Remove antivirus pro and/or other infections please? ty

Posted 11/26/2009 2:22 PM
#80156
User avatar

drakan3187 Member

Date Joined Nov 2016
Total Posts: 4
My mother has been complaining of a lot of pop ups on her desktop (usually in porn fashion) and also the Antivirus System Pro 2009 pop up as well. I don't know how to decipher the logs but will post the ones i believe you will need. Any help is greatly appreciated. The pop ups do overwhelm her computer at times leaving no other option than to manually turn it off from what I understand from her. <br/>Thank you All!!!! <br/> <br/> <br/> <br/>HJT: <br/> <br/>Logfile of Trend Micro HijackThis v2.0.2 <br/>Scan saved at 1:24:33 PM, on 11/21/2009 <br/>Platform: Windows XP SP3 (WinNT 5.01.2600) <br/>MSIE: Internet Explorer v7.00 (7.00.6000.16915) <br/>Boot mode: Normal <br/> <br/>Running processes: <br/>C:\WINDOWS\System32\smss.exe <br/>C:\WINDOWS\system32\winlogon.exe <br/>C:\WINDOWS\system32\services.exe <br/>C:\WINDOWS\system32\lsass.exe <br/>C:\WINDOWS\system32\svchost.exe <br/>C:\WINDOWS\System32\svchost.exe <br/>C:\WINDOWS\system32\svchost.exe <br/>C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe <br/>C:\WINDOWS\system32\LEXBCES.EXE <br/>C:\WINDOWS\system32\LEXPPS.EXE <br/>C:\WINDOWS\system32\spoolsv.exe <br/>C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe <br/>C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe <br/>C:\WINDOWS\Explorer.EXE <br/>C:\Program Files\Bonjour\mDNSResponder.exe <br/>C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe <br/>C:\WINDOWS\system32\dla\tfswctrl.exe <br/>C:\WINDOWS\System32\CTsvcCDA.exe <br/>C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE <br/>C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe <br/>C:\WINDOWS\System32\nvsvc32.exe <br/>C:\Program Files\Common Files\Real\Update_OB\realsched.exe <br/>C:\WINDOWS\system32\ctfmon.exe <br/>C:\WINDOWS\System32\svchost.exe <br/>C:\Program Files\Viewpoint\Common\ViewpointService.exe <br/>C:\WINDOWS\System32\MsPMSPSv.exe <br/>C:\WINDOWS\system32\fxssvc.exe <br/>C:\Program Files\Canon\CAL\CALMAIN.exe <br/>C:\WINDOWS\System32\svchost.exe <br/>C:\Program Files\Internet Explorer\iexplore.exe <br/>C:\Program Files\Trend Micro\HijackThis\HijackThis.exe <br/> <br/>R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.pogo.com/home/home.do <br/>R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 <br/>R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 <br/>R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 <br/>R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 <br/>R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = <br/>O1 - Hosts: ::1 localhost <br/>O1 - Hosts: 91.212.127.227 esysprotector2009.microsoft.com <br/>O1 - Hosts: 91.212.127.227 esysprotector2009.com <br/>O1 - Hosts: 91.212.127.227 www.esysprotector2009.com <br/>O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file) <br/>O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll <br/>O2 - BHO: Browser Defender BHO - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll <br/>O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll <br/>O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\coIEPlg.dll <br/>O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll <br/>O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll <br/>O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll <br/>O2 - BHO: Yontoo Layers - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files\Yontoo Layers Client\YontooIEClient.dll <br/>O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll <br/>O3 - Toolbar: PC Tools Browser Guard - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll <br/>O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup <br/>O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe <br/>O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r <br/>O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" <br/>O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton 360\osCheck.exe" <br/>O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot <br/>O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime <br/>O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript <br/>O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe <br/>O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp <br/>O4 - HKLM\..\Policies\Explorer\Run: []  <br/>O4 - HKUS\S-1-5-19\..\RunOnce: [] (User 'LOCAL SERVICE') <br/>O4 - HKUS\S-1-5-20\..\RunOnce: [] (User 'NETWORK SERVICE') <br/>O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM') <br/>O4 - HKUS\S-1-5-18\..\RunOnce: [] (User 'SYSTEM') <br/>O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user') <br/>O4 - HKUS\.DEFAULT\..\RunOnce: [] (User 'Default user') <br/>O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 <br/>O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll <br/>O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll <br/>O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL <br/>O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe <br/>O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe <br/>O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe <br/>O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe <br/>O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab <br/>O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - http://www.worldwinner.com/games/v50/tpir/tpir.cab <br/>O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab <br/>O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab <br/>O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab <br/>O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab <br/>O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab <br/>O16 - DPF: {9C23D886-43CB-43DE-B2DB-112A68D7E10A} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader2.cab <br/>O16 - DPF: {B516CA4E-A5BA-405C-AFCF-A97F08CC7429} (GoBit Games Player) - http://www.shockwave.com/content/burgershop/sis/GoBitGamesPlayer_v5.cab <br/>O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://games.myspace.com/Gameshell/GameHost/1.0/OberonGameHost.cab <br/>O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab <br/>O16 - DPF: {D71F9A27-723E-4B8B-B428-B725E47CBA3E} (Imikimi_activex_plugin Control) - http://imikimi.com/download/imikimi_plugin_0.5.1.cab <br/>O16 - DPF: {E93E9DF0-3E59-4331-A269-F1E077C66F00} (GameTap Web Plugin) - http://cnn-5.vo.llnwd.net/c1/static/client/browserplayer/gtplugin.cab <br/>O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll <br/>O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe <br/>O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe <br/>O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe <br/>O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe <br/>O23 - Service: Browser Defender Update Service - Threat Expert Ltd. - C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe <br/>O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe <br/>O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe <br/>O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe <br/>O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe <br/>O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe <br/>O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe <br/>O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe <br/>O23 - Service: Google Update Service (gupdate1c9e0bdb40deb2) (gupdate1c9e0bdb40deb2) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe <br/>O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe <br/>O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe <br/>O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe <br/>O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE <br/>O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE <br/>O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe <br/>O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe <br/>O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe <br/>O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe <br/>O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe <br/> <br/>-- <br/>End of file - 11060 bytes <br/> <br/> <br/>MBAM: <br/> <br/>Malwarebytes' Anti-Malware 1.41 <br/>Database version: 3206 <br/>Windows 5.1.2600 Service Pack 3 <br/> <br/>11/21/2009 12:43:15 PM <br/>mbam-log-2009-11-21 (12-43-15).txt <br/> <br/>Scan type: Full Scan (C:\|) <br/>Objects scanned: 200348 <br/>Time elapsed: 1 hour(s), 11 minute(s), 52 second(s) <br/> <br/>Memory Processes Infected: 0 <br/>Memory Modules Infected: 0 <br/>Registry Keys Infected: 36 <br/>Registry Values Infected: 3 <br/>Registry Data Items Infected: 0 <br/>Folders Infected: 0 <br/>Files Infected: 14 <br/> <br/>Memory Processes Infected: <br/>(No malicious items detected) <br/> <br/>Memory Modules Infected: <br/>(No malicious items detected) <br/> <br/>Registry Keys Infected: <br/>HKEY_CLASSES_ROOT\ddsme.kl (Trojan.BHO) -> Quarantined and deleted successfully. <br/>HKEY_CLASSES_ROOT\ddsme.kl.1 (Trojan.BHO) -> Quarantined and deleted successfully. <br/>HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully. <br/>HKEY_CLASSES_ROOT\Interface\{624f9012-d73b-11dd-95af-61c156d89593} (Trojan.BHO) -> Quarantined and deleted successfully. <br/>HKEY_CLASSES_ROOT\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff} (Adware.MyWebSearch) -> Quarantined and deleted successfully. <br/>HKEY_CLASSES_ROOT\Interface\{cf54be1c-9359-4395-8533-1657cf209cfe} (Adware.MyWebSearch) -> Quarantined and deleted successfully. <br/>HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> Quarantined and deleted successfully. <br/>HKEY_CLASSES_ROOT\CLSID\{2502bbd0-d73b-11dd-b4ec-cebf56d89593} (Trojan.BHO) -> Quarantined and deleted successfully. <br/>HKEY_CLASSES_ROOT\Typelib\{d518921a-4a03-425e-9873-b9a71756821e} (Adware.MyWebSearch) -> Quarantined and deleted successfully. <br/>HKEY_CLASSES_ROOT\Typelib\{52cde0e4-d73b-11dd-9b90-fcc056d89593} (Trojan.BHO) -> Quarantined and deleted successfully. <br/>HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{0ed403e8-470a-4a8a-85a4-d7688cfe39a3} (Adware.Gamevance) -> Quarantined and deleted successfully. <br/>HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully. <br/>HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea1-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully. <br/>HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully. <br/>HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18eab-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully. <br/>HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully. <br/>HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{25560540-9571-4d7b-9389-0f166788785a} (Adware.MyWebSearch) -> Quarantined and deleted successfully. <br/>HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3dc201fb-e9c9-499c-a11f-23c360d7c3f8} (Adware.MyWebSearch) -> Quarantined and deleted successfully. <br/>HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{63d0ed2c-b45b-4458-8b3b-60c69bbbd83c} (Adware.MyWebSearch) -> Quarantined and deleted successfully. <br/>HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{9ff05104-b030-46fc-94b8-81276e4e27df} (Adware.MyWebSearch) -> Quarantined and deleted successfully. <br/>HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{2502bbd0-d73b-11dd-b4ec-cebf56d89593} (Trojan.BHO) -> Quarantined and deleted successfully. <br/>HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{ada8c222-95d2-47b5-950b-aebc0a508839} (Trojan.BHO) -> Quarantined and deleted successfully. <br/>HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{bd4f7a6d-0107-4bdf-b72b-021b717b06ce} (Trojan.FakeAlert) -> Quarantined and deleted successfully. <br/>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59c7fc09-1c83-4648-b3e6-003d2bbc7481} (Adware.MyWebSearch) -> Quarantined and deleted successfully. <br/>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68af847f-6e91-45dd-9b68-d6a12c30e5d7} (Adware.MyWebSearch) -> Quarantined and deleted successfully. <br/>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170b96c-28d4-4626-8358-27e6caeef907} (Adware.MyWebSearch) -> Quarantined and deleted successfully. <br/>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{d1a71fa0-ff48-48dd-9b6d-7a13a3e42127} (Adware.MyWebSearch) -> Quarantined and deleted successfully. <br/>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ddb1968e-ead6-40fd-8dae-ff14757f60c7} (Adware.MyWebSearch) -> Quarantined and deleted successfully. <br/>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{f138d901-86f0-4383-99b6-9cdd406036da} (Adware.MyWebSearch) -> Quarantined and deleted successfully. <br/>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{5b4c3b43-49b6-42a7-a602-f7acdca0d409} (Adware.OneStepSearch) -> Quarantined and deleted successfully. <br/>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> Quarantined and deleted successfully. <br/>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2502bbd0-d73b-11dd-b4ec-cebf56d89593} (Trojan.BHO) -> Quarantined and deleted successfully. <br/>HKEY_CURRENT_USER\SOFTWARE\AvScan (Trojan.FakeAlert) -> Quarantined and deleted successfully. <br/>HKEY_CURRENT_USER\SOFTWARE\Spyware Guard 2008 (Rogue.SpywareGuard) -> Quarantined and deleted successfully. <br/>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully. <br/>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully. <br/> <br/>Registry Values Infected: <br/>HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bkjrkupd (Trojan.Dropper) -> Quarantined and deleted successfully. <br/>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bkjrkupd (Trojan.Dropper) -> Quarantined and deleted successfully. <br/>HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\MenuExt\&Search\(default) (Adware.Hotbar) -> Quarantined and deleted successfully. <br/> <br/>Registry Data Items Infected: <br/>(No malicious items detected) <br/> <br/>Folders Infected: <br/>(No malicious items detected) <br/> <br/>Files Infected: <br/>C:\Documents and Settings\Marnie\Local Settings\Application Data\aamqsp\pstcsysguard.exe (Trojan.Dropper) -> Quarantined and deleted successfully. <br/>C:\Program Files\Uninstall Fun Web Products.