Malware/spyware/virus unable to remove .dll files

[Carlleetos]

I've run several different AV software AVG Norton and some other i do not remember. Now i turn to you guys.

Running certain programs a lot of things are showing up here. The files i'm having issues with are in c:\windows\system32

the main file i cannot delete is named "pmnkiii.dll" it has seemed to constantly create more .dll files all randomly named. the current ones that are on here ATM i'm able to delete excluding the one (using them as examples of the type of file names produced) are: jkhhf.dll and pmkjk.dll - files seen in runalyzer in explorer plugins: rmmtbxyl.dll, pmkjk.dll, jkhhf.dll, pmnkiii.dll, mljjj.dll

virus scanner keeps freezing on me. cannot post log.

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 8:44:09 PM, on 6/27/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\Program Files\Common Files\AOL\1135098635\ee\AOLSoftware.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Ahead\ODD Toolkit\DVDTray.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe
C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\User\My Documents\VundoFix.exe
C:\Program Files\Safer Networking\RunAlyzer\RunAlyzer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Security Task Manager\TaskMan.exe
C:\Documents and Settings\User\My Documents\NEW MODS\HiJackThis_v2.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1F6581D5-AA53-4b73-A6F9-41420C6B61F1} - C:\WINDOWS\system32\rmmtbxyl.dll (file missing)
O2 - BHO: (no name) - {443778C7-199B-40D0-89A8-C92673AA1CFF} - C:\WINDOWS\system32\pmkjk.dll
O2 - BHO: (no name) - {512637C4-288E-45C1-8F00-239CF1DEBF64} - C:\WINDOWS\system32\jkhhf.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: (no name) - {7C24493F-3D23-4258-9426-42C5FC3B8211} - C:\WINDOWS\system32\pmnkiii.dll
O2 - BHO: (no name) - {9BCFE9CB-79EA-4CAB-B482-161BB1A238DA} - C:\WINDOWS\system32\mljjj.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1135098635\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [DVDTray] C:\Program Files\Ahead\ODD Toolkit\DVDTray.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [smgr] mgrs.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SpywareBot] C:\Program Files\SpywareBot\SpywareBot.exe -boot
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [EasyLinkAdvisor] "C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Wauh] "C:\WINDOWS\system32\FNTS~1\msiexec.exe" -vt yazb
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Startup: SpywareBlaster.lnk = C:\Program Files\SpywareBlaster\spywareblaster.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {8A0019EB-51FA-4AE5-A40B-C0496BBFC739} (Verizon Wireless Media Upload) - http://www.vzwpix.com/activex/VerizonWirelessUploadControl.cab
O20 - Winlogon Notify: jkhhf - C:\WINDOWS\system32\jkhhf.dll (file missing)
O20 - Winlogon Notify: pmkjk - C:\WINDOWS\system32\pmkjk.dll
O20 - Winlogon Notify: pmnkiii - C:\WINDOWS\SYSTEM32\pmnkiii.dll
O20 - Winlogon Notify: winzwr32 - winzwr32.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\glbatvda.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: WMP54Gv4SVC - GEMTEKS - C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe

--
End of file - 9446 bytes


I hope someone can help me on this... i'll post the other log when i can

[Carlleetos]

Got it taken care of. Used "killbot". still wouldn't let me use it. then used an "unlocker assistant" and hit delete on killbot mere seconds before my computer shutdown and gave me a fatal error (upon startup). but the file is gone and the rest are not coming back it seems!

[pskelley]

Welcome to Safer Networking, I wish to be sure you have viewed and understand this information. "BEFORE you POST" (READ this Procedure before Requesting Assistance)
http://forums.spybot.info/showthread.php?t=288
All advice given is taken at your own risk.
Please make sure you have read this information so we are on the same page.

