Page 1 of 5 12345 LastLast
Results 1 to 10 of 41

Thread: Can't remove Win32.Autorun.tmp

  1. #1
    Junior Member
    Join Date
    Sep 2010
    Posts
    21

    Default Can't remove Win32.Autorun.tmp

    Hi there,

    I am having problems with a Trojan called Win32.Autorun.tmp. Spybot is able to detect it, and I request that it fixes it each time it does so, but it seems to return every time I run the scan. Very persistent and annoying!

    If anyone could help me purge it from my system forever that would be brilliant.

    Logs are posted below.

    Also I should note that I'm a complete noob, so if anyone can offer me advice, please do it in the most easy-to-understand way possible. Thanks!




    DDS (Ver_10-03-17.01) - FAT32x86
    Run by Owner at 12:26:02.54 on Sun 05/09/2010
    Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_20
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1015.209 [GMT 10:00]


    ============== Running Processes ===============

    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    svchost.exe
    svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    svchost.exe
    C:\DOCUME~1\WILLMO~1\LOCALS~1\TEMP\INSTAL~1.EXE
    C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
    C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Common Files\Java\Java Update\jusched.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
    C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe
    C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWare.exe
    C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINDOWS\system32\taskmgr.exe
    C:\Documents and Settings\willmonotti\Desktop\dds.scr
    C:\DOCUME~1\WILLMO~1\LOCALS~1\Temp\033.exe
    C:\DOCUME~1\WILLMO~1\LOCALS~1\Temp\089.exe
    C:\DOCUME~1\WILLMO~1\LOCALS~1\Temp\977.exe

    ============== Pseudo HJT Report ===============

    uStart Page = hxxp://trinity.unimelb.edu.au/portal
    mDefault_Page_URL = hxxp://global.acer.com
    uInternet Connection Wizard,ShellNext = hxxp://global.acer.com/
    uInternet Settings,ProxyServer = wwwproxy.student.unimelb.edu.au:8000
    uInternet Settings,ProxyOverride = <local>
    uURLSearchHooks: AOLSearchHook Class: {54eb34ea-e6be-4cfd-9f4f-c4a0c2eafa22} - c:\program files\aim search\AOLSearch.dll
    mWinlogon: Taskman=c:\recycler\s-1-5-21-7356296101-1933998588-915145784-2179\yv8g67.exe
    uWinlogon: Shell=c:\recycler\s-1-5-21-9624512614-5829467475-673620608-5226\rundll32.exe,explorer.exe,c:\recycler\s-1-5-21-7356296101-1933998588-915145784-2179\yv8g67.exe
    BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 6.0\reader\activex\AcroIEHelper.dll
    BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll
    BHO: AOLSearchHook Class: {54eb34ea-e6be-4cfd-9f4f-c4a0c2eafa22} - c:\program files\aim search\AOLSearch.dll
    BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL
    BHO: {b0cda128-b425-4eef-a174-61a11ac5dbf8} - No File
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    uRun: [MsnMsgr] "c:\program files\windows live\messenger\MsnMsgr.Exe" /background
    uRun: [DW6] "c:\program files\the weather channel fw\desktop\DesktopWeather.exe"
    uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    uRun: [vgr60] c:\windows\system32\6xc81oz.exe
    uRun: [lbhc6y] c:\windows\system32\lr2xd2jk.exe
    uRun: [llmcdi] c:\windows\system32\bm5hdyuu.exe
    uRun: [rcc86] c:\windows\system32\q1gw1ni13p.exe
    uRun: [mcdi3e] c:\windows\system32\bm86y3pl.exe
    uRun: [yuupgg] c:\windows\system32\ytkkfwwr.exe
    uRun: [zuvqm] c:\windows\system32\kkfwwrii.exe
    uRun: [upggbs] c:\windows\system32\dzpplbbxnn.exe
    uRun: [wbxxoo3] c:\windows\system32\0xdyep0.exe
    uRun: [teea6r] c:\windows\system32\w39ee5v1wb.exe
    uRun: [tkkfww] c:\windows\system32\i1eaavmmhy.exe
    uRun: [pkkgww] c:\windows\system32\ni1eaavmmh.exe
    uRun: [ezqqlcc] c:\windows\system32\oojaavmmhy.exe
    uRun: [Google Update] "c:\documents and settings\willmonotti\local settings\application data\google\update\GoogleUpdate.exe" /c
    uRun: [snoejuf] c:\windows\system32\86y2ff6.exe
    uRun: [yzpf0w] c:\windows\system32\n20zvfbw.exe
    uRun: [nojpk0r] c:\windows\system32\0jff66w.exe
    uRun: [falhcc] c:\windows\system32\1qmmhyy.exe
    uRun: [xdtyuua] c:\windows\system32\vlw2nyojzav.exe
    uRun: [dzuklg2] c:\windows\system32\rsnt66k8708.exe
    uRun: [uplbbxc] c:\windows\system32\pff69m1i.exe
    uRun: [faawmm] c:\windows\system32\3wwriid.exe
    uRun: [mmiyy6k] c:\windows\system32\fwwriiduupg.exe
    uRun: [hcyytkk] c:\windows\system32\qlccxoojaa.exe
    uRun: [zaflw] c:\windows\system32\70bxny1.exe
    uRun: [cydo8] c:\windows\system32\cttuzf81.exe
    uRun: [wcxtoeu] c:\windows\system32\70i1zuv.exe
    uRun: [akvwx] c:\windows\system32\e1vbg3sn.exe
    uRun: [vqwxin] c:\windows\system32\60niy1p.exe
    uRun: [qhxiioj] c:\windows\system32\1cdi81u.exe
    uRun: [hxdtp] c:\windows\system32\hm2noj081q.exe
    uRun: [xsoo8] c:\windows\system32\sndu1klq.exe
    uRun: [wrmns] c:\windows\system32\60xs0zf.exe
    uRun: [cito0] c:\windows\system32\chxd60flvr.exe
    uRun: [dezpq] c:\windows\system32\w2xyt081alm.exe
    uRun: [dzuva] c:\windows\system32\1epqlr8.exe
    mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
    mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
    mRun: [LaunchApp] Alaunch
    mRun: [SoundMan] SOUNDMAN.EXE
    mRun: [KTPWare] c:\program files\elantech\ktp.exe
    mRun: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
    mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    mRun: [MSPY2002] c:\windows\system32\ime\pintlgnt\ImScInst.exe /SYNC
    mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC
    mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName
    mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
    mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
    mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
    IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
    DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
    DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
    DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
    Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\progra~1\micros~2\office12\GR99D3~1.DLL
    Notify: AtiExtEvent - Ati2evxx.dll
    Notify: igfxcui - igfxsrvc.dll
    SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL