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully. <br/>C:\System Volume Information\_restore{74C9AA7F-3B54-4C56-86BB-A0CC4EA7C559}\RP792\A0113263.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. <br/>C:\System Volume Information\_restore{74C9AA7F-3B54-4C56-86BB-A0CC4EA7C559}\RP798\A0113331.exe (Rogue.Installer) -> Quarantined and deleted successfully. <br/>C:\WINDOWS\fdgg34353edfgdfdf (KoobFace.Trace) -> Quarantined and deleted successfully. <br/>C:\WINDOWS\0535251103110107106.yux (KoobFace.Trace) -> Quarantined and deleted successfully. <br/>C:\WINDOWS\010112010146120114.xe (KoobFace.Trace) -> Quarantined and deleted successfully. <br/>C:\WINDOWS\0101120101464950.xe (KoobFace.Trace) -> Quarantined and deleted successfully. <br/>C:\WINDOWS\0101120101465149.xe (KoobFace.Trace) -> Quarantined and deleted successfully. <br/>C:\WINDOWS\0101120101465449.xe (KoobFace.Trace) -> Quarantined and deleted successfully. <br/>C:\WINDOWS\0101120101465653.xe (KoobFace.Trace) -> Quarantined and deleted successfully. <br/>C:\WINDOWS\ectbbyn.dat (KoobFace.Trace) -> Quarantined and deleted successfully. <br/>C:\WINDOWS\prxid93ps.dat (Malware.Trace) -> Quarantined and deleted successfully. <br/>C:\WINDOWS\ex23567.dat (KoobFace.Trace) -> Quarantined and deleted successfully. <br/> <br/> <br/>DDS: <br/> <br/> <br/>DDS (Ver_09-10-26.01) - NTFSx86 <br/>Run by Marnie at 13:00:16.60 on Sat 11/21/2009 <br/>Internet Explorer: 7.0.5730.13 <br/>Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.135 [GMT -5:00] <br/> <br/>AV: Norton 360 *On-access scanning enabled* (Updated) {A5F1BC7C-EA33-4247-961C-0217208396C4} <br/>FW: Norton 360 *enabled* {371C0A40-5A0C-4AD2-A6E5-69C02037FBF3} <br/> <br/>============== Running Processes =============== <br/> <br/>C:\WINDOWS\system32\svchost -k DcomLaunch <br/>svchost.exe <br/>C:\WINDOWS\System32\svchost.exe -k netsvcs <br/>C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup <br/>svchost.exe <br/>svchost.exe <br/>C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe <br/>C:\WINDOWS\system32\LEXBCES.EXE <br/>C:\WINDOWS\system32\LEXPPS.EXE <br/>C:\WINDOWS\system32\spoolsv.exe <br/>svchost.exe <br/>C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe <br/>C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe <br/>C:\WINDOWS\Explorer.EXE <br/>C:\Program Files\Bonjour\mDNSResponder.exe <br/>C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe <br/>C:\WINDOWS\system32\dla\tfswctrl.exe <br/>C:\WINDOWS\System32\CTsvcCDA.exe <br/>C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE <br/>C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe <br/>C:\WINDOWS\System32\nvsvc32.exe <br/>C:\Program Files\Common Files\Real\Update_OB\realsched.exe <br/>C:\WINDOWS\system32\ctfmon.exe <br/>C:\WINDOWS\System32\svchost.exe -k imgsvc <br/>C:\Program Files\Viewpoint\Common\ViewpointService.exe <br/>C:\WINDOWS\System32\MsPMSPSv.exe <br/>C:\WINDOWS\system32\fxssvc.exe <br/>C:\Program Files\Canon\CAL\CALMAIN.exe <br/>C:\WINDOWS\System32\svchost.exe -k HTTPFilter <br/>C:\Program Files\Internet Explorer\iexplore.exe <br/>C:\WINDOWS\System32\NOTEPAD.EXE <br/>C:\WINDOWS\System32\NOTEPAD.EXE <br/>C:\Documents and Settings\Marnie\Desktop\dds.scr <br/> <br/>============== Pseudo HJT Report =============== <br/> <br/>uStart Page = hxxp://www.pogo.com/home/home.do <br/>uSearch Page = <br/>uSearch Bar = <br/>mSearchAssistant = <br/>BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File <br/>BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll <br/>BHO: PC Tools Browser Guard BHO: {2a0f3d1b-0909-4ff4-b272-609cce6054e7} - c:\program files\spyware doctor\bdt\PCTBrowserDefender.dll <br/>BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll <br/>BHO: NCO 2.0 IE BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - c:\program files\common files\symantec shared\coshared\browser\2.6\coIEPlg.dll <br/>BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\progra~1\common~1\symant~1\ids\IPSBHO.dll <br/>BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_05\bin\ssv.dll <br/>BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.3572\swg.dll <br/>BHO: Yontoo Layers: {fd72061e-9fde-484d-a58a-0bab4151cad8} - c:\program files\yontoo layers client\YontooIEClient.dll <br/>TB: Show Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - c:\program files\common files\symantec shared\coshared\browser\2.6\CoIEPlg.dll <br/>TB: PC Tools Browser Guard: {472734ea-242a-422b-adf8-83d1e48cc825} - c:\program files\spyware doctor\bdt\PCTBrowserDefender.dll <br/>TB: {10134636-E7AF-4AC5-A1DC-C7C44BB97D81} - No File <br/>TB: {98279C38-DE4B-4BCF-93C9-8EC26069D6F4} - No File <br/>EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File <br/>uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe <br/>uRun: [Aim6] "c:\program files\aim6\aim6.exe" /d locale=en-US ee://aol/imApp <br/>mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup <br/>mRun: [dla] c:\windows\system32\dla\tfswctrl.exe <br/>mRun: [StorageGuard] "c:\program files\common files\sonic\update manager\sgtray.exe" /r <br/>mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe" <br/>mRun: [osCheck] "c:\program files\norton 360\osCheck.exe" <br/>mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot <br/>mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime <br/>mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript <br/>dRun: [MySpaceIM] c:\program files\myspace\im\MySpaceIM.exe <br/>dRunOnce: [<NO NAME>] <br/>mExplorerRun: [<NO NAME>] 1 (0x1) <br/>mPolicies-explorer: <NO NAME> = <br/>IE: &Search <br/>IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000 <br/>IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe <br/>IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe <br/>IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_05\bin\ssv.dll <br/>IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL <br/>DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/templates/ieawsdc.cab <br/>DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab <br/>DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} - <a target="_blank" href="file:///C:/Program%20Files/Family%20Feud%202/Images/stg_drm.ocx">file:///C:/Program%20Files/Family%20Feud%202/Images/stg_drm.ocx</A> <br/>DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab <br/>DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/8/b/d/8bd77752-5704-4d68-a152-f7252adaa4f2/LegitCheckControl.cab <br/>DPF: {1D082E71-DF20-4AAF-863B-596428C49874} - hxxp://www.worldwinner.com/games/v50/tpir/tpir.cab <br/>DPF: {48DD0448-9209-4F81-9F6D-D83562940134} - hxxp://lads.myspace.com/upload/MySpaceUploader1006.cab <br/>DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - hxxp://download.divx.com/player/DivXBrowserPlugin.cab <br/>DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} - hxxps://webdl.symantec.com/activex/symdlmgr.cab <br/>DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab <br/>DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} - hxxp://www.worldwinner.com/games/shared/wwlaunch.cab <br/>DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab <br/>DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab <br/>DPF: {9C23D886-43CB-43DE-B2DB-112A68D7E10A} - hxxp://lads.myspace.com/upload/MySpaceUploader2.cab <br/>DPF: {B516CA4E-A5BA-405C-AFCF-A97F08CC7429} - hxxp://www.shockwave.com/content/burgershop/sis/GoBitGamesPlayer_v5.cab <br/>DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab <br/>DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab <br/>DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} - hxxp://games.myspace.com/Gameshell/GameHost/1.0/OberonGameHost.cab <br/>DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab <br/>DPF: {D71F9A27-723E-4B8B-B428-B725E47CBA3E} - hxxp://imikimi.com/download/imikimi_plugin_0.5.1.cab <br/>DPF: {E93E9DF0-3E59-4331-A269-F1E077C66F00} - hxxp://cnn-5.vo.llnwd.net/c1/static/client/browserplayer/gtplugin.cab <br/>Handler: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - c:\program files\hp\hpcoretech\comp\hpuiprot.dll <br/>Notify: GoToAssist - c:\program files\citrix\gotoassist\514\G2AWinLogon.dll <br/>SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll <br/> <br/>============= SERVICES / DRIVERS =============== <br/> <br/>R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-11-9 207280] <br/>R2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\spyware doctor\bdt\BDTUpdateService.exe [2009-11-9 112592] <br/>R2 LiveUpdate Notice;LiveUpdate Notice;c:\program files\common files\symantec shared\CCSVCHST.EXE [2008-2-18 149352] <br/>R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2004-6-9 24652] <br/>R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2009-8-29 102448] <br/>S0 e244b8de60491926380db35e44121e6e;e244b8de60491926380db35e44121e6e;c:\windows\system32\e244b8de60491926380db35e44121e6e.sys --> c:\windows\system32\e244b8de60491926380db35e44121e6e.sys [?] <br/>S2 gupdate1c9e0bdb40deb2;Google Update Service (gupdate1c9e0bdb40deb2);c:\program files\google\update\GoogleUpdate.exe [2009-5-29 133104] <br/>S3 COH_Mon;COH_Mon;c:\windows\system32\drivers\COH_Mon.sys [2008-1-12 23888] <br/> <br/>=============== Created Last 30 ================ <br/> <br/>2009-11-21 16:29:00 0 d-----w- c:\docume~1\marnie\applic~1\Malwarebytes <br/>2009-11-21 16:28:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys <br/>2009-11-21 16:28:52 19160 ----a-w- c:\windows\system32\drivers\mbam.sys <br/>2009-11-21 16:28:52 0 d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes <br/>2009-11-21 16:28:51 0 d-----w- c:\program files\Malwarebytes' Anti-Malware <br/>2009-11-21 16:23:56 0 d-----w- c:\program files\Trend Micro <br/>2009-11-21 16:12:57 12160 -c--a-w- c:\windows\system32\dllcache\mouhid.sys <br/>2009-11-21 16:12:57 12160 ----a-w- c:\windows\system32\drivers\mouhid.sys <br/>2009-11-21 16:12:49 10368 -c--a-w- c:\windows\system32\dllcache\hidusb.sys <br/>2009-11-21 16:12:49 10368 ----a-w- c:\windows\system32\drivers\hidusb.sys <br/>2009-11-09 23:44:03 767952 ----a-w- c:\windows\BDTSupport.dll <br/>2009-11-09 23:44:02 883 ----a-w- c:\windows\RegSDImport.xml <br/>2009-11-09 23:44:02 880 ----a-w- c:\windows\RegISSImport.xml <br/>2009-11-09 23:44:02 165840 ----a-w- c:\windows\PCTBDRes.dll <br/>2009-11-09 23:44:02 1636304 ----a-w- c:\windows\PCTBDCore.dll <br/>2009-11-09 23:44:02 149456 ----a-w- c:\windows\SGDetectionTool.dll <br/>2009-11-09 23:44:02 131 ----a-w- c:\windows\IDB.zip <br/>2009-11-09 23:44:02 1152470 ----a-w- c:\windows\UDB.zip <br/>2009-11-09 23:38:23 7387 ----a-w- c:\windows\system32\drivers\pctgntdi.cat <br/>2009-11-09 23:38:22 229304 ----a-w- c:\windows\system32\drivers\pctgntdi.sys <br/>2009-11-09 23:37:32 87784 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys <br/>2009-11-09 23:37:32 7412 ----a-w- c:\windows\system32\drivers\PCTAppEvent.cat <br/>2009-11-09 23:37:32 7383 ----a-w- c:\windows\system32\drivers\pctcore.cat <br/>2009-11-09 23:37:32 207280 ----a-w- c:\windows\system32\drivers\PCTCore.sys <br/>2009-11-09 23:37:10 7383 ----a-w- c:\windows\system32\drivers\pctplsg.cat <br/>2009-11-09 23:37:10 70408 ----a-w- c:\windows\system32\drivers\pctplsg.sys <br/>2009-11-09 23:36:54 0 d-----w- c:\program files\Spyware Doctor <br/>2009-11-09 23:36:54 0 d-----w- c:\program files\common files\PC Tools <br/>2009-11-09 23:36:54 0 d-----w- c:\docume~1\marnie\applic~1\PC Tools <br/>2009-11-09 23:36:54 0 d-----w- c:\docume~1\alluse~1\applic~1\PC Tools <br/>2009-11-01 15:18:26 0 d-----w- c:\program files\ahdosw <br/> <br/>==================== Find3M ==================== <br/> <br/>2009-09-11 14:18:39 136192 ----a-w- c:\windows\system32\msv1_0.dll <br/>2009-09-04 21:03:36 58880 ----a-w- c:\windows\system32\msasn1.dll <br/>2009-08-29 07:36:27 832512 ----a-w- c:\windows\system32\wininet.dll <br/>2009-08-29 07:36:24 78336 ----a-w- c:\windows\system32\ieencode.dll <br/>2009-08-29 07:36:24 17408 ------w- c:\windows\system32\corpol.dll <br/>2009-08-26 08:00:21 247326 ----a-w- c:\windows\system32\strmdll.dll <br/>2008-08-05 07:07:42 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008080520080806\index.dat <br/> <br/>============= FINISH: 13:01:19.28 =============== <br/> <br/> <br/>ATTACH (other DDS): <br/> <br/> <br/>UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. <br/>IF REQUESTED, ZIP IT UP & ATTACH IT <br/> <br/>DDS (Ver_09-10-26.01) <br/> <br/>Microsoft Windows XP Home Edition <br/>Boot Device: \Device\HarddiskVolume1 <br/>Install Date: 3/25/2008 1:13:28 PM <br/>System Uptime: 11/21/2009 12:45:16 PM (1 hours ago) <br/> <br/>Motherboard: Dell Computer Corp. | | 0F4491 <br/>Processor: Intel(R) Pentium(R) 4 CPU 2.80GHz | Microprocessor | 2793/533mhz <br/> <br/>==== Disk Partitions ========================= <br/> <br/>A: is Removable <br/>C: is FIXED (NTFS) - 112 GiB total, 76.481 GiB free. <br/>D: is CDROM () <br/>E: is CDROM () <br/> <br/>==== Disabled Device Manager Items ============= <br/> <br/>==== System Restore Points =================== <br/> <br/>RP720: 8/17/2009 9:31:24 AM - System Checkpoint <br/>RP721: 8/18/2009 10:32:31 AM - System Checkpoint <br/>RP722: 8/19/2009 10:33:10 AM - System Checkpoint <br/>RP723: 8/20/2009 11:17:42 AM - System Checkpoint <br/>RP724: 8/21/2009 11:56:09 AM - System Checkpoint <br/>RP725: 8/22/2009 12:04:11 PM - System Checkpoint <br/>RP726: 8/23/2009 1:19:48 PM - System Checkpoint <br/>RP727: 8/24/2009 2:05:26 PM - System Checkpoint <br/>RP728: 8/25/2009 4:36:44 PM - System Checkpoint <br/>RP729: 8/26/2009 5:31:03 PM - System Checkpoint <br/>RP730: 8/26/2009 8:11:41 PM - Software Distribution Service 3.0 <br/>RP731: 8/27/2009 8:37:02 PM - System Checkpoint <br/>RP732: 8/29/2009 2:18:08 AM - System Checkpoint <br/>RP733: 8/30/2009 8:14:05 AM - Software Distribution Service 3.0 <br/>RP734: 8/30/2009 8:28:32 AM - Software Distribution Service 3.0 <br/>RP735: 8/30/2009 8:43:32 AM - Removed Microsoft Silverlight <br/>RP736: 8/31/2009 4:58:48 PM - System Checkpoint <br/>RP737: 9/1/2009 5:44:15 PM - System Checkpoint <br/>RP738: 9/2/2009 6:15:59 PM - System Checkpoint <br/>RP739: 9/3/2009 7:35:06 PM - System Checkpoint <br/>RP740: 9/5/2009 7:54:06 AM - System Checkpoint <br/>RP741: 9/6/2009 10:18:35 AM - System Checkpoint <br/>RP742: 9/7/2009 2:00:22 PM - System Checkpoint <br/>RP743: 9/8/2009 5:06:40 PM - System Checkpoint <br/>RP744: 9/9/2009 6:21:15 PM - System Checkpoint <br/>RP745: 9/10/2009 7:09:01 PM - Software Distribution Service 3.0 <br/>RP746: 9/11/2009 3:14:29 PM - Installed Compatibility Pack for the 2007 Office system <br/>RP747: 9/12/2009 4:11:27 PM - System Checkpoint <br/>RP748: 9/13/2009 4:35:18 PM - System Checkpoint <br/>RP749: 9/14/2009 6:29:49 PM - System Checkpoint <br/>RP750: 9/15/2009 7:53:22 PM - System Checkpoint <br/>RP751: 9/16/2009 9:30:15 PM - System Checkpoint <br/>RP752: 9/18/2009 4:33:58 PM - System Checkpoint <br/>RP753: 9/19/2009 4:42:46 PM - System Checkpoint <br/>RP754: 9/20/2009 5:16:30 PM - System Checkpoint <br/>RP755: 9/21/2009 6:54:27 PM - System Checkpoint <br/>RP756: 9/23/2009 4:39:30 PM - System Checkpoint <br/>RP757: 9/24/2009 4:42:32 PM - System Checkpoint <br/>RP758: 9/25/2009 5:45:31 PM - System Checkpoint <br/>RP759: 9/26/2009 6:26:31 PM - System Checkpoint <br/>RP760: 9/27/2009 6:53:11 PM - System Checkpoint <br/>RP761: 9/28/2009 7:10:15 PM - System Checkpoint <br/>RP762: 9/29/2009 7:11:20 PM - System Checkpoint <br/>RP763: 9/30/2009 9:28:21 PM - System Checkpoint <br/>RP764: 10/1/2009 10:55:07 PM - System Checkpoint <br/>RP765: 10/3/2009 12:59:16 PM - System Checkpoint <br/>RP766: 10/4/2009 1:24:29 PM - System Checkpoint <br/>RP767: 10/5/2009 2:07:19 PM - System Checkpoint <br/>RP768: 10/5/2009 7:13:58 PM - Configured SAMSUNG Mobile USB DRIVER(4.40.7.0) v1.6 <br/>RP769: 10/5/2009 7:17:44 PM - Configured SAMSUNG Mobile USB DRIVER(4.40.7.0) v1.6 <br/>RP770: 10/5/2009 7:22:14 PM - Configured SAMSUNG Mobile USB DRIVER(4.40.7.0) v1.6 <br/>RP771: 10/5/2009 7:23:18 PM - Installed SAMSUNG Mobile USB DRIVER(4.40.7.0) v1.6 <br/>RP772: 10/6/2009 7:49:27 PM - System Checkpoint <br/>RP773: 10/8/2009 7:47:26 AM - System Checkpoint <br/>RP774: 10/9/2009 5:06:10 PM - System Checkpoint <br/>RP775: 10/10/2009 5:10:26 PM - System Checkpoint <br/>RP776: 10/11/2009 7:29:09 PM - System Checkpoint <br/>RP777: 10/13/2009 5:45:40 PM - System Checkpoint <br/>RP778: 10/14/2009 6:16:54 PM - System Checkpoint <br/>RP779: 10/15/2009 6:45:27 PM - System Checkpoint <br/>RP780: 10/16/2009 6:56:43 PM - System Checkpoint <br/>RP781: 10/17/2009 7:08:15 PM - System Checkpoint <br/>RP782: 10/18/2009 8:00:06 PM - System Checkpoint <br/>RP783: 10/19/2009 9:14:03 PM - System Checkpoint <br/>RP784: 10/21/2009 4:42:21 PM - System Checkpoint <br/>RP785: 10/22/2009 6:17:18 PM - System Checkpoint <br/>RP786: 10/23/2009 7:05:09 PM - System Checkpoint <br/>RP787: 10/24/2009 7:13:07 PM - System Checkpoint <br/>RP788: 10/25/2009 7:43:09 PM - System Checkpoint <br/>RP789: 10/27/2009 6:24:23 PM - System Checkpoint <br/>RP790: 10/28/2009 6:27:24 PM - System Checkpoint <br/>RP791: 10/29/2009 7:19:02 PM - System Checkpoint <br/>RP792: 10/31/2009 11:07:52 AM - System Checkpoint <br/>RP793: 11/1/2009 1:11:03 PM - System Checkpoint <br/>RP794: 11/2/2009 8:07:45 PM - System Checkpoint <br/>RP795: 11/3/2009 8:21:09 PM - System Checkpoint <br/>RP796: 11/4/2009 9:11:09 PM - System Checkpoint <br/>RP797: 11/5/2009 9:20:34 PM - System Checkpoint <br/>RP798: 11/7/2009 12:00:44 PM - System Checkpoint <br/>RP799: 11/8/2009 11:14:47 AM - System Checkpoint <br/>RP800: 11/9/2009 11:45:22 AM - System Checkpoint <br/>RP801: 11/10/2009 4:50:56 PM - System Checkpoint <br/>RP802: 11/11/2009 4:54:12 PM - Software Distribution Service 3.0 <br/>RP803: 11/12/2009 5:32:57 PM - System Checkpoint <br/>RP804: 11/12/2009 7:06:07 PM - Software Distribution Service 3.0 <br/>RP805: 11/13/2009 7:47:17 PM - System Checkpoint <br/> <br/>==== Installed Programs ====================== <br/> <br/>Adobe Flash Player 10 ActiveX <br/>Adobe Flash Player 10 Plugin <br/>Adobe Reader 8.1.4 <br/>Adobe Shockwave Player 11.5 <br/>AIM 6 <br/>AppCore <br/>Apple Mobile Device Support <br/>Apple Software Update <br/>Ares 2.0.9 <br/>Backup <br/>Bonjour <br/>Browser Defender 2.0.6.10 <br/>BufferChm <br/>Canon Camera Access Library <br/>Canon Camera Support Core Library <br/>Canon Camera Window DC_DV 5 for ZoomBrowser EX <br/>Canon Camera Window DC_DV 6 for ZoomBrowser EX <br/>Canon Camera Window MC 6 for ZoomBrowser EX <br/>Canon G.726 WMP-Decoder <br/>Canon MovieEdit Task for ZoomBrowser EX <br/>Canon RAW Image Task for ZoomBrowser EX <br/>Canon RemoteCapture Task for ZoomBrowser EX <br/>Canon Utilities EOS Utility <br/>Canon Utilities PhotoStitch <br/>Canon Utilities ZoomBrowser EX <br/>ccCommon <br/>Compatibility Pack for the 2007 Office system <br/>Conexant SmartHSFi V.9x 56K DF PCI Modem <br/>CreativeProjects <br/>CreativeProjectsTemplates <br/>CueTour <br/>Dell AIO Printer A920 <br/>Dell Digital Jukebox Driver <br/>Dell Media Experience <br/>Dell ResourceCD <br/>Destinations <br/>Director <br/>DivX Web Player <br/>GearDrvs <br/>Google Earth <br/>Google Update Helper <br/>Google Updater <br/>GoToAssist 8.0.0.514 <br/>HijackThis 2.0.2 <br/>Hotfix for Windows Internet Explorer 7 (KB947864) <br/>Hotfix for Windows Media Format 11 SDK (KB929399) <br/>Hotfix for Windows XP (KB952287) <br/>Hotfix for Windows XP (KB970653-v3) <br/>HP Diagnostic Assistant <br/>HP Image Zone 4.0 <br/>HP Software Update <br/>HPSystemDiagnostics <br/>Imikimi Plugin <br/>IncrediMail <br/>InstantShare <br/>Intel(R) PRO Network Adapters and Drivers <br/>iTunes <br/>Jasc Paint Shop Photo Album <br/>Jasc Paint Shop Pro 8 Dell Edition <br/>Java(TM) 6 Update 5 <br/>LiveUpdate (Symantec Corporation) <br/>Malwarebytes' Anti-Malware <br/>Mavis Beacon Teaches Typing 15 <br/>Microsoft .NET Framework 1.1 <br/>Microsoft .NET Framework 1.1 Security Update (KB953297) <br/>Microsoft Internationalized Domain Names Mitigation APIs <br/>Microsoft National Language Support Downlevel APIs <br/>Microsoft Office Standard Edition 2003 <br/>Microsoft Silverlight <br/>Microsoft User-Mode Driver Framework Feature Pack 1.0 <br/>Microsoft VC9 runtime libraries <br/>Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 <br/>Microsoft Visual C++ 2005 Redistributable <br/>Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 <br/>Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 <br/>Move Networks Media Player for Internet Explorer <br/>MSXML 4.0 SP2 (KB936181) <br/>MSXML 4.0 SP2 (KB954430) <br/>MySpaceIM <br/>Netflix Movie Viewer <br/>Norton 360 <br/>Norton 360 (Symantec Corporation) <br/>Norton 360 HTMLHelp <br/>Norton Confidential Core <br/>NVIDIA Windows 2000/XP Display Drivers <br/>OLYMPUS CAMEDIA Master 4.0 <br/>Overland <br/>Palm <br/>PhotoGallery <br/>Photosmart 320,370,7400,8100,8400 Series <br/>PowerDVD <br/>PrintScreen <br/>PS320 <br/>PSPrinters06 <br/>QFolder <br/>QuickProjects <br/>QuickTime <br/>RealPlayer <br/>RegCure 1.5.0.0 <br/>SAMSUNG Mobile USB DRIVER(4.40.7.0) v1.6 <br/>Security Update for Windows Internet Explorer 7 (KB938127) <br/>Security Update for Windows Internet Explorer 7 (KB942615) <br/>Security Update for Windows Internet Explorer 7 (KB944533) <br/>Security Update for Windows Internet Explorer 7 (KB950759) <br/>Security Update for Windows Internet Explorer 7 (KB953838) <br/>Security Update for Windows Internet Explorer 7 (KB956390) <br/>Security Update for Windows Internet Explorer 7 (KB958215) <br/>Security Update for Windows Internet Explorer 7 (KB960714) <br/>Security Update for Windows Internet Explorer 7 (KB961260) <br/>Security Update for Windows Internet Explorer 7 (KB963027) <br/>Security Update for Windows Internet Explorer 7 (KB969897) <br/>Security Update for Windows Internet Explorer 7 (KB972260) <br/>Security Update for Windows Internet Explorer 7 (KB974455) <br/>Security Update for Windows Media Player (KB911564) <br/>Security Update for Windows Media Player (KB952069) <br/>Security Update for Windows Media Player (KB954155) <br/>Security Update for Windows Media Player (KB968816) <br/>Security Update for Windows Media Player (KB973540) <br/>Security Update for Windows Media Player 10 (KB936782) <br/>Security Update for Windows Media Player 6.4 (KB925398) <br/>Security Update for Windows Media Player 8 (KB917734) <br/>Security Update for Windows Media Player 9 (KB911565) <br/>Security Update for Windows Media Player 9 (KB936782) <br/>Security Update for Windows XP (KB923561) <br/>Security Update for Windows XP (KB938464) <br/>Security Update for Windows XP (KB941569) <br/>Security Update for Windows XP (KB946648) <br/>Security Update for Windows XP (KB950760) <br/>Security Update for Windows XP (KB950762) <br/>Security Update for Windows XP (KB950974) <br/>Security Update for Windows XP (KB951066) <br/>Security Update for Windows XP (KB951376-v2) <br/>Security Update for Windows XP (KB951376) <br/>Security Update for Windows XP (KB951698) <br/>Security Update for Windows XP (KB951748) <br/>Security Update for Windows XP (KB952004) <br/>Security Update for Windows XP (KB952954) <br/>Security Update for Windows XP (KB953839) <br/>Security Update for Windows XP (KB954211) <br/>Security Update for Windows XP (KB954459) <br/>Security Update for Windows XP (KB954600) <br/>Security Update for Windows XP (KB955069) <br/>Security Update for Windows XP (KB956391) <br/>Security Update for Windows XP (KB956572) <br/>Security Update for Windows XP (KB956744) <br/>Security Update for Windows XP (KB956802) <br/>Security Update for Windows XP (KB956803) <br/>Security Update for Windows XP (KB956841) <br/>Security Update for Windows XP (KB956844) <br/>Security Update for Windows XP (KB957095) <br/>Security Update for Windows XP (KB957097) <br/>Security Update for Windows XP (KB958644) <br/>Security Update for Windows XP (KB958687) <br/>Security Update for Windows XP (KB958690) <br/>Security Update for Windows XP (KB958869) <br/>Security Update for Windows XP (KB959426) <br/>Security Update for Windows XP (KB960225) <br/>Security Update for Windows XP (KB960715) <br/>Security Update for Windows XP (KB960803) <br/>Security Update for Windows XP (KB960859) <br/>Security Update for Windows XP (KB961371) <br/>Security Update for Windows XP (KB961373) <br/>Security Update for Windows XP (KB961501) <br/>Security Update for Windows XP (KB968537) <br/>Security Update for Windows XP (KB969059) <br/>Security Update for Windows XP (KB969898) <br/>Security Update for Windows XP (KB969947) <br/>Security Update for Windows XP (KB970238) <br/>Security Update for Windows XP (KB971486) <br/>Security Update for Windows XP (KB971557) <br/>Security Update for Windows XP (KB971633) <br/>Security Update for Windows XP (KB971657) <br/>Security Update for Windows XP (KB971961) <br/>Security Update for Windows XP (KB973346) <br/>Security Update for Windows XP (KB973354) <br/>Security Update for Windows XP (KB973507) <br/>Security Update for Windows XP (KB973525) <br/>Security Update for Windows XP (KB973869) <br/>Security Update for Windows XP (KB974112) <br/>Security Update for Windows XP (KB974571) <br/>Security Update for Windows XP (KB975025) <br/>Security Update for Windows XP (KB975467) <br/>SkinsHP1 <br/>Sonic DLA <br/>Sonic RecordNow! <br/>Sonic Update Manager <br/>Sound Blaster Live! <br/>SoundMAX <br/>SPBBC 32bit <br/>Sprint music manager <br/>Spyware Doctor 7.0 <br/>Symantec Real Time Storage Protection Component <br/>Symantec Technical Support Controls <br/>SymNet <br/>teddypropsal <br/>Themexp.org File <br/>TrayApp <br/>Ulead Photo Explorer 8.0 SE Basic <br/>Ulead Photo Express 5 SE <br/>Unity Web Player <br/>Unload <br/>Update for Windows Internet Explorer 7 (KB976749) <br/>Update for Windows XP (KB951072-v2) <br/>Update for Windows XP (KB951978) <br/>Update for Windows XP (KB955839) <br/>Update for Windows XP (KB967715) <br/>Update for Windows XP (KB968389) <br/>Update for Windows XP (KB973815) <br/>V5385 Digital Camera Driver <br/>VideoLAN VLC media player 0.8.6d <br/>Viewpoint Media Player <br/>WebFldrs XP <br/>WebReg <br/>Windows Backup Utility <br/>Windows Genuine Advantage Validation Tool (KB892130) <br/>Windows Internet Explorer 7 <br/>Windows Media Format 11 runtime <br/>Windows Media Player 10 <br/>Windows XP Service Pack 3 <br/>WinZip 11.1 <br/>Yontoo Layers Client 1.10.01 <br/> <br/>==== Event Viewer Messages From Past Week ======== <br/> <br/>11/14/2009 7:21:46 PM, error: Service Control Manager [7034] - The Browser Defender Update Service service terminated unexpectedly. It has done this 1 time(s). <br/>11/14/2009 7:17:35 PM, error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service. <br/> <br/>==== End Of File ===========================
Post attachments:
Posted 11/26/2009 2:46 PM
#80157
User avatar

