smitfraud, troj.printspool, win32.nlc

[goinnuts]

My daughter came home from college with the inability to log onto the web. Turns out her wireless connection was turned off. When I turned it on, the computer attempted to immediately hijack me to another site. i turned it off, ran some checks, got rid of alot of garbage. She only had spybot going, and hadnt run it in some time. I ran spybot, adaware, vundofix, Drweb-cureit and avgas, all of which found alot of junk. I tried to install the smitfraud fix, but only seem to get some french version that wont work. I still cannot get an internet connection through IE (card says connected), so i cannot get "autoupdates" from spybot and some others. I am copying programs to a disk on a uninfected computer. I thought I was clean, read the directions of "before you post" and installed bitdefender (see log below). I guess I wasnt. I think I cant get some updates because of the lack of connectivity, and wonder if my IE is so corrupted we need to crash and start over?

I hate to admit defeat! I really want to fix this, if I can.:sad:

Logfile of HijackThis v1.99.1
Scan saved at 9:14:16 AM, on 4/9/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Common Files\AOL\1143604640\ee\AOLSoftware.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\WINDOWS\gsvpm.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\rsbmsc.exe
C:\DOCUME~1\Annie\LOCALS~1\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe
D:\bitdefender_av_v10.exe
C:\DOCUME~1\Annie\LOCALS~1\Temp\IXP000.TMP\Setup.Exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Softwin\BitDefender10\vsserv.exe
C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Softwin\BitDefender10\bdagent.exe
C:\Program Files\Softwin\BitDefender10\bdmcon.exe
C:\DOCUME~1\Annie\LOCALS~1\Temp\Temporary Directory 2 for hijackthis.zip\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\mbti.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {38275B48-C2D4-433D-8A77-1E71CD433B4b} - C:\WINDOWS\system32\rloqetkd.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: (no name) - {8D974332-B8D4-4C9A-A0E2-F68551B45FF2} - C:\WINDOWS\msagent\chars\yssewb.dll (file missing)
O2 - BHO: (no name) - {90F28AF0-2CE4-487E-8B90-A578B7C4C417} - C:\WINDOWS\system32\iifcbcy.dll (file missing)
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "c:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1143604640\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [Anti-Virus] C:\WINDOWS\system32\vrss.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [AntiVirusUpdateExe] C:\WINDOWS\gsvpm.exe
O4 - HKLM\..\Run: [tcpipmon] tcpipmon.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SoundService] rundll32.exe "C:\WINDOWS\system32\ysnkdqnc.dll",setvm
O4 - HKLM\..\Run: [Microsoft (R) Windows Network Latency Controller] C:\WINDOWS\system32\mbti.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [63168E1F] C:\WINDOWS\system32\rsbmsc.exe
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
O4 - HKLM\..\RunOnce: [wextract_cleanup0] rundll32.exe C:\WINDOWS\system32\advpack.dll,DelNodeRunDLL32 "C:\DOCUME~1\Annie\LOCALS~1\Temp\IXP000.TMP\"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {E473A65C-8087-49A3-AFFD-C5BC4A10669B} (Quantum Streaming IE Player Class) - http://mvnet.xlontech.net/qm/fox/06101102/qsp2ie06101001.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe Active File Monitor (AdobeActiveFileMonitor) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: Data System Manager - Unknown owner - C:\WINDOWS\system32\vcmon.exe (file missing)
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)
O23 - Service: Distributed Process Services (MSDPSV) - Unknown owner - C:\WINDOWS\system32\msdpsv.exe (file missing)
O23 - Service: MSSQL$MICROSOFTSMLBIZ - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe" -sMICROSOFTSMLBIZ (file missing)
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: Photoshop Elements Device Connect (PhotoshopElementsDeviceConnect) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SQLAgent$MICROSOFTSMLBIZ - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlagent.EXE" -i MICROSOFTSMLBIZ (file missing)
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender10\vsserv.exe" /service (file missing)
O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)


and my bitdefender showed:


//-----------------------------------------------------------------
//
// Product BitDefender Antivirus v10
// Product 10.2
//
// Created on: 09/04/2007 08:43:04
//
//-----------------------------------------------------------------