    ================= FIREFOX ===================

    FF - ProfilePath - c:\docume~1\willmo~1\applic~1\mozilla\firefox\profiles\qtrsc0zj.default\
    FF - prefs.js: browser.search.defaulturl - hxxp://aim.search.aol.com/search/search?query={searchTerms}&invocationType=tb50-ff-aim-chromesbox-en-us
    FF - prefs.js: browser.search.selectedEngine - Wikipedia (en)
    FF - prefs.js: browser.startup.homepage - hxxps://www.trinitycollege.vic.edu.au/portal/today/today.php
    FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=tb50-ff-aim-ab-en-us&query=
    FF - prefs.js: network.proxy.ftp - wwwproxy.unimelb.edu.au
    FF - prefs.js: network.proxy.ftp_port - 8000
    FF - prefs.js: network.proxy.gopher - wwwproxy.unimelb.edu.au
    FF - prefs.js: network.proxy.gopher_port - 8000
    FF - prefs.js: network.proxy.http - wwwproxy.unimelb.edu.au
    FF - prefs.js: network.proxy.http_port - 8000
    FF - prefs.js: network.proxy.socks - wwwproxy.unimelb.edu.au
    FF - prefs.js: network.proxy.socks_port - 8000
    FF - prefs.js: network.proxy.ssl - wwwproxy.unimelb.edu.au
    FF - prefs.js: network.proxy.ssl_port - 8000
    FF - prefs.js: network.proxy.type - 1
    FF - plugin: c:\documents and settings\willmonotti\application data\mozilla\firefox\profiles\qtrsc0zj.default\extensions\{e2883e8f-472f-4fb0-9522-ac9bf37916a7}\plugins\np_gp.dll
    FF - plugin: c:\documents and settings\willmonotti\local settings\application data\google\update\1.2.183.29\npGoogleOneClick8.dll
    FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\npdnu.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\npdnupdater2.dll
    FF - plugin: c:\program files\quicktime\plugins\npqtplugin8.dll
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

    ---- FIREFOX POLICIES ----
    FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(network.protocol-handler.warn-external.dnupdate, falsec:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
    c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
    c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
    c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
    c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
    c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
    c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
    c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
    c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
    c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
    c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
    c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
    c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
    c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

    ============= SERVICES / DRIVERS ===============

    R? Lbd;Lbd
    R? WDC_SAM;WD SCSI Pass Thru driver
    R? ywyyitdy;System Monitor
    S? vsdatant;vsdatant
    S? WDDMService;WD SmartWare Drive Manager
    S? WDSmartWareBackgroundService;WD SmartWare Background Service

    =============== Created Last 30 ================

    2010-09-03 13:25:36 0 d-sh--w- C:\FOUND.026
    2010-09-02 12:08:00 0 d-sh--w- C:\FOUND.025
    2010-09-01 13:56:04 0 d-----w- c:\program files\Safer Networking
    2010-09-01 13:53:23 0 d-----w- c:\windows\pss
    2010-09-01 04:55:38 0 d-sh--w- C:\FOUND.024
    2010-08-31 13:58:24 0 d-sh--w- C:\FOUND.023
    2010-08-31 09:41:40 0 d-sh--w- C:\FOUND.022
    2010-08-27 11:22:10 0 d-sh--w- C:\FOUND.021
    2010-08-26 13:15:04 0 d-sh--w- C:\FOUND.020

    ==================== Find3M ====================

    2008-10-16 01:46:40 700 ----a-w- c:\program files\studentVPN.pcf
    2008-08-29 04:00:22 1073 ----a-w- c:\program files\sig.dat
    2008-08-29 04:00:20 1099 ----a-w- c:\program files\vpnclient_setup.ini
    2008-08-29 04:00:18 52224 ----a-w- c:\program files\vpnclient_jp.mst
    2008-08-29 04:00:06 10935808 ----a-w- c:\program files\vpnclient_setup.msi
    2008-08-29 04:00:04 51200 ----a-w- c:\program files\vpnclient_fc.mst
    2008-08-29 04:00:00 819 ----a-w- c:\program files\vpnclient_setup.sms
    2008-08-29 04:00:00 640 ----a-w- c:\program files\vpnclient_setup.pdf
    2008-08-29 04:00:00 1822520 ----a-w- c:\program files\instmsiw.exe
    2008-08-29 04:00:00 1708856 ----a-w- c:\program files\instmsi.exe
    2008-08-29 03:59:58 56832 ----a-w- c:\program files\vpnclient_setup.exe
    2008-08-29 03:58:04 221315 ----a-w- c:\program files\installservice.exe
    2008-08-29 03:57:32 16505 ----a-w- c:\program files\DelayInst.exe
    2004-08-03 19:00:00 160603 --sh--r- c:\windows\system32\gnhnveo.dll

    ============= FINISH: 12:28:04.40 ===============

  2. #2
    Senior Member
    Join Date
    Feb 2010
    Location
    Port Hedland, Western Australia
    Posts
    155

    Default

    Hello & Welcome to Safer-Networking

    Please Subscribe to this Thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant notification by email, then click Add Subscription.

    In the meantime please note the following:
    • Any recommendations made are for your computer problems only and should NOT be used on any other computer.
    • Please DO NOT run any scans/tools or other fixes unless I ask you to. This is very important for several reasons. Here are just two of them:
      1. The tools that we use are very powerful and can cause >>irreparable damage<< to your computer if not used correctly.
      2. Commercial scanners, for the most part can not completely remove some of the more "resistant" infections. This makes it much more difficult to get rid of completely.
    • If you get stuck or are unsure of something please ask for a further explanation, do not guess.
    • It will require more than one round to properly clean your system. Continue to respond to this thread until I give you the All Clean! even if symptoms seemingly abate.
    Please note that the forum is very busy and if I don't hear from you within four days this thread will be closed.
    If for any reason you cannot complete instructions within that time, that's fine, just put a post here so that I know you're still here. We get a lot of people who simply leave & if there is no contact for that amount of time I will have to assume you have abandoned your topic.

    Please be aware that removing Malware is a potentially hazardous undertaking. I will take care not to knowingly suggest courses of action that might damage your computer. However it is impossible for me to foresee all interactions that may happen between the software on your computer and those we'll use to clear you of infection, and I cannot guarantee the safety of your system. It is possible that we might encounter situations where the only recourse is to re-format and re-install your operating system, or to necessitate you taking your computer to a repair shop.

    Because of this, I advise you to backup any personal files and folders before you start.

    Thanks

    Safer-Networking P2P Policy
    IMPORTANT I notice there are signs of one or more P2P (Peer to Peer) File Sharing Programs on your computer.

    µTorrent

    I'd like you to read the File Sharing, otherwise known as Peer To Peer. (P2P).
    Go to Control Panel > Add/Remove Programs and uninstall the programs listed above (in red) & any other P2P programs.

    DDS
    Re-run DDS & post the contents of both logs... copy/pasting the contents will be fine, no need to attach the logs.

    Gmer
    Download GMER Rootkit Scanner from here & save it to your desktop.
    • Double click the .exe file. If asked to allow gmer.sys driver to load, please consent
    • If it gives you a warning about rootkit activity and asks if you want to run scan...click on NO


      Click the image to enlarge it
    • In the right panel, you will see several boxes that have been checked. Uncheck the following ...
      • IAT/EAT
      • Drives/Partition other than Systemdrive (typically C:\)
      • Show All (don't miss this one)
    • Then click the Scan button & wait for it to finish
    • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file
    • Save it where you can easily find it, such as your desktop, and post it in reply
    **Caution**
    Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries

    Do not run any programs while Gmer is running.