That sounds good:bigthumb: and I certainly hope you are right because we have more work than we can handle. I can see you have Vundofix onboard (which I suggest you remove from your computer at this point) but I can also see: mgrs.exe >>> http://spywarefiles.prevx.com/RRHBCD3637890/MGRS.EXE.html and this junk:
O4 - HKCU\..\Run: [Wauh] "C:\WINDOWS\system32\FNTS~1\msiexec.exe" -vt yazb which is probably this:
http://www.castlecops.com/startuplist-7912.html

You are also running this from your Services:
O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\glbatvda.exe (file missing)
http://www.castlecops.com/O23.html
DomainService X (8 digit random).exe Trojan.Win32.Agent.aoy Note: Located in :\WINDOWS\system32 (XP/NT)

I am taking the time (volunteered by the way) to show you this because not only is Vundo hard to remove but Vundofix does not remove the stuff I just pointed to.

Thanks

[Carlleetos]

TYVM for the info pskelly and thank you for taking the time to give me that volunteered time also. it totally slipped my mind that i posted this so i have only just read it. unfortunately i am bored at work atm so i cannot act on this. i remember i did kill mgrs.exe. not sure about the other two.

i do infact have an issue with torpig coming up with two files:

C:\WINDOWS\Temp\$_2341234.TMP
C:\WINDOWS\Temp\$_2341233.TMP

but only when i scan with S&D. otherwise i'm unable to find them. i can either start a new post or just post a log here.

ty
-Carl

[pskelley]

Review the instructions and post a new HJT log and I will be glad to look at it.

Thanks...Phil

[Carlleetos]

okay finally home! got the fiance off my back enough to work with you if you're ready

Logfile of HijackThis v1.99.1
Scan saved at 4:23:29 PM, on 7/7/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\Program Files\Common Files\AOL\1135098635\ee\AOLSoftware.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Ahead\ODD Toolkit\DVDTray.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\slserv.exe
C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe
C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\User\My Documents\NEW MODS\Hijack This\HijackThis.exe

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1135098635\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [DVDTray] C:\Program Files\Ahead\ODD Toolkit\DVDTray.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SpywareBot] C:\Program Files\SpywareBot\SpywareBot.exe -boot
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [EasyLinkAdvisor] "C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup
O4 - HKCU\..\Run: [Wauh] "C:\WINDOWS\system32\FNTS~1\msiexec.exe" -vt yazb
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Startup: SpywareBlaster.lnk = C:\Program Files\SpywareBlaster\spywareblaster.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {8A0019EB-51FA-4AE5-A40B-C0496BBFC739} (Verizon Wireless Media Upload) - http://www.vzwpix.com/activex/VerizonWirelessUploadControl.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: WMP54Gv4SVC - Unknown owner - C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe" "WMP54Gv4.exe (file missing)

i tried to follow the instructions let me know if i did anything wrong

[pskelley]

Unfortunately, I started my day on these logs at 5AM EST amd I am normally closed down by now. I will respond but it will be morning before I see your response.

I see this in the HJT log:
O4 - HKCU\..\Run: [Wauh] "C:\WINDOWS\system32\FNTS~1\msiexec.exe" -vt yazb
I am fairly sure this is PurityScan/OIN Adware.

O4 - HKLM\..\Run: [SpywareBot] C:\Program Files\SpywareBot\SpywareBot.exe -boot
http://www.spywarewarrior.com/rogue_anti-spyware.htm
SpywareBot spywarebot.com exploits name "Spybot Search & Destroy"; same app as AdwareAlert [A: 5-14-06 / U: 1-9-07]

If you thought that program was Spybot S&D, it is not as you can see.

Let's do this for tonight.

1) Open Hijackthis.
Click the "Open the Misc Tools" section Button.
Click the "Open Uninstall Manager" Button.
Click the "Save list..." Button.
Save it to your desktop. Copy and paste the contents into your reply.
(You may edit out Microsoft, Hotfixes, Security Update for Windows XP, Update for Windows XP and Windows XP Hotfix to shorten the list)

2) Thanks to sUBs and anyone else who helped with this fix.

Download ComboFix from Here (http://www.techsupportforum.com/sectools/sUBs/ComboFix.exe) or Here (http://download.bleepingcomputer.com/sUBs/ComboFix.exe) to your Desktop.

Double click combofix.exe and follow the prompts.
When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply

Note: Do not mouseclick combofix's window while its running. That may cause it to stall

Post the uninstall list, combofix log and a new HJT log.

