\system32\launvxy.dll 2007-07-08 23:13 <DIR> d-------- C:\WINDOWS\system32\X9 2007-07-08 23:13 <DIR> d-------- C:\WINDOWS\system32\X5 2007-07-08 23:13 <DIR> d-------- C:\WINDOWS\system32\X4 2007-07-08 23:13 <DIR> d-------- C:\WINDOWS\system32\X3 2007-07-08 23:13 <DIR> d-------- C:\WINDOWS\system32\X2 2007-07-05 22:56 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Comodo 2007-07-05 22:56 <DIR> d-------- C:\DOCUME~1\ALEXSC~1\APPLIC~1\Comodo 2007-07-05 22:49 <DIR> d-------- C:\Program Files\Comodo 2007-07-05 22:45 95,872 --a------ C:\WINDOWS\system32\AvastSS.scr 2007-07-05 22:45 94,552 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2007-07-05 22:45 85,952 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2007-07-05 22:45 745,600 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-07-05 22:45 43,176 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2007-07-05 22:45 26,888 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-07-05 22:45 23,416 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2007-07-05 22:45 <DIR> d-------- C:\Program Files\Alwil Software 2007-07-01 13:38 49,152 --a------ C:\WINDOWS\nircmd.exe 2007-07-01 13:19 <DIR> d-------- C:\VundoFix Backups (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-07-29 22:48:47 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll 2007-07-26 01:31:12 -------- d-----w C:\Program Files\Windows NT 2007-07-22 02:35:33 -------- d--h--w C:\Program Files\InstallShield Installation Information 2007-07-19 05:18:40 -------- d-----w C:\Program Files\CCleaner 2007-07-19 05:10:30 -------- d-----w C:\Program Files\Yahoo! 2007-07-11 01:46:21 163,644 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2007-07-10 12:34:17 79,872 ----a-w C:\WINDOWS\system32\drivers\FOPN.sys 2007-07-09 12:36:40 -------- d-----w C:\DOCUME~1\ALEXSC~1\APPLIC~1\BitTorrent 2007-07-06 04:12:13 4 ----a-w C:\WINDOWS\system32\stfv.bin 2007-06-30 01:24:50 -------- d-----w C:\Program Files\Enigma Software Group 2007-06-28 13:41:59 19,456 ----a-w C:\WINDOWS\system32\180ax.exe 2007-06-28 13:41:57 28,928 ----a-w C:\WINDOWS\system32\updatetc.exe 2007-06-28 13:41:57 17,920 ----a-w C:\WINDOWS\system32\salm.exe 2007-06-28 13:41:50 13,312 ----a-w C:\WINDOWS\saiemod.dll 2007-06-28 13:41:39 12 ----a-w C:\WINDOWS\system32\gtv_sd.bin 2007-06-18 16:46:20 9,417 ----a-w C:\WINDOWS\mozver.dat 2007-06-18 16:46:18 -------- d-----w C:\Program Files\DivX 2007-06-15 19:43:08 53,248 ----a-w C:\WINDOWS\uni_eh43.exe 2007-06-15 19:42:02 53,248 ----a-w C:\WINDOWS\uninst1014.exe ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx [2001-04-16 17:39] {53707962-6F74-2D53-2644-206D7942484F}=C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2004-05-12 02:03] {cdc41c99-8bed-46bc-97b6-9ec228afe395}=C:\WINDOWS\System32\launvxy.dll [2007-07-25 07:29] {DCD53738-C4F9-414A-A03C-C7405A4AC844}=C:\WINDOWS\System32\opnkjif.dll [] {F116E937-5F68-4D7E-9647-14BD1A1C934F}=C:\WINDOWS\System32\geeba.dll [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Cmaudio"="cmicnfg.cpl" [] "nwiz"="nwiz.exe" [2006-10-22 12:22 C:\WINDOWS\system32\nwiz.exe] "HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [2003-06-25 12:24] "HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-10-23 20:51] "Device Detector"="C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe" [2004-09-02 16:51] "IPHSend"="C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe" [2006-02-17 11:59] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-04-30 10:42] "COMODO Firewall Pro"="C:\Program Files\Comodo\Firewall\CPF.exe" [2007-07-05 22:49] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-07-10 09:18] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Arun"="C:\WINDOWS\STEM32~1\dllhost.exe" [] "Dripaks"="C:\Documents and Settings\Alex Schwartz\My Documents\?icrosoft.NET\?canregw.exe" [] [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0] Source= C:\Program Files\Internet Explorer\profsyzyzoz.html FriendlyName= [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" [2007-05-30 07:29] "{DCD53738-C4F9-414A-A03C-C7405A4AC844}"="C:\WINDOWS\System32\opnkjif.dll" [] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\opnkjif] opnkjif.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Driver] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Guard] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "Alerter"=3 (0x3) "TrkWks"=2 (0x2) "MSDTC"=3 (0x3) "ClipSrv"=3 (0x3) Contents of the 'Scheduled Tasks' folder 2007-07-20 03:21:00 C:\WINDOWS\tasks\AppleSoftwareUpdate.job ************************************************************************** catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-07-29 21:39:23 Windows 5.1.2600 Service Pack 1 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0