Touch Advanced member

Date Joined Nov 2016
Total Posts: 12976
Hello, and welcome to BG :smile: <br/> <br/> <br/> <br/> <br/> <br/><SPAN class=postbody><SPAN style="FONT-FAMILY: Verdana; COLOR: black; FONT-SIZE: 9pt; mso-bidi-font-family: Tahoma; mso-ansi-language: EN-GB" lang=EN-GB>Please download Combofix from:<SPAN class=postbody><SPAN style="FONT-FAMILY: Verdana; FONT-SIZE: 9pt; mso-bidi-font-family: Tahoma; mso-ansi-language: EN-GB" lang=EN-GB><?xml:namespace prefix = o ns = "urn:schemas-microsoft-com:office:office" /><o:p></o:p> <br/> <br/><SPAN style="FONT-FAMILY: Verdana; COLOR: black; FONT-SIZE: 9pt; mso-ansi-language: EN-US; mso-bidi-font-size: 11.0pt" lang=EN-US> <SPAN style="FONT-FAMILY: Verdana; COLOR: black; FONT-SIZE: 8.5pt"><SPAN style="mso-ansi-language: EN-GB" lang=EN-GB>http://download.bleepingcomputer.com/sUBs/ComboFix.exe<SPAN style="mso-ansi-language: EN-GB" lang=EN-GB><o:p></o:p> <br/> <br/><SPAN style="FONT-FAMILY: Verdana; COLOR: black; FONT-SIZE: 9pt; mso-ansi-language: EN-GB; mso-bidi-font-size: 11.0pt" lang=EN-GB> <o:p></o:p> <br/> <br/><SPAN style="FONT-FAMILY: Verdana; COLOR: black; FONT-SIZE: 9pt; mso-ansi-language: EN-GB; mso-bidi-font-size: 11.0pt" lang=EN-GB> <SPAN class=postbody><SPAN style="FONT-FAMILY: Verdana; COLOR: black; FONT-SIZE: 9pt; mso-bidi-font-family: Tahoma; mso-ansi-language: EN-GB" lang=EN-GB>And save to the desktop.<SPAN class=postbody><SPAN style="FONT-FAMILY: Verdana; FONT-SIZE: 9pt; mso-bidi-font-family: Tahoma; mso-ansi-language: EN-GB" lang=EN-GB><o:p></o:p> <br/> <br/><SPAN style="FONT-FAMILY: Verdana; COLOR: black; FONT-SIZE: 9pt; mso-ansi-language: EN-GB; mso-bidi-font-size: 11.0pt" lang=EN-GB> <br/><SPAN style="FONT-FAMILY: Verdana; COLOR: black; FONT-SIZE: 9pt; mso-ansi-language: EN; mso-bidi-font-size: 11.0pt" lang=EN>Close all other browser windows.<o:p></o:p> <br/> <br/><SPAN style="FONT-FAMILY: Verdana; COLOR: black; FONT-SIZE: 9pt; mso-ansi-language: EN; mso-bidi-font-size: 11.0pt" lang=EN> <o:p></o:p> <br/> <br/><SPAN style="FONT-FAMILY: Verdana; COLOR: black; FONT-SIZE: 9pt; mso-ansi-language: EN-GB" lang=EN-GB>Double-click on the combofix icon found on your desktop. <o:p></o:p> <br/> <br/><SPAN style="FONT-FAMILY: Verdana; COLOR: black; FONT-SIZE: 9pt; mso-ansi-language: EN-GB" lang=EN-GB> <o:p></o:p> <br/> <br/><B style="mso-bidi-font-weight: normal"><SPAN style="FONT-FAMILY: Verdana; COLOR: black; FONT-SIZE: 9pt; mso-ansi-language: EN-GB; mso-bidi-font-size: 11.0pt" lang=EN-GB>Please note, that once you start combofix you should not click anywhere on the combofix window as it can cause the program to stall. In fact, when combofix is running, do not touch your computer at all and just take a break as it may take a while for it to complete.<o:p></o:p></B> <br/> <br/><SPAN style="FONT-FAMILY: Verdana; COLOR: black; FONT-SIZE: 9pt; mso-ansi-language: EN-GB; mso-bidi-font-size: 11.0pt" lang=EN-GB> <br/><SPAN class=postbody><SPAN style="FONT-FAMILY: Verdana; COLOR: black; FONT-SIZE: 9pt; mso-bidi-font-family: Tahoma; mso-ansi-language: EN-GB" lang=EN-GB><SPAN style="mso-spacerun: yes"> When finished, it will produce a logfile located at C:\combofix.txt.<SPAN class=postbody><SPAN style="FONT-FAMILY: Verdana; FONT-SIZE: 9pt; mso-bidi-font-family: Tahoma; mso-ansi-language: EN-GB" lang=EN-GB><o:p></o:p> <br/> <br/><SPAN class=postbody><SPAN style="FONT-FAMILY: Verdana; COLOR: black; FONT-SIZE: 9pt; mso-bidi-font-family: Tahoma; mso-ansi-language: EN-GB" lang=EN-GB> <SPAN class=postbody><SPAN style="FONT-FAMILY: Verdana; FONT-SIZE: 9pt; mso-bidi-font-family: Tahoma; mso-ansi-language: EN-GB" lang=EN-GB><o:p></o:p> <br/> <br/><SPAN style="FONT-FAMILY: Verdana; COLOR: black; FONT-SIZE: 9pt; mso-ansi-language: EN-GB; mso-bidi-font-size: 11.0pt" lang=EN-GB> <br/><SPAN class=postbody><SPAN style="FONT-FAMILY: Verdana; COLOR: black; FONT-SIZE: 9pt; mso-bidi-font-family: Tahoma; mso-ansi-language: EN-GB" lang=EN-GB>Post the contents of that log in your next reply <o:p></o:p> <br/> <br/><SPAN class=postbody><SPAN style="FONT-FAMILY: Verdana; COLOR: black; FONT-SIZE: 9pt; mso-bidi-font-family: Tahoma; mso-ansi-language: EN-GB" lang=EN-GB> <o:p></o:p> <br/><SPAN style="FONT-FAMILY: Verdana; COLOR: black; FONT-SIZE: 9pt; mso-bidi-font-family: 'Times New Roman'; mso-ansi-language: EN; mso-fareast-font-family: 'Times New Roman'; mso-bidi-font-size: 12.0pt; mso-fareast-language: DA; mso-bidi-language: AR-SA" lang=EN>The logs will be reasonably large so you may have to divide them into sections and make several posts to post them.<BR style="mso-special-character: line-break"><BR style="mso-special-character: line-break">

[color=black face="Courier New" sab="311">[2]Click here: Before-posting-a-log[/2][/url]

<?xml:namespace prefix = o ns = "urn:schemas-microsoft-com:office:office" />
[/color]
Do not PM me with logfiles. They will be deleted.