Virus Statistics

Scan path : C:\WINDOWS
C:\Program Files
Folders : 3739
Files : 25024
Memory processes scanned : 0
Archives : 0
Runtime packers : 2146
Identified viruses : 14
Infected files : 42
Memory processes infected : 0
Suspect files : 1
Warnings : 0
Disinfected files : 0
Deleted files : 5
Moved files : 37
I/O errors : 1
Scan time : 00:11:48
Scan speed (files/sec) : 35

Virus definitions : 454148
Scan plugins : 16
Archive plugins : 41
Unpack plugins : 6
Mail plugins : 6
System plugins : 5

Virus scan options

Detection
[X] Scan boot sectors
[ ] Memory Processes
[ ] Scan archives
[X] Scan runtime packers
[X] Scan email

File mask
[X] Programs
[ ] All files
[ ] User defined extensions:
[ ] Exclude extensions: ;

Action

Infected objects
[ ] Ignore
[X] Disinfect
[ ] Delete
[ ] Move to quarantine
[ ] Prompt user

Second action
[ ] Ignore
[ ] Delete
[X] Move to quarantine
[ ] Prompt user

Virus scan options
[X] Enable warnings
[ ] Enable heuristics
[ ] Show all files in log
[X] Report file: C:\DOCUME~1\Annie\LOCALS~1\Temp\1176126184.log

Spyware scan options

[X] Scan for riskware
[ ] Skip dial and applications from scan
[ ] Registry keys
[ ] Cookies


Summary:

C:\WINDOWS\system32\agqufisw.exe Detected: Adware.Agent.AT
C:\WINDOWS\system32\agqufisw.exe Disinfection failed
C:\WINDOWS\system32\agqufisw.exe Moved
C:\WINDOWS\system32\cgparcfi.exe Detected: Adware.Agent.AT
C:\WINDOWS\system32\cgparcfi.exe Disinfection failed
C:\WINDOWS\system32\cgparcfi.exe Moved
C:\WINDOWS\system32\cxpfupud.exe Detected: Adware.Agent.AT
C:\WINDOWS\system32\cxpfupud.exe Disinfection failed
C:\WINDOWS\system32\cxpfupud.exe Moved
C:\WINDOWS\system32\djlbyksi.exe Detected: Adware.Agent.AT
C:\WINDOWS\system32\djlbyksi.exe Disinfection failed
C:\WINDOWS\system32\djlbyksi.exe Moved
C:\WINDOWS\system32\dvfwxjvp.exe Detected: Adware.Agent.AT
C:\WINDOWS\system32\dvfwxjvp.exe Disinfection failed
C:\WINDOWS\system32\dvfwxjvp.exe Moved
C:\WINDOWS\system32\ecfvirti.exe Detected: Adware.Agent.AT
C:\WINDOWS\system32\ecfvirti.exe Disinfection failed
C:\WINDOWS\system32\ecfvirti.exe Moved
C:\WINDOWS\system32\ettpunks.exe Detected: Adware.Searchcolor.A
C:\WINDOWS\system32\ettpunks.exe Deleted
C:\WINDOWS\system32\evilxrox.dll Infected: Trojan.Spy.VBStat.H
C:\WINDOWS\system32\evilxrox.dll Disinfection failed
C:\WINDOWS\system32\evilxrox.dll Moved
C:\WINDOWS\system32\fckxdwjh.exe Detected: Adware.Agent.AT
C:\WINDOWS\system32\fckxdwjh.exe Disinfection failed
C:\WINDOWS\system32\fckxdwjh.exe Moved
C:\WINDOWS\system32\fpsfhefd.dll Infected: Trojan.Spy.VBStat.H
C:\WINDOWS\system32\fpsfhefd.dll Disinfection failed
C:\WINDOWS\system32\fpsfhefd.dll Moved
C:\WINDOWS\system32\hpsvc.exe Infected: Generic.Sdbot.E6B8952D
C:\WINDOWS\system32\hpsvc.exe Deleted
C:\WINDOWS\system32\hskgqfpe.dll Infected: Trojan.Juan.E
C:\WINDOWS\system32\hskgqfpe.dll Disinfection failed
C:\WINDOWS\system32\hskgqfpe.dll Moved
C:\WINDOWS\system32\ipeafyff.exe Detected: Adware.Agent.AT
C:\WINDOWS\system32\ipeafyff.exe Disinfection failed
C:\WINDOWS\system32\ipeafyff.exe Moved
C:\WINDOWS\system32\jdehiivn.exe Detected: Adware.Agent.AT
C:\WINDOWS\system32\jdehiivn.exe Disinfection failed
C:\WINDOWS\system32\jdehiivn.exe Moved
C:\WINDOWS\system32\kiacdvpv.exe Detected: Adware.Agent.AT
C:\WINDOWS\system32\kiacdvpv.exe Disinfection failed
C:\WINDOWS\system32\kiacdvpv.exe Moved
C:\WINDOWS\system32\kikfcfcp.exe Detected: Adware.Agent.AT
C:\WINDOWS\system32\kikfcfcp.exe Disinfection failed
C:\WINDOWS\system32\kikfcfcp.exe Moved
C:\WINDOWS\system32\lqvbfill.dll Infected: Trojan.Juan.D
C:\WINDOWS\system32\lqvbfill.dll Disinfection failed
C:\WINDOWS\system32\lqvbfill.dll Moved
C:\WINDOWS\system32\max1d1641.exe Detected: Dialer.Porn.Gbdialer.I
C:\WINDOWS\system32\max1d1641.exe Disinfection failed
C:\WINDOWS\system32\max1d1641.exe Moved
C:\WINDOWS\system32\mpreg.exe Infected: Generic.Ranky.3DC22BDF
C:\WINDOWS\system32\mpreg.exe Disinfection failed
C:\WINDOWS\system32\mpreg.exe Moved
C:\WINDOWS\system32\nkrqjpaj.exe Detected: Adware.Agent.AT
C:\WINDOWS\system32\nkrqjpaj.exe Disinfection failed
C:\WINDOWS\system32\nkrqjpaj.exe Moved
C:\WINDOWS\system32\nsldfdke.dll Infected: Trojan.Winfixer.AH
C:\WINDOWS\system32\nsldfdke.dll Deleted
C:\WINDOWS\system32\oeuesdfl.dll Infected: Backdoor.Pcclient.CC
C:\WINDOWS\system32\oeuesdfl.dll Disinfection failed
C:\WINDOWS\system32\oeuesdfl.dll Moved
C:\WINDOWS\system32\ovpdmjvt.dll Infected: Trojan.Spy.VBStat.H
C:\WINDOWS\system32\ovpdmjvt.dll Disinfection failed
C:\WINDOWS\system32\ovpdmjvt.dll Moved
C:\WINDOWS\system32\pmgyahrb.dll Infected: Trojan.Spy.VBStat.H
C:\WINDOWS\system32\pmgyahrb.dll Disinfection failed
C:\WINDOWS\system32\pmgyahrb.dll Moved
C:\WINDOWS\system32\pvknclkg.dll Infected: Trojan.Juan.A
C:\WINDOWS\system32\pvknclkg.dll Disinfection failed
C:\WINDOWS\system32\pvknclkg.dll Moved
C:\WINDOWS\system32\qdaawrrs.exe Detected: Adware.Agent.AT
C:\WINDOWS\system32\qdaawrrs.exe Disinfection failed
C:\WINDOWS\system32\qdaawrrs.exe Moved
C:\WINDOWS\system32\qsyieuse.exe Detected: Adware.Agent.AT
C:\WINDOWS\system32\qsyieuse.exe Disinfection failed
C:\WINDOWS\system32\qsyieuse.exe Moved
C:\WINDOWS\system32\sgbxrhdu.dll Infected: Trojan.Spy.VBStat.H
C:\WINDOWS\system32\sgbxrhdu.dll Disinfection failed
C:\WINDOWS\system32\sgbxrhdu.dll Moved
C:\WINDOWS\system32\spoolb.exe Infected: Backdoor.HacDef.GR
C:\WINDOWS\system32\spoolb.exe Disinfection failed
C:\WINDOWS\system32\spoolb.exe Moved
C:\WINDOWS\system32\svhnicmx.exe Detected: Adware.Agent.AT
C:\WINDOWS\system32\svhnicmx.exe Disinfection failed
C:\WINDOWS\system32\svhnicmx.exe Moved
C:\WINDOWS\system32\sxkqrffp.exe Detected: Adware.Agent.AT
C:\WINDOWS\system32\sxkqrffp.exe Disinfection failed
C:\WINDOWS\system32\sxkqrffp.exe Moved
C:\WINDOWS\system32\tayxpvrb.exe Detected: Adware.Agent.AT
C:\WINDOWS\system32\tayxpvrb.exe Disinfection failed
C:\WINDOWS\system32\tayxpvrb.exe Moved
C:\WINDOWS\system32\thhacxah.dll Infected: Trojan.Winfixer.AH
C:\WINDOWS\system32\thhacxah.dll Deleted
C:\WINDOWS\system32\vjuriqmg.exe Detected: Adware.Agent.AT
C:\WINDOWS\system32\vjuriqmg.exe Disinfection failed
C:\WINDOWS\system32\vjuriqmg.exe Moved
C:\WINDOWS\system32\vpms.exe Infected: Trojan.Spambot.BA
C:\WINDOWS\system32\vpms.exe Disinfection failed
C:\WINDOWS\system32\vpms.exe Moved
C:\WINDOWS\system32\widiaqre.exe Detected: Adware.Agent.AT
C:\WINDOWS\system32\widiaqre.exe Disinfection failed
C:\WINDOWS\system32\widiaqre.exe Moved
C:\WINDOWS\system32\winmgr.exe Infected: Generic.Sdbot.63B56755
C:\WINDOWS\system32\winmgr.exe Deleted
C:\WINDOWS\system32\wlodhsmt.exe Detected: Adware.Agent.AT
C:\WINDOWS\system32\wlodhsmt.exe Disinfection failed
C:\WINDOWS\system32\wlodhsmt.exe Moved
C:\WINDOWS\system32\wwcindbf.exe Detected: Adware.Agent.AT
C:\WINDOWS\system32\wwcindbf.exe Disinfection failed
C:\WINDOWS\system32\wwcindbf.exe Moved
C:\WINDOWS\system32\ylfhgwgq.exe Detected: Adware.Agent.AT
C:\WINDOWS\system32\ylfhgwgq.exe Disinfection failed
C:\WINDOWS\system32\ylfhgwgq.exe Moved
C:\WINDOWS\system32\ymnxpnvs.exe Detected: Adware.Agent.AT
C:\WINDOWS\system32\ymnxpnvs.exe Disinfection failed
C:\WINDOWS\system32\ymnxpnvs.exe Moved
C:\WINDOWS\system32\zdrive.exe Infected: Backdoor.HacDef.GR
C:\WINDOWS\system32\zdrive.exe Disinfection failed
C:\WINDOWS\system32\zdrive.exe Moved