    NOTE: If you cannot run GMER as indicated above, save a scan from the initial startup scan.
    • Before scanning, make sure all other running programs are closed & no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan
    • Double click the gmer.exe file
    • The program will begin to run & perform an initial scan. If possible rootkit activity is found, you will be asked if you would like to perform a full scan. Click No
    • After the "initial scan" is complete, click on the Save button, save the log file to your desktop & post it in your reply
    To post in next reply:
    Contents of DDS log
    Contents of Attach.txt
    Contents of Gmer log

  3. #3
    Junior Member
    Join Date
    Sep 2010
    Posts
    21

    Default

    Hey jmw3! Thanks so much for replying and helping me.

    The logs you requested are posted below:

    "DDS":

    DDS (Ver_10-03-17.01) - FAT32x86
    Run by willmonotti at 13:01:38.37 on Wed 08/09/2010
    Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_20
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1015.357 [GMT 10:00]


    ============== Running Processes ===============

    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    svchost.exe
    svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    svchost.exe
    C:\DOCUME~1\WILLMO~1\LOCALS~1\TEMP\INSTAL~1.EXE
    C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
    C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Common Files\Java\Java Update\jusched.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
    C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe
    C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWare.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\iTunes\iTunes.exe
    C:\Program Files\Last.fm\LastFM.exe
    C:\Program Files\Cisco Systems\VPN Client\vpngui.exe
    C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
    C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
    C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
    C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
    C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
    C:\Documents and Settings\willmonotti\Desktop\dds.scr

    ============== Pseudo HJT Report ===============

    uStart Page = hxxp://trinity.unimelb.edu.au/portal
    mDefault_Page_URL = hxxp://global.acer.com
    uInternet Connection Wizard,ShellNext = hxxp://global.acer.com/
    uInternet Settings,ProxyServer = wwwproxy.student.unimelb.edu.au:8000
    uInternet Settings,ProxyOverride = <local>
    uURLSearchHooks: AOLSearchHook Class: {54eb34ea-e6be-4cfd-9f4f-c4a0c2eafa22} - c:\program files\aim search\AOLSearch.dll
    mWinlogon: Taskman=c:\recycler\s-1-5-21-7356296101-1933998588-915145784-2179\yv8g67.exe
    uWinlogon: Shell=c:\recycler\s-1-5-21-9624512614-5829467475-673620608-5226\rundll32.exe,explorer.exe,c:\recycler\s-1-5-21-7356296101-1933998588-915145784-2179\yv8g67.exe
    BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 6.0\reader\activex\AcroIEHelper.dll
    BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll
    BHO: AOLSearchHook Class: {54eb34ea-e6be-4cfd-9f4f-c4a0c2eafa22} - c:\program files\aim search\AOLSearch.dll
    BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL
    BHO: {b0cda128-b425-4eef-a174-61a11ac5dbf8} - No File
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    uRun: [MsnMsgr] "c:\program files\windows live\messenger\MsnMsgr.Exe" /background
    uRun: [DW6] "c:\program files\the weather channel fw\desktop\DesktopWeather.exe"
    uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    uRun: [vgr60] c:\windows\system32\6xc81oz.exe
    uRun: [lbhc6y] c:\windows\system32\lr2xd2jk.exe
    uRun: [llmcdi] c:\windows\system32\bm5hdyuu.exe
    uRun: [rcc86] c:\windows\system32\q1gw1ni13p.exe
    uRun: [mcdi3e] c:\windows\system32\bm86y3pl.exe
    uRun: [yuupgg] c:\windows\system32\ytkkfwwr.exe
    uRun: [zuvqm] c:\windows\system32\kkfwwrii.exe
    uRun: [upggbs] c:\windows\system32\dzpplbbxnn.exe
    uRun: [wbxxoo3] c:\windows\system32\0xdyep0.exe
    uRun: [teea6r] c:\windows\system32\w39ee5v1wb.exe
    uRun: [tkkfww] c:\windows\system32\i1eaavmmhy.exe
    uRun: [pkkgww] c:\windows\system32\ni1eaavmmh.exe
    uRun: [ezqqlcc] c:\windows\system32\oojaavmmhy.exe
    uRun: [Google Update] "c:\documents and settings\willmonotti\local settings\application data\google\update\GoogleUpdate.exe" /c
    uRun: [snoejuf] c:\windows\system32\86y2ff6.exe
    uRun: [yzpf0w] c:\windows\system32\n20zvfbw.exe
    uRun: [nojpk0r] c:\windows\system32\0jff66w.exe
    uRun: [falhcc] c:\windows\system32\1qmmhyy.exe
    uRun: [xdtyuua] c:\windows\system32\vlw2nyojzav.exe
    uRun: [dzuklg2] c:\windows\system32\rsnt66k8708.exe
    uRun: [uplbbxc] c:\windows\system32\pff69m1i.exe
    uRun: [faawmm] c:\windows\system32\3wwriid.exe
    uRun: [mmiyy6k] c:\windows\system32\fwwriiduupg.exe
    uRun: [hcyytkk] c:\windows\system32\qlccxoojaa.exe
    uRun: [zaflw] c:\windows\system32\70bxny1.exe
    uRun: [cydo8] c:\windows\system32\cttuzf81.exe
    uRun: [wcxtoeu] c:\windows\system32\70i1zuv.exe
    uRun: [akvwx] c:\windows\system32\e1vbg3sn.exe
    uRun: [vqwxin] c:\windows\system32\60niy1p.exe
    uRun: [qhxiioj] c:\windows\system32\1cdi81u.exe
    uRun: [hxdtp] c:\windows\system32\hm2noj081q.exe
    uRun: [xsoo8] c:\windows\system32\sndu1klq.exe
    uRun: [wrmns] c:\windows\system32\60xs0zf.exe
    uRun: [cito0] c:\windows\system32\chxd60flvr.exe
    uRun: [dezpq] c:\windows\system32\w2xyt081alm.exe
    uRun: [dzuva] c:\windows\system32\1epqlr8.exe
    mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
    mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
    mRun: [LaunchApp] Alaunch
    mRun: [SoundMan] SOUNDMAN.EXE
    mRun: [KTPWare] c:\program files\elantech\ktp.exe
    mRun: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
    mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    mRun: [MSPY2002] c:\windows\system32\ime\pintlgnt\ImScInst.exe /SYNC
    mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC
    mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName
    mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
    mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
    mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\pkfgbh60jef.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\jjkf08hm.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\91whidj.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\gbxx2dtkk.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\vrhhxd66u81.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\86i81uf.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\siy0zpv6.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\xnndj66a8.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\kpfl60ntdz.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\tup03g0h.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\0wwriid.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\gccxoojaav.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\hcc6oo6aa81.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\1tjpvbh.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\s8jpvbhnz.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\vwhntjpvgrs.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\glwhidj6.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\fbwxc81zu.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\g6w81itup.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\bxx66o86.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\86c81o3.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\dzpplbbx.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\6kk6ww6.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\qqlccxooja.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\zvggrchsdez.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\m86y81kvw.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\w1mns86e3a.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\6dtz0fq.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\ddtz0fqlc.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\tjjfvvrh.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\lccxooz870b.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\2bcx081.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\chsdezf6.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\3cxyy0z.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\fl5ccsty.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\1yjpfl2.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\d0ze81b5cn0.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\0ssneef.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\r1cteeffbw.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\z03q1hn1y.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\1bh0xtt.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\u87wcx1jj.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\ieezqqlccx.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\jfvvrhhd.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\3wwriid.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\g1cyytkk.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\m70njee6q.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\6yy6kk6.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\pfl2rx2d.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\f66rs1i3.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\di3e1aq1rs.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\hdd66u86.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\yy13avg86.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\91itupf.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\w81itupv2.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\fq1ghm81.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\jfaq1mc1y.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\aql0ccsi1z.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\yo1f70bmsn.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\up084xnn.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\zuklq6rcnoj.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\g3msn0eeu.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\kpalmhn2.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\gbrstju1.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\l0ccxytup.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\1vfbwxc.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\ll2c5xtop.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\fgb081yopu.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\eezqqlccxo.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\cxyu5ghy.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\94uufq5.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\citzkf253x.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\ekl271it.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\u3l0rx0t26.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\6g0hndd.exe
    StartupFolder: c:\docume~1\willmo~1\startm~1\programs\startup\erunta~1.lnk - c:\program files\erunt\AUTOBACK.EXE
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\q81cnojzavl.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\nxtopu81g8.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\w86i81ufgbr.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\yzkfagb081.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\s9efvvrcsxt.exe
    StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\tjpfvwrhii.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\winzip~1.lnk - c:\program files\winzip\WZQKPICK.EXE
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\vpncli~1.lnk - c:\windows\installer\{51fb15f4-ad27-43bc-ad4b-dd0354fb6bbd}\Icon3E5562ED7.ico
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\wddmst~1.lnk - c:\program files\western digital\wd smartware\wd drive manager\WDDMStatus.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\wdsmar~1.lnk - c:\program files\western digital\wd smartware\front parlor\WDSmartWare.exe
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
    IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
    DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
    DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
    DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
    TCP: {A26EB843-3715-4469-B456-842FEF3FC788} = 128.250.66.5,128.250.201.5
    Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\progra~1\micros~2\office12\GR99D3~1.DLL
    Notify: AtiExtEvent - Ati2evxx.dll
    Notify: igfxcui - igfxsrvc.dll
    SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL

    ================= FIREFOX ===================

    FF - ProfilePath - c:\docume~1\willmo~1\applic~1\mozilla\firefox\profiles\qtrsc0zj.default\
    FF - prefs.js: browser.search.defaulturl - hxxp://aim.search.aol.com/search/search?query={searchTerms}&invocationType=tb50-ff-aim-chromesbox-en-us
    FF - prefs.js: browser.startup.homepage - hxxps://www.trinitycollege.vic.edu.au/portal/today/today.php
    FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=tb50-ff-aim-ab-en-us&query=
    FF - prefs.js: network.proxy.ftp - wwwproxy.unimelb.edu.au
    FF - prefs.js: network.proxy.ftp_port - 8000
    FF - prefs.js: network.proxy.gopher - wwwproxy.unimelb.edu.au
    FF - prefs.js: network.proxy.gopher_port - 8000
    FF - prefs.js: network.proxy.http - wwwproxy.unimelb.edu.au
    FF - prefs.js: network.proxy.http_port - 8000
    FF - prefs.js: network.proxy.socks - wwwproxy.unimelb.edu.au
    FF - prefs.js: network.proxy.socks_port - 8000
    FF - prefs.js: network.proxy.ssl - wwwproxy.unimelb.edu.au
    FF - prefs.js: network.proxy.ssl_port - 8000
    FF - prefs.js: network.proxy.type - 1
    FF - plugin: c:\documents and settings\willmonotti\application data\mozilla\firefox\profiles\qtrsc0zj.default\extensions\{e2883e8f-472f-4fb0-9522-ac9bf37916a7}\plugins\np_gp.dll
    FF - plugin: c:\documents and settings\willmonotti\local settings\application data\google\update\1.2.183.29\npGoogleOneClick8.dll
    FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\npdnu.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\npdnupdater2.dll
    FF - plugin: c:\program files\quicktime\plugins\npqtplugin8.dll
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

    ---- FIREFOX POLICIES ----
    FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(network.protocol-handler.warn-external.dnupdate, falsec:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
    c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
    c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
    c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
    c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
    c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
    c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
    c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
    c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
    c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
    c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
    c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
    c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
    c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

    ============= SERVICES / DRIVERS ===============

    R2 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2007-11-14 394952]
    R2 WDDMService;WD SmartWare Drive Manager;c:\program files\western digital\wd smartware\wd drive manager\WDDMService.exe [2009-11-13 110592]
    R2 WDSmartWareBackgroundService;WD SmartWare Background Service;c:\program files\western digital\wd smartware\front parlor\WDSmartWareBackgroundService.exe [2009-6-16 20480]
    R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [2010-6-21 11520]
    S0 Lbd;Lbd;c:\windows\system32\drivers\lbd.sys --> c:\windows\system32\drivers\Lbd.sys [?]
    S2 ywyyitdy;System Monitor;c:\windows\system32\svchost.exe -k netsvcs [2005-5-24 14336]

    =============== Created Last 30 ================

    2010-09-06 04:43:12 0 d-sh--w- C:\FOUND.027
    2010-09-03 13:25:36 0 d-sh--w- C:\FOUND.026
    2010-09-02 12:08:00 0 d-sh--w- C:\FOUND.025
    2010-09-01 13:56:04 0 d-----w- c:\program files\Safer Networking
    2010-09-01 13:53:23 0 d-----w- c:\windows\pss
    2010-09-01 04:55:38 0 d-sh--w- C:\FOUND.024
    2010-08-31 13:58:24 0 d-sh--w- C:\FOUND.023
    2010-08-31 09:41:40 0 d-sh--w- C:\FOUND.022
    2010-08-27 11:22:10 0 d-sh--w- C:\FOUND.021
    2010-08-26 13:15:04 0 d-sh--w- C:\FOUND.020

    ==================== Find3M ====================

    2008-10-16 01:46:40 700 ----a-w- c:\program files\studentVPN.pcf
    2008-08-29 04:00:22 1073 ----a-w- c:\program files\sig.dat
    2008-08-29 04:00:20 1099 ----a-w- c:\program files\vpnclient_setup.ini
    2008-08-29 04:00:18 52224 ----a-w- c:\program files\vpnclient_jp.mst
    2008-08-29 04:00:06 10935808 ----a-w- c:\program files\vpnclient_setup.msi
    2008-08-29 04:00:04 51200 ----a-w- c:\program files\vpnclient_fc.mst
    2008-08-29 04:00:00 819 ----a-w- c:\program files\vpnclient_setup.sms
    2008-08-29 04:00:00 640 ----a-w- c:\program files\vpnclient_setup.pdf
    2008-08-29 04:00:00 1822520 ----a-w- c:\program files\instmsiw.exe
    2008-08-29 04:00:00 1708856 ----a-w- c:\program files\instmsi.exe
    2008-08-29 03:59:58 56832 ----a-w- c:\program files\vpnclient_setup.exe
    2008-08-29 03:58:04 221315 ----a-w- c:\program files\installservice.exe
    2008-08-29 03:57:32 16505 ----a-w- c:\program files\DelayInst.exe
    2004-08-03 19:00:00 160603 --sh--r- c:\windows\system32\gnhnveo.dll

    ============= FINISH: 13:01:54.54 ===============


    "Attach":



    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT

    DDS (Ver_10-03-17.01)

    Microsoft Windows XP Professional
    Boot Device: \Device\HarddiskVolume1
    Install Date: 8/02/2009 6:39:55 AM
    System Uptime: 9/07/2010 10:28:54 PM (1455 hours ago)

    Motherboard: Acer | | Mimid
    Processor: Intel(R) Pentium(R) M processor 1.73GHz | uFCPGA | 1313/133mhz

    ==== Disk Partitions =========================

    C: is FIXED (FAT32) - 75 GiB total, 3.589 GiB free.
    D: is CDROM ()
    F: is CDROM (UDF)
    G: is FIXED (NTFS) - 465 GiB total, 396.211 GiB free.