Thanks

[Carlleetos]

Uninstall Log

Adobe Reader 8
AVG 7.5
CardRd81
CCHelp
CCScore
CopyToDVD Suite 3
CR2
DivX Player
DivX Pro Codec
DVD X Rescue
ESSAdpt
ESSANUP
ESSBrwr
ESSCAM
ESSCDBK
ESScore
ESSCT
ESSgui
ESShelp
ESSini
ESSPCD
ESSPDock
ESSSONIC
ESSTUTOR
ESSvpaht
ESSvpot
FileAlyzer
Google Pack Screensaver
Google Toolbar for Internet Explorer
Google Toolbar for Internet Explorer
HijackThis 1.99.1
HLPCCTR
HLPIndex
HLPPDOCK
HLPRFO
Kodak EasyShare software
KSU
Linksys EasyLink Advisor 1.5 (1045)
Linksys Wireless-G PCI Adapter
Macromedia Flash Player 8
Microsoft .NET Framework 2.0
MSN Music Assistant
Nero Suite
Notifier
NVIDIA Drivers
OTtBP
OTtBPSDK
PCDLNCH
PowerArchiver 2006 v9.63
PowerDVD
QuickTime
RunAlyzer
ScummVM 0.9.0
Security Task Manager 1.7e
SFR
SFR2
SiS 900 PCI Fast Ethernet Adapter Driver
Spybot - Search & Destroy 1.4
Unlocker 1.8.5
VCAMCEN
VPRINTOL
WinAce Archiver
Windows Media Format Runtime
Windows Media Player 10
World of Warcraft
Yahoo! Browser Services
Yahoo! Install Manager
Yahoo! Internet Mail
Yahoo! Messenger
Yahoo! Toolbar

"User" - 2007-07-07 17:32:04 - ComboFix 07-07-07.3 - Service Pack 2


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\DOCUME~1\User\Desktop\internet.lnk
C:\Program Files\Common Files\microsoft shared\web folders\ibm00001.dll
C:\WINDOWS\system32\fnts~1


((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


-------\LEGACY_ASC3550U
-------\LEGACY_DOMAINSERVICE
-------\asc3550u
-------\DomainService


((((((((((((((((((((((((( Files Created from 2007-06-08 to 2007-07-08 )))))))))))))))))))))))))))))))


2007-07-07 17:30 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-06-28 19:01 <DIR> d-------- C:\WINDOWS\pss
2007-06-28 18:29 <DIR> d-------- C:\DOCUME~1\User\APPLIC~1\Uniblue
2007-06-27 22:55 1,858 --a------ C:\WINDOWS\system32\tmp.reg
2007-06-27 22:51 53,248 --a------ C:\WINDOWS\system32\Process.exe
2007-06-27 22:51 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2007-06-27 22:51 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2007-06-27 18:08 <DIR> d-------- C:\Program Files\Safer Networking
2007-06-26 21:07 <DIR> d-------- C:\DOCUME~1\User\APPLIC~1\SpywareBot
2007-06-26 20:29 <DIR> d-------- C:\Program Files\Security Task Manager
2007-06-26 20:29 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\SecTaskMan
2007-06-26 20:17 524,288 --ah----- C:\DOCUME~1\ADMINI~1\NTUSER.DAT
2007-06-26 20:17 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Gtek
2007-06-24 19:55 <DIR> d-------- C:\DOCUME~1\User\APPLIC~1\Symantec
2007-06-24 19:53 <DIR> d-------- C:\Program Files\Symantec
2007-06-24 19:53 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared
2007-06-24 19:51 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-06-29 21:55:13 -------- d-----w C:\Program Files\World of Warcraft
2006-01-24 08:45:22 8 --sh--r C:\WINDOWS\system32\ED5FC17486.sys
2006-01-24 08:45:23 1,890 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}]
2006-10-26 11:28 440384 --a------ C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2006-10-23 00:08 62080 --a------ C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
2005-05-31 01:04 853672 --a------ C:\PROGRA~1\SPYBOT~1\SDHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}]
2006-10-31 16:29 198136 --a------ C:\Program Files\Yahoo!\Common\yiesrvc.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
2007-03-12 18:37 2403392 -ra------ c:\program files\google\googletoolbar1.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
2007-05-27 13:20 325048 --a------ C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HostManager"="C:\Program Files\Common Files\AOL\1135098635\ee\AOLSoftware.exe" [2006-05-09 17:24]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-10-25 19:58]
"DVDTray"="C:\Program Files\Ahead\ODD Toolkit\DVDTray.exe" [2004-09-03 01:58]
"InCD"="C:\Program Files\Ahead\InCD\InCD.exe" [2005-07-25 03:01]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 20:24]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-06-25 16:48]
"SpywareBot"="C:\Program Files\SpywareBot\SpywareBot.exe" []
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 12:22]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"EasyLinkAdvisor"="C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" [2006-10-30 12:01]
"Wauh"="C:\WINDOWS\system32\FNTS~1\msiexec.exe" []
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-03-31 13:41]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup=C:\WINDOWS\pss\Kodak EasyShare software.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak software updater.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak software updater.lnk
backup=C:\WINDOWS\pss\Kodak software updater.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBJ]
"C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant]
"C:\Program Files\Unlocker\UnlockerAssistant.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - netsvcs
NtmlSvc