Posted 11/26/2009 4:43 PM
#80165
User avatar

drakan3187 Member

Date Joined Nov 2016
Total Posts: 4
Thank you <br/> <br/> <br/>Combofix log: <br/> <br/> <br/> <br/> ComboFix 09-11-25.05 - Marnie 11/26/2009 11:16.1.1 - x86 <br/>Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.304 [GMT -5:00] <br/>Running from: c:\documents and settings\Marnie\Desktop\ComboFix.exe <br/>AV: Norton 360 *On-access scanning disabled* (Updated) {A5F1BC7C-EA33-4247-961C-0217208396C4} <br/>FW: Norton 360 *disabled* {371C0A40-5A0C-4AD2-A6E5-69C02037FBF3} <br/>. <br/> <br/>((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) <br/>. <br/> <br/>c:\documents and settings\Marnie\My Documents\ZbThumbnail.info <br/>C:\log.udt <br/>c:\windows\system32\Data <br/> <br/>. <br/>((((((((((((((((((((((((( Files Created from 2009-10-26 to 2009-11-26 ))))))))))))))))))))))))))))))) <br/>. <br/> <br/>2009-11-21 18:03 . 2009-11-21 18:03 34816 ----a-w- c:\windows\system32\drivers\rootrepeal.sys <br/>2009-11-21 17:50 . 2009-11-21 17:51 -------- d-----w- C:\rsit <br/>2009-11-21 16:29 . 2009-11-21 16:29 -------- d-----w- c:\documents and settings\Marnie\Application Data\Malwarebytes <br/>2009-11-21 16:28 . 2009-09-10 19:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys <br/>2009-11-21 16:28 . 2009-11-21 16:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes <br/>2009-11-21 16:28 . 2009-09-10 19:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys <br/>2009-11-21 16:28 . 2009-11-21 16:28 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware <br/>2009-11-21 16:23 . 2009-11-21 16:23 -------- d-----w- c:\program files\Trend Micro <br/>2009-11-21 16:12 . 2001-08-17 18:48 12160 -c--a-w- c:\windows\system32\dllcache\mouhid.sys <br/>2009-11-21 16:12 . 2001-08-17 18:48 12160 ----a-w- c:\windows\system32\drivers\mouhid.sys <br/>2009-11-21 16:12 . 2008-04-13 19:45 10368 -c--a-w- c:\windows\system32\dllcache\hidusb.sys <br/>2009-11-21 16:12 . 2008-04-13 19:45 10368 ----a-w- c:\windows\system32\drivers\hidusb.sys <br/>2009-11-14 21:46 . 2009-11-21 17:42 -------- d-----w- c:\documents and settings\Marnie\Local Settings\Application Data\aamqsp <br/>2009-11-09 23:57 . 2009-11-09 23:57 -------- d-----w- c:\documents and settings\Marnie\Local Settings\Application Data\Threat Expert <br/>2009-11-09 23:44 . 2009-10-08 16:31 767952 ----a-w- c:\windows\BDTSupport.dll <br/>2009-11-09 23:44 . 2009-10-08 16:31 149456 ----a-w- c:\windows\SGDetectionTool.dll <br/>2009-11-09 23:44 . 2009-10-08 16:31 165840 ----a-w- c:\windows\PCTBDRes.dll <br/>2009-11-09 23:44 . 2009-10-08 16:31 1636304 ----a-w- c:\windows\PCTBDCore.dll <br/>2009-11-09 23:44 . 2009-10-02 19:19 1152470 ----a-w- c:\windows\UDB.zip <br/>2009-11-09 23:44 . 2008-11-26 17:08 131 ----a-w- c:\windows\IDB.zip <br/>2009-11-09 23:38 . 2009-09-24 13:55 229304 ----a-w- c:\windows\system32\drivers\pctgntdi.sys <br/>2009-11-09 23:37 . 2009-10-06 21:31 87784 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys <br/>2009-11-09 23:37 . 2009-09-23 21:10 207280 ----a-w- c:\windows\system32\drivers\PCTCore.sys <br/>2009-11-09 23:37 . 2009-09-03 14:45 70408 ----a-w- c:\windows\system32\drivers\pctplsg.sys <br/>2009-11-09 23:36 . 2009-11-10 00:14 -------- d-----w- c:\program files\Spyware Doctor <br/>2009-11-09 23:36 . 2009-11-09 23:45 -------- d-----w- c:\program files\Common Files\PC Tools <br/>2009-11-09 23:36 . 2009-11-09 23:36 -------- d-----w- c:\documents and settings\Marnie\Application Data\PC Tools <br/>2009-11-09 23:36 . 2009-11-09 23:36 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools <br/>2009-11-08 14:01 . 2009-11-08 14:22 -------- d-----w- c:\documents and settings\Marnie\Local Settings\Application Data\iqvost <br/>2009-11-01 15:18 . 2009-11-01 15:54 -------- d-----w- c:\program files\ahdosw <br/>2009-11-01 11:00 . 2009-11-01 11:00 -------- d-----w- c:\documents and settings\Marnie\Local Settings\Application Data\Temp <br/> <br/>. <br/>(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) <br/>. <br/>2009-11-26 16:08 . 2008-03-28 10:46 -------- d-----w- c:\program files\Common Files\Symantec Shared <br/>2009-11-26 16:03 . 2008-11-25 02:03 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP <br/>2009-11-25 04:37 . 2008-03-28 10:46 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec <br/>2009-10-20 18:06 . 2009-10-20 18:06 -------- d-----w- c:\program files\Microsoft Silverlight <br/>2009-10-17 00:00 . 2009-10-17 00:00 -------- d-----w- c:\documents and settings\Marnie\Application Data\vlc <br/>2009-10-16 00:38 . 2009-10-16 00:36 -------- d-----w- c:\program files\Graboid <br/>2009-10-16 00:37 . 2009-10-16 00:37 -------- d-----w- c:\program files\VideoLAN <br/>2009-10-05 23:23 . 2009-10-05 23:23 -------- d-----w- c:\program files\Samsung <br/>2009-10-05 23:22 . 2008-03-25 17:25 -------- d--h--w- c:\program files\InstallShield Installation Information <br/>2009-10-03 00:11 . 2009-10-03 00:11 -------- d-----w- c:\program files\Yontoo Layers Client <br/>2009-10-03 00:11 . 2009-10-03 00:11 -------- d-----w- c:\documents and settings\All Users\Application Data\Tarma Installer <br/>2009-09-30 18:58 . 2008-02-18 19:38 9576 ----a-w- c:\documents and settings\All Users\Application Data\Symantec\LiveUpdate\LuRegManifests\Static\CCMSLLUM.DLL <br/>2009-09-29 01:30 . 2009-10-03 00:11 108032 --s-a-r- c:\documents and settings\All Users\Application Data\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setup.dll <br/>2009-09-29 01:30 . 2009-10-03 00:11 161792 --s-a-r- c:\documents and settings\All Users\Application Data\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll <br/>2009-09-11 19:16 . 2008-03-28 10:17 37888 ----a-w- c:\documents and settings\Marnie\Local Settings\Application Data\GDIPFONTCACHEV1.DAT <br/>2009-09-11 14:18 . 2003-07-16 20:36 136192 ----a-w- c:\windows\system32\msv1_0.dll <br/>2009-09-11 06:41 . 2009-10-03 00:11 224256 --s---r- c:\documents and settings\All Users\Application Data\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.exe <br/>2009-09-10 20:11 . 2009-09-10 20:11 488968 ----a-w- c:\documents and settings\Marnie\Application Data\Real\Update\temp\~Upg0\setup.exe <br/>2009-09-04 21:03 . 2003-07-16 20:35 58880 ----a-w- c:\windows\system32\msasn1.dll <br/>2009-08-29 07:36 . 2006-06-23 16:33 832512 ----a-w- c:\windows\system32\wininet.dll <br/>2009-08-29 07:36 . 2004-08-04 07:56 78336 ----a-w- c:\windows\system32\ieencode.dll <br/>2009-08-29 07:36 . 2003-07-16 20:25 17408 ------w- c:\windows\system32\corpol.dll <br/>. <br/> <br/>((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) <br/>. <br/>. <br/>*Note* empty entries & legit default entries are not shown <br/>REGEDIT4 <br/> <br/>[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}] <br/>2009-09-25 19:22 194912 ------w- c:\program files\Yontoo Layers Client\YontooIEClient.dll <br/> <br/>[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] <br/>"Aim6"="c:\program files\AIM6\aim6.exe" [2009-05-19 49968] <br/> <br/>[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] <br/>"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-11-03 4800512] <br/>"dla"="c:\windows\system32\dla\tfswctrl.exe" [2003-08-06 114741] <br/>"StorageGuard"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-02-13 155648] <br/>"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-10-17 51048] <br/>"osCheck"="c:\program files\Norton 360\osCheck.exe" [2008-02-26 988512] <br/>"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-04-07 185896] <br/>"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-04 413696] <br/>"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080] <br/> <br/>[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] <br/>"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2008-12-12 9555968] <br/> <br/>[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist] <br/>2009-07-08 20:47 10536 ----a-w- c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll <br/> <br/>[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HotSync Manager.lnk] <br/>path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HotSync Manager.lnk <br/>backup=c:\windows\pss\HotSync Manager.lnkCommon Startup <br/> <br/>[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk] <br/>path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk <br/>backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup <br/> <br/>[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk] <br/>path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk <br/>backup=c:\windows\pss\HP Image Zone Fast Start.lnkCommon Startup <br/> <br/>[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Personal Coach.lnk] <br/>path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Personal Coach.lnk <br/>backup=c:\windows\pss\Personal Coach.lnkCommon Startup <br/> <br/>[HKLM\~\startupfolder\C:^Documents and Settings^Marnie^Start Menu^Programs^Startup^MEMonitor.lnk] <br/>path=c:\documents and settings\Marnie\Start Menu\Programs\Startup\MEMonitor.lnk <br/>backup=c:\windows\pss\MEMonitor.lnkStartup <br/> <br/>[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] <br/>"DisableMonitoring"=dword:00000001 <br/> <br/>[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] <br/>"DisableMonitoring"=dword:00000001 <br/> <br/>[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] <br/>"DisableMonitoring"=dword:00000001 <br/> <br/>[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] <br/>"EnableFirewall"= 0 (0x0) <br/> <br/>[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] <br/>"%windir%\\system32\\sessmgr.exe"= <br/>"%windir%\\Network Diagnostic\\xpnetdiag.exe"= <br/>"c:\\Program Files\\IncrediMail\\bin\\ImApp.exe"= <br/>"c:\\Program Files\\IncrediMail\\bin\\IncMail.exe"= <br/>"c:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"= <br/>"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= <br/>"c:\\Program Files\\AIM6\\aim6.exe"= <br/>"c:\\Program Files\\Ares\\Ares.exe"= <br/>"c:\\Program Files\\Bonjour\\mDNSResponder.exe"= <br/>"c:\\Program Files\\iTunes\\iTunes.exe"= <br/>"c:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"= <br/> <br/>[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] <br/>"13848:TCP"= 13848:TCP:BitComet 13848 TCP <br/>"13848:UDP"= 13848:UDP:BitComet 13848 UDP <br/> <br/>R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [11/9/2009 6:37 PM 207280] <br/>R2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\Spyware Doctor\BDT\BDTUpdateService.exe [11/9/2009 6:44 PM 112592] <br/>R2 LiveUpdate Notice;LiveUpdate Notice;c:\program files\Common Files\Symantec Shared\CCSVCHST.EXE [2/18/2008 2:37 PM 149352] <br/>R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [6/9/2004 12:30 PM 24652] <br/>R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [8/29/2009 4:15 AM 102448] <br/>S0 e244b8de60491926380db35e44121e6e;e244b8de60491926380db35e44121e6e;c:\windows\system32\e244b8de60491926380db35e44121e6e.sys --> c:\windows\system32\e244b8de60491926380db35e44121e6e.sys [?] <br/>S2 gupdate1c9e0bdb40deb2;Google Update Service (gupdate1c9e0bdb40deb2);c:\program files\Google\Update\GoogleUpdate.exe [5/29/2009 7:24 PM 133104] <br/>S3 COH_Mon;COH_Mon;c:\windows\system32\drivers\COH_Mon.sys [1/12/2008 9:32 PM 23888] <br/> <br/>--- Other Services/Drivers In Memory --- <br/> <br/>*NewlyCreated* - COMHOST <br/>. <br/>Contents of the 'Scheduled Tasks' folder <br/> <br/>2009-11-23 c:\windows\Tasks\AppleSoftwareUpdate.job <br/>- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34] <br/> <br/>2009-11-26 c:\windows\Tasks\Google Software Updater.job <br/>- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-05-30 00:22] <br/> <br/>2009-11-26 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job <br/>- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-30 00:24] <br/> <br/>2009-11-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job <br/>- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-30 00:24] <br/> <br/>2009-11-26 c:\windows\Tasks\HP Usg Daily FY04.job <br/>- c:\program files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\pexpress\hphped06.exe [2004-06-07 04:53] <br/> <br/>2009-11-26 c:\windows\Tasks\RegCure Program Check.job <br/>- c:\program files\RegCure\RegCure.exe [2007-08-02 16:20] <br/> <br/>2009-11-05 c:\windows\Tasks\RegCure.job <br/>- c:\program files\RegCure\RegCure.exe [2007-08-02 16:20] <br/>. <br/>. <br/>------- Supplementary Scan ------- <br/>. <br/>uStart Page = hxxp://www.pogo.com/home/home.do <br/>IE: &Search <br/>IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 <br/>DPF: {9C23D886-43CB-43DE-B2DB-112A68D7E10A} - hxxp://lads.myspace.com/upload/MySpaceUploader2.cab <br/>DPF: {D71F9A27-723E-4B8B-B428-B725E47CBA3E} - hxxp://imikimi.com/download/imikimi_plugin_0.5.1.cab <br/>DPF: {E93E9DF0-3E59-4331-A269-F1E077C66F00} - hxxp://cnn-5.vo.llnwd.net/c1/static/client/browserplayer/gtplugin.cab <br/>. <br/>- - - - ORPHANS REMOVED - - - - <br/> <br/>AddRemove-RealJukebox 1.0 - c:\program files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0 <br/>AddRemove-RealPlayer 6.0 - c:\program files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0 <br/> <br/> <br/> <br/>************************************************************************** <br/> <br/>catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net <br/>Rootkit scan 2009-11-26 11:28 <br/>Windows 5.1.2600 Service Pack 3 NTFS <br/> <br/>scanning hidden processes ... <br/> <br/>scanning hidden autostart entries ... <br/> <br/>scanning hidden files ... <br/> <br/> <br/>************************************************************************** <br/>. <br/>--------------------- DLLs Loaded Under Running Processes --------------------- <br/> <br/>- - - - - - - > 'winlogon.exe'(912) <br/>c:\program files\Citrix\GoToAssist\514\G2AWinLogon.dll <br/>. <br/>Completion time: 2009-11-26 11:33 <br/>ComboFix-quarantined-files.txt 2009-11-26 16:31 <br/> <br/>Pre-Run: 85,124,714,496 bytes free <br/>Post-Run: 85,543,800,832 bytes free <br/> <br/>WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe <br/>[boot loader] <br/>timeout=2 <br/>default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS <br/>[operating systems] <br/>c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons <br/>multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn <br/> <br/>- - End Of File - - F325BFFBE073C296A9FD4073F2D80AB1
Posted 11/27/2009 5:02 AM
#80190
User avatar