    ==== Disabled Device Manager Items =============

    ==== System Restore Points ===================

    No restore point in system.

    ==== Installed Programs ======================

    Adobe Download Manager
    Adobe Flash Player 10 ActiveX
    Adobe Flash Player 10 Plugin
    Adobe Reader 6.0
    Adobe Shockwave Player 11.5
    AIM 7
    AIM Search
    Apple Application Support
    Apple Mobile Device Support
    Apple Software Update
    Audacity 1.3.9 (Unicode)
    Bonjour
    Cisco Systems VPN Client 5.0.04.0300
    DC++ 0.7091
    Download Updater (AOL LLC)
    ERUNT 1.1j
    First Principles of Business Law
    foobar2000 v0.9.6.9
    Google Chrome
    Hotfix for Windows XP (KB915800-v4)
    Hotfix for Windows XP (KB915865)
    Intel(R) Graphics Media Accelerator Driver for Mobile
    iTunes
    Java Auto Updater
    Java(TM) 6 Update 20
    KTP Ware PS/2-WDM 5.0.1.2
    LAME v3.98.2 for Audacity
    Last.fm 1.5.4.24567
    Microsoft .NET Framework 2.0
    Microsoft Office Access MUI (English) 2007
    Microsoft Office Access Setup Metadata MUI (English) 2007
    Microsoft Office Excel MUI (English) 2007
    Microsoft Office Groove MUI (English) 2007
    Microsoft Office Groove Setup Metadata MUI (English) 2007
    Microsoft Office InfoPath MUI (English) 2007
    Microsoft Office OneNote MUI (English) 2007
    Microsoft Office Outlook MUI (English) 2007
    Microsoft Office PowerPoint MUI (English) 2007
    Microsoft Office Proof (English) 2007
    Microsoft Office Proof (French) 2007
    Microsoft Office Proof (Spanish) 2007
    Microsoft Office Proofing (English) 2007
    Microsoft Office Publisher MUI (English) 2007
    Microsoft Office Shared MUI (English) 2007
    Microsoft Office Shared Setup Metadata MUI (English) 2007
    Microsoft Office Ultimate 2007
    Microsoft Office Word MUI (English) 2007
    Microsoft Software Update for Web Folders (English) 12
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    Mozilla Firefox (3.6.3)
    NTI Backup NOW! 4
    NTI CD & DVD-Maker
    OGG MP3 Converter 3.2 build 827
    Protected Music Converter 1.0.0.21
    QuickTime
    Realtek AC'97 Audio
    RunAlyzer
    Safari
    Skills-Task 2 Feedback
    SMSC IrCC V5.1.3600.5 SP2
    SoftV90 Data Fax Modem with SmartCP
    Spybot - Search & Destroy
    Total Commander (Remove or Repair)
    Trillian
    Universal Soccer Manager 2
    Visual C++ 2008 x86 Runtime - (v9.0.30729)
    Visual C++ 2008 x86 Runtime - v9.0.30729.01
    VLC media player 0.9.8a
    WD SmartWare
    WebFldrs XP
    Windows Feature Pack for Storage (32-bit) - IMAPI update for Blu-Ray
    Windows Installer 3.1 (KB893803)
    Windows XP Hotfix - KB885855
    WinRAR archiver
    WinZip
    Xiph QuickTime Components

    ==== Event Viewer Messages From Past Week ========

    4/09/2010 12:29:49 AM, error: MRxSmb [8003] - The master browser has received a server announcement from the computer B38EF8B56EAF41E that believes that it is the master browser for the domain on transport NetBT_Tcpip_{773F261F-5C0. The master browser is stopping or an election is being forced.
    4/09/2010 10:10:04 AM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the WZCSVC service.
    4/09/2010 1:01:15 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the JavaQuickStarterService service.
    2/09/2010 7:47:08 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the Netman service.
    2/09/2010 4:28:20 PM, error: Service Control Manager [7000] - The Ati HotKey Poller service failed to start due to the following error: The system cannot find the file specified.
    2/09/2010 12:17:58 PM, error: MRxSmb [8003] - The master browser has received a server announcement from the computer ERIC-SINCLAIR that believes that it is the master browser for the domain on transport NetBT_Tcpip_{773F261F-5C09-. The master browser is stopping or an election is being forced.
    2/09/2010 11:08:44 AM, error: MRxSmb [8003] - The master browser has received a server announcement from the computer H203-28-242-83 that believes that it is the master browser for the domain on transport NetBT_Tcpip_{773F261F-5C09. The master browser is stopping or an election is being forced.
    1/09/2010 7:48:08 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Lbd
    1/09/2010 7:48:08 PM, error: Service Control Manager [7023] - The System Monitor service terminated with the following error: A dynamic link library (DLL) initialization routine failed.
    1/09/2010 3:03:54 PM, error: MRxSmb [8003] - The master browser has received a server announcement from the computer REICHART-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{773F261F-5C09-41. The master browser is stopping or an election is being forced.
    1/09/2010 2:58:56 PM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service BITS with arguments "" in order to run the server: {4991D34B-80A1-4291-83B6-3328366B9097}
    1/09/2010 2:56:09 PM, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751)
    1/09/2010 2:03:25 PM, error: MRxSmb [8003] - The master browser has received a server announcement from the computer SOPHIEBOUCAUT that believes that it is the master browser for the domain on transport NetBT_Tcpip_{773F261F-5C09-. The master browser is stopping or an election is being forced.
    1/09/2010 1:00:01 PM, error: MRxSmb [8003] - The master browser has received a server announcement from the computer SCOTT-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{773F261F-5C09-4150-. The master browser is stopping or an election is being forced.