Contents of the 'Scheduled Tasks' folder
2007-07-07 10:00:00 C:\WINDOWS\tasks\SpywareBot Scheduled Scan.job

**************************************************************************

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-07 17:34:57
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-07 17:36:53 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-07-07 17:36

--- E O F ---

Logfile of HijackThis v1.99.1
Scan saved at 5:41:12 PM, on 7/7/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\slserv.exe
C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe
C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe
C:\Program Files\Common Files\AOL\1135098635\ee\AOLSoftware.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Ahead\ODD Toolkit\DVDTray.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\User\My Documents\NEW MODS\Hijack This\HijackThis.exe

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1135098635\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DVDTray] C:\Program Files\Ahead\ODD Toolkit\DVDTray.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SpywareBot] C:\Program Files\SpywareBot\SpywareBot.exe -boot
O4 - HKCU\..\Run: [EasyLinkAdvisor] "C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup
O4 - HKCU\..\Run: [Wauh] "C:\WINDOWS\system32\FNTS~1\msiexec.exe" -vt yazb
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Startup: SpywareBlaster.lnk = C:\Program Files\SpywareBlaster\spywareblaster.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {8A0019EB-51FA-4AE5-A40B-C0496BBFC739} (Verizon Wireless Media Upload) - http://www.vzwpix.com/activex/VerizonWirelessUploadControl.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: WMP54Gv4SVC - Unknown owner - C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe" "WMP54Gv4.exe (file missing)


i have a couple comments that might or might not be other issues.
when i look at the properties for C:\\windows or C:\\windows\system32 the size and size on disk ticks up (dunno if this is the right explanation)

also when i fully booted up from the combofix, an error from google toolbar i'm assuming. it says "an attempt has been made to switch your default search away from google. i have the option to keep it as is or change it to "http://www.microsoft.com/isapi/redir.dll?prd=iear=iesearch"

any thoughts on these?

[Carlleetos]

I'm not sure if i should have or not (you didn't tell me to) but i went ahead and deleted msiexec.exe manually and O4 - HKLM\..\Run: [SpywareBot] C:\Program Files\SpywareBot\SpywareBot.exe -boot via HJT. I also went ahead and did about 4 or 5 resets just to make sure they didn't RES themselves. They didn't seem to.

here's a new log for you to look over.

Logfile of HijackThis v1.99.1
Scan saved at 6:27:38 PM, on 7/7/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\AOL\1135098635\ee\AOLSoftware.exe
C:\Program Files\Ahead\ODD Toolkit\DVDTray.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\slserv.exe
C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe
C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\User\My Documents\NEW MODS\Hijack This\HijackThis.exe

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1135098635\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DVDTray] C:\Program Files\Ahead\ODD Toolkit\DVDTray.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [EasyLinkAdvisor] "C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {8A0019EB-51FA-4AE5-A40B-C0496BBFC739} (Verizon Wireless Media Upload) - http://www.vzwpix.com/activex/VerizonWirelessUploadControl.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: WMP54Gv4SVC - Unknown owner - C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe" "WMP54Gv4.exe (file missing)