Touch Advanced member

Date Joined Nov 2016
Total Posts: 12976
<SPAN style="FONT-FAMILY: Verdana; COLOR: #222222; FONT-SIZE: 9pt; mso-ansi-language: EN-GB" lang=EN-GB>Open notepad and copy/paste the bold text in the codebox below into it:<?xml:namespace prefix = o ns = "urn:schemas-microsoft-com:office:office" /><o:p></o:p> <br/> <br/><SPAN style="FONT-FAMILY: Verdana; COLOR: #222222; FONT-SIZE: 9pt; mso-ansi-language: EN-GB" lang=EN-GB>Name the file as CFScript <br/>and Save it on the desktop<o:p></o:p> <br/> <br/> <br/><SPAN style="FONT-FAMILY: Verdana; COLOR: silver; FONT-SIZE: 7.5pt; mso-ansi-language: EN-GB" lang=EN-GB> <o:p></o:p> <br/>Code: <br/> <br/><SPAN style="COLOR: black; mso-ansi-language: EN-GB" lang=EN-GB>Killall::<o:p></o:p> <br/> <br/><SPAN style="COLOR: black; mso-ansi-language: EN-GB" lang=EN-GB>Snapshot::<o:p></o:p> <br/> <br/><SPAN style="COLOR: black; mso-ansi-language: DE" lang=DE>File:: <br/><SPAN style="COLOR: black; FONT-SIZE: 8pt; mso-ansi-language: DE" lang=DE>c:\windows\system32\e244b8de60491926380db35e44121e6e.sys <o:p></o:p> <br/> <br/><SPAN style="COLOR: black; FONT-SIZE: 8pt; mso-ansi-language: DE" lang=DE>Rootkit::<o:p></o:p> <br/> <br/><SPAN style="COLOR: black; FONT-SIZE: 8pt; mso-ansi-language: DE" lang=DE>c:\windows\system32\e244b8de60491926380db35e44121e6e.sys<o:p></o:p> <br/> <br/><SPAN style="COLOR: black; FONT-SIZE: 8pt; mso-ansi-language: EN-GB" lang=EN-GB>Dirlook::<o:p></o:p> <br/> <br/><SPAN style="COLOR: black; FONT-SIZE: 8pt; mso-ansi-language: EN-GB" lang=EN-GB>c:\documents and settings\Marnie\Local Settings\Application Data\iqvost <br/>c:\program files\ahdosw<o:p></o:p> <br/> <br/><SPAN style="COLOR: black; FONT-SIZE: 8pt; mso-ansi-language: EN-GB" lang=EN-GB>Tasks::<o:p></o:p> <br/> <br/><SPAN style="COLOR: black; FONT-SIZE: 8pt; mso-ansi-language: DE" lang=DE>Driver::<o:p></o:p> <br/> <br/><SPAN style="COLOR: black; FONT-SIZE: 8pt; mso-ansi-language: DE" lang=DE>e244b8de60491926380db35e44121e6e<o:p></o:p> <br/> <br/> <br/> <br/> <br/><SPAN style="FONT-FAMILY: Verdana; COLOR: black; FONT-SIZE: 9pt; mso-ansi-language: EN-GB; mso-bidi-font-size: 12.0pt" lang=EN-GB>User image <br/> <br/><SPAN style="FONT-FAMILY: Verdana; COLOR: black; FONT-SIZE: 9pt; mso-ansi-language: EN-GB; mso-bidi-font-size: 12.0pt" lang=EN-GB> <o:p></o:p> <br/> <br/><SPAN style="FONT-FAMILY: Verdana; COLOR: black; FONT-SIZE: 9pt; mso-ansi-language: EN-GB; mso-bidi-font-size: 12.0pt" lang=EN-GB>Once saved, refering to the picture above, drag CFScript.txt into ComboFix.exe. <br/> <br/><SPAN style="FONT-FAMILY: Verdana; COLOR: black; FONT-SIZE: 9pt; mso-ansi-language: EN-GB; mso-bidi-font-size: 12.0pt" lang=EN-GB><o:p></o:p> <br/> <br/><SPAN style="FONT-FAMILY: Verdana; COLOR: black; FONT-SIZE: 9pt; mso-ansi-language: EN-GB; mso-bidi-font-size: 12.0pt" lang=EN-GB> <o:p></o:p> <br/> <br/><SPAN style="FONT-FAMILY: Verdana; COLOR: black; FONT-SIZE: 9pt; mso-ansi-language: EN-GB; mso-bidi-font-size: 12.0pt" lang=EN-GB>Combofix will create a logfile and display it after your computer has rebooted. Usually located in c:\combofix.txt, please post it to your next reply<o:p></o:p> <br/> <br/><SPAN style="FONT-FAMILY: Verdana; COLOR: black; FONT-SIZE: 9pt; mso-ansi-language: EN-GB; mso-bidi-font-size: 12.0pt" lang=EN-GB> <o:p></o:p>

[color=black face="Courier New" sab="311">[2]Click here: Before-posting-a-log[/2][/url]

<?xml:namespace prefix = o ns = "urn:schemas-microsoft-com:office:office" />
[/color]
Do not PM me with logfiles. They will be deleted.