[pskelley]

Welcome to the forum, I hate to be the bearer of bad news, but that is all I have to offer in this case. This computer is badly infected. Have a look at the few trojans I could identify:
vcmon.exe Probably: http://www.sophos.com/security/analyses/w32tileboths.html
Allows others to access the computer
Installs itself in the Registry
Exploits system or software vulnerabilities
Used in DOS attacks
Scans network for vulnerabilities
Scans network for weak passwords

rsbmsc.exe: http://www.bleepingcomputer.com/startups/rsbmsc.exe-17317.html

mbti.exe: http://research.sunbelt-software.com/threatdisplay.aspx?name=Trojan-Proxy.Win32.Ranky.gen&threatid=50557
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\system32\mbti.exe Added by a variant of the Rbot familly of trojan

tcpipmon.exe: http://www.bleepingcomputer.com/startups/tcpipmon.exe-17087.html
http://www.google.com/search?hl=en&q=tcpipmon.exe&btnG=Search

There is more, those are just the ones I could identify. Because your security is severely compromised, I need to provide this information:
A Backdoor is a software program that gives an attacker unauthorized access to a machine and the means for remotely controlling the machine without the user's knowledge. A Backdoor compromises system integrity by making changes to the system that allow it to by used by the attacker for malicious purposes unknown to the user.

One or more of the identified infections is a backdoor trojan.
This allows hackers to remotely control your computer, steal critical system information and Download and Execute files
I would counsel you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.
Though the Trojan has been identified and can be killed, because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of Trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:

How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?
http://www.dslreports.com/faq/10451

When Should I Format, How Should I Reinstall
http://www.dslreports.com/faq/10063

Please let us know what you have decided to do in your next post.

Thanks

[tashi]

This topic has been archived to prevent others with similar issues posting in it.

If you need it re-opened please send me a private message (pm) and provide a link to the thread. Applies only to the original poster, anyone else with similar problems please start a new topic.