[pskelley]

Thanks for returning your information, as far as I can see the uninstall list looks ok. I do not know all of you programs, you might want to look for stuff you know does not belong or you no longer use...your call.

combofix located a real nasty backdoor trojan, see this:
http://www.pandasoftware.com/com/virus_info/encyclopedia/overview.aspx?lst=det&idvirus=109008
C:\Program Files\Common Files\microsoft shared\web folders\ibm00001.dll
I would read that information and also this: http://www.dslreports.com/faq/10451
I am not rying to scare you but this trojan was after information on your computer. I would change all passwords if I were you and keep a close eye on any accounts you have information about on the computer.
http://www.google.com/search?hl=en&q=ibm00001.dll&btnG=Google+Search


Logfile of HijackThis v1.99.1 Scan saved at 6:27:38 PM, on 7/7/2007

This HJT log looks clean, good job:bigthumb: Since you had a nasty infection let's run one good scan to make sure nothing is hiding. The scan will not remove anything but it will show us.

Run this online scan using Internet Explorer:
Kaspersky Online Scanner from http://www.kaspersky.com/virusscanner

Next Click on Launch Kaspersky Online Scanner

You will be prompted to install an ActiveX component from Kaspersky, Click Yes.

* The program will launch and then begin downloading the latest definition files:
* Once the files have been downloaded click on NEXT
* Now click on Scan Settings
* In the scan settings make that the following are selected:
* Scan using the following Anti-Virus database:
* Standard
* Scan Options:
* Scan Archives
* Scan Mail Bases
* Click OK
* Now under select a target to scan:
* Select My Computer
* This will program will start and scan your system.
* The scan will take a while so be patient and let it run.
* Once the scan is complete it will display if your system has been infected.
* Now click on the Save as Text button:
* Save the file to your desktop.

Then post it here. (only need the scan results this time)

____________________________________________________________

when i look at the properties for C:\\windows or C:\\windows\system32 the size and size on disk ticks up (dunno if this is the right explanation)I am not sure what you are asking here?

also when i fully booted up from the combofix, an error from google toolbar i'm assuming. it says "an attempt has been made to switch your default search away from googleYou may set any HomePage you wish in Internet Explorer. They appear as R1 and R2 lines in the HJT log, and I see none now? See if this information helps:
Making Microsoft Internet Explorer 7 Your Own: The Basics
http://www.microsoft.com/windows/ie/community/columns/ie7_basics.mspx

Thanks...Phil

[Carlleetos]

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Sunday, July 08, 2007 1:08:52 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.93.0
Kaspersky Anti-Virus database last update: 8/07/2007
Kaspersky Anti-Virus database records: 337507
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: standard
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\
F:\

Scan Statistics:
Total number of scanned objects: 41246
Number of viruses found: 6
Number of infected objects: 10
Number of suspicious objects: 0
Duration of the scan process: 00:40:16