Posted 11/28/2009 6:49 PM
#80268
User avatar

drakan3187 Member

Date Joined Nov 2016
Total Posts: 4
ComboFix 09-11-27.07 - Marnie 11/28/2009 12:25.2.1 - x86 <br/>Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.243 [GMT -5:00] <br/>Running from: c:\documents and settings\Marnie\Desktop\ComboFix.exe <br/>Command switches used :: c:\documents and settings\Marnie\Desktop\CFScript.txt <br/>AV: Norton 360 *On-access scanning disabled* (Updated) {A5F1BC7C-EA33-4247-961C-0217208396C4} <br/>FW: Norton 360 *enabled* {371C0A40-5A0C-4AD2-A6E5-69C02037FBF3} <br/>FILE :: <br/>"c:\windows\system32\e244b8de60491926380db35e44121e6e.sys" <br/>. <br/> <br/>((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) <br/>. <br/> <br/>c:\documents and settings\Marnie\My Documents\ZbThumbnail.info <br/>C:\LOG.TXT <br/> <br/>. <br/>((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) <br/>. <br/> <br/>-------\Legacy_E244B8DE60491926380DB35E44121E6E <br/>-------\Service_e244b8de60491926380db35e44121e6e <br/> <br/> <br/>((((((((((((((((((((((((( Files Created from 2009-10-28 to 2009-11-28 ))))))))))))))))))))))))))))))) <br/>. <br/> <br/>2009-11-21 18:03 . 2009-11-21 18:03 34816 ----a-w- c:\windows\system32\drivers\rootrepeal.sys <br/>2009-11-21 17:50 . 2009-11-21 17:51 -------- d-----w- C:\rsit <br/>2009-11-21 16:29 . 2009-11-21 16:29 -------- d-----w- c:\documents and settings\Marnie\Application Data\Malwarebytes <br/>2009-11-21 16:28 . 2009-09-10 19:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys <br/>2009-11-21 16:28 . 2009-11-21 16:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes <br/>2009-11-21 16:28 . 2009-09-10 19:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys <br/>2009-11-21 16:28 . 2009-11-21 16:28 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware <br/>2009-11-21 16:23 . 2009-11-21 16:23 -------- d-----w- c:\program files\Trend Micro <br/>2009-11-21 16:12 . 2001-08-17 18:48 12160 -c--a-w- c:\windows\system32\dllcache\mouhid.sys <br/>2009-11-21 16:12 . 2001-08-17 18:48 12160 ----a-w- c:\windows\system32\drivers\mouhid.sys <br/>2009-11-21 16:12 . 2008-04-13 19:45 10368 -c--a-w- c:\windows\system32\dllcache\hidusb.sys <br/>2009-11-21 16:12 . 2008-04-13 19:45 10368 ----a-w- c:\windows\system32\drivers\hidusb.sys <br/>2009-11-14 21:46 . 2009-11-21 17:42 -------- d-----w- c:\documents and settings\Marnie\Local Settings\Application Data\aamqsp <br/>2009-11-09 23:57 . 2009-11-09 23:57 -------- d-----w- c:\documents and settings\Marnie\Local Settings\Application Data\Threat Expert <br/>2009-11-09 23:44 . 2009-10-08 16:31 767952 ----a-w- c:\windows\BDTSupport.dll <br/>2009-11-09 23:44 . 2009-10-08 16:31 149456 ----a-w- c:\windows\SGDetectionTool.dll <br/>2009-11-09 23:44 . 2009-10-08 16:31 165840 ----a-w- c:\windows\PCTBDRes.dll <br/>2009-11-09 23:44 . 2009-10-08 16:31 1636304 ----a-w- c:\windows\PCTBDCore.dll <br/>2009-11-09 23:44 . 2009-10-02 19:19 1152470 ----a-w- c:\windows\UDB.zip <br/>2009-11-09 23:44 . 2008-11-26 17:08 131 ----a-w- c:\windows\IDB.zip <br/>2009-11-09 23:38 . 2009-09-24 13:55 229304 ----a-w- c:\windows\system32\drivers\pctgntdi.sys <br/>2009-11-09 23:37 . 2009-10-06 21:31 87784 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys <br/>2009-11-09 23:37 . 2009-09-23 21:10 207280 ----a-w- c:\windows\system32\drivers\PCTCore.sys <br/>2009-11-09 23:37 . 2009-09-03 14:45 70408 ----a-w- c:\windows\system32\drivers\pctplsg.sys <br/>2009-11-09 23:36 . 2009-11-10 00:14 -------- d-----w- c:\program files\Spyware Doctor <br/>2009-11-09 23:36 . 2009-11-09 23:45 -------- d-----w- c:\program files\Common Files\PC Tools <br/>2009-11-09 23:36 . 2009-11-09 23:36 -------- d-----w- c:\documents and settings\Marnie\Application Data\PC Tools <br/>2009-11-09 23:36 . 2009-11-09 23:36 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools <br/>2009-11-08 14:01 . 2009-11-08 14:22 -------- d-----w- c:\documents and settings\Marnie\Local Settings\Application Data\iqvost <br/>2009-11-01 15:18 . 2009-11-01 15:54 -------- d-----w- c:\program files\ahdosw <br/>2009-11-01 11:00 . 2009-11-01 11:00 -------- d-----w- c:\documents and settings\Marnie\Local Settings\Application Data\Temp <br/> <br/>. <br/>(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) <br/>. <br/>2009-11-28 17:38 . 2008-11-25 02:03 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP <br/>2009-11-28 17:38 . 2008-03-28 10:46 -------- d-----w- c:\program files\Common Files\Symantec Shared <br/>2009-11-25 04:37 . 2008-03-28 10:46 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec <br/>2009-10-20 18:06 . 2009-10-20 18:06 -------- d-----w- c:\program files\Microsoft Silverlight <br/>2009-10-17 00:00 . 2009-10-17 00:00 -------- d-----w- c:\documents and settings\Marnie\Application Data\vlc <br/>2009-10-16 00:38 . 2009-10-16 00:36 -------- d-----w- c:\program files\Graboid <br/>2009-10-16 00:37 . 2009-10-16 00:37 -------- d-----w- c:\program files\VideoLAN <br/>2009-10-05 23:23 . 2009-10-05 23:23 -------- d-----w- c:\program files\Samsung <br/>2009-10-05 23:22 . 2008-03-25 17:25 -------- d--h--w- c:\program files\InstallShield Installation Information <br/>2009-10-03 00:11 . 2009-10-03 00:11 -------- d-----w- c:\program files\Yontoo Layers Client <br/>2009-10-03 00:11 . 2009-10-03 00:11 -------- d-----w- c:\documents and settings\All Users\Application Data\Tarma Installer <br/>2009-09-30 18:58 . 2008-02-18 19:38 9576 ----a-w- c:\documents and settings\All Users\Application Data\Symantec\LiveUpdate\LuRegManifests\Static\CCMSLLUM.DLL <br/>2009-09-29 01:30 . 2009-10-03 00:11 108032 --s-a-r- c:\documents and settings\All Users\Application Data\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setup.dll <br/>2009-09-29 01:30 . 2009-10-03 00:11 161792 --s-a-r- c:\documents and settings\All Users\Application Data\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll <br/>2009-09-11 19:16 . 2008-03-28 10:17 37888 ----a-w- c:\documents and settings\Marnie\Local Settings\Application Data\GDIPFONTCACHEV1.DAT <br/>2009-09-11 14:18 . 2003-07-16 20:36 136192 ----a-w- c:\windows\system32\msv1_0.dll <br/>2009-09-11 06:41 . 2009-10-03 00:11 224256 --s---r- c:\documents and settings\All Users\Application Data\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.exe <br/>2009-09-10 20:11 . 2009-09-10 20:11 488968 ----a-w- c:\documents and settings\Marnie\Application Data\Real\Update\temp\~Upg0\setup.exe <br/>2009-09-04 21:03 . 2003-07-16 20:35 58880 ----a-w- c:\windows\system32\msasn1.dll <br/>. <br/> <br/>(((((((((((((((((((((((((((((((((((((((((((( Look ))))))))))))))))))))))))))))))))))))))))))))))))))))))))) <br/>. <br/>---- Directory of c:\documents and settings\Marnie\Local Settings\Application Data\iqvost ---- <br/> <br/> <br/>---- Directory of c:\program files\ahdosw ---- <br/> <br/> <br/> <br/>((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) <br/>. <br/>. <br/>*Note* empty entries & legit default entries are not shown <br/>REGEDIT4 <br/> <br/>[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}] <br/>2009-09-25 19:22 194912 ------w- c:\program files\Yontoo Layers Client\YontooIEClient.dll <br/> <br/>[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] <br/>"Aim6"="c:\program files\AIM6\aim6.exe" [2009-05-19 49968] <br/>"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] <br/> <br/>[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] <br/>"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-11-03 4800512] <br/>"dla"="c:\windows\system32\dla\tfswctrl.exe" [2003-08-06 114741] <br/>"StorageGuard"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-02-13 155648] <br/>"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-10-17 51048] <br/>"osCheck"="c:\program files\Norton 360\osCheck.exe" [2008-02-26 988512] <br/>"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-04-07 185896] <br/>"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-04 413696] <br/>"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080] <br/> <br/>[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] <br/>"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2008-12-12 9555968] <br/> <br/>[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist] <br/>2009-07-08 20:47 10536 ----a-w- c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll <br/> <br/>[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HotSync Manager.lnk] <br/>path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HotSync Manager.lnk <br/>backup=c:\windows\pss\HotSync Manager.lnkCommon Startup <br/> <br/>[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk] <br/>path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk <br/>backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup <br/> <br/>[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk] <br/>path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk <br/>backup=c:\windows\pss\HP Image Zone Fast Start.lnkCommon Startup <br/> <br/>[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Personal Coach.lnk] <br/>path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Personal Coach.lnk <br/>backup=c:\windows\pss\Personal Coach.lnkCommon Startup <br/> <br/>[HKLM\~\startupfolder\C:^Documents and Settings^Marnie^Start Menu^Programs^Startup^MEMonitor.lnk] <br/>path=c:\documents and settings\Marnie\Start Menu\Programs\Startup\MEMonitor.lnk <br/>backup=c:\windows\pss\MEMonitor.lnkStartup <br/> <br/>[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] <br/>"DisableMonitoring"=dword:00000001 <br/> <br/>[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] <br/>"DisableMonitoring"=dword:00000001 <br/> <br/>[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] <br/>"DisableMonitoring"=dword:00000001 <br/> <br/>[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] <br/>"EnableFirewall"= 0 (0x0) <br/> <br/>[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] <br/>"%windir%\\system32\\sessmgr.exe"= <br/>"%windir%\\Network Diagnostic\\xpnetdiag.exe"= <br/>"c:\\Program Files\\IncrediMail\\bin\\ImApp.exe"= <br/>"c:\\Program Files\\IncrediMail\\bin\\IncMail.exe"= <br/>"c:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"= <br/>"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= <br/>"c:\\Program Files\\AIM6\\aim6.exe"= <br/>"c:\\Program Files\\Ares\\Ares.exe"= <br/>"c:\\Program Files\\Bonjour\\mDNSResponder.exe"= <br/>"c:\\Program Files\\iTunes\\iTunes.exe"= <br/>"c:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"= <br/> <br/>[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] <br/>"13848:TCP"= 13848:TCP:BitComet 13848 TCP <br/>"13848:UDP"= 13848:UDP:BitComet 13848 UDP <br/> <br/>R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [11/9/2009 6:37 PM 207280] <br/>R2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\Spyware Doctor\BDT\BDTUpdateService.exe [11/9/2009 6:44 PM 112592] <br/>R2 LiveUpdate Notice;LiveUpdate Notice;c:\program files\Common Files\Symantec Shared\CCSVCHST.EXE [2/18/2008 2:37 PM 149352] <br/>R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [6/9/2004 12:30 PM 24652] <br/>R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [8/29/2009 4:15 AM 102448] <br/>S2 gupdate1c9e0bdb40deb2;Google Update Service (gupdate1c9e0bdb40deb2);c:\program files\Google\Update\GoogleUpdate.exe [5/29/2009 7:24 PM 133104] <br/>S3 COH_Mon;COH_Mon;c:\windows\system32\drivers\COH_Mon.sys [1/12/2008 9:32 PM 23888] <br/> <br/>--- Other Services/Drivers In Memory --- <br/> <br/>*NewlyCreated* - COMHOST <br/>. <br/>Contents of the 'Scheduled Tasks' folder <br/> <br/>2009-11-23 c:\windows\Tasks\AppleSoftwareUpdate.job <br/>- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34] <br/> <br/>2009-11-28 c:\windows\Tasks\Google Software Updater.job <br/>- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-05-30 00:22] <br/> <br/>2009-11-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job <br/>- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-30 00:24] <br/> <br/>2009-11-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job <br/>- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-30 00:24] <br/> <br/>2009-11-28 c:\windows\Tasks\HP Usg Daily FY04.job <br/>- c:\program files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\pexpress\hphped06.exe [2004-06-07 04:53] <br/> <br/>2009-11-28 c:\windows\Tasks\RegCure Program Check.job <br/>- c:\program files\RegCure\RegCure.exe [2007-08-02 16:20] <br/> <br/>2009-11-05 c:\windows\Tasks\RegCure.job <br/>- c:\program files\RegCure\RegCure.exe [2007-08-02 16:20] <br/>. <br/>. <br/>------- Supplementary Scan ------- <br/>. <br/>uStart Page = hxxp://www.pogo.com/home/home.do <br/>IE: &Search <br/>IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 <br/>DPF: {9C23D886-43CB-43DE-B2DB-112A68D7E10A} - hxxp://lads.myspace.com/upload/MySpaceUploader2.cab <br/>DPF: {D71F9A27-723E-4B8B-B428-B725E47CBA3E} - hxxp://imikimi.com/download/imikimi_plugin_0.5.1.cab <br/>DPF: {E93E9DF0-3E59-4331-A269-F1E077C66F00} - hxxp://cnn-5.vo.llnwd.net/c1/static/client/browserplayer/gtplugin.cab <br/>. <br/> <br/>************************************************************************** <br/> <br/>catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net <br/>Rootkit scan 2009-11-28 13:38 <br/>Windows 5.1.2600 Service Pack 3 NTFS <br/> <br/>scanning hidden processes ... <br/> <br/>scanning hidden autostart entries ... <br/> <br/>scanning hidden files ... <br/> <br/> <br/>************************************************************************** <br/>. <br/>--------------------- DLLs Loaded Under Running Processes --------------------- <br/> <br/>- - - - - - - > 'winlogon.exe'(908) <br/>c:\program files\Citrix\GoToAssist\514\G2AWinLogon.dll <br/> <br/>- - - - - - - > 'explorer.exe'(3028) <br/>c:\windows\system32\WININET.dll <br/>c:\windows\system32\IEFRAME.dll <br/>c:\progra~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL <br/>c:\windows\system32\mshtml.dll <br/>c:\windows\IME\SPGRMR.DLL <br/>c:\program files\Common Files\Microsoft Shared\INK\SKCHUI.DLL <br/>c:\windows\system32\WPDShServiceObj.dll <br/>c:\windows\system32\PortableDeviceTypes.dll <br/>c:\windows\system32\PortableDeviceApi.dll <br/>. <br/>------------------------ Other Running Processes ------------------------ <br/>. <br/>c:\windows\system32\LEXBCES.EXE <br/>c:\windows\system32\LEXPPS.EXE <br/>c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe <br/>c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe <br/>c:\program files\Bonjour\mDNSResponder.exe <br/>c:\windows\System32\CTsvcCDA.exe <br/>c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE <br/>c:\windows\System32\nvsvc32.exe <br/>c:\windows\System32\MsPMSPSv.exe <br/>c:\windows\system32\fxssvc.exe <br/>c:\program files\Canon\CAL\CALMAIN.exe <br/>c:\windows\system32\wscntfy.exe <br/>c:\program files\AIM6\aolsoftware.exe <br/>. <br/>************************************************************************** <br/>. <br/>Completion time: 2009-11-28 13:45 - machine was rebooted <br/>ComboFix-quarantined-files.txt 2009-11-28 18:44 <br/>ComboFix2.txt 2009-11-26 16:33 <br/> <br/>Pre-Run: 85,579,821,056 bytes free <br/>Post-Run: 85,785,939,968 bytes free <br/> <br/>- - End Of File - - 4EB45CBD45349D58EF51C12589256E91
Posted 11/29/2009 5:24 AM
#80284
User avatar

Touch Advanced member

Date Joined Nov 2016
Total Posts: 12976
Delete these two folders: <br/>c:\documents and settings\Marnie\Local Settings\Application Data\iqvost <br/>c:\program files\ahdosw <br/> <br/> <br/>Please post new hijackthis log and tell how things are running now ?