    ==== End Of File ===========================


    "GMER":


    GMER 1.0.15.15281 - http://www.gmer.net
    Rootkit scan 2010-09-08 13:23:22
    Windows 5.1.2600 Service Pack 2
    Running: umsywfnu.exe; Driver: C:\DOCUME~1\WILLMO~1\LOCALS~1\Temp\ugldqpod.sys


    ---- System - GMER 1.0.15 ----

    SSDT \??\C:\WINDOWS\system32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwCreateFile [0xAA773930]
    SSDT \??\C:\WINDOWS\system32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwCreateKey [0xAA77EA80]
    SSDT \??\C:\WINDOWS\system32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwDeleteFile [0xAA773F20]
    SSDT \??\C:\WINDOWS\system32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwDeleteKey [0xAA77F6E0]
    SSDT \??\C:\WINDOWS\system32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwDeleteValueKey [0xAA77F440]
    SSDT \??\C:\WINDOWS\system32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwLoadKey [0xAA77F8B0]
    SSDT \??\C:\WINDOWS\system32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwOpenFile [0xAA773D70]
    SSDT \??\C:\WINDOWS\system32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwRenameKey [0xAA780250]
    SSDT \??\C:\WINDOWS\system32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwReplaceKey [0xAA77FCB0]
    SSDT \??\C:\WINDOWS\system32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwRestoreKey [0xAA780080]
    SSDT \??\C:\WINDOWS\system32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwSetInformationFile [0xAA774120]
    SSDT \??\C:\WINDOWS\system32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwSetValueKey [0xAA77F140]

    ---- Kernel code sections - GMER 1.0.15 ----

    .text ntkrnlpa.exe!ZwCallbackReturn + 23D0 805010D4 4 Bytes JMP D25AAA77
    ? System32\Drivers\hiber_WMILIB.SYS The system cannot find the path specified. !

    ---- User code sections - GMER 1.0.15 ----

    .text C:\WINDOWS\System32\svchost.exe[320] ntdll.dll!NtQueryInformationProcess 7C90E01B 5 Bytes JMP 0165ADCD
    .text C:\WINDOWS\System32\svchost.exe[320] NETAPI32.dll!NetpwPathCanonicalize 5B86A259 5 Bytes JMP 0165AD64
    .text C:\WINDOWS\system32\svchost.exe[432] ntdll.dll!NtQueryInformationProcess 7C90E01B 5 Bytes JMP 008CADCD
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtCreateFile + 6 7C90D688 4 Bytes [28, 00, 16, 00]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtCreateFile + B 7C90D68D 1 Byte [E2]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtMapViewOfSection + 6 7C90DC5B 1 Byte [28]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtMapViewOfSection + 6 7C90DC5B 4 Bytes [28, 03, 16, 00]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtMapViewOfSection + B 7C90DC60 1 Byte [E2]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtOpenFile + 6 7C90DD03 4 Bytes [68, 00, 16, 00]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtOpenFile + B 7C90DD08 1 Byte [E2]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtOpenProcess + 6 7C90DD81 4 Bytes [A8, 01, 16, 00]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtOpenProcess + B 7C90DD86 1 Byte [E2]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtOpenProcessToken + 6 7C90DD96 4 Bytes CALL 7B90F39C
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtOpenProcessToken + B 7C90DD9B 1 Byte [E2]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtOpenProcessTokenEx + 6 7C90DDAB 4 Bytes [A8, 02, 16, 00]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtOpenProcessTokenEx + B 7C90DDB0 1 Byte [E2]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtOpenThread + 6 7C90DDFF 4 Bytes [68, 01, 16, 00]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtOpenThread + B 7C90DE04 1 Byte [E2]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtOpenThreadToken + 6 7C90DE14 4 Bytes [68, 02, 16, 00]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtOpenThreadToken + B 7C90DE19 1 Byte [E2]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtOpenThreadTokenEx + 6 7C90DE29 4 Bytes CALL 7B90F430
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtOpenThreadTokenEx + B 7C90DE2E 1 Byte [E2]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtQueryAttributesFile + 6 7C90DEE6 4 Bytes [A8, 00, 16, 00]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtQueryAttributesFile + B 7C90DEEB 1 Byte [E2]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtQueryFullAttributesFile + 6 7C90DFB8 4 Bytes CALL 7B90F5BD
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtQueryFullAttributesFile + B 7C90DFBD 1 Byte [E2]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtSetInformationFile + 6 7C90E5DF 4 Bytes [28, 01, 16, 00]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtSetInformationFile + B 7C90E5E4 1 Byte [E2]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtSetInformationThread + 6 7C90E648 4 Bytes [28, 02, 16, 00]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtSetInformationThread + B 7C90E64D 1 Byte [E2]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtUnmapViewOfSection + 6 7C90E966 1 Byte [68]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtUnmapViewOfSection + 6 7C90E966 4 Bytes [68, 03, 16, 00]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtUnmapViewOfSection + B 7C90E96B 1 Byte [E2]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtCreateFile + 6 7C90D688 4 Bytes [28, 00, 16, 00]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtCreateFile + B 7C90D68D 1 Byte [E2]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtMapViewOfSection + 6 7C90DC5B 1 Byte [28]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtMapViewOfSection + 6 7C90DC5B 4 Bytes [28, 03, 16, 00]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtMapViewOfSection + B 7C90DC60 1 Byte [E2]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtOpenFile + 6 7C90DD03 4 Bytes [68, 00, 16, 00]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtOpenFile + B 7C90DD08 1 Byte [E2]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtOpenProcess + 6 7C90DD81 4 Bytes [A8, 01, 16, 00]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtOpenProcess + B 7C90DD86 1 Byte [E2]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtOpenProcessToken + 6 7C90DD96 4 Bytes CALL 7B90F39C
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtOpenProcessToken + B 7C90DD9B 1 Byte [E2]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtOpenProcessTokenEx + 6 7C90DDAB 4 Bytes [A8, 02, 16, 00]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtOpenProcessTokenEx + B 7C90DDB0 1 Byte [E2]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtOpenThread + 6 7C90DDFF 4 Bytes [68, 01, 16, 00]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtOpenThread + B 7C90DE04 1 Byte [E2]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtOpenThreadToken + 6 7C90DE14 4 Bytes [68, 02, 16, 00]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtOpenThreadToken + B 7C90DE19 1 Byte [E2]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtOpenThreadTokenEx + 6 7C90DE29 4 Bytes CALL 7B90F430
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtOpenThreadTokenEx + B 7C90DE2E 1 Byte [E2]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtQueryAttributesFile + 6 7C90DEE6 4 Bytes [A8, 00, 16, 00]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtQueryAttributesFile + B 7C90DEEB 1 Byte [E2]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtQueryFullAttributesFile + 6 7C90DFB8 4 Bytes CALL 7B90F5BD
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtQueryFullAttributesFile + B 7C90DFBD 1 Byte [E2]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtSetInformationFile + 6 7C90E5DF 4 Bytes [28, 01, 16, 00]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtSetInformationFile + B 7C90E5E4 1 Byte [E2]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtSetInformationThread + 6 7C90E648 4 Bytes [28, 02, 16, 00]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtSetInformationThread + B 7C90E64D 1 Byte [E2]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtUnmapViewOfSection + 6 7C90E966 1 Byte [68]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtUnmapViewOfSection + 6 7C90E966 4 Bytes [68, 03, 16, 00]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtUnmapViewOfSection + B 7C90E96B 1 Byte [E2]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtCreateFile + 6 7C90D688 4 Bytes [28, 00, 16, 00]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtCreateFile + B 7C90D68D 1 Byte [E2]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtMapViewOfSection + 6 7C90DC5B 1 Byte [28]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtMapViewOfSection + 6 7C90DC5B 4 Bytes [28, 03, 16, 00]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtMapViewOfSection + B 7C90DC60 1 Byte [E2]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtOpenFile + 6 7C90DD03 4 Bytes [68, 00, 16, 00]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtOpenFile + B 7C90DD08 1 Byte [E2]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtOpenProcess + 6 7C90DD81 4 Bytes [A8, 01, 16, 00]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtOpenProcess + B 7C90DD86 1 Byte [E2]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtOpenProcessToken + 6 7C90DD96 4 Bytes CALL 7B90F39C
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtOpenProcessToken + B 7C90DD9B 1 Byte [E2]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtOpenProcessTokenEx + 6 7C90DDAB 4 Bytes [A8, 02, 16, 00]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtOpenProcessTokenEx + B 7C90DDB0 1 Byte [E2]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtOpenThread + 6 7C90DDFF 4 Bytes [68, 01, 16, 00]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtOpenThread + B 7C90DE04 1 Byte [E2]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtOpenThreadToken + 6 7C90DE14 4 Bytes [68, 02, 16, 00]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtOpenThreadToken + B 7C90DE19 1 Byte [E2]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtOpenThreadTokenEx + 6 7C90DE29 4 Bytes CALL 7B90F430
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtOpenThreadTokenEx + B 7C90DE2E 1 Byte [E2]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtQueryAttributesFile + 6 7C90DEE6 4 Bytes [A8, 00, 16, 00]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtQueryAttributesFile + B 7C90DEEB 1 Byte [E2]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtQueryFullAttributesFile + 6 7C90DFB8 4 Bytes CALL 7B90F5BD
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtQueryFullAttributesFile + B 7C90DFBD 1 Byte [E2]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtSetInformationFile + 6 7C90E5DF 4 Bytes [28, 01, 16, 00]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtSetInformationFile + B 7C90E5E4 1 Byte [E2]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtSetInformationThread + 6 7C90E648 4 Bytes [28, 02, 16, 00]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtSetInformationThread + B 7C90E64D 1 Byte [E2]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtUnmapViewOfSection + 6 7C90E966 1 Byte [68]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtUnmapViewOfSection + 6 7C90E966 4 Bytes [68, 03, 16, 00]
    .text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtUnmapViewOfSection + B 7C90E96B 1 Byte [E2]