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Avg7\Log\emc.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\User\Application Data\GTek\GTUpdate\AUpdate\EasyLinkAdvisor\gdql_lsa_LinksysAgent.log Object is locked skipped
C:\Documents and Settings\User\Application Data\GTek\GTUpdate\AUpdate\EasyLinkAdvisor\glog.log Object is locked skipped
C:\Documents and Settings\User\Application Data\GTek\GTUpdate\AUpdate\EasyLinkAdvisor\LinksysAgent.log Object is locked skipped
C:\Documents and Settings\User\Application Data\GTek\GTUpdate\AUpdate\EasyLinkAdvisor\LinksysAgent_GTActions.log Object is locked skipped
C:\Documents and Settings\User\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\User\Local Settings\Application Data\AOL\UserProfiles\All Users\cls\common.cls Object is locked skipped
C:\Documents and Settings\User\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\User\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\User\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\User\Local Settings\Temporary Internet Files\Content.IE5\4P2RK9ER\UserStatusChange[2].html Object is locked skipped
C:\Documents and Settings\User\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\User\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\User\ntuser.dat.LOG Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP543\A0047194.exe Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP543\A0047195.exe Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP543\A0047196.exe Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP543\A0047197.exe Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP543\A0047198.exe Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP543\A0047199.sys Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP543\A0047215.sys Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP543\A0047226.sys Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP543\A0047239.sys Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP543\A0047398.sys Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP543\A0047427.dll Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP543\A0047432.exe Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP544\A0048299.dll Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP544\A0048304.sys Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP544\A0048310.dll Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP544\A0048568.sys Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP544\A0048588.sys Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP544\A0048594.dll Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP544\A0048601.dll Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP544\A0048606.exe Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP544\A0048607.exe Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP544\A0048608.exe Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP544\A0048609.exe Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP544\A0048610.exe Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP544\A0048611.exe Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP544\A0048612.exe Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP544\A0048613.exe Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP544\A0048615.exe Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP544\A0048618.exe/data.rar/keygen.exe Infected: Trojan-Downloader.Win32.LoadAdv.gen skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP544\A0048618.exe/data.rar/crack.exe Infected: Trojan.Win32.Agent.apt skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP544\A0048618.exe/data.rar/serial.exe Infected: Trojan.Win32.Dialer.qn skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP544\A0048618.exe/data.rar/install.exe Infected: Trojan-Downloader.Win32.Agent.bls skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP544\A0048618.exe/data.rar Infected: Trojan-Downloader.Win32.Agent.bls skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP544\A0048618.exe RarSFX: infected - 5 skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP544\A0048655.exe Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP544\A0048660.exe Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP544\A0048704.exe Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP544\A0048705.exe Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP544\A0048716.sys Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP544\A0048732.sys Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP544\A0048746.sys Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP544\A0049746.sys Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP545\A0049764.exe Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP545\A0049783.dll Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP545\A0049784.exe Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP545\A0049788.exe Infected: Trojan-Spy.Win32.Agent.or skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP545\A0049789.exe Infected: Trojan.Win32.Agent.qt skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP545\A0049790.exe Infected: Trojan-Spy.Win32.Agent.or skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP545\A0049791.exe Infected: Trojan.Win32.Dialer.qn skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP545\A0050002.exe Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP545\A0050003.exe Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP545\A0050004.exe Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP545\A0050005.exe Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP545\A0050006.exe Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP545\A0050007.exe Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP545\A0050008.exe Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP545\A0050009.exe Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP545\A0050010.exe Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP545\A0050011.exe Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP545\A0050012.sys Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP546\A0051181.dll Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP553\A0051199.dll Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP559\A0052265.dll Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP559\A0052295.dll Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP559\A0052296.dll Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP559\A0052297.dll Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP559\A0053351.dll Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP561\A0054452.dll Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP563\A0058742.dll Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP563\A0058744.dll Object is locked skipped
C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP569\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\LogFiles\HTTPERR\httperr1.log Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.

found a few things here looks like when it found em it looks like it tripped AVG might have gotten them. looking over it it seems like a bunch of these things are for my world of warcraft addons but i'm not exactly sure

[pskelley]

Thanks for returning the scan report, the vast majority is C:\System Volume Information\_restore, I am sure you know what it is. In case any of those files are infected, we will clean the system restore point and make a new one, first let me see what else Kaspersky found.

C:\System Volume Information\_restore{1157BF2F-BE18-4C90-98B3-D39AEB8A54ED}\RP544\A0048618.exe/data.rar/crack.exe Infected: Trojan.Win32.Agent.apt skipped
This is probably the reason you are getting infected, cracks are dangerous and they are illegal.

System Restore does not know the good files from the bad. In case bad stuff has gotten into your System Restore files, follow the instructions in this link to get clean System Restore files. Turn it off, reboot then turn it back on:
http://www.microsoft.com/windowsxp/using/helpandsupport/learnmore/tips/mcgill1.mspx

Some good information for you:
http://users.telenet.be/bluepatchy/miekiemoes/slowcomputer.html
http://users.telenet.be/bluepatchy/miekiemoes/prevention.html

Here is some great information from Tony Klein, Texruss, ChrisRLG and Grinler to help you stay clean and safe online:
http://forums.spybot.info/showthread.php?t=279
http://russelltexas.com/malware/allclear.htm
http://forum.malwareremoval.com/viewtopic.php?t=14
http://www.bleepingcomputer.com/forums/topict2520.html
http://cybercoyote.org/security/not-admin.shtml

Thanks...pskelley
Safer Networking Forums
http://www.spybot.info/en/donate/index.html
If you are reading this information...thank a teacher,
If you are reading it in English...thank a soldier.