[color=black face="Courier New" sab="311">[2]Click here: Before-posting-a-log[/2][/url]

<?xml:namespace prefix = o ns = "urn:schemas-microsoft-com:office:office" />
[/color]
Do not PM me with logfiles. They will be deleted.


Posted 11/29/2009 4:42 PM
#80307
User avatar

drakan3187 Member

Date Joined Nov 2016
Total Posts: 4
Haven't received any of the popups since we started but they were coming and going ususallly, so hopefully they are gone thanks to you. THe computer is still running on the slower end of the spectrum but don't know if that has to do with anything. Thank you for helping us out. It is greatly appreciated. <br/> <br/> <br/> <br/> <br/>Logfile of Trend Micro HijackThis v2.0.2 <br/>Scan saved at 11:38:16 AM, on 11/29/2009 <br/>Platform: Windows XP SP3 (WinNT 5.01.2600) <br/>MSIE: Internet Explorer v7.00 (7.00.6000.16915) <br/>Boot mode: Normal <br/> <br/>Running processes: <br/>C:\WINDOWS\System32\smss.exe <br/>C:\WINDOWS\system32\winlogon.exe <br/>C:\WINDOWS\system32\services.exe <br/>C:\WINDOWS\system32\lsass.exe <br/>C:\WINDOWS\system32\svchost.exe <br/>C:\WINDOWS\system32\svchost.exe <br/>C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe <br/>C:\WINDOWS\system32\LEXBCES.EXE <br/>C:\WINDOWS\system32\LEXPPS.EXE <br/>C:\WINDOWS\system32\spoolsv.exe <br/>C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe <br/>C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe <br/>C:\Program Files\Bonjour\mDNSResponder.exe <br/>C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe <br/>C:\WINDOWS\System32\CTsvcCDA.exe <br/>C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE <br/>C:\WINDOWS\System32\nvsvc32.exe <br/>C:\WINDOWS\System32\svchost.exe <br/>C:\WINDOWS\System32\MsPMSPSv.exe <br/>C:\WINDOWS\system32\fxssvc.exe <br/>C:\Program Files\Canon\CAL\CALMAIN.exe <br/>C:\WINDOWS\system32\wscntfy.exe <br/>C:\WINDOWS\system32\ctfmon.exe <br/>C:\WINDOWS\system32\dla\tfswctrl.exe <br/>C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe <br/>C:\WINDOWS\System32\svchost.exe <br/>C:\WINDOWS\explorer.exe <br/>C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe <br/>C:\WINDOWS\System32\svchost.exe <br/>C:\Program Files\Trend Micro\HijackThis\HijackThis.exe <br/> <br/>R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.pogo.com/home/home.do <br/>R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 <br/>R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 <br/>R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 <br/>R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 <br/>O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file) <br/>O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll <br/>O2 - BHO: Browser Defender BHO - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll <br/>O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll <br/>O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\coIEPlg.dll <br/>O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll <br/>O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll <br/>O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll <br/>O2 - BHO: Yontoo Layers - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files\Yontoo Layers Client\YontooIEClient.dll <br/>O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll <br/>O3 - Toolbar: PC Tools Browser Guard - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll <br/>O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup <br/>O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe <br/>O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r <br/>O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" <br/>O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton 360\osCheck.exe" <br/>O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot <br/>O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime <br/>O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript <br/>O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp <br/>O4 - HKCU\..\RunOnce: [Shockwave Updater] C:\WINDOWS\system32\Adobe\Shockwave 11\SwHelper_1151601.exe -Update -1151601 -"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)" -"http://www.shockwave.com/gamelanding/gutterball.jsp" <br/>O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM') <br/>O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user') <br/>O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 <br/>O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll <br/>O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll <br/>O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL <br/>O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe <br/>O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe <br/>O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe <br/>O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe <br/>O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab <br/>O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - http://www.worldwinner.com/games/v50/tpir/tpir.cab <br/>O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab <br/>O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab <br/>O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab <br/>O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab <br/>O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab <br/>O16 - DPF: {9C23D886-43CB-43DE-B2DB-112A68D7E10A} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader2.cab <br/>O16 - DPF: {B516CA4E-A5BA-405C-AFCF-A97F08CC7429} (GoBit Games Player) - http://www.shockwave.com/content/burgershop/sis/GoBitGamesPlayer_v5.cab <br/>O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://games.myspace.com/Gameshell/GameHost/1.0/OberonGameHost.cab <br/>O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab <br/>O16 - DPF: {D71F9A27-723E-4B8B-B428-B725E47CBA3E} (Imikimi_activex_plugin Control) - http://imikimi.com/download/imikimi_plugin_0.5.1.cab <br/>O16 - DPF: {E93E9DF0-3E59-4331-A269-F1E077C66F00} (GameTap Web Plugin) - http://cnn-5.vo.llnwd.net/c1/static/client/browserplayer/gtplugin.cab <br/>O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll <br/>O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe <br/>O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe <br/>O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe <br/>O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe <br/>O23 - Service: Browser Defender Update Service - Threat Expert Ltd. - C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe <br/>O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe <br/>O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe <br/>O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe <br/>O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe <br/>O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe <br/>O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe <br/>O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe <br/>O23 - Service: Google Update Service (gupdate1c9e0bdb40deb2) (gupdate1c9e0bdb40deb2) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe <br/>O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe <br/>O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe <br/>O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe <br/>O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE <br/>O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE <br/>O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe <br/>O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe <br/>O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe <br/>O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe <br/>O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe <br/> <br/>-- <br/>End of file - 10610 bytes
Posted 12/2/2009 6:21 AM
#80415
User avatar

Touch Advanced member

Date Joined Nov 2016
Total Posts: 12976
Sorry for late reply. <br/> <br/> <br/> <br/> <br/><SPAN style="FONT-FAMILY: Verdana; COLOR: black; FONT-SIZE: 9pt; mso-bidi-font-family: Arial; mso-ansi-language: EN-GB; mso-bidi-font-size: 10.0pt" lang=EN-GB>Viewpoint is considered foistware and is not needed on your computer.<?xml:namespace prefix = o ns = "urn:schemas-microsoft-com:office:office" /><o:p></o:p> <br/> <br/><SPAN style="FONT-FAMILY: Verdana; COLOR: black; FONT-SIZE: 9pt; mso-bidi-font-family: Arial; mso-ansi-language: EN-GB; mso-bidi-font-size: 10.0pt" lang=EN-GB> <o:p></o:p> <br/> <br/><SPAN style="FONT-FAMILY: Verdana; COLOR: black; FONT-SIZE: 9pt; mso-bidi-font-family: Arial; mso-ansi-language: EN-GB; mso-bidi-font-size: 10.0pt" lang=EN-GB>Download and unzip ViewpointKiller to own folder on Desktop - http://www.softpedia.com/progDownload/ViewpointKiller-Download-29172.html <br/> <br/><SPAN style="FONT-FAMILY: Verdana; COLOR: black; FONT-SIZE: 9pt; mso-bidi-font-family: Arial; mso-ansi-language: EN-GB; mso-bidi-font-size: 10.0pt" lang=EN-GB>Run ViewpointKiller.exe<o:p></o:p> <br/> <br/><SPAN style="FONT-FAMILY: Verdana; COLOR: black; FONT-SIZE: 9pt; mso-bidi-font-family: Arial; mso-ansi-language: EN-GB; mso-bidi-font-size: 10.0pt" lang=EN-GB> <o:p></o:p> <br/> <br/><SPAN style="FONT-FAMILY: Verdana; COLOR: black; FONT-SIZE: 9pt; mso-bidi-font-family: Arial; mso-ansi-language: EN-GB; mso-bidi-font-size: 10.0pt; mso-fareast-font-family: 'Times New Roman'; mso-fareast-language: DA; mso-bidi-language: AR-SA" lang=EN-GB>Reboot. <br/> <br/><SPAN style="FONT-FAMILY: Verdana; COLOR: black; FONT-SIZE: 9pt; mso-bidi-font-family: Arial; mso-ansi-language: EN-GB; mso-bidi-font-size: 10.0pt; mso-fareast-font-family: 'Times New Roman'; mso-fareast-language: DA; mso-bidi-language: AR-SA" lang=EN-GB> <br/> <br/><SPAN style="FONT-FAMILY: Verdana; COLOR: black; FONT-SIZE: 9pt; mso-bidi-font-family: Arial; mso-ansi-language: EN-GB; mso-bidi-font-size: 10.0pt; mso-fareast-font-family: 'Times New Roman'; mso-fareast-language: DA; mso-bidi-language: AR-SA" lang=EN-GB> <br/> <br/><SPAN style="FONT-FAMILY: Verdana; COLOR: black; FONT-SIZE: 9pt; mso-bidi-font-family: Arial; mso-ansi-language: EN-GB; mso-bidi-font-size: 10.0pt; mso-fareast-font-family: 'Times New Roman'; mso-fareast-language: DA; mso-bidi-language: AR-SA" lang=EN-GB> <br/><SPAN class=spnmessagetext><SPAN style="FONT-FAMILY: Verdana; FONT-SIZE: 9pt; mso-ansi-language: EN-GB; mso-bidi-font-size: 10.0pt" lang=EN-GB>Now your computer problems are solved, it is time for the clean-up procedure<SPAN style="FONT-FAMILY: Verdana; COLOR: blue; FONT-SIZE: 9pt; mso-ansi-language: EN-GB; mso-bidi-font-size: 8.0pt" lang=EN-GB><o:p></o:p> <br/> <br/><SPAN style="FONT-FAMILY: Verdana; COLOR: #222222; FONT-SIZE: 9pt; mso-ansi-language: EN-GB" lang=EN-GB>You should Create a New Restore Point to prevent possible reinfection from an old one. <br/>The easiest and safest way to do this is:<o:p></o:p> <br/> <br/><SPAN style="FONT-FAMILY: Verdana; COLOR: black; FONT-SIZE: 9pt; mso-bidi-font-family: Arial; mso-ansi-language: EN-GB; mso-bidi-font-size: 10.0pt" lang=EN-GB>Go to Start > All Programs > Accessories > System Tools > System Restore <br/>Select Create a restore point, and Ok it. <br/>Next, go to Start > Run and type in cleanmgr <br/>Select the More options tab <br/>Choose the option to clean up system restore and OK it. <br/> <br/>This will remove all restore points except the new one you just created.<o:p></o:p> <br/> <br/><SPAN style="FONT-FAMILY: Verdana; COLOR: black; FONT-SIZE: 9pt; mso-ansi-language: EN-GB; mso-bidi-font-size: 8.0pt" lang=EN-GB> <o:p></o:p> <br/> <br/><SPAN style="FONT-FAMILY: Verdana; COLOR: black; FONT-SIZE: 9pt; mso-ansi-language: EN-GB; mso-bidi-font-size: 8.0pt" lang=EN-GB> <o:p></o:p> <br/> <br/>[2]Click on the CleanUp! button. You'll be asked if you want to Begin cleanup process? Select Yes. <o:p></o:p>[/2] <br/> <br/><SPAN style="mso-ansi-language: EN-GB" lang=EN-GB>[2]This step removes the files, folders, and shortcuts created by the tools I had you download and run.<o:p></o:p>[/2] <br/> <br/><SPAN style="mso-ansi-language: EN-GB" lang=EN-GB>[2] <o:p></o:p>[/2] <br/> <br/><SPAN style="mso-ansi-language: EN-GB" lang=EN-GB>[2]When done, you will be prompted to restart your computer. Please restart your computer.<o:p></o:p>[/2]

[color=black face="Courier New" sab="311">[2]Click here: Before-posting-a-log[/2][/url]

<?xml:namespace prefix = o ns = "urn:schemas-microsoft-com:office:office" />
[/color]
Do not PM me with logfiles. They will be deleted.


  • Unread posts or replies
  • No unread posts or replies
  • Unread Posts (Read Only Forum)
  • No Unread Posts (Read Only Forum)

Forum Information

Currently it is Tuesday, December 6, 2016, 9:20 AM (GMT +1)
There are a total of 61,160 posts in 13,449 threads.
In the last 3 days there were 2 new threads and 3 reply posts.

Who's online

This forum has 37,965 registered members. Please welcome our newest member, Old shape.
There are currently no users on-line.