    ---- Devices - GMER 1.0.15 ----

    Device \Driver\Tcpip \Device\Ip vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
    Device \Driver\Tcpip \Device\Tcp vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
    Device \Driver\Tcpip \Device\Udp vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
    Device \Driver\Tcpip \Device\RawIp vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
    Device \Driver\Tcpip \Device\IPMULTICAST vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)

    ---- Services - GMER 1.0.15 ----

    Service C:\WINDOWS\system32\svchost.exe (*** hidden *** ) [AUTO] ywyyitdy <-- ROOTKIT !!!

    ---- Registry - GMER 1.0.15 ----

    Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\000b6b5d6d42
    Reg HKLM\SYSTEM\CurrentControlSet\Services\ywyyitdy@DisplayName System Monitor
    Reg HKLM\SYSTEM\CurrentControlSet\Services\ywyyitdy@Type 32
    Reg HKLM\SYSTEM\CurrentControlSet\Services\ywyyitdy@Start 2
    Reg HKLM\SYSTEM\CurrentControlSet\Services\ywyyitdy@ErrorControl 0
    Reg HKLM\SYSTEM\CurrentControlSet\Services\ywyyitdy@ImagePath %SystemRoot%\system32\svchost.exe -k netsvcs
    Reg HKLM\SYSTEM\CurrentControlSet\Services\ywyyitdy@ObjectName LocalSystem
    Reg HKLM\SYSTEM\CurrentControlSet\Services\ywyyitdy@Description Supports file, print, and named-pipe sharing over the network for this computer. If this service is stopped, these functions will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.
    Reg HKLM\SYSTEM\CurrentControlSet\Services\ywyyitdy\Parameters
    Reg HKLM\SYSTEM\CurrentControlSet\Services\ywyyitdy\Parameters@ServiceDll C:\WINDOWS\system32\gnhnveo.dll
    Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\000b6b5d6d42 (not active ControlSet)
    Reg HKLM\SYSTEM\ControlSet003\Services\ywyyitdy@DisplayName System Monitor
    Reg HKLM\SYSTEM\ControlSet003\Services\ywyyitdy@Type 32
    Reg HKLM\SYSTEM\ControlSet003\Services\ywyyitdy@Start 2
    Reg HKLM\SYSTEM\ControlSet003\Services\ywyyitdy@ErrorControl 0
    Reg HKLM\SYSTEM\ControlSet003\Services\ywyyitdy@ImagePath %SystemRoot%\system32\svchost.exe -k netsvcs
    Reg HKLM\SYSTEM\ControlSet003\Services\ywyyitdy@ObjectName LocalSystem
    Reg HKLM\SYSTEM\ControlSet003\Services\ywyyitdy@Description Supports file, print, and named-pipe sharing over the network for this computer. If this service is stopped, these functions will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.
    Reg HKLM\SYSTEM\ControlSet003\Services\ywyyitdy\Parameters (not active ControlSet)
    Reg HKLM\SYSTEM\ControlSet003\Services\ywyyitdy\Parameters@ServiceDll C:\WINDOWS\system32\gnhnveo.dll

    ---- EOF - GMER 1.0.15 ----


    Thanks again!

  4. #4
    Senior Member
    Join Date
    Feb 2010
    Location
    Port Hedland, Western Australia
    Posts
    155

    Default

    Hmmm.... We've got some work to do.
    Windows XP Service Pack 2 & no Anti-Virus software. This is no doubt why you are so heavily infected.
    First up, some warnings advice you should seriously take heed of.

    WARNING!!!

    You are running a version of Windows that is no longer supported. You need to be aware that once an operating system is no longer supported there will be no further Microsoft Updates issued for that operating system. If you are running XP SP2, or running Vista with no Service Packs installed, be forewarned that those unpatched operating systems will soon become prime targets for malware infestations unless you take steps to bring them up to date by installing the required Service Pack for your system.

    http://windows.microsoft.com/en-us/w...f-support-mean

    Support for Windows Vista without any service packs ended on April 13, 2010. To continue support, make sure you've installed Windows Vista SP2.
    Support for Windows XP with Service Pack 2 (SP2) ended on July 13, 2010. To continue support, make sure you've installed Windows XP Service Pack 3 (SP3).
    IMPORTANT: The above mentioned Service Packs should only be installed on a malware free computer.
    So wait until I have given the All Clean.

    NOTE: 64 bit Windows XP SP2 will still receive security updates as there is no SP3 for 64 bit XP.

    Support for Windows XP SP1 ended on October 10, 2006.