[Carlleetos]

If you are reading this information...thank a teacher,
If you are reading it in English...thank a soldier.

i like that. it's quite ironic too. It just so happens i was a soldier and my fiance is a teacher.

Thank you for telling me about combofix. I ran it on my other pc and just so happens i found a rootkit. here's the log for that one.

"Carl" - 2007-07-07 18:02:44 - ComboFix 07-07-07.3 - Service Pack 2

Rootkit driver pe386 is present. ... attempting disinfection
pe386 ...... driver unloaded successfully.
ADS removed - system32: deleted 61114 bytes in 1 streams.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\DOCUME~1\Carl\Desktop.\internet explorer.lnk


((((((((((((((((((((((((( Files Created from 2007-06-08 to 2007-07-08 )))))))))))))))))))))))))))))))


2007-07-07 18:00 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-07-07 17:44 <DIR> d-------- C:\Program Files\PowerArchiver
2007-06-30 14:14 <DIR> d-------- C:\DOCUME~1\Carl\New Folder
2007-06-30 10:58 <DIR> d-------- C:\WINDOWS\system32\BWKDLogs
2007-06-30 10:58 <DIR> d-------- C:\Program Files\Common Files\Kodak
2007-06-30 10:56 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kodak
2007-06-30 10:55 <DIR> d-------- C:\Program Files\Kodak
2007-06-25 21:59 <DIR> d-------- C:\Program Files\Common Files\ODBC
2007-06-25 11:51 <DIR> d-------- C:\Program Files\iTunes
2007-06-25 11:51 <DIR> d-------- C:\Program Files\iPod
2007-06-25 11:50 <DIR> d-------- C:\Program Files\QuickTime
2007-06-17 23:55 <DIR> d-------- C:\DOCUME~1\Carl\APPLIC~1\CyberLink
2007-06-11 09:04 56,360 --a------ C:\WINDOWS\system32\WBHELP2.DLL


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-06-27 23:48:42 -------- d-----w C:\Program Files\World of Warcraft
2007-06-06 17:21:55 -------- d-----w C:\Program Files\AIM6
2007-06-06 17:21:48 -------- d-----w C:\Program Files\Viewpoint
2007-05-27 01:09:07 -------- d-----w C:\DOCUME~1\Carl\APPLIC~1\Ventrilo
2007-05-27 01:07:31 -------- d-----w C:\Program Files\Ventrilo
2007-05-27 01:07:12 -------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2007-05-16 09:10:19 74,240 ----a-w C:\WINDOWS\system32\3D Wormhole.scr
2007-04-30 07:57:21 561 ----a-w C:\WINDOWS\eReg.dat
2007-04-30 07:56:55 729,088 ----a-w C:\WINDOWS\iun6002.exe
2007-04-19 20:26:00 888,832 ----a-w C:\WINDOWS\system32\nvmobls.dll
2007-04-19 20:26:00 86,016 ----a-w C:\WINDOWS\system32\nvmctray.dll
2007-04-19 20:26:00 81,920 ----a-w C:\WINDOWS\system32\nvwddi.dll
2007-04-19 20:26:00 794,624 ----a-w C:\WINDOWS\system32\nvcplui.exe
2007-04-19 20:26:00 7,700,480 ----a-w C:\WINDOWS\system32\nvcpl.dll
2007-04-19 20:26:00 581,632 ----a-w C:\WINDOWS\system32\nvhwvid.dll
2007-04-19 20:26:00 5,644,288 ----a-w C:\WINDOWS\system32\nvoglnt.dll
2007-04-19 20:26:00 5,619,712 ----a-w C:\WINDOWS\system32\nvdisps.dll
2007-04-19 20:26:00 466,944 ----a-w C:\WINDOWS\system32\nvshell.dll
2007-04-19 20:26:00 45,056 ----a-w C:\WINDOWS\system32\nvmccsrs.dll
2007-04-19 20:26:00 442,368 ----a-w C:\WINDOWS\system32\nvappbar.exe
2007-04-19 20:26:00 425,984 ----a-w C:\WINDOWS\system32\keystone.exe
2007-04-19 20:26:00 4,543,616 ----a-w C:\WINDOWS\system32\nv4_disp.dll
2007-04-19 20:26:00 35,840 ----a-w C:\WINDOWS\system32\nvcodins.dll
2007-04-19 20:26:00 35,840 ----a-w C:\WINDOWS\system32\nvcod.dll
2007-04-19 20:26:00 311,296 ----a-w C:\WINDOWS\system32\nvexpbar.dll
2007-04-19 20:26:00 3,035,136 ----a-w C:\WINDOWS\system32\nvgames.dll
2007-04-19 20:26:00 286,720 ----a-w C:\WINDOWS\system32\nvnt4cpl.dll
2007-04-19 20:26:00 229,376 ----a-w C:\WINDOWS\system32\nvmccs.dll
2007-04-19 20:26:00 212,992 ----a-w C:\WINDOWS\system32\nvapi.dll
2007-04-19 20:26:00 2,924,544 ----a-w C:\WINDOWS\system32\nvvitvs.dll
2007-04-19 20:26:00 188,416 ----a-w C:\WINDOWS\system32\nvmccss.dll
2007-04-19 20:26:00 159,810 ----a-w C:\WINDOWS\system32\nvsvc32.exe
2007-04-19 20:26:00 147,456 ----a-w C:\WINDOWS\system32\nvcolor.exe
2007-04-19 20:26:00 1,703,936 ----a-w C:\WINDOWS\system32\nvwdmcpl.dll
2007-04-19 20:26:00 1,626,112 ----a-w C:\WINDOWS\system32\nwiz.exe
2007-04-19 20:26:00 1,474,560 ----a-w C:\WINDOWS\system32\nview.dll
2007-04-19 20:26:00 1,339,392 ----a-w C:\WINDOWS\system32\nvdspsch.exe
2007-04-19 20:26:00 1,236,992 ----a-w C:\WINDOWS\system32\nvwss.dll
2007-04-19 20:26:00 1,019,904 ----a-w C:\WINDOWS\system32\nvwimg.dll
2007-04-19 20:26:00 1,011,712 ----a-w C:\WINDOWS\system32\nvcpluir.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}]
2006-10-26 11:28 440384 --a------ C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
2005-05-31 02:04 853672 --a------ C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
2007-03-14 03:43 501400 --a------ C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nwiz"="nwiz.exe" [2007-04-19 13:26 C:\WINDOWS\system32\nwiz.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-12-19 12:12 C:\WINDOWS\RTHDCPL.exe]
"Alcmtr"="ALCMTR.EXE" [2005-05-03 19:43 C:\WINDOWS\Alcmtr.exe]
"googletalk"="C:\Program Files\Google\Google Talk\googletalk.exe" [2007-01-01 14:22]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-06-01 16:51]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-06-25 21:55]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="" []
"icasServ"="" []
"NS"="" []
"AlfaCleaner"="" []
"SysOps"="" []
"Dynamic Link Library loader"="" []
"NSystem"="" []
"wingo"="" []
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2007-05-29 18:34]
"EasyLinkAdvisor"="C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" [2006-10-30 12:01]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"MySpaceIM"=C:\Program Files\MySpace\IM\MySpaceIM.exe

*Newly Created Service* - GTNDIS5

Contents of the 'Scheduled Tasks' folder
2007-07-03 17:34:04 C:\WINDOWS\tasks\AppleSoftwareUpdate.job
2007-06-30 17:56:37 C:\WINDOWS\tasks\EasyShare Registration Task.job

**************************************************************************

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-07 18:07:15
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-07 18:07:30
C:\ComboFix-quarantined-files.txt ... 2007-07-07 18:07

--- E O F ---


No need to really troubleshoot that one i scanned it too and it came back fine. just wanted to thank you for all the help. have a good night

[pskelley]

As the problem appears to be resolved this topic has been closed.

If you need it re-opened please send me or a forum staff member a private message (pm) and provide a link to the thread; this applies only to the original topic starter.

Anyone else with similar problems please start a new topic.

Thanks...pskelley