    No Anti-virus
    You don't have any evidence of anti-virus software.
    Anti-virus software are programs that detect, cleanse, and erase harmful virus files on a computer, Web server, or network. Unchecked, virus files can unintentionally be forwarded to others, including trading partners and thereby spreading infection. Because new viruses regularly emerge, anti-virus software should be updated frequently. Anti-virus software can scan the computer memory and disk drives for malicious code. They can alert the user if a virus is present, and will clean, delete (or quarantine) infected files or directories. Download a free anti-virus software from one these excellent vendors NOW:

    1) Microsoft Security Essentials - Microsoft Security Essentials provides real-time protection for your home PC that guards against viruses, spyware, and other malicious software.
    2) Antivir PersonalEdition Classic- Free anti-virus software for Windows. Detects and removes more than 50,000 viruses. Free support.
    3) avast! 4 Home Edition - Anti-virus program for Windows. The home edition is freeware for noncommercial users.

    Your computer must have only ONE anti-virus program installed at any time. Having more than one anti-virus program installed & active will cause program conflicts, false virus alerts, and system crashes.

    Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.

    It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. If you have a problem with one step, just move to the next.

    Create A System Restore Point
    Create a new System Restore point which you can use in case of any problems that may occur:
    Press Start->All Programs->Accessories->System Tools->System Restore
    Select Create a restore point, then Next, type a name like Pre-Cleaning then press the Create button and once it's done press Close

    TFC (Temp File Cleaner)
    Download TFC (Temp File Cleaner) by Old Timer Here & save it to your desktop.
    • Save any unsaved work. TFC Cleaner will close all open application windows
    • Double-click TFC.exe to run the program, your desktop will temporarily disappear
    • If prompted, click Yes to reboot
    Note: Save your work.. TFC will automatically close any open programs, let it run uninterrupted. It shouldn't take any longer than a couple of minutes & may only take a few seconds. Only if needed will you be prompted to reboot.

    ComboFix
    Download ComboFix from one of these locations (DO NOT download ComboFix from anywhere else but one of the provided links):
    Link 1
    Link 2

    **IMPORTANT !!! Save ComboFix.exe to your Desktop**

    • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
      A guide to do this can be found here
    • Double click on ComboFix.exe & follow the prompts
    • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware
    • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console

    **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

    Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:


    • Click on Yes, to continue scanning for malware.
    • When finished, it shall produce a log for you. Please include the contents of C:\ComboFix.txt in your next reply
    A word of warning: Neither I nor sUBs are responsible for any damage you may cause to your machine by running ComboFix on your own. This tool is not a toy and not for everyday use.
    ComboFix SHOULD NOT be used unless requested by a forum helper


    To post in next reply:
    ComboFix log
    Update on how the computer is running

  5. #5
    Junior Member
    Join Date
    Sep 2010
    Posts
    21

    Default

    Hi there

    thanks again for your post and assistance

    I started running Combo Fix and it asked me if I needed to download the Microsoft Windows Recovery Console, I selected "Yes", then it came up with this message:



    So I pressed "OK" and this came up:



    I'm not sure how to proceed, have you any idea? Should I re-download Combo Fix?

    Cheers

  6. #6
    Senior Member
    Join Date
    Feb 2010
    Location
    Port Hedland, Western Australia
    Posts
    155

    Default

    Hi
    Quote Originally Posted by jmw3
    # As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware
    # Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console
    No need to re-download, but allow it to install the Recovery Console

  7. #7
    Senior Member
    Join Date
    Feb 2010
    Location
    Port Hedland, Western Australia
    Posts
    155

    Default

    Sorry... misread what you said.

    Yes, delete the copy of ComboFix you have & re-download it. before saving it rename it to commy.exe, then try running it.

  8. #8
    Junior Member
    Join Date
    Sep 2010
    Posts
    21

    Default

    Hmmm...still didn't work! :(

    After pressing OK again when I got the message about the Licence Agreement, this is what came up



    Then I pressed "close" and the same error message showed up again.

  9. #9
    Senior Member
    Join Date
    Feb 2010
    Location
    Port Hedland, Western Australia
    Posts
    155

    Default

    OK... Leave ComboFix for a bit. We'll try & get rid of some the crap that's on your computer to see if it makes any difference.

    Malwarebytes' Anti-Malware
    Download Malwarebytes' Anti-Malware here & save to your desktop.
    • Double-click mbam-setup.exe & follow the prompts to install the program
    • At the end, be sure a checkmark is placed next to:
      Update Malwarebytes' Anti-Malware
      Launch Malwarebytes' Anti-Malware
    • Then click Finish
    • If an update is found, it will download and install the latest version
    • Once the program has loaded, select Perform full scan, then click Scan
    • When the scan is complete, click OK, then Show Results to view the results
    • Check all items except items in the C:\System Volume Information folder... then click on Remove Selected
    • When completed, a log will open in Notepad. Please copy & paste the log back into your next reply
      Note:
    • The log is automatically saved by Malwarebytes' Anti-Malware & can be viewed by clicking the Logs tab
    Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
    Click OK to either & let Malwarebytes' Anti-Malware proceed with the disinfection process.
    If asked to restart the computer, please do so. Failure to reboot will prevent MBAM from removing all the malware.
    If you receive an (Error Loading) error on reboot please reboot a second time . It is normal for this error to occur once & does not need to be reported unless it returns on future reboots.

  10. #10
    Junior Member
    Join Date
    Sep 2010
    Posts
    21

    Default

    Swell...ok here's the Malwarebytes log:



    Malwarebytes' Anti-Malware 1.46
    www.malwarebytes.org

    Database version: 4052

    Windows 5.1.2600 Service Pack 2
    Internet Explorer 6.0.2900.2180

    8/09/2010 10:35:06 PM
    mbam-log-2010-09-08 (22-35-06).txt

    Scan type: Full scan (C:\|)
    Objects scanned: 176360
    Time elapsed: 22 minute(s), 0 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 3
    Registry Values Infected: 1
    Registry Data Items Infected: 2
    Folders Infected: 8
    Files Infected: 3

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    HKEY_CLASSES_ROOT\.pox (Rogue.FixTool) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\pofile (Rogue.FixTool) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Miracle (PUP.PerfectOptimizer) -> Quarantined and deleted successfully.

    Registry Values Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\taskman (Trojan.Agent) -> Quarantined and deleted successfully.

    Registry Data Items Infected:
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell (Hijack.Shell) -> Bad: (explorer.exe,C:\RECYCLER\S-1-5-21-9624512614-5829467475-673620608-5226\rundll32.exe) Good: (Explorer.exe) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue (Hijack.System.Hidden) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.

    Folders Infected:
    C:\Program Files\Perfect Optimizer (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
    C:\Program Files\Perfect Optimizer\Backup (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
    C:\Program Files\Perfect Optimizer\Backup\Registry (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
    C:\Program Files\Perfect Optimizer\Backup\Registry\FirstBackup (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
    C:\Program Files\Perfect Optimizer\Backup\Registry\FullBackup (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
    C:\Program Files\Perfect Optimizer\Backup\Service (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
    C:\Program Files\Perfect Optimizer\Backup\Application (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
    C:\Program Files\Perfect Optimizer\Temp (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.

    Files Infected:
    C:\RECYCLER\S-1-5-21-9624512614-5829467475-673620608-5226\rundll32.exe (Worm.P2P) -> Delete on reboot.
    C:\RECYCLER\S-1-5-21-7356296101-1933998588-915145784-2179\yv8g67.exe (Worm.Autorun.B) -> Delete on reboot.
    C:\Program Files\Perfect Optimizer\PerfectOptimizer.ini (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •